diff --git a/api/envoy/admin/v2alpha/certs.proto b/api/envoy/admin/v2alpha/certs.proto
index 1994d422bec77..d8269de5890f5 100644
--- a/api/envoy/admin/v2alpha/certs.proto
+++ b/api/envoy/admin/v2alpha/certs.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.admin.v2alpha;
 
+import "google/protobuf/timestamp.proto";
+
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 option java_outer_classname = "CertsProto";
 option java_multiple_files = true;
 
-import "google/protobuf/timestamp.proto";
-
 // [#protodoc-title: Certificates]
 
 // Proto representation of certificate details. Admin endpoint uses this wrapper for `/certs` to
diff --git a/api/envoy/admin/v2alpha/clusters.proto b/api/envoy/admin/v2alpha/clusters.proto
index c3580f161e979..dee414b48fc48 100644
--- a/api/envoy/admin/v2alpha/clusters.proto
+++ b/api/envoy/admin/v2alpha/clusters.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.admin.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.admin.v2alpha";
-option java_outer_classname = "ClustersProto";
-option java_multiple_files = true;
-
 import "envoy/admin/v2alpha/metrics.proto";
 import "envoy/api/v2/core/address.proto";
 import "envoy/api/v2/core/health_check.proto";
 import "envoy/type/percent.proto";
 
+option java_package = "io.envoyproxy.envoy.admin.v2alpha";
+option java_outer_classname = "ClustersProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Clusters]
 
 // Admin endpoint uses this wrapper for `/clusters` to display cluster status information.
diff --git a/api/envoy/admin/v2alpha/config_dump.proto b/api/envoy/admin/v2alpha/config_dump.proto
index a133318bad057..8b0fc53546951 100644
--- a/api/envoy/admin/v2alpha/config_dump.proto
+++ b/api/envoy/admin/v2alpha/config_dump.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.admin.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.admin.v2alpha";
-option java_outer_classname = "ConfigDumpProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/auth/cert.proto";
 import "envoy/api/v2/cds.proto";
 import "envoy/api/v2/lds.proto";
@@ -16,6 +12,10 @@ import "envoy/config/bootstrap/v2/bootstrap.proto";
 import "google/protobuf/any.proto";
 import "google/protobuf/timestamp.proto";
 
+option java_package = "io.envoyproxy.envoy.admin.v2alpha";
+option java_outer_classname = "ConfigDumpProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: ConfigDump]
 
 // The :ref:`/config_dump <operations_admin_interface_config_dump>` admin endpoint uses this wrapper
diff --git a/api/envoy/admin/v2alpha/listeners.proto b/api/envoy/admin/v2alpha/listeners.proto
index 087103dd9fc49..8fee45093065d 100644
--- a/api/envoy/admin/v2alpha/listeners.proto
+++ b/api/envoy/admin/v2alpha/listeners.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.admin.v2alpha;
 
+import "envoy/api/v2/core/address.proto";
+
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 option java_outer_classname = "ListenersProto";
 option java_multiple_files = true;
 
-import "envoy/api/v2/core/address.proto";
-
 // [#protodoc-title: Listeners]
 
 // Admin endpoint uses this wrapper for `/listeners` to display listener status information.
diff --git a/api/envoy/admin/v2alpha/server_info.proto b/api/envoy/admin/v2alpha/server_info.proto
index 6d2c79abb23f7..099e2f03bc8f0 100644
--- a/api/envoy/admin/v2alpha/server_info.proto
+++ b/api/envoy/admin/v2alpha/server_info.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.admin.v2alpha;
 
+import "google/protobuf/duration.proto";
+
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 option java_outer_classname = "ServerInfoProto";
 option java_multiple_files = true;
 
-import "google/protobuf/duration.proto";
-
 // [#protodoc-title: Server State]
 
 // Proto representation of the value returned by /server_info, containing
diff --git a/api/envoy/admin/v2alpha/tap.proto b/api/envoy/admin/v2alpha/tap.proto
index 3f35c124713d9..428fe8cd76187 100644
--- a/api/envoy/admin/v2alpha/tap.proto
+++ b/api/envoy/admin/v2alpha/tap.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.admin.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.admin.v2alpha";
-option java_outer_classname = "TapProto";
-option java_multiple_files = true;
-
 import "envoy/service/tap/v2alpha/common.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.admin.v2alpha";
+option java_outer_classname = "TapProto";
+option java_multiple_files = true;
+
 // The /tap admin request body that is used to configure an active tap session.
 message TapRequest {
   // The opaque configuration ID used to match the configuration to a loaded extension.
diff --git a/api/envoy/admin/v3alpha/certs.proto b/api/envoy/admin/v3alpha/certs.proto
index 679456f46b78c..ce5b2b28fa2fb 100644
--- a/api/envoy/admin/v3alpha/certs.proto
+++ b/api/envoy/admin/v3alpha/certs.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.admin.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.admin.v3alpha";
-option java_outer_classname = "CertsProto";
-option java_multiple_files = true;
-
 import "google/protobuf/timestamp.proto";
 
 import "udpa/annotations/versioning.proto";
 
+option java_package = "io.envoyproxy.envoy.admin.v3alpha";
+option java_outer_classname = "CertsProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Certificates]
 
 // Proto representation of certificate details. Admin endpoint uses this wrapper for `/certs` to
diff --git a/api/envoy/admin/v3alpha/clusters.proto b/api/envoy/admin/v3alpha/clusters.proto
index 47d809feea141..2b060a9fc26ee 100644
--- a/api/envoy/admin/v3alpha/clusters.proto
+++ b/api/envoy/admin/v3alpha/clusters.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.admin.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.admin.v3alpha";
-option java_outer_classname = "ClustersProto";
-option java_multiple_files = true;
-
 import "envoy/admin/v3alpha/metrics.proto";
 import "envoy/api/v3alpha/core/address.proto";
 import "envoy/api/v3alpha/core/health_check.proto";
@@ -13,6 +9,10 @@ import "envoy/type/v3alpha/percent.proto";
 
 import "udpa/annotations/versioning.proto";
 
+option java_package = "io.envoyproxy.envoy.admin.v3alpha";
+option java_outer_classname = "ClustersProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Clusters]
 
 // Admin endpoint uses this wrapper for `/clusters` to display cluster status information.
diff --git a/api/envoy/admin/v3alpha/config_dump.proto b/api/envoy/admin/v3alpha/config_dump.proto
index c7c7ac85326bb..6ee40c75b7577 100644
--- a/api/envoy/admin/v3alpha/config_dump.proto
+++ b/api/envoy/admin/v3alpha/config_dump.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.admin.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.admin.v3alpha";
-option java_outer_classname = "ConfigDumpProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/auth/cert.proto";
 import "envoy/api/v3alpha/cds.proto";
 import "envoy/api/v3alpha/lds.proto";
@@ -18,6 +14,10 @@ import "google/protobuf/timestamp.proto";
 
 import "udpa/annotations/versioning.proto";
 
+option java_package = "io.envoyproxy.envoy.admin.v3alpha";
+option java_outer_classname = "ConfigDumpProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: ConfigDump]
 
 // The :ref:`/config_dump <operations_admin_interface_config_dump>` admin endpoint uses this wrapper
diff --git a/api/envoy/admin/v3alpha/listeners.proto b/api/envoy/admin/v3alpha/listeners.proto
index 054cdc180d240..581a22fa6e36c 100644
--- a/api/envoy/admin/v3alpha/listeners.proto
+++ b/api/envoy/admin/v3alpha/listeners.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.admin.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.admin.v3alpha";
-option java_outer_classname = "ListenersProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/address.proto";
 
 import "udpa/annotations/versioning.proto";
 
+option java_package = "io.envoyproxy.envoy.admin.v3alpha";
+option java_outer_classname = "ListenersProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Listeners]
 
 // Admin endpoint uses this wrapper for `/listeners` to display listener status information.
diff --git a/api/envoy/admin/v3alpha/memory.proto b/api/envoy/admin/v3alpha/memory.proto
index e8b234979c486..9429548326c96 100644
--- a/api/envoy/admin/v3alpha/memory.proto
+++ b/api/envoy/admin/v3alpha/memory.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.admin.v3alpha;
 
+import "udpa/annotations/versioning.proto";
+
 option java_package = "io.envoyproxy.envoy.admin.v3alpha";
 option java_outer_classname = "MemoryProto";
 option java_multiple_files = true;
 
-import "udpa/annotations/versioning.proto";
-
 // [#protodoc-title: Memory]
 
 // Proto representation of the internal memory consumption of an Envoy instance. These represent
diff --git a/api/envoy/admin/v3alpha/metrics.proto b/api/envoy/admin/v3alpha/metrics.proto
index b36932dec3620..38225c8fc91da 100644
--- a/api/envoy/admin/v3alpha/metrics.proto
+++ b/api/envoy/admin/v3alpha/metrics.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.admin.v3alpha;
 
+import "udpa/annotations/versioning.proto";
+
 option java_package = "io.envoyproxy.envoy.admin.v3alpha";
 option java_outer_classname = "MetricsProto";
 option java_multiple_files = true;
 
-import "udpa/annotations/versioning.proto";
-
 // [#protodoc-title: Metrics]
 
 // Proto representation of an Envoy Counter or Gauge value.
diff --git a/api/envoy/admin/v3alpha/mutex_stats.proto b/api/envoy/admin/v3alpha/mutex_stats.proto
index d2729b021dba0..8b7e30956280f 100644
--- a/api/envoy/admin/v3alpha/mutex_stats.proto
+++ b/api/envoy/admin/v3alpha/mutex_stats.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.admin.v3alpha;
 
+import "udpa/annotations/versioning.proto";
+
 option java_package = "io.envoyproxy.envoy.admin.v3alpha";
 option java_outer_classname = "MutexStatsProto";
 option java_multiple_files = true;
 
-import "udpa/annotations/versioning.proto";
-
 // [#protodoc-title: MutexStats]
 
 // Proto representation of the statistics collected upon absl::Mutex contention, if Envoy is run
diff --git a/api/envoy/admin/v3alpha/server_info.proto b/api/envoy/admin/v3alpha/server_info.proto
index 527d9dfc27c1b..ccceb4e1b180e 100644
--- a/api/envoy/admin/v3alpha/server_info.proto
+++ b/api/envoy/admin/v3alpha/server_info.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.admin.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.admin.v3alpha";
-option java_outer_classname = "ServerInfoProto";
-option java_multiple_files = true;
-
 import "google/protobuf/duration.proto";
 
 import "udpa/annotations/versioning.proto";
 
+option java_package = "io.envoyproxy.envoy.admin.v3alpha";
+option java_outer_classname = "ServerInfoProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Server State]
 
 // Proto representation of the value returned by /server_info, containing
diff --git a/api/envoy/admin/v3alpha/tap.proto b/api/envoy/admin/v3alpha/tap.proto
index c0942866287f9..aaf23c56129e7 100644
--- a/api/envoy/admin/v3alpha/tap.proto
+++ b/api/envoy/admin/v3alpha/tap.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.admin.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.admin.v3alpha";
-option java_outer_classname = "TapProto";
-option java_multiple_files = true;
-
 import "envoy/service/tap/v3alpha/common.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.admin.v3alpha";
+option java_outer_classname = "TapProto";
+option java_multiple_files = true;
+
 // The /tap admin request body that is used to configure an active tap session.
 message TapRequest {
   option (udpa.annotations.versioning).previous_message_type = "envoy.admin.v2alpha.TapRequest";
diff --git a/api/envoy/api/v2/auth/cert.proto b/api/envoy/api/v2/auth/cert.proto
index b01999d7ded6e..3e0947ae6e9e7 100644
--- a/api/envoy/api/v2/auth/cert.proto
+++ b/api/envoy/api/v2/auth/cert.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.auth;
 
-option java_package = "io.envoyproxy.envoy.api.v2.auth";
-option java_outer_classname = "CertProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/core/config_source.proto";
 
@@ -15,6 +11,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2.auth";
+option java_outer_classname = "CertProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Common TLS configuration]
 
 message TlsParameters {
diff --git a/api/envoy/api/v2/cds.proto b/api/envoy/api/v2/cds.proto
index c8ab0193f5894..d174d929dc497 100644
--- a/api/envoy/api/v2/cds.proto
+++ b/api/envoy/api/v2/cds.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2;
 
-option java_package = "io.envoyproxy.envoy.api.v2";
-option java_outer_classname = "CdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v2/auth/cert.proto";
 import "envoy/api/v2/cluster/circuit_breaker.proto";
 import "envoy/api/v2/cluster/filter.proto";
@@ -29,6 +24,11 @@ import "google/protobuf/wrappers.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2";
+option java_outer_classname = "CdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: Clusters]
 
 // Return list of all clusters this proxy will load balance to.
diff --git a/api/envoy/api/v2/cluster/circuit_breaker.proto b/api/envoy/api/v2/cluster/circuit_breaker.proto
index 922f3178fbda2..1c25a80160ac0 100644
--- a/api/envoy/api/v2/cluster/circuit_breaker.proto
+++ b/api/envoy/api/v2/cluster/circuit_breaker.proto
@@ -2,18 +2,18 @@ syntax = "proto3";
 
 package envoy.api.v2.cluster;
 
-option java_package = "io.envoyproxy.envoy.api.v2.cluster";
-option java_outer_classname = "CircuitBreakerProto";
-option java_multiple_files = true;
-option csharp_namespace = "Envoy.Api.V2.ClusterNS";
-option ruby_package = "Envoy.Api.V2.ClusterNS";
-
 import "envoy/api/v2/core/base.proto";
 
 import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2.cluster";
+option java_outer_classname = "CircuitBreakerProto";
+option java_multiple_files = true;
+option csharp_namespace = "Envoy.Api.V2.ClusterNS";
+option ruby_package = "Envoy.Api.V2.ClusterNS";
+
 // [#protodoc-title: Circuit breakers]
 
 // :ref:`Circuit breaking<arch_overview_circuit_break>` settings can be
diff --git a/api/envoy/api/v2/cluster/filter.proto b/api/envoy/api/v2/cluster/filter.proto
index c8e7d0d6c0c5d..f4f89426d7b0a 100644
--- a/api/envoy/api/v2/cluster/filter.proto
+++ b/api/envoy/api/v2/cluster/filter.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.api.v2.cluster;
 
+import "google/protobuf/any.proto";
+
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.api.v2.cluster";
 option java_outer_classname = "FilterProto";
 option java_multiple_files = true;
 option csharp_namespace = "Envoy.Api.V2.ClusterNS";
 option ruby_package = "Envoy.Api.V2.ClusterNS";
 
-import "google/protobuf/any.proto";
-
-import "validate/validate.proto";
-
 // [#protodoc-title: Upstream filters]
 //
 // Upstream filters apply to the connections to the upstream cluster hosts.
diff --git a/api/envoy/api/v2/cluster/outlier_detection.proto b/api/envoy/api/v2/cluster/outlier_detection.proto
index a9708d7c984c5..df27775b51348 100644
--- a/api/envoy/api/v2/cluster/outlier_detection.proto
+++ b/api/envoy/api/v2/cluster/outlier_detection.proto
@@ -2,17 +2,17 @@ syntax = "proto3";
 
 package envoy.api.v2.cluster;
 
+import "google/protobuf/duration.proto";
+import "google/protobuf/wrappers.proto";
+
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.api.v2.cluster";
 option java_outer_classname = "OutlierDetectionProto";
 option java_multiple_files = true;
 option csharp_namespace = "Envoy.Api.V2.ClusterNS";
 option ruby_package = "Envoy.Api.V2.ClusterNS";
 
-import "google/protobuf/duration.proto";
-import "google/protobuf/wrappers.proto";
-
-import "validate/validate.proto";
-
 // [#protodoc-title: Outlier detection]
 
 // See the :ref:`architecture overview <arch_overview_outlier_detection>` for
diff --git a/api/envoy/api/v2/core/address.proto b/api/envoy/api/v2/core/address.proto
index 3b98e0973742a..fe66724892253 100644
--- a/api/envoy/api/v2/core/address.proto
+++ b/api/envoy/api/v2/core/address.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.api.v2.core;
 
-option java_package = "io.envoyproxy.envoy.api.v2.core";
-option java_outer_classname = "AddressProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/base.proto";
 
 import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2.core";
+option java_outer_classname = "AddressProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Network addresses]
 
 message Pipe {
diff --git a/api/envoy/api/v2/core/base.proto b/api/envoy/api/v2/core/base.proto
index 5bff9947f14bb..e18744a6419c9 100644
--- a/api/envoy/api/v2/core/base.proto
+++ b/api/envoy/api/v2/core/base.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.core;
 
-option java_package = "io.envoyproxy.envoy.api.v2.core";
-option java_outer_classname = "BaseProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/http_uri.proto";
 import "envoy/type/percent.proto";
 
@@ -15,6 +11,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2.core";
+option java_outer_classname = "BaseProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Common types]
 
 // Envoy supports :ref:`upstream priority routing
diff --git a/api/envoy/api/v2/core/config_source.proto b/api/envoy/api/v2/core/config_source.proto
index 6e532cd5e4f65..00dae5bdf8f8d 100644
--- a/api/envoy/api/v2/core/config_source.proto
+++ b/api/envoy/api/v2/core/config_source.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.core;
 
-option java_package = "io.envoyproxy.envoy.api.v2.core";
-option java_outer_classname = "ConfigSourceProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/grpc_service.proto";
 
 import "google/protobuf/duration.proto";
@@ -13,6 +9,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2.core";
+option java_outer_classname = "ConfigSourceProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Configuration sources]
 
 // API configuration source. This identifies the API type and cluster that Envoy
diff --git a/api/envoy/api/v2/core/grpc_service.proto b/api/envoy/api/v2/core/grpc_service.proto
index f9e469a08e449..02fb63ff5596c 100644
--- a/api/envoy/api/v2/core/grpc_service.proto
+++ b/api/envoy/api/v2/core/grpc_service.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.core;
 
-option java_package = "io.envoyproxy.envoy.api.v2.core";
-option java_outer_classname = "GrpcServiceProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/base.proto";
 
 import "google/protobuf/any.proto";
@@ -15,6 +11,10 @@ import "google/protobuf/struct.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2.core";
+option java_outer_classname = "GrpcServiceProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: gRPC services]
 
 // gRPC service configuration. This is used by :ref:`ApiConfigSource
diff --git a/api/envoy/api/v2/core/health_check.proto b/api/envoy/api/v2/core/health_check.proto
index 674303aa88ead..cbfb369a4fba8 100644
--- a/api/envoy/api/v2/core/health_check.proto
+++ b/api/envoy/api/v2/core/health_check.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.core;
 
-option java_package = "io.envoyproxy.envoy.api.v2.core";
-option java_outer_classname = "HealthCheckProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/type/http.proto";
 import "envoy/type/range.proto";
@@ -17,6 +13,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2.core";
+option java_outer_classname = "HealthCheckProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Health check]
 // * Health checking :ref:`architecture overview <arch_overview_health_checking>`.
 // * If health checking is configured for a cluster, additional statistics are emitted. They are
diff --git a/api/envoy/api/v2/core/http_uri.proto b/api/envoy/api/v2/core/http_uri.proto
index 11d6d80cb3fe7..14e24c71c3410 100644
--- a/api/envoy/api/v2/core/http_uri.proto
+++ b/api/envoy/api/v2/core/http_uri.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.api.v2.core;
 
-option java_package = "io.envoyproxy.envoy.api.v2.core";
-option java_outer_classname = "HttpUriProto";
-option java_multiple_files = true;
-
 import "google/protobuf/duration.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2.core";
+option java_outer_classname = "HttpUriProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: HTTP Service URI ]
 
 // Envoy external URI descriptor
diff --git a/api/envoy/api/v2/core/protocol.proto b/api/envoy/api/v2/core/protocol.proto
index 61ca6df6f7b5c..e06bee41f17c1 100644
--- a/api/envoy/api/v2/core/protocol.proto
+++ b/api/envoy/api/v2/core/protocol.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.api.v2.core;
 
-option java_package = "io.envoyproxy.envoy.api.v2.core";
-option java_outer_classname = "ProtocolProto";
-option java_multiple_files = true;
-
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2.core";
+option java_outer_classname = "ProtocolProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Protocol options]
 
 // [#not-implemented-hide:]
diff --git a/api/envoy/api/v2/discovery.proto b/api/envoy/api/v2/discovery.proto
index dd92187429662..fe9810243f5a5 100644
--- a/api/envoy/api/v2/discovery.proto
+++ b/api/envoy/api/v2/discovery.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.api.v2;
 
-option java_package = "io.envoyproxy.envoy.api.v2";
-option java_outer_classname = "DiscoveryProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/base.proto";
 
 import "google/protobuf/any.proto";
 import "google/rpc/status.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2";
+option java_outer_classname = "DiscoveryProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Common discovery API components]
 
 // A DiscoveryRequest requests a set of versioned resources of the same type for
diff --git a/api/envoy/api/v2/eds.proto b/api/envoy/api/v2/eds.proto
index 974d981547c05..1c2a5c362263a 100644
--- a/api/envoy/api/v2/eds.proto
+++ b/api/envoy/api/v2/eds.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2;
 
