From 5741c8ea2c2b2c105d426e56413643fcc654c0a5 Mon Sep 17 00:00:00 2001
From: jamesread <contact@jread.com>
Date: Thu, 6 Aug 2026 22:24:05 +0100
Subject: [PATCH] feat: Alpha support for search (behind feature gate)

---
 .github/SECURITY_ADVISORY_DUPLICATES.md       |    9 +-
 SECURITY.md                                   |   12 +
 .../pages/action_customization/hidden.adoc    |    2 +-
 .../pages/advanced_configuration/webui.adoc   |   17 +
 .../ROOT/pages/args/input_checklist.adoc      |    2 +
 .../ROOT/pages/args/input_dropdown.adoc       |    2 +
 docs/modules/ROOT/pages/config.adoc           |    1 +
 docs/modules/ROOT/pages/entities/intro.adoc   |    4 +
 docs/modules/ROOT/pages/security/acl.adoc     |   52 +
 .../ROOT/pages/security/design_choices.adoc   |    1 +
 frontend/package-lock.json                    |  499 ++++----
 frontend/package.json                         |    8 +-
 .../gen/olivetin/api/v1/olivetin_pb.d.ts      |  105 ++
 .../gen/olivetin/api/v1/olivetin_pb.js        |  174 +--
 frontend/resources/vue/App.vue                |   41 +-
 frontend/resources/vue/stores/searchIndex.js  |  228 ++++
 .../resources/vue/stores/searchIndex.test.mjs |  197 +++
 frontend/resources/vue/views/EntitiesView.vue |    1 -
 .../resources/vue/views/LogsCalendarView.vue  |    1 -
 frontend/resources/vue/views/LogsListView.vue |    1 -
 proto/olivetin/api/v1/olivetin.proto          |   30 +
 service/gen/olivetin/api/v1/olivetin.pb.go    | 1063 ++++++++++-------
 service/internal/acl/acl.go                   |   10 +
 service/internal/acl/acl_entity_test.go       |   80 ++
 service/internal/api/api.go                   |  131 +-
 service/internal/api/apiActions.go            |   60 +-
 service/internal/api/api_entities_list.go     |   91 +-
 service/internal/api/api_entity_acl_test.go   |  214 ++++
 .../internal/api/api_entity_argument_acl.go   |  152 +++
 .../api/api_entity_argument_acl_test.go       |  164 +++
 .../api/api_init_search_hints_test.go         |  273 +++++
 service/internal/api/api_search_hints.go      |  168 +++
 service/internal/api/api_test.go              |    2 +-
 service/internal/api/dashboard_entities.go    |    5 +
 service/internal/api/dashboards.go            |    9 +
 service/internal/config/config.go             |    7 +
 .../config/entity_argument_choices_test.go    |   40 +
 service/internal/config/sanitize.go           |   40 +
 service/internal/configcheck/rebuild.go       |   55 +-
 service/internal/configcheck/rebuild_test.go  |   58 +
 service/internal/configissues/issue.go        |    3 +-
 service/internal/entities/search_hints.go     |   37 +
 .../internal/entities/search_hints_test.go    |   42 +
 service/internal/executor/arguments.go        |    6 +-
 specs/entity-acls.md                          |   88 ++
 specs/feature-flags.md                        |   74 ++
 46 files changed, 3397 insertions(+), 862 deletions(-)
 create mode 100644 frontend/resources/vue/stores/searchIndex.js
 create mode 100644 frontend/resources/vue/stores/searchIndex.test.mjs
 create mode 100644 service/internal/acl/acl_entity_test.go
 create mode 100644 service/internal/api/api_entity_acl_test.go
 create mode 100644 service/internal/api/api_entity_argument_acl.go
 create mode 100644 service/internal/api/api_entity_argument_acl_test.go
 create mode 100644 service/internal/api/api_init_search_hints_test.go
 create mode 100644 service/internal/api/api_search_hints.go
 create mode 100644 service/internal/config/entity_argument_choices_test.go
 create mode 100644 service/internal/entities/search_hints.go
 create mode 100644 service/internal/entities/search_hints_test.go
 create mode 100644 specs/entity-acls.md
 create mode 100644 specs/feature-flags.md

diff --git a/.github/SECURITY_ADVISORY_DUPLICATES.md b/.github/SECURITY_ADVISORY_DUPLICATES.md
index 22f59fc6..f66b39f6 100644
--- a/.github/SECURITY_ADVISORY_DUPLICATES.md
+++ b/.github/SECURITY_ADVISORY_DUPLICATES.md
@@ -7,10 +7,11 @@ This document lists known duplicate security advisory clusters for [OliveTin/Oli
 ## Triage checklist
 
 1. Search open advisories for the same component and attack path.
-2. Match against clusters below.
-3. If duplicate: close the newer advisory, link to canonical, add reporter to canonical credits.
-4. If unique: accept, patch on a private branch, reassess CVSS with OliveTin context (see SECURITY.md — OliveTin is intentional RCE by design).
-5. Merge fix to `next`, publish advisory, credit reporters in advisory body (not commit message).
+2. Reject if the issue only affects feature-flagged / alpha functionality (`features.*` in config; see [SECURITY.md](../SECURITY.md#feature-flags-alpha--experimental)). Ask the reporter to open a normal GitHub issue instead; do not request a CVE.
+3. Match against clusters below.
+4. If duplicate: close the newer advisory, link to canonical, add reporter to canonical credits.
+5. If unique: accept, patch on a private branch, reassess CVSS with OliveTin context (see SECURITY.md — OliveTin is intentional RCE by design).
+6. Merge fix to `next`, publish advisory, credit reporters in advisory body (not commit message).
 
 ---
 
diff --git a/SECURITY.md b/SECURITY.md
index 78480cb2..67f623a3 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -37,6 +37,17 @@ The following notes might be helpful when reporting a vulnerability:
 * GitHub usernames are how we you will be credited for discoveries reported via GitHub, if using emails we'll ask for your preferred name/handle to credit you with.
 * CVEs will be requested via GitHub Security Advisories when appropriate, but we do not guarantee that all vulnerabilities will receive CVEs, as this is determined on a case-by-case basis.
 
+## Feature flags (alpha / experimental)
+
+OliveTin uses global `features.*` flags in `config.yaml` to ship unfinished or experimental functionality.
+
+* **All feature flags default to off.** Enabling a flag is an explicit operator choice.
+* Functionality behind a feature flag is **alpha / experimental** until the flag is removed or the feature is graduated to a stable, default-on product surface.
+* **Security reports and CVEs are not accepted** for bugs that only affect feature-flagged (alpha) functionality. Prefer filing a normal GitHub issue (or a PR) instead of a security advisory.
+* Reports that affect **stable, non-flagged** code paths remain in scope under this policy, even if a feature flag exists elsewhere in the project.
+
+Operators who enable experimental features should treat them as preview software and avoid relying on them in high-assurance production deployments.
+
 ## Disclosure of how vulnerabilities were found
 
 It is incredibly useful to not just patch security vulnerabilities, but also to understand how they were found. If you are able to share this information, it can help us and the community to better understand potential attack vectors and improve the overall security of the project.
@@ -52,6 +63,7 @@ Maintainers: see [.github/SECURITY_ADVISORY_DUPLICATES.md](.github/SECURITY_ADVI
 Once a vulnerability is reported, the process is;
 
 * Check [.github/SECURITY_ADVISORY_DUPLICATES.md](.github/SECURITY_ADVISORY_DUPLICATES.md) and open advisories for duplicates before accepting.
+* Reject reports that only affect feature-flagged / alpha functionality (see [Feature flags](#feature-flags-alpha--experimental) above); ask the reporter to open a normal issue instead.
 * Accept or reject the report, and communicate with the reporter about next steps.
 * If accepted, patch using a temporary branch, and code review will be requested from the original reporter if they are interested.
 * The severity of the vulnerability will be assessed using CVSS, and the patch will be prioritised accordingly.
diff --git a/docs/modules/ROOT/pages/action_customization/hidden.adoc b/docs/modules/ROOT/pages/action_customization/hidden.adoc
index 2a1d7240..a9b5676d 100644
--- a/docs/modules/ROOT/pages/action_customization/hidden.adoc
+++ b/docs/modules/ROOT/pages/action_customization/hidden.adoc
@@ -12,6 +12,6 @@ actions:
     execOnStartup: true
 ----
 
-IMPORTANT: `hidden` is **not** a security control. It only affects where the action appears in the UI. Users who are allowed to view the action (via `defaultPermissions` or ACLs) can still open its Action Details page, see it in logs, and call APIs such as `GetActionBinding`. To restrict who can see or run an action, use xref:security/acl.adoc[Access Control Lists].
+IMPORTANT: `hidden` is **not** a security control. It only affects where the action appears in the UI. Opening Action Details and calling APIs such as `GetActionBinding` require **view** permission; viewing execution logs requires **logs** permission. Those are separate from whether the action is listed on a dashboard. To restrict who can see or run an action, use xref:security/acl.adoc[Access Control Lists].
 
 You can still place a hidden action on a custom dashboard by title if you want a button for it in a specific place.
diff --git a/docs/modules/ROOT/pages/advanced_configuration/webui.adoc b/docs/modules/ROOT/pages/advanced_configuration/webui.adoc
index a6d1620c..bab8db93 100644
--- a/docs/modules/ROOT/pages/advanced_configuration/webui.adoc
+++ b/docs/modules/ROOT/pages/advanced_configuration/webui.adoc
@@ -143,6 +143,23 @@ You can add custom JavaScript to OliveTin, which will be executed on every page
 
 If the browser blocks your script or network calls with Content Security Policy errors, see xref:security/content_security_policy.adoc[Content Security Policy headers] for how to adjust or disable the CSP sent by OliveTin.
 
+[#header-search]
+== Header search
+
+Header QuickSearch is an **alpha / experimental** opt-in feature. All `features.*` flags default to **off**. Enabling a flag is an explicit operator choice; see the project https://github.com/OliveTin/OliveTin/blob/main/SECURITY.md[security policy] (feature flags are out of scope for CVEs and security advisories until graduated).
+
+Enable it in `config.yaml`:
+
+[source,yaml]
+----
+features:
+  headerSearch: true
+----
+
+When enabled, the header shows a search control that can jump to actions, dashboards, entities, and system navigation pages the user is already allowed to see. Refresh the browser after changing the flag so Init picks up the new value.
+
+Other `features.*` flags follow the same pattern: typed booleans under `features`, default false, exposed on Init for the web UI, and treated as alpha until graduated.
+
 == Custom CSS (with a custom theme)
 
 You can customize OliveTin with themes, but it's also possible to write your on very simple theme that contains just a few CSS rules to change the look and feel of OliveTin. This is very useful if you just want to change the colours of OliveTin, or hide a few elements.
diff --git a/docs/modules/ROOT/pages/args/input_checklist.adoc b/docs/modules/ROOT/pages/args/input_checklist.adoc
index 2e4bc3ff..4e4113f7 100644
--- a/docs/modules/ROOT/pages/args/input_checklist.adoc
+++ b/docs/modules/ROOT/pages/args/input_checklist.adoc
@@ -81,3 +81,5 @@ entities:
 ----
 
 OliveTin expands the template once per entity instance and renders each result as a checkbox. Selected values are still passed as a JSON array string.
+
+IMPORTANT: Like dropdowns, checklist arguments with `entity` must define **exactly one** choice template. Combining `entity` with multiple static choices is rejected on startup.
diff --git a/docs/modules/ROOT/pages/args/input_dropdown.adoc b/docs/modules/ROOT/pages/args/input_dropdown.adoc
index 6179694f..df0cae6b 100644
--- a/docs/modules/ROOT/pages/args/input_dropdown.adoc
+++ b/docs/modules/ROOT/pages/args/input_dropdown.adoc
@@ -62,6 +62,8 @@ This is what it looks like in the web interface;
 
 image::args/dropdown/dropdown-entities.png[]
 
+IMPORTANT: Arguments with `entity` must define **exactly one** choice template. Multiple static choices combined with `entity` is invalid configuration and is rejected on startup.
+
 include::partial$args/reject-null.adoc[]
 
 == Default values
diff --git a/docs/modules/ROOT/pages/config.adoc b/docs/modules/ROOT/pages/config.adoc
index 90030209..663fcfbb 100644
--- a/docs/modules/ROOT/pages/config.adoc
+++ b/docs/modules/ROOT/pages/config.adoc
@@ -60,6 +60,7 @@ All configuration options are covered in the solution sections
 | `defaultIconForBack` | The default icon to use for back (from directories). | `&laquo;` | Requires Restart | -
 | `enableCustomJs` | Enable custom JavaScript. | `false` | Live Reloadable, but refreshing the web browser is required. | xref:advanced_configuration/webui.adoc[Custom JS].
 | `themeName` | The theme to use. | `` | Restart recommended | xref:reference/reference_themes_for_users.adoc[Themes].
+| `features.headerSearch` | Enable header QuickSearch (actions, dashboards, entities). Alpha / experimental; all `features.*` default off. | `false` | Live reloadable; refresh the browser after changing. | xref:advanced_configuration/webui.adoc#header-search[Header search].
 |===
 
 == Security Configuration
diff --git a/docs/modules/ROOT/pages/entities/intro.adoc b/docs/modules/ROOT/pages/entities/intro.adoc
index 9ae46d93..ef4864b5 100644
--- a/docs/modules/ROOT/pages/entities/intro.adoc
+++ b/docs/modules/ROOT/pages/entities/intro.adoc
@@ -15,6 +15,8 @@ Entity field values are **not** sanitized for shell safety. If you substitute th
 
 To control which fields appear in the Entities page table and entity details view, configure `properties` on the entity definition in `config.yaml`. See xref:entities/properties.adoc[Entity properties] for details.
 
+To restrict which users may see an entity type (list, details, search, and related UI), list `acls` on the entity definition. See xref:security/acl.adoc#acls[Access Control Lists] (Entities section). Entity types with no `acls` stay unrestricted.
+
 [source,yaml]
 ----
 entities:
@@ -24,6 +26,8 @@ entities:
   - file: /etc/OliveTin/servers.yaml
     name: server
     icon: ssh
+    acls:
+      - ops
     properties:
       - name: hostname
         title: Hostname
diff --git a/docs/modules/ROOT/pages/security/acl.adoc b/docs/modules/ROOT/pages/security/acl.adoc
index 7a632312..4746cc11 100644
--- a/docs/modules/ROOT/pages/security/acl.adoc
+++ b/docs/modules/ROOT/pages/security/acl.adoc
@@ -160,6 +160,58 @@ In the example above, guests can open **Public tools**, but **Services** is hidd
 
 NOTE: Action `hidden: true` is not part of the ACL model. It only controls dashboard listing. Restrict who can see or run actions with the permissions above; see xref:action_customization/hidden.adoc[Hidden actions].
 
+== ACLs and Entities
+
+Entity types (entries under `entities` in configuration) can also list `acls`. This controls whether users may see that type in the Entities page, entity details, search hints, dashboard entity fieldsets, and entity-driven argument choices.
+
+* If an entity type has **no** `acls` (or an empty list), it is unrestricted — same as root dashboards without ACLs.
+* If an entity type lists one or more `acls`, access uses the same allow-list rules as actions and dashboards: a matching ACL that grants `view`, otherwise `defaultPermissions.view`.
+* Only **view** applies to entity types. `exec`, `logs`, and `kill` remain action permissions.
+* `addToEveryAction` does **not** apply to entities. List the ACL on the entity definition explicitly when you want to restrict it.
+* Access is per **entity type**, not per instance. All instances of a restricted type are hidden together.
+* Entity types loaded at runtime without a matching `entities:` entry stay unrestricted for ACL purposes, but Diagnostics reports a configuration warning.
+* Arguments that expand choices from an entity type must define **exactly one** choice template. Combining `entity` with multiple static choices is invalid and rejected on startup.
+
+Entity-related actions stay dual-gated:
+
+* Viewing the entity type requires entity `view`.
+* Seeing or running a related action still requires that action’s own ACLs (`view` / `exec`).
+* Search and dashboards do not show entity-bound actions for types the user cannot view, even if the action ACL alone would allow it.
+
+[source,yaml]
+.`config.yaml`
+----
+defaultPermissions:
+  view: false
+  exec: false
+
+accessControlLists:
+  - name: ops
+    matchUsergroups:
+      - ops
+    permissions:
+      view: true
+      exec: true
+
+entities:
+  - name: printers
+    file: entities/printers.yaml
+
+  - name: servers
+    file: entities/servers.yaml
+    acls:
+      - ops
+
+actions:
+  - title: Restart {{ name }}
+    entity: servers
+    shell: echo restart
+    acls:
+      - ops
+----
+
+In the example above, guests can see **printers** (unrestricted) but not **servers**. Users in the `ops` group can see **servers** and the Restart actions bound to them.
+
 == ACL Matching - usernames and usergroups.
 
 You can match users based on their usergroup which is the most common, but it is also possible to match based on the user's username.
diff --git a/docs/modules/ROOT/pages/security/design_choices.adoc b/docs/modules/ROOT/pages/security/design_choices.adoc
index e411074a..294c497f 100644
--- a/docs/modules/ROOT/pages/security/design_choices.adoc
+++ b/docs/modules/ROOT/pages/security/design_choices.adoc
@@ -12,6 +12,7 @@ OliveTin has a few design choices that should help it's general security posture
 * OliveTin listens on just 1 open public port by default (1337). The rest of the ports only listen on `localhost` so you don't have to worry about them in your firewall.
 * Standard Linux controls can be used to run OliveTin as non-root, with `sudo` permissions if needed. See the action customization section of these docs for more details.
 * Robust code-scanning, code review, and dependency analysis at build-time. OliveTin uses many linters and code checkers, especially on new pull requests. Out dated dependencies are addressed quickly.
+* Unfinished or experimental surfaces ship behind global `features.*` flags that **default to off**. Those surfaces are alpha until graduated; they are out of scope for security advisories and CVEs (see https://github.com/OliveTin/OliveTin/blob/main/SECURITY.md[SECURITY.md]). Do not enable experimental flags in high-assurance deployments unless you accept that risk.
 
 == Hardening Recommendations
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 8c3ba3b1..de86193c 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -18,11 +18,11 @@
 				"@xterm/addon-web-links": "^0.12.0",
 				"@xterm/xterm": "^6.0.0",
 				"iconify-icon": "^3.0.2",
-				"picocrank": "^1.21.2",
+				"picocrank": "^1.22.1",
 				"standard": "^17.1.2",
 				"unplugin-vue-components": "^32.1.0",
-				"vite": "^8.1.5",
-				"vue": "^3.5.40",
+				"vite": "^8.2.1",
+				"vue": "^3.5.41",
 				"vue-i18n": "^11.4.8",
 				"vue-router": "^5.2.0"
 			},
@@ -133,12 +133,12 @@
 			}
 		},
 		"node_modules/@babel/parser": {
-			"version": "7.29.7",
-			"resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.7.tgz",
-			"integrity": "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==",
+			"version": "7.29.8",
+			"resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.8.tgz",
+			"integrity": "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==",
 			"license": "MIT",
 			"dependencies": {
-				"@babel/types": "^7.29.7"
+				"@babel/types": "^7.29.8"
 			},
 			"bin": {
 				"parser": "bin/babel-parser.js"
@@ -148,9 +148,9 @@
 			}
 		},
 		"node_modules/@babel/types": {
-			"version": "7.29.7",
-			"resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.7.tgz",
-			"integrity": "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==",
+			"version": "7.29.8",
+			"resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz",
+			"integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==",
 			"license": "MIT",
 			"dependencies": {
 				"@babel/helper-string-parser": "^7.29.7",
@@ -409,37 +409,6 @@
 				"postcss-selector-parser": "^7.1.1"
 			}
 		},
-		"node_modules/@emnapi/core": {
-			"version": "1.11.1",
-			"resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz",
-			"integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"@emnapi/wasi-threads": "1.2.2",
-				"tslib": "^2.4.0"
-			}
-		},
-		"node_modules/@emnapi/runtime": {
-			"version": "1.11.1",
-			"resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz",
-			"integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"tslib": "^2.4.0"
-			}
-		},
-		"node_modules/@emnapi/wasi-threads": {
-			"version": "1.2.2",
-			"resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
-			"integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"tslib": "^2.4.0"
-			}
-		},
 		"node_modules/@esbuild/aix-ppc64": {
 			"version": "0.28.1",
 			"resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
@@ -1110,24 +1079,6 @@
 			"dev": true,
 			"license": "MIT"
 		},
-		"node_modules/@napi-rs/wasm-runtime": {
-			"version": "1.1.6",
-			"resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.6.tgz",
-			"integrity": "sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg==",
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"@tybys/wasm-util": "^0.10.3"
-			},
-			"funding": {
-				"type": "github",
-				"url": "https://github.com/sponsors/Brooooooklyn"
-			},
-			"peerDependencies": {
-				"@emnapi/core": "^1.7.1",
-				"@emnapi/runtime": "^1.7.1"
-			}
-		},
 		"node_modules/@nodelib/fs.scandir": {
 			"version": "2.1.5",
 			"resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
@@ -1161,18 +1112,18 @@
 			}
 		},
 		"node_modules/@oxc-project/types": {
-			"version": "0.139.0",
-			"resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.139.0.tgz",
-			"integrity": "sha512-r9gHphtCs+1M7J0pw6Sn/hh/Wpa/iQrOOkrNAlVLF/gHq+/CJmHIWKKUUhdWjcD6CIa8idarspCsASiXCXvFUw==",
+			"version": "0.143.0",
+			"resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.143.0.tgz",
+			"integrity": "sha512-u6JZdLBTLotrNC9Vd6vPssINdzcCzleKAH6EJKImQb7GtYvX5keN2dxkoK44stCc4tffE6QQRtZTXVSzsLUlWA==",
 			"license": "MIT",
 			"funding": {
 				"url": "https://github.com/sponsors/Boshen"
 			}
 		},
 		"node_modules/@rolldown/binding-android-arm64": {
-			"version": "1.1.5",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.5.tgz",
-			"integrity": "sha512-lZg8fqIv2v7FF237bwMgzGZEJvGL79/s5knJ/i6FmsGF4XXlzccZ4jb+TrFIxtSSxFtIpdsgrPZeMk1I9AFcyQ==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.3.tgz",
+			"integrity": "sha512-zrJtHDcaZJ1Fp7xf4hNl+7seH9Cn/N5TwLYkhgXREtBwAd/jaqW3uqeHxpDugJLVICWg4eW44kOQEGJ1r6jCGw==",
 			"cpu": [
 				"arm64"
 			],
@@ -1186,9 +1137,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-darwin-arm64": {
-			"version": "1.1.5",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.5.tgz",
-			"integrity": "sha512-51Bnx9pNiMRKSUNtBfySkNJ9vMU9Hh3I1ozDd6gyPPYzaXCfnptUcEZxXGYFn+ul2dtcMUiqGR1Yai2K10uoTw==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.3.tgz",
+			"integrity": "sha512-ieIiibVCp0tX7TLu2cafoNPv8wJyYi01ekXpbf8q2j7F4rGAhhXb/eQh7ge9DRBY78GwmRQtvjZDux7EDbA8kA==",
 			"cpu": [
 				"arm64"
 			],
@@ -1202,9 +1153,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-darwin-x64": {
-			"version": "1.1.5",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.5.tgz",
-			"integrity": "sha512-Tm+gbfC0aHu1tBA/JvKQh32S0K6YgCHkiAF4/W6xX0K0RmNuc94VeK419dJoE65R5aRxmo+noZQSWrAMF6yb6g==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.3.tgz",
+			"integrity": "sha512-Zh9tCon19eDXJoihx0rqKhMUlMYqzwj3aPsSuHmI4RWZh62dWUL+DJN4C5YQya5TcQBJU/Fe8+rY0jhXTQITqA==",
 			"cpu": [
 				"x64"
 			],
@@ -1218,9 +1169,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-freebsd-x64": {
-			"version": "1.1.5",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.5.tgz",
-			"integrity": "sha512-JMzDKCCXq93YccG5gz3hvOs1oXRKAf0XYpfOS88e+wZrC8Iugj6j68867vrYZkvpDDpKn/KoKORThmchMpF6TA==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.3.tgz",
+			"integrity": "sha512-nGbJWewA1wrXXZiQhjAT5rhibGfns5ZNkDVqxsO6zJ3f3YvpoDNNmGMSbbhLuXKjNScaBJVOAboztAWVespQMg==",
 			"cpu": [
 				"x64"
 			],
@@ -1234,9 +1185,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-			"version": "1.1.5",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.5.tgz",
-			"integrity": "sha512-uML21j2K5TfPGutKxub+M+nLjZIrWjXQ5Grx4lCe/nimTj9B4L63zHpjXLl4y0L3mcm2htEQIb06oCG/szerNw==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.3.tgz",
+			"integrity": "sha512-QNniJr5Kml0kDEB98jiDOJjXNroxIIi0IXIbdYzY26Xt1pVbeP62+KnoIZLwirOymX/0jDk/2gI/bNUv7A7OIw==",
 			"cpu": [
 				"arm"
 			],
@@ -1250,9 +1201,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-arm64-gnu": {
-			"version": "1.1.5",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.5.tgz",
-			"integrity": "sha512-navSiuTMogvnQoZoM/v+l3ZWo50/NTwSHSzheABx/RCnmUPaKwq9qSo4Br2OYRs21+Fz8uFqITZM3H4opOB0/Q==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.3.tgz",
+			"integrity": "sha512-TkqEAcmmvH3I/q4114NB4RVt6241Dao48pF45uLcFGrwAaIn0iITgTAKP/dLjbN0R4buJjGb91+UHSoFmpgIWw==",
 			"cpu": [
 				"arm64"
 			],
@@ -1266,9 +1217,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-arm64-musl": {
-			"version": "1.1.5",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.5.tgz",
-			"integrity": "sha512-lAryqH7IteztmCXQXk0etKj4wBQ7Gx5S6LjKhsgp9zb8I5bsuvU/2llH1hDQcjsFeqIsovMVN339/8pUDDBXxA==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.3.tgz",
+			"integrity": "sha512-NHqjnxpsndf4MPymxteFAWHHfkTL8HjWh1KB7z23ofZ6QO2euONuxDXjat69dKZRALnGypg8k8SsK8vZJoXv1Q==",
 			"cpu": [
 				"arm64"
 			],
@@ -1282,9 +1233,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-ppc64-gnu": {
-			"version": "1.1.5",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.5.tgz",
-			"integrity": "sha512-fsK/sNBnxzBlL4O1JNrZakVQxPspqpED5dLtNsZS9oOKmtSpdNIzxH2kkol5HYTWJN47sE20ztMJPxfZ89qGOg==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.3.tgz",
+			"integrity": "sha512-6tbrbwfz5GB9DQ4Jwo6hy9v+vR31xZlvzZ6n5Xut6Hhx5PvrA9q/HsK8KMaYQp063iqZGXwNvZtYNLD7EM/x0w==",
 			"cpu": [
 				"ppc64"
 			],
@@ -1298,9 +1249,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-s390x-gnu": {
-			"version": "1.1.5",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.5.tgz",
-			"integrity": "sha512-gLYb4BIadlfTOYT5gO503n8zQjXflgzpD0FcyKh0Mzx3rqCZKnHoJWV9xe1KXUJ5lx2JfcSHr/mhzS0PC/McAA==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.3.tgz",
+			"integrity": "sha512-oyuXxXmoZHjXC917IAPFAAv4wWAa0cM9afk8nx1+9/jNNOX1uPf8yDA6p7G0RypOfw/X0PQt5IfoquY1um+zSg==",
 			"cpu": [
 				"s390x"
 			],
@@ -1314,9 +1265,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-x64-gnu": {
-			"version": "1.1.5",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.5.tgz",
-			"integrity": "sha512-FjcpEKUyJygHgs1o50VYNvkt5+7Le/VEdYt0AkRpkL33MnyQfwr8l5mXwMmfmTbyMPr5vJLC+8/Gd9gXnwU1QQ==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.3.tgz",
+			"integrity": "sha512-TytMwF2KVGqP2tgd0I1OY0PAv78dZRAYcF5ssDzjM34SUXCED3uXvSd5+lHoC0bTD6eEdFz7LdQNCO1y0oVk9w==",
 			"cpu": [
 				"x64"
 			],
@@ -1330,9 +1281,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-linux-x64-musl": {
-			"version": "1.1.5",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.5.tgz",
-			"integrity": "sha512-Me+PfPI2TMeOQk0gYWfLQZtTktrmzbr8cDboqX83XKc7UrgAi55gF+2dUkWdxd19n55Essp2yeca+O9N5rBxHg==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.3.tgz",
+			"integrity": "sha512-/E9m3qstrJFVPoULV25mVQblSNExY2+kBsYe4sy0Tn0yOOgJ8wZbZt3KnRbF/XeU2Gl1STKUQnDNTqhIE5MD4A==",
 			"cpu": [
 				"x64"
 			],
@@ -1346,9 +1297,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-openharmony-arm64": {
-			"version": "1.1.5",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.5.tgz",
-			"integrity": "sha512-yc5WrLzXks6zCQfn9Oxr8pORKyl/pF+QjHmW/Qx3qu0oyrrNC+y2JLTU1E2rcWYAmzlnqngWXHQjy51VzW70Vw==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.3.tgz",
+			"integrity": "sha512-Kr0OcsoQI816i6HOl3vFHpd1K0eZyh76zgfj4c1nTyaTsd5r2Mj1lwM4R90y/qaCfmTn9eHy0SKwi98eitRxug==",
 			"cpu": [
 				"arm64"
 			],
@@ -1361,28 +1312,10 @@
 				"node": "^20.19.0 || >=22.12.0"
 			}
 		},
-		"node_modules/@rolldown/binding-wasm32-wasi": {
-			"version": "1.1.5",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.5.tgz",
-			"integrity": "sha512-VbQGPX2b4r48TAMIM2cjgluIM1HYutm4pcTEJsle7iEP7sB1dFqtPLBVbdLAZCxy1txCcPxf4QFf4v8uvltPqA==",
-			"cpu": [
-				"wasm32"
-			],
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"@emnapi/core": "1.11.1",
-				"@emnapi/runtime": "1.11.1",
-				"@napi-rs/wasm-runtime": "^1.1.6"
-			},
-			"engines": {
-				"node": "^20.19.0 || >=22.12.0"
-			}
-		},
 		"node_modules/@rolldown/binding-win32-arm64-msvc": {
-			"version": "1.1.5",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.5.tgz",
-			"integrity": "sha512-gHv82k63z4qpV5+Q1y/12KrK0ltWBukVDI8nZcbT7Tt/ZlOIVwppazneq0F93oDxTo3IgAMEDIoQh3E2n6mVsw==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.3.tgz",
+			"integrity": "sha512-hOtMwTqnME+/gJcH/PCZ0wn0zPUjiWOgkHpxbSJpfGKMezHltx1S7/k1SitzVa7Ww2cqrDDaFbZEhcJZO8o+Jw==",
 			"cpu": [
 				"arm64"
 			],
@@ -1396,9 +1329,9 @@
 			}
 		},
 		"node_modules/@rolldown/binding-win32-x64-msvc": {
-			"version": "1.1.5",
-			"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.5.tgz",
-			"integrity": "sha512-tTZuDBPw85tEN5PQi1pnEBzDy0Z49HtScLAbD5t6hyeU92A95pRWaSMw1GZZi/RwgSgUIl0xrSlXIT/9QzvYSA==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.3.tgz",
+			"integrity": "sha512-ekcqMMkI2PlhYnfzQnB/cEdYUVVJViWvoUyLrbzgDoi3Snfc1mVBwdnc306ufA5ejy8JSPjT2RlW1nQSjW7efg==",
 			"cpu": [
 				"x64"
 			],
@@ -1436,16 +1369,6 @@
 				"url": "https://github.com/sponsors/sindresorhus"
 			}
 		},
-		"node_modules/@tybys/wasm-util": {
-			"version": "0.10.3",
-			"resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
-			"integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==",
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"tslib": "^2.4.0"
-			}
-		},
 		"node_modules/@types/esrecurse": {
 			"version": "4.3.1",
 			"resolved": "https://registry.npmjs.org/@types/esrecurse/-/esrecurse-4.3.1.tgz",
@@ -1524,39 +1447,39 @@
 			}
 		},
 		"node_modules/@vue/compiler-core": {
-			"version": "3.5.40",
-			"resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.5.40.tgz",
-			"integrity": "sha512-39E8IgOhTbVDnoJFMKc2DvYnypcZwUqgUhQkccva/0m6FUwtIKSGV7n1hpVmYcFaoRAwf9pBcwnKlCEsN63ZEQ==",
+			"version": "3.5.41",
+			"resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.5.41.tgz",
+			"integrity": "sha512-q0Xtv/F9w2YO/7htQhtiL+Ev2WCJbe5N2hc+XfgyKkEKqWpSxknmT8QOuGdEKNdjPq0c3F7rNpFkTo3Kfrm7pg==",
 			"license": "MIT",
 			"dependencies": {
-				"@babel/parser": "^7.29.7",
-				"@vue/shared": "3.5.40",
+				"@babel/parser": "^7.29.8",
+				"@vue/shared": "3.5.41",
 				"entities": "^7.0.1",
 				"estree-walker": "^2.0.2",
 				"source-map-js": "^1.2.1"
 			}
 		},
 		"node_modules/@vue/compiler-dom": {
-			"version": "3.5.40",
-			"resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.5.40.tgz",
-			"integrity": "sha512-pwkx4vqlqOspFstrcmzwkKLePVMD3PT65imRzLhanU2V1Fj4K13g6OXjanOyzw3aTAuRk84BOmY8f3rEHqPaVA==",
+			"version": "3.5.41",
+			"resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.5.41.tgz",
+			"integrity": "sha512-oKacVfNglLvGjnS6BXOlGL7EyG2h8X03pqXCjzotRZUaXGjbrTJUnVAQjrCqUnS+lyu31nwQjZY/d817GmCnfw==",
 			"license": "MIT",
 			"dependencies": {
-				"@vue/compiler-core": "3.5.40",
-				"@vue/shared": "3.5.40"
+				"@vue/compiler-core": "3.5.41",
+				"@vue/shared": "3.5.41"
 			}
 		},
 		"node_modules/@vue/compiler-sfc": {
-			"version": "3.5.40",
-			"resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.5.40.tgz",
-			"integrity": "sha512-gIf497P4kpuALcvs5n3AEg1Vdn0pSY4XbjASIfHNYF1/MP3T2Mf2STERTubysBxCRxzJGJYtF/O7vwJrxFB3Vw==",
+			"version": "3.5.41",
+			"resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.5.41.tgz",
+			"integrity": "sha512-XJhip7R2wy6vX3knCxdZN4KracFaZUef58s1KYewqluedHIJaPIVfXoYT7MF1F8nCvv6k8bWWxDC8opMkg1VTQ==",
 			"license": "MIT",
 			"dependencies": {
-				"@babel/parser": "^7.29.7",
-				"@vue/compiler-core": "3.5.40",
-				"@vue/compiler-dom": "3.5.40",
-				"@vue/compiler-ssr": "3.5.40",
-				"@vue/shared": "3.5.40",
+				"@babel/parser": "^7.29.8",
+				"@vue/compiler-core": "3.5.41",
+				"@vue/compiler-dom": "3.5.41",
+				"@vue/compiler-ssr": "3.5.41",
+				"@vue/shared": "3.5.41",
 				"estree-walker": "^2.0.2",
 				"magic-string": "^0.30.21",
 				"postcss": "^8.5.19",
@@ -1564,13 +1487,13 @@
 			}
 		},
 		"node_modules/@vue/compiler-ssr": {
-			"version": "3.5.40",
-			"resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.5.40.tgz",
-			"integrity": "sha512-rrE5xiXG663+vHCHa3J9p2z5OcBRjXmoqenprJxAFQxg5pSshzeBiCE6pu46axapRJ2Adk0YDA2BRZVjiHXnhg==",
+			"version": "3.5.41",
+			"resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.5.41.tgz",
+			"integrity": "sha512-U3v5OejKEGqOI0Wy0+Sz7hGuIFZHA4LSXzrNM3IMIeDyJEBBfTpX26n3SDgToRpP2bLc9FfI2j/kSgcJ8Emq5A==",
 			"license": "MIT",
 			"dependencies": {
-				"@vue/compiler-dom": "3.5.40",
-				"@vue/shared": "3.5.40"
+				"@vue/compiler-dom": "3.5.41",
+				"@vue/shared": "3.5.41"
 			}
 		},
 		"node_modules/@vue/devtools-api": {
@@ -1598,51 +1521,51 @@
 			"license": "MIT"
 		},
 		"node_modules/@vue/reactivity": {
-			"version": "3.5.40",
-			"resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.5.40.tgz",
-			"integrity": "sha512-B7ot9UlUZOi1zbq61/LvE88ZLTV8IlajTdiZTAEiDQgrnIMIZoPr9kGw0Zw46ObW62O9+H/Be3kMbfb7kYPQZA==",
+			"version": "3.5.41",
+			"resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.5.41.tgz",
+			"integrity": "sha512-rznsqKM0np0x18EjzF8x88MpEhdNsffbvFbckLL5+oUKz1BxAImEmO7J1ArRYSyo6aQaVoBDp7jEkT91OOxydA==",
 			"license": "MIT",
 			"dependencies": {
-				"@vue/shared": "3.5.40"
+				"@vue/shared": "3.5.41"
 			}
 		},
 		"node_modules/@vue/runtime-core": {
-			"version": "3.5.40",
-			"resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.5.40.tgz",
-			"integrity": "sha512-KAZLweuZ6uUJPK1PMSQPgBU5gCjgrrfjUhSglmU9NhH+Zjepa8cnwSydPWDWHDwOgY4g3VcZ+PljbiHlURNCbw==",
+			"version": "3.5.41",
+			"resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.5.41.tgz",
+			"integrity": "sha512-Vcry58hiAKwGen9Z1jUZE0feFsNArPCMOImYI8el48A9Idf6DuQYD0U05zZIF2Iad1hGhPSvcbBbAOhNr55fhg==",
 			"license": "MIT",
 			"dependencies": {
-				"@vue/reactivity": "3.5.40",
-				"@vue/shared": "3.5.40"
+				"@vue/reactivity": "3.5.41",
+				"@vue/shared": "3.5.41"
 			}
 		},
 		"node_modules/@vue/runtime-dom": {
-			"version": "3.5.40",
-			"resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.5.40.tgz",
-			"integrity": "sha512-ZfrX8ssZQds900L9pr8AuK05ddnMsR4MPMZr8cPN9GoqoPWcXLhjvvbIA2SMv+7a97sJ1vv9pj/zxK0Cq/eEFQ==",
+			"version": "3.5.41",
+			"resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.5.41.tgz",
+			"integrity": "sha512-3vVBahVBS9+U6cmXBLyb8nE6/yYo4J/CGI9eVFs3KiMc0YHuudwKyShTD65jtJy/L9PUUxNAFu4cj4LiJ0UFbw==",
 			"license": "MIT",
 			"dependencies": {
-				"@vue/reactivity": "3.5.40",
-				"@vue/runtime-core": "3.5.40",
-				"@vue/shared": "3.5.40",
+				"@vue/reactivity": "3.5.41",
+				"@vue/runtime-core": "3.5.41",
+				"@vue/shared": "3.5.41",
 				"csstype": "^3.2.3"
 			}
 		},
 		"node_modules/@vue/server-renderer": {
-			"version": "3.5.40",
-			"resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.5.40.tgz",
-			"integrity": "sha512-XNJym9WpevhTVt1HuwOrCRJ5Q+9z4BjTMrDtjTrvx74SmUll8spNTw6whWJa9mEkO4PKn5TihI/bm/8ds2QVJw==",
+			"version": "3.5.41",
+			"resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.5.41.tgz",
+			"integrity": "sha512-n6hx/pNFfbD6SuyeuMVkvqox8bwf/ET9JlA/kAz/imw8sw++wkqKe2mHX5KutjPpbKE4Z56yTHszoOjGMI9igQ==",
 			"license": "MIT",
 			"dependencies": {
-				"@vue/compiler-ssr": "3.5.40",
-				"@vue/runtime-dom": "3.5.40",
-				"@vue/shared": "3.5.40"
+				"@vue/compiler-ssr": "3.5.41",
+				"@vue/runtime-dom": "3.5.41",
+				"@vue/shared": "3.5.41"
 			}
 		},
 		"node_modules/@vue/shared": {
-			"version": "3.5.40",
-			"resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.5.40.tgz",
-			"integrity": "sha512-WxnBtruIqOoV3rA4jeKDWzrYI5h7Cp4+pjwDi8kWGHz+IslhiN+wguLVVhtv2l8VoU02rzDCVfDjgCl1lNpZVg==",
+			"version": "3.5.41",
+			"resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.5.41.tgz",
+			"integrity": "sha512-IOnwSCma8j+9xJT6b8H0dEYidC80NsYmNMlZxRsukYcSoGaDBohog5hDxzeUXdFeGWFA++vWvxqOmrr96VlqMA==",
 			"license": "MIT"
 		},
 		"node_modules/@xterm/addon-fit": {
@@ -1972,9 +1895,9 @@
 			"license": "ISC"
 		},
 		"node_modules/brace-expansion": {
-			"version": "1.1.16",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
-			"integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+			"version": "1.1.18",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+			"integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
 			"license": "MIT",
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -3230,9 +3153,9 @@
 			"license": "MIT"
 		},
 		"node_modules/fast-uri": {
-			"version": "3.1.4",
-			"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
-			"integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
+			"version": "3.1.5",
+			"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
+			"integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
 			"dev": true,
 			"funding": [
 				{
@@ -3264,9 +3187,9 @@
 			}
 		},
 		"node_modules/femtocrank": {
-			"version": "2.5.0",
-			"resolved": "https://registry.npmjs.org/femtocrank/-/femtocrank-2.5.0.tgz",
-			"integrity": "sha512-plV1HNS/fUzohWJ349kuCBZ3TCfXz7V4F/sY2lVbVWtGXUV+aHxLG6IddAMEf64k2LJ8j0KVrj+nIIKepFaKvg==",
+			"version": "2.5.1",
+			"resolved": "https://registry.npmjs.org/femtocrank/-/femtocrank-2.5.1.tgz",
+			"integrity": "sha512-KdNcLMLBS/qwpXryPMp28OlB5OJjsLFL9d8qFSNkeldi/JQqn4Axuv345R6ZqGV0C5Aem8gkecjxdWrlOAS4pQ==",
 			"license": "AGPL-3.0"
 		},
 		"node_modules/file-entry-cache": {
@@ -4432,9 +4355,9 @@
 			}
 		},
 		"node_modules/lightningcss": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
-			"integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz",
+			"integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==",
 			"license": "MPL-2.0",
 			"dependencies": {
 				"detect-libc": "^2.0.3"
@@ -4447,23 +4370,23 @@
 				"url": "https://opencollective.com/parcel"
 			},
 			"optionalDependencies": {
-				"lightningcss-android-arm64": "1.32.0",
-				"lightningcss-darwin-arm64": "1.32.0",
-				"lightningcss-darwin-x64": "1.32.0",
-				"lightningcss-freebsd-x64": "1.32.0",
-				"lightningcss-linux-arm-gnueabihf": "1.32.0",
-				"lightningcss-linux-arm64-gnu": "1.32.0",
-				"lightningcss-linux-arm64-musl": "1.32.0",
-				"lightningcss-linux-x64-gnu": "1.32.0",
-				"lightningcss-linux-x64-musl": "1.32.0",
-				"lightningcss-win32-arm64-msvc": "1.32.0",
-				"lightningcss-win32-x64-msvc": "1.32.0"
+				"lightningcss-android-arm64": "1.33.0",
+				"lightningcss-darwin-arm64": "1.33.0",
+				"lightningcss-darwin-x64": "1.33.0",
+				"lightningcss-freebsd-x64": "1.33.0",
+				"lightningcss-linux-arm-gnueabihf": "1.33.0",
+				"lightningcss-linux-arm64-gnu": "1.33.0",
+				"lightningcss-linux-arm64-musl": "1.33.0",
+				"lightningcss-linux-x64-gnu": "1.33.0",
+				"lightningcss-linux-x64-musl": "1.33.0",
+				"lightningcss-win32-arm64-msvc": "1.33.0",
+				"lightningcss-win32-x64-msvc": "1.33.0"
 			}
 		},
 		"node_modules/lightningcss-android-arm64": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
-			"integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz",
+			"integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==",
 			"cpu": [
 				"arm64"
 			],
@@ -4481,9 +4404,9 @@
 			}
 		},
 		"node_modules/lightningcss-darwin-arm64": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
-			"integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz",
+			"integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==",
 			"cpu": [
 				"arm64"
 			],
@@ -4501,9 +4424,9 @@
 			}
 		},
 		"node_modules/lightningcss-darwin-x64": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
-			"integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz",
+			"integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==",
 			"cpu": [
 				"x64"
 			],
@@ -4521,9 +4444,9 @@
 			}
 		},
 		"node_modules/lightningcss-freebsd-x64": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
-			"integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz",
+			"integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==",
 			"cpu": [
 				"x64"
 			],
@@ -4541,9 +4464,9 @@
 			}
 		},
 		"node_modules/lightningcss-linux-arm-gnueabihf": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
-			"integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz",
+			"integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==",
 			"cpu": [
 				"arm"
 			],
@@ -4561,9 +4484,9 @@
 			}
 		},
 		"node_modules/lightningcss-linux-arm64-gnu": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
-			"integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz",
+			"integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==",
 			"cpu": [
 				"arm64"
 			],
@@ -4581,9 +4504,9 @@
 			}
 		},
 		"node_modules/lightningcss-linux-arm64-musl": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
-			"integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz",
+			"integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==",
 			"cpu": [
 				"arm64"
 			],
@@ -4601,9 +4524,9 @@
 			}
 		},
 		"node_modules/lightningcss-linux-x64-gnu": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
-			"integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz",
+			"integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==",
 			"cpu": [
 				"x64"
 			],
@@ -4621,9 +4544,9 @@
 			}
 		},
 		"node_modules/lightningcss-linux-x64-musl": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
-			"integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz",
+			"integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==",
 			"cpu": [
 				"x64"
 			],
@@ -4641,9 +4564,9 @@
 			}
 		},
 		"node_modules/lightningcss-win32-arm64-msvc": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
-			"integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz",
+			"integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==",
 			"cpu": [
 				"arm64"
 			],
@@ -4661,9 +4584,9 @@
 			}
 		},
 		"node_modules/lightningcss-win32-x64-msvc": {
-			"version": "1.32.0",
-			"resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
-			"integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
+			"version": "1.33.0",
+			"resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz",
+			"integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==",
 			"cpu": [
 				"x64"
 			],
@@ -4932,9 +4855,9 @@
 			"license": "MIT"
 		},
 		"node_modules/nanoid": {
-			"version": "3.3.16",
-			"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-			"integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+			"version": "3.3.17",
+			"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz",
+			"integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==",
 			"funding": [
 				{
 					"type": "github",
@@ -5272,19 +5195,19 @@
 			"license": "ISC"
 		},
 		"node_modules/picocrank": {
-			"version": "1.21.2",
-			"resolved": "https://registry.npmjs.org/picocrank/-/picocrank-1.21.2.tgz",
-			"integrity": "sha512-bUw6789jyYCTa9waINvYRHmnfgtoMquUidkJx2yhrDCMGbu2O65Qilkl++57yl5JnFeoZOhiPuQTKMPxMQku4A==",
+			"version": "1.22.1",
+			"resolved": "https://registry.npmjs.org/picocrank/-/picocrank-1.22.1.tgz",
+			"integrity": "sha512-sgIngxDkDIWI4OnXt6VVAsh/mgWChOvsj6/EWOMvaE5h3YUoCr89c9R9XKltEtNhTE5su+wH28qjKlsHpYR5Dg==",
 			"license": "ISC",
 			"dependencies": {
-				"@hugeicons/core-free-icons": "^4.2.2",
+				"@hugeicons/core-free-icons": "^4.2.3",
 				"@hugeicons/vue": "^1.0.7",
-				"@vitejs/plugin-vue": "^6.0.7",
-				"femtocrank": "^2.5.0",
+				"@vitejs/plugin-vue": "^6.0.8",
+				"femtocrank": "^2.5.1",
 				"unplugin-vue-components": "^32.1.0",
-				"vite": "^8.1.2",
-				"vue": "^3.5.39",
-				"vue-router": "^5.1.0"
+				"vite": "^8.2.0",
+				"vue": "^3.5.40",
+				"vue-router": "^5.2.0"
 			}
 		},
 		"node_modules/picomatch": {
@@ -5404,9 +5327,9 @@
 			}
 		},
 		"node_modules/postcss": {
-			"version": "8.5.22",
-			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.22.tgz",
-			"integrity": "sha512-KBDEIpLrvpv16pp3K0Fw+UCoZfopFjjgeB+0tA/aaThfEE74kKDLrgg603YvOWJyg3+WYtyq3xYsQWsIyZlPqQ==",
+			"version": "8.5.26",
+			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
+			"integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
 			"funding": [
 				{
 					"type": "opencollective",
@@ -5423,7 +5346,7 @@
 			],
 			"license": "MIT",
 			"dependencies": {
-				"nanoid": "^3.3.16",
+				"nanoid": "^3.3.17",
 				"picocolors": "^1.1.1",
 				"source-map-js": "^1.2.1"
 			},
@@ -5706,12 +5629,12 @@
 			}
 		},
 		"node_modules/rolldown": {
-			"version": "1.1.5",
-			"resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.5.tgz",
-			"integrity": "sha512-t9z29cJjXf/vxQ8dyhCSpt6H6aSwHTk8cT5I3iy6SMXuFpk5mB6PL6XfC8PCwrPTx93udwKUm9HRteAlTGBLiA==",
+			"version": "1.2.3",
+			"resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.3.tgz",
+			"integrity": "sha512-rn9wpmxplLf7NLNyCk9FyWh3FM43DbY8jOzCdEPzH7uflhTftRbCEpqi6Ly2osgoU8OwObtmavMbWLaWy4LX7A==",
 			"license": "MIT",
 			"dependencies": {
-				"@oxc-project/types": "=0.139.0",
+				"@oxc-project/types": "=0.143.0",
 				"@rolldown/pluginutils": "^1.0.0"
 			},
 			"bin": {
@@ -5721,21 +5644,20 @@
 				"node": "^20.19.0 || >=22.12.0"
 			},
 			"optionalDependencies": {
-				"@rolldown/binding-android-arm64": "1.1.5",
-				"@rolldown/binding-darwin-arm64": "1.1.5",
-				"@rolldown/binding-darwin-x64": "1.1.5",
-				"@rolldown/binding-freebsd-x64": "1.1.5",
-				"@rolldown/binding-linux-arm-gnueabihf": "1.1.5",
-				"@rolldown/binding-linux-arm64-gnu": "1.1.5",
-				"@rolldown/binding-linux-arm64-musl": "1.1.5",
-				"@rolldown/binding-linux-ppc64-gnu": "1.1.5",
-				"@rolldown/binding-linux-s390x-gnu": "1.1.5",
-				"@rolldown/binding-linux-x64-gnu": "1.1.5",
-				"@rolldown/binding-linux-x64-musl": "1.1.5",
-				"@rolldown/binding-openharmony-arm64": "1.1.5",
-				"@rolldown/binding-wasm32-wasi": "1.1.5",
-				"@rolldown/binding-win32-arm64-msvc": "1.1.5",
-				"@rolldown/binding-win32-x64-msvc": "1.1.5"
+				"@rolldown/binding-android-arm64": "1.2.3",
+				"@rolldown/binding-darwin-arm64": "1.2.3",
+				"@rolldown/binding-darwin-x64": "1.2.3",
+				"@rolldown/binding-freebsd-x64": "1.2.3",
+				"@rolldown/binding-linux-arm-gnueabihf": "1.2.3",
+				"@rolldown/binding-linux-arm64-gnu": "1.2.3",
+				"@rolldown/binding-linux-arm64-musl": "1.2.3",
+				"@rolldown/binding-linux-ppc64-gnu": "1.2.3",
+				"@rolldown/binding-linux-s390x-gnu": "1.2.3",
+				"@rolldown/binding-linux-x64-gnu": "1.2.3",
+				"@rolldown/binding-linux-x64-musl": "1.2.3",
+				"@rolldown/binding-openharmony-arm64": "1.2.3",
+				"@rolldown/binding-win32-arm64-msvc": "1.2.3",
+				"@rolldown/binding-win32-x64-msvc": "1.2.3"
 			}
 		},
 		"node_modules/run-parallel": {
@@ -6611,13 +6533,6 @@
 				"strip-bom": "^3.0.0"
 			}
 		},
-		"node_modules/tslib": {
-			"version": "2.8.1",
-			"resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-			"integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-			"license": "0BSD",
-			"optional": true
-		},
 		"node_modules/type-check": {
 			"version": "0.4.0",
 			"resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
@@ -6916,15 +6831,15 @@
 			}
 		},
 		"node_modules/vite": {
-			"version": "8.1.5",
-			"resolved": "https://registry.npmjs.org/vite/-/vite-8.1.5.tgz",
-			"integrity": "sha512-7ULLwsCdYx/nRyrpiEwvqb5TFHrMVZyBt+rg/OAXT7rgj/z+DtTDyKFeLAdDkubDVDKD8jOsndmy7m55XcfUsw==",
+			"version": "8.2.1",
+			"resolved": "https://registry.npmjs.org/vite/-/vite-8.2.1.tgz",
+			"integrity": "sha512-EU/eS7BH3XROHh2YnBefjM6DBKA6ZeMZEYQbj7NLWg5wHYlhB8B/Mayd5XsgWq+NFYccDOTemRpdETWR6Ka/lw==",
 			"license": "MIT",
 			"dependencies": {
-				"lightningcss": "^1.32.0",
+				"lightningcss": "^1.33.0",
 				"picomatch": "^4.0.5",
-				"postcss": "^8.5.17",
-				"rolldown": "~1.1.5",
+				"postcss": "^8.5.25",
+				"rolldown": "~1.2.1",
 				"tinyglobby": "^0.2.17"
 			},
 			"bin": {
@@ -6941,7 +6856,7 @@
 			},
 			"peerDependencies": {
 				"@types/node": "^20.19.0 || >=22.12.0",
-				"@vitejs/devtools": "^0.3.0",
+				"@vitejs/devtools": "^0.4.0",
 				"esbuild": "^0.27.0 || ^0.28.0",
 				"jiti": ">=1.21.0",
 				"less": "^4.0.0",
@@ -7005,16 +6920,16 @@
 			}
 		},
 		"node_modules/vue": {
-			"version": "3.5.40",
-			"resolved": "https://registry.npmjs.org/vue/-/vue-3.5.40.tgz",
-			"integrity": "sha512-+8PJ4SJXdn/cHGImF4CKdxlWHIN5Dkt7DoufRREM6h6uVCx2m7QxgcEQmmzyOK8A9mcafg7sFbJFYsdFVubTig==",
+			"version": "3.5.41",
+			"resolved": "https://registry.npmjs.org/vue/-/vue-3.5.41.tgz",
+			"integrity": "sha512-2laE0p+aK+/AOPG/XL/WepOs/GlK755LJ1XECi9kDUrz1FKNw8rb2Xzlw9JS1rqEV55nb0ttsKxVlTCcd+R5cg==",
 			"license": "MIT",
 			"dependencies": {
-				"@vue/compiler-dom": "3.5.40",
-				"@vue/compiler-sfc": "3.5.40",
-				"@vue/runtime-dom": "3.5.40",
-				"@vue/server-renderer": "3.5.40",
-				"@vue/shared": "3.5.40"
+				"@vue/compiler-dom": "3.5.41",
+				"@vue/compiler-sfc": "3.5.41",
+				"@vue/runtime-dom": "3.5.41",
+				"@vue/server-renderer": "3.5.41",
+				"@vue/shared": "3.5.41"
 			},
 			"peerDependencies": {
 				"typescript": "*"
diff --git a/frontend/package.json b/frontend/package.json
index a0b90e78..ba26478f 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -11,7 +11,7 @@
 		"stylelint-config-standard": "^40.0.0"
 	},
 	"scripts": {
-		"test": "node --test resources/vue/components/*.test.mjs resources/vue/utils/*.test.mjs"
+		"test": "node --test resources/vue/components/*.test.mjs resources/vue/utils/*.test.mjs resources/vue/stores/*.test.mjs"
 	},
 	"author": "",
 	"parcelIgnore": [
@@ -32,11 +32,11 @@
 		"@xterm/addon-web-links": "^0.12.0",
 		"@xterm/xterm": "^6.0.0",
 		"iconify-icon": "^3.0.2",
-		"picocrank": "^1.21.2",
+		"picocrank": "^1.22.1",
 		"standard": "^17.1.2",
 		"unplugin-vue-components": "^32.1.0",
-		"vite": "^8.1.5",
-		"vue": "^3.5.40",
+		"vite": "^8.2.1",
+		"vue": "^3.5.41",
 		"vue-i18n": "^11.4.8",
 		"vue-router": "^5.2.0"
 	},
diff --git a/frontend/resources/scripts/gen/olivetin/api/v1/olivetin_pb.d.ts b/frontend/resources/scripts/gen/olivetin/api/v1/olivetin_pb.d.ts
index acc3f89d..19e4560a 100644
--- a/frontend/resources/scripts/gen/olivetin/api/v1/olivetin_pb.d.ts
+++ b/frontend/resources/scripts/gen/olivetin/api/v1/olivetin_pb.d.ts
@@ -335,6 +335,77 @@ export declare type GetDashboardResponse = Message<"olivetin.api.v1.GetDashboard
  */
 export declare const GetDashboardResponseSchema: GenMessage<GetDashboardResponse>;
 