-option java_package = "io.envoyproxy.envoy.api.v2";
-option java_outer_classname = "EdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v2/discovery.proto";
 import "envoy/api/v2/endpoint/endpoint.proto";
 import "envoy/type/percent.proto";
@@ -17,6 +12,11 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2";
+option java_outer_classname = "EdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: EDS]
 // Endpoint discovery :ref:`architecture overview <arch_overview_service_discovery_types_eds>`
 
diff --git a/api/envoy/api/v2/endpoint/endpoint.proto b/api/envoy/api/v2/endpoint/endpoint.proto
index d878960082f84..ebcf7aa8ac155 100644
--- a/api/envoy/api/v2/endpoint/endpoint.proto
+++ b/api/envoy/api/v2/endpoint/endpoint.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.endpoint;
 
-option java_package = "io.envoyproxy.envoy.api.v2.endpoint";
-option java_outer_classname = "EndpointProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/address.proto";
 import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/core/health_check.proto";
@@ -14,6 +10,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2.endpoint";
+option java_outer_classname = "EndpointProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Endpoints]
 
 // Upstream host identifier.
diff --git a/api/envoy/api/v2/endpoint/load_report.proto b/api/envoy/api/v2/endpoint/load_report.proto
index ff7465d4d1a31..e9e85a4ecc9ef 100644
--- a/api/envoy/api/v2/endpoint/load_report.proto
+++ b/api/envoy/api/v2/endpoint/load_report.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.endpoint;
 
-option java_package = "io.envoyproxy.envoy.api.v2.endpoint";
-option java_outer_classname = "LoadReportProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/address.proto";
 import "envoy/api/v2/core/base.proto";
 
@@ -14,6 +10,10 @@ import "google/protobuf/struct.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2.endpoint";
+option java_outer_classname = "LoadReportProto";
+option java_multiple_files = true;
+
 // These are stats Envoy reports to GLB every so often. Report frequency is
 // defined by
 // :ref:`LoadStatsResponse.load_reporting_interval<envoy_api_field_service.load_stats.v2.LoadStatsResponse.load_reporting_interval>`.
diff --git a/api/envoy/api/v2/lds.proto b/api/envoy/api/v2/lds.proto
index 2d56bff417d79..fd2f6fbf40c02 100644
--- a/api/envoy/api/v2/lds.proto
+++ b/api/envoy/api/v2/lds.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2;
 
-option java_package = "io.envoyproxy.envoy.api.v2";
-option java_outer_classname = "LdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v2/core/address.proto";
 import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/discovery.proto";
@@ -20,6 +15,11 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2";
+option java_outer_classname = "LdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: Listener]
 // Listener :ref:`configuration overview <config_listeners>`
 
diff --git a/api/envoy/api/v2/listener/listener.proto b/api/envoy/api/v2/listener/listener.proto
index 851da80e73259..65caf2b98f8f9 100644
--- a/api/envoy/api/v2/listener/listener.proto
+++ b/api/envoy/api/v2/listener/listener.proto
@@ -2,12 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.listener;
 
-option java_package = "io.envoyproxy.envoy.api.v2.listener";
-option java_outer_classname = "ListenerProto";
-option java_multiple_files = true;
-option csharp_namespace = "Envoy.Api.V2.ListenerNS";
-option ruby_package = "Envoy.Api.V2.ListenerNS";
-
 import "envoy/api/v2/auth/cert.proto";
 import "envoy/api/v2/core/address.proto";
 import "envoy/api/v2/core/base.proto";
@@ -18,6 +12,12 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2.listener";
+option java_outer_classname = "ListenerProto";
+option java_multiple_files = true;
+option csharp_namespace = "Envoy.Api.V2.ListenerNS";
+option ruby_package = "Envoy.Api.V2.ListenerNS";
+
 // [#protodoc-title: Listener components]
 // Listener :ref:`configuration overview <config_listeners>`
 
diff --git a/api/envoy/api/v2/listener/quic_config.proto b/api/envoy/api/v2/listener/quic_config.proto
index 8679f3b3086c0..bb9d1b0f7bf34 100644
--- a/api/envoy/api/v2/listener/quic_config.proto
+++ b/api/envoy/api/v2/listener/quic_config.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.api.v2.listener;
 
+import "google/protobuf/duration.proto";
+import "google/protobuf/wrappers.proto";
+
 option java_package = "io.envoyproxy.envoy.api.v2.listener";
 option java_outer_classname = "QuicConfigProto";
 option java_multiple_files = true;
 option csharp_namespace = "Envoy.Api.V2.ListenerNS";
 option ruby_package = "Envoy.Api.V2.ListenerNS";
 
-import "google/protobuf/duration.proto";
-import "google/protobuf/wrappers.proto";
-
 // [#protodoc-title: QUIC listener Config]
 
 // Configuration specific to the QUIC protocol.
diff --git a/api/envoy/api/v2/listener/udp_listener_config.proto b/api/envoy/api/v2/listener/udp_listener_config.proto
index 33318826ca68c..917aa05b4f19a 100644
--- a/api/envoy/api/v2/listener/udp_listener_config.proto
+++ b/api/envoy/api/v2/listener/udp_listener_config.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.api.v2.listener;
 
+import "google/protobuf/any.proto";
+import "google/protobuf/struct.proto";
+
 option java_package = "io.envoyproxy.envoy.api.v2.listener";
 option java_outer_classname = "UdpListenerConfigProto";
 option java_multiple_files = true;
 option csharp_namespace = "Envoy.Api.V2.ListenerNS";
 option ruby_package = "Envoy.Api.V2.ListenerNS";
 
-import "google/protobuf/any.proto";
-import "google/protobuf/struct.proto";
-
 // [#protodoc-title: UDP Listener Config]
 // Listener :ref:`configuration overview <config_listeners>`
 
diff --git a/api/envoy/api/v2/ratelimit/ratelimit.proto b/api/envoy/api/v2/ratelimit/ratelimit.proto
index 481697166b784..63fe2fbe49f4e 100644
--- a/api/envoy/api/v2/ratelimit/ratelimit.proto
+++ b/api/envoy/api/v2/ratelimit/ratelimit.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.api.v2.ratelimit;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.api.v2.ratelimit";
 option java_outer_classname = "RatelimitProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: Common rate limit components]
 
 // A RateLimitDescriptor is a list of hierarchical entries that are used by the service to
diff --git a/api/envoy/api/v2/rds.proto b/api/envoy/api/v2/rds.proto
index b114aaf2546f2..eb7456d00216c 100644
--- a/api/envoy/api/v2/rds.proto
+++ b/api/envoy/api/v2/rds.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2;
 
-option java_package = "io.envoyproxy.envoy.api.v2";
-option java_outer_classname = "RdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/core/config_source.proto";
 import "envoy/api/v2/discovery.proto";
@@ -17,6 +12,11 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2";
+option java_outer_classname = "RdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: HTTP route configuration]
 // * Routing :ref:`architecture overview <arch_overview_http_routing>`
 // * HTTP :ref:`router filter <config_http_filters_router>`
diff --git a/api/envoy/api/v2/route/route.proto b/api/envoy/api/v2/route/route.proto
index d87f5e68fa40b..a802ff4207719 100644
--- a/api/envoy/api/v2/route/route.proto
+++ b/api/envoy/api/v2/route/route.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v2.route;
 
-option java_package = "io.envoyproxy.envoy.api.v2.route";
-option java_outer_classname = "RouteProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/type/matcher/regex.proto";
 import "envoy/type/matcher/string.proto";
@@ -21,6 +17,10 @@ import "google/protobuf/wrappers.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2.route";
+option java_outer_classname = "RouteProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: HTTP route]
 // * Routing :ref:`architecture overview <arch_overview_http_routing>`
 // * HTTP :ref:`router filter <config_http_filters_router>`
diff --git a/api/envoy/api/v2/srds.proto b/api/envoy/api/v2/srds.proto
index 89fc25c31a598..c0644112d34f9 100644
--- a/api/envoy/api/v2/srds.proto
+++ b/api/envoy/api/v2/srds.proto
@@ -2,17 +2,17 @@ syntax = "proto3";
 
 package envoy.api.v2;
 
-option java_package = "io.envoyproxy.envoy.api.v2";
-option java_outer_classname = "SrdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v2/discovery.proto";
 
 import "google/api/annotations.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v2";
+option java_outer_classname = "SrdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: HTTP scoped routing configuration]
 // * Routing :ref:`architecture overview <arch_overview_http_routing>`
 
diff --git a/api/envoy/api/v3alpha/auth/cert.proto b/api/envoy/api/v3alpha/auth/cert.proto
index 82bbc3ed2badd..a91a30be36a45 100644
--- a/api/envoy/api/v3alpha/auth/cert.proto
+++ b/api/envoy/api/v3alpha/auth/cert.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.auth;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.auth";
-option java_outer_classname = "CertProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/api/v3alpha/core/config_source.proto";
 
@@ -17,6 +13,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.auth";
+option java_outer_classname = "CertProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Common TLS configuration]
 
 message TlsParameters {
diff --git a/api/envoy/api/v3alpha/cds.proto b/api/envoy/api/v3alpha/cds.proto
index e704537fcbc21..f2717064de1c2 100644
--- a/api/envoy/api/v3alpha/cds.proto
+++ b/api/envoy/api/v3alpha/cds.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha";
-option java_outer_classname = "CdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v3alpha/cluster/circuit_breaker.proto";
 import "envoy/api/v3alpha/cluster/filter.proto";
 import "envoy/api/v3alpha/cluster/outlier_detection.proto";
@@ -29,6 +24,11 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha";
+option java_outer_classname = "CdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: Clusters]
 
 // Return list of all clusters this proxy will load balance to.
diff --git a/api/envoy/api/v3alpha/cluster/circuit_breaker.proto b/api/envoy/api/v3alpha/cluster/circuit_breaker.proto
index 89a8e3c406c92..40360f4fcb9e7 100644
--- a/api/envoy/api/v3alpha/cluster/circuit_breaker.proto
+++ b/api/envoy/api/v3alpha/cluster/circuit_breaker.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.cluster;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.cluster";
-option java_outer_classname = "CircuitBreakerProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 
 import "google/protobuf/wrappers.proto";
@@ -14,6 +10,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.cluster";
+option java_outer_classname = "CircuitBreakerProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Circuit breakers]
 
 // :ref:`Circuit breaking<arch_overview_circuit_break>` settings can be
diff --git a/api/envoy/api/v3alpha/cluster/filter.proto b/api/envoy/api/v3alpha/cluster/filter.proto
index aa2a24bf02315..ec4193132116d 100644
--- a/api/envoy/api/v3alpha/cluster/filter.proto
+++ b/api/envoy/api/v3alpha/cluster/filter.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.cluster;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.cluster";
-option java_outer_classname = "FilterProto";
-option java_multiple_files = true;
-
 import "google/protobuf/any.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.cluster";
+option java_outer_classname = "FilterProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Upstream filters]
 //
 // Upstream filters apply to the connections to the upstream cluster hosts.
diff --git a/api/envoy/api/v3alpha/cluster/outlier_detection.proto b/api/envoy/api/v3alpha/cluster/outlier_detection.proto
index f49ceba092565..5fbd6be1dda48 100644
--- a/api/envoy/api/v3alpha/cluster/outlier_detection.proto
+++ b/api/envoy/api/v3alpha/cluster/outlier_detection.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.cluster;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.cluster";
-option java_outer_classname = "OutlierDetectionProto";
-option java_multiple_files = true;
-
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
@@ -13,6 +9,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.cluster";
+option java_outer_classname = "OutlierDetectionProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Outlier detection]
 
 // See the :ref:`architecture overview <arch_overview_outlier_detection>` for
diff --git a/api/envoy/api/v3alpha/core/address.proto b/api/envoy/api/v3alpha/core/address.proto
index a2fe375ac76e6..4f6280425864e 100644
--- a/api/envoy/api/v3alpha/core/address.proto
+++ b/api/envoy/api/v3alpha/core/address.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.core;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.core";
-option java_outer_classname = "AddressProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 
 import "google/protobuf/wrappers.proto";
@@ -14,6 +10,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.core";
+option java_outer_classname = "AddressProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Network addresses]
 
 message Pipe {
diff --git a/api/envoy/api/v3alpha/core/base.proto b/api/envoy/api/v3alpha/core/base.proto
index 4930193481623..0aa1dcbeb4388 100644
--- a/api/envoy/api/v3alpha/core/base.proto
+++ b/api/envoy/api/v3alpha/core/base.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.core;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.core";
-option java_outer_classname = "BaseProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/http_uri.proto";
 import "envoy/type/v3alpha/percent.proto";
 
@@ -17,6 +13,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.core";
+option java_outer_classname = "BaseProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Common types]
 
 // Envoy supports :ref:`upstream priority routing
diff --git a/api/envoy/api/v3alpha/core/config_source.proto b/api/envoy/api/v3alpha/core/config_source.proto
index ef88f7d44c291..3b87d57e3d4e0 100644
--- a/api/envoy/api/v3alpha/core/config_source.proto
+++ b/api/envoy/api/v3alpha/core/config_source.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.core;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.core";
-option java_outer_classname = "ConfigSourceProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/grpc_service.proto";
 
 import "google/protobuf/duration.proto";
@@ -15,6 +11,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.core";
+option java_outer_classname = "ConfigSourceProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Configuration sources]
 
 // API configuration source. This identifies the API type and cluster that Envoy
diff --git a/api/envoy/api/v3alpha/core/grpc_service.proto b/api/envoy/api/v3alpha/core/grpc_service.proto
index 02f3b646a6f97..68aac3955164a 100644
--- a/api/envoy/api/v3alpha/core/grpc_service.proto
+++ b/api/envoy/api/v3alpha/core/grpc_service.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.core;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.core";
-option java_outer_classname = "GrpcServiceProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 
 import "google/protobuf/any.proto";
@@ -17,6 +13,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.core";
+option java_outer_classname = "GrpcServiceProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: gRPC services]
 
 // gRPC service configuration. This is used by :ref:`ApiConfigSource
diff --git a/api/envoy/api/v3alpha/core/health_check.proto b/api/envoy/api/v3alpha/core/health_check.proto
index a8974740c6490..3dfd274454cef 100644
--- a/api/envoy/api/v3alpha/core/health_check.proto
+++ b/api/envoy/api/v3alpha/core/health_check.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.core;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.core";
-option java_outer_classname = "HealthCheckProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/type/v3alpha/http.proto";
 import "envoy/type/v3alpha/range.proto";
@@ -19,6 +15,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.core";
+option java_outer_classname = "HealthCheckProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Health check]
 // * Health checking :ref:`architecture overview <arch_overview_health_checking>`.
 // * If health checking is configured for a cluster, additional statistics are emitted. They are
diff --git a/api/envoy/api/v3alpha/core/http_uri.proto b/api/envoy/api/v3alpha/core/http_uri.proto
index 30b8d8647216d..5d990ce3fa16c 100644
--- a/api/envoy/api/v3alpha/core/http_uri.proto
+++ b/api/envoy/api/v3alpha/core/http_uri.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.core;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.core";
-option java_outer_classname = "HttpUriProto";
-option java_multiple_files = true;
-
 import "google/protobuf/duration.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.core";
+option java_outer_classname = "HttpUriProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: HTTP Service URI ]
 
 // Envoy external URI descriptor
diff --git a/api/envoy/api/v3alpha/core/protocol.proto b/api/envoy/api/v3alpha/core/protocol.proto
index 02dce60112253..d143fca862f61 100644
--- a/api/envoy/api/v3alpha/core/protocol.proto
+++ b/api/envoy/api/v3alpha/core/protocol.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.core;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.core";
-option java_outer_classname = "ProtocolProto";
-option java_multiple_files = true;
-
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
@@ -13,6 +9,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.core";
+option java_outer_classname = "ProtocolProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Protocol options]
 
 // [#not-implemented-hide:]
diff --git a/api/envoy/api/v3alpha/discovery.proto b/api/envoy/api/v3alpha/discovery.proto
index 9781fa3666705..ab3ce3e58245b 100644
--- a/api/envoy/api/v3alpha/discovery.proto
+++ b/api/envoy/api/v3alpha/discovery.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha";
-option java_outer_classname = "DiscoveryProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 
 import "google/protobuf/any.proto";
@@ -13,6 +9,10 @@ import "google/rpc/status.proto";
 
 import "udpa/annotations/versioning.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha";
+option java_outer_classname = "DiscoveryProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Common discovery API components]
 
 // A DiscoveryRequest requests a set of versioned resources of the same type for
diff --git a/api/envoy/api/v3alpha/eds.proto b/api/envoy/api/v3alpha/eds.proto
index dc2f90f4b41eb..805d3c47ae4d8 100644
--- a/api/envoy/api/v3alpha/eds.proto
+++ b/api/envoy/api/v3alpha/eds.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha";
-option java_outer_classname = "EdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v3alpha/discovery.proto";
 import "envoy/api/v3alpha/endpoint/endpoint.proto";
 import "envoy/type/v3alpha/percent.proto";
@@ -19,6 +14,11 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha";
+option java_outer_classname = "EdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: EDS]
 // Endpoint discovery :ref:`architecture overview <arch_overview_service_discovery_types_eds>`
 
diff --git a/api/envoy/api/v3alpha/endpoint/endpoint.proto b/api/envoy/api/v3alpha/endpoint/endpoint.proto
index cdd0ec032b80e..e849005a2823f 100644
--- a/api/envoy/api/v3alpha/endpoint/endpoint.proto
+++ b/api/envoy/api/v3alpha/endpoint/endpoint.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.endpoint;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.endpoint";
-option java_outer_classname = "EndpointProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/address.proto";
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/api/v3alpha/core/health_check.proto";
@@ -16,6 +12,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.endpoint";
+option java_outer_classname = "EndpointProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Endpoints]
 
 // Upstream host identifier.
diff --git a/api/envoy/api/v3alpha/endpoint/load_report.proto b/api/envoy/api/v3alpha/endpoint/load_report.proto
index 844f776cf0076..c5afbdd40c261 100644
--- a/api/envoy/api/v3alpha/endpoint/load_report.proto
+++ b/api/envoy/api/v3alpha/endpoint/load_report.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.endpoint;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.endpoint";
-option java_outer_classname = "LoadReportProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/address.proto";
 import "envoy/api/v3alpha/core/base.proto";
 
@@ -16,6 +12,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.endpoint";
+option java_outer_classname = "LoadReportProto";
+option java_multiple_files = true;
+
 // These are stats Envoy reports to GLB every so often. Report frequency is
 // defined by
 // :ref:`LoadStatsResponse.load_reporting_interval<envoy_api_field_service.load_stats.v3alpha.LoadStatsResponse.load_reporting_interval>`.
diff --git a/api/envoy/api/v3alpha/lds.proto b/api/envoy/api/v3alpha/lds.proto
index 2424071ce6121..8d8742be08144 100644
--- a/api/envoy/api/v3alpha/lds.proto
+++ b/api/envoy/api/v3alpha/lds.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha";
-option java_outer_classname = "LdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v3alpha/core/address.proto";
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/api/v3alpha/discovery.proto";
@@ -22,6 +17,11 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha";
+option java_outer_classname = "LdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: Listener]
 // Listener :ref:`configuration overview <config_listeners>`
 
diff --git a/api/envoy/api/v3alpha/listener/listener.proto b/api/envoy/api/v3alpha/listener/listener.proto
index 2cfcb73f28490..0e72c5b531251 100644
--- a/api/envoy/api/v3alpha/listener/listener.proto
+++ b/api/envoy/api/v3alpha/listener/listener.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.listener;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.listener";
-option java_outer_classname = "ListenerProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/address.proto";
 import "envoy/api/v3alpha/core/base.proto";
 
@@ -17,6 +13,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.listener";
+option java_outer_classname = "ListenerProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Listener components]
 // Listener :ref:`configuration overview <config_listeners>`
 
diff --git a/api/envoy/api/v3alpha/listener/quic_config.proto b/api/envoy/api/v3alpha/listener/quic_config.proto
index 4f021de000acd..4323a8aa151ab 100644
--- a/api/envoy/api/v3alpha/listener/quic_config.proto
+++ b/api/envoy/api/v3alpha/listener/quic_config.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.listener;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.listener";
-option java_outer_classname = "QuicConfigProto";
-option java_multiple_files = true;
-
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/versioning.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.listener";
+option java_outer_classname = "QuicConfigProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: QUIC listener Config]
 
 // Configuration specific to the QUIC protocol.
diff --git a/api/envoy/api/v3alpha/listener/udp_listener_config.proto b/api/envoy/api/v3alpha/listener/udp_listener_config.proto
index f53f7a8ae5239..e203d67bad186 100644
--- a/api/envoy/api/v3alpha/listener/udp_listener_config.proto
+++ b/api/envoy/api/v3alpha/listener/udp_listener_config.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.listener;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.listener";
-option java_outer_classname = "UdpListenerConfigProto";
-option java_multiple_files = true;
-
 import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
 
 import "udpa/annotations/versioning.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.listener";
+option java_outer_classname = "UdpListenerConfigProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: UDP Listener Config]
 // Listener :ref:`configuration overview <config_listeners>`
 
diff --git a/api/envoy/api/v3alpha/ratelimit/ratelimit.proto b/api/envoy/api/v3alpha/ratelimit/ratelimit.proto
index 28a6d7b988878..88466bf4a43f8 100644
--- a/api/envoy/api/v3alpha/ratelimit/ratelimit.proto
+++ b/api/envoy/api/v3alpha/ratelimit/ratelimit.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.ratelimit;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.ratelimit";
-option java_outer_classname = "RatelimitProto";
-option java_multiple_files = true;
-
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.ratelimit";
+option java_outer_classname = "RatelimitProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Common rate limit components]
 
 // A RateLimitDescriptor is a list of hierarchical entries that are used by the service to
diff --git a/api/envoy/api/v3alpha/rds.proto b/api/envoy/api/v3alpha/rds.proto
index 3df63feb1be92..7eb58dee5d42d 100644
--- a/api/envoy/api/v3alpha/rds.proto
+++ b/api/envoy/api/v3alpha/rds.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha";
-option java_outer_classname = "RdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/api/v3alpha/core/config_source.proto";
 import "envoy/api/v3alpha/discovery.proto";
@@ -19,6 +14,11 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha";
+option java_outer_classname = "RdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: HTTP route configuration]
 // * Routing :ref:`architecture overview <arch_overview_http_routing>`
 // * HTTP :ref:`router filter <config_http_filters_router>`
diff --git a/api/envoy/api/v3alpha/route/route.proto b/api/envoy/api/v3alpha/route/route.proto
index 2fd41d784fa1f..a94b541f6c319 100644
--- a/api/envoy/api/v3alpha/route/route.proto
+++ b/api/envoy/api/v3alpha/route/route.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha.route;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha.route";
-option java_outer_classname = "RouteProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/type/matcher/v3alpha/regex.proto";
 import "envoy/type/matcher/v3alpha/string.proto";
@@ -22,6 +18,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha.route";
+option java_outer_classname = "RouteProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: HTTP route]
 // * Routing :ref:`architecture overview <arch_overview_http_routing>`
 // * HTTP :ref:`router filter <config_http_filters_router>`
diff --git a/api/envoy/api/v3alpha/srds.proto b/api/envoy/api/v3alpha/srds.proto
index e642fa80e0753..8732609c1afc1 100644
--- a/api/envoy/api/v3alpha/srds.proto
+++ b/api/envoy/api/v3alpha/srds.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.api.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.api.v3alpha";
-option java_outer_classname = "SrdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v3alpha/discovery.proto";
 
 import "google/api/annotations.proto";
@@ -15,6 +10,11 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.api.v3alpha";
+option java_outer_classname = "SrdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: HTTP scoped routing configuration]
 // * Routing :ref:`architecture overview <arch_overview_http_routing>`
 
diff --git a/api/envoy/config/accesslog/v2/als.proto b/api/envoy/config/accesslog/v2/als.proto
index 84af198acbf0d..bf1356248bede 100644
--- a/api/envoy/config/accesslog/v2/als.proto
+++ b/api/envoy/config/accesslog/v2/als.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.accesslog.v2;
 
-option java_package = "io.envoyproxy.envoy.config.accesslog.v2";
-option java_outer_classname = "AlsProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/grpc_service.proto";
 
 import "google/protobuf/duration.proto";
@@ -13,6 +9,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.accesslog.v2";
+option java_outer_classname = "AlsProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: gRPC Access Log Service (ALS)]
 
 // Configuration for the built-in *envoy.http_grpc_access_log*
diff --git a/api/envoy/config/accesslog/v2/file.proto b/api/envoy/config/accesslog/v2/file.proto
index 5e58671a0836d..831429baa3e7c 100644
--- a/api/envoy/config/accesslog/v2/file.proto
+++ b/api/envoy/config/accesslog/v2/file.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.config.accesslog.v2;
 
-option java_package = "io.envoyproxy.envoy.config.accesslog.v2";
-option java_outer_classname = "FileProto";
-option java_multiple_files = true;
-
 import "google/protobuf/struct.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.accesslog.v2";
+option java_outer_classname = "FileProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: File access log]
 // [#extension: envoy.access_loggers.file]
 
diff --git a/api/envoy/config/accesslog/v3alpha/als.proto b/api/envoy/config/accesslog/v3alpha/als.proto
index a723ff813802e..92197c43cb112 100644
--- a/api/envoy/config/accesslog/v3alpha/als.proto
+++ b/api/envoy/config/accesslog/v3alpha/als.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.accesslog.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.accesslog.v3alpha";
-option java_outer_classname = "AlsProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/grpc_service.proto";
 
 import "google/protobuf/duration.proto";
@@ -15,6 +11,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.accesslog.v3alpha";
+option java_outer_classname = "AlsProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: gRPC Access Log Service (ALS)]
 
 // Configuration for the built-in *envoy.http_grpc_access_log*
diff --git a/api/envoy/config/accesslog/v3alpha/file.proto b/api/envoy/config/accesslog/v3alpha/file.proto
index f366dc5768c5e..3b85c4fee1f4f 100644
--- a/api/envoy/config/accesslog/v3alpha/file.proto
+++ b/api/envoy/config/accesslog/v3alpha/file.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.accesslog.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.accesslog.v3alpha";
-option java_outer_classname = "FileProto";
-option java_multiple_files = true;
-
 import "google/protobuf/struct.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.accesslog.v3alpha";
+option java_outer_classname = "FileProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: File access log]
 // [#extension: envoy.access_loggers.file]
 
diff --git a/api/envoy/config/bootstrap/v2/bootstrap.proto b/api/envoy/config/bootstrap/v2/bootstrap.proto
index 6fd3923088c8b..609300721c507 100644
--- a/api/envoy/config/bootstrap/v2/bootstrap.proto
+++ b/api/envoy/config/bootstrap/v2/bootstrap.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.bootstrap.v2;
 
-option java_package = "io.envoyproxy.envoy.config.bootstrap.v2";
-option java_outer_classname = "BootstrapProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/auth/cert.proto";
 import "envoy/api/v2/cds.proto";
 import "envoy/api/v2/core/address.proto";
@@ -22,6 +18,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.bootstrap.v2";
+option java_outer_classname = "BootstrapProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Bootstrap]
 // This proto is supplied via the :option:`-c` CLI flag and acts as the root
 // of the Envoy v2 configuration. See the :ref:`v2 configuration overview
diff --git a/api/envoy/config/bootstrap/v3alpha/bootstrap.proto b/api/envoy/config/bootstrap/v3alpha/bootstrap.proto
index 9b9355296eb48..b2c8722ba6d65 100644
--- a/api/envoy/config/bootstrap/v3alpha/bootstrap.proto
+++ b/api/envoy/config/bootstrap/v3alpha/bootstrap.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.bootstrap.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.bootstrap.v3alpha";
-option java_outer_classname = "BootstrapProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/auth/cert.proto";
 import "envoy/api/v3alpha/cds.proto";
 import "envoy/api/v3alpha/core/address.proto";
@@ -24,6 +20,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.bootstrap.v3alpha";
+option java_outer_classname = "BootstrapProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Bootstrap]
 // This proto is supplied via the :option:`-c` CLI flag and acts as the root
 // of the Envoy v2 configuration. See the :ref:`v2 configuration overview
diff --git a/api/envoy/config/cluster/aggregate/v2alpha/cluster.proto b/api/envoy/config/cluster/aggregate/v2alpha/cluster.proto
index 73e79150d514b..932b3ead8e0ab 100644
--- a/api/envoy/config/cluster/aggregate/v2alpha/cluster.proto
+++ b/api/envoy/config/cluster/aggregate/v2alpha/cluster.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.config.cluster.aggregate.v2alpha;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.config.cluster.aggregate.v2alpha";
 option java_outer_classname = "ClusterProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: Aggregate cluster configuration]
 
 // Configuration for the aggregate cluster. See the :ref:`architecture overview
diff --git a/api/envoy/config/cluster/dynamic_forward_proxy/v2alpha/cluster.proto b/api/envoy/config/cluster/dynamic_forward_proxy/v2alpha/cluster.proto
index 71a95434a2bd4..c8634ba4a2df8 100644
--- a/api/envoy/config/cluster/dynamic_forward_proxy/v2alpha/cluster.proto
+++ b/api/envoy/config/cluster/dynamic_forward_proxy/v2alpha/cluster.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.config.cluster.dynamic_forward_proxy.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.config.cluster.dynamic_forward_proxy.v2alpha";
-option java_outer_classname = "ClusterProto";
-option java_multiple_files = true;
-
 import "envoy/config/common/dynamic_forward_proxy/v2alpha/dns_cache.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.cluster.dynamic_forward_proxy.v2alpha";
+option java_outer_classname = "ClusterProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Dynamic forward proxy cluster configuration]
 
 // Configuration for the dynamic forward proxy cluster. See the :ref:`architecture overview
diff --git a/api/envoy/config/cluster/dynamic_forward_proxy/v3alpha/cluster.proto b/api/envoy/config/cluster/dynamic_forward_proxy/v3alpha/cluster.proto
index 167e1c2a25070..954a6ea3474ff 100644
--- a/api/envoy/config/cluster/dynamic_forward_proxy/v3alpha/cluster.proto
+++ b/api/envoy/config/cluster/dynamic_forward_proxy/v3alpha/cluster.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.cluster.dynamic_forward_proxy.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.cluster.dynamic_forward_proxy.v3alpha";
-option java_outer_classname = "ClusterProto";
-option java_multiple_files = true;
-
 import "envoy/config/common/dynamic_forward_proxy/v3alpha/dns_cache.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.cluster.dynamic_forward_proxy.v3alpha";
+option java_outer_classname = "ClusterProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Dynamic forward proxy cluster configuration]
 
 // Configuration for the dynamic forward proxy cluster. See the :ref:`architecture overview
diff --git a/api/envoy/config/cluster/redis/redis_cluster.proto b/api/envoy/config/cluster/redis/redis_cluster.proto
index 57073ce2f30d6..f36345c337e6f 100644
--- a/api/envoy/config/cluster/redis/redis_cluster.proto
+++ b/api/envoy/config/cluster/redis/redis_cluster.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.config.cluster.redis;
 
-option java_package = "io.envoyproxy.envoy.config.cluster.redis";
-option java_outer_classname = "RedisClusterProto";
-option java_multiple_files = true;
-
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.cluster.redis";
+option java_outer_classname = "RedisClusterProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Redis Cluster Configuration]
 // This cluster adds support for `Redis Cluster <https://redis.io/topics/cluster-spec>`_, as part
 // of :ref:`Envoy's support for Redis Cluster <arch_overview_redis>`.
diff --git a/api/envoy/config/common/dynamic_forward_proxy/v2alpha/dns_cache.proto b/api/envoy/config/common/dynamic_forward_proxy/v2alpha/dns_cache.proto
index e9720cda8d440..0e206cae8b504 100644
--- a/api/envoy/config/common/dynamic_forward_proxy/v2alpha/dns_cache.proto
+++ b/api/envoy/config/common/dynamic_forward_proxy/v2alpha/dns_cache.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.common.dynamic_forward_proxy.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.config.common.dynamic_forward_proxy.v2alpha";
-option java_outer_classname = "DnsCacheProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/cds.proto";
 
 import "google/protobuf/duration.proto";
@@ -13,6 +9,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.common.dynamic_forward_proxy.v2alpha";
+option java_outer_classname = "DnsCacheProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Dynamic forward proxy common configuration]
 
 // Configuration for the dynamic forward proxy DNS cache. See the :ref:`architecture overview
diff --git a/api/envoy/config/common/dynamic_forward_proxy/v3alpha/dns_cache.proto b/api/envoy/config/common/dynamic_forward_proxy/v3alpha/dns_cache.proto
index d59ad622d072b..2824559d47878 100644
--- a/api/envoy/config/common/dynamic_forward_proxy/v3alpha/dns_cache.proto
+++ b/api/envoy/config/common/dynamic_forward_proxy/v3alpha/dns_cache.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.common.dynamic_forward_proxy.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.common.dynamic_forward_proxy.v3alpha";
-option java_outer_classname = "DnsCacheProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/cds.proto";
 
 import "google/protobuf/duration.proto";
@@ -15,6 +11,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.common.dynamic_forward_proxy.v3alpha";
+option java_outer_classname = "DnsCacheProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Dynamic forward proxy common configuration]
 
 // Configuration for the dynamic forward proxy DNS cache. See the :ref:`architecture overview
diff --git a/api/envoy/config/common/tap/v2alpha/common.proto b/api/envoy/config/common/tap/v2alpha/common.proto
index 30de0067ee05c..594cb7641cd6a 100644
--- a/api/envoy/config/common/tap/v2alpha/common.proto
+++ b/api/envoy/config/common/tap/v2alpha/common.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.config.common.tap.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.config.common.tap.v2alpha";
-option java_outer_classname = "CommonProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/config_source.proto";
 import "envoy/service/tap/v2alpha/common.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.common.tap.v2alpha";
+option java_outer_classname = "CommonProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Common tap extension configuration]
 
 // Common configuration for all tap extensions.
diff --git a/api/envoy/config/common/tap/v3alpha/common.proto b/api/envoy/config/common/tap/v3alpha/common.proto
index 127bb3e442203..3a470f8d28c38 100644
--- a/api/envoy/config/common/tap/v3alpha/common.proto
+++ b/api/envoy/config/common/tap/v3alpha/common.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.common.tap.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.common.tap.v3alpha";
-option java_outer_classname = "CommonProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/config_source.proto";
 import "envoy/service/tap/v3alpha/common.proto";
 
@@ -13,6 +9,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.common.tap.v3alpha";
+option java_outer_classname = "CommonProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Common tap extension configuration]
 
 // Common configuration for all tap extensions.
diff --git a/api/envoy/config/filter/accesslog/v2/accesslog.proto b/api/envoy/config/filter/accesslog/v2/accesslog.proto
index 489bc82dc4692..e634f4c2a77a0 100644
--- a/api/envoy/config/filter/accesslog/v2/accesslog.proto
+++ b/api/envoy/config/filter/accesslog/v2/accesslog.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.accesslog.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.accesslog.v2";
-option java_outer_classname = "AccesslogProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/route/route.proto";
 import "envoy/type/percent.proto";
@@ -15,6 +11,10 @@ import "google/protobuf/struct.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.accesslog.v2";
+option java_outer_classname = "AccesslogProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Common access log types]
 
 message AccessLog {
diff --git a/api/envoy/config/filter/accesslog/v3alpha/accesslog.proto b/api/envoy/config/filter/accesslog/v3alpha/accesslog.proto
index 5a32bc1a022d2..8c9f8a558d037 100644
--- a/api/envoy/config/filter/accesslog/v3alpha/accesslog.proto
+++ b/api/envoy/config/filter/accesslog/v3alpha/accesslog.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.accesslog.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.accesslog.v3alpha";
-option java_outer_classname = "AccesslogProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/api/v3alpha/route/route.proto";
 import "envoy/type/v3alpha/percent.proto";
@@ -17,6 +13,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.accesslog.v3alpha";
+option java_outer_classname = "AccesslogProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Common access log types]
 
 message AccessLog {
diff --git a/api/envoy/config/filter/fault/v2/fault.proto b/api/envoy/config/filter/fault/v2/fault.proto
index 696253f874eb0..7dd1405a6e07f 100644
--- a/api/envoy/config/filter/fault/v2/fault.proto
+++ b/api/envoy/config/filter/fault/v2/fault.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.filter.fault.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.fault.v2";
-option java_outer_classname = "FaultProto";
-option java_multiple_files = true;
-
 import "envoy/type/percent.proto";
 
 import "google/protobuf/duration.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.fault.v2";
+option java_outer_classname = "FaultProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Common fault injection types]
 
 // Delay specification is used to inject latency into the
diff --git a/api/envoy/config/filter/fault/v3alpha/fault.proto b/api/envoy/config/filter/fault/v3alpha/fault.proto
index 8a225c47326cb..226fa00000eff 100644
--- a/api/envoy/config/filter/fault/v3alpha/fault.proto
+++ b/api/envoy/config/filter/fault/v3alpha/fault.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.fault.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.fault.v3alpha";
-option java_outer_classname = "FaultProto";
-option java_multiple_files = true;
-
 import "envoy/type/v3alpha/percent.proto";
 
 import "google/protobuf/duration.proto";
@@ -14,6 +10,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.fault.v3alpha";
+option java_outer_classname = "FaultProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Common fault injection types]
 
 // Delay specification is used to inject latency into the
diff --git a/api/envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.proto b/api/envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.proto
index 52a0951959955..dd5d7db69c568 100644
--- a/api/envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.proto
+++ b/api/envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.adaptive_concurrency.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.adaptive_concurrency.v2alpha";
-option java_outer_classname = "AdaptiveConcurrencyProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/type/percent.proto";
 
@@ -15,6 +11,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.adaptive_concurrency.v2alpha";
+option java_outer_classname = "AdaptiveConcurrencyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Adaptive Concurrency]
 // Adaptive Concurrency Control :ref:`configuration overview
 // <config_http_filters_adaptive_concurrency>`.
diff --git a/api/envoy/config/filter/http/adaptive_concurrency/v3alpha/adaptive_concurrency.proto b/api/envoy/config/filter/http/adaptive_concurrency/v3alpha/adaptive_concurrency.proto
index a0745ce774796..b31ef0d1beb7b 100644
--- a/api/envoy/config/filter/http/adaptive_concurrency/v3alpha/adaptive_concurrency.proto
+++ b/api/envoy/config/filter/http/adaptive_concurrency/v3alpha/adaptive_concurrency.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.adaptive_concurrency.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.adaptive_concurrency.v3alpha";
-option java_outer_classname = "AdaptiveConcurrencyProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/type/v3alpha/percent.proto";
 
@@ -17,6 +13,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.adaptive_concurrency.v3alpha";
+option java_outer_classname = "AdaptiveConcurrencyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Adaptive Concurrency]
 // Adaptive Concurrency Control :ref:`configuration overview
 // <config_http_filters_adaptive_concurrency>`.
diff --git a/api/envoy/config/filter/http/buffer/v2/buffer.proto b/api/envoy/config/filter/http/buffer/v2/buffer.proto
index 234e1652997f2..fc9dd7e296722 100644
--- a/api/envoy/config/filter/http/buffer/v2/buffer.proto
+++ b/api/envoy/config/filter/http/buffer/v2/buffer.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.config.filter.http.buffer.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.buffer.v2";
-option java_outer_classname = "BufferProto";
-option java_multiple_files = true;
-
 import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.buffer.v2";
+option java_outer_classname = "BufferProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Buffer]
 // Buffer :ref:`configuration overview <config_http_filters_buffer>`.
 // [#extension: envoy.filters.http.buffer]
diff --git a/api/envoy/config/filter/http/csrf/v2/csrf.proto b/api/envoy/config/filter/http/csrf/v2/csrf.proto
index 2ef87b1f9d4d7..a9435cf865e85 100644
--- a/api/envoy/config/filter/http/csrf/v2/csrf.proto
+++ b/api/envoy/config/filter/http/csrf/v2/csrf.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.config.filter.http.csrf.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.csrf.v2";
-option java_outer_classname = "CsrfProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/type/matcher/string.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.csrf.v2";
+option java_outer_classname = "CsrfProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: CSRF]
 // Cross-Site Request Forgery :ref:`configuration overview <config_http_filters_csrf>`.
 // [#extension: envoy.filters.http.csrf]
diff --git a/api/envoy/config/filter/http/csrf/v3alpha/csrf.proto b/api/envoy/config/filter/http/csrf/v3alpha/csrf.proto
index 23ec7be0a3029..8dd4feb0010a0 100644
--- a/api/envoy/config/filter/http/csrf/v3alpha/csrf.proto
+++ b/api/envoy/config/filter/http/csrf/v3alpha/csrf.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.csrf.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.csrf.v3alpha";
-option java_outer_classname = "CsrfProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/type/matcher/v3alpha/string.proto";
 
@@ -13,6 +9,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.csrf.v3alpha";
+option java_outer_classname = "CsrfProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: CSRF]
 // Cross-Site Request Forgery :ref:`configuration overview <config_http_filters_csrf>`.
 // [#extension: envoy.filters.http.csrf]
diff --git a/api/envoy/config/filter/http/dynamic_forward_proxy/v2alpha/dynamic_forward_proxy.proto b/api/envoy/config/filter/http/dynamic_forward_proxy/v2alpha/dynamic_forward_proxy.proto
index b515ffdac41ec..3c4b8063b245f 100644
--- a/api/envoy/config/filter/http/dynamic_forward_proxy/v2alpha/dynamic_forward_proxy.proto
+++ b/api/envoy/config/filter/http/dynamic_forward_proxy/v2alpha/dynamic_forward_proxy.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.config.filter.http.dynamic_forward_proxy.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.dynamic_forward_proxy.v2alpha";
-option java_outer_classname = "DynamicForwardProxyProto";
-option java_multiple_files = true;
-
 import "envoy/config/common/dynamic_forward_proxy/v2alpha/dns_cache.proto";
 