+/**
+ * @generated from message olivetin.api.v1.SearchHints
+ */
+export declare type SearchHints = Message<"olivetin.api.v1.SearchHints"> & {
+  /**
+   * Lightweight titles for client search only. Omits fields, icons, and payloads.
+   * Dashboards are not included; clients index Init.root_dashboard_entries instead.
+   *
+   * @generated from field: repeated olivetin.api.v1.EntitySearchHint entities = 1;
+   */
+  entities: EntitySearchHint[];
+
+  /**
+   * @generated from field: repeated olivetin.api.v1.ActionSearchHint actions = 2;
+   */
+  actions: ActionSearchHint[];
+};
+
+/**
+ * Describes the message olivetin.api.v1.SearchHints.
+ * Use `create(SearchHintsSchema)` to create a new message.
+ */
+export declare const SearchHintsSchema: GenMessage<SearchHints>;
+
+/**
+ * @generated from message olivetin.api.v1.EntitySearchHint
+ */
+export declare type EntitySearchHint = Message<"olivetin.api.v1.EntitySearchHint"> & {
+  /**
+   * @generated from field: string title = 1;
+   */
+  title: string;
+
+  /**
+   * @generated from field: string type = 2;
+   */
+  type: string;
+
+  /**
+   * @generated from field: string unique_key = 3;
+   */
+  uniqueKey: string;
+};
+
+/**
+ * Describes the message olivetin.api.v1.EntitySearchHint.
+ * Use `create(EntitySearchHintSchema)` to create a new message.
+ */
+export declare const EntitySearchHintSchema: GenMessage<EntitySearchHint>;
+
+/**
+ * @generated from message olivetin.api.v1.ActionSearchHint
+ */
+export declare type ActionSearchHint = Message<"olivetin.api.v1.ActionSearchHint"> & {
+  /**
+   * @generated from field: string title = 1;
+   */
+  title: string;
+
+  /**
+   * @generated from field: string binding_id = 2;
+   */
+  bindingId: string;
+};
+
+/**
+ * Describes the message olivetin.api.v1.ActionSearchHint.
+ * Use `create(ActionSearchHintSchema)` to create a new message.
+ */
+export declare const ActionSearchHintSchema: GenMessage<ActionSearchHint>;
+
 /**
  * @generated from message olivetin.api.v1.EffectivePolicy
  */
@@ -361,6 +432,25 @@ export declare type EffectivePolicy = Message<"olivetin.api.v1.EffectivePolicy">
  */
 export declare const EffectivePolicySchema: GenMessage<EffectivePolicy>;
 
+/**
+ * Features are global opt-in flags from config.yaml features.*.
+ * All flags default to false and gate alpha / experimental functionality.
+ *
+ * @generated from message olivetin.api.v1.Features
+ */
+export declare type Features = Message<"olivetin.api.v1.Features"> & {
+  /**
+   * @generated from field: bool header_search = 1;
+   */
+  headerSearch: boolean;
+};
+
+/**
+ * Describes the message olivetin.api.v1.Features.
+ * Use `create(FeaturesSchema)` to create a new message.
+ */
+export declare const FeaturesSchema: GenMessage<Features>;
+
 /**
  * @generated from message olivetin.api.v1.GetDashboardRequest
  */
@@ -1895,6 +1985,21 @@ export declare type InitResponse = Message<"olivetin.api.v1.InitResponse"> & {
    * @generated from field: repeated olivetin.api.v1.RootDashboard root_dashboard_entries = 27;
    */
   rootDashboardEntries: RootDashboard[];
+
+  /**
+   * Client-side search index hints. Omitted when login is required
+   * or features.header_search is false.
+   * Entities match GetEntities visibility; actions use view ACL.
+   * Dashboards are indexed client-side from root_dashboard_entries.
+   *
+   * @generated from field: olivetin.api.v1.SearchHints search_hints = 28;
+   */
+  searchHints?: SearchHints | undefined;
+
+  /**
+   * @generated from field: olivetin.api.v1.Features features = 29;
+   */
+  features?: Features | undefined;
 };
 