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.dynamic_forward_proxy.v2alpha";
+option java_outer_classname = "DynamicForwardProxyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Dynamic forward proxy]
 
 // Configuration for the dynamic forward proxy HTTP filter. See the :ref:`architecture overview
diff --git a/api/envoy/config/filter/http/dynamic_forward_proxy/v3alpha/dynamic_forward_proxy.proto b/api/envoy/config/filter/http/dynamic_forward_proxy/v3alpha/dynamic_forward_proxy.proto
index 4df0b26d204ce..c278ed5a919c8 100644
--- a/api/envoy/config/filter/http/dynamic_forward_proxy/v3alpha/dynamic_forward_proxy.proto
+++ b/api/envoy/config/filter/http/dynamic_forward_proxy/v3alpha/dynamic_forward_proxy.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.filter.http.dynamic_forward_proxy.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.dynamic_forward_proxy.v3alpha";
-option java_outer_classname = "DynamicForwardProxyProto";
-option java_multiple_files = true;
-
 import "envoy/config/common/dynamic_forward_proxy/v3alpha/dns_cache.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.dynamic_forward_proxy.v3alpha";
+option java_outer_classname = "DynamicForwardProxyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Dynamic forward proxy]
 
 // Configuration for the dynamic forward proxy HTTP filter. See the :ref:`architecture overview
diff --git a/api/envoy/config/filter/http/ext_authz/v2/ext_authz.proto b/api/envoy/config/filter/http/ext_authz/v2/ext_authz.proto
index 5b15297955595..3ce8b6261977f 100644
--- a/api/envoy/config/filter/http/ext_authz/v2/ext_authz.proto
+++ b/api/envoy/config/filter/http/ext_authz/v2/ext_authz.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.ext_authz.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.ext_authz.v2";
-option java_outer_classname = "ExtAuthzProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/core/grpc_service.proto";
 import "envoy/api/v2/core/http_uri.proto";
@@ -14,6 +10,10 @@ import "envoy/type/matcher/string.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.ext_authz.v2";
+option java_outer_classname = "ExtAuthzProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: External Authorization]
 // External Authorization :ref:`configuration overview <config_http_filters_ext_authz>`.
 // [#extension: envoy.filters.http.ext_authz]
diff --git a/api/envoy/config/filter/http/ext_authz/v3alpha/ext_authz.proto b/api/envoy/config/filter/http/ext_authz/v3alpha/ext_authz.proto
index 01825760a5f79..b0fa54592f229 100644
--- a/api/envoy/config/filter/http/ext_authz/v3alpha/ext_authz.proto
+++ b/api/envoy/config/filter/http/ext_authz/v3alpha/ext_authz.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.ext_authz.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.ext_authz.v3alpha";
-option java_outer_classname = "ExtAuthzProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/api/v3alpha/core/grpc_service.proto";
 import "envoy/api/v3alpha/core/http_uri.proto";
@@ -16,6 +12,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.ext_authz.v3alpha";
+option java_outer_classname = "ExtAuthzProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: External Authorization]
 // External Authorization :ref:`configuration overview <config_http_filters_ext_authz>`.
 // [#extension: envoy.filters.http.ext_authz]
diff --git a/api/envoy/config/filter/http/fault/v2/fault.proto b/api/envoy/config/filter/http/fault/v2/fault.proto
index 972dc704429e8..8bdd59f161758 100644
--- a/api/envoy/config/filter/http/fault/v2/fault.proto
+++ b/api/envoy/config/filter/http/fault/v2/fault.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.fault.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.fault.v2";
-option java_outer_classname = "FaultProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/route/route.proto";
 import "envoy/config/filter/fault/v2/fault.proto";
 import "envoy/type/percent.proto";
@@ -14,6 +10,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.fault.v2";
+option java_outer_classname = "FaultProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Fault Injection]
 // Fault Injection :ref:`configuration overview <config_http_filters_fault_injection>`.
 // [#extension: envoy.filters.http.fault]
diff --git a/api/envoy/config/filter/http/fault/v3alpha/fault.proto b/api/envoy/config/filter/http/fault/v3alpha/fault.proto
index d5045f74dbd7c..07b7e01e2c2d9 100644
--- a/api/envoy/config/filter/http/fault/v3alpha/fault.proto
+++ b/api/envoy/config/filter/http/fault/v3alpha/fault.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.fault.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.fault.v3alpha";
-option java_outer_classname = "FaultProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/route/route.proto";
 import "envoy/config/filter/fault/v3alpha/fault.proto";
 import "envoy/type/v3alpha/percent.proto";
@@ -16,6 +12,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.fault.v3alpha";
+option java_outer_classname = "FaultProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Fault Injection]
 // Fault Injection :ref:`configuration overview <config_http_filters_fault_injection>`.
 // [#extension: envoy.filters.http.fault]
diff --git a/api/envoy/config/filter/http/grpc_http1_reverse_bridge/v2alpha1/config.proto b/api/envoy/config/filter/http/grpc_http1_reverse_bridge/v2alpha1/config.proto
index 9aa6d4dfe57a1..15da29c9358a7 100644
--- a/api/envoy/config/filter/http/grpc_http1_reverse_bridge/v2alpha1/config.proto
+++ b/api/envoy/config/filter/http/grpc_http1_reverse_bridge/v2alpha1/config.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.config.filter.http.grpc_http1_reverse_bridge.v2alpha1;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.config.filter.http.grpc_http1_reverse_bridge.v2alpha1";
 option java_outer_classname = "ConfigProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: gRPC HTTP/1.1 Reverse Bridge]
 // gRPC HTTP/1.1 Reverse Bridge :ref:`configuration overview
 // <config_http_filters_grpc_http1_reverse_bridge>`.
diff --git a/api/envoy/config/filter/http/grpc_stats/v2alpha/config.proto b/api/envoy/config/filter/http/grpc_stats/v2alpha/config.proto
index 680bfa3dc8e7c..213d71cf4b7c1 100644
--- a/api/envoy/config/filter/http/grpc_stats/v2alpha/config.proto
+++ b/api/envoy/config/filter/http/grpc_stats/v2alpha/config.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.config.filter.http.grpc_stats.v2alpha;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.config.filter.http.grpc_stats.v2alpha";
 option java_outer_classname = "ConfigProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: gRPC statistics] gRPC statistics filter
 // :ref:`configuration overview <config_http_filters_grpc_stats>`.
 // [#extension: envoy.filters.http.grpc_stats]
diff --git a/api/envoy/config/filter/http/gzip/v2/gzip.proto b/api/envoy/config/filter/http/gzip/v2/gzip.proto
index 16ba4aa6a5906..aeac0f77cdd08 100644
--- a/api/envoy/config/filter/http/gzip/v2/gzip.proto
+++ b/api/envoy/config/filter/http/gzip/v2/gzip.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.config.filter.http.gzip.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.gzip.v2";
-option java_outer_classname = "GzipProto";
-option java_multiple_files = true;
-
 import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.gzip.v2";
+option java_outer_classname = "GzipProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Gzip]
 // Gzip :ref:`configuration overview <config_http_filters_gzip>`.
 // [#extension: envoy.filters.http.gzip]
diff --git a/api/envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.proto b/api/envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.proto
index 4571b880c478c..d608f8398a951 100644
--- a/api/envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.proto
+++ b/api/envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.config.filter.http.header_to_metadata.v2;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.config.filter.http.header_to_metadata.v2";
 option java_outer_classname = "HeaderToMetadataProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: Header-To-Metadata Filter]
 //
 // The configuration for transforming headers into metadata. This is useful
diff --git a/api/envoy/config/filter/http/health_check/v2/health_check.proto b/api/envoy/config/filter/http/health_check/v2/health_check.proto
index 18f1e79baca53..8026724b821b6 100644
--- a/api/envoy/config/filter/http/health_check/v2/health_check.proto
+++ b/api/envoy/config/filter/http/health_check/v2/health_check.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.health_check.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.health_check.v2";
-option java_outer_classname = "HealthCheckProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/route/route.proto";
 import "envoy/type/percent.proto";
 
@@ -14,6 +10,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.health_check.v2";
+option java_outer_classname = "HealthCheckProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Health check]
 // Health check :ref:`configuration overview <config_http_filters_health_check>`.
 // [#extension: envoy.filters.http.health_check]
diff --git a/api/envoy/config/filter/http/health_check/v3alpha/health_check.proto b/api/envoy/config/filter/http/health_check/v3alpha/health_check.proto
index 78b11e730bab7..27d1e6a0883d2 100644
--- a/api/envoy/config/filter/http/health_check/v3alpha/health_check.proto
+++ b/api/envoy/config/filter/http/health_check/v3alpha/health_check.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.health_check.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.health_check.v3alpha";
-option java_outer_classname = "HealthCheckProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/route/route.proto";
 import "envoy/type/v3alpha/percent.proto";
 
@@ -16,6 +12,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.health_check.v3alpha";
+option java_outer_classname = "HealthCheckProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Health check]
 // Health check :ref:`configuration overview <config_http_filters_health_check>`.
 // [#extension: envoy.filters.http.health_check]
diff --git a/api/envoy/config/filter/http/ip_tagging/v2/ip_tagging.proto b/api/envoy/config/filter/http/ip_tagging/v2/ip_tagging.proto
index 40dc19260bc6b..a713771e8caf7 100644
--- a/api/envoy/config/filter/http/ip_tagging/v2/ip_tagging.proto
+++ b/api/envoy/config/filter/http/ip_tagging/v2/ip_tagging.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.config.filter.http.ip_tagging.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.ip_tagging.v2";
-option java_outer_classname = "IpTaggingProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/address.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.ip_tagging.v2";
+option java_outer_classname = "IpTaggingProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: IP tagging]
 // IP tagging :ref:`configuration overview <config_http_filters_ip_tagging>`.
 // [#extension: envoy.filters.http.ip_tagging]
diff --git a/api/envoy/config/filter/http/ip_tagging/v3alpha/ip_tagging.proto b/api/envoy/config/filter/http/ip_tagging/v3alpha/ip_tagging.proto
index fc6922d05a449..d1eda9f85a99c 100644
--- a/api/envoy/config/filter/http/ip_tagging/v3alpha/ip_tagging.proto
+++ b/api/envoy/config/filter/http/ip_tagging/v3alpha/ip_tagging.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.filter.http.ip_tagging.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.ip_tagging.v3alpha";
-option java_outer_classname = "IpTaggingProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/address.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.ip_tagging.v3alpha";
+option java_outer_classname = "IpTaggingProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: IP tagging]
 // IP tagging :ref:`configuration overview <config_http_filters_ip_tagging>`.
 // [#extension: envoy.filters.http.ip_tagging]
diff --git a/api/envoy/config/filter/http/jwt_authn/v2alpha/config.proto b/api/envoy/config/filter/http/jwt_authn/v2alpha/config.proto
index 5f3c187948fe9..cb030e646c7aa 100644
--- a/api/envoy/config/filter/http/jwt_authn/v2alpha/config.proto
+++ b/api/envoy/config/filter/http/jwt_authn/v2alpha/config.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.jwt_authn.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.jwt_authn.v2alpha";
-option java_outer_classname = "ConfigProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/core/http_uri.proto";
 import "envoy/api/v2/route/route.proto";
@@ -15,6 +11,10 @@ import "google/protobuf/empty.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.jwt_authn.v2alpha";
+option java_outer_classname = "ConfigProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: JWT Authentication]
 // JWT Authentication :ref:`configuration overview <config_http_filters_jwt_authn>`.
 // [#extension: envoy.filters.http.jwt_authn]
diff --git a/api/envoy/config/filter/http/jwt_authn/v3alpha/config.proto b/api/envoy/config/filter/http/jwt_authn/v3alpha/config.proto
index a0c315e3634fc..5233bb381c146 100644
--- a/api/envoy/config/filter/http/jwt_authn/v3alpha/config.proto
+++ b/api/envoy/config/filter/http/jwt_authn/v3alpha/config.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.jwt_authn.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.jwt_authn.v3alpha";
-option java_outer_classname = "ConfigProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/api/v3alpha/core/http_uri.proto";
 import "envoy/api/v3alpha/route/route.proto";
@@ -17,6 +13,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.jwt_authn.v3alpha";
+option java_outer_classname = "ConfigProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: JWT Authentication]
 // JWT Authentication :ref:`configuration overview <config_http_filters_jwt_authn>`.
 // [#extension: envoy.filters.http.jwt_authn]
diff --git a/api/envoy/config/filter/http/lua/v2/lua.proto b/api/envoy/config/filter/http/lua/v2/lua.proto
index b1f427cdf3c41..389678a41554f 100644
--- a/api/envoy/config/filter/http/lua/v2/lua.proto
+++ b/api/envoy/config/filter/http/lua/v2/lua.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.config.filter.http.lua.v2;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.config.filter.http.lua.v2";
 option java_outer_classname = "LuaProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: Lua]
 // Lua :ref:`configuration overview <config_http_filters_lua>`.
 // [#extension: envoy.filters.http.lua]
diff --git a/api/envoy/config/filter/http/original_src/v2alpha1/original_src.proto b/api/envoy/config/filter/http/original_src/v2alpha1/original_src.proto
index 2244cfc847dc3..50f6494058308 100644
--- a/api/envoy/config/filter/http/original_src/v2alpha1/original_src.proto
+++ b/api/envoy/config/filter/http/original_src/v2alpha1/original_src.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.config.filter.http.original_src.v2alpha1;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.config.filter.http.original_src.v2alpha1";
 option java_outer_classname = "OriginalSrcProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: Original Src Filter]
 // Use the Original source address on upstream connections.
 
diff --git a/api/envoy/config/filter/http/rate_limit/v2/rate_limit.proto b/api/envoy/config/filter/http/rate_limit/v2/rate_limit.proto
index 0ccce68ce6d0f..90fcb0dd816af 100644
--- a/api/envoy/config/filter/http/rate_limit/v2/rate_limit.proto
+++ b/api/envoy/config/filter/http/rate_limit/v2/rate_limit.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.filter.http.rate_limit.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.rate_limit.v2";
-option java_outer_classname = "RateLimitProto";
-option java_multiple_files = true;
-
 import "envoy/config/ratelimit/v2/rls.proto";
 
 import "google/protobuf/duration.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.rate_limit.v2";
+option java_outer_classname = "RateLimitProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Rate limit]
 // Rate limit :ref:`configuration overview <config_http_filters_rate_limit>`.
 // [#extension: envoy.filters.http.ratelimit]
diff --git a/api/envoy/config/filter/http/rate_limit/v3alpha/rate_limit.proto b/api/envoy/config/filter/http/rate_limit/v3alpha/rate_limit.proto
index 3a41cb2786aa3..ee4064e42d1a0 100644
--- a/api/envoy/config/filter/http/rate_limit/v3alpha/rate_limit.proto
+++ b/api/envoy/config/filter/http/rate_limit/v3alpha/rate_limit.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.rate_limit.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.rate_limit.v3alpha";
-option java_outer_classname = "RateLimitProto";
-option java_multiple_files = true;
-
 import "envoy/config/ratelimit/v3alpha/rls.proto";
 
 import "google/protobuf/duration.proto";
@@ -14,6 +10,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.rate_limit.v3alpha";
+option java_outer_classname = "RateLimitProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Rate limit]
 // Rate limit :ref:`configuration overview <config_http_filters_rate_limit>`.
 // [#extension: envoy.filters.http.ratelimit]
diff --git a/api/envoy/config/filter/http/rbac/v2/rbac.proto b/api/envoy/config/filter/http/rbac/v2/rbac.proto
index baebccaf4a6bb..7930b686663b7 100644
--- a/api/envoy/config/filter/http/rbac/v2/rbac.proto
+++ b/api/envoy/config/filter/http/rbac/v2/rbac.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.config.filter.http.rbac.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.rbac.v2";
-option java_outer_classname = "RbacProto";
-option java_multiple_files = true;
-
 import "envoy/config/rbac/v2/rbac.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.rbac.v2";
+option java_outer_classname = "RbacProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: RBAC]
 // Role-Based Access Control :ref:`configuration overview <config_http_filters_rbac>`.
 // [#extension: envoy.filters.http.rbac]
diff --git a/api/envoy/config/filter/http/rbac/v3alpha/rbac.proto b/api/envoy/config/filter/http/rbac/v3alpha/rbac.proto
index b5c23c7d4f324..33581330c7483 100644
--- a/api/envoy/config/filter/http/rbac/v3alpha/rbac.proto
+++ b/api/envoy/config/filter/http/rbac/v3alpha/rbac.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.filter.http.rbac.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.rbac.v3alpha";
-option java_outer_classname = "RbacProto";
-option java_multiple_files = true;
-
 import "envoy/config/rbac/v3alpha/rbac.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.rbac.v3alpha";
+option java_outer_classname = "RbacProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: RBAC]
 // Role-Based Access Control :ref:`configuration overview <config_http_filters_rbac>`.
 // [#extension: envoy.filters.http.rbac]
diff --git a/api/envoy/config/filter/http/router/v2/router.proto b/api/envoy/config/filter/http/router/v2/router.proto
index db02de41a253a..af584af5b4ff0 100644
--- a/api/envoy/config/filter/http/router/v2/router.proto
+++ b/api/envoy/config/filter/http/router/v2/router.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.filter.http.router.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.router.v2";
-option java_outer_classname = "RouterProto";
-option java_multiple_files = true;
-
 import "envoy/config/filter/accesslog/v2/accesslog.proto";
 
 import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.router.v2";
+option java_outer_classname = "RouterProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Router]
 // Router :ref:`configuration overview <config_http_filters_router>`.
 // [#extension: envoy.filters.http.router]
diff --git a/api/envoy/config/filter/http/router/v3alpha/router.proto b/api/envoy/config/filter/http/router/v3alpha/router.proto
index 6ea99f4256d55..7164ec97014cf 100644
--- a/api/envoy/config/filter/http/router/v3alpha/router.proto
+++ b/api/envoy/config/filter/http/router/v3alpha/router.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.http.router.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.router.v3alpha";
-option java_outer_classname = "RouterProto";
-option java_multiple_files = true;
-
 import "envoy/config/filter/accesslog/v3alpha/accesslog.proto";
 
 import "google/protobuf/wrappers.proto";
@@ -14,6 +10,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.router.v3alpha";
+option java_outer_classname = "RouterProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Router]
 // Router :ref:`configuration overview <config_http_filters_router>`.
 // [#extension: envoy.filters.http.router]
diff --git a/api/envoy/config/filter/http/squash/v2/squash.proto b/api/envoy/config/filter/http/squash/v2/squash.proto
index a864f4533346d..a0fe4ab894841 100644
--- a/api/envoy/config/filter/http/squash/v2/squash.proto
+++ b/api/envoy/config/filter/http/squash/v2/squash.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.config.filter.http.squash.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.squash.v2";
-option java_outer_classname = "SquashProto";
-option java_multiple_files = true;
-
 import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.squash.v2";
+option java_outer_classname = "SquashProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Squash]
 // Squash :ref:`configuration overview <config_http_filters_squash>`.
 // [#extension: envoy.filters.http.squash]
diff --git a/api/envoy/config/filter/http/tap/v2alpha/tap.proto b/api/envoy/config/filter/http/tap/v2alpha/tap.proto
index 247e898af8bbc..bf784c76c8a3d 100644
--- a/api/envoy/config/filter/http/tap/v2alpha/tap.proto
+++ b/api/envoy/config/filter/http/tap/v2alpha/tap.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.config.filter.http.tap.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.tap.v2alpha";
-option java_outer_classname = "TapProto";
-option java_multiple_files = true;
-
 import "envoy/config/common/tap/v2alpha/common.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.tap.v2alpha";
+option java_outer_classname = "TapProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Tap]
 // Tap :ref:`configuration overview <config_http_filters_tap>`.
 // [#extension: envoy.filters.http.tap]
diff --git a/api/envoy/config/filter/http/tap/v3alpha/tap.proto b/api/envoy/config/filter/http/tap/v3alpha/tap.proto
index f2a1f2560fad7..68ea090e576be 100644
--- a/api/envoy/config/filter/http/tap/v3alpha/tap.proto
+++ b/api/envoy/config/filter/http/tap/v3alpha/tap.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.filter.http.tap.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.http.tap.v3alpha";
-option java_outer_classname = "TapProto";
-option java_multiple_files = true;
-
 import "envoy/config/common/tap/v3alpha/common.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.http.tap.v3alpha";
+option java_outer_classname = "TapProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Tap]
 // Tap :ref:`configuration overview <config_http_filters_tap>`.
 // [#extension: envoy.filters.http.tap]
diff --git a/api/envoy/config/filter/http/transcoder/v2/transcoder.proto b/api/envoy/config/filter/http/transcoder/v2/transcoder.proto
index c88b18541b502..de22db17b52ff 100644
--- a/api/envoy/config/filter/http/transcoder/v2/transcoder.proto
+++ b/api/envoy/config/filter/http/transcoder/v2/transcoder.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.config.filter.http.transcoder.v2;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.config.filter.http.transcoder.v2";
 option java_outer_classname = "TranscoderProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: gRPC-JSON transcoder]
 // gRPC-JSON transcoder :ref:`configuration overview <config_http_filters_grpc_json_transcoder>`.
 // [#extension: envoy.filters.http.grpc_json_transcoder]
diff --git a/api/envoy/config/filter/listener/original_src/v2alpha1/original_src.proto b/api/envoy/config/filter/listener/original_src/v2alpha1/original_src.proto
index 6259f376f5edd..5f837087518f2 100644
--- a/api/envoy/config/filter/listener/original_src/v2alpha1/original_src.proto
+++ b/api/envoy/config/filter/listener/original_src/v2alpha1/original_src.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.config.filter.listener.original_src.v2alpha1;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.config.filter.listener.original_src.v2alpha1";
 option java_outer_classname = "OriginalSrcProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: Original Src Filter]
 // Use the Original source address on upstream connections.
 // [#extension: envoy.filters.listener.original_src]
diff --git a/api/envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.proto b/api/envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.proto
index cec44c94f986f..ff979953d333a 100644
--- a/api/envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.proto
+++ b/api/envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.filter.network.client_ssl_auth.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.client_ssl_auth.v2";
-option java_outer_classname = "ClientSslAuthProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/address.proto";
 
 import "google/protobuf/duration.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.client_ssl_auth.v2";
+option java_outer_classname = "ClientSslAuthProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Client TLS authentication]
 // Client TLS authentication
 // :ref:`configuration overview <config_network_filters_client_ssl_auth>`.
diff --git a/api/envoy/config/filter/network/client_ssl_auth/v3alpha/client_ssl_auth.proto b/api/envoy/config/filter/network/client_ssl_auth/v3alpha/client_ssl_auth.proto
index 2a6b6f10e6647..807cf060b50c2 100644
--- a/api/envoy/config/filter/network/client_ssl_auth/v3alpha/client_ssl_auth.proto
+++ b/api/envoy/config/filter/network/client_ssl_auth/v3alpha/client_ssl_auth.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.client_ssl_auth.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.client_ssl_auth.v3alpha";
-option java_outer_classname = "ClientSslAuthProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/address.proto";
 
 import "google/protobuf/duration.proto";
@@ -14,6 +10,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.client_ssl_auth.v3alpha";
+option java_outer_classname = "ClientSslAuthProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Client TLS authentication]
 // Client TLS authentication
 // :ref:`configuration overview <config_network_filters_client_ssl_auth>`.
diff --git a/api/envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.proto b/api/envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.proto
index 16308e28e31ca..2ecd9a29419e0 100644
--- a/api/envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.proto
+++ b/api/envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.filter.network.dubbo_proxy.v2alpha1;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.dubbo_proxy.v2alpha1";
-option java_outer_classname = "DubboProxyProto";
-option java_multiple_files = true;
-
 import "envoy/config/filter/network/dubbo_proxy/v2alpha1/route.proto";
 
 import "google/protobuf/any.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.dubbo_proxy.v2alpha1";
+option java_outer_classname = "DubboProxyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Dubbo Proxy]
 // Dubbo Proxy :ref:`configuration overview <config_network_filters_dubbo_proxy>`.
 // [#extension: envoy.filters.network.dubbo_proxy]
diff --git a/api/envoy/config/filter/network/dubbo_proxy/v2alpha1/route.proto b/api/envoy/config/filter/network/dubbo_proxy/v2alpha1/route.proto
index b38089d985d60..c6b03a8bbf9b5 100644
--- a/api/envoy/config/filter/network/dubbo_proxy/v2alpha1/route.proto
+++ b/api/envoy/config/filter/network/dubbo_proxy/v2alpha1/route.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.filter.network.dubbo_proxy.v2alpha1;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.dubbo_proxy.v2alpha1";
-option java_outer_classname = "RouteProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/route/route.proto";
 import "envoy/type/matcher/string.proto";
 import "envoy/type/range.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.dubbo_proxy.v2alpha1";
+option java_outer_classname = "RouteProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Dubbo Proxy Route Configuration]
 // Dubbo Proxy :ref:`configuration overview <config_network_filters_dubbo_proxy>`.
 
diff --git a/api/envoy/config/filter/network/dubbo_proxy/v3alpha/dubbo_proxy.proto b/api/envoy/config/filter/network/dubbo_proxy/v3alpha/dubbo_proxy.proto
index ad1a3d5ad536e..83977f95e8e25 100644
--- a/api/envoy/config/filter/network/dubbo_proxy/v3alpha/dubbo_proxy.proto
+++ b/api/envoy/config/filter/network/dubbo_proxy/v3alpha/dubbo_proxy.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.dubbo_proxy.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.dubbo_proxy.v3alpha";
-option java_outer_classname = "DubboProxyProto";
-option java_multiple_files = true;
-
 import "envoy/config/filter/network/dubbo_proxy/v3alpha/route.proto";
 
 import "google/protobuf/any.proto";
@@ -14,6 +10,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.dubbo_proxy.v3alpha";
+option java_outer_classname = "DubboProxyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Dubbo Proxy]
 // Dubbo Proxy :ref:`configuration overview <config_network_filters_dubbo_proxy>`.
 // [#extension: envoy.filters.network.dubbo_proxy]
diff --git a/api/envoy/config/filter/network/dubbo_proxy/v3alpha/route.proto b/api/envoy/config/filter/network/dubbo_proxy/v3alpha/route.proto
index eef19b6adce5e..ab213644e8ccc 100644
--- a/api/envoy/config/filter/network/dubbo_proxy/v3alpha/route.proto
+++ b/api/envoy/config/filter/network/dubbo_proxy/v3alpha/route.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.dubbo_proxy.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.dubbo_proxy.v3alpha";
-option java_outer_classname = "RouteProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/route/route.proto";
 import "envoy/type/matcher/v3alpha/string.proto";
 import "envoy/type/v3alpha/range.proto";
@@ -14,6 +10,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.dubbo_proxy.v3alpha";
+option java_outer_classname = "RouteProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Dubbo Proxy Route Configuration]
 // Dubbo Proxy :ref:`configuration overview <config_network_filters_dubbo_proxy>`.
 
diff --git a/api/envoy/config/filter/network/ext_authz/v2/ext_authz.proto b/api/envoy/config/filter/network/ext_authz/v2/ext_authz.proto
index 3690bdc89697d..b5003ebfe5ed3 100644
--- a/api/envoy/config/filter/network/ext_authz/v2/ext_authz.proto
+++ b/api/envoy/config/filter/network/ext_authz/v2/ext_authz.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.config.filter.network.ext_authz.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.ext_authz.v2";
-option java_outer_classname = "ExtAuthzProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/grpc_service.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.ext_authz.v2";
+option java_outer_classname = "ExtAuthzProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Network External Authorization ]
 // The network layer external authorization service configuration
 // :ref:`configuration overview <config_network_filters_ext_authz>`.
diff --git a/api/envoy/config/filter/network/ext_authz/v3alpha/ext_authz.proto b/api/envoy/config/filter/network/ext_authz/v3alpha/ext_authz.proto
index 215b9a598903f..8b397d0951f79 100644
--- a/api/envoy/config/filter/network/ext_authz/v3alpha/ext_authz.proto
+++ b/api/envoy/config/filter/network/ext_authz/v3alpha/ext_authz.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.filter.network.ext_authz.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.ext_authz.v3alpha";
-option java_outer_classname = "ExtAuthzProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/grpc_service.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.ext_authz.v3alpha";
+option java_outer_classname = "ExtAuthzProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Network External Authorization ]
 // The network layer external authorization service configuration
 // :ref:`configuration overview <config_network_filters_ext_authz>`.
diff --git a/api/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto b/api/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto
index f818506993fc1..4a3b7b4df5ae5 100644
--- a/api/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto
+++ b/api/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.http_connection_manager.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.http_connection_manager.v2";
-option java_outer_classname = "HttpConnectionManagerProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/config_source.proto";
 import "envoy/api/v2/core/protocol.proto";
 import "envoy/api/v2/rds.proto";
@@ -21,6 +17,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.http_connection_manager.v2";
+option java_outer_classname = "HttpConnectionManagerProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: HTTP connection manager]
 // HTTP connection manager :ref:`configuration overview <config_http_conn_man>`.
 // [#extension: envoy.filters.network.http_connection_manager]
diff --git a/api/envoy/config/filter/network/http_connection_manager/v3alpha/http_connection_manager.proto b/api/envoy/config/filter/network/http_connection_manager/v3alpha/http_connection_manager.proto
index f8880d1de10d6..40a0343b0c480 100644
--- a/api/envoy/config/filter/network/http_connection_manager/v3alpha/http_connection_manager.proto
+++ b/api/envoy/config/filter/network/http_connection_manager/v3alpha/http_connection_manager.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.http_connection_manager.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.http_connection_manager.v3alpha";
-option java_outer_classname = "HttpConnectionManagerProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/config_source.proto";
 import "envoy/api/v3alpha/core/protocol.proto";
 import "envoy/api/v3alpha/rds.proto";
@@ -23,6 +19,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.http_connection_manager.v3alpha";
+option java_outer_classname = "HttpConnectionManagerProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: HTTP connection manager]
 // HTTP connection manager :ref:`configuration overview <config_http_conn_man>`.
 // [#extension: envoy.filters.network.http_connection_manager]
diff --git a/api/envoy/config/filter/network/mongo_proxy/v2/mongo_proxy.proto b/api/envoy/config/filter/network/mongo_proxy/v2/mongo_proxy.proto
index 2a1fa76ef729a..6e8891c4f502a 100644
--- a/api/envoy/config/filter/network/mongo_proxy/v2/mongo_proxy.proto
+++ b/api/envoy/config/filter/network/mongo_proxy/v2/mongo_proxy.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.config.filter.network.mongo_proxy.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.mongo_proxy.v2";
-option java_outer_classname = "MongoProxyProto";
-option java_multiple_files = true;
-
 import "envoy/config/filter/fault/v2/fault.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.mongo_proxy.v2";
+option java_outer_classname = "MongoProxyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Mongo proxy]
 // MongoDB :ref:`configuration overview <config_network_filters_mongo_proxy>`.
 // [#extension: envoy.filters.network.mongo_proxy]
diff --git a/api/envoy/config/filter/network/mongo_proxy/v3alpha/mongo_proxy.proto b/api/envoy/config/filter/network/mongo_proxy/v3alpha/mongo_proxy.proto
index 35be47ad393b4..10b22a9597f5c 100644
--- a/api/envoy/config/filter/network/mongo_proxy/v3alpha/mongo_proxy.proto
+++ b/api/envoy/config/filter/network/mongo_proxy/v3alpha/mongo_proxy.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.filter.network.mongo_proxy.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.mongo_proxy.v3alpha";
-option java_outer_classname = "MongoProxyProto";
-option java_multiple_files = true;
-
 import "envoy/config/filter/fault/v3alpha/fault.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.mongo_proxy.v3alpha";
+option java_outer_classname = "MongoProxyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Mongo proxy]
 // MongoDB :ref:`configuration overview <config_network_filters_mongo_proxy>`.
 // [#extension: envoy.filters.network.mongo_proxy]
diff --git a/api/envoy/config/filter/network/mysql_proxy/v1alpha1/mysql_proxy.proto b/api/envoy/config/filter/network/mysql_proxy/v1alpha1/mysql_proxy.proto
index cf4e28422ce77..e9276f427fbdc 100644
--- a/api/envoy/config/filter/network/mysql_proxy/v1alpha1/mysql_proxy.proto
+++ b/api/envoy/config/filter/network/mysql_proxy/v1alpha1/mysql_proxy.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.config.filter.network.mysql_proxy.v1alpha1;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.config.filter.network.mysql_proxy.v1alpha1";
 option java_outer_classname = "MysqlProxyProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: MySQL proxy]
 // MySQL Proxy :ref:`configuration overview <config_network_filters_mysql_proxy>`.
 // [#extension: envoy.filters.network.mysql_proxy]
diff --git a/api/envoy/config/filter/network/rate_limit/v2/rate_limit.proto b/api/envoy/config/filter/network/rate_limit/v2/rate_limit.proto
index d9f4d11c7e210..fc2b95242353c 100644
--- a/api/envoy/config/filter/network/rate_limit/v2/rate_limit.proto
+++ b/api/envoy/config/filter/network/rate_limit/v2/rate_limit.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.rate_limit.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.rate_limit.v2";
-option java_outer_classname = "RateLimitProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/ratelimit/ratelimit.proto";
 import "envoy/config/ratelimit/v2/rls.proto";
 
@@ -13,6 +9,10 @@ import "google/protobuf/duration.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.rate_limit.v2";
+option java_outer_classname = "RateLimitProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Rate limit]
 // Rate limit :ref:`configuration overview <config_network_filters_rate_limit>`.
 // [#extension: envoy.filters.network.ratelimit]
diff --git a/api/envoy/config/filter/network/rate_limit/v3alpha/rate_limit.proto b/api/envoy/config/filter/network/rate_limit/v3alpha/rate_limit.proto
index 50c36c1fdf2be..48c438554df5e 100644
--- a/api/envoy/config/filter/network/rate_limit/v3alpha/rate_limit.proto
+++ b/api/envoy/config/filter/network/rate_limit/v3alpha/rate_limit.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.rate_limit.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.rate_limit.v3alpha";
-option java_outer_classname = "RateLimitProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/ratelimit/ratelimit.proto";
 import "envoy/config/ratelimit/v3alpha/rls.proto";
 
@@ -15,6 +11,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.rate_limit.v3alpha";
+option java_outer_classname = "RateLimitProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Rate limit]
 // Rate limit :ref:`configuration overview <config_network_filters_rate_limit>`.
 // [#extension: envoy.filters.network.ratelimit]
diff --git a/api/envoy/config/filter/network/rbac/v2/rbac.proto b/api/envoy/config/filter/network/rbac/v2/rbac.proto
index de96f28cf6682..e3f28cee26274 100644
--- a/api/envoy/config/filter/network/rbac/v2/rbac.proto
+++ b/api/envoy/config/filter/network/rbac/v2/rbac.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.config.filter.network.rbac.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.rbac.v2";
-option java_outer_classname = "RbacProto";
-option java_multiple_files = true;
-
 import "envoy/config/rbac/v2/rbac.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.rbac.v2";
+option java_outer_classname = "RbacProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: RBAC]
 // Role-Based Access Control :ref:`configuration overview <config_network_filters_rbac>`.
 // [#extension: envoy.filters.network.rbac]
diff --git a/api/envoy/config/filter/network/rbac/v3alpha/rbac.proto b/api/envoy/config/filter/network/rbac/v3alpha/rbac.proto
index 4dbdec4d8c623..5ed4126ab825f 100644
--- a/api/envoy/config/filter/network/rbac/v3alpha/rbac.proto
+++ b/api/envoy/config/filter/network/rbac/v3alpha/rbac.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.filter.network.rbac.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.rbac.v3alpha";
-option java_outer_classname = "RbacProto";
-option java_multiple_files = true;
-
 import "envoy/config/rbac/v3alpha/rbac.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.rbac.v3alpha";
+option java_outer_classname = "RbacProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: RBAC]
 // Role-Based Access Control :ref:`configuration overview <config_network_filters_rbac>`.
 // [#extension: envoy.filters.network.rbac]
diff --git a/api/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto b/api/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto
index 9dbf9af696edc..0cb24e873d109 100644
--- a/api/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto
+++ b/api/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.redis_proxy.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.redis_proxy.v2";
-option java_outer_classname = "RedisProxyProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/base.proto";
 
 import "google/protobuf/duration.proto";
@@ -13,6 +9,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.redis_proxy.v2";
+option java_outer_classname = "RedisProxyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Redis Proxy]
 // Redis Proxy :ref:`configuration overview <config_network_filters_redis_proxy>`.
 // [#extension: envoy.filters.network.redis_proxy]
diff --git a/api/envoy/config/filter/network/redis_proxy/v3alpha/redis_proxy.proto b/api/envoy/config/filter/network/redis_proxy/v3alpha/redis_proxy.proto
index 26ea0f6c4d9aa..71fc0f17c6f47 100644
--- a/api/envoy/config/filter/network/redis_proxy/v3alpha/redis_proxy.proto
+++ b/api/envoy/config/filter/network/redis_proxy/v3alpha/redis_proxy.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.redis_proxy.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.redis_proxy.v3alpha";
-option java_outer_classname = "RedisProxyProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 
 import "google/protobuf/duration.proto";
@@ -15,6 +11,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.redis_proxy.v3alpha";
+option java_outer_classname = "RedisProxyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Redis Proxy]
 // Redis Proxy :ref:`configuration overview <config_network_filters_redis_proxy>`.
 // [#extension: envoy.filters.network.redis_proxy]
diff --git a/api/envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.proto b/api/envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.proto
index eacd7a7bcdada..5ab0b667ecd89 100644
--- a/api/envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.proto
+++ b/api/envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.tcp_proxy.v2;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.tcp_proxy.v2";
-option java_outer_classname = "TcpProxyProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/address.proto";
 import "envoy/api/v2/core/base.proto";
 import "envoy/config/filter/accesslog/v2/accesslog.proto";
@@ -16,6 +12,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.tcp_proxy.v2";
+option java_outer_classname = "TcpProxyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: TCP Proxy]
 // TCP Proxy :ref:`configuration overview <config_network_filters_tcp_proxy>`.
 // [#extension: envoy.filters.network.tcp_proxy]
diff --git a/api/envoy/config/filter/network/tcp_proxy/v3alpha/tcp_proxy.proto b/api/envoy/config/filter/network/tcp_proxy/v3alpha/tcp_proxy.proto
index d78bc780f0da5..2ed631f623f96 100644
--- a/api/envoy/config/filter/network/tcp_proxy/v3alpha/tcp_proxy.proto
+++ b/api/envoy/config/filter/network/tcp_proxy/v3alpha/tcp_proxy.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.tcp_proxy.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.tcp_proxy.v3alpha";
-option java_outer_classname = "TcpProxyProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/address.proto";
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/config/filter/accesslog/v3alpha/accesslog.proto";
@@ -18,6 +14,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.tcp_proxy.v3alpha";
+option java_outer_classname = "TcpProxyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: TCP Proxy]
 // TCP Proxy :ref:`configuration overview <config_network_filters_tcp_proxy>`.
 // [#extension: envoy.filters.network.tcp_proxy]
diff --git a/api/envoy/config/filter/network/thrift_proxy/v2alpha1/route.proto b/api/envoy/config/filter/network/thrift_proxy/v2alpha1/route.proto
index d2983a131e2af..3c9edae88c5aa 100644
--- a/api/envoy/config/filter/network/thrift_proxy/v2alpha1/route.proto
+++ b/api/envoy/config/filter/network/thrift_proxy/v2alpha1/route.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.thrift_proxy.v2alpha1;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.thrift_proxy.v2alpha1";
-option java_outer_classname = "RouteProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/route/route.proto";
 
@@ -13,6 +9,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.thrift_proxy.v2alpha1";
+option java_outer_classname = "RouteProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Thrift Proxy Route Configuration]
 // Thrift Proxy :ref:`configuration overview <config_network_filters_thrift_proxy>`.
 
diff --git a/api/envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto b/api/envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto
index c99d2eea03846..721030e129ec2 100644
--- a/api/envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto
+++ b/api/envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.thrift_proxy.v2alpha1;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.thrift_proxy.v2alpha1";
-option java_outer_classname = "ThriftProxyProto";
-option java_multiple_files = true;
-
 import "envoy/config/filter/network/thrift_proxy/v2alpha1/route.proto";
 
 import "google/protobuf/any.proto";
@@ -13,6 +9,10 @@ import "google/protobuf/struct.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.thrift_proxy.v2alpha1";
+option java_outer_classname = "ThriftProxyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Thrift Proxy]
 // Thrift Proxy :ref:`configuration overview <config_network_filters_thrift_proxy>`.
 // [#extension: envoy.filters.network.thrift_proxy]
diff --git a/api/envoy/config/filter/network/thrift_proxy/v3alpha/route.proto b/api/envoy/config/filter/network/thrift_proxy/v3alpha/route.proto
index afe789a8b7bd0..9b9aea3327ae2 100644
--- a/api/envoy/config/filter/network/thrift_proxy/v3alpha/route.proto
+++ b/api/envoy/config/filter/network/thrift_proxy/v3alpha/route.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.thrift_proxy.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.thrift_proxy.v3alpha";
-option java_outer_classname = "RouteProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/api/v3alpha/route/route.proto";
 