 /**
diff --git a/frontend/resources/scripts/gen/olivetin/api/v1/olivetin_pb.js b/frontend/resources/scripts/gen/olivetin/api/v1/olivetin_pb.js
index 5f363b24..aa253acf 100644
--- a/frontend/resources/scripts/gen/olivetin/api/v1/olivetin_pb.js
+++ b/frontend/resources/scripts/gen/olivetin/api/v1/olivetin_pb.js
@@ -8,7 +8,7 @@ import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2
  * Describes the file olivetin/api/v1/olivetin.proto.
  */
 export const file_olivetin_api_v1_olivetin = /*@__PURE__*/
-  fileDesc("Ch5vbGl2ZXRpbi9hcGkvdjEvb2xpdmV0aW4ucHJvdG8SD29saXZldGluLmFwaS52MSLGBAoGQWN0aW9uEhIKCmJpbmRpbmdfaWQYASABKAkSDQoFdGl0bGUYAiABKAkSDAoEaWNvbhgDIAEoCRIQCghjYW5fZXhlYxgEIAEoCBIyCglhcmd1bWVudHMYBSADKAsyHy5vbGl2ZXRpbi5hcGkudjEuQWN0aW9uQXJndW1lbnQSFgoOcG9wdXBfb25fc3RhcnQYBiABKAkSDQoFb3JkZXIYByABKAUSDwoHdGltZW91dBgIIAEoBRIjChtkYXRldGltZV9yYXRlX2xpbWl0X2V4cGlyZXMYCSABKAkSFwoPZXhlY19vbl9zdGFydHVwGAogASgIEhQKDGV4ZWNfb25fY3JvbhgLIAMoCRIjChtleGVjX29uX2ZpbGVfY3JlYXRlZF9pbl9kaXIYDCADKAkSIwobZXhlY19vbl9maWxlX2NoYW5nZWRfaW5fZGlyGA0gAygJEh0KFWV4ZWNfb25fY2FsZW5kYXJfZmlsZRgOIAEoCRJAChBleGVjX29uX3dlYmhvb2tzGA8gAygLMiYub2xpdmV0aW4uYXBpLnYxLkFjdGlvbldlYmhvb2tFeGVjSGludBIVCg1qdXN0aWZpY2F0aW9uGBQgASgJEhwKFGhhc19ydW5uaW5nX2luc3RhbmNlGBEgASgIEhsKE2hhc19xdWV1ZWRfaW5zdGFuY2UYEiABKAgSNgoGZ3JvdXBzGBMgAygLMiYub2xpdmV0aW4uYXBpLnYxLkFjdGlvbkdyb3VwTWVtYmVyc2hpcEoECBAQESJRChVBY3Rpb25Hcm91cE1lbWJlcnNoaXASDAoEbmFtZRgBIAEoCRIWCg5tYXhfY29uY3VycmVudBgCIAEoBRISCgpxdWV1ZV9zaXplGAMgASgFIsMCChVBY3Rpb25XZWJob29rRXhlY0hpbnQSEAoIdGVtcGxhdGUYASABKAkSEgoKbWF0Y2hfcGF0aBgCIAEoCRJPCg1tYXRjaF9oZWFkZXJzGAMgAygLMjgub2xpdmV0aW4uYXBpLnYxLkFjdGlvbldlYmhvb2tFeGVjSGludC5NYXRjaEhlYWRlcnNFbnRyeRJLCgttYXRjaF9xdWVyeRgEIAMoCzI2Lm9saXZldGluLmFwaS52MS5BY3Rpb25XZWJob29rRXhlY0hpbnQuTWF0Y2hRdWVyeUVudHJ5GjMKEU1hdGNoSGVhZGVyc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEaMQoPTWF0Y2hRdWVyeUVudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiuwIKDkFjdGlvbkFyZ3VtZW50EgwKBG5hbWUYASABKAkSDQoFdGl0bGUYAiABKAkSDAoEdHlwZRgDIAEoCRIVCg1kZWZhdWx0X3ZhbHVlGAQgASgJEjYKB2Nob2ljZXMYBSADKAsyJS5vbGl2ZXRpbi5hcGkudjEuQWN0aW9uQXJndW1lbnRDaG9pY2USEwoLZGVzY3JpcHRpb24YBiABKAkSRQoLc3VnZ2VzdGlvbnMYByADKAsyMC5vbGl2ZXRpbi5hcGkudjEuQWN0aW9uQXJndW1lbnQuU3VnZ2VzdGlvbnNFbnRyeRIfChdzdWdnZXN0aW9uc19icm93c2VyX2tleRgIIAEoCRoyChBTdWdnZXN0aW9uc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiNAoUQWN0aW9uQXJndW1lbnRDaG9pY2USDQoFdmFsdWUYASABKAkSDQoFdGl0bGUYAiABKAki1AEKE0VudGl0eVJlbGF0ZWRBY3Rpb24SJwoGYWN0aW9uGAEgASgLMhcub2xpdmV0aW4uYXBpLnYxLkFjdGlvbhJZChNwcmVmaWxsZWRfYXJndW1lbnRzGAIgAygLMjwub2xpdmV0aW4uYXBpLnYxLkVudGl0eVJlbGF0ZWRBY3Rpb24uUHJlZmlsbGVkQXJndW1lbnRzRW50cnkaOQoXUHJlZmlsbGVkQXJndW1lbnRzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASL/AQoGRW50aXR5Eg0KBXRpdGxlGAEgASgJEhIKCnVuaXF1ZV9rZXkYAiABKAkSDAoEdHlwZRgDIAEoCRITCgtkaXJlY3RvcmllcxgEIAMoCRIzCgZmaWVsZHMYBSADKAsyIy5vbGl2ZXRpbi5hcGkudjEuRW50aXR5LkZpZWxkc0VudHJ5Ej0KD3JlbGF0ZWRfYWN0aW9ucxgGIAMoCzIkLm9saXZldGluLmFwaS52MS5FbnRpdHlSZWxhdGVkQWN0aW9uEgwKBGljb24YByABKAkaLQoLRmllbGRzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASJUChRHZXREYXNoYm9hcmRSZXNwb25zZRINCgV0aXRsZRgBIAEoCRItCglkYXNoYm9hcmQYBCABKAsyGi5vbGl2ZXRpbi5hcGkudjEuRGFzaGJvYXJkIl8KD0VmZmVjdGl2ZVBvbGljeRIYChBzaG93X2RpYWdub3N0aWNzGAEgASgIEhUKDXNob3dfbG9nX2xpc3QYAiABKAgSGwoTc2hvd192ZXJzaW9uX251bWJlchgDIAEoCCJNChNHZXREYXNoYm9hcmRSZXF1ZXN0Eg0KBXRpdGxlGAEgASgJEhMKC2VudGl0eV90eXBlGAIgASgJEhIKCmVudGl0eV9rZXkYAyABKAkiUQoJRGFzaGJvYXJkEg0KBXRpdGxlGAEgASgJEjUKCGNvbnRlbnRzGAIgAygLMiMub2xpdmV0aW4uYXBpLnYxLkRhc2hib2FyZENvbXBvbmVudCLbAQoSRGFzaGJvYXJkQ29tcG9uZW50Eg0KBXRpdGxlGAEgASgJEgwKBHR5cGUYAiABKAkSNQoIY29udGVudHMYAyADKAsyIy5vbGl2ZXRpbi5hcGkudjEuRGFzaGJvYXJkQ29tcG9uZW50EgwKBGljb24YBCABKAkSEQoJY3NzX2NsYXNzGAUgASgJEicKBmFjdGlvbhgGIAEoCzIXLm9saXZldGluLmFwaS52MS5BY3Rpb24SEwoLZW50aXR5X3R5cGUYByABKAkSEgoKZW50aXR5X2tleRgIIAEoCSKUAQoSU3RhcnRBY3Rpb25SZXF1ZXN0EhIKCmJpbmRpbmdfaWQYASABKAkSNwoJYXJndW1lbnRzGAIgAygLMiQub2xpdmV0aW4uYXBpLnYxLlN0YXJ0QWN0aW9uQXJndW1lbnQSGgoSdW5pcXVlX3RyYWNraW5nX2lkGAMgASgJEhUKDWp1c3RpZmljYXRpb24YBCABKAkiMgoTU3RhcnRBY3Rpb25Bcmd1bWVudBIMCgRuYW1lGAEgASgJEg0KBXZhbHVlGAIgASgJIjQKE1N0YXJ0QWN0aW9uUmVzcG9uc2USHQoVZXhlY3V0aW9uX3RyYWNraW5nX2lkGAIgASgJIn4KGVN0YXJ0QWN0aW9uQW5kV2FpdFJlcXVlc3QSEQoJYWN0aW9uX2lkGAEgASgJEjcKCWFyZ3VtZW50cxgCIAMoCzIkLm9saXZldGluLmFwaS52MS5TdGFydEFjdGlvbkFyZ3VtZW50EhUKDWp1c3RpZmljYXRpb24YAyABKAkiSgoaU3RhcnRBY3Rpb25BbmRXYWl0UmVzcG9uc2USLAoJbG9nX2VudHJ5GAEgASgLMhkub2xpdmV0aW4uYXBpLnYxLkxvZ0VudHJ5IiwKF1N0YXJ0QWN0aW9uQnlHZXRSZXF1ZXN0EhEKCWFjdGlvbl9pZBgBIAEoCSI5ChhTdGFydEFjdGlvbkJ5R2V0UmVzcG9uc2USHQoVZXhlY3V0aW9uX3RyYWNraW5nX2lkGAIgASgJIjMKHlN0YXJ0QWN0aW9uQnlHZXRBbmRXYWl0UmVxdWVzdBIRCglhY3Rpb25faWQYASABKAkiTwofU3RhcnRBY3Rpb25CeUdldEFuZFdhaXRSZXNwb25zZRIsCglsb2dfZW50cnkYASABKAsyGS5vbGl2ZXRpbi5hcGkudjEuTG9nRW50cnkiXgoOR2V0TG9nc1JlcXVlc3QSFAoMc3RhcnRfb2Zmc2V0GAEgASgDEhMKC2RhdGVfZmlsdGVyGAIgASgJEhEKCXBhZ2Vfc2l6ZRgDIAEoAxIOCgZmaWx0ZXIYBCABKAkilAQKCExvZ0VudHJ5EhgKEGRhdGV0aW1lX3N0YXJ0ZWQYASABKAkSFAoMYWN0aW9uX3RpdGxlGAIgASgJEg4KBm91dHB1dBgDIAEoCRIRCgl0aW1lZF9vdXQYBSABKAgSEQoJZXhpdF9jb2RlGAYgASgFEgwKBHVzZXIYByABKAkSEgoKdXNlcl9jbGFzcxgIIAEoCRITCgthY3Rpb25faWNvbhgJIAEoCRIMCgR0YWdzGAogAygJEh0KFWV4ZWN1dGlvbl90cmFja2luZ19pZBgLIAEoCRIZChFkYXRldGltZV9maW5pc2hlZBgMIAEoCRIZChFleGVjdXRpb25fc3RhcnRlZBgOIAEoCBIaChJleGVjdXRpb25fZmluaXNoZWQYDyABKAgSDwoHYmxvY2tlZBgQIAEoCBIWCg5kYXRldGltZV9pbmRleBgRIAEoAxIQCghjYW5fa2lsbBgSIAEoCBIjChtkYXRldGltZV9yYXRlX2xpbWl0X2V4cGlyZXMYEyABKAkSEgoKYmluZGluZ19pZBgUIAEoCRIOCgZxdWV1ZWQYFSABKAgSGAoQcXVldWVkX2Zvcl9ncm91cBgWIAEoCRIVCg1qdXN0aWZpY2F0aW9uGBcgASgJEjcKCWFyZ3VtZW50cxgYIAMoCzIkLm9saXZldGluLmFwaS52MS5TdGFydEFjdGlvbkFyZ3VtZW50IpEBCg9HZXRMb2dzUmVzcG9uc2USJwoEbG9ncxgBIAMoCzIZLm9saXZldGluLmFwaS52MS5Mb2dFbnRyeRIXCg9jb3VudF9yZW1haW5pbmcYAiABKAMSEQoJcGFnZV9zaXplGAMgASgDEhMKC3RvdGFsX2NvdW50GAQgASgDEhQKDHN0YXJ0X29mZnNldBgFIAEoAyI/ChRHZXRBY3Rpb25Mb2dzUmVxdWVzdBIRCglhY3Rpb25faWQYASABKAkSFAoMc3RhcnRfb2Zmc2V0GAIgASgDIpcBChVHZXRBY3Rpb25Mb2dzUmVzcG9uc2USJwoEbG9ncxgBIAMoCzIZLm9saXZldGluLmFwaS52MS5Mb2dFbnRyeRIXCg9jb3VudF9yZW1haW5pbmcYAiABKAMSEQoJcGFnZV9zaXplGAMgASgDEhMKC3RvdGFsX2NvdW50GAQgASgDEhQKDHN0YXJ0X29mZnNldBgFIAEoAyIaChhHZXRFeGVjdXRpb25RdWV1ZVJlcXVlc3QixgEKFEV4ZWN1dGlvblF1ZXVlQWN0aW9uEhIKCmJpbmRpbmdfaWQYASABKAkSFAoMYWN0aW9uX3RpdGxlGAIgASgJEhMKC2FjdGlvbl9pY29uGAMgASgJEhYKDm1heF9jb25jdXJyZW50GAQgASgFEhQKDGFjdGl2ZV9jb3VudBgFIAEoBRIVCg1lbnRpdHlfcHJlZml4GAYgASgJEioKB2VudHJpZXMYByADKAsyGS5vbGl2ZXRpbi5hcGkudjEuTG9nRW50cnkiwQEKE0V4ZWN1dGlvblF1ZXVlR3JvdXASDAoEbmFtZRgBIAEoCRIMCgRpY29uGAIgASgJEhYKDm1heF9jb25jdXJyZW50GAMgASgFEhQKDGFjdGl2ZV9jb3VudBgEIAEoBRI2CgdhY3Rpb25zGAUgAygLMiUub2xpdmV0aW4uYXBpLnYxLkV4ZWN1dGlvblF1ZXVlQWN0aW9uEhQKDHF1ZXVlZF9jb3VudBgGIAEoBRISCgpxdWV1ZV9zaXplGAcgASgFImcKGUdldEV4ZWN1dGlvblF1ZXVlUmVzcG9uc2USNAoGZ3JvdXBzGAEgAygLMiQub2xpdmV0aW4uYXBpLnYxLkV4ZWN1dGlvblF1ZXVlR3JvdXASFAoMdG90YWxfYWN0aXZlGAIgASgFImUKG1ZhbGlkYXRlQXJndW1lbnRUeXBlUmVxdWVzdBINCgV2YWx1ZRgBIAEoCRIMCgR0eXBlGAIgASgJEhIKCmJpbmRpbmdfaWQYAyABKAkSFQoNYXJndW1lbnRfbmFtZRgEIAEoCSJCChxWYWxpZGF0ZUFyZ3VtZW50VHlwZVJlc3BvbnNlEg0KBXZhbGlkGAEgASgIEhMKC2Rlc2NyaXB0aW9uGAIgASgJIjYKFVdhdGNoRXhlY3V0aW9uUmVxdWVzdBIdChVleGVjdXRpb25fdHJhY2tpbmdfaWQYASABKAkiJgoUV2F0Y2hFeGVjdXRpb25VcGRhdGUSDgoGdXBkYXRlGAEgASgJIkoKFkV4ZWN1dGlvblN0YXR1c1JlcXVlc3QSHQoVZXhlY3V0aW9uX3RyYWNraW5nX2lkGAEgASgJEhEKCWFjdGlvbl9pZBgCIAEoCSJhChlEYXNoYm9hcmROYXZpZ2F0aW9uVGFyZ2V0Eg0KBXRpdGxlGAEgASgJEhMKC2VudGl0eV90eXBlGAIgASgJEhIKCmVudGl0eV9rZXkYAyABKAkSDAoEcGF0aBgEIAEoCSKPAQoXRXhlY3V0aW9uU3RhdHVzUmVzcG9uc2USLAoJbG9nX2VudHJ5GAEgASgLMhkub2xpdmV0aW4uYXBpLnYxLkxvZ0VudHJ5EkYKEmJhY2tfdG9fZGFzaGJvYXJkcxgCIAMoCzIqLm9saXZldGluLmFwaS52MS5EYXNoYm9hcmROYXZpZ2F0aW9uVGFyZ2V0Ig8KDVdob0FtSVJlcXVlc3QibAoOV2hvQW1JUmVzcG9uc2USGgoSYXV0aGVudGljYXRlZF91c2VyGAEgASgJEhEKCXVzZXJncm91cBgCIAEoCRIQCghwcm92aWRlchgDIAEoCRIMCgRhY2xzGAQgAygJEgsKA3NpZBgFIAEoCSIaChhTZXJ2ZXJEaWFnbm9zdGljc1JlcXVlc3QiKgoZU2VydmVyRGlhZ25vc3RpY3NSZXNwb25zZRINCgVhbGVydBgBIAEoCSIRCg9EdW1wVmFyc1JlcXVlc3QilQEKEER1bXBWYXJzUmVzcG9uc2USDQoFYWxlcnQYASABKAkSQQoIY29udGVudHMYAiADKAsyLy5vbGl2ZXRpbi5hcGkudjEuRHVtcFZhcnNSZXNwb25zZS5Db250ZW50c0VudHJ5Gi8KDUNvbnRlbnRzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASI7CgxEZWJ1Z0JpbmRpbmcSFAoMYWN0aW9uX3RpdGxlGAEgASgJEhUKDWVudGl0eV9wcmVmaXgYAiABKAkiHgocRHVtcFB1YmxpY0lkQWN0aW9uTWFwUmVxdWVzdCLOAQodRHVtcFB1YmxpY0lkQWN0aW9uTWFwUmVzcG9uc2USDQoFYWxlcnQYASABKAkSTgoIY29udGVudHMYAiADKAsyPC5vbGl2ZXRpbi5hcGkudjEuRHVtcFB1YmxpY0lkQWN0aW9uTWFwUmVzcG9uc2UuQ29udGVudHNFbnRyeRpOCg1Db250ZW50c0VudHJ5EgsKA2tleRgBIAEoCRIsCgV2YWx1ZRgCIAEoCzIdLm9saXZldGluLmFwaS52MS5EZWJ1Z0JpbmRpbmc6AjgBIhIKEEdldFJlYWR5elJlcXVlc3QiIwoRR2V0UmVhZHl6UmVzcG9uc2USDgoGc3RhdHVzGAEgASgJIhQKEkV2ZW50U3RyZWFtUmVxdWVzdCKZAwoTRXZlbnRTdHJlYW1SZXNwb25zZRI9Cg5lbnRpdHlfY2hhbmdlZBgCIAEoCzIjLm9saXZldGluLmFwaS52MS5FdmVudEVudGl0eUNoYW5nZWRIABI9Cg5jb25maWdfY2hhbmdlZBgDIAEoCzIjLm9saXZldGluLmFwaS52MS5FdmVudENvbmZpZ0NoYW5nZWRIABJFChJleGVjdXRpb25fZmluaXNoZWQYBCABKAsyJy5vbGl2ZXRpbi5hcGkudjEuRXZlbnRFeGVjdXRpb25GaW5pc2hlZEgAEkMKEWV4ZWN1dGlvbl9zdGFydGVkGAUgASgLMiYub2xpdmV0aW4uYXBpLnYxLkV2ZW50RXhlY3V0aW9uU3RhcnRlZEgAEjkKDG91dHB1dF9jaHVuaxgGIAEoCzIhLm9saXZldGluLmFwaS52MS5FdmVudE91dHB1dENodW5rSAASNAoJaGVhcnRiZWF0GAcgASgLMh8ub2xpdmV0aW4uYXBpLnYxLkV2ZW50SGVhcnRiZWF0SABCBwoFZXZlbnQiQQoQRXZlbnRPdXRwdXRDaHVuaxIdChVleGVjdXRpb25fdHJhY2tpbmdfaWQYASABKAkSDgoGb3V0cHV0GAIgASgJIhQKEkV2ZW50RW50aXR5Q2hhbmdlZCIUChJFdmVudENvbmZpZ0NoYW5nZWQiEAoORXZlbnRIZWFydGJlYXQiRgoWRXZlbnRFeGVjdXRpb25GaW5pc2hlZBIsCglsb2dfZW50cnkYASABKAsyGS5vbGl2ZXRpbi5hcGkudjEuTG9nRW50cnkiRQoVRXZlbnRFeGVjdXRpb25TdGFydGVkEiwKCWxvZ19lbnRyeRgBIAEoCzIZLm9saXZldGluLmFwaS52MS5Mb2dFbnRyeSIyChFLaWxsQWN0aW9uUmVxdWVzdBIdChVleGVjdXRpb25fdHJhY2tpbmdfaWQYASABKAkibQoSS2lsbEFjdGlvblJlc3BvbnNlEh0KFWV4ZWN1dGlvbl90cmFja2luZ19pZBgBIAEoCRIOCgZraWxsZWQYAiABKAgSGQoRYWxyZWFkeV9jb21wbGV0ZWQYAyABKAgSDQoFZm91bmQYBCABKAgiOwoVTG9jYWxVc2VyTG9naW5SZXF1ZXN0EhAKCHVzZXJuYW1lGAEgASgJEhAKCHBhc3N3b3JkGAIgASgJIikKFkxvY2FsVXNlckxvZ2luUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCCInChNQYXNzd29yZEhhc2hSZXF1ZXN0EhAKCHBhc3N3b3JkGAEgASgJIiQKFFBhc3N3b3JkSGFzaFJlc3BvbnNlEgwKBGhhc2gYASABKAkiDwoNTG9nb3V0UmVxdWVzdCIQCg5Mb2dvdXRSZXNwb25zZSIXChVHZXREaWFnbm9zdGljc1JlcXVlc3QiowEKC0NvbmZpZ0lzc3VlEhAKCHNldmVyaXR5GAEgASgJEgwKBGNvZGUYAiABKAkSDwoHbWVzc2FnZRgDIAEoCRIRCglhY3Rpb25faWQYBCABKAkSFAoMYWN0aW9uX3RpdGxlGAUgASgJEhUKDWFyZ3VtZW50X25hbWUYBiABKAkSDgoGc291cmNlGAcgASgJEhMKC2NvbmZpZ19maWxlGAggASgJInoKFkdldERpYWdub3N0aWNzUmVzcG9uc2USEwoLU3NoRm91bmRLZXkYASABKAkSFgoOU3NoRm91bmRDb25maWcYAiABKAkSMwoNY29uZmlnX2lzc3VlcxgDIAMoCzIcLm9saXZldGluLmFwaS52MS5Db25maWdJc3N1ZSINCgtJbml0UmVxdWVzdCLHBgoMSW5pdFJlc3BvbnNlEhIKCnNob3dGb290ZXIYASABKAgSFgoOc2hvd05hdmlnYXRpb24YAiABKAgSFwoPc2hvd05ld1ZlcnNpb25zGAMgASgIEhgKEGF2YWlsYWJsZVZlcnNpb24YBCABKAkSFgoOY3VycmVudFZlcnNpb24YBSABKAkSEQoJcGFnZVRpdGxlGAYgASgJEh4KFnNlY3Rpb25OYXZpZ2F0aW9uU3R5bGUYByABKAkSGgoSZGVmYXVsdEljb25Gb3JCYWNrGAggASgJEhYKDmVuYWJsZUN1c3RvbUpzGAkgASgIEhQKDGF1dGhMb2dpblVybBgKIAEoCRIWCg5hdXRoTG9jYWxMb2dpbhgLIAEoCBIRCglzdHlsZU1vZHMYDCADKAkSOAoPb0F1dGgyUHJvdmlkZXJzGA0gAygLMh8ub2xpdmV0aW4uYXBpLnYxLk9BdXRoMlByb3ZpZGVyEjgKD2FkZGl0aW9uYWxMaW5rcxgOIAMoCzIfLm9saXZldGluLmFwaS52MS5BZGRpdGlvbmFsTGluaxIWCg5yb290RGFzaGJvYXJkcxgPIAMoCRIaChJhdXRoZW50aWNhdGVkX3VzZXIYECABKAkSIwobYXV0aGVudGljYXRlZF91c2VyX3Byb3ZpZGVyGBEgASgJEjoKEGVmZmVjdGl2ZV9wb2xpY3kYEiABKAsyIC5vbGl2ZXRpbi5hcGkudjEuRWZmZWN0aXZlUG9saWN5EhYKDmJhbm5lcl9tZXNzYWdlGBMgASgJEhIKCmJhbm5lcl9jc3MYFCABKAkSGAoQc2hvd19kaWFnbm9zdGljcxgVIAEoCBIVCg1zaG93X2xvZ19saXN0GBYgASgIEhYKDmxvZ2luX3JlcXVpcmVkGBcgASgIEhgKEGF2YWlsYWJsZV90aGVtZXMYGCADKAkSJAocc2hvd19uYXZpZ2F0ZV9vbl9zdGFydF9pY29ucxgZIAEoCBIaChJjb25maWdfaXNzdWVfY291bnQYGiABKAUSPgoWcm9vdF9kYXNoYm9hcmRfZW50cmllcxgbIAMoCzIeLm9saXZldGluLmFwaS52MS5Sb290RGFzaGJvYXJkIjAKDVJvb3REYXNoYm9hcmQSDQoFdGl0bGUYASABKAkSEAoIY2F0ZWdvcnkYAiABKAkiLAoOQWRkaXRpb25hbExpbmsSDQoFdGl0bGUYASABKAkSCwoDdXJsGAIgASgJIjoKDk9BdXRoMlByb3ZpZGVyEg0KBXRpdGxlGAEgASgJEgwKBGljb24YAyABKAkSCwoDa2V5GAQgASgJIi0KF0dldEFjdGlvbkJpbmRpbmdSZXF1ZXN0EhIKCmJpbmRpbmdfaWQYASABKAkiiwEKGEdldEFjdGlvbkJpbmRpbmdSZXNwb25zZRInCgZhY3Rpb24YASABKAsyFy5vbGl2ZXRpbi5hcGkudjEuQWN0aW9uEkYKEmJhY2tfdG9fZGFzaGJvYXJkcxgCIAMoCzIqLm9saXZldGluLmFwaS52MS5EYXNoYm9hcmROYXZpZ2F0aW9uVGFyZ2V0IloKEkdldEVudGl0aWVzUmVxdWVzdBITCgtlbnRpdHlfdHlwZRgBIAEoCRIOCgZmaWx0ZXIYAiABKAkSDAoEcGFnZRgDIAEoBRIRCglwYWdlX3NpemUYBCABKAUiVAoTR2V0RW50aXRpZXNSZXNwb25zZRI9ChJlbnRpdHlfZGVmaW5pdGlvbnMYASADKAsyIS5vbGl2ZXRpbi5hcGkudjEuRW50aXR5RGVmaW5pdGlvbiLFAQoQRW50aXR5RGVmaW5pdGlvbhINCgV0aXRsZRgBIAEoCRIqCglpbnN0YW5jZXMYAiADKAsyFy5vbGl2ZXRpbi5hcGkudjEuRW50aXR5EhoKEnVzZWRfb25fZGFzaGJvYXJkcxgDIAMoCRIMCgRpY29uGAQgASgJEjMKCnByb3BlcnRpZXMYBSADKAsyHy5vbGl2ZXRpbi5hcGkudjEuRW50aXR5UHJvcGVydHkSFwoPdG90YWxfaW5zdGFuY2VzGAYgASgFIi0KDkVudGl0eVByb3BlcnR5EgwKBG5hbWUYASABKAkSDQoFdGl0bGUYAiABKAkiNAoQR2V0RW50aXR5UmVxdWVzdBISCgp1bmlxdWVfa2V5GAEgASgJEgwKBHR5cGUYAiABKAkiNQoUUmVzdGFydEFjdGlvblJlcXVlc3QSHQoVZXhlY3V0aW9uX3RyYWNraW5nX2lkGAEgASgJMu4TChJPbGl2ZVRpbkFwaVNlcnZpY2USXQoMR2V0RGFzaGJvYXJkEiQub2xpdmV0aW4uYXBpLnYxLkdldERhc2hib2FyZFJlcXVlc3QaJS5vbGl2ZXRpbi5hcGkudjEuR2V0RGFzaGJvYXJkUmVzcG9uc2UiABJaCgtTdGFydEFjdGlvbhIjLm9saXZldGluLmFwaS52MS5TdGFydEFjdGlvblJlcXVlc3QaJC5vbGl2ZXRpbi5hcGkudjEuU3RhcnRBY3Rpb25SZXNwb25zZSIAEm8KElN0YXJ0QWN0aW9uQW5kV2FpdBIqLm9saXZldGluLmFwaS52MS5TdGFydEFjdGlvbkFuZFdhaXRSZXF1ZXN0Gisub2xpdmV0aW4uYXBpLnYxLlN0YXJ0QWN0aW9uQW5kV2FpdFJlc3BvbnNlIgASaQoQU3RhcnRBY3Rpb25CeUdldBIoLm9saXZldGluLmFwaS52MS5TdGFydEFjdGlvbkJ5R2V0UmVxdWVzdBopLm9saXZldGluLmFwaS52MS5TdGFydEFjdGlvbkJ5R2V0UmVzcG9uc2UiABJ+ChdTdGFydEFjdGlvbkJ5R2V0QW5kV2FpdBIvLm9saXZldGluLmFwaS52MS5TdGFydEFjdGlvbkJ5R2V0QW5kV2FpdFJlcXVlc3QaMC5vbGl2ZXRpbi5hcGkudjEuU3RhcnRBY3Rpb25CeUdldEFuZFdhaXRSZXNwb25zZSIAEl4KDVJlc3RhcnRBY3Rpb24SJS5vbGl2ZXRpbi5hcGkudjEuUmVzdGFydEFjdGlvblJlcXVlc3QaJC5vbGl2ZXRpbi5hcGkudjEuU3RhcnRBY3Rpb25SZXNwb25zZSIAElcKCktpbGxBY3Rpb24SIi5vbGl2ZXRpbi5hcGkudjEuS2lsbEFjdGlvblJlcXVlc3QaIy5vbGl2ZXRpbi5hcGkudjEuS2lsbEFjdGlvblJlc3BvbnNlIgASZgoPRXhlY3V0aW9uU3RhdHVzEicub2xpdmV0aW4uYXBpLnYxLkV4ZWN1dGlvblN0YXR1c1JlcXVlc3QaKC5vbGl2ZXRpbi5hcGkudjEuRXhlY3V0aW9uU3RhdHVzUmVzcG9uc2UiABJOCgdHZXRMb2dzEh8ub2xpdmV0aW4uYXBpLnYxLkdldExvZ3NSZXF1ZXN0GiAub2xpdmV0aW4uYXBpLnYxLkdldExvZ3NSZXNwb25zZSIAEmAKDUdldEFjdGlvbkxvZ3MSJS5vbGl2ZXRpbi5hcGkudjEuR2V0QWN0aW9uTG9nc1JlcXVlc3QaJi5vbGl2ZXRpbi5hcGkudjEuR2V0QWN0aW9uTG9nc1Jlc3BvbnNlIgASbAoRR2V0RXhlY3V0aW9uUXVldWUSKS5vbGl2ZXRpbi5hcGkudjEuR2V0RXhlY3V0aW9uUXVldWVSZXF1ZXN0Gioub2xpdmV0aW4uYXBpLnYxLkdldEV4ZWN1dGlvblF1ZXVlUmVzcG9uc2UiABJ1ChRWYWxpZGF0ZUFyZ3VtZW50VHlwZRIsLm9saXZldGluLmFwaS52MS5WYWxpZGF0ZUFyZ3VtZW50VHlwZVJlcXVlc3QaLS5vbGl2ZXRpbi5hcGkudjEuVmFsaWRhdGVBcmd1bWVudFR5cGVSZXNwb25zZSIAEksKBldob0FtSRIeLm9saXZldGluLmFwaS52MS5XaG9BbUlSZXF1ZXN0Gh8ub2xpdmV0aW4uYXBpLnYxLldob0FtSVJlc3BvbnNlIgASbAoRU2VydmVyRGlhZ25vc3RpY3MSKS5vbGl2ZXRpbi5hcGkudjEuU2VydmVyRGlhZ25vc3RpY3NSZXF1ZXN0Gioub2xpdmV0aW4uYXBpLnYxLlNlcnZlckRpYWdub3N0aWNzUmVzcG9uc2UiABJRCghEdW1wVmFycxIgLm9saXZldGluLmFwaS52MS5EdW1wVmFyc1JlcXVlc3QaIS5vbGl2ZXRpbi5hcGkudjEuRHVtcFZhcnNSZXNwb25zZSIAEngKFUR1bXBQdWJsaWNJZEFjdGlvbk1hcBItLm9saXZldGluLmFwaS52MS5EdW1wUHVibGljSWRBY3Rpb25NYXBSZXF1ZXN0Gi4ub2xpdmV0aW4uYXBpLnYxLkR1bXBQdWJsaWNJZEFjdGlvbk1hcFJlc3BvbnNlIgASVAoJR2V0UmVhZHl6EiEub2xpdmV0aW4uYXBpLnYxLkdldFJlYWR5elJlcXVlc3QaIi5vbGl2ZXRpbi5hcGkudjEuR2V0UmVhZHl6UmVzcG9uc2UiABJjCg5Mb2NhbFVzZXJMb2dpbhImLm9saXZldGluLmFwaS52MS5Mb2NhbFVzZXJMb2dpblJlcXVlc3QaJy5vbGl2ZXRpbi5hcGkudjEuTG9jYWxVc2VyTG9naW5SZXNwb25zZSIAEl0KDFBhc3N3b3JkSGFzaBIkLm9saXZldGluLmFwaS52MS5QYXNzd29yZEhhc2hSZXF1ZXN0GiUub2xpdmV0aW4uYXBpLnYxLlBhc3N3b3JkSGFzaFJlc3BvbnNlIgASSwoGTG9nb3V0Eh4ub2xpdmV0aW4uYXBpLnYxLkxvZ291dFJlcXVlc3QaHy5vbGl2ZXRpbi5hcGkudjEuTG9nb3V0UmVzcG9uc2UiABJcCgtFdmVudFN0cmVhbRIjLm9saXZldGluLmFwaS52MS5FdmVudFN0cmVhbVJlcXVlc3QaJC5vbGl2ZXRpbi5hcGkudjEuRXZlbnRTdHJlYW1SZXNwb25zZSIAMAESYwoOR2V0RGlhZ25vc3RpY3MSJi5vbGl2ZXRpbi5hcGkudjEuR2V0RGlhZ25vc3RpY3NSZXF1ZXN0Gicub2xpdmV0aW4uYXBpLnYxLkdldERpYWdub3N0aWNzUmVzcG9uc2UiABJFCgRJbml0Ehwub2xpdmV0aW4uYXBpLnYxLkluaXRSZXF1ZXN0Gh0ub2xpdmV0aW4uYXBpLnYxLkluaXRSZXNwb25zZSIAEmkKEEdldEFjdGlvbkJpbmRpbmcSKC5vbGl2ZXRpbi5hcGkudjEuR2V0QWN0aW9uQmluZGluZ1JlcXVlc3QaKS5vbGl2ZXRpbi5hcGkudjEuR2V0QWN0aW9uQmluZGluZ1Jlc3BvbnNlIgASWgoLR2V0RW50aXRpZXMSIy5vbGl2ZXRpbi5hcGkudjEuR2V0RW50aXRpZXNSZXF1ZXN0GiQub2xpdmV0aW4uYXBpLnYxLkdldEVudGl0aWVzUmVzcG9uc2UiABJJCglHZXRFbnRpdHkSIS5vbGl2ZXRpbi5hcGkudjEuR2V0RW50aXR5UmVxdWVzdBoXLm9saXZldGluLmFwaS52MS5FbnRpdHkiAEI4WjZnaXRodWIuY29tL09saXZlVGluL09saXZlVGluL2dlbi9vbGl2ZXRpbi9hcGkvdjE7YXBpdjFiBnByb3RvMw");
+  fileDesc("Ch5vbGl2ZXRpbi9hcGkvdjEvb2xpdmV0aW4ucHJvdG8SD29saXZldGluLmFwaS52MSLGBAoGQWN0aW9uEhIKCmJpbmRpbmdfaWQYASABKAkSDQoFdGl0bGUYAiABKAkSDAoEaWNvbhgDIAEoCRIQCghjYW5fZXhlYxgEIAEoCBIyCglhcmd1bWVudHMYBSADKAsyHy5vbGl2ZXRpbi5hcGkudjEuQWN0aW9uQXJndW1lbnQSFgoOcG9wdXBfb25fc3RhcnQYBiABKAkSDQoFb3JkZXIYByABKAUSDwoHdGltZW91dBgIIAEoBRIjChtkYXRldGltZV9yYXRlX2xpbWl0X2V4cGlyZXMYCSABKAkSFwoPZXhlY19vbl9zdGFydHVwGAogASgIEhQKDGV4ZWNfb25fY3JvbhgLIAMoCRIjChtleGVjX29uX2ZpbGVfY3JlYXRlZF9pbl9kaXIYDCADKAkSIwobZXhlY19vbl9maWxlX2NoYW5nZWRfaW5fZGlyGA0gAygJEh0KFWV4ZWNfb25fY2FsZW5kYXJfZmlsZRgOIAEoCRJAChBleGVjX29uX3dlYmhvb2tzGA8gAygLMiYub2xpdmV0aW4uYXBpLnYxLkFjdGlvbldlYmhvb2tFeGVjSGludBIVCg1qdXN0aWZpY2F0aW9uGBQgASgJEhwKFGhhc19ydW5uaW5nX2luc3RhbmNlGBEgASgIEhsKE2hhc19xdWV1ZWRfaW5zdGFuY2UYEiABKAgSNgoGZ3JvdXBzGBMgAygLMiYub2xpdmV0aW4uYXBpLnYxLkFjdGlvbkdyb3VwTWVtYmVyc2hpcEoECBAQESJRChVBY3Rpb25Hcm91cE1lbWJlcnNoaXASDAoEbmFtZRgBIAEoCRIWCg5tYXhfY29uY3VycmVudBgCIAEoBRISCgpxdWV1ZV9zaXplGAMgASgFIsMCChVBY3Rpb25XZWJob29rRXhlY0hpbnQSEAoIdGVtcGxhdGUYASABKAkSEgoKbWF0Y2hfcGF0aBgCIAEoCRJPCg1tYXRjaF9oZWFkZXJzGAMgAygLMjgub2xpdmV0aW4uYXBpLnYxLkFjdGlvbldlYmhvb2tFeGVjSGludC5NYXRjaEhlYWRlcnNFbnRyeRJLCgttYXRjaF9xdWVyeRgEIAMoCzI2Lm9saXZldGluLmFwaS52MS5BY3Rpb25XZWJob29rRXhlY0hpbnQuTWF0Y2hRdWVyeUVudHJ5GjMKEU1hdGNoSGVhZGVyc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEaMQoPTWF0Y2hRdWVyeUVudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiuwIKDkFjdGlvbkFyZ3VtZW50EgwKBG5hbWUYASABKAkSDQoFdGl0bGUYAiABKAkSDAoEdHlwZRgDIAEoCRIVCg1kZWZhdWx0X3ZhbHVlGAQgASgJEjYKB2Nob2ljZXMYBSADKAsyJS5vbGl2ZXRpbi5hcGkudjEuQWN0aW9uQXJndW1lbnRDaG9pY2USEwoLZGVzY3JpcHRpb24YBiABKAkSRQoLc3VnZ2VzdGlvbnMYByADKAsyMC5vbGl2ZXRpbi5hcGkudjEuQWN0aW9uQXJndW1lbnQuU3VnZ2VzdGlvbnNFbnRyeRIfChdzdWdnZXN0aW9uc19icm93c2VyX2tleRgIIAEoCRoyChBTdWdnZXN0aW9uc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiNAoUQWN0aW9uQXJndW1lbnRDaG9pY2USDQoFdmFsdWUYASABKAkSDQoFdGl0bGUYAiABKAki1AEKE0VudGl0eVJlbGF0ZWRBY3Rpb24SJwoGYWN0aW9uGAEgASgLMhcub2xpdmV0aW4uYXBpLnYxLkFjdGlvbhJZChNwcmVmaWxsZWRfYXJndW1lbnRzGAIgAygLMjwub2xpdmV0aW4uYXBpLnYxLkVudGl0eVJlbGF0ZWRBY3Rpb24uUHJlZmlsbGVkQXJndW1lbnRzRW50cnkaOQoXUHJlZmlsbGVkQXJndW1lbnRzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASL/AQoGRW50aXR5Eg0KBXRpdGxlGAEgASgJEhIKCnVuaXF1ZV9rZXkYAiABKAkSDAoEdHlwZRgDIAEoCRITCgtkaXJlY3RvcmllcxgEIAMoCRIzCgZmaWVsZHMYBSADKAsyIy5vbGl2ZXRpbi5hcGkudjEuRW50aXR5LkZpZWxkc0VudHJ5Ej0KD3JlbGF0ZWRfYWN0aW9ucxgGIAMoCzIkLm9saXZldGluLmFwaS52MS5FbnRpdHlSZWxhdGVkQWN0aW9uEgwKBGljb24YByABKAkaLQoLRmllbGRzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASJUChRHZXREYXNoYm9hcmRSZXNwb25zZRINCgV0aXRsZRgBIAEoCRItCglkYXNoYm9hcmQYBCABKAsyGi5vbGl2ZXRpbi5hcGkudjEuRGFzaGJvYXJkInYKC1NlYXJjaEhpbnRzEjMKCGVudGl0aWVzGAEgAygLMiEub2xpdmV0aW4uYXBpLnYxLkVudGl0eVNlYXJjaEhpbnQSMgoHYWN0aW9ucxgCIAMoCzIhLm9saXZldGluLmFwaS52MS5BY3Rpb25TZWFyY2hIaW50IkMKEEVudGl0eVNlYXJjaEhpbnQSDQoFdGl0bGUYASABKAkSDAoEdHlwZRgCIAEoCRISCgp1bmlxdWVfa2V5GAMgASgJIjUKEEFjdGlvblNlYXJjaEhpbnQSDQoFdGl0bGUYASABKAkSEgoKYmluZGluZ19pZBgCIAEoCSJfCg9FZmZlY3RpdmVQb2xpY3kSGAoQc2hvd19kaWFnbm9zdGljcxgBIAEoCBIVCg1zaG93X2xvZ19saXN0GAIgASgIEhsKE3Nob3dfdmVyc2lvbl9udW1iZXIYAyABKAgiIQoIRmVhdHVyZXMSFQoNaGVhZGVyX3NlYXJjaBgBIAEoCCJNChNHZXREYXNoYm9hcmRSZXF1ZXN0Eg0KBXRpdGxlGAEgASgJEhMKC2VudGl0eV90eXBlGAIgASgJEhIKCmVudGl0eV9rZXkYAyABKAkiUQoJRGFzaGJvYXJkEg0KBXRpdGxlGAEgASgJEjUKCGNvbnRlbnRzGAIgAygLMiMub2xpdmV0aW4uYXBpLnYxLkRhc2hib2FyZENvbXBvbmVudCLbAQoSRGFzaGJvYXJkQ29tcG9uZW50Eg0KBXRpdGxlGAEgASgJEgwKBHR5cGUYAiABKAkSNQoIY29udGVudHMYAyADKAsyIy5vbGl2ZXRpbi5hcGkudjEuRGFzaGJvYXJkQ29tcG9uZW50EgwKBGljb24YBCABKAkSEQoJY3NzX2NsYXNzGAUgASgJEicKBmFjdGlvbhgGIAEoCzIXLm9saXZldGluLmFwaS52MS5BY3Rpb24SEwoLZW50aXR5X3R5cGUYByABKAkSEgoKZW50aXR5X2tleRgIIAEoCSKUAQoSU3RhcnRBY3Rpb25SZXF1ZXN0EhIKCmJpbmRpbmdfaWQYASABKAkSNwoJYXJndW1lbnRzGAIgAygLMiQub2xpdmV0aW4uYXBpLnYxLlN0YXJ0QWN0aW9uQXJndW1lbnQSGgoSdW5pcXVlX3RyYWNraW5nX2lkGAMgASgJEhUKDWp1c3RpZmljYXRpb24YBCABKAkiMgoTU3RhcnRBY3Rpb25Bcmd1bWVudBIMCgRuYW1lGAEgASgJEg0KBXZhbHVlGAIgASgJIjQKE1N0YXJ0QWN0aW9uUmVzcG9uc2USHQoVZXhlY3V0aW9uX3RyYWNraW5nX2lkGAIgASgJIn4KGVN0YXJ0QWN0aW9uQW5kV2FpdFJlcXVlc3QSEQoJYWN0aW9uX2lkGAEgASgJEjcKCWFyZ3VtZW50cxgCIAMoCzIkLm9saXZldGluLmFwaS52MS5TdGFydEFjdGlvbkFyZ3VtZW50EhUKDWp1c3RpZmljYXRpb24YAyABKAkiSgoaU3RhcnRBY3Rpb25BbmRXYWl0UmVzcG9uc2USLAoJbG9nX2VudHJ5GAEgASgLMhkub2xpdmV0aW4uYXBpLnYxLkxvZ0VudHJ5IiwKF1N0YXJ0QWN0aW9uQnlHZXRSZXF1ZXN0EhEKCWFjdGlvbl9pZBgBIAEoCSI5ChhTdGFydEFjdGlvbkJ5R2V0UmVzcG9uc2USHQoVZXhlY3V0aW9uX3RyYWNraW5nX2lkGAIgASgJIjMKHlN0YXJ0QWN0aW9uQnlHZXRBbmRXYWl0UmVxdWVzdBIRCglhY3Rpb25faWQYASABKAkiTwofU3RhcnRBY3Rpb25CeUdldEFuZFdhaXRSZXNwb25zZRIsCglsb2dfZW50cnkYASABKAsyGS5vbGl2ZXRpbi5hcGkudjEuTG9nRW50cnkiXgoOR2V0TG9nc1JlcXVlc3QSFAoMc3RhcnRfb2Zmc2V0GAEgASgDEhMKC2RhdGVfZmlsdGVyGAIgASgJEhEKCXBhZ2Vfc2l6ZRgDIAEoAxIOCgZmaWx0ZXIYBCABKAkilAQKCExvZ0VudHJ5EhgKEGRhdGV0aW1lX3N0YXJ0ZWQYASABKAkSFAoMYWN0aW9uX3RpdGxlGAIgASgJEg4KBm91dHB1dBgDIAEoCRIRCgl0aW1lZF9vdXQYBSABKAgSEQoJZXhpdF9jb2RlGAYgASgFEgwKBHVzZXIYByABKAkSEgoKdXNlcl9jbGFzcxgIIAEoCRITCgthY3Rpb25faWNvbhgJIAEoCRIMCgR0YWdzGAogAygJEh0KFWV4ZWN1dGlvbl90cmFja2luZ19pZBgLIAEoCRIZChFkYXRldGltZV9maW5pc2hlZBgMIAEoCRIZChFleGVjdXRpb25fc3RhcnRlZBgOIAEoCBIaChJleGVjdXRpb25fZmluaXNoZWQYDyABKAgSDwoHYmxvY2tlZBgQIAEoCBIWCg5kYXRldGltZV9pbmRleBgRIAEoAxIQCghjYW5fa2lsbBgSIAEoCBIjChtkYXRldGltZV9yYXRlX2xpbWl0X2V4cGlyZXMYEyABKAkSEgoKYmluZGluZ19pZBgUIAEoCRIOCgZxdWV1ZWQYFSABKAgSGAoQcXVldWVkX2Zvcl9ncm91cBgWIAEoCRIVCg1qdXN0aWZpY2F0aW9uGBcgASgJEjcKCWFyZ3VtZW50cxgYIAMoCzIkLm9saXZldGluLmFwaS52MS5TdGFydEFjdGlvbkFyZ3VtZW50IpEBCg9HZXRMb2dzUmVzcG9uc2USJwoEbG9ncxgBIAMoCzIZLm9saXZldGluLmFwaS52MS5Mb2dFbnRyeRIXCg9jb3VudF9yZW1haW5pbmcYAiABKAMSEQoJcGFnZV9zaXplGAMgASgDEhMKC3RvdGFsX2NvdW50GAQgASgDEhQKDHN0YXJ0X29mZnNldBgFIAEoAyI/ChRHZXRBY3Rpb25Mb2dzUmVxdWVzdBIRCglhY3Rpb25faWQYASABKAkSFAoMc3RhcnRfb2Zmc2V0GAIgASgDIpcBChVHZXRBY3Rpb25Mb2dzUmVzcG9uc2USJwoEbG9ncxgBIAMoCzIZLm9saXZldGluLmFwaS52MS5Mb2dFbnRyeRIXCg9jb3VudF9yZW1haW5pbmcYAiABKAMSEQoJcGFnZV9zaXplGAMgASgDEhMKC3RvdGFsX2NvdW50GAQgASgDEhQKDHN0YXJ0X29mZnNldBgFIAEoAyIaChhHZXRFeGVjdXRpb25RdWV1ZVJlcXVlc3QixgEKFEV4ZWN1dGlvblF1ZXVlQWN0aW9uEhIKCmJpbmRpbmdfaWQYASABKAkSFAoMYWN0aW9uX3RpdGxlGAIgASgJEhMKC2FjdGlvbl9pY29uGAMgASgJEhYKDm1heF9jb25jdXJyZW50GAQgASgFEhQKDGFjdGl2ZV9jb3VudBgFIAEoBRIVCg1lbnRpdHlfcHJlZml4GAYgASgJEioKB2VudHJpZXMYByADKAsyGS5vbGl2ZXRpbi5hcGkudjEuTG9nRW50cnkiwQEKE0V4ZWN1dGlvblF1ZXVlR3JvdXASDAoEbmFtZRgBIAEoCRIMCgRpY29uGAIgASgJEhYKDm1heF9jb25jdXJyZW50GAMgASgFEhQKDGFjdGl2ZV9jb3VudBgEIAEoBRI2CgdhY3Rpb25zGAUgAygLMiUub2xpdmV0aW4uYXBpLnYxLkV4ZWN1dGlvblF1ZXVlQWN0aW9uEhQKDHF1ZXVlZF9jb3VudBgGIAEoBRISCgpxdWV1ZV9zaXplGAcgASgFImcKGUdldEV4ZWN1dGlvblF1ZXVlUmVzcG9uc2USNAoGZ3JvdXBzGAEgAygLMiQub2xpdmV0aW4uYXBpLnYxLkV4ZWN1dGlvblF1ZXVlR3JvdXASFAoMdG90YWxfYWN0aXZlGAIgASgFImUKG1ZhbGlkYXRlQXJndW1lbnRUeXBlUmVxdWVzdBINCgV2YWx1ZRgBIAEoCRIMCgR0eXBlGAIgASgJEhIKCmJpbmRpbmdfaWQYAyABKAkSFQoNYXJndW1lbnRfbmFtZRgEIAEoCSJCChxWYWxpZGF0ZUFyZ3VtZW50VHlwZVJlc3BvbnNlEg0KBXZhbGlkGAEgASgIEhMKC2Rlc2NyaXB0aW9uGAIgASgJIjYKFVdhdGNoRXhlY3V0aW9uUmVxdWVzdBIdChVleGVjdXRpb25fdHJhY2tpbmdfaWQYASABKAkiJgoUV2F0Y2hFeGVjdXRpb25VcGRhdGUSDgoGdXBkYXRlGAEgASgJIkoKFkV4ZWN1dGlvblN0YXR1c1JlcXVlc3QSHQoVZXhlY3V0aW9uX3RyYWNraW5nX2lkGAEgASgJEhEKCWFjdGlvbl9pZBgCIAEoCSJhChlEYXNoYm9hcmROYXZpZ2F0aW9uVGFyZ2V0Eg0KBXRpdGxlGAEgASgJEhMKC2VudGl0eV90eXBlGAIgASgJEhIKCmVudGl0eV9rZXkYAyABKAkSDAoEcGF0aBgEIAEoCSKPAQoXRXhlY3V0aW9uU3RhdHVzUmVzcG9uc2USLAoJbG9nX2VudHJ5GAEgASgLMhkub2xpdmV0aW4uYXBpLnYxLkxvZ0VudHJ5EkYKEmJhY2tfdG9fZGFzaGJvYXJkcxgCIAMoCzIqLm9saXZldGluLmFwaS52MS5EYXNoYm9hcmROYXZpZ2F0aW9uVGFyZ2V0Ig8KDVdob0FtSVJlcXVlc3QibAoOV2hvQW1JUmVzcG9uc2USGgoSYXV0aGVudGljYXRlZF91c2VyGAEgASgJEhEKCXVzZXJncm91cBgCIAEoCRIQCghwcm92aWRlchgDIAEoCRIMCgRhY2xzGAQgAygJEgsKA3NpZBgFIAEoCSIaChhTZXJ2ZXJEaWFnbm9zdGljc1JlcXVlc3QiKgoZU2VydmVyRGlhZ25vc3RpY3NSZXNwb25zZRINCgVhbGVydBgBIAEoCSIRCg9EdW1wVmFyc1JlcXVlc3QilQEKEER1bXBWYXJzUmVzcG9uc2USDQoFYWxlcnQYASABKAkSQQoIY29udGVudHMYAiADKAsyLy5vbGl2ZXRpbi5hcGkudjEuRHVtcFZhcnNSZXNwb25zZS5Db250ZW50c0VudHJ5Gi8KDUNvbnRlbnRzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASI7CgxEZWJ1Z0JpbmRpbmcSFAoMYWN0aW9uX3RpdGxlGAEgASgJEhUKDWVudGl0eV9wcmVmaXgYAiABKAkiHgocRHVtcFB1YmxpY0lkQWN0aW9uTWFwUmVxdWVzdCLOAQodRHVtcFB1YmxpY0lkQWN0aW9uTWFwUmVzcG9uc2USDQoFYWxlcnQYASABKAkSTgoIY29udGVudHMYAiADKAsyPC5vbGl2ZXRpbi5hcGkudjEuRHVtcFB1YmxpY0lkQWN0aW9uTWFwUmVzcG9uc2UuQ29udGVudHNFbnRyeRpOCg1Db250ZW50c0VudHJ5EgsKA2tleRgBIAEoCRIsCgV2YWx1ZRgCIAEoCzIdLm9saXZldGluLmFwaS52MS5EZWJ1Z0JpbmRpbmc6AjgBIhIKEEdldFJlYWR5elJlcXVlc3QiIwoRR2V0UmVhZHl6UmVzcG9uc2USDgoGc3RhdHVzGAEgASgJIhQKEkV2ZW50U3RyZWFtUmVxdWVzdCKZAwoTRXZlbnRTdHJlYW1SZXNwb25zZRI9Cg5lbnRpdHlfY2hhbmdlZBgCIAEoCzIjLm9saXZldGluLmFwaS52MS5FdmVudEVudGl0eUNoYW5nZWRIABI9Cg5jb25maWdfY2hhbmdlZBgDIAEoCzIjLm9saXZldGluLmFwaS52MS5FdmVudENvbmZpZ0NoYW5nZWRIABJFChJleGVjdXRpb25fZmluaXNoZWQYBCABKAsyJy5vbGl2ZXRpbi5hcGkudjEuRXZlbnRFeGVjdXRpb25GaW5pc2hlZEgAEkMKEWV4ZWN1dGlvbl9zdGFydGVkGAUgASgLMiYub2xpdmV0aW4uYXBpLnYxLkV2ZW50RXhlY3V0aW9uU3RhcnRlZEgAEjkKDG91dHB1dF9jaHVuaxgGIAEoCzIhLm9saXZldGluLmFwaS52MS5FdmVudE91dHB1dENodW5rSAASNAoJaGVhcnRiZWF0GAcgASgLMh8ub2xpdmV0aW4uYXBpLnYxLkV2ZW50SGVhcnRiZWF0SABCBwoFZXZlbnQiQQoQRXZlbnRPdXRwdXRDaHVuaxIdChVleGVjdXRpb25fdHJhY2tpbmdfaWQYASABKAkSDgoGb3V0cHV0GAIgASgJIhQKEkV2ZW50RW50aXR5Q2hhbmdlZCIUChJFdmVudENvbmZpZ0NoYW5nZWQiEAoORXZlbnRIZWFydGJlYXQiRgoWRXZlbnRFeGVjdXRpb25GaW5pc2hlZBIsCglsb2dfZW50cnkYASABKAsyGS5vbGl2ZXRpbi5hcGkudjEuTG9nRW50cnkiRQoVRXZlbnRFeGVjdXRpb25TdGFydGVkEiwKCWxvZ19lbnRyeRgBIAEoCzIZLm9saXZldGluLmFwaS52MS5Mb2dFbnRyeSIyChFLaWxsQWN0aW9uUmVxdWVzdBIdChVleGVjdXRpb25fdHJhY2tpbmdfaWQYASABKAkibQoSS2lsbEFjdGlvblJlc3BvbnNlEh0KFWV4ZWN1dGlvbl90cmFja2luZ19pZBgBIAEoCRIOCgZraWxsZWQYAiABKAgSGQoRYWxyZWFkeV9jb21wbGV0ZWQYAyABKAgSDQoFZm91bmQYBCABKAgiOwoVTG9jYWxVc2VyTG9naW5SZXF1ZXN0EhAKCHVzZXJuYW1lGAEgASgJEhAKCHBhc3N3b3JkGAIgASgJIikKFkxvY2FsVXNlckxvZ2luUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCCInChNQYXNzd29yZEhhc2hSZXF1ZXN0EhAKCHBhc3N3b3JkGAEgASgJIiQKFFBhc3N3b3JkSGFzaFJlc3BvbnNlEgwKBGhhc2gYASABKAkiDwoNTG9nb3V0UmVxdWVzdCIQCg5Mb2dvdXRSZXNwb25zZSIXChVHZXREaWFnbm9zdGljc1JlcXVlc3QiowEKC0NvbmZpZ0lzc3VlEhAKCHNldmVyaXR5GAEgASgJEgwKBGNvZGUYAiABKAkSDwoHbWVzc2FnZRgDIAEoCRIRCglhY3Rpb25faWQYBCABKAkSFAoMYWN0aW9uX3RpdGxlGAUgASgJEhUKDWFyZ3VtZW50X25hbWUYBiABKAkSDgoGc291cmNlGAcgASgJEhMKC2NvbmZpZ19maWxlGAggASgJInoKFkdldERpYWdub3N0aWNzUmVzcG9uc2USEwoLU3NoRm91bmRLZXkYASABKAkSFgoOU3NoRm91bmRDb25maWcYAiABKAkSMwoNY29uZmlnX2lzc3VlcxgDIAMoCzIcLm9saXZldGluLmFwaS52MS5Db25maWdJc3N1ZSINCgtJbml0UmVxdWVzdCKoBwoMSW5pdFJlc3BvbnNlEhIKCnNob3dGb290ZXIYASABKAgSFgoOc2hvd05hdmlnYXRpb24YAiABKAgSFwoPc2hvd05ld1ZlcnNpb25zGAMgASgIEhgKEGF2YWlsYWJsZVZlcnNpb24YBCABKAkSFgoOY3VycmVudFZlcnNpb24YBSABKAkSEQoJcGFnZVRpdGxlGAYgASgJEh4KFnNlY3Rpb25OYXZpZ2F0aW9uU3R5bGUYByABKAkSGgoSZGVmYXVsdEljb25Gb3JCYWNrGAggASgJEhYKDmVuYWJsZUN1c3RvbUpzGAkgASgIEhQKDGF1dGhMb2dpblVybBgKIAEoCRIWCg5hdXRoTG9jYWxMb2dpbhgLIAEoCBIRCglzdHlsZU1vZHMYDCADKAkSOAoPb0F1dGgyUHJvdmlkZXJzGA0gAygLMh8ub2xpdmV0aW4uYXBpLnYxLk9BdXRoMlByb3ZpZGVyEjgKD2FkZGl0aW9uYWxMaW5rcxgOIAMoCzIfLm9saXZldGluLmFwaS52MS5BZGRpdGlvbmFsTGluaxIWCg5yb290RGFzaGJvYXJkcxgPIAMoCRIaChJhdXRoZW50aWNhdGVkX3VzZXIYECABKAkSIwobYXV0aGVudGljYXRlZF91c2VyX3Byb3ZpZGVyGBEgASgJEjoKEGVmZmVjdGl2ZV9wb2xpY3kYEiABKAsyIC5vbGl2ZXRpbi5hcGkudjEuRWZmZWN0aXZlUG9saWN5EhYKDmJhbm5lcl9tZXNzYWdlGBMgASgJEhIKCmJhbm5lcl9jc3MYFCABKAkSGAoQc2hvd19kaWFnbm9zdGljcxgVIAEoCBIVCg1zaG93X2xvZ19saXN0GBYgASgIEhYKDmxvZ2luX3JlcXVpcmVkGBcgASgIEhgKEGF2YWlsYWJsZV90aGVtZXMYGCADKAkSJAocc2hvd19uYXZpZ2F0ZV9vbl9zdGFydF9pY29ucxgZIAEoCBIaChJjb25maWdfaXNzdWVfY291bnQYGiABKAUSPgoWcm9vdF9kYXNoYm9hcmRfZW50cmllcxgbIAMoCzIeLm9saXZldGluLmFwaS52MS5Sb290RGFzaGJvYXJkEjIKDHNlYXJjaF9oaW50cxgcIAEoCzIcLm9saXZldGluLmFwaS52MS5TZWFyY2hIaW50cxIrCghmZWF0dXJlcxgdIAEoCzIZLm9saXZldGluLmFwaS52MS5GZWF0dXJlcyIwCg1Sb290RGFzaGJvYXJkEg0KBXRpdGxlGAEgASgJEhAKCGNhdGVnb3J5GAIgASgJIiwKDkFkZGl0aW9uYWxMaW5rEg0KBXRpdGxlGAEgASgJEgsKA3VybBgCIAEoCSI6Cg5PQXV0aDJQcm92aWRlchINCgV0aXRsZRgBIAEoCRIMCgRpY29uGAMgASgJEgsKA2tleRgEIAEoCSItChdHZXRBY3Rpb25CaW5kaW5nUmVxdWVzdBISCgpiaW5kaW5nX2lkGAEgASgJIosBChhHZXRBY3Rpb25CaW5kaW5nUmVzcG9uc2USJwoGYWN0aW9uGAEgASgLMhcub2xpdmV0aW4uYXBpLnYxLkFjdGlvbhJGChJiYWNrX3RvX2Rhc2hib2FyZHMYAiADKAsyKi5vbGl2ZXRpbi5hcGkudjEuRGFzaGJvYXJkTmF2aWdhdGlvblRhcmdldCJaChJHZXRFbnRpdGllc1JlcXVlc3QSEwoLZW50aXR5X3R5cGUYASABKAkSDgoGZmlsdGVyGAIgASgJEgwKBHBhZ2UYAyABKAUSEQoJcGFnZV9zaXplGAQgASgFIlQKE0dldEVudGl0aWVzUmVzcG9uc2USPQoSZW50aXR5X2RlZmluaXRpb25zGAEgAygLMiEub2xpdmV0aW4uYXBpLnYxLkVudGl0eURlZmluaXRpb24ixQEKEEVudGl0eURlZmluaXRpb24SDQoFdGl0bGUYASABKAkSKgoJaW5zdGFuY2VzGAIgAygLMhcub2xpdmV0aW4uYXBpLnYxLkVudGl0eRIaChJ1c2VkX29uX2Rhc2hib2FyZHMYAyADKAkSDAoEaWNvbhgEIAEoCRIzCgpwcm9wZXJ0aWVzGAUgAygLMh8ub2xpdmV0aW4uYXBpLnYxLkVudGl0eVByb3BlcnR5EhcKD3RvdGFsX2luc3RhbmNlcxgGIAEoBSItCg5FbnRpdHlQcm9wZXJ0eRIMCgRuYW1lGAEgASgJEg0KBXRpdGxlGAIgASgJIjQKEEdldEVudGl0eVJlcXVlc3QSEgoKdW5pcXVlX2tleRgBIAEoCRIMCgR0eXBlGAIgASgJIjUKFFJlc3RhcnRBY3Rpb25SZXF1ZXN0Eh0KFWV4ZWN1dGlvbl90cmFja2luZ19pZBgBIAEoCTLuEwoST2xpdmVUaW5BcGlTZXJ2aWNlEl0KDEdldERhc2hib2FyZBIkLm9saXZldGluLmFwaS52MS5HZXREYXNoYm9hcmRSZXF1ZXN0GiUub2xpdmV0aW4uYXBpLnYxLkdldERhc2hib2FyZFJlc3BvbnNlIgASWgoLU3RhcnRBY3Rpb24SIy5vbGl2ZXRpbi5hcGkudjEuU3RhcnRBY3Rpb25SZXF1ZXN0GiQub2xpdmV0aW4uYXBpLnYxLlN0YXJ0QWN0aW9uUmVzcG9uc2UiABJvChJTdGFydEFjdGlvbkFuZFdhaXQSKi5vbGl2ZXRpbi5hcGkudjEuU3RhcnRBY3Rpb25BbmRXYWl0UmVxdWVzdBorLm9saXZldGluLmFwaS52MS5TdGFydEFjdGlvbkFuZFdhaXRSZXNwb25zZSIAEmkKEFN0YXJ0QWN0aW9uQnlHZXQSKC5vbGl2ZXRpbi5hcGkudjEuU3RhcnRBY3Rpb25CeUdldFJlcXVlc3QaKS5vbGl2ZXRpbi5hcGkudjEuU3RhcnRBY3Rpb25CeUdldFJlc3BvbnNlIgASfgoXU3RhcnRBY3Rpb25CeUdldEFuZFdhaXQSLy5vbGl2ZXRpbi5hcGkudjEuU3RhcnRBY3Rpb25CeUdldEFuZFdhaXRSZXF1ZXN0GjAub2xpdmV0aW4uYXBpLnYxLlN0YXJ0QWN0aW9uQnlHZXRBbmRXYWl0UmVzcG9uc2UiABJeCg1SZXN0YXJ0QWN0aW9uEiUub2xpdmV0aW4uYXBpLnYxLlJlc3RhcnRBY3Rpb25SZXF1ZXN0GiQub2xpdmV0aW4uYXBpLnYxLlN0YXJ0QWN0aW9uUmVzcG9uc2UiABJXCgpLaWxsQWN0aW9uEiIub2xpdmV0aW4uYXBpLnYxLktpbGxBY3Rpb25SZXF1ZXN0GiMub2xpdmV0aW4uYXBpLnYxLktpbGxBY3Rpb25SZXNwb25zZSIAEmYKD0V4ZWN1dGlvblN0YXR1cxInLm9saXZldGluLmFwaS52MS5FeGVjdXRpb25TdGF0dXNSZXF1ZXN0Gigub2xpdmV0aW4uYXBpLnYxLkV4ZWN1dGlvblN0YXR1c1Jlc3BvbnNlIgASTgoHR2V0TG9ncxIfLm9saXZldGluLmFwaS52MS5HZXRMb2dzUmVxdWVzdBogLm9saXZldGluLmFwaS52MS5HZXRMb2dzUmVzcG9uc2UiABJgCg1HZXRBY3Rpb25Mb2dzEiUub2xpdmV0aW4uYXBpLnYxLkdldEFjdGlvbkxvZ3NSZXF1ZXN0GiYub2xpdmV0aW4uYXBpLnYxLkdldEFjdGlvbkxvZ3NSZXNwb25zZSIAEmwKEUdldEV4ZWN1dGlvblF1ZXVlEikub2xpdmV0aW4uYXBpLnYxLkdldEV4ZWN1dGlvblF1ZXVlUmVxdWVzdBoqLm9saXZldGluLmFwaS52MS5HZXRFeGVjdXRpb25RdWV1ZVJlc3BvbnNlIgASdQoUVmFsaWRhdGVBcmd1bWVudFR5cGUSLC5vbGl2ZXRpbi5hcGkudjEuVmFsaWRhdGVBcmd1bWVudFR5cGVSZXF1ZXN0Gi0ub2xpdmV0aW4uYXBpLnYxLlZhbGlkYXRlQXJndW1lbnRUeXBlUmVzcG9uc2UiABJLCgZXaG9BbUkSHi5vbGl2ZXRpbi5hcGkudjEuV2hvQW1JUmVxdWVzdBofLm9saXZldGluLmFwaS52MS5XaG9BbUlSZXNwb25zZSIAEmwKEVNlcnZlckRpYWdub3N0aWNzEikub2xpdmV0aW4uYXBpLnYxLlNlcnZlckRpYWdub3N0aWNzUmVxdWVzdBoqLm9saXZldGluLmFwaS52MS5TZXJ2ZXJEaWFnbm9zdGljc1Jlc3BvbnNlIgASUQoIRHVtcFZhcnMSIC5vbGl2ZXRpbi5hcGkudjEuRHVtcFZhcnNSZXF1ZXN0GiEub2xpdmV0aW4uYXBpLnYxLkR1bXBWYXJzUmVzcG9uc2UiABJ4ChVEdW1wUHVibGljSWRBY3Rpb25NYXASLS5vbGl2ZXRpbi5hcGkudjEuRHVtcFB1YmxpY0lkQWN0aW9uTWFwUmVxdWVzdBouLm9saXZldGluLmFwaS52MS5EdW1wUHVibGljSWRBY3Rpb25NYXBSZXNwb25zZSIAElQKCUdldFJlYWR5ehIhLm9saXZldGluLmFwaS52MS5HZXRSZWFkeXpSZXF1ZXN0GiIub2xpdmV0aW4uYXBpLnYxLkdldFJlYWR5elJlc3BvbnNlIgASYwoOTG9jYWxVc2VyTG9naW4SJi5vbGl2ZXRpbi5hcGkudjEuTG9jYWxVc2VyTG9naW5SZXF1ZXN0Gicub2xpdmV0aW4uYXBpLnYxLkxvY2FsVXNlckxvZ2luUmVzcG9uc2UiABJdCgxQYXNzd29yZEhhc2gSJC5vbGl2ZXRpbi5hcGkudjEuUGFzc3dvcmRIYXNoUmVxdWVzdBolLm9saXZldGluLmFwaS52MS5QYXNzd29yZEhhc2hSZXNwb25zZSIAEksKBkxvZ291dBIeLm9saXZldGluLmFwaS52MS5Mb2dvdXRSZXF1ZXN0Gh8ub2xpdmV0aW4uYXBpLnYxLkxvZ291dFJlc3BvbnNlIgASXAoLRXZlbnRTdHJlYW0SIy5vbGl2ZXRpbi5hcGkudjEuRXZlbnRTdHJlYW1SZXF1ZXN0GiQub2xpdmV0aW4uYXBpLnYxLkV2ZW50U3RyZWFtUmVzcG9uc2UiADABEmMKDkdldERpYWdub3N0aWNzEiYub2xpdmV0aW4uYXBpLnYxLkdldERpYWdub3N0aWNzUmVxdWVzdBonLm9saXZldGluLmFwaS52MS5HZXREaWFnbm9zdGljc1Jlc3BvbnNlIgASRQoESW5pdBIcLm9saXZldGluLmFwaS52MS5Jbml0UmVxdWVzdBodLm9saXZldGluLmFwaS52MS5Jbml0UmVzcG9uc2UiABJpChBHZXRBY3Rpb25CaW5kaW5nEigub2xpdmV0aW4uYXBpLnYxLkdldEFjdGlvbkJpbmRpbmdSZXF1ZXN0Gikub2xpdmV0aW4uYXBpLnYxLkdldEFjdGlvbkJpbmRpbmdSZXNwb25zZSIAEloKC0dldEVudGl0aWVzEiMub2xpdmV0aW4uYXBpLnYxLkdldEVudGl0aWVzUmVxdWVzdBokLm9saXZldGluLmFwaS52MS5HZXRFbnRpdGllc1Jlc3BvbnNlIgASSQoJR2V0RW50aXR5EiEub2xpdmV0aW4uYXBpLnYxLkdldEVudGl0eVJlcXVlc3QaFy5vbGl2ZXRpbi5hcGkudjEuRW50aXR5IgBCOFo2Z2l0aHViLmNvbS9PbGl2ZVRpbi9PbGl2ZVRpbi9nZW4vb2xpdmV0aW4vYXBpL3YxO2FwaXYxYgZwcm90bzM");
 
 /**
  * Describes the message olivetin.api.v1.Action.
@@ -66,509 +66,537 @@ export const EntitySchema = /*@__PURE__*/
 export const GetDashboardResponseSchema = /*@__PURE__*/
   messageDesc(file_olivetin_api_v1_olivetin, 7);
 
+/**
+ * Describes the message olivetin.api.v1.SearchHints.
+ * Use `create(SearchHintsSchema)` to create a new message.
+ */
+export const SearchHintsSchema = /*@__PURE__*/
+  messageDesc(file_olivetin_api_v1_olivetin, 8);
+
+/**
+ * Describes the message olivetin.api.v1.EntitySearchHint.
+ * Use `create(EntitySearchHintSchema)` to create a new message.
+ */
+export const EntitySearchHintSchema = /*@__PURE__*/
+  messageDesc(file_olivetin_api_v1_olivetin, 9);
+
+/**
+ * Describes the message olivetin.api.v1.ActionSearchHint.
+ * Use `create(ActionSearchHintSchema)` to create a new message.
+ */
+export const ActionSearchHintSchema = /*@__PURE__*/
+  messageDesc(file_olivetin_api_v1_olivetin, 10);
+
 /**
  * Describes the message olivetin.api.v1.EffectivePolicy.
  * Use `create(EffectivePolicySchema)` to create a new message.
  */
 export const EffectivePolicySchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 8);
+  messageDesc(file_olivetin_api_v1_olivetin, 11);
+
+/**
+ * Describes the message olivetin.api.v1.Features.
+ * Use `create(FeaturesSchema)` to create a new message.
+ */
+export const FeaturesSchema = /*@__PURE__*/
+  messageDesc(file_olivetin_api_v1_olivetin, 12);
 
 /**
  * Describes the message olivetin.api.v1.GetDashboardRequest.
  * Use `create(GetDashboardRequestSchema)` to create a new message.
  */
 export const GetDashboardRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 9);
+  messageDesc(file_olivetin_api_v1_olivetin, 13);
 
 /**
  * Describes the message olivetin.api.v1.Dashboard.
  * Use `create(DashboardSchema)` to create a new message.
  */
 export const DashboardSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 10);
+  messageDesc(file_olivetin_api_v1_olivetin, 14);
 
 /**
  * Describes the message olivetin.api.v1.DashboardComponent.
  * Use `create(DashboardComponentSchema)` to create a new message.
  */
 export const DashboardComponentSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 11);
+  messageDesc(file_olivetin_api_v1_olivetin, 15);
 
 /**
  * Describes the message olivetin.api.v1.StartActionRequest.
  * Use `create(StartActionRequestSchema)` to create a new message.
  */
 export const StartActionRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 12);
+  messageDesc(file_olivetin_api_v1_olivetin, 16);
 
 /**
  * Describes the message olivetin.api.v1.StartActionArgument.
  * Use `create(StartActionArgumentSchema)` to create a new message.
  */
 export const StartActionArgumentSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 13);
+  messageDesc(file_olivetin_api_v1_olivetin, 17);
 
 /**
  * Describes the message olivetin.api.v1.StartActionResponse.
  * Use `create(StartActionResponseSchema)` to create a new message.
  */
 export const StartActionResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 14);
+  messageDesc(file_olivetin_api_v1_olivetin, 18);
 
 /**
  * Describes the message olivetin.api.v1.StartActionAndWaitRequest.
  * Use `create(StartActionAndWaitRequestSchema)` to create a new message.
  */
 export const StartActionAndWaitRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 15);
+  messageDesc(file_olivetin_api_v1_olivetin, 19);
 
 /**
  * Describes the message olivetin.api.v1.StartActionAndWaitResponse.
  * Use `create(StartActionAndWaitResponseSchema)` to create a new message.
  */
 export const StartActionAndWaitResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 16);
+  messageDesc(file_olivetin_api_v1_olivetin, 20);
 
 /**
  * Describes the message olivetin.api.v1.StartActionByGetRequest.
  * Use `create(StartActionByGetRequestSchema)` to create a new message.
  */
 export const StartActionByGetRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 17);
+  messageDesc(file_olivetin_api_v1_olivetin, 21);
 
 /**
  * Describes the message olivetin.api.v1.StartActionByGetResponse.
  * Use `create(StartActionByGetResponseSchema)` to create a new message.
  */
 export const StartActionByGetResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 18);
+  messageDesc(file_olivetin_api_v1_olivetin, 22);
 
 /**
  * Describes the message olivetin.api.v1.StartActionByGetAndWaitRequest.
  * Use `create(StartActionByGetAndWaitRequestSchema)` to create a new message.
  */
 export const StartActionByGetAndWaitRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 19);
+  messageDesc(file_olivetin_api_v1_olivetin, 23);
 
 /**
  * Describes the message olivetin.api.v1.StartActionByGetAndWaitResponse.
  * Use `create(StartActionByGetAndWaitResponseSchema)` to create a new message.
  */
 export const StartActionByGetAndWaitResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 20);
+  messageDesc(file_olivetin_api_v1_olivetin, 24);
 
 /**
  * Describes the message olivetin.api.v1.GetLogsRequest.
  * Use `create(GetLogsRequestSchema)` to create a new message.
  */
 export const GetLogsRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 21);
+  messageDesc(file_olivetin_api_v1_olivetin, 25);
 
 /**
  * Describes the message olivetin.api.v1.LogEntry.
  * Use `create(LogEntrySchema)` to create a new message.
  */
 export const LogEntrySchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 22);
+  messageDesc(file_olivetin_api_v1_olivetin, 26);
 