@@ -15,6 +11,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.thrift_proxy.v3alpha";
+option java_outer_classname = "RouteProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Thrift Proxy Route Configuration]
 // Thrift Proxy :ref:`configuration overview <config_network_filters_thrift_proxy>`.
 
diff --git a/api/envoy/config/filter/network/thrift_proxy/v3alpha/thrift_proxy.proto b/api/envoy/config/filter/network/thrift_proxy/v3alpha/thrift_proxy.proto
index 73c5288500a53..afc733b4c7d2b 100644
--- a/api/envoy/config/filter/network/thrift_proxy/v3alpha/thrift_proxy.proto
+++ b/api/envoy/config/filter/network/thrift_proxy/v3alpha/thrift_proxy.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.network.thrift_proxy.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.thrift_proxy.v3alpha";
-option java_outer_classname = "ThriftProxyProto";
-option java_multiple_files = true;
-
 import "envoy/config/filter/network/thrift_proxy/v3alpha/route.proto";
 
 import "google/protobuf/any.proto";
@@ -15,6 +11,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.thrift_proxy.v3alpha";
+option java_outer_classname = "ThriftProxyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Thrift Proxy]
 // Thrift Proxy :ref:`configuration overview <config_network_filters_thrift_proxy>`.
 // [#extension: envoy.filters.network.thrift_proxy]
diff --git a/api/envoy/config/filter/network/zookeeper_proxy/v1alpha1/zookeeper_proxy.proto b/api/envoy/config/filter/network/zookeeper_proxy/v1alpha1/zookeeper_proxy.proto
index 11cb6a2ffb002..dc5d6b02eeede 100644
--- a/api/envoy/config/filter/network/zookeeper_proxy/v1alpha1/zookeeper_proxy.proto
+++ b/api/envoy/config/filter/network/zookeeper_proxy/v1alpha1/zookeeper_proxy.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.config.filter.network.zookeeper_proxy.v1alpha1;
 
-option java_package = "io.envoyproxy.envoy.config.filter.network.zookeeper_proxy.v1alpha1";
-option java_outer_classname = "ZookeeperProxyProto";
-option java_multiple_files = true;
-
 import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.network.zookeeper_proxy.v1alpha1";
+option java_outer_classname = "ZookeeperProxyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: ZooKeeper proxy]
 // ZooKeeper Proxy :ref:`configuration overview <config_network_filters_zookeeper_proxy>`.
 // [#extension: envoy.filters.network.zookeeper_proxy]
diff --git a/api/envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.proto b/api/envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.proto
index 7a057fa49c84e..a6db82f380958 100644
--- a/api/envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.proto
+++ b/api/envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.filter.thrift.rate_limit.v2alpha1;
 
-option java_package = "io.envoyproxy.envoy.config.filter.thrift.rate_limit.v2alpha1";
-option java_outer_classname = "RateLimitProto";
-option java_multiple_files = true;
-
 import "envoy/config/ratelimit/v2/rls.proto";
 
 import "google/protobuf/duration.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.thrift.rate_limit.v2alpha1";
+option java_outer_classname = "RateLimitProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Rate limit]
 // Rate limit :ref:`configuration overview <config_thrift_filters_rate_limit>`.
 // [#extension: envoy.filters.thrift.ratelimit]
diff --git a/api/envoy/config/filter/thrift/rate_limit/v3alpha/rate_limit.proto b/api/envoy/config/filter/thrift/rate_limit/v3alpha/rate_limit.proto
index c111454e1da94..8e9eb976efdb6 100644
--- a/api/envoy/config/filter/thrift/rate_limit/v3alpha/rate_limit.proto
+++ b/api/envoy/config/filter/thrift/rate_limit/v3alpha/rate_limit.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.filter.thrift.rate_limit.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.thrift.rate_limit.v3alpha";
-option java_outer_classname = "RateLimitProto";
-option java_multiple_files = true;
-
 import "envoy/config/ratelimit/v3alpha/rls.proto";
 
 import "google/protobuf/duration.proto";
@@ -14,6 +10,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.thrift.rate_limit.v3alpha";
+option java_outer_classname = "RateLimitProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Rate limit]
 // Rate limit :ref:`configuration overview <config_thrift_filters_rate_limit>`.
 // [#extension: envoy.filters.thrift.ratelimit]
diff --git a/api/envoy/config/filter/udp/udp_proxy/v2alpha/udp_proxy.proto b/api/envoy/config/filter/udp/udp_proxy/v2alpha/udp_proxy.proto
index 4a8b079f286d0..720277aa4ccce 100644
--- a/api/envoy/config/filter/udp/udp_proxy/v2alpha/udp_proxy.proto
+++ b/api/envoy/config/filter/udp/udp_proxy/v2alpha/udp_proxy.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.config.filter.udp.udp_proxy.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.config.filter.udp.udp_proxy.v2alpha";
-option java_outer_classname = "UdpProxyProto";
-option java_multiple_files = true;
-
 import "google/protobuf/duration.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.filter.udp.udp_proxy.v2alpha";
+option java_outer_classname = "UdpProxyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: UDP proxy]
 // UDP proxy :ref:`configuration overview <config_udp_listener_filters_udp_proxy>`.
 // [#extension: envoy.filters.udp_listener.udp_proxy]
diff --git a/api/envoy/config/grpc_credential/v2alpha/aws_iam.proto b/api/envoy/config/grpc_credential/v2alpha/aws_iam.proto
index 7a25662858633..9f17b40554be0 100644
--- a/api/envoy/config/grpc_credential/v2alpha/aws_iam.proto
+++ b/api/envoy/config/grpc_credential/v2alpha/aws_iam.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.config.grpc_credential.v2alpha;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.config.grpc_credential.v2alpha";
 option java_outer_classname = "AwsIamProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: Grpc Credentials AWS IAM]
 // Configuration for AWS IAM Grpc Credentials Plugin
 // [#extension: envoy.grpc_credentials.aws_iam]
diff --git a/api/envoy/config/grpc_credential/v2alpha/file_based_metadata.proto b/api/envoy/config/grpc_credential/v2alpha/file_based_metadata.proto
index b7fccf2f3fbe7..cbb754a27a501 100644
--- a/api/envoy/config/grpc_credential/v2alpha/file_based_metadata.proto
+++ b/api/envoy/config/grpc_credential/v2alpha/file_based_metadata.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.config.grpc_credential.v2alpha;
 
+import "envoy/api/v2/core/base.proto";
+
 option java_package = "io.envoyproxy.envoy.config.grpc_credential.v2alpha";
 option java_outer_classname = "FileBasedMetadataProto";
 option java_multiple_files = true;
 
-import "envoy/api/v2/core/base.proto";
-
 // [#protodoc-title: Grpc Credentials File Based Metadata]
 // Configuration for File Based Metadata Grpc Credentials Plugin
 // [#extension: envoy.grpc_credentials.file_based_metadata]
diff --git a/api/envoy/config/grpc_credential/v3alpha/aws_iam.proto b/api/envoy/config/grpc_credential/v3alpha/aws_iam.proto
index 7841e3d7ac188..005b3ca711ed5 100644
--- a/api/envoy/config/grpc_credential/v3alpha/aws_iam.proto
+++ b/api/envoy/config/grpc_credential/v3alpha/aws_iam.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.config.grpc_credential.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.grpc_credential.v3alpha";
-option java_outer_classname = "AwsIamProto";
-option java_multiple_files = true;
-
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.grpc_credential.v3alpha";
+option java_outer_classname = "AwsIamProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Grpc Credentials AWS IAM]
 // Configuration for AWS IAM Grpc Credentials Plugin
 // [#extension: envoy.grpc_credentials.aws_iam]
diff --git a/api/envoy/config/grpc_credential/v3alpha/file_based_metadata.proto b/api/envoy/config/grpc_credential/v3alpha/file_based_metadata.proto
index a1166235c910b..8bdfecf2cbe6b 100644
--- a/api/envoy/config/grpc_credential/v3alpha/file_based_metadata.proto
+++ b/api/envoy/config/grpc_credential/v3alpha/file_based_metadata.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.config.grpc_credential.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.grpc_credential.v3alpha";
-option java_outer_classname = "FileBasedMetadataProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 
 import "udpa/annotations/versioning.proto";
 
+option java_package = "io.envoyproxy.envoy.config.grpc_credential.v3alpha";
+option java_outer_classname = "FileBasedMetadataProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Grpc Credentials File Based Metadata]
 // Configuration for File Based Metadata Grpc Credentials Plugin
 // [#extension: envoy.grpc_credentials.file_based_metadata]
diff --git a/api/envoy/config/listener/v2/api_listener.proto b/api/envoy/config/listener/v2/api_listener.proto
index 5a497cd17d9da..65da5efa56c59 100644
--- a/api/envoy/config/listener/v2/api_listener.proto
+++ b/api/envoy/config/listener/v2/api_listener.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.config.listener.v2;
 
+import "google/protobuf/any.proto";
+
 option java_package = "io.envoyproxy.envoy.config.listener.v2";
 option java_outer_classname = "ApiListenerProto";
 option java_multiple_files = true;
 
-import "google/protobuf/any.proto";
-
 // [#not-implemented-hide:]
 // Describes a type of API listener, which is used in non-proxy clients. The type of API
 // exposed to the non-proxy application depends on the type of API listener.
diff --git a/api/envoy/config/metrics/v2/metrics_service.proto b/api/envoy/config/metrics/v2/metrics_service.proto
index d23de6c1a01a1..0cf192136706f 100644
--- a/api/envoy/config/metrics/v2/metrics_service.proto
+++ b/api/envoy/config/metrics/v2/metrics_service.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.config.metrics.v2;
 
-option java_package = "io.envoyproxy.envoy.config.metrics.v2";
-option java_outer_classname = "MetricsServiceProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/grpc_service.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.metrics.v2";
+option java_outer_classname = "MetricsServiceProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Metrics service]
 
 // Metrics Service is configured as a built-in *envoy.metrics_service* :ref:`StatsSink
diff --git a/api/envoy/config/metrics/v2/stats.proto b/api/envoy/config/metrics/v2/stats.proto
index 716c9c2eb9c27..518ad86247608 100644
--- a/api/envoy/config/metrics/v2/stats.proto
+++ b/api/envoy/config/metrics/v2/stats.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.metrics.v2;
 
-option java_package = "io.envoyproxy.envoy.config.metrics.v2";
-option java_outer_classname = "StatsProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/address.proto";
 import "envoy/type/matcher/string.proto";
 
@@ -15,6 +11,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.metrics.v2";
+option java_outer_classname = "StatsProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Stats]
 // Statistics :ref:`architecture overview <arch_overview_statistics>`.
 
diff --git a/api/envoy/config/metrics/v3alpha/metrics_service.proto b/api/envoy/config/metrics/v3alpha/metrics_service.proto
index d389be5bc68f5..591c30f9b06c6 100644
--- a/api/envoy/config/metrics/v3alpha/metrics_service.proto
+++ b/api/envoy/config/metrics/v3alpha/metrics_service.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.metrics.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.metrics.v3alpha";
-option java_outer_classname = "MetricsServiceProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/grpc_service.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.metrics.v3alpha";
+option java_outer_classname = "MetricsServiceProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Metrics service]
 
 // Metrics Service is configured as a built-in *envoy.metrics_service* :ref:`StatsSink
diff --git a/api/envoy/config/metrics/v3alpha/stats.proto b/api/envoy/config/metrics/v3alpha/stats.proto
index 5d69dd122060f..54c6f9045b876 100644
--- a/api/envoy/config/metrics/v3alpha/stats.proto
+++ b/api/envoy/config/metrics/v3alpha/stats.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.metrics.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.metrics.v3alpha";
-option java_outer_classname = "StatsProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/address.proto";
 import "envoy/type/matcher/v3alpha/string.proto";
 
@@ -17,6 +13,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.metrics.v3alpha";
+option java_outer_classname = "StatsProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Stats]
 // Statistics :ref:`architecture overview <arch_overview_statistics>`.
 
diff --git a/api/envoy/config/overload/v2alpha/overload.proto b/api/envoy/config/overload/v2alpha/overload.proto
index 4272453541931..ff71a1e5dcca5 100644
--- a/api/envoy/config/overload/v2alpha/overload.proto
+++ b/api/envoy/config/overload/v2alpha/overload.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.overload.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.config.overload.v2alpha";
-option java_outer_classname = "OverloadProto";
-option java_multiple_files = true;
-
 import "google/protobuf/any.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.overload.v2alpha";
+option java_outer_classname = "OverloadProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Overload Manager]
 
 // The Overload Manager provides an extensible framework to protect Envoy instances
diff --git a/api/envoy/config/overload/v3alpha/overload.proto b/api/envoy/config/overload/v3alpha/overload.proto
index 7e52a31ce24c9..24845e6c469e4 100644
--- a/api/envoy/config/overload/v3alpha/overload.proto
+++ b/api/envoy/config/overload/v3alpha/overload.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.overload.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.overload.v3alpha";
-option java_outer_classname = "OverloadProto";
-option java_multiple_files = true;
-
 import "google/protobuf/any.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
@@ -14,6 +10,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.overload.v3alpha";
+option java_outer_classname = "OverloadProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Overload Manager]
 
 // The Overload Manager provides an extensible framework to protect Envoy instances
diff --git a/api/envoy/config/ratelimit/v2/rls.proto b/api/envoy/config/ratelimit/v2/rls.proto
index 618ecf7c718a4..e617ec22f5dee 100644
--- a/api/envoy/config/ratelimit/v2/rls.proto
+++ b/api/envoy/config/ratelimit/v2/rls.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.config.ratelimit.v2;
 
-option java_package = "io.envoyproxy.envoy.config.ratelimit.v2";
-option java_outer_classname = "RlsProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/grpc_service.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.ratelimit.v2";
+option java_outer_classname = "RlsProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Rate limit service]
 
 // Rate limit :ref:`configuration overview <config_rate_limit_service>`.
diff --git a/api/envoy/config/ratelimit/v3alpha/rls.proto b/api/envoy/config/ratelimit/v3alpha/rls.proto
index 73da57d1df8a4..76b408f4c1dc6 100644
--- a/api/envoy/config/ratelimit/v3alpha/rls.proto
+++ b/api/envoy/config/ratelimit/v3alpha/rls.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.config.ratelimit.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.ratelimit.v3alpha";
-option java_outer_classname = "RlsProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/grpc_service.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.ratelimit.v3alpha";
+option java_outer_classname = "RlsProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Rate limit service]
 
 // Rate limit :ref:`configuration overview <config_rate_limit_service>`.
diff --git a/api/envoy/config/rbac/v2/rbac.proto b/api/envoy/config/rbac/v2/rbac.proto
index adf2b320cdb9c..9633e95572083 100644
--- a/api/envoy/config/rbac/v2/rbac.proto
+++ b/api/envoy/config/rbac/v2/rbac.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.rbac.v2;
 
-option java_package = "io.envoyproxy.envoy.config.rbac.v2";
-option java_outer_classname = "RbacProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/address.proto";
 import "envoy/api/v2/route/route.proto";
 import "envoy/type/matcher/metadata.proto";
@@ -15,6 +11,10 @@ import "google/api/expr/v1alpha1/syntax.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.rbac.v2";
+option java_outer_classname = "RbacProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Role Based Access Control (RBAC)]
 
 // Role Based Access Control (RBAC) provides service-level and method-level access control for a
diff --git a/api/envoy/config/rbac/v3alpha/rbac.proto b/api/envoy/config/rbac/v3alpha/rbac.proto
index ed704d65f7d67..ddb15ec24c94b 100644
--- a/api/envoy/config/rbac/v3alpha/rbac.proto
+++ b/api/envoy/config/rbac/v3alpha/rbac.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.rbac.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.rbac.v3alpha";
-option java_outer_classname = "RbacProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/address.proto";
 import "envoy/api/v3alpha/route/route.proto";
 import "envoy/type/matcher/v3alpha/metadata.proto";
@@ -17,6 +13,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.rbac.v3alpha";
+option java_outer_classname = "RbacProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Role Based Access Control (RBAC)]
 
 // Role Based Access Control (RBAC) provides service-level and method-level access control for a
diff --git a/api/envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto b/api/envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto
index 42a946f431665..0ec5c9424edda 100644
--- a/api/envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto
+++ b/api/envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.config.resource_monitor.fixed_heap.v2alpha;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.config.resource_monitor.fixed_heap.v2alpha";
 option java_outer_classname = "FixedHeapProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: Fixed heap]
 // [#extension: envoy.resource_monitors.fixed_heap]
 
diff --git a/api/envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto b/api/envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto
index 12fd97a541b8d..1073e16b1b6e2 100644
--- a/api/envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto
+++ b/api/envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.config.resource_monitor.injected_resource.v2alpha;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.config.resource_monitor.injected_resource.v2alpha";
 option java_outer_classname = "InjectedResourceProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: Injected resource]
 // [#extension: envoy.resource_monitors.injected_resource]
 
diff --git a/api/envoy/config/retry/previous_priorities/previous_priorities_config.proto b/api/envoy/config/retry/previous_priorities/previous_priorities_config.proto
index bfc2331031319..ead70badc29c0 100644
--- a/api/envoy/config/retry/previous_priorities/previous_priorities_config.proto
+++ b/api/envoy/config/retry/previous_priorities/previous_priorities_config.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.config.retry.previous_priorities;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.config.retry.previous_priorities";
 option java_outer_classname = "PreviousPrioritiesConfigProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // A retry host selector that attempts to spread retries between priorities, even if certain
 // priorities would not normally be attempted due to higher priorities being available.
 //
diff --git a/api/envoy/config/trace/v2/trace.proto b/api/envoy/config/trace/v2/trace.proto
index 31dbd4e46952b..e0d925aaf675d 100644
--- a/api/envoy/config/trace/v2/trace.proto
+++ b/api/envoy/config/trace/v2/trace.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.trace.v2;
 
-option java_package = "io.envoyproxy.envoy.config.trace.v2";
-option java_outer_classname = "TraceProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/grpc_service.proto";
 
 import "google/protobuf/any.proto";
@@ -16,6 +12,10 @@ import "opencensus/proto/trace/v1/trace_config.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.trace.v2";
+option java_outer_classname = "TraceProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Tracing]
 // Tracing :ref:`architecture overview <arch_overview_tracing>`.
 
diff --git a/api/envoy/config/trace/v2alpha/xray.proto b/api/envoy/config/trace/v2alpha/xray.proto
index 53292833e4afb..d415846dfef16 100644
--- a/api/envoy/config/trace/v2alpha/xray.proto
+++ b/api/envoy/config/trace/v2alpha/xray.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.config.trace.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.config.trace.v2alpha";
-option java_outer_classname = "XrayProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/address.proto";
 import "envoy/api/v2/core/base.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.trace.v2alpha";
+option java_outer_classname = "XrayProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: AWS X-Ray Tracer Configuration]
 // Configuration for AWS X-Ray tracer
 
diff --git a/api/envoy/config/trace/v3alpha/trace.proto b/api/envoy/config/trace/v3alpha/trace.proto
index c837e07f962c1..9501b9035ea1b 100644
--- a/api/envoy/config/trace/v3alpha/trace.proto
+++ b/api/envoy/config/trace/v3alpha/trace.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.trace.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.trace.v3alpha";
-option java_outer_classname = "TraceProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/grpc_service.proto";
 
 import "google/protobuf/any.proto";
@@ -17,6 +13,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.trace.v3alpha";
+option java_outer_classname = "TraceProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Tracing]
 // Tracing :ref:`architecture overview <arch_overview_tracing>`.
 
diff --git a/api/envoy/config/trace/v3alpha/xray.proto b/api/envoy/config/trace/v3alpha/xray.proto
index 4cd9753fab2c5..33afc71b1b867 100644
--- a/api/envoy/config/trace/v3alpha/xray.proto
+++ b/api/envoy/config/trace/v3alpha/xray.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.trace.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.trace.v3alpha";
-option java_outer_classname = "XrayProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/address.proto";
 import "envoy/api/v3alpha/core/base.proto";
 
@@ -13,6 +9,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.trace.v3alpha";
+option java_outer_classname = "XrayProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: AWS X-Ray Tracer Configuration]
 // Configuration for AWS X-Ray tracer
 
diff --git a/api/envoy/config/transport_socket/alts/v2alpha/alts.proto b/api/envoy/config/transport_socket/alts/v2alpha/alts.proto
index 6141595acac34..5da4db3af9c9f 100644
--- a/api/envoy/config/transport_socket/alts/v2alpha/alts.proto
+++ b/api/envoy/config/transport_socket/alts/v2alpha/alts.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.config.transport_socket.alts.v2alpha;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.config.transport_socket.alts.v2alpha";
 option java_outer_classname = "AltsProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: ALTS]
 // [#extension: envoy.transport_sockets.alts]
 
diff --git a/api/envoy/config/transport_socket/tap/v2alpha/tap.proto b/api/envoy/config/transport_socket/tap/v2alpha/tap.proto
index 8f3a51ff4489e..0e05360982c66 100644
--- a/api/envoy/config/transport_socket/tap/v2alpha/tap.proto
+++ b/api/envoy/config/transport_socket/tap/v2alpha/tap.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.config.transport_socket.tap.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.config.transport_socket.tap.v2alpha";
-option java_outer_classname = "TapProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/config/common/tap/v2alpha/common.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.transport_socket.tap.v2alpha";
+option java_outer_classname = "TapProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Tap]
 // [#extension: envoy.transport_sockets.tap]
 
diff --git a/api/envoy/config/transport_socket/tap/v3alpha/tap.proto b/api/envoy/config/transport_socket/tap/v3alpha/tap.proto
index 56648883b8013..45b567a9767dd 100644
--- a/api/envoy/config/transport_socket/tap/v3alpha/tap.proto
+++ b/api/envoy/config/transport_socket/tap/v3alpha/tap.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.config.transport_socket.tap.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.config.transport_socket.tap.v3alpha";
-option java_outer_classname = "TapProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/config/common/tap/v3alpha/common.proto";
 
@@ -13,6 +9,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.config.transport_socket.tap.v3alpha";
+option java_outer_classname = "TapProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Tap]
 // [#extension: envoy.transport_sockets.tap]
 
diff --git a/api/envoy/data/accesslog/v2/accesslog.proto b/api/envoy/data/accesslog/v2/accesslog.proto
index 5d2c75d7a1d36..1c4e5ee13c730 100644
--- a/api/envoy/data/accesslog/v2/accesslog.proto
+++ b/api/envoy/data/accesslog/v2/accesslog.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.data.accesslog.v2;
 
-option java_package = "io.envoyproxy.envoy.data.accesslog.v2";
-option java_outer_classname = "AccesslogProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/address.proto";
 import "envoy/api/v2/core/base.proto";
 
@@ -16,6 +12,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.data.accesslog.v2";
+option java_outer_classname = "AccesslogProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: gRPC access logs]
 // Envoy access logs describe incoming interaction with Envoy over a fixed
 // period of time, and typically cover a single request/response exchange,
diff --git a/api/envoy/data/accesslog/v3alpha/accesslog.proto b/api/envoy/data/accesslog/v3alpha/accesslog.proto
index 68980cb845eff..11b48ec303cb2 100644
--- a/api/envoy/data/accesslog/v3alpha/accesslog.proto
+++ b/api/envoy/data/accesslog/v3alpha/accesslog.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.data.accesslog.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.data.accesslog.v3alpha";
-option java_outer_classname = "AccesslogProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/address.proto";
 import "envoy/api/v3alpha/core/base.proto";
 
@@ -18,6 +14,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.data.accesslog.v3alpha";
+option java_outer_classname = "AccesslogProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: gRPC access logs]
 // Envoy access logs describe incoming interaction with Envoy over a fixed
 // period of time, and typically cover a single request/response exchange,
diff --git a/api/envoy/data/cluster/v2alpha/outlier_detection_event.proto b/api/envoy/data/cluster/v2alpha/outlier_detection_event.proto
index 80afadd92b822..abbf57cd86066 100644
--- a/api/envoy/data/cluster/v2alpha/outlier_detection_event.proto
+++ b/api/envoy/data/cluster/v2alpha/outlier_detection_event.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.data.cluster.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.data.cluster.v2alpha";
-option java_outer_classname = "OutlierDetectionEventProto";
-option java_multiple_files = true;
-
 import "google/protobuf/timestamp.proto";
 import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.data.cluster.v2alpha";
+option java_outer_classname = "OutlierDetectionEventProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Outlier detection logging events]
 // :ref:`Outlier detection logging <arch_overview_outlier_detection_logging>`.
 
diff --git a/api/envoy/data/core/v2alpha/health_check_event.proto b/api/envoy/data/core/v2alpha/health_check_event.proto
index f5a4533e61556..777cb9c270dfc 100644
--- a/api/envoy/data/core/v2alpha/health_check_event.proto
+++ b/api/envoy/data/core/v2alpha/health_check_event.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.data.core.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.data.core.v2alpha";
-option java_outer_classname = "HealthCheckEventProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/address.proto";
 
 import "google/protobuf/timestamp.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.data.core.v2alpha";
+option java_outer_classname = "HealthCheckEventProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Health check logging events]
 // :ref:`Health check logging <arch_overview_health_check_logging>`.
 
diff --git a/api/envoy/data/core/v3alpha/health_check_event.proto b/api/envoy/data/core/v3alpha/health_check_event.proto
index 3ae7b40d199ab..321f4e70114db 100644
--- a/api/envoy/data/core/v3alpha/health_check_event.proto
+++ b/api/envoy/data/core/v3alpha/health_check_event.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.data.core.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.data.core.v3alpha";
-option java_outer_classname = "HealthCheckEventProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/address.proto";
 
 import "google/protobuf/timestamp.proto";
@@ -14,6 +10,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.data.core.v3alpha";
+option java_outer_classname = "HealthCheckEventProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Health check logging events]
 // :ref:`Health check logging <arch_overview_health_check_logging>`.
 
diff --git a/api/envoy/data/tap/v2alpha/http.proto b/api/envoy/data/tap/v2alpha/http.proto
index 849538b892d92..bde7006e10930 100644
--- a/api/envoy/data/tap/v2alpha/http.proto
+++ b/api/envoy/data/tap/v2alpha/http.proto
@@ -2,13 +2,13 @@ syntax = "proto3";
 
 package envoy.data.tap.v2alpha;
 
+import "envoy/api/v2/core/base.proto";
+import "envoy/data/tap/v2alpha/common.proto";
+
 option java_package = "io.envoyproxy.envoy.data.tap.v2alpha";
 option java_outer_classname = "HttpProto";
 option java_multiple_files = true;
 
-import "envoy/api/v2/core/base.proto";
-import "envoy/data/tap/v2alpha/common.proto";
-
 // [#protodoc-title: HTTP tap data]
 
 // A fully buffered HTTP trace message.
diff --git a/api/envoy/data/tap/v2alpha/transport.proto b/api/envoy/data/tap/v2alpha/transport.proto
index 7d2f2c4f1a41b..dfc7f07806116 100644
--- a/api/envoy/data/tap/v2alpha/transport.proto
+++ b/api/envoy/data/tap/v2alpha/transport.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.data.tap.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.data.tap.v2alpha";
-option java_outer_classname = "TransportProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/address.proto";
 import "envoy/data/tap/v2alpha/common.proto";
 
 import "google/protobuf/timestamp.proto";
 
+option java_package = "io.envoyproxy.envoy.data.tap.v2alpha";
+option java_outer_classname = "TransportProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Transport tap data]
 // Trace format for the tap transport socket extension. This dumps plain text read/write
 // sequences on a socket.
diff --git a/api/envoy/data/tap/v2alpha/wrapper.proto b/api/envoy/data/tap/v2alpha/wrapper.proto
index 3445e67e9d28f..13d39b8d35854 100644
--- a/api/envoy/data/tap/v2alpha/wrapper.proto
+++ b/api/envoy/data/tap/v2alpha/wrapper.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.data.tap.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.data.tap.v2alpha";
-option java_outer_classname = "WrapperProto";
-option java_multiple_files = true;
-
 import "envoy/data/tap/v2alpha/http.proto";
 import "envoy/data/tap/v2alpha/transport.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.data.tap.v2alpha";
+option java_outer_classname = "WrapperProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Tap data wrappers]
 
 // Wrapper for all fully buffered and streamed tap traces that Envoy emits. This is required for
diff --git a/api/envoy/data/tap/v3alpha/common.proto b/api/envoy/data/tap/v3alpha/common.proto
index 148e48e2b7179..abb6c75101b56 100644
--- a/api/envoy/data/tap/v3alpha/common.proto
+++ b/api/envoy/data/tap/v3alpha/common.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.data.tap.v3alpha;
 
+import "udpa/annotations/versioning.proto";
+
 option java_package = "io.envoyproxy.envoy.data.tap.v3alpha";
 option java_outer_classname = "CommonProto";
 option java_multiple_files = true;
 
-import "udpa/annotations/versioning.proto";
-
 // [#protodoc-title: Tap common data]
 
 // Wrapper for tapped body data. This includes HTTP request/response body, transport socket received
diff --git a/api/envoy/data/tap/v3alpha/http.proto b/api/envoy/data/tap/v3alpha/http.proto
index f09b2c148f5e0..f29071932ff0a 100644
--- a/api/envoy/data/tap/v3alpha/http.proto
+++ b/api/envoy/data/tap/v3alpha/http.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.data.tap.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.data.tap.v3alpha";
-option java_outer_classname = "HttpProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/data/tap/v3alpha/common.proto";
 
 import "udpa/annotations/versioning.proto";
 
+option java_package = "io.envoyproxy.envoy.data.tap.v3alpha";
+option java_outer_classname = "HttpProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: HTTP tap data]
 
 // A fully buffered HTTP trace message.
diff --git a/api/envoy/data/tap/v3alpha/transport.proto b/api/envoy/data/tap/v3alpha/transport.proto
index 2fe147e573f73..3f4ecb9f7b805 100644
--- a/api/envoy/data/tap/v3alpha/transport.proto
+++ b/api/envoy/data/tap/v3alpha/transport.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.data.tap.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.data.tap.v3alpha";
-option java_outer_classname = "TransportProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/address.proto";
 import "envoy/data/tap/v3alpha/common.proto";
 
@@ -13,6 +9,10 @@ import "google/protobuf/timestamp.proto";
 
 import "udpa/annotations/versioning.proto";
 
+option java_package = "io.envoyproxy.envoy.data.tap.v3alpha";
+option java_outer_classname = "TransportProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Transport tap data]
 // Trace format for the tap transport socket extension. This dumps plain text read/write
 // sequences on a socket.
diff --git a/api/envoy/data/tap/v3alpha/wrapper.proto b/api/envoy/data/tap/v3alpha/wrapper.proto
index bcad27e6f7a2d..a8a336dbc9bf4 100644
--- a/api/envoy/data/tap/v3alpha/wrapper.proto
+++ b/api/envoy/data/tap/v3alpha/wrapper.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.data.tap.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.data.tap.v3alpha";
-option java_outer_classname = "WrapperProto";
-option java_multiple_files = true;
-
 import "envoy/data/tap/v3alpha/http.proto";
 import "envoy/data/tap/v3alpha/transport.proto";
 
@@ -13,6 +9,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.data.tap.v3alpha";
+option java_outer_classname = "WrapperProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Tap data wrappers]
 
 // Wrapper for all fully buffered and streamed tap traces that Envoy emits. This is required for
diff --git a/api/envoy/service/accesslog/v2/als.proto b/api/envoy/service/accesslog/v2/als.proto
index fffe668b9835b..69618be73011f 100644
--- a/api/envoy/service/accesslog/v2/als.proto
+++ b/api/envoy/service/accesslog/v2/als.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.service.accesslog.v2;
 
-option java_package = "io.envoyproxy.envoy.service.accesslog.v2";
-option java_outer_classname = "AlsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/data/accesslog/v2/accesslog.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.accesslog.v2";
+option java_outer_classname = "AlsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: gRPC Access Log Service (ALS)]
 
 // Service for streaming access logs from Envoy to an access log server.
diff --git a/api/envoy/service/accesslog/v3alpha/als.proto b/api/envoy/service/accesslog/v3alpha/als.proto
index 113e1adff07c7..c102d854729e0 100644
--- a/api/envoy/service/accesslog/v3alpha/als.proto
+++ b/api/envoy/service/accesslog/v3alpha/als.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.service.accesslog.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.service.accesslog.v3alpha";
-option java_outer_classname = "AlsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/data/accesslog/v3alpha/accesslog.proto";
 
@@ -14,6 +9,11 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.accesslog.v3alpha";
+option java_outer_classname = "AlsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: gRPC Access Log Service (ALS)]
 
 // Service for streaming access logs from Envoy to an access log server.
diff --git a/api/envoy/service/auth/v2/attribute_context.proto b/api/envoy/service/auth/v2/attribute_context.proto
index 82b2065f80f44..d918c74440a67 100644
--- a/api/envoy/service/auth/v2/attribute_context.proto
+++ b/api/envoy/service/auth/v2/attribute_context.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.service.auth.v2;
 
-option java_package = "io.envoyproxy.envoy.service.auth.v2";
-option java_outer_classname = "AttributeContextProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/address.proto";
 import "envoy/api/v2/core/base.proto";
 
 import "google/protobuf/timestamp.proto";
 
+option java_package = "io.envoyproxy.envoy.service.auth.v2";
+option java_outer_classname = "AttributeContextProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Attribute Context ]
 
 // See :ref:`network filter configuration overview <config_network_filters_ext_authz>`
diff --git a/api/envoy/service/auth/v2/external_auth.proto b/api/envoy/service/auth/v2/external_auth.proto
index b9da8d6dad258..8245106334b7c 100644
--- a/api/envoy/service/auth/v2/external_auth.proto
+++ b/api/envoy/service/auth/v2/external_auth.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.service.auth.v2;
 
-option java_package = "io.envoyproxy.envoy.service.auth.v2";
-option java_outer_classname = "ExternalAuthProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/service/auth/v2/attribute_context.proto";
 import "envoy/type/http_status.proto";
@@ -15,6 +10,11 @@ import "google/rpc/status.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.auth.v2";
+option java_outer_classname = "ExternalAuthProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: Authorization Service ]
 
 // The authorization service request messages used by external authorization :ref:`network filter
diff --git a/api/envoy/service/auth/v3alpha/attribute_context.proto b/api/envoy/service/auth/v3alpha/attribute_context.proto
index e50f6d6381e6d..aad80bad41173 100644
--- a/api/envoy/service/auth/v3alpha/attribute_context.proto
+++ b/api/envoy/service/auth/v3alpha/attribute_context.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.service.auth.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.service.auth.v3alpha";
-option java_outer_classname = "AttributeContextProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/address.proto";
 import "envoy/api/v3alpha/core/base.proto";
 
@@ -13,6 +9,10 @@ import "google/protobuf/timestamp.proto";
 
 import "udpa/annotations/versioning.proto";
 
+option java_package = "io.envoyproxy.envoy.service.auth.v3alpha";
+option java_outer_classname = "AttributeContextProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Attribute Context ]
 
 // See :ref:`network filter configuration overview <config_network_filters_ext_authz>`
diff --git a/api/envoy/service/auth/v3alpha/external_auth.proto b/api/envoy/service/auth/v3alpha/external_auth.proto
index 8daf10f01a447..8636daa67f2d6 100644
--- a/api/envoy/service/auth/v3alpha/external_auth.proto
+++ b/api/envoy/service/auth/v3alpha/external_auth.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.service.auth.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.service.auth.v3alpha";
-option java_outer_classname = "ExternalAuthProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/service/auth/v3alpha/attribute_context.proto";
 import "envoy/type/v3alpha/http_status.proto";
@@ -17,6 +12,11 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.auth.v3alpha";
+option java_outer_classname = "ExternalAuthProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: Authorization Service ]
 
 // The authorization service request messages used by external authorization :ref:`network filter
diff --git a/api/envoy/service/discovery/v2/ads.proto b/api/envoy/service/discovery/v2/ads.proto
index 40945e1b4d108..e2002ecf248fa 100644
--- a/api/envoy/service/discovery/v2/ads.proto
+++ b/api/envoy/service/discovery/v2/ads.proto
@@ -2,13 +2,13 @@ syntax = "proto3";
 
 package envoy.service.discovery.v2;
 
+import "envoy/api/v2/discovery.proto";
+
 option java_package = "io.envoyproxy.envoy.service.discovery.v2";
 option java_outer_classname = "AdsProto";
 option java_multiple_files = true;
 option java_generic_services = true;
 
-import "envoy/api/v2/discovery.proto";
-
 // [#not-implemented-hide:] Discovery services for endpoints, clusters, routes,
 // and listeners are retained in the package `envoy.api.v2` for backwards
 // compatibility with existing management servers. New development in discovery
diff --git a/api/envoy/service/discovery/v2/hds.proto b/api/envoy/service/discovery/v2/hds.proto
index 1045d865042c0..7c4886b04cc5b 100644
--- a/api/envoy/service/discovery/v2/hds.proto
+++ b/api/envoy/service/discovery/v2/hds.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.service.discovery.v2;
 
-option java_package = "io.envoyproxy.envoy.service.discovery.v2";
-option java_outer_classname = "HdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/core/health_check.proto";
 import "envoy/api/v2/endpoint/endpoint.proto";
@@ -14,6 +9,11 @@ import "envoy/api/v2/endpoint/endpoint.proto";
 import "google/api/annotations.proto";
 import "google/protobuf/duration.proto";
 
+option java_package = "io.envoyproxy.envoy.service.discovery.v2";
+option java_outer_classname = "HdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // HDS is Health Discovery Service. It compliments Envoy’s health checking
 // service by designating this Envoy to be a healthchecker for a subset of hosts
 // in the cluster. The status of these health checks will be reported to the
diff --git a/api/envoy/service/discovery/v2/rtds.proto b/api/envoy/service/discovery/v2/rtds.proto
index eebf9e20e8a75..cea95425cb8b2 100644
--- a/api/envoy/service/discovery/v2/rtds.proto
+++ b/api/envoy/service/discovery/v2/rtds.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.service.discovery.v2;
 
-option java_package = "io.envoyproxy.envoy.service.discovery.v2";
-option java_outer_classname = "RtdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v2/discovery.proto";
 
 import "google/api/annotations.proto";
@@ -14,6 +9,11 @@ import "google/protobuf/struct.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.discovery.v2";
+option java_outer_classname = "RtdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: Runtime Discovery Service (RTDS)]
 // RTDS :ref:`configuration overview <config_runtime_rtds>`
 
diff --git a/api/envoy/service/discovery/v2/sds.proto b/api/envoy/service/discovery/v2/sds.proto
index df517f06eed24..848e08496dbbc 100644
--- a/api/envoy/service/discovery/v2/sds.proto
+++ b/api/envoy/service/discovery/v2/sds.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.service.discovery.v2;
 
+import "envoy/api/v2/discovery.proto";
+
+import "google/api/annotations.proto";
+
 option java_package = "io.envoyproxy.envoy.service.discovery.v2";
 option java_outer_classname = "SdsProto";
 option java_multiple_files = true;
 option java_generic_services = true;
 
-import "envoy/api/v2/discovery.proto";
-
-import "google/api/annotations.proto";
-
 service SecretDiscoveryService {
   rpc DeltaSecrets(stream api.v2.DeltaDiscoveryRequest)
       returns (stream api.v2.DeltaDiscoveryResponse) {
diff --git a/api/envoy/service/discovery/v3alpha/ads.proto b/api/envoy/service/discovery/v3alpha/ads.proto
index a89bf61bdf570..a8e9a247eedb3 100644
--- a/api/envoy/service/discovery/v3alpha/ads.proto
+++ b/api/envoy/service/discovery/v3alpha/ads.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.service.discovery.v3alpha;
 
+import "envoy/api/v3alpha/discovery.proto";
+
+import "udpa/annotations/versioning.proto";
+
 option java_package = "io.envoyproxy.envoy.service.discovery.v3alpha";
 option java_outer_classname = "AdsProto";
 option java_multiple_files = true;
 option java_generic_services = true;
 
-import "envoy/api/v3alpha/discovery.proto";
-
-import "udpa/annotations/versioning.proto";
-
 // [#not-implemented-hide:] Discovery services for endpoints, clusters, routes,
 // and listeners are retained in the package `envoy.api.v2` for backwards
 // compatibility with existing management servers. New development in discovery
diff --git a/api/envoy/service/discovery/v3alpha/hds.proto b/api/envoy/service/discovery/v3alpha/hds.proto
index ca472f02c6e7b..fee49f0febeac 100644
--- a/api/envoy/service/discovery/v3alpha/hds.proto
+++ b/api/envoy/service/discovery/v3alpha/hds.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.service.discovery.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.service.discovery.v3alpha";
-option java_outer_classname = "HdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/api/v3alpha/core/health_check.proto";
 import "envoy/api/v3alpha/endpoint/endpoint.proto";
@@ -16,6 +11,11 @@ import "google/protobuf/duration.proto";
 
 import "udpa/annotations/versioning.proto";
 