 /**
  * Describes the message olivetin.api.v1.GetLogsResponse.
  * Use `create(GetLogsResponseSchema)` to create a new message.
  */
 export const GetLogsResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 23);
+  messageDesc(file_olivetin_api_v1_olivetin, 27);
 
 /**
  * Describes the message olivetin.api.v1.GetActionLogsRequest.
  * Use `create(GetActionLogsRequestSchema)` to create a new message.
  */
 export const GetActionLogsRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 24);
+  messageDesc(file_olivetin_api_v1_olivetin, 28);
 
 /**
  * Describes the message olivetin.api.v1.GetActionLogsResponse.
  * Use `create(GetActionLogsResponseSchema)` to create a new message.
  */
 export const GetActionLogsResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 25);
+  messageDesc(file_olivetin_api_v1_olivetin, 29);
 
 /**
  * Describes the message olivetin.api.v1.GetExecutionQueueRequest.
  * Use `create(GetExecutionQueueRequestSchema)` to create a new message.
  */
 export const GetExecutionQueueRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 26);
+  messageDesc(file_olivetin_api_v1_olivetin, 30);
 
 /**
  * Describes the message olivetin.api.v1.ExecutionQueueAction.
  * Use `create(ExecutionQueueActionSchema)` to create a new message.
  */
 export const ExecutionQueueActionSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 27);
+  messageDesc(file_olivetin_api_v1_olivetin, 31);
 
 /**
  * Describes the message olivetin.api.v1.ExecutionQueueGroup.
  * Use `create(ExecutionQueueGroupSchema)` to create a new message.
  */
 export const ExecutionQueueGroupSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 28);
+  messageDesc(file_olivetin_api_v1_olivetin, 32);
 
 /**
  * Describes the message olivetin.api.v1.GetExecutionQueueResponse.
  * Use `create(GetExecutionQueueResponseSchema)` to create a new message.
  */
 export const GetExecutionQueueResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 29);
+  messageDesc(file_olivetin_api_v1_olivetin, 33);
 
 /**
  * Describes the message olivetin.api.v1.ValidateArgumentTypeRequest.
  * Use `create(ValidateArgumentTypeRequestSchema)` to create a new message.
  */
 export const ValidateArgumentTypeRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 30);
+  messageDesc(file_olivetin_api_v1_olivetin, 34);
 
 /**
  * Describes the message olivetin.api.v1.ValidateArgumentTypeResponse.
  * Use `create(ValidateArgumentTypeResponseSchema)` to create a new message.
  */
 export const ValidateArgumentTypeResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 31);
+  messageDesc(file_olivetin_api_v1_olivetin, 35);
 
 /**
  * Describes the message olivetin.api.v1.WatchExecutionRequest.
  * Use `create(WatchExecutionRequestSchema)` to create a new message.
  */
 export const WatchExecutionRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 32);
+  messageDesc(file_olivetin_api_v1_olivetin, 36);
 
 /**
  * Describes the message olivetin.api.v1.WatchExecutionUpdate.
  * Use `create(WatchExecutionUpdateSchema)` to create a new message.
  */
 export const WatchExecutionUpdateSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 33);
+  messageDesc(file_olivetin_api_v1_olivetin, 37);
 
 /**
  * Describes the message olivetin.api.v1.ExecutionStatusRequest.
  * Use `create(ExecutionStatusRequestSchema)` to create a new message.
  */
 export const ExecutionStatusRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 34);
+  messageDesc(file_olivetin_api_v1_olivetin, 38);
 
 /**
  * Describes the message olivetin.api.v1.DashboardNavigationTarget.
  * Use `create(DashboardNavigationTargetSchema)` to create a new message.
  */
 export const DashboardNavigationTargetSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 35);
+  messageDesc(file_olivetin_api_v1_olivetin, 39);
 
 /**
  * Describes the message olivetin.api.v1.ExecutionStatusResponse.
  * Use `create(ExecutionStatusResponseSchema)` to create a new message.
  */
 export const ExecutionStatusResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 36);
+  messageDesc(file_olivetin_api_v1_olivetin, 40);
 
 /**
  * Describes the message olivetin.api.v1.WhoAmIRequest.
  * Use `create(WhoAmIRequestSchema)` to create a new message.
  */
 export const WhoAmIRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 37);
+  messageDesc(file_olivetin_api_v1_olivetin, 41);
 
 /**
  * Describes the message olivetin.api.v1.WhoAmIResponse.
  * Use `create(WhoAmIResponseSchema)` to create a new message.
  */
 export const WhoAmIResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 38);
+  messageDesc(file_olivetin_api_v1_olivetin, 42);
 
 /**
  * Describes the message olivetin.api.v1.ServerDiagnosticsRequest.
  * Use `create(ServerDiagnosticsRequestSchema)` to create a new message.
  */
 export const ServerDiagnosticsRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 39);
+  messageDesc(file_olivetin_api_v1_olivetin, 43);
 
 /**
  * Describes the message olivetin.api.v1.ServerDiagnosticsResponse.
  * Use `create(ServerDiagnosticsResponseSchema)` to create a new message.
  */
 export const ServerDiagnosticsResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 40);
+  messageDesc(file_olivetin_api_v1_olivetin, 44);
 
 /**
  * Describes the message olivetin.api.v1.DumpVarsRequest.
  * Use `create(DumpVarsRequestSchema)` to create a new message.
  */
 export const DumpVarsRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 41);
+  messageDesc(file_olivetin_api_v1_olivetin, 45);
 
 /**
  * Describes the message olivetin.api.v1.DumpVarsResponse.
  * Use `create(DumpVarsResponseSchema)` to create a new message.
  */
 export const DumpVarsResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 42);
+  messageDesc(file_olivetin_api_v1_olivetin, 46);
 
 /**
  * Describes the message olivetin.api.v1.DebugBinding.
  * Use `create(DebugBindingSchema)` to create a new message.
  */
 export const DebugBindingSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 43);
+  messageDesc(file_olivetin_api_v1_olivetin, 47);
 
 /**
  * Describes the message olivetin.api.v1.DumpPublicIdActionMapRequest.
  * Use `create(DumpPublicIdActionMapRequestSchema)` to create a new message.
  */
 export const DumpPublicIdActionMapRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 44);
+  messageDesc(file_olivetin_api_v1_olivetin, 48);
 
 /**
  * Describes the message olivetin.api.v1.DumpPublicIdActionMapResponse.
  * Use `create(DumpPublicIdActionMapResponseSchema)` to create a new message.
  */
 export const DumpPublicIdActionMapResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 45);
+  messageDesc(file_olivetin_api_v1_olivetin, 49);
 
 /**
  * Describes the message olivetin.api.v1.GetReadyzRequest.
  * Use `create(GetReadyzRequestSchema)` to create a new message.
  */
 export const GetReadyzRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 46);
+  messageDesc(file_olivetin_api_v1_olivetin, 50);
 
 /**
  * Describes the message olivetin.api.v1.GetReadyzResponse.
  * Use `create(GetReadyzResponseSchema)` to create a new message.
  */
 export const GetReadyzResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 47);
+  messageDesc(file_olivetin_api_v1_olivetin, 51);
 
 /**
  * Describes the message olivetin.api.v1.EventStreamRequest.
  * Use `create(EventStreamRequestSchema)` to create a new message.
  */
 export const EventStreamRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 48);
+  messageDesc(file_olivetin_api_v1_olivetin, 52);
 
 /**
  * Describes the message olivetin.api.v1.EventStreamResponse.
  * Use `create(EventStreamResponseSchema)` to create a new message.
  */
 export const EventStreamResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 49);
+  messageDesc(file_olivetin_api_v1_olivetin, 53);
 
 /**
  * Describes the message olivetin.api.v1.EventOutputChunk.
  * Use `create(EventOutputChunkSchema)` to create a new message.
  */
 export const EventOutputChunkSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 50);
+  messageDesc(file_olivetin_api_v1_olivetin, 54);
 
 /**
  * Describes the message olivetin.api.v1.EventEntityChanged.
  * Use `create(EventEntityChangedSchema)` to create a new message.
  */
 export const EventEntityChangedSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 51);
+  messageDesc(file_olivetin_api_v1_olivetin, 55);
 
 /**
  * Describes the message olivetin.api.v1.EventConfigChanged.
  * Use `create(EventConfigChangedSchema)` to create a new message.
  */
 export const EventConfigChangedSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 52);
+  messageDesc(file_olivetin_api_v1_olivetin, 56);
 
 /**
  * Describes the message olivetin.api.v1.EventHeartbeat.
  * Use `create(EventHeartbeatSchema)` to create a new message.
  */
 export const EventHeartbeatSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 53);
+  messageDesc(file_olivetin_api_v1_olivetin, 57);
 
 /**
  * Describes the message olivetin.api.v1.EventExecutionFinished.
  * Use `create(EventExecutionFinishedSchema)` to create a new message.
  */
 export const EventExecutionFinishedSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 54);
+  messageDesc(file_olivetin_api_v1_olivetin, 58);
 
 /**
  * Describes the message olivetin.api.v1.EventExecutionStarted.
  * Use `create(EventExecutionStartedSchema)` to create a new message.
  */
 export const EventExecutionStartedSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 55);
+  messageDesc(file_olivetin_api_v1_olivetin, 59);
 
 /**
  * Describes the message olivetin.api.v1.KillActionRequest.
  * Use `create(KillActionRequestSchema)` to create a new message.
  */
 export const KillActionRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 56);
+  messageDesc(file_olivetin_api_v1_olivetin, 60);
 
 /**
  * Describes the message olivetin.api.v1.KillActionResponse.
  * Use `create(KillActionResponseSchema)` to create a new message.
  */
 export const KillActionResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 57);
+  messageDesc(file_olivetin_api_v1_olivetin, 61);
 
 /**
  * Describes the message olivetin.api.v1.LocalUserLoginRequest.
  * Use `create(LocalUserLoginRequestSchema)` to create a new message.
  */
 export const LocalUserLoginRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 58);
+  messageDesc(file_olivetin_api_v1_olivetin, 62);
 
 /**
  * Describes the message olivetin.api.v1.LocalUserLoginResponse.
  * Use `create(LocalUserLoginResponseSchema)` to create a new message.
  */
 export const LocalUserLoginResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 59);
+  messageDesc(file_olivetin_api_v1_olivetin, 63);
 
 /**
  * Describes the message olivetin.api.v1.PasswordHashRequest.
  * Use `create(PasswordHashRequestSchema)` to create a new message.
  */
 export const PasswordHashRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 60);
+  messageDesc(file_olivetin_api_v1_olivetin, 64);
 
 /**
  * Describes the message olivetin.api.v1.PasswordHashResponse.
  * Use `create(PasswordHashResponseSchema)` to create a new message.
  */
 export const PasswordHashResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 61);
+  messageDesc(file_olivetin_api_v1_olivetin, 65);
 
 /**
  * Describes the message olivetin.api.v1.LogoutRequest.
  * Use `create(LogoutRequestSchema)` to create a new message.
  */
 export const LogoutRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 62);
+  messageDesc(file_olivetin_api_v1_olivetin, 66);
 
 /**
  * Describes the message olivetin.api.v1.LogoutResponse.
  * Use `create(LogoutResponseSchema)` to create a new message.
  */
 export const LogoutResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 63);
+  messageDesc(file_olivetin_api_v1_olivetin, 67);
 
 /**
  * Describes the message olivetin.api.v1.GetDiagnosticsRequest.
  * Use `create(GetDiagnosticsRequestSchema)` to create a new message.
  */
 export const GetDiagnosticsRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 64);
+  messageDesc(file_olivetin_api_v1_olivetin, 68);
 
 /**
  * Describes the message olivetin.api.v1.ConfigIssue.
  * Use `create(ConfigIssueSchema)` to create a new message.
  */
 export const ConfigIssueSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 65);
+  messageDesc(file_olivetin_api_v1_olivetin, 69);
 
 /**
  * Describes the message olivetin.api.v1.GetDiagnosticsResponse.
  * Use `create(GetDiagnosticsResponseSchema)` to create a new message.
  */
 export const GetDiagnosticsResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 66);
+  messageDesc(file_olivetin_api_v1_olivetin, 70);
 
 /**
  * Describes the message olivetin.api.v1.InitRequest.
  * Use `create(InitRequestSchema)` to create a new message.
  */
 export const InitRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 67);
+  messageDesc(file_olivetin_api_v1_olivetin, 71);
 
 /**
  * Describes the message olivetin.api.v1.InitResponse.
  * Use `create(InitResponseSchema)` to create a new message.
  */
 export const InitResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 68);
+  messageDesc(file_olivetin_api_v1_olivetin, 72);
 
 /**
  * Describes the message olivetin.api.v1.RootDashboard.
  * Use `create(RootDashboardSchema)` to create a new message.
  */
 export const RootDashboardSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 69);
+  messageDesc(file_olivetin_api_v1_olivetin, 73);
 
 /**
  * Describes the message olivetin.api.v1.AdditionalLink.
  * Use `create(AdditionalLinkSchema)` to create a new message.
  */
 export const AdditionalLinkSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 70);
+  messageDesc(file_olivetin_api_v1_olivetin, 74);
 
 /**
  * Describes the message olivetin.api.v1.OAuth2Provider.
  * Use `create(OAuth2ProviderSchema)` to create a new message.
  */
 export const OAuth2ProviderSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 71);
+  messageDesc(file_olivetin_api_v1_olivetin, 75);
 
 /**
  * Describes the message olivetin.api.v1.GetActionBindingRequest.
  * Use `create(GetActionBindingRequestSchema)` to create a new message.
  */
 export const GetActionBindingRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 72);
+  messageDesc(file_olivetin_api_v1_olivetin, 76);
 
 /**
  * Describes the message olivetin.api.v1.GetActionBindingResponse.
  * Use `create(GetActionBindingResponseSchema)` to create a new message.
  */
 export const GetActionBindingResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 73);
+  messageDesc(file_olivetin_api_v1_olivetin, 77);
 
 /**
  * Describes the message olivetin.api.v1.GetEntitiesRequest.
  * Use `create(GetEntitiesRequestSchema)` to create a new message.
  */
 export const GetEntitiesRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 74);
+  messageDesc(file_olivetin_api_v1_olivetin, 78);
 
 /**
  * Describes the message olivetin.api.v1.GetEntitiesResponse.
  * Use `create(GetEntitiesResponseSchema)` to create a new message.
  */
 export const GetEntitiesResponseSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 75);
+  messageDesc(file_olivetin_api_v1_olivetin, 79);
 
 /**
  * Describes the message olivetin.api.v1.EntityDefinition.
  * Use `create(EntityDefinitionSchema)` to create a new message.
  */
 export const EntityDefinitionSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 76);
+  messageDesc(file_olivetin_api_v1_olivetin, 80);
 
 /**
  * Describes the message olivetin.api.v1.EntityProperty.
  * Use `create(EntityPropertySchema)` to create a new message.
  */
 export const EntityPropertySchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 77);
+  messageDesc(file_olivetin_api_v1_olivetin, 81);
 
 /**
  * Describes the message olivetin.api.v1.GetEntityRequest.
  * Use `create(GetEntityRequestSchema)` to create a new message.
  */
 export const GetEntityRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 78);
+  messageDesc(file_olivetin_api_v1_olivetin, 82);
 
 /**
  * Describes the message olivetin.api.v1.RestartActionRequest.
  * Use `create(RestartActionRequestSchema)` to create a new message.
  */
 export const RestartActionRequestSchema = /*@__PURE__*/
-  messageDesc(file_olivetin_api_v1_olivetin, 79);
+  messageDesc(file_olivetin_api_v1_olivetin, 83);
 
 /**
  * @generated from service olivetin.api.v1.OliveTinApiService
diff --git a/frontend/resources/vue/App.vue b/frontend/resources/vue/App.vue
index 6ff12a21..f5ea4229 100644
--- a/frontend/resources/vue/App.vue
+++ b/frontend/resources/vue/App.vue
@@ -8,6 +8,14 @@
     @toggle-sidebar="toggleSidebar"
   >
     <template #toolbar>
+      <QuickSearch
+        v-if="!loginRequired && headerSearchEnabled"
+        :items="searchIndexItems"
+        :auto-import-routes="false"
+        :search-fields="['title', 'description', 'category']"
+        :max-results="15"
+        placeholder="Search actions, dashboards, entities…"
+      />
       <div
         v-if="bannerMessage"
         id="banner"
@@ -193,6 +201,7 @@ import { useRouter } from 'vue-router'
 import Sidebar from 'picocrank/vue/components/Sidebar.vue'
 import Navigation from 'picocrank/vue/components/Navigation.vue'
 import Header from 'picocrank/vue/components/Header.vue'
+import QuickSearch from 'picocrank/vue/components/QuickSearch.vue'
 import ConnectionBanner from './components/ConnectionBanner.vue'
 import { connectEventStreamIfNeeded } from '../../js/websocket.js'
 import { HugeiconsIcon } from '@hugeicons/vue'
@@ -200,6 +209,7 @@ import { UserCircle02Icon, DashboardSquare01Icon } from '@hugeicons/core-free-ic
 import logoUrl from '../../OliveTinLogo.png'
 import { useI18n } from 'vue-i18n'
 import combinedTranslations from '../../../lang/combined_output.json'
+import { searchIndexItems, clearSearchIndex, indexSystemNavigation, indexSearchHints, indexRootDashboardEntries } from './stores/searchIndex.js'
 const { t } = useI18n()
 
 const router = useRouter()
@@ -220,6 +230,8 @@ const showDiagnostics = ref(true)
 const showVersionNumber = ref(true)
 const showLoginLink = ref(true)
 const sectionNavigationStyle = ref('sidebar')
+const loginRequired = ref(false)
+const headerSearchEnabled = ref(false)
 
 const languageDialog = ref(null)
 const browserLanguages = ref([])
@@ -305,8 +317,15 @@ function updateHeaderFromInit () {
     return
   }
 
-  username.value = window.initResponse.authenticatedUser
-  isLoggedIn.value = window.initResponse.authenticatedUser !== '' && window.initResponse.authenticatedUser !== 'guest'
+  // Rebuild the in-memory search index from this Init; never persist it.
+  clearSearchIndex()
+
+  const authenticatedUser = window.initResponse.authenticatedUser
+  loginRequired.value = !!window.initResponse.loginRequired
+  headerSearchEnabled.value = !!window.initResponse.features?.headerSearch
+
+  username.value = authenticatedUser
+  isLoggedIn.value = authenticatedUser !== '' && authenticatedUser !== 'guest'
   currentVersion.value = window.initResponse.currentVersion
   pageTitle.value = window.initResponse.pageTitle || 'OliveTin'
   bannerMessage.value = window.initResponse.bannerMessage || ''
@@ -329,12 +348,17 @@ function updateHeaderFromInit () {
   renderNavigation()
   applyTheme()
 
-  if (window.initResponse.loginRequired) {
+  if (loginRequired.value) {
     connectEventStreamIfNeeded()
     router.push('/login')
     return
   }
 
+  if (headerSearchEnabled.value) {
+    indexSearchHints(window.initResponse.searchHints)
+    indexRootDashboardEntries(getRootDashboardEntries())
+  }
+
   connectEventStreamIfNeeded()
 }
 
@@ -433,6 +457,17 @@ function addSystemNavLinks () {
     })
   }
 
+  if (!loginRequired.value && headerSearchEnabled.value) {
+    indexRootDashboardEntries(getRootDashboardEntries())
+    indexSystemNavigation({
+      showLogs: showLogs.value,
+      showDiagnostics: showDiagnostics.value,
+      entitiesTitle: t('nav.entities'),
+      logsTitle: t('nav.logs'),
+      diagnosticsTitle: t('nav.diagnostics')
+    })
+  }
+
   if (systemLinks.length === 0) {
     return
   }
diff --git a/frontend/resources/vue/stores/searchIndex.js b/frontend/resources/vue/stores/searchIndex.js
new file mode 100644
index 00000000..55ad8b5c
--- /dev/null
+++ b/frontend/resources/vue/stores/searchIndex.js
@@ -0,0 +1,228 @@
+import { reactive, computed } from 'vue'
+import {
+  CellsIcon,
+  DashboardSquare01Icon,
+  LeftToRightListDashIcon,
+  PlayIcon,
+  Wrench01Icon
+} from '@hugeicons/core-free-icons'
+
+export const MAX_SEARCH_HINT_ACTIONS = 100
+export const MAX_SEARCH_HINT_DASHBOARDS = 100
+export const MAX_SEARCH_HINT_ENTITIES_PER_TYPE = 50
+
+const SOURCE_ENTITIES = 'entities'
+const SOURCE_ACTIONS = 'actions'
+const SOURCE_DASHBOARDS = 'dashboards'
+const SOURCE_NAVIGATION = 'navigation'
+
+// QuickSearch keeps insertion order; prefer entities over actions for equal matches.
+const CATEGORY_PRIORITY = {
+  Navigation: 0,
+  Dashboards: 1,
+  Entities: 2,
+  Actions: 3
+}
+
+const state = reactive({
+  itemsById: {},
+  sourceToIds: {}
+})
+
+export const searchIndexItems = computed(() => {
+  return Object.values(state.itemsById).sort((a, b) => {
+    return categoryPriority(a.category) - categoryPriority(b.category)
+  })
+})
+
+function categoryPriority (category) {
+  return CATEGORY_PRIORITY[category] ?? 50
+}
+
+export function clearSearchIndex () {
+  state.itemsById = {}
+  state.sourceToIds = {}
+}
+
+function replaceSource (source, items) {
+  const previousIds = state.sourceToIds[source] || []
+
+  for (const itemId of previousIds) {
+    delete state.itemsById[itemId]
+  }
+
+  const nextIds = []
+  for (const item of items) {
+    if (!item?.id) {
+      continue
+    }
+
+    state.itemsById[item.id] = item
+    nextIds.push(item.id)
+  }
+
+  state.sourceToIds[source] = nextIds
+}
+
+export function dashboardRoutePath (title, entityType, entityKey) {
+  if (!title) {
+    return '/'
+  }
+
+  if (title === 'Actions' && !entityType && !entityKey) {
+    return '/'
+  }
+
+  let path = `/dashboards/${title}`
+
+  if (entityType && entityKey) {
+    path += `/${entityType}/${entityKey}`
+  }
+
+  return path
+}
+
+/**
+ * Indexes search hints from Init (entities and actions).
+ * Dashboards are indexed separately from rootDashboardEntries.
+ */
+export function indexSearchHints (searchHints) {
+  replaceSource(SOURCE_ENTITIES, entityItemsFromHints(searchHints?.entities))
+  replaceSource(SOURCE_ACTIONS, actionItemsFromHints(searchHints?.actions))
+}
+
+/**
+ * Indexes dashboards from Init.rootDashboardEntries (already ACL-filtered).
+ */
+export function indexRootDashboardEntries (entries) {
+  replaceSource(SOURCE_DASHBOARDS, dashboardItemsFromRootEntries(entries))
+}
+
+function entityItemsFromHints (hints) {
+  if (!Array.isArray(hints)) {
+    return []
+  }
+
+  const countsByType = {}
+  const items = []
+
+  for (const hint of hints) {
+    if (!hint?.uniqueKey || !hint?.type) {
+      continue
+    }
+
+    const count = countsByType[hint.type] || 0
+    if (count >= MAX_SEARCH_HINT_ENTITIES_PER_TYPE) {
+      continue
+    }
+
+    countsByType[hint.type] = count + 1
+    items.push({
+      id: `entity:${hint.type}:${hint.uniqueKey}`,
+      title: hint.title || hint.uniqueKey,
+      description: hint.type,
+      category: 'Entities',
+      type: 'route',
+      path: `/entity-details/${hint.type}/${hint.uniqueKey}`,
+      icon: CellsIcon
+    })
+  }
+
+  return items
+}
+
+function actionItemsFromHints (hints) {
+  if (!Array.isArray(hints)) {
+    return []
+  }
+
+  const items = []
+  for (const hint of hints.slice(0, MAX_SEARCH_HINT_ACTIONS)) {
+    if (!hint?.bindingId) {
+      continue
+    }
+
+    items.push({
+      id: `action:${hint.bindingId}`,
+      title: hint.title || hint.bindingId,
+      category: 'Actions',
+      type: 'route',
+      path: `/action/${hint.bindingId}`,
+      icon: PlayIcon
+    })
+  }
+
+  return items
+}
+
+function dashboardItemsFromRootEntries (entries) {
+  if (!Array.isArray(entries)) {
+    return []
+  }
+
+  const items = []
+  for (const entry of entries.slice(0, MAX_SEARCH_HINT_DASHBOARDS)) {
+    if (!entry?.title) {
+      continue
+    }
+
+    const section = (entry.category || '').trim()
+
+    items.push({
+      id: `dashboard:${entry.title}`,
+      title: entry.title,
+      description: section,
+      category: 'Dashboards',
+      type: 'route',
+      path: dashboardRoutePath(entry.title),
+      icon: DashboardSquare01Icon
+    })
+  }
+
+  return items
+}
+
+/**
+ * Indexes system navigation destinations that the user can already reach from
+ * the sidebar, respecting Init visibility flags.
+ */
+export function indexSystemNavigation ({
+  showLogs = false,
+  showDiagnostics = false,
+  entitiesTitle = 'Entities',
+  logsTitle = 'Logs',
+  diagnosticsTitle = 'Diagnostics'
+} = {}) {
+  const items = [{
+    id: 'nav:entities',
+    title: entitiesTitle,
+    category: 'Navigation',
+    type: 'route',
+    path: '/entities',
+    icon: CellsIcon
+  }]
+
+  if (showLogs) {
+    items.push({
+      id: 'nav:logs',
+      title: logsTitle,
+      category: 'Navigation',
+      type: 'route',
+      path: '/logs',
+      icon: LeftToRightListDashIcon
+    })
+  }
+
+  if (showDiagnostics) {
+    items.push({
+      id: 'nav:diagnostics',
+      title: diagnosticsTitle,
+      category: 'Navigation',
+      type: 'route',
+      path: '/diagnostics',
+      icon: Wrench01Icon
+    })
+  }
+
+  replaceSource(SOURCE_NAVIGATION, items)
+}
diff --git a/frontend/resources/vue/stores/searchIndex.test.mjs b/frontend/resources/vue/stores/searchIndex.test.mjs
new file mode 100644
index 00000000..83f6979c
--- /dev/null
+++ b/frontend/resources/vue/stores/searchIndex.test.mjs
@@ -0,0 +1,197 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+
+import {
+  MAX_SEARCH_HINT_ACTIONS,
+  MAX_SEARCH_HINT_DASHBOARDS,
+  MAX_SEARCH_HINT_ENTITIES_PER_TYPE,
+  clearSearchIndex,
+  dashboardRoutePath,
+  indexRootDashboardEntries,
+  indexSearchHints,
+  indexSystemNavigation,
+  searchIndexItems
+} from '../stores/searchIndex.js'
+
+function resetIndex () {
+  clearSearchIndex()
+}
+
+test('dashboardRoutePath maps Actions to root', () => {
+  assert.equal(dashboardRoutePath('Actions'), '/')
+})
+
+test('dashboardRoutePath builds dashboard and entity paths', () => {
+  assert.equal(dashboardRoutePath('Servers'), '/dashboards/Servers')
+  assert.equal(
+    dashboardRoutePath('Servers', 'host', 'web01'),
+    '/dashboards/Servers/host/web01'
+  )
+})
+
+test('indexSearchHints indexes entities and actions', () => {
+  resetIndex()
+
+  indexSearchHints({
+    entities: [
+      { title: 'web01', type: 'host', uniqueKey: '0' },
+      { title: '', type: 'host', uniqueKey: '1' },
+      { title: 'skip', type: '', uniqueKey: 'x' }
+    ],
+    actions: [
+      { title: 'Ping Host', bindingId: 'bind-ping' },
+      { title: '', bindingId: 'bind-empty-title' },
+      { title: 'Ignored', bindingId: '' }
+    ]
+  })
+
+  const byId = Object.fromEntries(searchIndexItems.value.map((item) => [item.id, item]))
+
+  assert.equal(byId['entity:host:0'].title, 'web01')
+  assert.equal(byId['entity:host:0'].path, '/entity-details/host/0')
+  assert.equal(byId['entity:host:0'].description, 'host')
+  assert.equal(byId['entity:host:1'].title, '1')
+
+  assert.equal(byId['action:bind-ping'].title, 'Ping Host')
+  assert.equal(byId['action:bind-ping'].path, '/action/bind-ping')
+  assert.equal(byId['action:bind-ping'].category, 'Actions')
+  assert.equal(byId['action:bind-empty-title'].title, 'bind-empty-title')
+
+  assert.equal(Object.keys(byId).includes('entity:host:x'), false)
+  assert.equal(Object.keys(byId).includes('action:'), false)
+})
+
+test('indexRootDashboardEntries indexes ACL-filtered dashboards', () => {
+  resetIndex()
+
+  indexRootDashboardEntries([
+    { title: 'Actions', category: '' },
+    { title: 'My Server', category: 'Infrastructure' },
+    { title: '', category: 'Ignored' }
+  ])
+
+  const byId = Object.fromEntries(searchIndexItems.value.map((item) => [item.id, item]))
+  assert.equal(byId['dashboard:Actions'].path, '/')
+  assert.equal(byId['dashboard:My Server'].path, '/dashboards/My Server')
+  assert.equal(byId['dashboard:My Server'].description, 'Infrastructure')
+  assert.equal(byId['dashboard:My Server'].category, 'Dashboards')
+})
+
+test('indexSearchHints replaces prior entity and action snapshots', () => {
+  resetIndex()
+
+  indexSearchHints({
+    entities: [{ title: 'old', type: 'host', uniqueKey: 'old' }],
+    actions: [{ title: 'Old Action', bindingId: 'old-action' }]
+  })
+  indexRootDashboardEntries([{ title: 'Old Board', category: '' }])
+
+  indexSearchHints({
+    entities: [{ title: 'new', type: 'host', uniqueKey: 'new' }],
+    actions: [{ title: 'New Action', bindingId: 'new-action' }]
+  })
+  indexRootDashboardEntries([{ title: 'New Board', category: 'Ops' }])
+
+  const byId = Object.fromEntries(searchIndexItems.value.map((item) => [item.id, item]))
+  assert.equal(byId['entity:host:old'], undefined)
+  assert.equal(byId['action:old-action'], undefined)
+  assert.equal(byId['dashboard:Old Board'], undefined)
+  assert.equal(byId['entity:host:new'].title, 'new')
+  assert.equal(byId['action:new-action'].title, 'New Action')
+  assert.equal(byId['dashboard:New Board'].description, 'Ops')
+})
+
+test('caps actions globally, entities per type, and dashboards from root entries', () => {
+  resetIndex()
+
+  const actions = []
+  for (let i = 0; i < MAX_SEARCH_HINT_ACTIONS + 20; i++) {
+    actions.push({ title: `Action ${i}`, bindingId: `a-${i}` })
+  }
+
+  const entities = []
+  for (let i = 0; i < MAX_SEARCH_HINT_ENTITIES_PER_TYPE + 20; i++) {
+    entities.push({ title: `Host ${i}`, type: 'host', uniqueKey: `${i}` })
+    entities.push({ title: `Container ${i}`, type: 'container', uniqueKey: `${i}` })
+  }
+
+  const dashboards = []
+  for (let i = 0; i < MAX_SEARCH_HINT_DASHBOARDS + 20; i++) {
+    dashboards.push({ title: `Board ${i}`, category: '' })
+  }
+
+  indexSearchHints({ actions, entities })
+  indexRootDashboardEntries(dashboards)
+
+  const items = searchIndexItems.value
+  assert.equal(items.filter((item) => item.category === 'Actions').length, MAX_SEARCH_HINT_ACTIONS)
+  assert.equal(items.filter((item) => item.category === 'Dashboards').length, MAX_SEARCH_HINT_DASHBOARDS)
+  assert.equal(
+    items.filter((item) => item.category === 'Entities' && item.description === 'host').length,
+    MAX_SEARCH_HINT_ENTITIES_PER_TYPE
+  )
+  assert.equal(
+    items.filter((item) => item.category === 'Entities' && item.description === 'container').length,
+    MAX_SEARCH_HINT_ENTITIES_PER_TYPE
+  )
+})
+
+test('indexSystemNavigation always includes entities and respects visibility flags', () => {
+  resetIndex()
+
+  indexSystemNavigation({
+    showLogs: true,
+    showDiagnostics: false,
+    entitiesTitle: 'Entities',
+    logsTitle: 'Logs',
+    diagnosticsTitle: 'Diagnostics'
+  })
+
+  let byId = Object.fromEntries(searchIndexItems.value.map((item) => [item.id, item]))
+  assert.equal(byId['nav:entities'].path, '/entities')
+  assert.equal(byId['nav:logs'].path, '/logs')
+  assert.equal(byId['nav:diagnostics'], undefined)
+
+  indexSystemNavigation({
+    showLogs: false,
+    showDiagnostics: true
+  })
+
+  byId = Object.fromEntries(searchIndexItems.value.map((item) => [item.id, item]))
+  assert.equal(byId['nav:entities'].path, '/entities')
+  assert.equal(byId['nav:logs'], undefined)
+  assert.equal(byId['nav:diagnostics'].path, '/diagnostics')
+})
+
+test('entities appear before actions in searchIndexItems', () => {
+  resetIndex()
+
+  indexSearchHints({
+    entities: [{ title: 'server1', type: 'host', uniqueKey: '0' }],
+    actions: [{ title: 'server1', bindingId: 'bind-server1' }]
+  })
+
+  const titlesByCategory = searchIndexItems.value.map((item) => [item.category, item.title])
+  const entityIndex = titlesByCategory.findIndex(([category]) => category === 'Entities')
+  const actionIndex = titlesByCategory.findIndex(([category]) => category === 'Actions')
+
+  assert.ok(entityIndex >= 0)
+  assert.ok(actionIndex >= 0)
+  assert.ok(entityIndex < actionIndex)
+})
+
+test('search index has no Logs category', () => {
+  resetIndex()
+
+  indexSearchHints({
+    entities: [{ title: 'web01', type: 'host', uniqueKey: '0' }],
+    actions: [{ title: 'Backup', bindingId: 'bind-backup' }]
+  })
+  indexRootDashboardEntries([{ title: 'Ops', category: '' }])
+  indexSystemNavigation({ showLogs: true, showDiagnostics: true })
+
+  assert.equal(
+    searchIndexItems.value.some((item) => item.category === 'Logs'),
+    false
+  )
+})
diff --git a/frontend/resources/vue/views/EntitiesView.vue b/frontend/resources/vue/views/EntitiesView.vue
index 20d268d0..dd1b56f8 100644
--- a/frontend/resources/vue/views/EntitiesView.vue
+++ b/frontend/resources/vue/views/EntitiesView.vue
@@ -24,7 +24,6 @@
 import { ref, computed, onMounted } from 'vue'
 import Section from 'picocrank/vue/components/Section.vue'
 import EntityDefinitionSection from '../components/EntityDefinitionSection.vue'
-
 const definitionsLoaded = ref(false)
 const entityDefinitions = ref([])
 
diff --git a/frontend/resources/vue/views/LogsCalendarView.vue b/frontend/resources/vue/views/LogsCalendarView.vue
index ceb0b811..b1f6efed 100644
--- a/frontend/resources/vue/views/LogsCalendarView.vue
+++ b/frontend/resources/vue/views/LogsCalendarView.vue
@@ -45,7 +45,6 @@ import { useI18n } from 'vue-i18n'
 import Calendar from 'picocrank/vue/components/Calendar.vue'
 import Section from 'picocrank/vue/components/Section.vue'
 import { loadStoredLogsFilter } from '../utils/logsFilterStorage.js'
-
 const router = useRouter()
 const { t } = useI18n()
 
diff --git a/frontend/resources/vue/views/LogsListView.vue b/frontend/resources/vue/views/LogsListView.vue
index bbeeaaf7..5b21da90 100644
--- a/frontend/resources/vue/views/LogsListView.vue
+++ b/frontend/resources/vue/views/LogsListView.vue
@@ -222,7 +222,6 @@ import ActionIconGlyph from '../components/ActionIconGlyph.vue'
 import LogActionTitle from '../components/LogActionTitle.vue'
 import { getExecutionLogEntry, updateLogEntryInList } from '../utils/executionLogEvents.js'
 import { loadStoredLogsFilter, storeLogsFilter } from '../utils/logsFilterStorage.js'
-
 const route = useRoute()
 const router = useRouter()
 
diff --git a/proto/olivetin/api/v1/olivetin.proto b/proto/olivetin/api/v1/olivetin.proto
index ab86b04d..9aa08f36 100644
--- a/proto/olivetin/api/v1/olivetin.proto
+++ b/proto/olivetin/api/v1/olivetin.proto
@@ -79,12 +79,36 @@ message GetDashboardResponse {
 	Dashboard dashboard = 4;
 }
 
+message SearchHints {
+	// Lightweight titles for client search only. Omits fields, icons, and payloads.
+	// Dashboards are not included; clients index Init.root_dashboard_entries instead.
+	repeated EntitySearchHint entities = 1;
+	repeated ActionSearchHint actions = 2;
+}
+
+message EntitySearchHint {
+	string title = 1;
+	string type = 2;
+	string unique_key = 3;
+}
+
+message ActionSearchHint {
+	string title = 1;
+	string binding_id = 2;
+}
+
 message EffectivePolicy {
 	bool show_diagnostics = 1;
 	bool show_log_list = 2;
 	bool show_version_number = 3;
 }
 
+// Features are global opt-in flags from config.yaml features.*.
+// All flags default to false and gate alpha / experimental functionality.
+message Features {
+	bool header_search = 1;
+}
+
 message GetDashboardRequest {
 	string title = 1;
 	string entity_type = 2;
@@ -426,6 +450,12 @@ message InitResponse {
 	bool show_navigate_on_start_icons = 25;
 	int32 config_issue_count = 26;
 	repeated RootDashboard root_dashboard_entries = 27;
+	// Client-side search index hints. Omitted when login is required
+	// or features.header_search is false.
+	// Entities match GetEntities visibility; actions use view ACL.
+	// Dashboards are indexed client-side from root_dashboard_entries.
+	SearchHints search_hints = 28;
+	Features features = 29;
 }
 
 message RootDashboard {
diff --git a/service/gen/olivetin/api/v1/olivetin.pb.go b/service/gen/olivetin/api/v1/olivetin.pb.go
index a3da7f47..3e7f6458 100644
--- a/service/gen/olivetin/api/v1/olivetin.pb.go
+++ b/service/gen/olivetin/api/v1/olivetin.pb.go
@@ -685,6 +685,172 @@ func (x *GetDashboardResponse) GetDashboard() *Dashboard {
 	return nil
 }
 
+type SearchHints struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Lightweight titles for client search only. Omits fields, icons, and payloads.
+	// Dashboards are not included; clients index Init.root_dashboard_entries instead.
+	Entities      []*EntitySearchHint `protobuf:"bytes,1,rep,name=entities,proto3" json:"entities,omitempty"`
+	Actions       []*ActionSearchHint `protobuf:"bytes,2,rep,name=actions,proto3" json:"actions,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SearchHints) Reset() {
+	*x = SearchHints{}
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SearchHints) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SearchHints) ProtoMessage() {}
+
+func (x *SearchHints) ProtoReflect() protoreflect.Message {
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SearchHints.ProtoReflect.Descriptor instead.
+func (*SearchHints) Descriptor() ([]byte, []int) {
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *SearchHints) GetEntities() []*EntitySearchHint {
+	if x != nil {
+		return x.Entities
+	}
+	return nil
+}
+
+func (x *SearchHints) GetActions() []*ActionSearchHint {
+	if x != nil {
+		return x.Actions
+	}
+	return nil
+}
+
+type EntitySearchHint struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Title         string                 `protobuf:"bytes,1,opt,name=title,proto3" json:"title,omitempty"`
+	Type          string                 `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`
+	UniqueKey     string                 `protobuf:"bytes,3,opt,name=unique_key,json=uniqueKey,proto3" json:"unique_key,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *EntitySearchHint) Reset() {
+	*x = EntitySearchHint{}
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *EntitySearchHint) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EntitySearchHint) ProtoMessage() {}
+
+func (x *EntitySearchHint) ProtoReflect() protoreflect.Message {
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EntitySearchHint.ProtoReflect.Descriptor instead.
+func (*EntitySearchHint) Descriptor() ([]byte, []int) {
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *EntitySearchHint) GetTitle() string {
+	if x != nil {
+		return x.Title
+	}
+	return ""
+}
+
+func (x *EntitySearchHint) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *EntitySearchHint) GetUniqueKey() string {
+	if x != nil {
+		return x.UniqueKey
+	}
+	return ""
+}
+
+type ActionSearchHint struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Title         string                 `protobuf:"bytes,1,opt,name=title,proto3" json:"title,omitempty"`
+	BindingId     string                 `protobuf:"bytes,2,opt,name=binding_id,json=bindingId,proto3" json:"binding_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ActionSearchHint) Reset() {
+	*x = ActionSearchHint{}
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ActionSearchHint) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ActionSearchHint) ProtoMessage() {}
+
+func (x *ActionSearchHint) ProtoReflect() protoreflect.Message {
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ActionSearchHint.ProtoReflect.Descriptor instead.
+func (*ActionSearchHint) Descriptor() ([]byte, []int) {
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *ActionSearchHint) GetTitle() string {
+	if x != nil {
+		return x.Title
+	}
+	return ""
+}
+
+func (x *ActionSearchHint) GetBindingId() string {
+	if x != nil {
+		return x.BindingId
+	}
+	return ""
+}
+
 type EffectivePolicy struct {
 	state             protoimpl.MessageState `protogen:"open.v1"`
 	ShowDiagnostics   bool                   `protobuf:"varint,1,opt,name=show_diagnostics,json=showDiagnostics,proto3" json:"show_diagnostics,omitempty"`
@@ -696,7 +862,7 @@ type EffectivePolicy struct {
 
 func (x *EffectivePolicy) Reset() {
 	*x = EffectivePolicy{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[8]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -708,7 +874,7 @@ func (x *EffectivePolicy) String() string {
 func (*EffectivePolicy) ProtoMessage() {}
 
 func (x *EffectivePolicy) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[8]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -721,7 +887,7 @@ func (x *EffectivePolicy) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EffectivePolicy.ProtoReflect.Descriptor instead.
 func (*EffectivePolicy) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{8}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *EffectivePolicy) GetShowDiagnostics() bool {
@@ -745,6 +911,52 @@ func (x *EffectivePolicy) GetShowVersionNumber() bool {
 	return false
 }
 
+// Features are global opt-in flags from config.yaml features.*.
+// All flags default to false and gate alpha / experimental functionality.
+type Features struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	HeaderSearch  bool                   `protobuf:"varint,1,opt,name=header_search,json=headerSearch,proto3" json:"header_search,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Features) Reset() {
+	*x = Features{}
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Features) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Features) ProtoMessage() {}
+
+func (x *Features) ProtoReflect() protoreflect.Message {
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[12]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Features.ProtoReflect.Descriptor instead.
+func (*Features) Descriptor() ([]byte, []int) {
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *Features) GetHeaderSearch() bool {
+	if x != nil {
+		return x.HeaderSearch
+	}
+	return false
+}
+
 type GetDashboardRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Title         string                 `protobuf:"bytes,1,opt,name=title,proto3" json:"title,omitempty"`
@@ -756,7 +968,7 @@ type GetDashboardRequest struct {
 
 func (x *GetDashboardRequest) Reset() {
 	*x = GetDashboardRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[9]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -768,7 +980,7 @@ func (x *GetDashboardRequest) String() string {
 func (*GetDashboardRequest) ProtoMessage() {}
 
 func (x *GetDashboardRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[9]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -781,7 +993,7 @@ func (x *GetDashboardRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetDashboardRequest.ProtoReflect.Descriptor instead.
 func (*GetDashboardRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{9}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *GetDashboardRequest) GetTitle() string {
@@ -815,7 +1027,7 @@ type Dashboard struct {
 
 func (x *Dashboard) Reset() {
 	*x = Dashboard{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[10]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -827,7 +1039,7 @@ func (x *Dashboard) String() string {
 func (*Dashboard) ProtoMessage() {}
 
 func (x *Dashboard) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[10]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -840,7 +1052,7 @@ func (x *Dashboard) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Dashboard.ProtoReflect.Descriptor instead.
 func (*Dashboard) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{10}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *Dashboard) GetTitle() string {
@@ -873,7 +1085,7 @@ type DashboardComponent struct {
 
 func (x *DashboardComponent) Reset() {
 	*x = DashboardComponent{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[11]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -885,7 +1097,7 @@ func (x *DashboardComponent) String() string {
 func (*DashboardComponent) ProtoMessage() {}
 
 func (x *DashboardComponent) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[11]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -898,7 +1110,7 @@ func (x *DashboardComponent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DashboardComponent.ProtoReflect.Descriptor instead.
 func (*DashboardComponent) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{11}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *DashboardComponent) GetTitle() string {
@@ -969,7 +1181,7 @@ type StartActionRequest struct {
 
 func (x *StartActionRequest) Reset() {
 	*x = StartActionRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[12]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -981,7 +1193,7 @@ func (x *StartActionRequest) String() string {
 func (*StartActionRequest) ProtoMessage() {}
 
 func (x *StartActionRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[12]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -994,7 +1206,7 @@ func (x *StartActionRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartActionRequest.ProtoReflect.Descriptor instead.
 func (*StartActionRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{12}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *StartActionRequest) GetBindingId() string {
@@ -1035,7 +1247,7 @@ type StartActionArgument struct {
 
 func (x *StartActionArgument) Reset() {
 	*x = StartActionArgument{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[13]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1047,7 +1259,7 @@ func (x *StartActionArgument) String() string {
 func (*StartActionArgument) ProtoMessage() {}
 
 func (x *StartActionArgument) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[13]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1060,7 +1272,7 @@ func (x *StartActionArgument) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartActionArgument.ProtoReflect.Descriptor instead.
 func (*StartActionArgument) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{13}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *StartActionArgument) GetName() string {
@@ -1086,7 +1298,7 @@ type StartActionResponse struct {
 
 func (x *StartActionResponse) Reset() {
 	*x = StartActionResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[14]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1098,7 +1310,7 @@ func (x *StartActionResponse) String() string {
 func (*StartActionResponse) ProtoMessage() {}
 
 func (x *StartActionResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[14]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1111,7 +1323,7 @@ func (x *StartActionResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartActionResponse.ProtoReflect.Descriptor instead.
 func (*StartActionResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{14}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *StartActionResponse) GetExecutionTrackingId() string {
@@ -1132,7 +1344,7 @@ type StartActionAndWaitRequest struct {
 
 func (x *StartActionAndWaitRequest) Reset() {
 	*x = StartActionAndWaitRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[15]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1144,7 +1356,7 @@ func (x *StartActionAndWaitRequest) String() string {
 func (*StartActionAndWaitRequest) ProtoMessage() {}
 
 func (x *StartActionAndWaitRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[15]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1157,7 +1369,7 @@ func (x *StartActionAndWaitRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartActionAndWaitRequest.ProtoReflect.Descriptor instead.
 func (*StartActionAndWaitRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{15}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *StartActionAndWaitRequest) GetActionId() string {
@@ -1190,7 +1402,7 @@ type StartActionAndWaitResponse struct {
 
 func (x *StartActionAndWaitResponse) Reset() {
 	*x = StartActionAndWaitResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[16]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1202,7 +1414,7 @@ func (x *StartActionAndWaitResponse) String() string {
 func (*StartActionAndWaitResponse) ProtoMessage() {}
 
 func (x *StartActionAndWaitResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[16]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1215,7 +1427,7 @@ func (x *StartActionAndWaitResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartActionAndWaitResponse.ProtoReflect.Descriptor instead.
 func (*StartActionAndWaitResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{16}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *StartActionAndWaitResponse) GetLogEntry() *LogEntry {
@@ -1234,7 +1446,7 @@ type StartActionByGetRequest struct {
 
 func (x *StartActionByGetRequest) Reset() {
 	*x = StartActionByGetRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[17]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1246,7 +1458,7 @@ func (x *StartActionByGetRequest) String() string {
 func (*StartActionByGetRequest) ProtoMessage() {}
 
 func (x *StartActionByGetRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[17]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1259,7 +1471,7 @@ func (x *StartActionByGetRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartActionByGetRequest.ProtoReflect.Descriptor instead.
 func (*StartActionByGetRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{17}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *StartActionByGetRequest) GetActionId() string {
@@ -1278,7 +1490,7 @@ type StartActionByGetResponse struct {
 
 func (x *StartActionByGetResponse) Reset() {
 	*x = StartActionByGetResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[18]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1290,7 +1502,7 @@ func (x *StartActionByGetResponse) String() string {
 func (*StartActionByGetResponse) ProtoMessage() {}
 
 func (x *StartActionByGetResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[18]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1303,7 +1515,7 @@ func (x *StartActionByGetResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartActionByGetResponse.ProtoReflect.Descriptor instead.
 func (*StartActionByGetResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{18}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *StartActionByGetResponse) GetExecutionTrackingId() string {
@@ -1322,7 +1534,7 @@ type StartActionByGetAndWaitRequest struct {
 
 func (x *StartActionByGetAndWaitRequest) Reset() {
 	*x = StartActionByGetAndWaitRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[19]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1334,7 +1546,7 @@ func (x *StartActionByGetAndWaitRequest) String() string {
 func (*StartActionByGetAndWaitRequest) ProtoMessage() {}
 
 func (x *StartActionByGetAndWaitRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[19]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1347,7 +1559,7 @@ func (x *StartActionByGetAndWaitRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartActionByGetAndWaitRequest.ProtoReflect.Descriptor instead.
 func (*StartActionByGetAndWaitRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{19}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *StartActionByGetAndWaitRequest) GetActionId() string {
@@ -1366,7 +1578,7 @@ type StartActionByGetAndWaitResponse struct {
 
 func (x *StartActionByGetAndWaitResponse) Reset() {
 	*x = StartActionByGetAndWaitResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[20]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1378,7 +1590,7 @@ func (x *StartActionByGetAndWaitResponse) String() string {
 func (*StartActionByGetAndWaitResponse) ProtoMessage() {}
 
 func (x *StartActionByGetAndWaitResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[20]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1391,7 +1603,7 @@ func (x *StartActionByGetAndWaitResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartActionByGetAndWaitResponse.ProtoReflect.Descriptor instead.
 func (*StartActionByGetAndWaitResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{20}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *StartActionByGetAndWaitResponse) GetLogEntry() *LogEntry {
@@ -1413,7 +1625,7 @@ type GetLogsRequest struct {
 
 func (x *GetLogsRequest) Reset() {
 	*x = GetLogsRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[21]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1425,7 +1637,7 @@ func (x *GetLogsRequest) String() string {
 func (*GetLogsRequest) ProtoMessage() {}
 
 func (x *GetLogsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[21]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1438,7 +1650,7 @@ func (x *GetLogsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetLogsRequest.ProtoReflect.Descriptor instead.
 func (*GetLogsRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{21}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *GetLogsRequest) GetStartOffset() int64 {
@@ -1499,7 +1711,7 @@ type LogEntry struct {
 
 func (x *LogEntry) Reset() {
 	*x = LogEntry{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[22]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1511,7 +1723,7 @@ func (x *LogEntry) String() string {
 func (*LogEntry) ProtoMessage() {}
 
 func (x *LogEntry) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[22]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1524,7 +1736,7 @@ func (x *LogEntry) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LogEntry.ProtoReflect.Descriptor instead.
 func (*LogEntry) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{22}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *LogEntry) GetDatetimeStarted() string {
@@ -1694,7 +1906,7 @@ type GetLogsResponse struct {
 
 func (x *GetLogsResponse) Reset() {
 	*x = GetLogsResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[23]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1706,7 +1918,7 @@ func (x *GetLogsResponse) String() string {
 func (*GetLogsResponse) ProtoMessage() {}
 
 func (x *GetLogsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[23]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1719,7 +1931,7 @@ func (x *GetLogsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetLogsResponse.ProtoReflect.Descriptor instead.
 func (*GetLogsResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{23}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *GetLogsResponse) GetLogs() []*LogEntry {
@@ -1767,7 +1979,7 @@ type GetActionLogsRequest struct {
 
 func (x *GetActionLogsRequest) Reset() {
 	*x = GetActionLogsRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[24]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[28]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1779,7 +1991,7 @@ func (x *GetActionLogsRequest) String() string {
 func (*GetActionLogsRequest) ProtoMessage() {}
 
 func (x *GetActionLogsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[24]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[28]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1792,7 +2004,7 @@ func (x *GetActionLogsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetActionLogsRequest.ProtoReflect.Descriptor instead.
 func (*GetActionLogsRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{24}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *GetActionLogsRequest) GetActionId() string {
@@ -1822,7 +2034,7 @@ type GetActionLogsResponse struct {
 
 func (x *GetActionLogsResponse) Reset() {
 	*x = GetActionLogsResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[25]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[29]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1834,7 +2046,7 @@ func (x *GetActionLogsResponse) String() string {
 func (*GetActionLogsResponse) ProtoMessage() {}
 
 func (x *GetActionLogsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[25]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[29]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1847,7 +2059,7 @@ func (x *GetActionLogsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetActionLogsResponse.ProtoReflect.Descriptor instead.
 func (*GetActionLogsResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{25}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{29}
 }
 
 func (x *GetActionLogsResponse) GetLogs() []*LogEntry {
@@ -1893,7 +2105,7 @@ type GetExecutionQueueRequest struct {
 
 func (x *GetExecutionQueueRequest) Reset() {
 	*x = GetExecutionQueueRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[26]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[30]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1905,7 +2117,7 @@ func (x *GetExecutionQueueRequest) String() string {
 func (*GetExecutionQueueRequest) ProtoMessage() {}
 
 func (x *GetExecutionQueueRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[26]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[30]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1918,7 +2130,7 @@ func (x *GetExecutionQueueRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetExecutionQueueRequest.ProtoReflect.Descriptor instead.
 func (*GetExecutionQueueRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{26}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{30}
 }
 
 type ExecutionQueueAction struct {
@@ -1936,7 +2148,7 @@ type ExecutionQueueAction struct {
 
 func (x *ExecutionQueueAction) Reset() {
 	*x = ExecutionQueueAction{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[27]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[31]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1948,7 +2160,7 @@ func (x *ExecutionQueueAction) String() string {
 func (*ExecutionQueueAction) ProtoMessage() {}
 
 func (x *ExecutionQueueAction) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[27]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[31]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1961,7 +2173,7 @@ func (x *ExecutionQueueAction) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExecutionQueueAction.ProtoReflect.Descriptor instead.
 func (*ExecutionQueueAction) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{27}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{31}
 }
 
 func (x *ExecutionQueueAction) GetBindingId() string {
@@ -2028,7 +2240,7 @@ type ExecutionQueueGroup struct {
 
 func (x *ExecutionQueueGroup) Reset() {
 	*x = ExecutionQueueGroup{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[28]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[32]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2040,7 +2252,7 @@ func (x *ExecutionQueueGroup) String() string {
 func (*ExecutionQueueGroup) ProtoMessage() {}
 
 func (x *ExecutionQueueGroup) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[28]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[32]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2053,7 +2265,7 @@ func (x *ExecutionQueueGroup) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExecutionQueueGroup.ProtoReflect.Descriptor instead.
 func (*ExecutionQueueGroup) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{28}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{32}
 }
 
 func (x *ExecutionQueueGroup) GetName() string {
@@ -2115,7 +2327,7 @@ type GetExecutionQueueResponse struct {
 
 func (x *GetExecutionQueueResponse) Reset() {
 	*x = GetExecutionQueueResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[29]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[33]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2127,7 +2339,7 @@ func (x *GetExecutionQueueResponse) String() string {
 func (*GetExecutionQueueResponse) ProtoMessage() {}
 
 func (x *GetExecutionQueueResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[29]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[33]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2140,7 +2352,7 @@ func (x *GetExecutionQueueResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetExecutionQueueResponse.ProtoReflect.Descriptor instead.
 func (*GetExecutionQueueResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{29}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{33}
 }
 
 func (x *GetExecutionQueueResponse) GetGroups() []*ExecutionQueueGroup {
@@ -2169,7 +2381,7 @@ type ValidateArgumentTypeRequest struct {
 
 func (x *ValidateArgumentTypeRequest) Reset() {
 	*x = ValidateArgumentTypeRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[30]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[34]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2181,7 +2393,7 @@ func (x *ValidateArgumentTypeRequest) String() string {
 func (*ValidateArgumentTypeRequest) ProtoMessage() {}
 
 func (x *ValidateArgumentTypeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[30]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[34]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2194,7 +2406,7 @@ func (x *ValidateArgumentTypeRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateArgumentTypeRequest.ProtoReflect.Descriptor instead.
 func (*ValidateArgumentTypeRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{30}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{34}
 }
 
 func (x *ValidateArgumentTypeRequest) GetValue() string {
@@ -2235,7 +2447,7 @@ type ValidateArgumentTypeResponse struct {
 
 func (x *ValidateArgumentTypeResponse) Reset() {
 	*x = ValidateArgumentTypeResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[31]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[35]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2247,7 +2459,7 @@ func (x *ValidateArgumentTypeResponse) String() string {
 func (*ValidateArgumentTypeResponse) ProtoMessage() {}
 
 func (x *ValidateArgumentTypeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[31]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[35]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2260,7 +2472,7 @@ func (x *ValidateArgumentTypeResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateArgumentTypeResponse.ProtoReflect.Descriptor instead.
 func (*ValidateArgumentTypeResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{31}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{35}
 }
 
 func (x *ValidateArgumentTypeResponse) GetValid() bool {
@@ -2286,7 +2498,7 @@ type WatchExecutionRequest struct {
 
 func (x *WatchExecutionRequest) Reset() {
 	*x = WatchExecutionRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[32]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[36]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2298,7 +2510,7 @@ func (x *WatchExecutionRequest) String() string {
 func (*WatchExecutionRequest) ProtoMessage() {}
 
 func (x *WatchExecutionRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[32]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[36]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2311,7 +2523,7 @@ func (x *WatchExecutionRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WatchExecutionRequest.ProtoReflect.Descriptor instead.
 func (*WatchExecutionRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{32}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{36}
 }
 
 func (x *WatchExecutionRequest) GetExecutionTrackingId() string {
@@ -2330,7 +2542,7 @@ type WatchExecutionUpdate struct {
 
 func (x *WatchExecutionUpdate) Reset() {
 	*x = WatchExecutionUpdate{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[33]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[37]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2342,7 +2554,7 @@ func (x *WatchExecutionUpdate) String() string {
 func (*WatchExecutionUpdate) ProtoMessage() {}
 
 func (x *WatchExecutionUpdate) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[33]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[37]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2355,7 +2567,7 @@ func (x *WatchExecutionUpdate) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WatchExecutionUpdate.ProtoReflect.Descriptor instead.
 func (*WatchExecutionUpdate) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{33}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{37}
 }
 
 func (x *WatchExecutionUpdate) GetUpdate() string {
@@ -2375,7 +2587,7 @@ type ExecutionStatusRequest struct {
 
 func (x *ExecutionStatusRequest) Reset() {
 	*x = ExecutionStatusRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[34]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[38]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2387,7 +2599,7 @@ func (x *ExecutionStatusRequest) String() string {
 func (*ExecutionStatusRequest) ProtoMessage() {}
 
 func (x *ExecutionStatusRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[34]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[38]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2400,7 +2612,7 @@ func (x *ExecutionStatusRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExecutionStatusRequest.ProtoReflect.Descriptor instead.
 func (*ExecutionStatusRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{34}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{38}
 }
 
 func (x *ExecutionStatusRequest) GetExecutionTrackingId() string {
@@ -2429,7 +2641,7 @@ type DashboardNavigationTarget struct {
 
 func (x *DashboardNavigationTarget) Reset() {
 	*x = DashboardNavigationTarget{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[35]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[39]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2441,7 +2653,7 @@ func (x *DashboardNavigationTarget) String() string {
 func (*DashboardNavigationTarget) ProtoMessage() {}
 
 func (x *DashboardNavigationTarget) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[35]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[39]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2454,7 +2666,7 @@ func (x *DashboardNavigationTarget) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DashboardNavigationTarget.ProtoReflect.Descriptor instead.
 func (*DashboardNavigationTarget) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{35}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{39}
 }
 
 func (x *DashboardNavigationTarget) GetTitle() string {
@@ -2495,7 +2707,7 @@ type ExecutionStatusResponse struct {
 
 func (x *ExecutionStatusResponse) Reset() {
 	*x = ExecutionStatusResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[36]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[40]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2507,7 +2719,7 @@ func (x *ExecutionStatusResponse) String() string {
 func (*ExecutionStatusResponse) ProtoMessage() {}
 
 func (x *ExecutionStatusResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[36]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[40]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2520,7 +2732,7 @@ func (x *ExecutionStatusResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExecutionStatusResponse.ProtoReflect.Descriptor instead.
 func (*ExecutionStatusResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{36}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{40}
 }
 
 func (x *ExecutionStatusResponse) GetLogEntry() *LogEntry {
@@ -2545,7 +2757,7 @@ type WhoAmIRequest struct {
 
 func (x *WhoAmIRequest) Reset() {
 	*x = WhoAmIRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[37]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[41]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2557,7 +2769,7 @@ func (x *WhoAmIRequest) String() string {
 func (*WhoAmIRequest) ProtoMessage() {}
 
 func (x *WhoAmIRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[37]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[41]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2570,7 +2782,7 @@ func (x *WhoAmIRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WhoAmIRequest.ProtoReflect.Descriptor instead.
 func (*WhoAmIRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{37}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{41}
 }
 
 type WhoAmIResponse struct {
@@ -2586,7 +2798,7 @@ type WhoAmIResponse struct {
 
 func (x *WhoAmIResponse) Reset() {
 	*x = WhoAmIResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[38]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[42]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2598,7 +2810,7 @@ func (x *WhoAmIResponse) String() string {
 func (*WhoAmIResponse) ProtoMessage() {}
 
 func (x *WhoAmIResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[38]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[42]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2611,7 +2823,7 @@ func (x *WhoAmIResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WhoAmIResponse.ProtoReflect.Descriptor instead.
 func (*WhoAmIResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{38}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{42}
 }
 
 func (x *WhoAmIResponse) GetAuthenticatedUser() string {
@@ -2657,7 +2869,7 @@ type ServerDiagnosticsRequest struct {
 
 func (x *ServerDiagnosticsRequest) Reset() {
 	*x = ServerDiagnosticsRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[39]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[43]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2669,7 +2881,7 @@ func (x *ServerDiagnosticsRequest) String() string {
 func (*ServerDiagnosticsRequest) ProtoMessage() {}
 
 func (x *ServerDiagnosticsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[39]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[43]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2682,7 +2894,7 @@ func (x *ServerDiagnosticsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ServerDiagnosticsRequest.ProtoReflect.Descriptor instead.
 func (*ServerDiagnosticsRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{39}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{43}
 }
 
 type ServerDiagnosticsResponse struct {
@@ -2694,7 +2906,7 @@ type ServerDiagnosticsResponse struct {
 
 func (x *ServerDiagnosticsResponse) Reset() {
 	*x = ServerDiagnosticsResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[40]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[44]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2706,7 +2918,7 @@ func (x *ServerDiagnosticsResponse) String() string {
 func (*ServerDiagnosticsResponse) ProtoMessage() {}
 
 func (x *ServerDiagnosticsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[40]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[44]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2719,7 +2931,7 @@ func (x *ServerDiagnosticsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ServerDiagnosticsResponse.ProtoReflect.Descriptor instead.
 func (*ServerDiagnosticsResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{40}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{44}
 }
 
 func (x *ServerDiagnosticsResponse) GetAlert() string {
@@ -2737,7 +2949,7 @@ type DumpVarsRequest struct {
 
 func (x *DumpVarsRequest) Reset() {
 	*x = DumpVarsRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[41]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[45]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2749,7 +2961,7 @@ func (x *DumpVarsRequest) String() string {
 func (*DumpVarsRequest) ProtoMessage() {}
 
 func (x *DumpVarsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[41]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[45]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2762,7 +2974,7 @@ func (x *DumpVarsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DumpVarsRequest.ProtoReflect.Descriptor instead.
 func (*DumpVarsRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{41}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{45}
 }
 
 type DumpVarsResponse struct {
@@ -2775,7 +2987,7 @@ type DumpVarsResponse struct {
 
 func (x *DumpVarsResponse) Reset() {
 	*x = DumpVarsResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[42]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[46]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2787,7 +2999,7 @@ func (x *DumpVarsResponse) String() string {
 func (*DumpVarsResponse) ProtoMessage() {}
 
 func (x *DumpVarsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[42]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[46]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2800,7 +3012,7 @@ func (x *DumpVarsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DumpVarsResponse.ProtoReflect.Descriptor instead.
 func (*DumpVarsResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{42}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{46}
 }
 
 func (x *DumpVarsResponse) GetAlert() string {
@@ -2827,7 +3039,7 @@ type DebugBinding struct {
 
 func (x *DebugBinding) Reset() {
 	*x = DebugBinding{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[43]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[47]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2839,7 +3051,7 @@ func (x *DebugBinding) String() string {
 func (*DebugBinding) ProtoMessage() {}
 
 func (x *DebugBinding) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[43]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[47]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2852,7 +3064,7 @@ func (x *DebugBinding) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DebugBinding.ProtoReflect.Descriptor instead.
 func (*DebugBinding) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{43}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{47}
 }
 
 func (x *DebugBinding) GetActionTitle() string {
@@ -2877,7 +3089,7 @@ type DumpPublicIdActionMapRequest struct {
 
 func (x *DumpPublicIdActionMapRequest) Reset() {
 	*x = DumpPublicIdActionMapRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[44]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[48]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2889,7 +3101,7 @@ func (x *DumpPublicIdActionMapRequest) String() string {
 func (*DumpPublicIdActionMapRequest) ProtoMessage() {}
 
 func (x *DumpPublicIdActionMapRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[44]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[48]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2902,7 +3114,7 @@ func (x *DumpPublicIdActionMapRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DumpPublicIdActionMapRequest.ProtoReflect.Descriptor instead.
 func (*DumpPublicIdActionMapRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{44}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{48}
 }
 
 type DumpPublicIdActionMapResponse struct {
@@ -2915,7 +3127,7 @@ type DumpPublicIdActionMapResponse struct {
 
 func (x *DumpPublicIdActionMapResponse) Reset() {
 	*x = DumpPublicIdActionMapResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[45]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[49]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2927,7 +3139,7 @@ func (x *DumpPublicIdActionMapResponse) String() string {
 func (*DumpPublicIdActionMapResponse) ProtoMessage() {}
 
 func (x *DumpPublicIdActionMapResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[45]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[49]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2940,7 +3152,7 @@ func (x *DumpPublicIdActionMapResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DumpPublicIdActionMapResponse.ProtoReflect.Descriptor instead.
 func (*DumpPublicIdActionMapResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{45}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{49}
 }
 
 func (x *DumpPublicIdActionMapResponse) GetAlert() string {
@@ -2965,7 +3177,7 @@ type GetReadyzRequest struct {
 
 func (x *GetReadyzRequest) Reset() {
 	*x = GetReadyzRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[46]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[50]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2977,7 +3189,7 @@ func (x *GetReadyzRequest) String() string {
 func (*GetReadyzRequest) ProtoMessage() {}
 
 func (x *GetReadyzRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[46]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[50]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2990,7 +3202,7 @@ func (x *GetReadyzRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetReadyzRequest.ProtoReflect.Descriptor instead.
 func (*GetReadyzRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{46}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{50}
 }
 
 type GetReadyzResponse struct {
@@ -3002,7 +3214,7 @@ type GetReadyzResponse struct {
 
 func (x *GetReadyzResponse) Reset() {
 	*x = GetReadyzResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[47]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[51]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3014,7 +3226,7 @@ func (x *GetReadyzResponse) String() string {
 func (*GetReadyzResponse) ProtoMessage() {}
 
 func (x *GetReadyzResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[47]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[51]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3027,7 +3239,7 @@ func (x *GetReadyzResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetReadyzResponse.ProtoReflect.Descriptor instead.
 func (*GetReadyzResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{47}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{51}
 }
 
 func (x *GetReadyzResponse) GetStatus() string {
@@ -3045,7 +3257,7 @@ type EventStreamRequest struct {
 
 func (x *EventStreamRequest) Reset() {
 	*x = EventStreamRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[48]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[52]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3057,7 +3269,7 @@ func (x *EventStreamRequest) String() string {
 func (*EventStreamRequest) ProtoMessage() {}
 
 func (x *EventStreamRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[48]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[52]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3070,7 +3282,7 @@ func (x *EventStreamRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EventStreamRequest.ProtoReflect.Descriptor instead.
 func (*EventStreamRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{48}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{52}
 }
 
 type EventStreamResponse struct {
@@ -3090,7 +3302,7 @@ type EventStreamResponse struct {
 
 func (x *EventStreamResponse) Reset() {
 	*x = EventStreamResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[49]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[53]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3102,7 +3314,7 @@ func (x *EventStreamResponse) String() string {
 func (*EventStreamResponse) ProtoMessage() {}
 
 func (x *EventStreamResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[49]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[53]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3115,7 +3327,7 @@ func (x *EventStreamResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EventStreamResponse.ProtoReflect.Descriptor instead.
 func (*EventStreamResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{49}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{53}
 }
 
 func (x *EventStreamResponse) GetEvent() isEventStreamResponse_Event {
@@ -3229,7 +3441,7 @@ type EventOutputChunk struct {
 
 func (x *EventOutputChunk) Reset() {
 	*x = EventOutputChunk{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[50]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[54]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3241,7 +3453,7 @@ func (x *EventOutputChunk) String() string {
 func (*EventOutputChunk) ProtoMessage() {}
 
 func (x *EventOutputChunk) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[50]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[54]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3254,7 +3466,7 @@ func (x *EventOutputChunk) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EventOutputChunk.ProtoReflect.Descriptor instead.
 func (*EventOutputChunk) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{50}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{54}
 }
 
 func (x *EventOutputChunk) GetExecutionTrackingId() string {
@@ -3279,7 +3491,7 @@ type EventEntityChanged struct {
 
 func (x *EventEntityChanged) Reset() {
 	*x = EventEntityChanged{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[51]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[55]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3291,7 +3503,7 @@ func (x *EventEntityChanged) String() string {
 func (*EventEntityChanged) ProtoMessage() {}
 
 func (x *EventEntityChanged) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[51]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[55]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3304,7 +3516,7 @@ func (x *EventEntityChanged) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EventEntityChanged.ProtoReflect.Descriptor instead.
 func (*EventEntityChanged) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{51}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{55}
 }
 
 type EventConfigChanged struct {
@@ -3315,7 +3527,7 @@ type EventConfigChanged struct {
 
 func (x *EventConfigChanged) Reset() {
 	*x = EventConfigChanged{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[52]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[56]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3327,7 +3539,7 @@ func (x *EventConfigChanged) String() string {
 func (*EventConfigChanged) ProtoMessage() {}
 
 func (x *EventConfigChanged) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[52]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[56]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3340,7 +3552,7 @@ func (x *EventConfigChanged) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EventConfigChanged.ProtoReflect.Descriptor instead.
 func (*EventConfigChanged) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{52}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{56}
 }
 
 type EventHeartbeat struct {
@@ -3351,7 +3563,7 @@ type EventHeartbeat struct {
 
 func (x *EventHeartbeat) Reset() {
 	*x = EventHeartbeat{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[53]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[57]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3363,7 +3575,7 @@ func (x *EventHeartbeat) String() string {
 func (*EventHeartbeat) ProtoMessage() {}
 
 func (x *EventHeartbeat) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[53]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[57]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3376,7 +3588,7 @@ func (x *EventHeartbeat) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EventHeartbeat.ProtoReflect.Descriptor instead.
 func (*EventHeartbeat) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{53}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{57}
 }
 
 type EventExecutionFinished struct {
@@ -3388,7 +3600,7 @@ type EventExecutionFinished struct {
 
 func (x *EventExecutionFinished) Reset() {
 	*x = EventExecutionFinished{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[54]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[58]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3400,7 +3612,7 @@ func (x *EventExecutionFinished) String() string {
 func (*EventExecutionFinished) ProtoMessage() {}
 
 func (x *EventExecutionFinished) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[54]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[58]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3413,7 +3625,7 @@ func (x *EventExecutionFinished) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EventExecutionFinished.ProtoReflect.Descriptor instead.
 func (*EventExecutionFinished) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{54}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{58}
 }
 
 func (x *EventExecutionFinished) GetLogEntry() *LogEntry {
@@ -3432,7 +3644,7 @@ type EventExecutionStarted struct {
 
 func (x *EventExecutionStarted) Reset() {
 	*x = EventExecutionStarted{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[55]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[59]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3444,7 +3656,7 @@ func (x *EventExecutionStarted) String() string {
 func (*EventExecutionStarted) ProtoMessage() {}
 
 func (x *EventExecutionStarted) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[55]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[59]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3457,7 +3669,7 @@ func (x *EventExecutionStarted) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EventExecutionStarted.ProtoReflect.Descriptor instead.
 func (*EventExecutionStarted) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{55}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{59}
 }
 
 func (x *EventExecutionStarted) GetLogEntry() *LogEntry {
@@ -3476,7 +3688,7 @@ type KillActionRequest struct {
 
 func (x *KillActionRequest) Reset() {
 	*x = KillActionRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[56]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[60]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3488,7 +3700,7 @@ func (x *KillActionRequest) String() string {
 func (*KillActionRequest) ProtoMessage() {}
 
 func (x *KillActionRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[56]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[60]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3501,7 +3713,7 @@ func (x *KillActionRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use KillActionRequest.ProtoReflect.Descriptor instead.
 func (*KillActionRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{56}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{60}
 }
 
 func (x *KillActionRequest) GetExecutionTrackingId() string {
@@ -3523,7 +3735,7 @@ type KillActionResponse struct {
 
 func (x *KillActionResponse) Reset() {
 	*x = KillActionResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[57]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[61]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3535,7 +3747,7 @@ func (x *KillActionResponse) String() string {
 func (*KillActionResponse) ProtoMessage() {}
 
 func (x *KillActionResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[57]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[61]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3548,7 +3760,7 @@ func (x *KillActionResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use KillActionResponse.ProtoReflect.Descriptor instead.
 func (*KillActionResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{57}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{61}
 }
 
 func (x *KillActionResponse) GetExecutionTrackingId() string {
@@ -3589,7 +3801,7 @@ type LocalUserLoginRequest struct {
 
 func (x *LocalUserLoginRequest) Reset() {
 	*x = LocalUserLoginRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[58]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[62]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3601,7 +3813,7 @@ func (x *LocalUserLoginRequest) String() string {
 func (*LocalUserLoginRequest) ProtoMessage() {}
 
 func (x *LocalUserLoginRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[58]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[62]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3614,7 +3826,7 @@ func (x *LocalUserLoginRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LocalUserLoginRequest.ProtoReflect.Descriptor instead.
 func (*LocalUserLoginRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{58}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{62}
 }
 
 func (x *LocalUserLoginRequest) GetUsername() string {
@@ -3640,7 +3852,7 @@ type LocalUserLoginResponse struct {
 
 func (x *LocalUserLoginResponse) Reset() {
 	*x = LocalUserLoginResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[59]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[63]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3652,7 +3864,7 @@ func (x *LocalUserLoginResponse) String() string {
 func (*LocalUserLoginResponse) ProtoMessage() {}
 
 func (x *LocalUserLoginResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[59]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[63]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3665,7 +3877,7 @@ func (x *LocalUserLoginResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LocalUserLoginResponse.ProtoReflect.Descriptor instead.
 func (*LocalUserLoginResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{59}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{63}
 }
 
 func (x *LocalUserLoginResponse) GetSuccess() bool {
@@ -3684,7 +3896,7 @@ type PasswordHashRequest struct {
 
 func (x *PasswordHashRequest) Reset() {
 	*x = PasswordHashRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[60]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[64]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3696,7 +3908,7 @@ func (x *PasswordHashRequest) String() string {
 func (*PasswordHashRequest) ProtoMessage() {}
 
 func (x *PasswordHashRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[60]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[64]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3709,7 +3921,7 @@ func (x *PasswordHashRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PasswordHashRequest.ProtoReflect.Descriptor instead.
 func (*PasswordHashRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{60}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{64}
 }
 
 func (x *PasswordHashRequest) GetPassword() string {
@@ -3728,7 +3940,7 @@ type PasswordHashResponse struct {
 
 func (x *PasswordHashResponse) Reset() {
 	*x = PasswordHashResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[61]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[65]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3740,7 +3952,7 @@ func (x *PasswordHashResponse) String() string {
 func (*PasswordHashResponse) ProtoMessage() {}
 
 func (x *PasswordHashResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[61]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[65]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3753,7 +3965,7 @@ func (x *PasswordHashResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PasswordHashResponse.ProtoReflect.Descriptor instead.
 func (*PasswordHashResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{61}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{65}
 }
 
 func (x *PasswordHashResponse) GetHash() string {
@@ -3771,7 +3983,7 @@ type LogoutRequest struct {
 
 func (x *LogoutRequest) Reset() {
 	*x = LogoutRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[62]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[66]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3783,7 +3995,7 @@ func (x *LogoutRequest) String() string {
 func (*LogoutRequest) ProtoMessage() {}
 
 func (x *LogoutRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[62]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[66]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3796,7 +4008,7 @@ func (x *LogoutRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LogoutRequest.ProtoReflect.Descriptor instead.
 func (*LogoutRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{62}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{66}
 }
 
 type LogoutResponse struct {
@@ -3807,7 +4019,7 @@ type LogoutResponse struct {
 
 func (x *LogoutResponse) Reset() {
 	*x = LogoutResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[63]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[67]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3819,7 +4031,7 @@ func (x *LogoutResponse) String() string {
 func (*LogoutResponse) ProtoMessage() {}
 
 func (x *LogoutResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[63]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[67]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3832,7 +4044,7 @@ func (x *LogoutResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LogoutResponse.ProtoReflect.Descriptor instead.
 func (*LogoutResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{63}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{67}
 }
 
 type GetDiagnosticsRequest struct {
@@ -3843,7 +4055,7 @@ type GetDiagnosticsRequest struct {
 
 func (x *GetDiagnosticsRequest) Reset() {
 	*x = GetDiagnosticsRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[64]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[68]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3855,7 +4067,7 @@ func (x *GetDiagnosticsRequest) String() string {
 func (*GetDiagnosticsRequest) ProtoMessage() {}
 
 func (x *GetDiagnosticsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[64]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[68]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3868,7 +4080,7 @@ func (x *GetDiagnosticsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetDiagnosticsRequest.ProtoReflect.Descriptor instead.
 func (*GetDiagnosticsRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{64}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{68}
 }
 
 type ConfigIssue struct {
@@ -3887,7 +4099,7 @@ type ConfigIssue struct {
 
 func (x *ConfigIssue) Reset() {
 	*x = ConfigIssue{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[65]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[69]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3899,7 +4111,7 @@ func (x *ConfigIssue) String() string {
 func (*ConfigIssue) ProtoMessage() {}
 
 func (x *ConfigIssue) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[65]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[69]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3912,7 +4124,7 @@ func (x *ConfigIssue) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ConfigIssue.ProtoReflect.Descriptor instead.
 func (*ConfigIssue) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{65}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{69}
 }
 
 func (x *ConfigIssue) GetSeverity() string {
@@ -3982,7 +4194,7 @@ type GetDiagnosticsResponse struct {
 
 func (x *GetDiagnosticsResponse) Reset() {
 	*x = GetDiagnosticsResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[66]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[70]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3994,7 +4206,7 @@ func (x *GetDiagnosticsResponse) String() string {
 func (*GetDiagnosticsResponse) ProtoMessage() {}
 
 func (x *GetDiagnosticsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[66]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[70]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4007,7 +4219,7 @@ func (x *GetDiagnosticsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetDiagnosticsResponse.ProtoReflect.Descriptor instead.
 func (*GetDiagnosticsResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{66}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{70}
 }
 
 func (x *GetDiagnosticsResponse) GetSshFoundKey() string {
@@ -4039,7 +4251,7 @@ type InitRequest struct {
 
 func (x *InitRequest) Reset() {
 	*x = InitRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[67]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[71]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4051,7 +4263,7 @@ func (x *InitRequest) String() string {
 func (*InitRequest) ProtoMessage() {}
 
 func (x *InitRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[67]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[71]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4064,7 +4276,7 @@ func (x *InitRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InitRequest.ProtoReflect.Descriptor instead.
 func (*InitRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{67}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{71}
 }
 
 type InitResponse struct {
@@ -4096,13 +4308,19 @@ type InitResponse struct {
 	ShowNavigateOnStartIcons  bool                   `protobuf:"varint,25,opt,name=show_navigate_on_start_icons,json=showNavigateOnStartIcons,proto3" json:"show_navigate_on_start_icons,omitempty"`
 	ConfigIssueCount          int32                  `protobuf:"varint,26,opt,name=config_issue_count,json=configIssueCount,proto3" json:"config_issue_count,omitempty"`
 	RootDashboardEntries      []*RootDashboard       `protobuf:"bytes,27,rep,name=root_dashboard_entries,json=rootDashboardEntries,proto3" json:"root_dashboard_entries,omitempty"`
-	unknownFields             protoimpl.UnknownFields
-	sizeCache                 protoimpl.SizeCache
+	// Client-side search index hints. Omitted when login is required
+	// or features.header_search is false.
+	// Entities match GetEntities visibility; actions use view ACL.
+	// Dashboards are indexed client-side from root_dashboard_entries.
+	SearchHints   *SearchHints `protobuf:"bytes,28,opt,name=search_hints,json=searchHints,proto3" json:"search_hints,omitempty"`
+	Features      *Features    `protobuf:"bytes,29,opt,name=features,proto3" json:"features,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *InitResponse) Reset() {
 	*x = InitResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[68]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[72]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4114,7 +4332,7 @@ func (x *InitResponse) String() string {
 func (*InitResponse) ProtoMessage() {}
 
 func (x *InitResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[68]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[72]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4127,7 +4345,7 @@ func (x *InitResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InitResponse.ProtoReflect.Descriptor instead.
 func (*InitResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{68}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{72}
 }
 
 func (x *InitResponse) GetShowFooter() bool {
@@ -4319,6 +4537,20 @@ func (x *InitResponse) GetRootDashboardEntries() []*RootDashboard {
 	return nil
 }
 
+func (x *InitResponse) GetSearchHints() *SearchHints {
+	if x != nil {
+		return x.SearchHints
+	}
+	return nil
+}
+
+func (x *InitResponse) GetFeatures() *Features {
+	if x != nil {
+		return x.Features
+	}
+	return nil
+}
+
 type RootDashboard struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Title         string                 `protobuf:"bytes,1,opt,name=title,proto3" json:"title,omitempty"`
@@ -4329,7 +4561,7 @@ type RootDashboard struct {
 
 func (x *RootDashboard) Reset() {
 	*x = RootDashboard{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[69]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[73]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4341,7 +4573,7 @@ func (x *RootDashboard) String() string {
 func (*RootDashboard) ProtoMessage() {}
 
 func (x *RootDashboard) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[69]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[73]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4354,7 +4586,7 @@ func (x *RootDashboard) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RootDashboard.ProtoReflect.Descriptor instead.
 func (*RootDashboard) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{69}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{73}
 }
 
 func (x *RootDashboard) GetTitle() string {
@@ -4381,7 +4613,7 @@ type AdditionalLink struct {
 
 func (x *AdditionalLink) Reset() {
 	*x = AdditionalLink{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[70]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[74]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4393,7 +4625,7 @@ func (x *AdditionalLink) String() string {
 func (*AdditionalLink) ProtoMessage() {}
 
 func (x *AdditionalLink) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[70]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[74]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4406,7 +4638,7 @@ func (x *AdditionalLink) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AdditionalLink.ProtoReflect.Descriptor instead.
 func (*AdditionalLink) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{70}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{74}
 }
 
 func (x *AdditionalLink) GetTitle() string {
@@ -4434,7 +4666,7 @@ type OAuth2Provider struct {
 
 func (x *OAuth2Provider) Reset() {
 	*x = OAuth2Provider{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[71]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[75]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4446,7 +4678,7 @@ func (x *OAuth2Provider) String() string {
 func (*OAuth2Provider) ProtoMessage() {}
 
 func (x *OAuth2Provider) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[71]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[75]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4459,7 +4691,7 @@ func (x *OAuth2Provider) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OAuth2Provider.ProtoReflect.Descriptor instead.
 func (*OAuth2Provider) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{71}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{75}
 }
 
 func (x *OAuth2Provider) GetTitle() string {
@@ -4492,7 +4724,7 @@ type GetActionBindingRequest struct {
 
 func (x *GetActionBindingRequest) Reset() {
 	*x = GetActionBindingRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[72]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[76]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4504,7 +4736,7 @@ func (x *GetActionBindingRequest) String() string {
 func (*GetActionBindingRequest) ProtoMessage() {}
 
 func (x *GetActionBindingRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[72]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[76]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4517,7 +4749,7 @@ func (x *GetActionBindingRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetActionBindingRequest.ProtoReflect.Descriptor instead.
 func (*GetActionBindingRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{72}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{76}
 }
 
 func (x *GetActionBindingRequest) GetBindingId() string {
@@ -4537,7 +4769,7 @@ type GetActionBindingResponse struct {
 
 func (x *GetActionBindingResponse) Reset() {
 	*x = GetActionBindingResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[73]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[77]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4549,7 +4781,7 @@ func (x *GetActionBindingResponse) String() string {
 func (*GetActionBindingResponse) ProtoMessage() {}
 
 func (x *GetActionBindingResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[73]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[77]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4562,7 +4794,7 @@ func (x *GetActionBindingResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetActionBindingResponse.ProtoReflect.Descriptor instead.
 func (*GetActionBindingResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{73}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{77}
 }
 
 func (x *GetActionBindingResponse) GetAction() *Action {
@@ -4591,7 +4823,7 @@ type GetEntitiesRequest struct {
 
 func (x *GetEntitiesRequest) Reset() {
 	*x = GetEntitiesRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[74]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[78]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4603,7 +4835,7 @@ func (x *GetEntitiesRequest) String() string {
 func (*GetEntitiesRequest) ProtoMessage() {}
 
 func (x *GetEntitiesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[74]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[78]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4616,7 +4848,7 @@ func (x *GetEntitiesRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetEntitiesRequest.ProtoReflect.Descriptor instead.
 func (*GetEntitiesRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{74}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{78}
 }
 
 func (x *GetEntitiesRequest) GetEntityType() string {
@@ -4656,7 +4888,7 @@ type GetEntitiesResponse struct {
 
 func (x *GetEntitiesResponse) Reset() {
 	*x = GetEntitiesResponse{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[75]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[79]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4668,7 +4900,7 @@ func (x *GetEntitiesResponse) String() string {
 func (*GetEntitiesResponse) ProtoMessage() {}
 
 func (x *GetEntitiesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[75]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[79]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4681,7 +4913,7 @@ func (x *GetEntitiesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetEntitiesResponse.ProtoReflect.Descriptor instead.
 func (*GetEntitiesResponse) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{75}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{79}
 }
 
 func (x *GetEntitiesResponse) GetEntityDefinitions() []*EntityDefinition {
@@ -4705,7 +4937,7 @@ type EntityDefinition struct {
 
 func (x *EntityDefinition) Reset() {
 	*x = EntityDefinition{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[76]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[80]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4717,7 +4949,7 @@ func (x *EntityDefinition) String() string {
 func (*EntityDefinition) ProtoMessage() {}
 
 func (x *EntityDefinition) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[76]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[80]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4730,7 +4962,7 @@ func (x *EntityDefinition) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EntityDefinition.ProtoReflect.Descriptor instead.
 func (*EntityDefinition) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{76}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{80}
 }
 
 func (x *EntityDefinition) GetTitle() string {
@@ -4785,7 +5017,7 @@ type EntityProperty struct {
 
 func (x *EntityProperty) Reset() {
 	*x = EntityProperty{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[77]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[81]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4797,7 +5029,7 @@ func (x *EntityProperty) String() string {
 func (*EntityProperty) ProtoMessage() {}
 
 func (x *EntityProperty) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[77]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[81]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4810,7 +5042,7 @@ func (x *EntityProperty) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EntityProperty.ProtoReflect.Descriptor instead.
 func (*EntityProperty) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{77}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{81}
 }
 
 func (x *EntityProperty) GetName() string {
@@ -4837,7 +5069,7 @@ type GetEntityRequest struct {
 
 func (x *GetEntityRequest) Reset() {
 	*x = GetEntityRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[78]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[82]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4849,7 +5081,7 @@ func (x *GetEntityRequest) String() string {
 func (*GetEntityRequest) ProtoMessage() {}
 
 func (x *GetEntityRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[78]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[82]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4862,7 +5094,7 @@ func (x *GetEntityRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetEntityRequest.ProtoReflect.Descriptor instead.
 func (*GetEntityRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{78}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{82}
 }
 
 func (x *GetEntityRequest) GetUniqueKey() string {
@@ -4888,7 +5120,7 @@ type RestartActionRequest struct {
 
 func (x *RestartActionRequest) Reset() {
 	*x = RestartActionRequest{}
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[79]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[83]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4900,7 +5132,7 @@ func (x *RestartActionRequest) String() string {
 func (*RestartActionRequest) ProtoMessage() {}
 
 func (x *RestartActionRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[79]
+	mi := &file_olivetin_api_v1_olivetin_proto_msgTypes[83]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4913,7 +5145,7 @@ func (x *RestartActionRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RestartActionRequest.ProtoReflect.Descriptor instead.
 func (*RestartActionRequest) Descriptor() ([]byte, []int) {
-	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{79}
+	return file_olivetin_api_v1_olivetin_proto_rawDescGZIP(), []int{83}
 }
 
 func (x *RestartActionRequest) GetExecutionTrackingId() string {
@@ -5004,11 +5236,25 @@ const file_olivetin_api_v1_olivetin_proto_rawDesc = "" +
 	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"f\n" +
 	"\x14GetDashboardResponse\x12\x14\n" +
 	"\x05title\x18\x01 \x01(\tR\x05title\x128\n" +
-	"\tdashboard\x18\x04 \x01(\v2\x1a.olivetin.api.v1.DashboardR\tdashboard\"\x90\x01\n" +
+	"\tdashboard\x18\x04 \x01(\v2\x1a.olivetin.api.v1.DashboardR\tdashboard\"\x89\x01\n" +
+	"\vSearchHints\x12=\n" +
+	"\bentities\x18\x01 \x03(\v2!.olivetin.api.v1.EntitySearchHintR\bentities\x12;\n" +
+	"\aactions\x18\x02 \x03(\v2!.olivetin.api.v1.ActionSearchHintR\aactions\"[\n" +
+	"\x10EntitySearchHint\x12\x14\n" +
+	"\x05title\x18\x01 \x01(\tR\x05title\x12\x12\n" +
+	"\x04type\x18\x02 \x01(\tR\x04type\x12\x1d\n" +
+	"\n" +
+	"unique_key\x18\x03 \x01(\tR\tuniqueKey\"G\n" +
+	"\x10ActionSearchHint\x12\x14\n" +
+	"\x05title\x18\x01 \x01(\tR\x05title\x12\x1d\n" +
+	"\n" +
+	"binding_id\x18\x02 \x01(\tR\tbindingId\"\x90\x01\n" +
 	"\x0fEffectivePolicy\x12)\n" +
 	"\x10show_diagnostics\x18\x01 \x01(\bR\x0fshowDiagnostics\x12\"\n" +
 	"\rshow_log_list\x18\x02 \x01(\bR\vshowLogList\x12.\n" +
-	"\x13show_version_number\x18\x03 \x01(\bR\x11showVersionNumber\"k\n" +
+	"\x13show_version_number\x18\x03 \x01(\bR\x11showVersionNumber\"/\n" +
+	"\bFeatures\x12#\n" +
+	"\rheader_search\x18\x01 \x01(\bR\fheaderSearch\"k\n" +
 	"\x13GetDashboardRequest\x12\x14\n" +
 	"\x05title\x18\x01 \x01(\tR\x05title\x12\x1f\n" +
 	"\ventity_type\x18\x02 \x01(\tR\n" +
@@ -5235,8 +5481,7 @@ const file_olivetin_api_v1_olivetin_proto_rawDesc = "" +
 	"\vSshFoundKey\x18\x01 \x01(\tR\vSshFoundKey\x12&\n" +
 	"\x0eSshFoundConfig\x18\x02 \x01(\tR\x0eSshFoundConfig\x12A\n" +
 	"\rconfig_issues\x18\x03 \x03(\v2\x1c.olivetin.api.v1.ConfigIssueR\fconfigIssues\"\r\n" +
-	"\vInitRequest\"\x91\n" +
-	"\n" +
+	"\vInitRequest\"\x89\v\n" +
 	"\fInitResponse\x12\x1e\n" +
 	"\n" +
 	"showFooter\x18\x01 \x01(\bR\n" +
@@ -5268,7 +5513,9 @@ const file_olivetin_api_v1_olivetin_proto_rawDesc = "" +
 	"\x10available_themes\x18\x18 \x03(\tR\x0favailableThemes\x12>\n" +
 	"\x1cshow_navigate_on_start_icons\x18\x19 \x01(\bR\x18showNavigateOnStartIcons\x12,\n" +
 	"\x12config_issue_count\x18\x1a \x01(\x05R\x10configIssueCount\x12T\n" +
-	"\x16root_dashboard_entries\x18\x1b \x03(\v2\x1e.olivetin.api.v1.RootDashboardR\x14rootDashboardEntries\"A\n" +
+	"\x16root_dashboard_entries\x18\x1b \x03(\v2\x1e.olivetin.api.v1.RootDashboardR\x14rootDashboardEntries\x12?\n" +
+	"\fsearch_hints\x18\x1c \x01(\v2\x1c.olivetin.api.v1.SearchHintsR\vsearchHints\x125\n" +
+	"\bfeatures\x18\x1d \x01(\v2\x19.olivetin.api.v1.FeaturesR\bfeatures\"A\n" +
 	"\rRootDashboard\x12\x14\n" +
 	"\x05title\x18\x01 \x01(\tR\x05title\x12\x1a\n" +
 	"\bcategory\x18\x02 \x01(\tR\bcategory\"8\n" +
@@ -5352,7 +5599,7 @@ func file_olivetin_api_v1_olivetin_proto_rawDescGZIP() []byte {
 	return file_olivetin_api_v1_olivetin_proto_rawDescData
 }
 
-var file_olivetin_api_v1_olivetin_proto_msgTypes = make([]protoimpl.MessageInfo, 87)
+var file_olivetin_api_v1_olivetin_proto_msgTypes = make([]protoimpl.MessageInfo, 91)
 var file_olivetin_api_v1_olivetin_proto_goTypes = []any{
 	(*Action)(nil),                          // 0: olivetin.api.v1.Action
 	(*ActionGroupMembership)(nil),           // 1: olivetin.api.v1.ActionGroupMembership
@@ -5362,192 +5609,200 @@ var file_olivetin_api_v1_olivetin_proto_goTypes = []any{
 	(*EntityRelatedAction)(nil),             // 5: olivetin.api.v1.EntityRelatedAction
 	(*Entity)(nil),                          // 6: olivetin.api.v1.Entity
 	(*GetDashboardResponse)(nil),            // 7: olivetin.api.v1.GetDashboardResponse
-	(*EffectivePolicy)(nil),                 // 8: olivetin.api.v1.EffectivePolicy
-	(*GetDashboardRequest)(nil),             // 9: olivetin.api.v1.GetDashboardRequest
-	(*Dashboard)(nil),                       // 10: olivetin.api.v1.Dashboard
-	(*DashboardComponent)(nil),              // 11: olivetin.api.v1.DashboardComponent
-	(*StartActionRequest)(nil),              // 12: olivetin.api.v1.StartActionRequest
-	(*StartActionArgument)(nil),             // 13: olivetin.api.v1.StartActionArgument
-	(*StartActionResponse)(nil),             // 14: olivetin.api.v1.StartActionResponse
-	(*StartActionAndWaitRequest)(nil),       // 15: olivetin.api.v1.StartActionAndWaitRequest
-	(*StartActionAndWaitResponse)(nil),      // 16: olivetin.api.v1.StartActionAndWaitResponse
-	(*StartActionByGetRequest)(nil),         // 17: olivetin.api.v1.StartActionByGetRequest
-	(*StartActionByGetResponse)(nil),        // 18: olivetin.api.v1.StartActionByGetResponse
-	(*StartActionByGetAndWaitRequest)(nil),  // 19: olivetin.api.v1.StartActionByGetAndWaitRequest
-	(*StartActionByGetAndWaitResponse)(nil), // 20: olivetin.api.v1.StartActionByGetAndWaitResponse
-	(*GetLogsRequest)(nil),                  // 21: olivetin.api.v1.GetLogsRequest
-	(*LogEntry)(nil),                        // 22: olivetin.api.v1.LogEntry
-	(*GetLogsResponse)(nil),                 // 23: olivetin.api.v1.GetLogsResponse
-	(*GetActionLogsRequest)(nil),            // 24: olivetin.api.v1.GetActionLogsRequest
-	(*GetActionLogsResponse)(nil),           // 25: olivetin.api.v1.GetActionLogsResponse
-	(*GetExecutionQueueRequest)(nil),        // 26: olivetin.api.v1.GetExecutionQueueRequest
-	(*ExecutionQueueAction)(nil),            // 27: olivetin.api.v1.ExecutionQueueAction
-	(*ExecutionQueueGroup)(nil),             // 28: olivetin.api.v1.ExecutionQueueGroup
-	(*GetExecutionQueueResponse)(nil),       // 29: olivetin.api.v1.GetExecutionQueueResponse
-	(*ValidateArgumentTypeRequest)(nil),     // 30: olivetin.api.v1.ValidateArgumentTypeRequest
-	(*ValidateArgumentTypeResponse)(nil),    // 31: olivetin.api.v1.ValidateArgumentTypeResponse
-	(*WatchExecutionRequest)(nil),           // 32: olivetin.api.v1.WatchExecutionRequest
-	(*WatchExecutionUpdate)(nil),            // 33: olivetin.api.v1.WatchExecutionUpdate
-	(*ExecutionStatusRequest)(nil),          // 34: olivetin.api.v1.ExecutionStatusRequest
-	(*DashboardNavigationTarget)(nil),       // 35: olivetin.api.v1.DashboardNavigationTarget
-	(*ExecutionStatusResponse)(nil),         // 36: olivetin.api.v1.ExecutionStatusResponse
-	(*WhoAmIRequest)(nil),                   // 37: olivetin.api.v1.WhoAmIRequest
-	(*WhoAmIResponse)(nil),                  // 38: olivetin.api.v1.WhoAmIResponse
-	(*ServerDiagnosticsRequest)(nil),        // 39: olivetin.api.v1.ServerDiagnosticsRequest
-	(*ServerDiagnosticsResponse)(nil),       // 40: olivetin.api.v1.ServerDiagnosticsResponse
-	(*DumpVarsRequest)(nil),                 // 41: olivetin.api.v1.DumpVarsRequest
-	(*DumpVarsResponse)(nil),                // 42: olivetin.api.v1.DumpVarsResponse
-	(*DebugBinding)(nil),                    // 43: olivetin.api.v1.DebugBinding
-	(*DumpPublicIdActionMapRequest)(nil),    // 44: olivetin.api.v1.DumpPublicIdActionMapRequest
-	(*DumpPublicIdActionMapResponse)(nil),   // 45: olivetin.api.v1.DumpPublicIdActionMapResponse
-	(*GetReadyzRequest)(nil),                // 46: olivetin.api.v1.GetReadyzRequest
-	(*GetReadyzResponse)(nil),               // 47: olivetin.api.v1.GetReadyzResponse
-	(*EventStreamRequest)(nil),              // 48: olivetin.api.v1.EventStreamRequest
-	(*EventStreamResponse)(nil),             // 49: olivetin.api.v1.EventStreamResponse
-	(*EventOutputChunk)(nil),                // 50: olivetin.api.v1.EventOutputChunk
-	(*EventEntityChanged)(nil),              // 51: olivetin.api.v1.EventEntityChanged
-	(*EventConfigChanged)(nil),              // 52: olivetin.api.v1.EventConfigChanged
-	(*EventHeartbeat)(nil),                  // 53: olivetin.api.v1.EventHeartbeat
-	(*EventExecutionFinished)(nil),          // 54: olivetin.api.v1.EventExecutionFinished
-	(*EventExecutionStarted)(nil),           // 55: olivetin.api.v1.EventExecutionStarted
-	(*KillActionRequest)(nil),               // 56: olivetin.api.v1.KillActionRequest
-	(*KillActionResponse)(nil),              // 57: olivetin.api.v1.KillActionResponse
-	(*LocalUserLoginRequest)(nil),           // 58: olivetin.api.v1.LocalUserLoginRequest
-	(*LocalUserLoginResponse)(nil),          // 59: olivetin.api.v1.LocalUserLoginResponse
-	(*PasswordHashRequest)(nil),             // 60: olivetin.api.v1.PasswordHashRequest
-	(*PasswordHashResponse)(nil),            // 61: olivetin.api.v1.PasswordHashResponse
-	(*LogoutRequest)(nil),                   // 62: olivetin.api.v1.LogoutRequest
-	(*LogoutResponse)(nil),                  // 63: olivetin.api.v1.LogoutResponse
-	(*GetDiagnosticsRequest)(nil),           // 64: olivetin.api.v1.GetDiagnosticsRequest
-	(*ConfigIssue)(nil),                     // 65: olivetin.api.v1.ConfigIssue
-	(*GetDiagnosticsResponse)(nil),          // 66: olivetin.api.v1.GetDiagnosticsResponse
-	(*InitRequest)(nil),                     // 67: olivetin.api.v1.InitRequest
-	(*InitResponse)(nil),                    // 68: olivetin.api.v1.InitResponse
-	(*RootDashboard)(nil),                   // 69: olivetin.api.v1.RootDashboard
-	(*AdditionalLink)(nil),                  // 70: olivetin.api.v1.AdditionalLink
-	(*OAuth2Provider)(nil),                  // 71: olivetin.api.v1.OAuth2Provider
-	(*GetActionBindingRequest)(nil),         // 72: olivetin.api.v1.GetActionBindingRequest
-	(*GetActionBindingResponse)(nil),        // 73: olivetin.api.v1.GetActionBindingResponse
-	(*GetEntitiesRequest)(nil),              // 74: olivetin.api.v1.GetEntitiesRequest
-	(*GetEntitiesResponse)(nil),             // 75: olivetin.api.v1.GetEntitiesResponse
-	(*EntityDefinition)(nil),                // 76: olivetin.api.v1.EntityDefinition
-	(*EntityProperty)(nil),                  // 77: olivetin.api.v1.EntityProperty
-	(*GetEntityRequest)(nil),                // 78: olivetin.api.v1.GetEntityRequest
-	(*RestartActionRequest)(nil),            // 79: olivetin.api.v1.RestartActionRequest
-	nil,                                     // 80: olivetin.api.v1.ActionWebhookExecHint.MatchHeadersEntry
-	nil,                                     // 81: olivetin.api.v1.ActionWebhookExecHint.MatchQueryEntry
-	nil,                                     // 82: olivetin.api.v1.ActionArgument.SuggestionsEntry
-	nil,                                     // 83: olivetin.api.v1.EntityRelatedAction.PrefilledArgumentsEntry
-	nil,                                     // 84: olivetin.api.v1.Entity.FieldsEntry
-	nil,                                     // 85: olivetin.api.v1.DumpVarsResponse.ContentsEntry
-	nil,                                     // 86: olivetin.api.v1.DumpPublicIdActionMapResponse.ContentsEntry
+	(*SearchHints)(nil),                     // 8: olivetin.api.v1.SearchHints
+	(*EntitySearchHint)(nil),                // 9: olivetin.api.v1.EntitySearchHint
+	(*ActionSearchHint)(nil),                // 10: olivetin.api.v1.ActionSearchHint
+	(*EffectivePolicy)(nil),                 // 11: olivetin.api.v1.EffectivePolicy
+	(*Features)(nil),                        // 12: olivetin.api.v1.Features
+	(*GetDashboardRequest)(nil),             // 13: olivetin.api.v1.GetDashboardRequest
+	(*Dashboard)(nil),                       // 14: olivetin.api.v1.Dashboard
+	(*DashboardComponent)(nil),              // 15: olivetin.api.v1.DashboardComponent
+	(*StartActionRequest)(nil),              // 16: olivetin.api.v1.StartActionRequest
+	(*StartActionArgument)(nil),             // 17: olivetin.api.v1.StartActionArgument
+	(*StartActionResponse)(nil),             // 18: olivetin.api.v1.StartActionResponse
+	(*StartActionAndWaitRequest)(nil),       // 19: olivetin.api.v1.StartActionAndWaitRequest
+	(*StartActionAndWaitResponse)(nil),      // 20: olivetin.api.v1.StartActionAndWaitResponse
+	(*StartActionByGetRequest)(nil),         // 21: olivetin.api.v1.StartActionByGetRequest
+	(*StartActionByGetResponse)(nil),        // 22: olivetin.api.v1.StartActionByGetResponse
+	(*StartActionByGetAndWaitRequest)(nil),  // 23: olivetin.api.v1.StartActionByGetAndWaitRequest
+	(*StartActionByGetAndWaitResponse)(nil), // 24: olivetin.api.v1.StartActionByGetAndWaitResponse
+	(*GetLogsRequest)(nil),                  // 25: olivetin.api.v1.GetLogsRequest
+	(*LogEntry)(nil),                        // 26: olivetin.api.v1.LogEntry
+	(*GetLogsResponse)(nil),                 // 27: olivetin.api.v1.GetLogsResponse
+	(*GetActionLogsRequest)(nil),            // 28: olivetin.api.v1.GetActionLogsRequest
+	(*GetActionLogsResponse)(nil),           // 29: olivetin.api.v1.GetActionLogsResponse
+	(*GetExecutionQueueRequest)(nil),        // 30: olivetin.api.v1.GetExecutionQueueRequest
+	(*ExecutionQueueAction)(nil),            // 31: olivetin.api.v1.ExecutionQueueAction
+	(*ExecutionQueueGroup)(nil),             // 32: olivetin.api.v1.ExecutionQueueGroup
+	(*GetExecutionQueueResponse)(nil),       // 33: olivetin.api.v1.GetExecutionQueueResponse
+	(*ValidateArgumentTypeRequest)(nil),     // 34: olivetin.api.v1.ValidateArgumentTypeRequest
+	(*ValidateArgumentTypeResponse)(nil),    // 35: olivetin.api.v1.ValidateArgumentTypeResponse
+	(*WatchExecutionRequest)(nil),           // 36: olivetin.api.v1.WatchExecutionRequest
+	(*WatchExecutionUpdate)(nil),            // 37: olivetin.api.v1.WatchExecutionUpdate
+	(*ExecutionStatusRequest)(nil),          // 38: olivetin.api.v1.ExecutionStatusRequest
+	(*DashboardNavigationTarget)(nil),       // 39: olivetin.api.v1.DashboardNavigationTarget
+	(*ExecutionStatusResponse)(nil),         // 40: olivetin.api.v1.ExecutionStatusResponse
+	(*WhoAmIRequest)(nil),                   // 41: olivetin.api.v1.WhoAmIRequest
+	(*WhoAmIResponse)(nil),                  // 42: olivetin.api.v1.WhoAmIResponse
+	(*ServerDiagnosticsRequest)(nil),        // 43: olivetin.api.v1.ServerDiagnosticsRequest
+	(*ServerDiagnosticsResponse)(nil),       // 44: olivetin.api.v1.ServerDiagnosticsResponse
+	(*DumpVarsRequest)(nil),                 // 45: olivetin.api.v1.DumpVarsRequest
+	(*DumpVarsResponse)(nil),                // 46: olivetin.api.v1.DumpVarsResponse
+	(*DebugBinding)(nil),                    // 47: olivetin.api.v1.DebugBinding
+	(*DumpPublicIdActionMapRequest)(nil),    // 48: olivetin.api.v1.DumpPublicIdActionMapRequest
+	(*DumpPublicIdActionMapResponse)(nil),   // 49: olivetin.api.v1.DumpPublicIdActionMapResponse
+	(*GetReadyzRequest)(nil),                // 50: olivetin.api.v1.GetReadyzRequest
+	(*GetReadyzResponse)(nil),               // 51: olivetin.api.v1.GetReadyzResponse
+	(*EventStreamRequest)(nil),              // 52: olivetin.api.v1.EventStreamRequest
+	(*EventStreamResponse)(nil),             // 53: olivetin.api.v1.EventStreamResponse
+	(*EventOutputChunk)(nil),                // 54: olivetin.api.v1.EventOutputChunk
+	(*EventEntityChanged)(nil),              // 55: olivetin.api.v1.EventEntityChanged
+	(*EventConfigChanged)(nil),              // 56: olivetin.api.v1.EventConfigChanged
+	(*EventHeartbeat)(nil),                  // 57: olivetin.api.v1.EventHeartbeat
+	(*EventExecutionFinished)(nil),          // 58: olivetin.api.v1.EventExecutionFinished
+	(*EventExecutionStarted)(nil),           // 59: olivetin.api.v1.EventExecutionStarted
+	(*KillActionRequest)(nil),               // 60: olivetin.api.v1.KillActionRequest
+	(*KillActionResponse)(nil),              // 61: olivetin.api.v1.KillActionResponse
+	(*LocalUserLoginRequest)(nil),           // 62: olivetin.api.v1.LocalUserLoginRequest
+	(*LocalUserLoginResponse)(nil),          // 63: olivetin.api.v1.LocalUserLoginResponse
+	(*PasswordHashRequest)(nil),             // 64: olivetin.api.v1.PasswordHashRequest
+	(*PasswordHashResponse)(nil),            // 65: olivetin.api.v1.PasswordHashResponse
+	(*LogoutRequest)(nil),                   // 66: olivetin.api.v1.LogoutRequest
+	(*LogoutResponse)(nil),                  // 67: olivetin.api.v1.LogoutResponse
+	(*GetDiagnosticsRequest)(nil),           // 68: olivetin.api.v1.GetDiagnosticsRequest
+	(*ConfigIssue)(nil),                     // 69: olivetin.api.v1.ConfigIssue
+	(*GetDiagnosticsResponse)(nil),          // 70: olivetin.api.v1.GetDiagnosticsResponse
+	(*InitRequest)(nil),                     // 71: olivetin.api.v1.InitRequest
+	(*InitResponse)(nil),                    // 72: olivetin.api.v1.InitResponse
+	(*RootDashboard)(nil),                   // 73: olivetin.api.v1.RootDashboard
+	(*AdditionalLink)(nil),                  // 74: olivetin.api.v1.AdditionalLink
+	(*OAuth2Provider)(nil),                  // 75: olivetin.api.v1.OAuth2Provider
+	(*GetActionBindingRequest)(nil),         // 76: olivetin.api.v1.GetActionBindingRequest
+	(*GetActionBindingResponse)(nil),        // 77: olivetin.api.v1.GetActionBindingResponse
+	(*GetEntitiesRequest)(nil),              // 78: olivetin.api.v1.GetEntitiesRequest
+	(*GetEntitiesResponse)(nil),             // 79: olivetin.api.v1.GetEntitiesResponse
+	(*EntityDefinition)(nil),                // 80: olivetin.api.v1.EntityDefinition
+	(*EntityProperty)(nil),                  // 81: olivetin.api.v1.EntityProperty
+	(*GetEntityRequest)(nil),                // 82: olivetin.api.v1.GetEntityRequest
+	(*RestartActionRequest)(nil),            // 83: olivetin.api.v1.RestartActionRequest
+	nil,                                     // 84: olivetin.api.v1.ActionWebhookExecHint.MatchHeadersEntry
+	nil,                                     // 85: olivetin.api.v1.ActionWebhookExecHint.MatchQueryEntry
+	nil,                                     // 86: olivetin.api.v1.ActionArgument.SuggestionsEntry
+	nil,                                     // 87: olivetin.api.v1.EntityRelatedAction.PrefilledArgumentsEntry
+	nil,                                     // 88: olivetin.api.v1.Entity.FieldsEntry
+	nil,                                     // 89: olivetin.api.v1.DumpVarsResponse.ContentsEntry
+	nil,                                     // 90: olivetin.api.v1.DumpPublicIdActionMapResponse.ContentsEntry
 }
 var file_olivetin_api_v1_olivetin_proto_depIdxs = []int32{
 	3,  // 0: olivetin.api.v1.Action.arguments:type_name -> olivetin.api.v1.ActionArgument
 	2,  // 1: olivetin.api.v1.Action.exec_on_webhooks:type_name -> olivetin.api.v1.ActionWebhookExecHint
 	1,  // 2: olivetin.api.v1.Action.groups:type_name -> olivetin.api.v1.ActionGroupMembership
-	80, // 3: olivetin.api.v1.ActionWebhookExecHint.match_headers:type_name -> olivetin.api.v1.ActionWebhookExecHint.MatchHeadersEntry
-	81, // 4: olivetin.api.v1.ActionWebhookExecHint.match_query:type_name -> olivetin.api.v1.ActionWebhookExecHint.MatchQueryEntry
+	84, // 3: olivetin.api.v1.ActionWebhookExecHint.match_headers:type_name -> olivetin.api.v1.ActionWebhookExecHint.MatchHeadersEntry
+	85, // 4: olivetin.api.v1.ActionWebhookExecHint.match_query:type_name -> olivetin.api.v1.ActionWebhookExecHint.MatchQueryEntry
 	4,  // 5: olivetin.api.v1.ActionArgument.choices:type_name -> olivetin.api.v1.ActionArgumentChoice
-	82, // 6: olivetin.api.v1.ActionArgument.suggestions:type_name -> olivetin.api.v1.ActionArgument.SuggestionsEntry
+	86, // 6: olivetin.api.v1.ActionArgument.suggestions:type_name -> olivetin.api.v1.ActionArgument.SuggestionsEntry
 	0,  // 7: olivetin.api.v1.EntityRelatedAction.action:type_name -> olivetin.api.v1.Action
-	83, // 8: olivetin.api.v1.EntityRelatedAction.prefilled_arguments:type_name -> olivetin.api.v1.EntityRelatedAction.PrefilledArgumentsEntry
-	84, // 9: olivetin.api.v1.Entity.fields:type_name -> olivetin.api.v1.Entity.FieldsEntry
+	87, // 8: olivetin.api.v1.EntityRelatedAction.prefilled_arguments:type_name -> olivetin.api.v1.EntityRelatedAction.PrefilledArgumentsEntry
+	88, // 9: olivetin.api.v1.Entity.fields:type_name -> olivetin.api.v1.Entity.FieldsEntry
 	5,  // 10: olivetin.api.v1.Entity.related_actions:type_name -> olivetin.api.v1.EntityRelatedAction
-	10, // 11: olivetin.api.v1.GetDashboardResponse.dashboard:type_name -> olivetin.api.v1.Dashboard
-	11, // 12: olivetin.api.v1.Dashboard.contents:type_name -> olivetin.api.v1.DashboardComponent
-	11, // 13: olivetin.api.v1.DashboardComponent.contents:type_name -> olivetin.api.v1.DashboardComponent
-	0,  // 14: olivetin.api.v1.DashboardComponent.action:type_name -> olivetin.api.v1.Action
-	13, // 15: olivetin.api.v1.StartActionRequest.arguments:type_name -> olivetin.api.v1.StartActionArgument
-	13, // 16: olivetin.api.v1.StartActionAndWaitRequest.arguments:type_name -> olivetin.api.v1.StartActionArgument
-	22, // 17: olivetin.api.v1.StartActionAndWaitResponse.log_entry:type_name -> olivetin.api.v1.LogEntry
-	22, // 18: olivetin.api.v1.StartActionByGetAndWaitResponse.log_entry:type_name -> olivetin.api.v1.LogEntry
-	13, // 19: olivetin.api.v1.LogEntry.arguments:type_name -> olivetin.api.v1.StartActionArgument
-	22, // 20: olivetin.api.v1.GetLogsResponse.logs:type_name -> olivetin.api.v1.LogEntry
-	22, // 21: olivetin.api.v1.GetActionLogsResponse.logs:type_name -> olivetin.api.v1.LogEntry
-	22, // 22: olivetin.api.v1.ExecutionQueueAction.entries:type_name -> olivetin.api.v1.LogEntry
-	27, // 23: olivetin.api.v1.ExecutionQueueGroup.actions:type_name -> olivetin.api.v1.ExecutionQueueAction
-	28, // 24: olivetin.api.v1.GetExecutionQueueResponse.groups:type_name -> olivetin.api.v1.ExecutionQueueGroup
-	22, // 25: olivetin.api.v1.ExecutionStatusResponse.log_entry:type_name -> olivetin.api.v1.LogEntry
-	35, // 26: olivetin.api.v1.ExecutionStatusResponse.back_to_dashboards:type_name -> olivetin.api.v1.DashboardNavigationTarget
-	85, // 27: olivetin.api.v1.DumpVarsResponse.contents:type_name -> olivetin.api.v1.DumpVarsResponse.ContentsEntry
-	86, // 28: olivetin.api.v1.DumpPublicIdActionMapResponse.contents:type_name -> olivetin.api.v1.DumpPublicIdActionMapResponse.ContentsEntry
-	51, // 29: olivetin.api.v1.EventStreamResponse.entity_changed:type_name -> olivetin.api.v1.EventEntityChanged
-	52, // 30: olivetin.api.v1.EventStreamResponse.config_changed:type_name -> olivetin.api.v1.EventConfigChanged
-	54, // 31: olivetin.api.v1.EventStreamResponse.execution_finished:type_name -> olivetin.api.v1.EventExecutionFinished
-	55, // 32: olivetin.api.v1.EventStreamResponse.execution_started:type_name -> olivetin.api.v1.EventExecutionStarted
-	50, // 33: olivetin.api.v1.EventStreamResponse.output_chunk:type_name -> olivetin.api.v1.EventOutputChunk
-	53, // 34: olivetin.api.v1.EventStreamResponse.heartbeat:type_name -> olivetin.api.v1.EventHeartbeat
-	22, // 35: olivetin.api.v1.EventExecutionFinished.log_entry:type_name -> olivetin.api.v1.LogEntry
-	22, // 36: olivetin.api.v1.EventExecutionStarted.log_entry:type_name -> olivetin.api.v1.LogEntry
-	65, // 37: olivetin.api.v1.GetDiagnosticsResponse.config_issues:type_name -> olivetin.api.v1.ConfigIssue
-	71, // 38: olivetin.api.v1.InitResponse.oAuth2Providers:type_name -> olivetin.api.v1.OAuth2Provider
-	70, // 39: olivetin.api.v1.InitResponse.additionalLinks:type_name -> olivetin.api.v1.AdditionalLink
-	8,  // 40: olivetin.api.v1.InitResponse.effective_policy:type_name -> olivetin.api.v1.EffectivePolicy
-	69, // 41: olivetin.api.v1.InitResponse.root_dashboard_entries:type_name -> olivetin.api.v1.RootDashboard
-	0,  // 42: olivetin.api.v1.GetActionBindingResponse.action:type_name -> olivetin.api.v1.Action
-	35, // 43: olivetin.api.v1.GetActionBindingResponse.back_to_dashboards:type_name -> olivetin.api.v1.DashboardNavigationTarget
-	76, // 44: olivetin.api.v1.GetEntitiesResponse.entity_definitions:type_name -> olivetin.api.v1.EntityDefinition
-	6,  // 45: olivetin.api.v1.EntityDefinition.instances:type_name -> olivetin.api.v1.Entity
-	77, // 46: olivetin.api.v1.EntityDefinition.properties:type_name -> olivetin.api.v1.EntityProperty
-	43, // 47: olivetin.api.v1.DumpPublicIdActionMapResponse.ContentsEntry.value:type_name -> olivetin.api.v1.DebugBinding
-	9,  // 48: olivetin.api.v1.OliveTinApiService.GetDashboard:input_type -> olivetin.api.v1.GetDashboardRequest
-	12, // 49: olivetin.api.v1.OliveTinApiService.StartAction:input_type -> olivetin.api.v1.StartActionRequest
-	15, // 50: olivetin.api.v1.OliveTinApiService.StartActionAndWait:input_type -> olivetin.api.v1.StartActionAndWaitRequest
-	17, // 51: olivetin.api.v1.OliveTinApiService.StartActionByGet:input_type -> olivetin.api.v1.StartActionByGetRequest
-	19, // 52: olivetin.api.v1.OliveTinApiService.StartActionByGetAndWait:input_type -> olivetin.api.v1.StartActionByGetAndWaitRequest
-	79, // 53: olivetin.api.v1.OliveTinApiService.RestartAction:input_type -> olivetin.api.v1.RestartActionRequest
-	56, // 54: olivetin.api.v1.OliveTinApiService.KillAction:input_type -> olivetin.api.v1.KillActionRequest
-	34, // 55: olivetin.api.v1.OliveTinApiService.ExecutionStatus:input_type -> olivetin.api.v1.ExecutionStatusRequest
-	21, // 56: olivetin.api.v1.OliveTinApiService.GetLogs:input_type -> olivetin.api.v1.GetLogsRequest
-	24, // 57: olivetin.api.v1.OliveTinApiService.GetActionLogs:input_type -> olivetin.api.v1.GetActionLogsRequest
-	26, // 58: olivetin.api.v1.OliveTinApiService.GetExecutionQueue:input_type -> olivetin.api.v1.GetExecutionQueueRequest
-	30, // 59: olivetin.api.v1.OliveTinApiService.ValidateArgumentType:input_type -> olivetin.api.v1.ValidateArgumentTypeRequest
-	37, // 60: olivetin.api.v1.OliveTinApiService.WhoAmI:input_type -> olivetin.api.v1.WhoAmIRequest
-	39, // 61: olivetin.api.v1.OliveTinApiService.ServerDiagnostics:input_type -> olivetin.api.v1.ServerDiagnosticsRequest
-	41, // 62: olivetin.api.v1.OliveTinApiService.DumpVars:input_type -> olivetin.api.v1.DumpVarsRequest
-	44, // 63: olivetin.api.v1.OliveTinApiService.DumpPublicIdActionMap:input_type -> olivetin.api.v1.DumpPublicIdActionMapRequest
-	46, // 64: olivetin.api.v1.OliveTinApiService.GetReadyz:input_type -> olivetin.api.v1.GetReadyzRequest
-	58, // 65: olivetin.api.v1.OliveTinApiService.LocalUserLogin:input_type -> olivetin.api.v1.LocalUserLoginRequest
-	60, // 66: olivetin.api.v1.OliveTinApiService.PasswordHash:input_type -> olivetin.api.v1.PasswordHashRequest
-	62, // 67: olivetin.api.v1.OliveTinApiService.Logout:input_type -> olivetin.api.v1.LogoutRequest
-	48, // 68: olivetin.api.v1.OliveTinApiService.EventStream:input_type -> olivetin.api.v1.EventStreamRequest
-	64, // 69: olivetin.api.v1.OliveTinApiService.GetDiagnostics:input_type -> olivetin.api.v1.GetDiagnosticsRequest
-	67, // 70: olivetin.api.v1.OliveTinApiService.Init:input_type -> olivetin.api.v1.InitRequest
-	72, // 71: olivetin.api.v1.OliveTinApiService.GetActionBinding:input_type -> olivetin.api.v1.GetActionBindingRequest
-	74, // 72: olivetin.api.v1.OliveTinApiService.GetEntities:input_type -> olivetin.api.v1.GetEntitiesRequest
-	78, // 73: olivetin.api.v1.OliveTinApiService.GetEntity:input_type -> olivetin.api.v1.GetEntityRequest
-	7,  // 74: olivetin.api.v1.OliveTinApiService.GetDashboard:output_type -> olivetin.api.v1.GetDashboardResponse
-	14, // 75: olivetin.api.v1.OliveTinApiService.StartAction:output_type -> olivetin.api.v1.StartActionResponse
-	16, // 76: olivetin.api.v1.OliveTinApiService.StartActionAndWait:output_type -> olivetin.api.v1.StartActionAndWaitResponse
-	18, // 77: olivetin.api.v1.OliveTinApiService.StartActionByGet:output_type -> olivetin.api.v1.StartActionByGetResponse
-	20, // 78: olivetin.api.v1.OliveTinApiService.StartActionByGetAndWait:output_type -> olivetin.api.v1.StartActionByGetAndWaitResponse
-	14, // 79: olivetin.api.v1.OliveTinApiService.RestartAction:output_type -> olivetin.api.v1.StartActionResponse
-	57, // 80: olivetin.api.v1.OliveTinApiService.KillAction:output_type -> olivetin.api.v1.KillActionResponse
-	36, // 81: olivetin.api.v1.OliveTinApiService.ExecutionStatus:output_type -> olivetin.api.v1.ExecutionStatusResponse
-	23, // 82: olivetin.api.v1.OliveTinApiService.GetLogs:output_type -> olivetin.api.v1.GetLogsResponse
-	25, // 83: olivetin.api.v1.OliveTinApiService.GetActionLogs:output_type -> olivetin.api.v1.GetActionLogsResponse
-	29, // 84: olivetin.api.v1.OliveTinApiService.GetExecutionQueue:output_type -> olivetin.api.v1.GetExecutionQueueResponse
-	31, // 85: olivetin.api.v1.OliveTinApiService.ValidateArgumentType:output_type -> olivetin.api.v1.ValidateArgumentTypeResponse
-	38, // 86: olivetin.api.v1.OliveTinApiService.WhoAmI:output_type -> olivetin.api.v1.WhoAmIResponse
-	40, // 87: olivetin.api.v1.OliveTinApiService.ServerDiagnostics:output_type -> olivetin.api.v1.ServerDiagnosticsResponse
-	42, // 88: olivetin.api.v1.OliveTinApiService.DumpVars:output_type -> olivetin.api.v1.DumpVarsResponse
-	45, // 89: olivetin.api.v1.OliveTinApiService.DumpPublicIdActionMap:output_type -> olivetin.api.v1.DumpPublicIdActionMapResponse
-	47, // 90: olivetin.api.v1.OliveTinApiService.GetReadyz:output_type -> olivetin.api.v1.GetReadyzResponse
-	59, // 91: olivetin.api.v1.OliveTinApiService.LocalUserLogin:output_type -> olivetin.api.v1.LocalUserLoginResponse
-	61, // 92: olivetin.api.v1.OliveTinApiService.PasswordHash:output_type -> olivetin.api.v1.PasswordHashResponse
-	63, // 93: olivetin.api.v1.OliveTinApiService.Logout:output_type -> olivetin.api.v1.LogoutResponse
-	49, // 94: olivetin.api.v1.OliveTinApiService.EventStream:output_type -> olivetin.api.v1.EventStreamResponse
-	66, // 95: olivetin.api.v1.OliveTinApiService.GetDiagnostics:output_type -> olivetin.api.v1.GetDiagnosticsResponse
-	68, // 96: olivetin.api.v1.OliveTinApiService.Init:output_type -> olivetin.api.v1.InitResponse
-	73, // 97: olivetin.api.v1.OliveTinApiService.GetActionBinding:output_type -> olivetin.api.v1.GetActionBindingResponse
-	75, // 98: olivetin.api.v1.OliveTinApiService.GetEntities:output_type -> olivetin.api.v1.GetEntitiesResponse
-	6,  // 99: olivetin.api.v1.OliveTinApiService.GetEntity:output_type -> olivetin.api.v1.Entity
-	74, // [74:100] is the sub-list for method output_type
-	48, // [48:74] is the sub-list for method input_type
-	48, // [48:48] is the sub-list for extension type_name
-	48, // [48:48] is the sub-list for extension extendee
-	0,  // [0:48] is the sub-list for field type_name
+	14, // 11: olivetin.api.v1.GetDashboardResponse.dashboard:type_name -> olivetin.api.v1.Dashboard
+	9,  // 12: olivetin.api.v1.SearchHints.entities:type_name -> olivetin.api.v1.EntitySearchHint
+	10, // 13: olivetin.api.v1.SearchHints.actions:type_name -> olivetin.api.v1.ActionSearchHint
+	15, // 14: olivetin.api.v1.Dashboard.contents:type_name -> olivetin.api.v1.DashboardComponent
+	15, // 15: olivetin.api.v1.DashboardComponent.contents:type_name -> olivetin.api.v1.DashboardComponent
+	0,  // 16: olivetin.api.v1.DashboardComponent.action:type_name -> olivetin.api.v1.Action
+	17, // 17: olivetin.api.v1.StartActionRequest.arguments:type_name -> olivetin.api.v1.StartActionArgument
+	17, // 18: olivetin.api.v1.StartActionAndWaitRequest.arguments:type_name -> olivetin.api.v1.StartActionArgument
+	26, // 19: olivetin.api.v1.StartActionAndWaitResponse.log_entry:type_name -> olivetin.api.v1.LogEntry
+	26, // 20: olivetin.api.v1.StartActionByGetAndWaitResponse.log_entry:type_name -> olivetin.api.v1.LogEntry
+	17, // 21: olivetin.api.v1.LogEntry.arguments:type_name -> olivetin.api.v1.StartActionArgument
+	26, // 22: olivetin.api.v1.GetLogsResponse.logs:type_name -> olivetin.api.v1.LogEntry
+	26, // 23: olivetin.api.v1.GetActionLogsResponse.logs:type_name -> olivetin.api.v1.LogEntry
+	26, // 24: olivetin.api.v1.ExecutionQueueAction.entries:type_name -> olivetin.api.v1.LogEntry
+	31, // 25: olivetin.api.v1.ExecutionQueueGroup.actions:type_name -> olivetin.api.v1.ExecutionQueueAction
+	32, // 26: olivetin.api.v1.GetExecutionQueueResponse.groups:type_name -> olivetin.api.v1.ExecutionQueueGroup
+	26, // 27: olivetin.api.v1.ExecutionStatusResponse.log_entry:type_name -> olivetin.api.v1.LogEntry
+	39, // 28: olivetin.api.v1.ExecutionStatusResponse.back_to_dashboards:type_name -> olivetin.api.v1.DashboardNavigationTarget
+	89, // 29: olivetin.api.v1.DumpVarsResponse.contents:type_name -> olivetin.api.v1.DumpVarsResponse.ContentsEntry
+	90, // 30: olivetin.api.v1.DumpPublicIdActionMapResponse.contents:type_name -> olivetin.api.v1.DumpPublicIdActionMapResponse.ContentsEntry
+	55, // 31: olivetin.api.v1.EventStreamResponse.entity_changed:type_name -> olivetin.api.v1.EventEntityChanged
+	56, // 32: olivetin.api.v1.EventStreamResponse.config_changed:type_name -> olivetin.api.v1.EventConfigChanged
+	58, // 33: olivetin.api.v1.EventStreamResponse.execution_finished:type_name -> olivetin.api.v1.EventExecutionFinished
+	59, // 34: olivetin.api.v1.EventStreamResponse.execution_started:type_name -> olivetin.api.v1.EventExecutionStarted
+	54, // 35: olivetin.api.v1.EventStreamResponse.output_chunk:type_name -> olivetin.api.v1.EventOutputChunk
+	57, // 36: olivetin.api.v1.EventStreamResponse.heartbeat:type_name -> olivetin.api.v1.EventHeartbeat
+	26, // 37: olivetin.api.v1.EventExecutionFinished.log_entry:type_name -> olivetin.api.v1.LogEntry
+	26, // 38: olivetin.api.v1.EventExecutionStarted.log_entry:type_name -> olivetin.api.v1.LogEntry
+	69, // 39: olivetin.api.v1.GetDiagnosticsResponse.config_issues:type_name -> olivetin.api.v1.ConfigIssue
+	75, // 40: olivetin.api.v1.InitResponse.oAuth2Providers:type_name -> olivetin.api.v1.OAuth2Provider
+	74, // 41: olivetin.api.v1.InitResponse.additionalLinks:type_name -> olivetin.api.v1.AdditionalLink
+	11, // 42: olivetin.api.v1.InitResponse.effective_policy:type_name -> olivetin.api.v1.EffectivePolicy
+	73, // 43: olivetin.api.v1.InitResponse.root_dashboard_entries:type_name -> olivetin.api.v1.RootDashboard
+	8,  // 44: olivetin.api.v1.InitResponse.search_hints:type_name -> olivetin.api.v1.SearchHints
+	12, // 45: olivetin.api.v1.InitResponse.features:type_name -> olivetin.api.v1.Features
+	0,  // 46: olivetin.api.v1.GetActionBindingResponse.action:type_name -> olivetin.api.v1.Action
+	39, // 47: olivetin.api.v1.GetActionBindingResponse.back_to_dashboards:type_name -> olivetin.api.v1.DashboardNavigationTarget
+	80, // 48: olivetin.api.v1.GetEntitiesResponse.entity_definitions:type_name -> olivetin.api.v1.EntityDefinition
+	6,  // 49: olivetin.api.v1.EntityDefinition.instances:type_name -> olivetin.api.v1.Entity
+	81, // 50: olivetin.api.v1.EntityDefinition.properties:type_name -> olivetin.api.v1.EntityProperty
+	47, // 51: olivetin.api.v1.DumpPublicIdActionMapResponse.ContentsEntry.value:type_name -> olivetin.api.v1.DebugBinding
+	13, // 52: olivetin.api.v1.OliveTinApiService.GetDashboard:input_type -> olivetin.api.v1.GetDashboardRequest
+	16, // 53: olivetin.api.v1.OliveTinApiService.StartAction:input_type -> olivetin.api.v1.StartActionRequest
+	19, // 54: olivetin.api.v1.OliveTinApiService.StartActionAndWait:input_type -> olivetin.api.v1.StartActionAndWaitRequest
+	21, // 55: olivetin.api.v1.OliveTinApiService.StartActionByGet:input_type -> olivetin.api.v1.StartActionByGetRequest
+	23, // 56: olivetin.api.v1.OliveTinApiService.StartActionByGetAndWait:input_type -> olivetin.api.v1.StartActionByGetAndWaitRequest
+	83, // 57: olivetin.api.v1.OliveTinApiService.RestartAction:input_type -> olivetin.api.v1.RestartActionRequest
+	60, // 58: olivetin.api.v1.OliveTinApiService.KillAction:input_type -> olivetin.api.v1.KillActionRequest
+	38, // 59: olivetin.api.v1.OliveTinApiService.ExecutionStatus:input_type -> olivetin.api.v1.ExecutionStatusRequest
+	25, // 60: olivetin.api.v1.OliveTinApiService.GetLogs:input_type -> olivetin.api.v1.GetLogsRequest
+	28, // 61: olivetin.api.v1.OliveTinApiService.GetActionLogs:input_type -> olivetin.api.v1.GetActionLogsRequest
+	30, // 62: olivetin.api.v1.OliveTinApiService.GetExecutionQueue:input_type -> olivetin.api.v1.GetExecutionQueueRequest
+	34, // 63: olivetin.api.v1.OliveTinApiService.ValidateArgumentType:input_type -> olivetin.api.v1.ValidateArgumentTypeRequest
+	41, // 64: olivetin.api.v1.OliveTinApiService.WhoAmI:input_type -> olivetin.api.v1.WhoAmIRequest
+	43, // 65: olivetin.api.v1.OliveTinApiService.ServerDiagnostics:input_type -> olivetin.api.v1.ServerDiagnosticsRequest
+	45, // 66: olivetin.api.v1.OliveTinApiService.DumpVars:input_type -> olivetin.api.v1.DumpVarsRequest
+	48, // 67: olivetin.api.v1.OliveTinApiService.DumpPublicIdActionMap:input_type -> olivetin.api.v1.DumpPublicIdActionMapRequest
+	50, // 68: olivetin.api.v1.OliveTinApiService.GetReadyz:input_type -> olivetin.api.v1.GetReadyzRequest
+	62, // 69: olivetin.api.v1.OliveTinApiService.LocalUserLogin:input_type -> olivetin.api.v1.LocalUserLoginRequest
+	64, // 70: olivetin.api.v1.OliveTinApiService.PasswordHash:input_type -> olivetin.api.v1.PasswordHashRequest
+	66, // 71: olivetin.api.v1.OliveTinApiService.Logout:input_type -> olivetin.api.v1.LogoutRequest
+	52, // 72: olivetin.api.v1.OliveTinApiService.EventStream:input_type -> olivetin.api.v1.EventStreamRequest
+	68, // 73: olivetin.api.v1.OliveTinApiService.GetDiagnostics:input_type -> olivetin.api.v1.GetDiagnosticsRequest
+	71, // 74: olivetin.api.v1.OliveTinApiService.Init:input_type -> olivetin.api.v1.InitRequest
+	76, // 75: olivetin.api.v1.OliveTinApiService.GetActionBinding:input_type -> olivetin.api.v1.GetActionBindingRequest
+	78, // 76: olivetin.api.v1.OliveTinApiService.GetEntities:input_type -> olivetin.api.v1.GetEntitiesRequest
+	82, // 77: olivetin.api.v1.OliveTinApiService.GetEntity:input_type -> olivetin.api.v1.GetEntityRequest
+	7,  // 78: olivetin.api.v1.OliveTinApiService.GetDashboard:output_type -> olivetin.api.v1.GetDashboardResponse
+	18, // 79: olivetin.api.v1.OliveTinApiService.StartAction:output_type -> olivetin.api.v1.StartActionResponse
+	20, // 80: olivetin.api.v1.OliveTinApiService.StartActionAndWait:output_type -> olivetin.api.v1.StartActionAndWaitResponse
+	22, // 81: olivetin.api.v1.OliveTinApiService.StartActionByGet:output_type -> olivetin.api.v1.StartActionByGetResponse
+	24, // 82: olivetin.api.v1.OliveTinApiService.StartActionByGetAndWait:output_type -> olivetin.api.v1.StartActionByGetAndWaitResponse
+	18, // 83: olivetin.api.v1.OliveTinApiService.RestartAction:output_type -> olivetin.api.v1.StartActionResponse
+	61, // 84: olivetin.api.v1.OliveTinApiService.KillAction:output_type -> olivetin.api.v1.KillActionResponse
+	40, // 85: olivetin.api.v1.OliveTinApiService.ExecutionStatus:output_type -> olivetin.api.v1.ExecutionStatusResponse
+	27, // 86: olivetin.api.v1.OliveTinApiService.GetLogs:output_type -> olivetin.api.v1.GetLogsResponse
+	29, // 87: olivetin.api.v1.OliveTinApiService.GetActionLogs:output_type -> olivetin.api.v1.GetActionLogsResponse
+	33, // 88: olivetin.api.v1.OliveTinApiService.GetExecutionQueue:output_type -> olivetin.api.v1.GetExecutionQueueResponse
+	35, // 89: olivetin.api.v1.OliveTinApiService.ValidateArgumentType:output_type -> olivetin.api.v1.ValidateArgumentTypeResponse
+	42, // 90: olivetin.api.v1.OliveTinApiService.WhoAmI:output_type -> olivetin.api.v1.WhoAmIResponse
+	44, // 91: olivetin.api.v1.OliveTinApiService.ServerDiagnostics:output_type -> olivetin.api.v1.ServerDiagnosticsResponse
+	46, // 92: olivetin.api.v1.OliveTinApiService.DumpVars:output_type -> olivetin.api.v1.DumpVarsResponse
+	49, // 93: olivetin.api.v1.OliveTinApiService.DumpPublicIdActionMap:output_type -> olivetin.api.v1.DumpPublicIdActionMapResponse
+	51, // 94: olivetin.api.v1.OliveTinApiService.GetReadyz:output_type -> olivetin.api.v1.GetReadyzResponse
+	63, // 95: olivetin.api.v1.OliveTinApiService.LocalUserLogin:output_type -> olivetin.api.v1.LocalUserLoginResponse
+	65, // 96: olivetin.api.v1.OliveTinApiService.PasswordHash:output_type -> olivetin.api.v1.PasswordHashResponse
+	67, // 97: olivetin.api.v1.OliveTinApiService.Logout:output_type -> olivetin.api.v1.LogoutResponse
+	53, // 98: olivetin.api.v1.OliveTinApiService.EventStream:output_type -> olivetin.api.v1.EventStreamResponse
+	70, // 99: olivetin.api.v1.OliveTinApiService.GetDiagnostics:output_type -> olivetin.api.v1.GetDiagnosticsResponse
+	72, // 100: olivetin.api.v1.OliveTinApiService.Init:output_type -> olivetin.api.v1.InitResponse
+	77, // 101: olivetin.api.v1.OliveTinApiService.GetActionBinding:output_type -> olivetin.api.v1.GetActionBindingResponse
+	79, // 102: olivetin.api.v1.OliveTinApiService.GetEntities:output_type -> olivetin.api.v1.GetEntitiesResponse
+	6,  // 103: olivetin.api.v1.OliveTinApiService.GetEntity:output_type -> olivetin.api.v1.Entity
+	78, // [78:104] is the sub-list for method output_type
+	52, // [52:78] is the sub-list for method input_type
+	52, // [52:52] is the sub-list for extension type_name
+	52, // [52:52] is the sub-list for extension extendee
+	0,  // [0:52] is the sub-list for field type_name
 }
 
 func init() { file_olivetin_api_v1_olivetin_proto_init() }
@@ -5555,7 +5810,7 @@ func file_olivetin_api_v1_olivetin_proto_init() {
 	if File_olivetin_api_v1_olivetin_proto != nil {
 		return
 	}
-	file_olivetin_api_v1_olivetin_proto_msgTypes[49].OneofWrappers = []any{
+	file_olivetin_api_v1_olivetin_proto_msgTypes[53].OneofWrappers = []any{
 		(*EventStreamResponse_EntityChanged)(nil),
 		(*EventStreamResponse_ConfigChanged)(nil),
 		(*EventStreamResponse_ExecutionFinished)(nil),
@@ -5569,7 +5824,7 @@ func file_olivetin_api_v1_olivetin_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_olivetin_api_v1_olivetin_proto_rawDesc), len(file_olivetin_api_v1_olivetin_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   87,
+			NumMessages:   91,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/service/internal/acl/acl.go b/service/internal/acl/acl.go
index 7cceed0e..97200da1 100644
--- a/service/internal/acl/acl.go
+++ b/service/internal/acl/acl.go
@@ -139,6 +139,16 @@ func IsAllowedViewDashboard(cfg *config.Config, user *authpublic.AuthenticatedUs
 	return aclCheck(View, cfg.DefaultPermissions.View, cfg, "isAllowedViewDashboard", user, dashboard.Title, dashboard.Acls, false)
 }
 
+// IsAllowedViewEntityType checks if a user may see an entity type (list, details, search).
+// Entity types with no acls are unrestricted. AddToEveryAction does not apply.
+func IsAllowedViewEntityType(cfg *config.Config, user *authpublic.AuthenticatedUser, entityFile *config.EntityFile) bool {
+	if entityFile == nil || len(entityFile.Acls) == 0 {
+		return true
+	}
+
+	return aclCheck(View, cfg.DefaultPermissions.View, cfg, "isAllowedViewEntityType", user, entityFile.Name, entityFile.Acls, false)
+}
+
 func isACLRelevant(resourceAcls []string, acl *config.AccessControlList, user *authpublic.AuthenticatedUser, includeAddToEvery bool) bool {
 	if !slices.Contains(user.Acls, acl.Name) {
 		return false
diff --git a/service/internal/acl/acl_entity_test.go b/service/internal/acl/acl_entity_test.go
new file mode 100644
index 00000000..8778b4dd
--- /dev/null
+++ b/service/internal/acl/acl_entity_test.go
@@ -0,0 +1,80 @@
+package acl
+
+import (
+	"testing"
+
+	authpublic "github.com/OliveTin/OliveTin/internal/auth/authpublic"
+	config "github.com/OliveTin/OliveTin/internal/config"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsAllowedViewEntityTypeAbsentAclsUnrestricted(t *testing.T) {
+	cfg := config.DefaultConfig()
+	cfg.DefaultPermissions.View = false
+
+	entityFile := &config.EntityFile{
+		Name: "printers",
+		File: "printers.yaml",
+	}
+
+	guest := &authpublic.AuthenticatedUser{Username: "guest", Provider: "system"}
+	guest.BuildUserAcls(cfg)
+
+	assert.True(t, IsAllowedViewEntityType(cfg, guest, entityFile))
+	assert.True(t, IsAllowedViewEntityType(cfg, guest, nil))
+}
+
+func TestIsAllowedViewEntityTypeAllowDenyAndDefaultFallback(t *testing.T) {
+	cfg := config.DefaultConfig()
+	cfg.DefaultPermissions.View = false
+	cfg.AccessControlLists = []*config.AccessControlList{
+		{
+			Name:           "ops",
+			MatchUsernames: []string{"admin"},
+			Permissions:    config.PermissionsList{View: true, Exec: true},
+		},
+	}
+
+	entityFile := &config.EntityFile{
+		Name: "servers",
+		File: "servers.yaml",
+		Acls: []string{"ops"},
+	}
+
+	guest := &authpublic.AuthenticatedUser{Username: "guest", Provider: "system"}
+	guest.BuildUserAcls(cfg)
+	admin := &authpublic.AuthenticatedUser{Username: "admin"}
+	admin.BuildUserAcls(cfg)
+
+	assert.False(t, IsAllowedViewEntityType(cfg, guest, entityFile))
+	assert.True(t, IsAllowedViewEntityType(cfg, admin, entityFile))
+
+	cfg.DefaultPermissions.View = true
+	assert.True(t, IsAllowedViewEntityType(cfg, guest, entityFile),
+		"when no relevant ACL matches, fall back to defaultPermissions.view")
+}
+
+func TestIsAllowedViewEntityTypeIgnoresAddToEveryAction(t *testing.T) {
+	cfg := config.DefaultConfig()
+	cfg.DefaultPermissions.View = false
+	cfg.AccessControlLists = []*config.AccessControlList{
+		{
+			Name:             "admins",
+			MatchUsernames:   []string{"admin"},
+			AddToEveryAction: true,
+			Permissions:      config.PermissionsList{View: true, Exec: true},
+		},
+	}
+
+	entityFile := &config.EntityFile{
+		Name: "secret",
+		File: "secret.yaml",
+		Acls: []string{"other"},
+	}
+
+	admin := &authpublic.AuthenticatedUser{Username: "admin"}
+	admin.BuildUserAcls(cfg)
+
+	assert.False(t, IsAllowedViewEntityType(cfg, admin, entityFile),
+		"AddToEveryAction must not grant entity view without listing the ACL on the entity")
+}
diff --git a/service/internal/api/api.go b/service/internal/api/api.go
index 7fc3dc0f..931a4244 100644
--- a/service/internal/api/api.go
+++ b/service/internal/api/api.go
@@ -161,6 +161,10 @@ func (api *oliveTinAPI) StartAction(ctx ctx.Context, req *connect.Request[apiv1.
 
 	authenticatedUser := auth.UserFromApiCall(ctx, req, api.cfg)
 	args := startActionArgumentsFromProto(req.Msg.Arguments)
+	if err := api.errUnlessStartEntityAccessAllowed(authenticatedUser, pair, args); err != nil {
+		return nil, err
+	}
+
 	justification := resolveStartJustification(pair.Action, pair, req.Msg.Justification, args)
 	if err := validateJustificationRequired(pair.Action, justification, authenticatedUser); err != nil {
 		return nil, connectInvalidJustification(err)
@@ -309,6 +313,10 @@ func (api *oliveTinAPI) StartActionAndWait(ctx ctx.Context, req *connect.Request
 
 	user := auth.UserFromApiCall(ctx, req, api.cfg)
 	args := startActionArgumentsFromProto(req.Msg.Arguments)
+	if err = api.errUnlessStartEntityAccessAllowed(user, binding, args); err != nil {
+		return nil, err
+	}
+
 	justification := resolveStartJustification(binding.Action, binding, req.Msg.Justification, args)
 
 	if err = validateJustificationRequired(binding.Action, justification, user); err != nil {
@@ -330,13 +338,18 @@ func (api *oliveTinAPI) StartActionByGet(ctx ctx.Context, req *connect.Request[a
 		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("action with ID %s not found", req.Msg.ActionId))
 	}
 
+	user := auth.UserFromApiCall(ctx, req, api.cfg)
+	if err := api.errUnlessStartEntityAccessAllowed(user, binding, map[string]string{}); err != nil {
+		return nil, err
+	}
+
 	args := make(map[string]string)
 
 	execReq := executor.ExecutionRequest{
 		Binding:           binding,
 		TrackingID:        uuid.NewString(),
 		Arguments:         args,
-		AuthenticatedUser: auth.UserFromApiCall(ctx, req, api.cfg),
+		AuthenticatedUser: user,
 		Cfg:               api.cfg,
 	}
 
@@ -377,6 +390,10 @@ func (api *oliveTinAPI) StartActionByGetAndWait(ctx ctx.Context, req *connect.Re
 	}
 
 	user := auth.UserFromApiCall(ctx, req, api.cfg)
+	if err := api.errUnlessStartEntityAccessAllowed(user, binding, map[string]string{}); err != nil {
+		return nil, err
+	}
+
 	logEntry, err := api.startActionByGetAndWaitLogEntry(binding, user)
 	if err != nil {
 		return nil, err
@@ -586,7 +603,7 @@ func (api *oliveTinAPI) getActionBindingResponse(user *authpublic.AuthenticatedU
 		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("action with ID %s not found", bindingId))
 	}
 
-	if !api.userCanViewAction(user, binding.Action) {
+	if !api.userCanViewBinding(user, binding) {
 		return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}
 
@@ -603,6 +620,38 @@ func (api *oliveTinAPI) userCanViewAction(user *authpublic.AuthenticatedUser, ac
 	return acl.IsAllowedView(api.cfg, user, action)
 }
 
+func (api *oliveTinAPI) userCanViewEntityType(user *authpublic.AuthenticatedUser, entityType string) bool {
+	return acl.IsAllowedViewEntityType(api.cfg, user, entityFileForType(api.cfg, entityType))
+}
+
+func (api *oliveTinAPI) userCanViewBinding(user *authpublic.AuthenticatedUser, binding *executor.ActionBinding) bool {
+	if binding == nil || binding.Action == nil {
+		return false
+	}
+
+	if !api.userCanViewAction(user, binding.Action) {
+		return false
+	}
+
+	return api.bindingEntityTypeAllowed(user, binding)
+}
+
+func (api *oliveTinAPI) bindingEntityTypeAllowed(user *authpublic.AuthenticatedUser, binding *executor.ActionBinding) bool {
+	if binding == nil || binding.Entity == nil || binding.Action == nil || binding.Action.Entity == "" {
+		return true
+	}
+
+	return api.userCanViewEntityType(user, binding.Action.Entity)
+}
+
+func (api *oliveTinAPI) errUnlessBindingEntityTypeAllowed(user *authpublic.AuthenticatedUser, binding *executor.ActionBinding) error {
+	if api.bindingEntityTypeAllowed(user, binding) {
+		return nil
+	}
+
+	return connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+}
+
 func (api *oliveTinAPI) GetDashboard(ctx ctx.Context, req *connect.Request[apiv1.GetDashboardRequest]) (*connect.Response[apiv1.GetDashboardResponse], error) {
 	user := auth.UserFromApiCall(ctx, req, api.cfg)
 
@@ -848,7 +897,7 @@ func (api *oliveTinAPI) errUnlessUserMayValidateArgumentTypeForBinding(user *aut
 		return connect.NewError(connect.CodeNotFound, fmt.Errorf("action or argument not found for binding ID %s", bindingID))
 	}
 
-	if !api.userCanViewAction(user, binding.Action) {
+	if !api.userCanViewBinding(user, binding) {
 		return connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
 	}
 
@@ -869,9 +918,31 @@ func (api *oliveTinAPI) ValidateArgumentType(ctx ctx.Context, req *connect.Reque
 		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("action or argument not found for binding ID %s", req.Msg.BindingId))
 	}
 
+	if err := api.validateArgumentTypeEntityAccess(user, req.Msg); err != nil {
+		return nil, err
+	}
+
 	return api.validateArgumentTypeConnectResponse(req.Msg)
 }
 
+func (api *oliveTinAPI) validateArgumentTypeEntityAccess(user *authpublic.AuthenticatedUser, msg *apiv1.ValidateArgumentTypeRequest) error {
+	arg := api.argumentFromValidationRequest(msg)
+	if arg == nil {
+		return nil
+	}
+
+	return api.errUnlessEntityArgumentAllowed(user, arg, "")
+}
+
+func (api *oliveTinAPI) argumentFromValidationRequest(msg *apiv1.ValidateArgumentTypeRequest) *config.ActionArgument {
+	if msg == nil || msg.BindingId == "" || msg.ArgumentName == "" {
+		return nil
+	}
+
+	arg, _ := api.findArgumentForValidation(msg.BindingId, msg.ArgumentName)
+	return arg
+}
+
 func (api *oliveTinAPI) validateArgumentTypeConnectResponse(msg *apiv1.ValidateArgumentTypeRequest) (*connect.Response[apiv1.ValidateArgumentTypeResponse], error) {
 	err := api.validateArgumentTypeInternal(msg)
 	desc := ""
@@ -895,6 +966,10 @@ func (api *oliveTinAPI) validateArgumentTypeInternal(msg *apiv1.ValidateArgument
 		return fmt.Errorf("argument not found")
 	}
 
+	if err := errUnlessEntityArgumentValueAllowed(arg, msg.Value); err != nil {
+		return err
+	}
+
 	return executor.ValidateArgument(arg, msg.Value, action)
 }
 
@@ -1227,23 +1302,18 @@ func (api *oliveTinAPI) GetDiagnostics(ctx ctx.Context, req *connect.Request[api
 
 func (api *oliveTinAPI) Init(ctx ctx.Context, req *connect.Request[apiv1.InitRequest]) (*connect.Response[apiv1.InitResponse], error) {
 	user := auth.UserFromApiCall(ctx, req, api.cfg)
+	return connect.NewResponse(api.buildInitResponse(user)), nil
+}
 
+func (api *oliveTinAPI) buildInitResponse(user *authpublic.AuthenticatedUser) *apiv1.InitResponse {
 	loginRequired := user.IsGuest() && api.cfg.AuthRequireGuestsToLogin
-
-	showVersion := user.EffectivePolicy.ShowVersionNumber
-	currentVersion := ""
-	availableVersion := ""
-	if showVersion {
-		currentVersion = installationinfo.Build.Version
-		availableVersion = installationinfo.Runtime.AvailableVersion
-	}
-
+	currentVersion, availableVersion, showNewVersions := initVersionFields(user, api.cfg)
 	rootDashboardEntries := api.buildRootDashboardEntries(user, api.cfg.Dashboards)
 
 	res := &apiv1.InitResponse{
 		ShowFooter:                api.cfg.ShowFooter,
 		ShowNavigation:            api.cfg.ShowNavigation,
-		ShowNewVersions:           showVersion && api.cfg.ShowNewVersions,
+		ShowNewVersions:           showNewVersions,
 		AvailableVersion:          availableVersion,
 		CurrentVersion:            currentVersion,
 		PageTitle:                 api.cfg.PageTitle,
@@ -1268,9 +1338,29 @@ func (api *oliveTinAPI) Init(ctx ctx.Context, req *connect.Request[apiv1.InitReq
 		AvailableThemes:           discoverAvailableThemes(api.cfg),
 		ShowNavigateOnStartIcons:  api.cfg.ShowNavigateOnStartIcons,
 		ConfigIssueCount:          configIssueCountForUser(api, user),
+		Features: &apiv1.Features{
+			HeaderSearch: api.cfg.Features.HeaderSearch,
+		},
+		SearchHints: api.initSearchHints(user, loginRequired),
 	}
 
-	return connect.NewResponse(res), nil
+	return res
+}
+
+func initVersionFields(user *authpublic.AuthenticatedUser, cfg *config.Config) (currentVersion string, availableVersion string, showNewVersions bool) {
+	if !user.EffectivePolicy.ShowVersionNumber {
+		return "", "", false
+	}
+
+	return installationinfo.Build.Version, installationinfo.Runtime.AvailableVersion, cfg.ShowNewVersions
+}
+
+func (api *oliveTinAPI) initSearchHints(user *authpublic.AuthenticatedUser, loginRequired bool) *apiv1.SearchHints {
+	if loginRequired || !api.cfg.Features.HeaderSearch {
+		return nil
+	}
+
+	return api.buildSearchHints(user)
 }
 
 // discoverAvailableThemes finds all available themes in the custom-webui/themes directory.
@@ -1450,7 +1540,7 @@ func (api *oliveTinAPI) GetEntities(ctx ctx.Context, req *connect.Request[apiv1.
 	}
 
 	entityMap := entities.GetEntities()
-	entityDefinitions := api.buildEntityDefinitionsResponse(req.Msg, entityMap)
+	entityDefinitions := api.buildEntityDefinitionsResponse(user, req.Msg, entityMap)
 
 	res := &apiv1.GetEntitiesResponse{
 		EntityDefinitions: entityDefinitions,
@@ -1570,6 +1660,10 @@ func (api *oliveTinAPI) GetEntity(ctx ctx.Context, req *connect.Request[apiv1.Ge
 		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("entity type %s not found", req.Msg.Type))
 	}
 
+	if !api.userCanViewEntityType(user, req.Msg.Type) {
+		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("entity type %s not found", req.Msg.Type))
+	}
+
 	entity, ok := instances[req.Msg.UniqueKey]
 	if !ok {
 		return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("entity with unique key %s not found in type %s", req.Msg.UniqueKey, req.Msg.Type))
@@ -1701,9 +1795,14 @@ func (api *oliveTinAPI) RestartAction(ctx ctx.Context, req *connect.Request[apiv
 	}
 
 	authenticatedUser := auth.UserFromApiCall(ctx, req, api.cfg)
+	restartArgs := copyStringMap(execReqLogEntry.Arguments)
+	if err := api.errUnlessStartEntityAccessAllowed(authenticatedUser, execReqLogEntry.Binding, restartArgs); err != nil {
+		return nil, err
+	}
+
 	execReq := executor.ExecutionRequest{
 		Binding:           execReqLogEntry.Binding,
-		Arguments:         copyStringMap(execReqLogEntry.Arguments),
+		Arguments:         restartArgs,
 		Justification:     execReqLogEntry.Justification,
 		AuthenticatedUser: authenticatedUser,
 		Cfg:               api.cfg,
diff --git a/service/internal/api/apiActions.go b/service/internal/api/apiActions.go
index cb7bed81..3f8a8c26 100644
--- a/service/internal/api/apiActions.go
+++ b/service/internal/api/apiActions.go
@@ -81,18 +81,42 @@ func (rr *DashboardRenderRequest) findActionForEntity(title string, entity *enti
 	defer rr.ex.MapActionBindingsLock.RUnlock()
 
 	for _, binding := range rr.ex.MapActionBindings {
-		if !bindingMatchesTitleAndEntity(binding, title, entity) {
-			continue
+		if action := rr.actionFromMatchingBinding(title, entity, binding); action != nil {
+			return action
 		}
-		if !acl.IsAllowedView(rr.cfg, rr.AuthenticatedUser, binding.Action) {
-			return nil
-		}
-		return buildAction(binding, rr)
 	}
 
 	return nil
 }
 
+func (rr *DashboardRenderRequest) actionFromMatchingBinding(title string, entity *entities.Entity, binding *executor.ActionBinding) *apiv1.Action {
+	if !bindingMatchesTitleAndEntity(binding, title, entity) {
+		return nil
+	}
+
+	if !rr.canViewBindingForDashboard(binding) {
+		return nil
+	}
+
+	return buildAction(binding, rr)
+}
+
+func (rr *DashboardRenderRequest) canViewBindingForDashboard(binding *executor.ActionBinding) bool {
+	if binding == nil || binding.Action == nil {
+		return false
+	}
+
+	if !acl.IsAllowedView(rr.cfg, rr.AuthenticatedUser, binding.Action) {
+		return false
+	}
+
+	if binding.Action.Entity == "" {
+		return true
+	}
+
+	return acl.IsAllowedViewEntityType(rr.cfg, rr.AuthenticatedUser, entityFileForType(rr.cfg, binding.Action.Entity))
+}
+
 func matchesEntity(binding *executor.ActionBinding, entity *entities.Entity) bool {
 	if entity == nil {
 		return binding.Entity == nil
@@ -191,7 +215,7 @@ func applyActiveBindingStateToAction(btn *apiv1.Action, bindingID string, states
 	btn.HasQueuedInstance = state.hasQueued
 }
 
-func buildActionArguments(action *config.Action, entity *entities.Entity) []*apiv1.ActionArgument {
+func buildActionArguments(action *config.Action, entity *entities.Entity, rr *DashboardRenderRequest) []*apiv1.ActionArgument {
 	args := make([]*apiv1.ActionArgument, 0, len(action.Arguments))
 	for _, cfgArg := range action.Arguments {
 		args = append(args, &apiv1.ActionArgument{
@@ -200,7 +224,7 @@ func buildActionArguments(action *config.Action, entity *entities.Entity) []*api
 			Type:                  cfgArg.Type,
 			Description:           cfgArg.Description,
 			DefaultValue:          getDefaultArgumentValue(cfgArg, entity),
-			Choices:               buildChoices(cfgArg),
+			Choices:               buildChoices(cfgArg, rr),
 			Suggestions:           cfgArg.Suggestions,
 			SuggestionsBrowserKey: cfgArg.SuggestionsBrowserKey,
 		})
@@ -228,7 +252,7 @@ func buildAction(actionBinding *executor.ActionBinding, rr *DashboardRenderReque
 
 	applyActiveBindingStateToAction(&btn, binding.ID, rr.activeBindingStates)
 	applyActionExecTriggers(&btn, action)
-	btn.Arguments = buildActionArguments(action, binding.Entity)
+	btn.Arguments = buildActionArguments(action, binding.Entity, rr)
 	btn.Groups = buildActionGroups(action, rr.cfg)
 
 	return &btn
@@ -262,15 +286,23 @@ func actionGroupMembershipFromConfig(name string, cfg *config.Config) *apiv1.Act
 	return membership
 }
 
-func buildChoices(arg config.ActionArgument) []*apiv1.ActionArgumentChoice {
-	if arg.Entity != "" && len(arg.Choices) == 1 {
-		return buildChoicesEntity(arg.Choices[0], arg.Entity)
-	} else {
+func buildChoices(arg config.ActionArgument, rr *DashboardRenderRequest) []*apiv1.ActionArgumentChoice {
+	if arg.Entity == "" {
 		return buildChoicesSimple(arg.Choices)
 	}
+
+	if len(arg.Choices) != 1 {
+		return []*apiv1.ActionArgumentChoice{}
+	}
+
+	return buildChoicesEntity(arg.Choices[0], arg.Entity, rr)
 }
 
-func buildChoicesEntity(firstChoice config.ActionArgumentChoice, entityTitle string) []*apiv1.ActionArgumentChoice {
+func buildChoicesEntity(firstChoice config.ActionArgumentChoice, entityTitle string, rr *DashboardRenderRequest) []*apiv1.ActionArgumentChoice {
+	if rr != nil && !acl.IsAllowedViewEntityType(rr.cfg, rr.AuthenticatedUser, entityFileForType(rr.cfg, entityTitle)) {
+		return []*apiv1.ActionArgumentChoice{}
+	}
+
 	ret := []*apiv1.ActionArgumentChoice{}
 
 	for _, ent := range entities.GetEntityInstancesOrdered(entityTitle) {
diff --git a/service/internal/api/api_entities_list.go b/service/internal/api/api_entities_list.go
index a5207ad7..ab1ec784 100644
--- a/service/internal/api/api_entities_list.go
+++ b/service/internal/api/api_entities_list.go
@@ -5,6 +5,7 @@ import (
 	"strings"
 
 	apiv1 "github.com/OliveTin/OliveTin/gen/olivetin/api/v1"
+	authpublic "github.com/OliveTin/OliveTin/internal/auth/authpublic"
 	config "github.com/OliveTin/OliveTin/internal/config"
 	"github.com/OliveTin/OliveTin/internal/entities"
 )
@@ -14,66 +15,73 @@ const (
 	maxEntityInstancesPageSize     = 100
 )
 
-func (api *oliveTinAPI) buildEntityDefinitionsResponse(req *apiv1.GetEntitiesRequest, entityMap entities.EntitiesByClass) []*apiv1.EntityDefinition {
+func (api *oliveTinAPI) buildEntityDefinitionsResponse(user *authpublic.AuthenticatedUser, req *apiv1.GetEntitiesRequest, entityMap entities.EntitiesByClass) []*apiv1.EntityDefinition {
 	if req != nil && req.EntityType != "" {
-		return api.buildFilteredEntityDefinitions(req, entityMap)
+		return api.buildFilteredEntityDefinitions(user, req, entityMap)
 	}
 
-	return api.buildAllEntityDefinitions(entityMap)
+	return api.buildAllEntityDefinitions(user, entityMap)
 }
 
-func (api *oliveTinAPI) buildAllEntityDefinitions(entityMap entities.EntitiesByClass) []*apiv1.EntityDefinition {
+func (api *oliveTinAPI) buildAllEntityDefinitions(user *authpublic.AuthenticatedUser, entityMap entities.EntitiesByClass) []*apiv1.EntityDefinition {
 	entityNames := sortedEntityTypeNames(entityMap)
 	entityDefinitions := make([]*apiv1.EntityDefinition, 0, len(entityNames))
 
 	for _, name := range entityNames {
-		entityFile := entityFileForType(api.cfg, name)
-		properties := entityPropertiesFromFile(entityFile)
-		instances := buildSortedEntityInstances(name, entityMap[name], properties)
-
-		def := &apiv1.EntityDefinition{
-			Title:            name,
-			UsedOnDashboards: findDashboardsForEntity(name, api.cfg.Dashboards),
-			Icon:             entityTypeIcon(api.cfg, name),
-			Properties:       entityDefinitionProperties(properties),
-			TotalInstances:   int32(len(instances)),
-		}
-
-		if len(properties) == 0 {
-			def.Instances = instances
+		if !api.userCanViewEntityType(user, name) {
+			continue
 		}
 
+		def := api.buildEntityDefinition(name, entityMap[name], false, "", 0, 0)
 		entityDefinitions = append(entityDefinitions, def)
 	}
 
 	return entityDefinitions
 }
 
-func (api *oliveTinAPI) buildFilteredEntityDefinitions(req *apiv1.GetEntitiesRequest, entityMap entities.EntitiesByClass) []*apiv1.EntityDefinition {
+func (api *oliveTinAPI) buildFilteredEntityDefinitions(user *authpublic.AuthenticatedUser, req *apiv1.GetEntitiesRequest, entityMap entities.EntitiesByClass) []*apiv1.EntityDefinition {
+	if !api.userCanViewEntityType(user, req.EntityType) {
+		return nil
+	}
+
 	entityInstances, ok := entityMap[req.EntityType]
 	if !ok || len(entityInstances) == 0 {
 		return nil
 	}
 
-	entityFile := entityFileForType(api.cfg, req.EntityType)
-	properties := entityPropertiesFromFile(entityFile)
-	instances := buildSortedEntityInstances(req.EntityType, entityInstances, properties)
-	filtered := filterEntityInstances(instances, req.Filter)
 	pageSize := normalizeEntityInstancesPageSize(req.PageSize)
 	page := normalizeEntityInstancesPage(req.Page)
-
-	def := &apiv1.EntityDefinition{
-		Title:            req.EntityType,
-		UsedOnDashboards: findDashboardsForEntity(req.EntityType, api.cfg.Dashboards),
-		Icon:             entityTypeIcon(api.cfg, req.EntityType),
-		Properties:       entityDefinitionProperties(properties),
-		TotalInstances:   int32(len(filtered)),
-		Instances:        paginateEntityInstances(filtered, page, pageSize),
-	}
+	def := api.buildEntityDefinition(req.EntityType, entityInstances, true, req.Filter, page, pageSize)
 
 	return []*apiv1.EntityDefinition{def}
 }
 
+func (api *oliveTinAPI) buildEntityDefinition(entityType string, entityInstances map[string]*entities.Entity, paginate bool, filter string, page, pageSize int32) *apiv1.EntityDefinition {
+	entityFile := entityFileForType(api.cfg, entityType)
+	properties := entityPropertiesFromFile(entityFile)
+	instances := buildSortedEntityInstances(entityType, entityInstances, properties)
+
+	def := &apiv1.EntityDefinition{
+		Title:            entityType,
+		UsedOnDashboards: findDashboardsForEntity(entityType, api.cfg.Dashboards),
+		Icon:             entityTypeIcon(api.cfg, entityType),
+		Properties:       entityDefinitionProperties(properties),
+		TotalInstances:   int32(len(instances)),
+	}
+
+	if !paginate {
+		if len(properties) == 0 {
+			def.Instances = instances
+		}
+		return def
+	}
+
+	filtered := filterEntityInstances(instances, filter)
+	def.TotalInstances = int32(len(filtered))
+	def.Instances = paginateEntityInstances(filtered, page, pageSize)
+	return def
+}
+
 func sortedEntityTypeNames(entityMap entities.EntitiesByClass) []string {
 	entityNames := make([]string, 0, len(entityMap))
 	for name := range entityMap {
@@ -112,17 +120,28 @@ func filterEntityInstances(instances []*apiv1.Entity, filter string) []*apiv1.En
 			filtered = append(filtered, instance)
 		}
 	}
-
 	return filtered
 }
 
 func entityInstanceMatchesFilter(instance *apiv1.Entity, filter string) bool {
-	if strings.Contains(strings.ToLower(instance.Title), filter) {
+	if instance == nil {
+		return false
+	}
+
+	if stringContainsFold(instance.Title, filter) || stringContainsFold(instance.UniqueKey, filter) {
 		return true
 	}
 
-	for _, value := range instance.Fields {
-		if strings.Contains(strings.ToLower(value), filter) {
+	return entityFieldsContainFilter(instance.Fields, filter)
+}
+
+func stringContainsFold(value, filter string) bool {
+	return strings.Contains(strings.ToLower(value), filter)
+}
+
+func entityFieldsContainFilter(fields map[string]string, filter string) bool {
+	for _, value := range fields {
+		if stringContainsFold(value, filter) {
 			return true
 		}
 	}
diff --git a/service/internal/api/api_entity_acl_test.go b/service/internal/api/api_entity_acl_test.go
new file mode 100644
index 00000000..611db86f
--- /dev/null
+++ b/service/internal/api/api_entity_acl_test.go
@@ -0,0 +1,214 @@
+package api
+
+import (
+	"context"
+	"testing"
+
+	"connectrpc.com/connect"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	apiv1 "github.com/OliveTin/OliveTin/gen/olivetin/api/v1"
+	authpublic "github.com/OliveTin/OliveTin/internal/auth/authpublic"
+	config "github.com/OliveTin/OliveTin/internal/config"
+	"github.com/OliveTin/OliveTin/internal/entities"
+	"github.com/OliveTin/OliveTin/internal/executor"
+)
+
+func buildEntityAclTestConfig() *config.Config {
+	cfg := config.DefaultConfig()
+	cfg.DefaultPermissions.View = false
+	cfg.DefaultPermissions.Exec = false
+	cfg.AccessControlLists = []*config.AccessControlList{
+		{
+			Name:           "ops",
+			MatchUsernames: []string{"admin"},
+			Permissions:    config.PermissionsList{View: true, Exec: true},
+		},
+		{
+			Name:             "everyone",
+			MatchUsernames:   []string{"guest", "admin"},
+			Permissions:      config.PermissionsList{View: true, Exec: true},
+			AddToEveryAction: true,
+		},
+	}
+	cfg.Entities = []*config.EntityFile{
+		{Name: "printers", File: "printers.yaml"},
+		{Name: "servers", File: "servers.yaml", Acls: []string{"ops"}},
+	}
+	cfg.Actions = []*config.Action{
+		{
+			ID:     "restart-server",
+			Title:  "Restart {{ servers.name }}",
+			Shell:  "echo restart",
+			Entity: "servers",
+		},
+		{
+			ID:    "ping-printer",
+			Title: "Ping printer",
+			Shell: "echo ping",
+		},
+	}
+	cfg.Dashboards = []*config.DashboardComponent{
+		{
+			Title: "Infra",
+			Contents: []*config.DashboardComponent{
+				{
+					Title:  "{{ servers.name }}",
+					Type:   "fieldset",
+					Entity: "servers",
+					Contents: []*config.DashboardComponent{
+						{Title: "Restart {{ servers.name }}"},
+					},
+				},
+			},
+		},
+	}
+	cfg.Sanitize()
+	return cfg
+}
+
+func seedEntityAclTestEntities(t *testing.T) {
+	t.Helper()
+	entities.ClearEntitiesOfType("printers")
+	entities.ClearEntitiesOfType("servers")
+	t.Cleanup(func() {
+		entities.ClearEntitiesOfType("printers")
+		entities.ClearEntitiesOfType("servers")
+	})
+
+	entities.AddEntity("printers", "p1", map[string]any{"name": "lobby"})
+	entities.AddEntity("servers", "0", map[string]any{"name": "web01"})
+}
+
+func TestGetEntitiesOmitsRestrictedEntityTypes(t *testing.T) {
+	seedEntityAclTestEntities(t)
+	cfg := buildEntityAclTestConfig()
+	ex := executor.DefaultExecutor(cfg)
+	ex.RebuildActionMap()
+	api := newServer(ex)
+
+	guest := &authpublic.AuthenticatedUser{Username: "guest", Provider: "system"}
+	guest.BuildUserAcls(cfg)
+
+	defs := api.buildEntityDefinitionsResponse(guest, &apiv1.GetEntitiesRequest{}, entities.GetEntities())
+	titles := make([]string, 0, len(defs))
+	for _, def := range defs {
+		titles = append(titles, def.Title)
+	}
+
+	assert.Contains(t, titles, "printers")
+	assert.NotContains(t, titles, "servers")
+}
+
+func TestGetEntityNotFoundForRestrictedType(t *testing.T) {
+	seedEntityAclTestEntities(t)
+	cfg := buildEntityAclTestConfig()
+	ex := executor.DefaultExecutor(cfg)
+	ex.RebuildActionMap()
+	ts, client := getNewTestServerAndClientWithExecutor(cfg, ex)
+	defer ts.Close()
+
+	// Guest Init/API without login uses guest user with default ACLs from UserFromApiCall.
+	_, err := client.GetEntity(context.Background(), connect.NewRequest(&apiv1.GetEntityRequest{
+		Type:      "servers",
+		UniqueKey: "0",
+	}))
+	require.Error(t, err)
+	assert.Equal(t, connect.CodeNotFound, connect.CodeOf(err))
+
+	resp, err := client.GetEntity(context.Background(), connect.NewRequest(&apiv1.GetEntityRequest{
+		Type:      "printers",
+		UniqueKey: "p1",
+	}))
+	require.NoError(t, err)
+	assert.Equal(t, "lobby", resp.Msg.Title)
+}
+
+func TestSearchHintsOmitRestrictedEntitiesAndEntityBoundActions(t *testing.T) {
+	seedEntityAclTestEntities(t)
+	cfg := buildEntityAclTestConfig()
+	ex := executor.DefaultExecutor(cfg)
+	ex.RebuildActionMap()
+	api := newServer(ex)
+
+	guest := &authpublic.AuthenticatedUser{Username: "guest", Provider: "system"}
+	guest.BuildUserAcls(cfg)
+	admin := &authpublic.AuthenticatedUser{Username: "admin"}
+	admin.BuildUserAcls(cfg)
+
+	guestHints := api.buildSearchHints(guest)
+	require.NotNil(t, guestHints)
+
+	guestEntityKeys := make([]string, 0)
+	for _, hint := range guestHints.Entities {
+		guestEntityKeys = append(guestEntityKeys, hint.Type+":"+hint.UniqueKey)
+	}
+	assert.Contains(t, guestEntityKeys, "printers:p1")
+	assert.NotContains(t, guestEntityKeys, "servers:0")
+
+	guestActionIDs := actionHintBindingIDs(guestHints.Actions)
+	for _, id := range guestActionIDs {
+		assert.NotContains(t, id, "restart")
+	}
+
+	adminHints := api.buildSearchHints(admin)
+	require.NotNil(t, adminHints)
+
+	adminEntityKeys := make([]string, 0)
+	for _, hint := range adminHints.Entities {
+		adminEntityKeys = append(adminEntityKeys, hint.Type+":"+hint.UniqueKey)
+	}
+	assert.Contains(t, adminEntityKeys, "servers:0")
+	assert.NotEmpty(t, adminHints.Actions)
+}
+
+func TestEntityFieldsetOmitsRestrictedEntityType(t *testing.T) {
+	seedEntityAclTestEntities(t)
+	cfg := buildEntityAclTestConfig()
+	ex := executor.DefaultExecutor(cfg)
+	ex.RebuildActionMap()
+	api := newServer(ex)
+
+	guest := &authpublic.AuthenticatedUser{Username: "guest", Provider: "system"}
+	guest.BuildUserAcls(cfg)
+	admin := &authpublic.AuthenticatedUser{Username: "admin"}
+	admin.BuildUserAcls(cfg)
+
+	guestRR := api.createDashboardRenderRequest(guest, "", "")
+	guestDB := renderDashboard(guestRR, "Infra")
+	require.NotNil(t, guestDB)
+	assert.Empty(t, guestDB.Contents, "restricted entity fieldsets must not leak instances")
+
+	adminRR := api.createDashboardRenderRequest(admin, "", "")
+	adminDB := renderDashboard(adminRR, "Infra")
+	require.NotNil(t, adminDB)
+	require.NotEmpty(t, adminDB.Contents)
+}
+
+func TestBuildChoicesEntityRespectsEntityACL(t *testing.T) {
+	seedEntityAclTestEntities(t)
+	cfg := buildEntityAclTestConfig()
+	ex := executor.DefaultExecutor(cfg)
+	ex.RebuildActionMap()
+
+	guest := &authpublic.AuthenticatedUser{Username: "guest", Provider: "system"}
+	guest.BuildUserAcls(cfg)
+	admin := &authpublic.AuthenticatedUser{Username: "admin"}
+	admin.BuildUserAcls(cfg)
+
+	arg := config.ActionArgument{
+		Entity: "servers",
+		Choices: []config.ActionArgumentChoice{
+			{Title: "{{ servers.name }}", Value: "{{ servers.name }}"},
+		},
+	}
+
+	guestRR := &DashboardRenderRequest{AuthenticatedUser: guest, cfg: cfg, ex: ex}
+	assert.Empty(t, buildChoices(arg, guestRR))
+
+	adminRR := &DashboardRenderRequest{AuthenticatedUser: admin, cfg: cfg, ex: ex}
+	choices := buildChoices(arg, adminRR)
+	require.Len(t, choices, 1)
+	assert.Equal(t, "web01", choices[0].Value)
+}
diff --git a/service/internal/api/api_entity_argument_acl.go b/service/internal/api/api_entity_argument_acl.go
new file mode 100644
index 00000000..5724c77f
--- /dev/null
+++ b/service/internal/api/api_entity_argument_acl.go
@@ -0,0 +1,152 @@
+package api
+
+import (
+	"fmt"
+	"strings"
+
+	"connectrpc.com/connect"
+
+	authpublic "github.com/OliveTin/OliveTin/internal/auth/authpublic"
+	config "github.com/OliveTin/OliveTin/internal/config"
+	"github.com/OliveTin/OliveTin/internal/entities"
+	"github.com/OliveTin/OliveTin/internal/executor"
+	"github.com/OliveTin/OliveTin/internal/tpl"
+)
+
+// errUnlessStartEntityAccessAllowed enforces entity-type view ACL on the binding
+// and rejects entity-backed argument values the user may not use.
+func (api *oliveTinAPI) errUnlessStartEntityAccessAllowed(user *authpublic.AuthenticatedUser, binding *executor.ActionBinding, args map[string]string) error {
+	if err := api.errUnlessBindingEntityTypeAllowed(user, binding); err != nil {
+		return err
+	}
+
+	if binding == nil {
+		return nil
+	}
+
+	return api.errUnlessEntityArgumentsAllowed(user, binding.Action, args)
+}
+
+// errUnlessEntityArgumentsAllowed rejects starts that use entity-backed arguments
+// the user may not view, or guessed values that are not in the allowed choice set.
+func (api *oliveTinAPI) errUnlessEntityArgumentsAllowed(user *authpublic.AuthenticatedUser, action *config.Action, args map[string]string) error {
+	if action == nil {
+		return nil
+	}
+
+	for i := range action.Arguments {
+		arg := &action.Arguments[i]
+		if arg.Entity == "" {
+			continue
+		}
+
+		if err := api.errUnlessEntityArgumentAllowed(user, arg, args[arg.Name]); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func isEntityBackedArgument(arg *config.ActionArgument) bool {
+	return arg != nil && arg.Entity != "" && len(arg.Choices) == 1
+}
+
+func isMalformedEntityArgument(arg *config.ActionArgument) bool {
+	return arg != nil && arg.Entity != "" && len(arg.Choices) != 1
+}
+
+func (api *oliveTinAPI) errUnlessEntityArgumentAllowed(user *authpublic.AuthenticatedUser, arg *config.ActionArgument, value string) error {
+	if err := errUnlessEntityArgumentShapeAllowed(arg); err != nil {
+		return err
+	}
+
+	if !isEntityBackedArgument(arg) {
+		return nil
+	}
+
+	if !api.userCanViewEntityType(user, arg.Entity) {
+		return connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied"))
+	}
+
+	if err := errUnlessEntityArgumentValueAllowed(arg, value); err != nil {
+		return connect.NewError(connect.CodeInvalidArgument, err)
+	}
+
+	return nil
+}
+
+func errUnlessEntityArgumentShapeAllowed(arg *config.ActionArgument) error {
+	if !isMalformedEntityArgument(arg) {
+		return nil
+	}
+
+	return connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("argument %q with entity must define exactly one choice template", arg.Name))
+}
+
+func errUnlessEntityArgumentValueAllowed(arg *config.ActionArgument, value string) error {
+	if isMalformedEntityArgument(arg) {
+		return fmt.Errorf("argument %q with entity must define exactly one choice template", arg.Name)
+	}
+
+	if !isEntityBackedArgument(arg) {
+		return nil
+	}
+
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return nil
+	}
+
+	if !entityArgumentValueAllowed(arg, value) {
+		return fmt.Errorf("argument %q is not a permitted entity value", arg.Name)
+	}
+
+	return nil
+}
+
+func entityArgumentValueAllowed(arg *config.ActionArgument, value string) bool {
+	allowed := entityArgumentAllowedValues(arg)
+	if strings.EqualFold(arg.Type, "checklist") {
+		return checklistEntityValuesAllowed(value, allowed)
+	}
+
+	_, ok := allowed[value]
+	return ok
+}
+
+func entityArgumentAllowedValues(arg *config.ActionArgument) map[string]struct{} {
+	allowed := make(map[string]struct{})
+	if arg == nil || len(arg.Choices) != 1 {
+		return allowed
+	}
+
+	for _, ent := range entities.GetEntityInstancesOrdered(arg.Entity) {
+		resolved := tpl.ParseTemplateOfActionBeforeExec(arg.Choices[0].Value, ent)
+		if resolved == "" {
+			continue
+		}
+		allowed[resolved] = struct{}{}
+	}
+
+	return allowed
+}
+
+func checklistEntityValuesAllowed(value string, allowed map[string]struct{}) bool {
+	parts := strings.Split(value, ",")
+	sawItem := false
+
+	for _, part := range parts {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+
+		sawItem = true
+		if _, ok := allowed[part]; !ok {
+			return false
+		}
+	}
+
+	return sawItem
+}
diff --git a/service/internal/api/api_entity_argument_acl_test.go b/service/internal/api/api_entity_argument_acl_test.go
new file mode 100644
index 00000000..16ef2b45
--- /dev/null
+++ b/service/internal/api/api_entity_argument_acl_test.go
@@ -0,0 +1,164 @@
+package api
+
+import (
+	"context"
+	"testing"
+
+	"connectrpc.com/connect"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	apiv1 "github.com/OliveTin/OliveTin/gen/olivetin/api/v1"
+	config "github.com/OliveTin/OliveTin/internal/config"
+	"github.com/OliveTin/OliveTin/internal/entities"
+	"github.com/OliveTin/OliveTin/internal/executor"
+)
+
+func buildEntityArgumentGuessConfig() *config.Config {
+	cfg := config.DefaultConfig()
+	cfg.DefaultPermissions.View = false
+	cfg.DefaultPermissions.Exec = false
+	cfg.AccessControlLists = []*config.AccessControlList{
+		{
+			Name:           "ops",
+			MatchUsernames: []string{"admin"},
+			Permissions:    config.PermissionsList{View: true, Exec: true},
+		},
+		{
+			Name:             "everyone",
+			MatchUsernames:   []string{"guest", "admin"},
+			Permissions:      config.PermissionsList{View: true, Exec: true},
+			AddToEveryAction: true,
+		},
+	}
+	cfg.Entities = []*config.EntityFile{
+		{Name: "servers", File: "servers.yaml", Acls: []string{"ops"}},
+	}
+	cfg.Actions = []*config.Action{
+		{
+			ID:    "reboot-server",
+			Title: "Reboot server",
+			Shell: "echo reboot '{{ target }}'",
+			Arguments: []config.ActionArgument{
+				{
+					Name:   "target",
+					Title:  "Server",
+					Entity: "servers",
+					Choices: []config.ActionArgumentChoice{
+						{Title: "{{ servers.name }}", Value: "{{ servers.name }}"},
+					},
+				},
+			},
+		},
+	}
+	cfg.Sanitize()
+	return cfg
+}
+
+func seedEntityArgumentGuessEntities(t *testing.T) {
+	t.Helper()
+	entities.ClearEntitiesOfType("servers")
+	t.Cleanup(func() {
+		entities.ClearEntitiesOfType("servers")
+	})
+	entities.AddEntity("servers", "0", map[string]any{"name": "web01"})
+	entities.AddEntity("servers", "1", map[string]any{"name": "db01"})
+}
+
+func TestStartActionRejectsGuessedRestrictedEntityArgument(t *testing.T) {
+	seedEntityArgumentGuessEntities(t)
+	cfg := buildEntityArgumentGuessConfig()
+	ex := executor.DefaultExecutor(cfg)
+	ex.RebuildActionMap()
+	ts, client := getNewTestServerAndClientWithExecutor(cfg, ex)
+	defer ts.Close()
+
+	_, err := client.StartAction(context.Background(), connect.NewRequest(&apiv1.StartActionRequest{
+		BindingId: "reboot-server",
+		Arguments: []*apiv1.StartActionArgument{
+			{Name: "target", Value: "web01"},
+		},
+	}))
+	require.Error(t, err)
+	assert.Equal(t, connect.CodePermissionDenied, connect.CodeOf(err))
+}
+
+func TestStartActionRejectsUnknownEntityArgumentValue(t *testing.T) {
+	seedEntityArgumentGuessEntities(t)
+	cfg := buildEntityArgumentGuessConfig()
+	// Make servers unrestricted so guests can view the type but not invent values.
+	cfg.Entities[0].Acls = nil
+	cfg.Sanitize()
+
+	ex := executor.DefaultExecutor(cfg)
+	ex.RebuildActionMap()
+	ts, client := getNewTestServerAndClientWithExecutor(cfg, ex)
+	defer ts.Close()
+
+	_, err := client.StartAction(context.Background(), connect.NewRequest(&apiv1.StartActionRequest{
+		BindingId: "reboot-server",
+		Arguments: []*apiv1.StartActionArgument{
+			{Name: "target", Value: "not-a-real-server"},
+		},
+	}))
+	require.Error(t, err)
+	assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
+}
+
+func TestStartActionAllowsListedEntityArgumentValue(t *testing.T) {
+	seedEntityArgumentGuessEntities(t)
+	cfg := buildEntityArgumentGuessConfig()
+	cfg.Entities[0].Acls = nil
+	cfg.Sanitize()
+
+	ex := executor.DefaultExecutor(cfg)
+	ex.RebuildActionMap()
+	ts, client := getNewTestServerAndClientWithExecutor(cfg, ex)
+	defer ts.Close()
+
+	resp, err := client.StartAction(context.Background(), connect.NewRequest(&apiv1.StartActionRequest{
+		BindingId: "reboot-server",
+		Arguments: []*apiv1.StartActionArgument{
+			{Name: "target", Value: "web01"},
+		},
+	}))
+	require.NoError(t, err)
+	assert.NotEmpty(t, resp.Msg.ExecutionTrackingId)
+}
+
+func TestChecklistEntityValuesAllowedRejectsBlankOnlyInput(t *testing.T) {
+	allowed := map[string]struct{}{"web01": {}, "db01": {}}
+
+	assert.False(t, checklistEntityValuesAllowed(",,,", allowed))
+	assert.False(t, checklistEntityValuesAllowed(" , ", allowed))
+	assert.False(t, checklistEntityValuesAllowed("", allowed),
+		"all-blank checklist parts are rejected here; empty string is accepted by the caller separately")
+	assert.True(t, checklistEntityValuesAllowed("web01", allowed))
+	assert.True(t, checklistEntityValuesAllowed("web01, db01", allowed))
+	assert.False(t, checklistEntityValuesAllowed("web01, unknown", allowed))
+}
+
+func TestStartActionRejectsMalformedMultiChoiceEntityArgument(t *testing.T) {
+	seedEntityArgumentGuessEntities(t)
+	cfg := buildEntityArgumentGuessConfig()
+	// After sanitize, force an invalid entity+multi-choice shape that would
+	// previously skip ACL and fall through to static UI choices.
+	cfg.Actions[0].Arguments[0].Choices = []config.ActionArgumentChoice{
+		{Title: "{{ servers.name }}", Value: "{{ servers.name }}"},
+		{Title: "web01", Value: "web01"},
+	}
+
+	ex := executor.DefaultExecutor(cfg)
+	ex.RebuildActionMap()
+	ts, client := getNewTestServerAndClientWithExecutor(cfg, ex)
+	defer ts.Close()
+
+	_, err := client.StartAction(context.Background(), connect.NewRequest(&apiv1.StartActionRequest{
+		BindingId: "reboot-server",
+		Arguments: []*apiv1.StartActionArgument{
+			{Name: "target", Value: "web01"},
+		},
+	}))
+	require.Error(t, err)
+	assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
+}
diff --git a/service/internal/api/api_init_search_hints_test.go b/service/internal/api/api_init_search_hints_test.go
new file mode 100644
index 00000000..91fd2b8d
--- /dev/null
+++ b/service/internal/api/api_init_search_hints_test.go
@@ -0,0 +1,273 @@
+package api
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"connectrpc.com/connect"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	apiv1 "github.com/OliveTin/OliveTin/gen/olivetin/api/v1"
+	authpublic "github.com/OliveTin/OliveTin/internal/auth/authpublic"
+	config "github.com/OliveTin/OliveTin/internal/config"
+	"github.com/OliveTin/OliveTin/internal/entities"
+	"github.com/OliveTin/OliveTin/internal/executor"
+)
+
+func TestInitIncludesEntitySearchHints(t *testing.T) {
+	entities.ClearEntitiesOfType("server")
+	entities.ClearEntitiesOfType("database")
+	t.Cleanup(func() {
+		entities.ClearEntitiesOfType("server")
+		entities.ClearEntitiesOfType("database")
+	})
+
+	entities.AddEntity("server", "0", map[string]any{
+		"name":   "web01",
+		"secret": "must-not-appear-in-search-hints",
+	})
+	entities.AddEntity("database", "db-1", map[string]any{
+		"title": "postgres",
+	})
+
+	cfg := config.DefaultConfig()
+	cfg.Features.HeaderSearch = true
+	cfg.Sanitize()
+
+	ex := executor.DefaultExecutor(cfg)
+	ex.RebuildActionMap()
+	ts, client := getNewTestServerAndClientWithExecutor(cfg, ex)
+	defer ts.Close()
+
+	resp, err := client.Init(context.Background(), connect.NewRequest(&apiv1.InitRequest{}))
+	require.NoError(t, err)
+	require.NotNil(t, resp.Msg.Features)
+	assert.True(t, resp.Msg.Features.HeaderSearch)
+	require.NotNil(t, resp.Msg.SearchHints)
+
+	byKey := map[string]*apiv1.EntitySearchHint{}
+	for _, hint := range resp.Msg.SearchHints.Entities {
+		byKey[hint.Type+":"+hint.UniqueKey] = hint
+	}
+
+	host, ok := byKey["server:0"]
+	require.True(t, ok, "expected server:0 search hint")
+	assert.Equal(t, "web01", host.Title)
+	assert.Equal(t, "server", host.Type)
+	assert.Equal(t, "0", host.UniqueKey)
+
+	db, ok := byKey["database:db-1"]
+	require.True(t, ok, "expected database:db-1 search hint")
+	assert.Equal(t, "postgres", db.Title)
+}
+
+func TestInitOmitsSearchHintsWhenLoginRequired(t *testing.T) {
+	entities.ClearEntitiesOfType("server")
+	t.Cleanup(func() {
+		entities.ClearEntitiesOfType("server")
+	})
+
+	entities.AddEntity("server", "0", map[string]any{"name": "web01"})
+
+	cfg := config.DefaultConfig()
+	cfg.AuthRequireGuestsToLogin = true
+	cfg.Features.HeaderSearch = true
+	cfg.Sanitize()
+
+	ex := executor.DefaultExecutor(cfg)
+	ex.RebuildActionMap()
+	ts, client := getNewTestServerAndClientWithExecutor(cfg, ex)
+	defer ts.Close()
+
+	resp, err := client.Init(context.Background(), connect.NewRequest(&apiv1.InitRequest{}))
+	require.NoError(t, err)
+	require.True(t, resp.Msg.LoginRequired)
+	assert.Nil(t, resp.Msg.SearchHints)
+}
+
+func TestInitOmitsSearchHintsWhenHeaderSearchDisabled(t *testing.T) {
+	entities.ClearEntitiesOfType("server")
+	t.Cleanup(func() {
+		entities.ClearEntitiesOfType("server")
+	})
+
+	entities.AddEntity("server", "0", map[string]any{"name": "web01"})
+
+	cfg := config.DefaultConfig()
+	cfg.Sanitize()
+	require.False(t, cfg.Features.HeaderSearch)
+
+	ex := executor.DefaultExecutor(cfg)
+	ex.RebuildActionMap()
+	ts, client := getNewTestServerAndClientWithExecutor(cfg, ex)
+	defer ts.Close()
+
+	resp, err := client.Init(context.Background(), connect.NewRequest(&apiv1.InitRequest{}))
+	require.NoError(t, err)
+	require.NotNil(t, resp.Msg.Features)
+	assert.False(t, resp.Msg.Features.HeaderSearch)
+	assert.Nil(t, resp.Msg.SearchHints)
+}
+
+func TestBuildSearchHintsRespectsActionACL(t *testing.T) {
+	cfg := config.DefaultConfig()
+	cfg.DefaultPermissions.View = false
+	cfg.DefaultPermissions.Exec = false
+	cfg.Actions = []*config.Action{
+		{ID: "public_action", Title: "Public Action", Shell: "echo public"},
+		{ID: "secret_action", Title: "Secret Action", Shell: "echo secret", Acls: []string{"admins"}},
+	}
+	cfg.AccessControlLists = []*config.AccessControlList{
+		{
+			Name:             "everyone",
+			MatchUsernames:   []string{"guest", "admin"},
+			AddToEveryAction: false,
+			Permissions:      config.PermissionsList{View: true, Exec: true},
+		},
+		{
+			Name:           "admins",
+			MatchUsernames: []string{"admin"},
+			Permissions:    config.PermissionsList{View: true, Exec: true},
+		},
+	}
+	cfg.Actions[0].Acls = []string{"everyone"}
+	cfg.Sanitize()
+
+	ex := executor.DefaultExecutor(cfg)
+	ex.RebuildActionMap()
+	api := newServer(ex)
+
+	guest := &authpublic.AuthenticatedUser{Username: "guest", Provider: "system"}
+	guest.BuildUserAcls(cfg)
+	admin := &authpublic.AuthenticatedUser{Username: "admin"}
+	admin.BuildUserAcls(cfg)
+
+	guestHints := api.buildSearchHints(guest)
+	require.NotNil(t, guestHints)
+
+	guestActionIDs := actionHintBindingIDs(guestHints.Actions)
+	assert.Contains(t, guestActionIDs, "public_action")
+	assert.NotContains(t, guestActionIDs, "secret_action")
+
+	adminHints := api.buildSearchHints(admin)
+	require.NotNil(t, adminHints)
+
+	adminActionIDs := actionHintBindingIDs(adminHints.Actions)
+	assert.Contains(t, adminActionIDs, "public_action")
+	assert.Contains(t, adminActionIDs, "secret_action")
+}
+
+func TestBuildSearchHintsOmitsHiddenActions(t *testing.T) {
+	cfg := config.DefaultConfig()
+	cfg.Actions = []*config.Action{
+		{ID: "visible", Title: "Visible", Shell: "echo visible"},
+		{ID: "hidden", Title: "Hidden", Shell: "echo hidden", Hidden: true},
+	}
+	cfg.Sanitize()
+
+	ex := executor.DefaultExecutor(cfg)
+	ex.RebuildActionMap()
+	api := newServer(ex)
+
+	user := &authpublic.AuthenticatedUser{Username: "guest", Provider: "system"}
+	user.BuildUserAcls(cfg)
+
+	hints := api.buildSearchHints(user)
+	require.NotNil(t, hints)
+
+	ids := actionHintBindingIDs(hints.Actions)
+	assert.Contains(t, ids, "visible")
+	assert.NotContains(t, ids, "hidden")
+}
+
+func TestBuildSearchHintsCapsActionsAndEntitiesPerType(t *testing.T) {
+	entities.ClearEntitiesOfType("cap_host")
+	entities.ClearEntitiesOfType("cap_container")
+	t.Cleanup(func() {
+		entities.ClearEntitiesOfType("cap_host")
+		entities.ClearEntitiesOfType("cap_container")
+	})
+
+	for i := 0; i < maxSearchHintEntitiesPerType+5; i++ {
+		entities.AddEntity("cap_host", fmt.Sprintf("%03d", i), map[string]any{"name": fmt.Sprintf("host-%03d", i)})
+		entities.AddEntity("cap_container", fmt.Sprintf("%03d", i), map[string]any{"name": fmt.Sprintf("ctr-%03d", i)})
+	}
+
+	cfg := config.DefaultConfig()
+	cfg.Entities = []*config.EntityFile{
+		{Name: "cap_host", File: "cap_host.yaml"},
+		{Name: "cap_container", File: "cap_container.yaml"},
+	}
+	cfg.Actions = make([]*config.Action, 0, maxSearchHintActions+5)
+	for i := 0; i < maxSearchHintActions+5; i++ {
+		cfg.Actions = append(cfg.Actions, &config.Action{
+			ID:    fmt.Sprintf("action-%03d", i),
+			Title: fmt.Sprintf("Action %03d", i),
+			Shell: "echo",
+		})
+	}
+	cfg.Sanitize()
+
+	ex := executor.DefaultExecutor(cfg)
+	ex.RebuildActionMap()
+	api := newServer(ex)
+
+	user := &authpublic.AuthenticatedUser{Username: "guest", Provider: "system"}
+	user.BuildUserAcls(cfg)
+
+	hints := api.buildSearchHints(user)
+	require.NotNil(t, hints)
+	assert.Len(t, hints.Actions, maxSearchHintActions)
+	assert.Equal(t, maxSearchHintEntitiesPerType, countEntityHintsByType(hints.Entities, "cap_host"))
+	assert.Equal(t, maxSearchHintEntitiesPerType, countEntityHintsByType(hints.Entities, "cap_container"))
+}
+
+func countEntityHintsByType(hints []*apiv1.EntitySearchHint, entityType string) int {
+	count := 0
+	for _, hint := range hints {
+		if hint.Type == entityType {
+			count++
+		}
+	}
+	return count
+}
+
+func TestBuildSearchHintsPrefersNonEntityActions(t *testing.T) {
+	entities.ClearEntitiesOfType("host")
+	t.Cleanup(func() {
+		entities.ClearEntitiesOfType("host")
+	})
+
+	for i := 0; i < 10; i++ {
+		entities.AddEntity("host", fmt.Sprintf("%d", i), map[string]any{"name": fmt.Sprintf("host-%d", i)})
+	}
+
+	cfg := config.DefaultConfig()
+	cfg.Actions = []*config.Action{
+		{ID: "plain", Title: "Plain Action", Shell: "echo plain"},
+		{Title: "Entity Action {{ name }}", Shell: "echo entity", Entity: "host"},
+	}
+	cfg.Sanitize()
+
+	ex := executor.DefaultExecutor(cfg)
+	ex.RebuildActionMap()
+	api := newServer(ex)
+
+	user := &authpublic.AuthenticatedUser{Username: "guest", Provider: "system"}
+	user.BuildUserAcls(cfg)
+
+	hints := api.buildSearchHints(user)
+	require.NotNil(t, hints)
+	require.NotEmpty(t, hints.Actions)
+	assert.Equal(t, "plain", hints.Actions[0].BindingId)
+}
+
+func actionHintBindingIDs(hints []*apiv1.ActionSearchHint) []string {
+	ids := make([]string, 0, len(hints))
+	for _, hint := range hints {
+		ids = append(ids, hint.BindingId)
+	}
+	return ids
+}
diff --git a/service/internal/api/api_search_hints.go b/service/internal/api/api_search_hints.go
new file mode 100644
index 00000000..987abbc1
--- /dev/null
+++ b/service/internal/api/api_search_hints.go
@@ -0,0 +1,168 @@
+package api
+
+import (
+	"sort"
+
+	apiv1 "github.com/OliveTin/OliveTin/gen/olivetin/api/v1"
+	acl "github.com/OliveTin/OliveTin/internal/acl"
+	authpublic "github.com/OliveTin/OliveTin/internal/auth/authpublic"
+	"github.com/OliveTin/OliveTin/internal/entities"
+	executor "github.com/OliveTin/OliveTin/internal/executor"
+	"github.com/OliveTin/OliveTin/internal/tpl"
+)
+
+const (
+	maxSearchHintActions         = 100
+	maxSearchHintEntitiesPerType = 50
+)
+
+// buildSearchHints returns lightweight search index data for Init.
+// Dashboards are not included; clients index Init.root_dashboard_entries.
+// Visibility matches action/entity view ACL; omitted entirely when login is required.
+func (api *oliveTinAPI) buildSearchHints(user *authpublic.AuthenticatedUser) *apiv1.SearchHints {
+	return &apiv1.SearchHints{
+		Entities: api.buildEntitySearchHints(user),
+		Actions:  api.buildActionSearchHints(user),
+	}
+}
+
+func (api *oliveTinAPI) buildEntitySearchHints(user *authpublic.AuthenticatedUser) []*apiv1.EntitySearchHint {
+	hints := entities.ListSearchHints()
+	out := make([]*apiv1.EntitySearchHint, 0, len(hints))
+
+	for _, hint := range hints {
+		if pb := api.entitySearchHintIfAllowed(user, hint); pb != nil {
+			out = append(out, pb)
+		}
+	}
+
+	sortEntitySearchHints(out)
+	return capEntitySearchHintsPerType(out, maxSearchHintEntitiesPerType)
+}
+
+func (api *oliveTinAPI) entitySearchHintIfAllowed(user *authpublic.AuthenticatedUser, hint entities.SearchHint) *apiv1.EntitySearchHint {
+	if hint.UniqueKey == "" || hint.Type == "" {
+		return nil
+	}
+
+	if !api.userCanViewEntityType(user, hint.Type) {
+		return nil
+	}
+
+	return &apiv1.EntitySearchHint{
+		Title:     hint.Title,
+		Type:      hint.Type,
+		UniqueKey: hint.UniqueKey,
+	}
+}
+
+func sortEntitySearchHints(hints []*apiv1.EntitySearchHint) {
+	sort.SliceStable(hints, func(i, j int) bool {
+		if hints[i].Type != hints[j].Type {
+			return hints[i].Type < hints[j].Type
+		}
+
+		if hints[i].UniqueKey != hints[j].UniqueKey {
+			return hints[i].UniqueKey < hints[j].UniqueKey
+		}
+
+		return hints[i].Title < hints[j].Title
+	})
+}
+
+func capEntitySearchHintsPerType(hints []*apiv1.EntitySearchHint, perType int) []*apiv1.EntitySearchHint {
+	if perType < 1 || len(hints) == 0 {
+		return hints
+	}
+
+	counts := make(map[string]int)
+	out := make([]*apiv1.EntitySearchHint, 0, len(hints))
+
+	for _, hint := range hints {
+		if counts[hint.Type] >= perType {
+			continue
+		}
+
+		counts[hint.Type]++
+		out = append(out, hint)
+	}
+
+	return out
+}
+
+func (api *oliveTinAPI) buildActionSearchHints(user *authpublic.AuthenticatedUser) []*apiv1.ActionSearchHint {
+	candidates := api.collectViewableActionBindings(user)
+	sortActionSearchCandidates(candidates)
+
+	if len(candidates) > maxSearchHintActions {
+		candidates = candidates[:maxSearchHintActions]
+	}
+
+	out := make([]*apiv1.ActionSearchHint, 0, len(candidates))
+	for _, candidate := range candidates {
+		out = append(out, &apiv1.ActionSearchHint{
+			Title:     candidate.title,
+			BindingId: candidate.bindingID,
+		})
+	}
+
+	return out
+}
+
+type actionSearchCandidate struct {
+	title     string
+	bindingID string
+	hasEntity bool
+}
+
+func (api *oliveTinAPI) collectViewableActionBindings(user *authpublic.AuthenticatedUser) []actionSearchCandidate {
+	api.executor.MapActionBindingsLock.RLock()
+	defer api.executor.MapActionBindingsLock.RUnlock()
+
+	candidates := make([]actionSearchCandidate, 0)
+	for _, binding := range api.executor.MapActionBindings {
+		if candidate, ok := actionSearchCandidateFromBinding(api, user, binding); ok {
+			candidates = append(candidates, candidate)
+		}
+	}
+
+	return candidates
+}
+
+func actionSearchCandidateFromBinding(api *oliveTinAPI, user *authpublic.AuthenticatedUser, binding *executor.ActionBinding) (actionSearchCandidate, bool) {
+	if !isSearchableActionBinding(binding) {
+		return actionSearchCandidate{}, false
+	}
+
+	if !acl.IsAllowedView(api.cfg, user, binding.Action) {
+		return actionSearchCandidate{}, false
+	}
+
+	if !api.bindingEntityTypeAllowed(user, binding) {
+		return actionSearchCandidate{}, false
+	}
+
+	return actionSearchCandidate{
+		title:     tpl.ParseTemplateOfActionBeforeExec(binding.Action.Title, binding.Entity),
+		bindingID: binding.ID,
+		hasEntity: binding.Entity != nil,
+	}, true
+}
+
+func isSearchableActionBinding(binding *executor.ActionBinding) bool {
+	return binding != nil && binding.Action != nil && binding.ID != "" && !binding.Action.Hidden
+}
+
+func sortActionSearchCandidates(candidates []actionSearchCandidate) {
+	sort.SliceStable(candidates, func(i, j int) bool {
+		if candidates[i].hasEntity != candidates[j].hasEntity {
+			return !candidates[i].hasEntity
+		}
+
+		if candidates[i].title != candidates[j].title {
+			return candidates[i].title < candidates[j].title
+		}
+
+		return candidates[i].bindingID < candidates[j].bindingID
+	})
+}
diff --git a/service/internal/api/api_test.go b/service/internal/api/api_test.go
index f3647538..48069519 100644
--- a/service/internal/api/api_test.go
+++ b/service/internal/api/api_test.go
@@ -1099,7 +1099,7 @@ func TestBuildChoicesExpandsChecklistEntityChoices(t *testing.T) {
 		},
 	}
 
-	choices := buildChoices(arg)
+	choices := buildChoices(arg, nil)
 	require.Len(t, choices, 2)
 	assert.Equal(t, "attic", choices[0].Value)
 	assert.Equal(t, "attic", choices[0].Title)
diff --git a/service/internal/api/dashboard_entities.go b/service/internal/api/dashboard_entities.go
index d588a575..77b67354 100644
--- a/service/internal/api/dashboard_entities.go
+++ b/service/internal/api/dashboard_entities.go
@@ -2,6 +2,7 @@ package api
 
 import (
 	apiv1 "github.com/OliveTin/OliveTin/gen/olivetin/api/v1"
+	acl "github.com/OliveTin/OliveTin/internal/acl"
 	config "github.com/OliveTin/OliveTin/internal/config"
 	entities "github.com/OliveTin/OliveTin/internal/entities"
 	"github.com/OliveTin/OliveTin/internal/tpl"
@@ -9,6 +10,10 @@ import (
 )
 
 func buildEntityFieldsets(entityTitle string, tpl *config.DashboardComponent, rr *DashboardRenderRequest) []*apiv1.DashboardComponent {
+	if !acl.IsAllowedViewEntityType(rr.cfg, rr.AuthenticatedUser, entityFileForType(rr.cfg, entityTitle)) {
+		return nil
+	}
+
 	ret := make([]*apiv1.DashboardComponent, 0)
 
 	orderedEntities := entities.GetEntityInstancesOrdered(entityTitle)
diff --git a/service/internal/api/dashboards.go b/service/internal/api/dashboards.go
index 42338efe..d6da56b7 100644
--- a/service/internal/api/dashboards.go
+++ b/service/internal/api/dashboards.go
@@ -26,6 +26,10 @@ func getEntityFromRequest(rr *DashboardRenderRequest) *entities.Entity {
 		return nil
 	}
 
+	if !acl.IsAllowedViewEntityType(rr.cfg, rr.AuthenticatedUser, entityFileForType(rr.cfg, rr.EntityType)) {
+		return nil
+	}
+
 	entityInstances := entities.GetEntityInstances(rr.EntityType)
 	if entity, ok := entityInstances[rr.EntityKey]; ok {
 		return entity
@@ -157,6 +161,11 @@ func buildDefaultDashboard(rr *DashboardRenderRequest) *apiv1.Dashboard {
 			continue
 		}
 
+		if binding.Entity != nil && binding.Action.Entity != "" &&
+			!acl.IsAllowedViewEntityType(rr.cfg, rr.AuthenticatedUser, entityFileForType(rr.cfg, binding.Action.Entity)) {
+			continue
+		}
+
 		action := buildAction(binding, rr)
 		if action == nil {
 			continue
diff --git a/service/internal/config/config.go b/service/internal/config/config.go
index 5106c159..a1dd57c6 100644
--- a/service/internal/config/config.go
+++ b/service/internal/config/config.go
@@ -112,6 +112,7 @@ type EntityFile struct {
 	Icon       string           `koanf:"icon"`
 	SourceFile string           `koanf:"-"`
 	Properties []EntityProperty `koanf:"properties"`
+	Acls       []string         `koanf:"acls"`
 }
 
 // EntityProperty defines a column shown when listing entity instances in the UI.
@@ -145,6 +146,11 @@ type ConfigurationPolicy struct {
 	ShowVersionNumber bool `koanf:"showVersionNumber"`
 }
 
+// FeaturesConfig holds global opt-in feature flags. New flags default to false.
+type FeaturesConfig struct {
+	HeaderSearch bool `koanf:"headerSearch"`
+}
+
 type PrometheusConfig struct {
 	Enabled          bool `koanf:"enabled"`
 	DefaultGoMetrics bool `koanf:"defaultGoMetrics"`
@@ -228,6 +234,7 @@ type Config struct {
 	ShowFooter                         bool                 `koanf:"showFooter"`
 	UseSingleHTTPFrontend              bool                 `koanf:"useSingleHTTPFrontend"`
 	ThemeCacheDisabled                 bool                 `koanf:"themeCacheDisabled"`
+	Features                           FeaturesConfig       `koanf:"features"`
 }
 
 type AuthLocalUsersConfig struct {
diff --git a/service/internal/config/entity_argument_choices_test.go b/service/internal/config/entity_argument_choices_test.go
new file mode 100644
index 00000000..1046eccc
--- /dev/null
+++ b/service/internal/config/entity_argument_choices_test.go
@@ -0,0 +1,40 @@
+package config
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestValidateEntityArgumentChoicesForArgument(t *testing.T) {
+	assert.NoError(t, validateEntityArgumentChoicesForArgument("Reboot", ActionArgument{
+		Name:   "target",
+		Entity: "servers",
+		Choices: []ActionArgumentChoice{
+			{Value: "{{ servers.name }}"},
+		},
+	}))
+
+	assert.Error(t, validateEntityArgumentChoicesForArgument("Reboot", ActionArgument{
+		Name:   "target",
+		Entity: "servers",
+		Choices: []ActionArgumentChoice{
+			{Value: "{{ servers.name }}"},
+			{Value: "web01"},
+		},
+	}))
+
+	assert.Error(t, validateEntityArgumentChoicesForArgument("Reboot", ActionArgument{
+		Name:    "target",
+		Entity:  "servers",
+		Choices: nil,
+	}))
+
+	assert.NoError(t, validateEntityArgumentChoicesForArgument("Reboot", ActionArgument{
+		Name: "plain",
+		Choices: []ActionArgumentChoice{
+			{Value: "a"},
+			{Value: "b"},
+		},
+	}))
+}
diff --git a/service/internal/config/sanitize.go b/service/internal/config/sanitize.go
index bb48550a..843f4dc5 100644
--- a/service/internal/config/sanitize.go
+++ b/service/internal/config/sanitize.go
@@ -40,6 +40,10 @@ func (cfg *Config) Sanitize() {
 	if err := cfg.validateChecklistChoiceValues(); err != nil {
 		log.Fatalf("%v", err)
 	}
+
+	if err := cfg.validateEntityArgumentChoices(); err != nil {
+		log.Fatalf("%v", err)
+	}
 }
 
 func (cfg *Config) validateReservedActionArgumentNames() error {
@@ -108,6 +112,42 @@ func validateChecklistChoicesForArgument(actionTitle string, arg ActionArgument)
 	return nil
 }
 
+func (cfg *Config) validateEntityArgumentChoices() error {
+	for _, action := range cfg.Actions {
+		if err := action.validateEntityArgumentChoices(); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (action *Action) validateEntityArgumentChoices() error {
+	if action == nil {
+		return nil
+	}
+
+	for _, arg := range action.Arguments {
+		if err := validateEntityArgumentChoicesForArgument(action.Title, arg); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func validateEntityArgumentChoicesForArgument(actionTitle string, arg ActionArgument) error {
+	if arg.Entity == "" || len(arg.Choices) == 1 {
+		return nil
+	}
+
+	return fmt.Errorf(
+		`action %q argument %q with entity must define exactly one choice template`,
+		actionTitle,
+		arg.Name,
+	)
+}
+
 func (cfg *Config) sanitizeDashboardsForInlineActions() {
 	for _, dashboard := range cfg.Dashboards {
 		cfg.sanitizeDashboardComponentForInlineActions(dashboard)
diff --git a/service/internal/configcheck/rebuild.go b/service/internal/configcheck/rebuild.go
index 9063fee3..66ad0a49 100644
--- a/service/internal/configcheck/rebuild.go
+++ b/service/internal/configcheck/rebuild.go
@@ -32,6 +32,7 @@ func Rebuild(cfg *config.Config, extra ...configissues.Issue) {
 	collected = append(collected, collectIncludeIssues(cfg)...)
 	collected = append(collected, collectTemplateParseIssues(cfg)...)
 	collected = append(collected, collectEntityFileIssues(cfg)...)
+	collected = append(collected, collectOrphanEntityTypeIssues(cfg)...)
 	collected = append(collected, collectEntityEmptyIssues(cfg)...)
 	collected = append(collected, collectCronIssues(cfg)...)
 	collected = append(collected, collectWatcherPathIssues(cfg)...)
@@ -94,13 +95,13 @@ func collectArgumentIssues(cfg *config.Config) []configissues.Issue {
 }
 
 func argumentIssues(action *config.Action, arg *config.ActionArgument) []configissues.Issue {
-	if arg.Type != "checklist" {
-		return nil
+	out := make([]configissues.Issue, 0)
+	out = append(out, entityArgumentChoicesIssue(action, arg)...)
+
+	if arg.Type == "checklist" {
+		out = append(out, checklistNoChoicesIssue(action, arg)...)
 	}
 
-	out := make([]configissues.Issue, 0)
-	out = append(out, checklistNoChoicesIssue(action, arg)...)
-	out = append(out, checklistEntityChoicesIssue(action, arg)...)
 	return out
 }
 
@@ -113,13 +114,13 @@ func checklistNoChoicesIssue(action *config.Action, arg *config.ActionArgument)
 		"Checklist argument has no choices defined", "", arg.Name)}
 }
 
-func checklistEntityChoicesIssue(action *config.Action, arg *config.ActionArgument) []configissues.Issue {
-	if arg.Entity == "" || len(arg.Choices) <= 1 {
+func entityArgumentChoicesIssue(action *config.Action, arg *config.ActionArgument) []configissues.Issue {
+	if arg.Entity == "" || len(arg.Choices) == 1 {
 		return nil
 	}
 
-	return []configissues.Issue{actionIssue(action, configissues.SeverityWarning, configissues.CodeChecklistEntityChoices,
-		"Checklist argument with entity should define exactly one choice template", arg.Entity, arg.Name)}
+	return []configissues.Issue{actionIssue(action, configissues.SeverityError, configissues.CodeEntityArgumentChoices,
+		"Arguments with entity must define exactly one choice template", arg.Entity, arg.Name)}
 }
 
 func collectIncludeIssues(cfg *config.Config) []configissues.Issue {
@@ -215,6 +216,42 @@ func collectEntityFileIssues(cfg *config.Config) []configissues.Issue {
 	return out
 }
 
+func collectOrphanEntityTypeIssues(cfg *config.Config) []configissues.Issue {
+	configured := configuredEntityTypeNames(cfg)
+	out := make([]configissues.Issue, 0)
+
+	for entityType := range entities.GetEntities() {
+		if configured[entityType] {
+			continue
+		}
+
+		out = append(out, configissues.Issue{
+			Severity: configissues.SeverityWarning,
+			Code:     configissues.CodeEntityTypeUnconfigured,
+			Message:  fmt.Sprintf("Entity type %q is loaded but has no matching entities entry in configuration", entityType),
+			Source:   entityType,
+		})
+	}
+
+	return out
+}
+
+func configuredEntityTypeNames(cfg *config.Config) map[string]bool {
+	configured := make(map[string]bool)
+	if cfg == nil {
+		return configured
+	}
+
+	for _, entityFile := range cfg.Entities {
+		if entityFile == nil || entityFile.Name == "" {
+			continue
+		}
+		configured[entityFile.Name] = true
+	}
+
+	return configured
+}
+
 func entityFileIssuesFor(ef *config.EntityFile, baseDir string) []configissues.Issue {
 	if ef == nil || ef.File == "" {
 		return nil
diff --git a/service/internal/configcheck/rebuild_test.go b/service/internal/configcheck/rebuild_test.go
index 339484f4..883294cd 100644
--- a/service/internal/configcheck/rebuild_test.go
+++ b/service/internal/configcheck/rebuild_test.go
@@ -191,6 +191,64 @@ func TestStickyEnvUnsetSurvivesRebuild(t *testing.T) {
 	assert.True(t, hasCode(configissues.List(), configissues.CodeEnvUnset))
 }
 
+func TestRebuildWarnsForEntityTypeWithoutConfigEntry(t *testing.T) {
+	entities.ClearEntitiesOfType("orphan_type")
+	t.Cleanup(func() {
+		entities.ClearEntitiesOfType("orphan_type")
+	})
+
+	entities.AddEntity("orphan_type", "0", map[string]any{"name": "lonely"})
+
+	configissues.BeginConfigLoad()
+	cfg := config.DefaultConfig()
+	cfg.Entities = nil
+	configcheck.Rebuild(cfg)
+
+	issues := configissues.List()
+	require.True(t, hasCode(issues, configissues.CodeEntityTypeUnconfigured))
+	found := false
+	for _, issue := range issues {
+		if issue.Code == configissues.CodeEntityTypeUnconfigured {
+			assert.Equal(t, configissues.SeverityWarning, issue.Severity)
+			assert.Equal(t, "orphan_type", issue.Source)
+			found = true
+		}
+	}
+	assert.True(t, found)
+}
+
+func TestRebuildEntityArgumentChoices(t *testing.T) {
+	configissues.BeginConfigLoad()
+	cfg := config.DefaultConfig()
+	cfg.Actions = []*config.Action{
+		{
+			Title: "Reboot",
+			ID:    "reboot",
+			Arguments: []config.ActionArgument{
+				{
+					Name:   "target",
+					Entity: "servers",
+					Choices: []config.ActionArgumentChoice{
+						{Value: "{{ servers.name }}"},
+						{Value: "web01"},
+					},
+				},
+			},
+		},
+	}
+
+	configcheck.Rebuild(cfg)
+
+	issues := configissues.List()
+	require.True(t, hasCode(issues, configissues.CodeEntityArgumentChoices))
+	for _, issue := range issues {
+		if issue.Code == configissues.CodeEntityArgumentChoices {
+			assert.Equal(t, configissues.SeverityError, issue.Severity)
+			assert.Equal(t, "target", issue.ArgumentName)
+		}
+	}
+}
+
 func hasCode(issues []configissues.Issue, code string) bool {
 	for _, issue := range issues {
 		if issue.Code == code {
diff --git a/service/internal/configissues/issue.go b/service/internal/configissues/issue.go
index 63489f19..833d728b 100644
--- a/service/internal/configissues/issue.go
+++ b/service/internal/configissues/issue.go
@@ -8,13 +8,14 @@ const (
 	CodeActionGroupUnenforced  = "action_group_unenforced"
 	CodeArgTypeUnset           = "arg_type_unset"
 	CodeChecklistNoChoices     = "checklist_no_choices"
-	CodeChecklistEntityChoices = "checklist_entity_choices"
+	CodeEntityArgumentChoices  = "entity_argument_choices"
 	CodeEnvUnset               = "env_unset"
 	CodeIncludeMissing         = "include_missing"
 	CodeTemplateParse          = "template_parse"
 	CodeArgDefaultInvalid      = "arg_default_invalid"
 	CodeEntityFile             = "entity_file"
 	CodeEntityEmpty            = "entity_empty"
+	CodeEntityTypeUnconfigured = "entity_type_unconfigured"
 	CodeCronInvalid            = "cron_invalid"
 	CodeCronEntityBinding      = "cron_entity_binding"
 	CodeWatcherPath            = "watcher_path"
diff --git a/service/internal/entities/search_hints.go b/service/internal/entities/search_hints.go
new file mode 100644
index 00000000..5cb3ce09
--- /dev/null
+++ b/service/internal/entities/search_hints.go
@@ -0,0 +1,37 @@
+package entities
+
+// SearchHint is a minimal entity identity for client search indexes.
+type SearchHint struct {
+	Title     string
+	Type      string
+	UniqueKey string
+}
+
+// ListSearchHints returns title/type/key for every entity instance.
+// It holds only a read lock and does not copy entity Data payloads.
+func ListSearchHints() []SearchHint {
+	rwmutex.RLock()
+	defer rwmutex.RUnlock()
+
+	count := 0
+	for _, instances := range entities {
+		count += len(instances)
+	}
+
+	hints := make([]SearchHint, 0, count)
+	for entityType, instances := range entities {
+		for _, entity := range instances {
+			if entity == nil {
+				continue
+			}
+
+			hints = append(hints, SearchHint{
+				Title:     entity.Title,
+				Type:      entityType,
+				UniqueKey: entity.UniqueKey,
+			})
+		}
+	}
+
+	return hints
+}
diff --git a/service/internal/entities/search_hints_test.go b/service/internal/entities/search_hints_test.go
new file mode 100644
index 00000000..a6850de8
--- /dev/null
+++ b/service/internal/entities/search_hints_test.go
@@ -0,0 +1,42 @@
+package entities
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestListSearchHintsReturnsLightweightIdentities(t *testing.T) {
+	ClearEntitiesOfType("search_hint_host")
+	ClearEntitiesOfType("search_hint_app")
+	t.Cleanup(func() {
+		ClearEntitiesOfType("search_hint_host")
+		ClearEntitiesOfType("search_hint_app")
+	})
+
+	AddEntity("search_hint_host", "0", map[string]any{
+		"name":     "web01",
+		"secret":   "should-not-be-copied-by-search-hints",
+		"hostname": "192.168.1.10",
+	})
+	AddEntity("search_hint_app", "app-1", map[string]any{
+		"title": "Frontend",
+	})
+
+	hints := ListSearchHints()
+	byKey := map[string]SearchHint{}
+	for _, hint := range hints {
+		byKey[hint.Type+":"+hint.UniqueKey] = hint
+	}
+
+	host, ok := byKey["search_hint_host:0"]
+	require.True(t, ok)
+	assert.Equal(t, "web01", host.Title)
+	assert.Equal(t, "search_hint_host", host.Type)
+	assert.Equal(t, "0", host.UniqueKey)
+
+	app, ok := byKey["search_hint_app:app-1"]
+	require.True(t, ok)
+	assert.Equal(t, "Frontend", app.Title)
+}
diff --git a/service/internal/executor/arguments.go b/service/internal/executor/arguments.go
index 084ce6aa..d4ea3eb8 100644
--- a/service/internal/executor/arguments.go
+++ b/service/internal/executor/arguments.go
@@ -300,6 +300,10 @@ func typecheckChoice(value string, arg *config.ActionArgument) error {
 }
 
 func typecheckChoiceEntity(value string, arg *config.ActionArgument) error {
+	if len(arg.Choices) != 1 {
+		return fmt.Errorf("entity-backed argument must define exactly one choice template")
+	}
+
 	templateChoice := arg.Choices[0].Value
 
 	for _, ent := range entities.GetEntityInstances(arg.Entity) {
@@ -613,7 +617,7 @@ func mangleChoiceSegment(arg *config.ActionArgument, value string, actionTitle s
 }
 
 func mangleChoiceSegmentEntity(arg *config.ActionArgument, value string, actionTitle string) (string, bool) {
-	if arg.Entity == "" || len(arg.Choices) == 0 {
+	if arg.Entity == "" || len(arg.Choices) != 1 {
 		return value, false
 	}
 
diff --git a/specs/entity-acls.md b/specs/entity-acls.md
new file mode 100644
index 00000000..e600da6b
--- /dev/null
+++ b/specs/entity-acls.md
@@ -0,0 +1,88 @@
+# Spec: Entity access control
+
+This spec describes how OliveTin restricts which entity types a user may see, and how that interacts with entity-related actions.
+
+---
+
+## 1. Scope
+
+Access control applies at the **entity type** level (each entry under entities in configuration), not per instance.
+
+- Instances remain data loaded from entity files.
+- Only the **view** permission is consulted for entity types.
+- Action permissions (view, exec, logs, kill) continue to govern actions themselves.
+
+---
+
+## 2. Configuration
+
+Each entity definition may list zero or more ACL names.
+
+- If the list is omitted or empty, the entity type is **unrestricted**: any user who may use the dashboard UI can see that type (same rule as root dashboards with no ACLs).
+- If one or more ACL names are listed, access is an allow list: a matching ACL that grants view, otherwise the default view permission.
+- Adding an ACL to every action does not apply to entity types. An ACL must be listed on the entity definition to restrict it.
+
+---
+
+## 3. Listing and details
+
+When listing entity types and instances:
+
+- Types the user cannot view are omitted from the list. The response does not advertise that those types exist.
+- A request for a single entity whose type the user cannot view is treated as not found (the type is not confirmed to exist).
+
+The Entities navigation page remains available; it simply shows fewer (or no) types when some are restricted.
+
+---
+
+## 4. Search hints
+
+Client search hints for entities include only instances of types the user may view.
+
+Entity-bound action hints (actions generated per entity instance) appear only when the user may view both the action and the entity type. Action view alone is not enough if the entity type is restricted.
+
+Search hints are omitted from Init when guests must log in, when the header search feature flag is off, and the QuickSearch control is not shown until login is no longer required and header search is enabled.
+
+Hints are capped at 100 actions and 50 entity instances **per entity type** per Init response. The client applies the same caps when indexing.
+
+Dashboards are not included in search hints. Clients build the dashboard search index from Init root dashboard entries (already filtered by dashboard ACL).
+
+Entity types with no ACL list remain unrestricted for search and listing.
+
+---
+
+## 5. Entity-related actions
+
+There are two shapes of related actions on an entity details page:
+
+1. Actions bound to the entity type (one binding per instance).
+2. Unbound actions that prefill arguments from the entity.
+
+Rules:
+
+- Opening the entity details page requires view on that entity type.
+- Seeing or running a related action still requires the action’s own permissions.
+- Entity type access does not replace action permissions.
+
+---
+
+## 6. Dashboards and argument forms
+
+When a dashboard expands an entity fieldset, instances of types the user cannot view are not rendered.
+
+When an action argument draws choices from an entity type, it must define **exactly one** choice template plus `entity`. OliveTin expands that template per instance. Only instances of types the user may view are included. Users who can view the action but not the entity type must not learn instance names from the argument form.
+
+Arguments that set `entity` with zero or multiple choices are invalid configuration: startup/reload rejects them, Diagnostics reports an error, the argument form shows no choices, and start/validate requests are rejected.
+
+Starting or validating an action rejects entity-backed argument values when:
+
+- The user may not view that entity type (permission denied), or
+- The value is not one of the entity-expanded choice values for that argument (invalid argument).
+
+Guessing an instance name must not bypass entity type access control.
+
+---
+
+## 7. Compatibility
+
+Existing entity definitions without ACL lists stay unrestricted. Setting default view to false alone does not hide unrestricted entity types; operators must list ACLs on entity definitions to lock them down.
diff --git a/specs/feature-flags.md b/specs/feature-flags.md
new file mode 100644
index 00000000..27fe17e7
--- /dev/null
+++ b/specs/feature-flags.md
@@ -0,0 +1,74 @@
+# Spec: Feature flags
+
+This spec describes how OliveTin opts into unfinished or optional product features for the whole installation.
+
+---
+
+## 1. Scope
+
+Feature flags are **global** settings. They apply to every user and are not overridden by access control lists or policy.
+
+They are distinct from policy options such as diagnostics or log list visibility, which may differ per user.
+
+All feature-flagged functionality is **alpha / experimental**. Flags default to off. Security advisories and CVEs are not accepted for issues that only affect feature-flagged code; see the project security policy.
+
+---
+
+## 2. Configuration
+
+Flags live under `features` in configuration.
+
+- Each flag is a boolean.
+- Omitted flags are **false**.
+- Enabling a feature requires setting it to true explicitly.
+
+Example:
+
+```yaml
+features:
+  headerSearch: true
+```
+
+Unknown keys under `features` are ignored by the configuration loader (same as other unknown config keys).
+
+---
+
+## 3. Init projection
+
+Every Init response includes a `features` object with the current flag values.
+
+Clients must not assume a missing flag means enabled. Treat absent or false as off.
+
+---
+
+## 4. Server and client behavior
+
+When a feature is off:
+
+- The server skips work that exists only to support that feature (for example, building search hints when header search is off).
+- The web UI hides controls and does not index or call APIs that exist only for that feature.
+
+When a feature is on, normal access control still applies to the data and actions the feature exposes. Operators who enable a flag accept that the surface is experimental.
+
+---
+
+## 5. Header search
+
+`features.headerSearch` controls the header QuickSearch control and Init search hints.
+
+- Default: false (alpha / experimental).
+- When false: Init omits search hints; the client does not show QuickSearch or populate the search index.
+- When true: Init includes ACL-filtered search hints (unless guests must log in); the client shows QuickSearch after login is satisfied.
+
+---
+
+## 6. Adding a new flag
+
+To add a flag:
+
+1. Add a boolean field under `features` in configuration (default false).
+2. Add the same field to the Init `features` message.
+3. Project the value on every Init response.
+4. Gate server work and UI behind the flag.
+5. Document the flag as alpha / experimental and update this spec’s feature list.
+6. Keep the security policy statement that CVEs are not accepted for feature-flagged functionality until the feature graduates (flag removed or stable default-on).