+option java_package = "io.envoyproxy.envoy.service.discovery.v3alpha";
+option java_outer_classname = "HdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // HDS is Health Discovery Service. It compliments Envoy’s health checking
 // service by designating this Envoy to be a healthchecker for a subset of hosts
 // in the cluster. The status of these health checks will be reported to the
diff --git a/api/envoy/service/discovery/v3alpha/rtds.proto b/api/envoy/service/discovery/v3alpha/rtds.proto
index ff1bc04de76e8..b41f0d30fee94 100644
--- a/api/envoy/service/discovery/v3alpha/rtds.proto
+++ b/api/envoy/service/discovery/v3alpha/rtds.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.service.discovery.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.service.discovery.v3alpha";
-option java_outer_classname = "RtdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v3alpha/discovery.proto";
 
 import "google/api/annotations.proto";
@@ -16,6 +11,11 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.discovery.v3alpha";
+option java_outer_classname = "RtdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: Runtime Discovery Service (RTDS)]
 // RTDS :ref:`configuration overview <config_runtime_rtds>`
 
diff --git a/api/envoy/service/discovery/v3alpha/sds.proto b/api/envoy/service/discovery/v3alpha/sds.proto
index 6cdbd26a4d065..2b6af20ee351d 100644
--- a/api/envoy/service/discovery/v3alpha/sds.proto
+++ b/api/envoy/service/discovery/v3alpha/sds.proto
@@ -2,17 +2,17 @@ syntax = "proto3";
 
 package envoy.service.discovery.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.service.discovery.v3alpha";
-option java_outer_classname = "SdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v3alpha/discovery.proto";
 
 import "google/api/annotations.proto";
 
 import "udpa/annotations/versioning.proto";
 
+option java_package = "io.envoyproxy.envoy.service.discovery.v3alpha";
+option java_outer_classname = "SdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 service SecretDiscoveryService {
   rpc DeltaSecrets(stream api.v3alpha.DeltaDiscoveryRequest)
       returns (stream api.v3alpha.DeltaDiscoveryResponse) {
diff --git a/api/envoy/service/load_stats/v2/lrs.proto b/api/envoy/service/load_stats/v2/lrs.proto
index fe3e7e977ae52..a82d703de8c36 100644
--- a/api/envoy/service/load_stats/v2/lrs.proto
+++ b/api/envoy/service/load_stats/v2/lrs.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.service.load_stats.v2;
 
-option java_package = "io.envoyproxy.envoy.service.load_stats.v2";
-option java_outer_classname = "LrsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/endpoint/load_report.proto";
 
@@ -14,6 +9,11 @@ import "google/protobuf/duration.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.load_stats.v2";
+option java_outer_classname = "LrsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: Load reporting service]
 
 service LoadReportingService {
diff --git a/api/envoy/service/load_stats/v3alpha/lrs.proto b/api/envoy/service/load_stats/v3alpha/lrs.proto
index 7718b168fb60b..9b68ab4dc197b 100644
--- a/api/envoy/service/load_stats/v3alpha/lrs.proto
+++ b/api/envoy/service/load_stats/v3alpha/lrs.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.service.load_stats.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.service.load_stats.v3alpha";
-option java_outer_classname = "LrsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/api/v3alpha/endpoint/load_report.proto";
 
@@ -16,6 +11,11 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.load_stats.v3alpha";
+option java_outer_classname = "LrsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: Load reporting service]
 
 service LoadReportingService {
diff --git a/api/envoy/service/metrics/v2/metrics_service.proto b/api/envoy/service/metrics/v2/metrics_service.proto
index 28484b22417f1..bfe970971a101 100644
--- a/api/envoy/service/metrics/v2/metrics_service.proto
+++ b/api/envoy/service/metrics/v2/metrics_service.proto
@@ -2,17 +2,17 @@ syntax = "proto3";
 
 package envoy.service.metrics.v2;
 
-option java_package = "io.envoyproxy.envoy.service.metrics.v2";
-option java_outer_classname = "MetricsServiceProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v2/core/base.proto";
 
 import "metrics.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.metrics.v2";
+option java_outer_classname = "MetricsServiceProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // Service for streaming metrics to server that consumes the metrics data. It uses Prometheus metric
 // data model as a standard to represent metrics information.
 service MetricsService {
diff --git a/api/envoy/service/metrics/v3alpha/metrics_service.proto b/api/envoy/service/metrics/v3alpha/metrics_service.proto
index 98d7a5a90ed24..d1069bea69e1d 100644
--- a/api/envoy/service/metrics/v3alpha/metrics_service.proto
+++ b/api/envoy/service/metrics/v3alpha/metrics_service.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.service.metrics.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.service.metrics.v3alpha";
-option java_outer_classname = "MetricsServiceProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 
 import "metrics.proto";
@@ -14,6 +9,11 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.metrics.v3alpha";
+option java_outer_classname = "MetricsServiceProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // Service for streaming metrics to server that consumes the metrics data. It uses Prometheus metric
 // data model as a standard to represent metrics information.
 service MetricsService {
diff --git a/api/envoy/service/ratelimit/v2/rls.proto b/api/envoy/service/ratelimit/v2/rls.proto
index 8c2bb0496f211..5d9b35e0c9ff1 100644
--- a/api/envoy/service/ratelimit/v2/rls.proto
+++ b/api/envoy/service/ratelimit/v2/rls.proto
@@ -2,17 +2,17 @@ syntax = "proto3";
 
 package envoy.service.ratelimit.v2;
 
-option java_package = "io.envoyproxy.envoy.service.ratelimit.v2";
-option java_outer_classname = "RlsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/ratelimit/ratelimit.proto";
 
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.ratelimit.v2";
+option java_outer_classname = "RlsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: Rate Limit Service (RLS)]
 
 service RateLimitService {
diff --git a/api/envoy/service/ratelimit/v3alpha/rls.proto b/api/envoy/service/ratelimit/v3alpha/rls.proto
index 79f06f58af9f8..34389d291ad89 100644
--- a/api/envoy/service/ratelimit/v3alpha/rls.proto
+++ b/api/envoy/service/ratelimit/v3alpha/rls.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.service.ratelimit.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.service.ratelimit.v3alpha";
-option java_outer_classname = "RlsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/api/v3alpha/ratelimit/ratelimit.proto";
 
@@ -14,6 +9,11 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.ratelimit.v3alpha";
+option java_outer_classname = "RlsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: Rate Limit Service (RLS)]
 
 service RateLimitService {
diff --git a/api/envoy/service/tap/v2alpha/common.proto b/api/envoy/service/tap/v2alpha/common.proto
index 098ee6c67298f..a1efca2ed23c5 100644
--- a/api/envoy/service/tap/v2alpha/common.proto
+++ b/api/envoy/service/tap/v2alpha/common.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.service.tap.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.service.tap.v2alpha";
-option java_outer_classname = "CommonProto";
-option java_multiple_files = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/core/grpc_service.proto";
 import "envoy/api/v2/route/route.proto";
@@ -14,6 +10,10 @@ import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.tap.v2alpha";
+option java_outer_classname = "CommonProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Common tap configuration]
 
 // Tap configuration.
diff --git a/api/envoy/service/tap/v2alpha/tap.proto b/api/envoy/service/tap/v2alpha/tap.proto
index bdf461508cbc9..c0d25a1b57e51 100644
--- a/api/envoy/service/tap/v2alpha/tap.proto
+++ b/api/envoy/service/tap/v2alpha/tap.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.service.tap.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.service.tap.v2alpha";
-option java_outer_classname = "TapProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v2/core/base.proto";
 import "envoy/data/tap/v2alpha/wrapper.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.tap.v2alpha";
+option java_outer_classname = "TapProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: Tap Sink Service]
 
 // [#not-implemented-hide:] A tap service to receive incoming taps. Envoy will call
diff --git a/api/envoy/service/tap/v2alpha/tapds.proto b/api/envoy/service/tap/v2alpha/tapds.proto
index 280d848f6a033..6ef1288d13194 100644
--- a/api/envoy/service/tap/v2alpha/tapds.proto
+++ b/api/envoy/service/tap/v2alpha/tapds.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.service.tap.v2alpha;
 
-option java_package = "io.envoyproxy.envoy.service.tap.v2alpha";
-option java_outer_classname = "TapdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v2/discovery.proto";
 import "envoy/service/tap/v2alpha/common.proto";
 
@@ -14,6 +9,11 @@ import "google/api/annotations.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.tap.v2alpha";
+option java_outer_classname = "TapdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: Tap discovery service]
 
 // [#not-implemented-hide:] Tap discovery service.
diff --git a/api/envoy/service/tap/v3alpha/common.proto b/api/envoy/service/tap/v3alpha/common.proto
index dcb1f5ce083e9..e0acc558fd6ec 100644
--- a/api/envoy/service/tap/v3alpha/common.proto
+++ b/api/envoy/service/tap/v3alpha/common.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.service.tap.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.service.tap.v3alpha";
-option java_outer_classname = "CommonProto";
-option java_multiple_files = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/api/v3alpha/core/grpc_service.proto";
 import "envoy/api/v3alpha/route/route.proto";
@@ -16,6 +12,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.tap.v3alpha";
+option java_outer_classname = "CommonProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Common tap configuration]
 
 // Tap configuration.
diff --git a/api/envoy/service/tap/v3alpha/tap.proto b/api/envoy/service/tap/v3alpha/tap.proto
index 4bb11675eed93..5e06510e0298f 100644
--- a/api/envoy/service/tap/v3alpha/tap.proto
+++ b/api/envoy/service/tap/v3alpha/tap.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.service.tap.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.service.tap.v3alpha";
-option java_outer_classname = "TapProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 import "envoy/data/tap/v3alpha/wrapper.proto";
 
@@ -14,6 +9,11 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.tap.v3alpha";
+option java_outer_classname = "TapProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: Tap Sink Service]
 
 // [#not-implemented-hide:] A tap service to receive incoming taps. Envoy will call
diff --git a/api/envoy/service/tap/v3alpha/tapds.proto b/api/envoy/service/tap/v3alpha/tapds.proto
index c4c5962e5bad0..f3ab0d3901ad3 100644
--- a/api/envoy/service/tap/v3alpha/tapds.proto
+++ b/api/envoy/service/tap/v3alpha/tapds.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.service.tap.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.service.tap.v3alpha";
-option java_outer_classname = "TapdsProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v3alpha/discovery.proto";
 import "envoy/service/tap/v3alpha/common.proto";
 
@@ -16,6 +11,11 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.tap.v3alpha";
+option java_outer_classname = "TapdsProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // [#protodoc-title: Tap discovery service]
 
 // [#not-implemented-hide:] Tap discovery service.
diff --git a/api/envoy/service/trace/v2/trace_service.proto b/api/envoy/service/trace/v2/trace_service.proto
index 7396d9752c084..767320387c5cb 100644
--- a/api/envoy/service/trace/v2/trace_service.proto
+++ b/api/envoy/service/trace/v2/trace_service.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.service.trace.v2;
 
-option java_package = "io.envoyproxy.envoy.service.trace.v2";
-option java_outer_classname = "TraceServiceProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v2/core/base.proto";
 
 import "google/api/annotations.proto";
@@ -15,6 +10,11 @@ import "opencensus/proto/trace/v1/trace.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.trace.v2";
+option java_outer_classname = "TraceServiceProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // Service for streaming traces to server that consumes the trace data. It
 // uses OpenCensus data model as a standard to represent trace information.
 service TraceService {
diff --git a/api/envoy/service/trace/v3alpha/trace_service.proto b/api/envoy/service/trace/v3alpha/trace_service.proto
index fbbe174d7f087..9dce4849fb3df 100644
--- a/api/envoy/service/trace/v3alpha/trace_service.proto
+++ b/api/envoy/service/trace/v3alpha/trace_service.proto
@@ -2,11 +2,6 @@ syntax = "proto3";
 
 package envoy.service.trace.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.service.trace.v3alpha";
-option java_outer_classname = "TraceServiceProto";
-option java_multiple_files = true;
-option java_generic_services = true;
-
 import "envoy/api/v3alpha/core/base.proto";
 
 import "google/api/annotations.proto";
@@ -16,6 +11,11 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.service.trace.v3alpha";
+option java_outer_classname = "TraceServiceProto";
+option java_multiple_files = true;
+option java_generic_services = true;
+
 // Service for streaming traces to server that consumes the trace data. It
 // uses OpenCensus data model as a standard to represent trace information.
 service TraceService {
diff --git a/api/envoy/type/hash_policy.proto b/api/envoy/type/hash_policy.proto
index 29950a6599fb3..1e13e60b286b4 100644
--- a/api/envoy/type/hash_policy.proto
+++ b/api/envoy/type/hash_policy.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.type;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.type";
 option java_outer_classname = "HashPolicyProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: Hash Policy]
 
 // Specifies the hash policy
diff --git a/api/envoy/type/http_status.proto b/api/envoy/type/http_status.proto
index 3b99cf0cfe671..1f8ed6f888ff2 100644
--- a/api/envoy/type/http_status.proto
+++ b/api/envoy/type/http_status.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.type;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.type";
 option java_outer_classname = "HttpStatusProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // HTTP response codes supported in Envoy.
 // For more details: https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml
 enum StatusCode {
diff --git a/api/envoy/type/matcher/metadata.proto b/api/envoy/type/matcher/metadata.proto
index 65e478c6a7e8d..4bc9e20932429 100644
--- a/api/envoy/type/matcher/metadata.proto
+++ b/api/envoy/type/matcher/metadata.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.type.matcher;
 
-option java_package = "io.envoyproxy.envoy.type.matcher";
-option java_outer_classname = "MetadataProto";
-option java_multiple_files = true;
-
 import "envoy/type/matcher/value.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.type.matcher";
+option java_outer_classname = "MetadataProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: MetadataMatcher]
 
 // MetadataMatcher provides a general interface to check if a given value is matched in
diff --git a/api/envoy/type/matcher/number.proto b/api/envoy/type/matcher/number.proto
index de00fbed39817..fbcd307248664 100644
--- a/api/envoy/type/matcher/number.proto
+++ b/api/envoy/type/matcher/number.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.type.matcher;
 
-option java_package = "io.envoyproxy.envoy.type.matcher";
-option java_outer_classname = "NumberProto";
-option java_multiple_files = true;
-
 import "envoy/type/range.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.type.matcher";
+option java_outer_classname = "NumberProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: NumberMatcher]
 
 // Specifies the way to match a double value.
diff --git a/api/envoy/type/matcher/regex.proto b/api/envoy/type/matcher/regex.proto
index e3a9d8e23b203..cc2d92209be37 100644
--- a/api/envoy/type/matcher/regex.proto
+++ b/api/envoy/type/matcher/regex.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.type.matcher;
 
-option java_package = "io.envoyproxy.envoy.type.matcher";
-option java_outer_classname = "RegexProto";
-option java_multiple_files = true;
-
 import "google/protobuf/wrappers.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.type.matcher";
+option java_outer_classname = "RegexProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: RegexMatcher]
 
 // A regex matcher designed for safety when used with untrusted input.
diff --git a/api/envoy/type/matcher/string.proto b/api/envoy/type/matcher/string.proto
index ab252d6fa62d9..25331890d14d3 100644
--- a/api/envoy/type/matcher/string.proto
+++ b/api/envoy/type/matcher/string.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.type.matcher;
 
-option java_package = "io.envoyproxy.envoy.type.matcher";
-option java_outer_classname = "StringProto";
-option java_multiple_files = true;
-
 import "envoy/type/matcher/regex.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.type.matcher";
+option java_outer_classname = "StringProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: StringMatcher]
 
 // Specifies the way to match a string.
diff --git a/api/envoy/type/matcher/v3alpha/metadata.proto b/api/envoy/type/matcher/v3alpha/metadata.proto
index 5c00876d57bb5..d46e5afda9fed 100644
--- a/api/envoy/type/matcher/v3alpha/metadata.proto
+++ b/api/envoy/type/matcher/v3alpha/metadata.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.type.matcher.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.type.matcher.v3alpha";
-option java_outer_classname = "MetadataProto";
-option java_multiple_files = true;
-
 import "envoy/type/matcher/v3alpha/value.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.type.matcher.v3alpha";
+option java_outer_classname = "MetadataProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: MetadataMatcher]
 
 // MetadataMatcher provides a general interface to check if a given value is matched in
diff --git a/api/envoy/type/matcher/v3alpha/number.proto b/api/envoy/type/matcher/v3alpha/number.proto
index da26510385b69..071fc9ba5f681 100644
--- a/api/envoy/type/matcher/v3alpha/number.proto
+++ b/api/envoy/type/matcher/v3alpha/number.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.type.matcher.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.type.matcher.v3alpha";
-option java_outer_classname = "NumberProto";
-option java_multiple_files = true;
-
 import "envoy/type/v3alpha/range.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.type.matcher.v3alpha";
+option java_outer_classname = "NumberProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: NumberMatcher]
 
 // Specifies the way to match a double value.
diff --git a/api/envoy/type/matcher/v3alpha/regex.proto b/api/envoy/type/matcher/v3alpha/regex.proto
index 51f296f15bb86..12f483cdb4547 100644
--- a/api/envoy/type/matcher/v3alpha/regex.proto
+++ b/api/envoy/type/matcher/v3alpha/regex.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.type.matcher.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.type.matcher.v3alpha";
-option java_outer_classname = "RegexProto";
-option java_multiple_files = true;
-
 import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.type.matcher.v3alpha";
+option java_outer_classname = "RegexProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: RegexMatcher]
 
 // A regex matcher designed for safety when used with untrusted input.
diff --git a/api/envoy/type/matcher/v3alpha/string.proto b/api/envoy/type/matcher/v3alpha/string.proto
index bba1b6b626854..5fcc83419ed5e 100644
--- a/api/envoy/type/matcher/v3alpha/string.proto
+++ b/api/envoy/type/matcher/v3alpha/string.proto
@@ -2,16 +2,16 @@ syntax = "proto3";
 
 package envoy.type.matcher.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.type.matcher.v3alpha";
-option java_outer_classname = "StringProto";
-option java_multiple_files = true;
-
 import "envoy/type/matcher/v3alpha/regex.proto";
 
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.type.matcher.v3alpha";
+option java_outer_classname = "StringProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: StringMatcher]
 
 // Specifies the way to match a string.
diff --git a/api/envoy/type/matcher/v3alpha/value.proto b/api/envoy/type/matcher/v3alpha/value.proto
index 7268df4716651..3c9adbc71f0bc 100644
--- a/api/envoy/type/matcher/v3alpha/value.proto
+++ b/api/envoy/type/matcher/v3alpha/value.proto
@@ -2,10 +2,6 @@ syntax = "proto3";
 
 package envoy.type.matcher.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.type.matcher.v3alpha";
-option java_outer_classname = "ValueProto";
-option java_multiple_files = true;
-
 import "envoy/type/matcher/v3alpha/number.proto";
 import "envoy/type/matcher/v3alpha/string.proto";
 
@@ -13,6 +9,10 @@ import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.type.matcher.v3alpha";
+option java_outer_classname = "ValueProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: ValueMatcher]
 
 // Specifies the way to match a ProtobufWkt::Value. Primitive values and ListValue are supported.
diff --git a/api/envoy/type/matcher/value.proto b/api/envoy/type/matcher/value.proto
index f68d49afc0fce..5f51cf7ddb2d5 100644
--- a/api/envoy/type/matcher/value.proto
+++ b/api/envoy/type/matcher/value.proto
@@ -2,15 +2,15 @@ syntax = "proto3";
 
 package envoy.type.matcher;
 
-option java_package = "io.envoyproxy.envoy.type.matcher";
-option java_outer_classname = "ValueProto";
-option java_multiple_files = true;
-
 import "envoy/type/matcher/number.proto";
 import "envoy/type/matcher/string.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.type.matcher";
+option java_outer_classname = "ValueProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: ValueMatcher]
 
 // Specifies the way to match a ProtobufWkt::Value. Primitive values and ListValue are supported.
diff --git a/api/envoy/type/metadata/v2/metadata.proto b/api/envoy/type/metadata/v2/metadata.proto
index b1a92beff48cd..401b974824c90 100644
--- a/api/envoy/type/metadata/v2/metadata.proto
+++ b/api/envoy/type/metadata/v2/metadata.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.type.metadata.v2;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.type.metadata.v2";
 option java_outer_classname = "MetadataProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: Metadata]
 
 // MetadataKey provides a general interface using `key` and `path` to retrieve value from
diff --git a/api/envoy/type/percent.proto b/api/envoy/type/percent.proto
index 9c0aa65ad836f..3420342dee2fe 100644
--- a/api/envoy/type/percent.proto
+++ b/api/envoy/type/percent.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.type;
 
+import "validate/validate.proto";
+
 option java_package = "io.envoyproxy.envoy.type";
 option java_outer_classname = "PercentProto";
 option java_multiple_files = true;
 
-import "validate/validate.proto";
-
 // [#protodoc-title: Percent]
 
 // Identifies a percentage, in the range [0.0, 100.0].
diff --git a/api/envoy/type/tracing/v2/custom_tag.proto b/api/envoy/type/tracing/v2/custom_tag.proto
index de3b550d6034c..683a5c536776d 100644
--- a/api/envoy/type/tracing/v2/custom_tag.proto
+++ b/api/envoy/type/tracing/v2/custom_tag.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.type.tracing.v2;
 
-option java_package = "io.envoyproxy.envoy.type.tracing.v2";
-option java_outer_classname = "CustomTagProto";
-option java_multiple_files = true;
-
 import "envoy/type/metadata/v2/metadata.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.type.tracing.v2";
+option java_outer_classname = "CustomTagProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Custom Tag]
 
 // Describes custom tags for the active span.
diff --git a/api/envoy/type/v3alpha/hash_policy.proto b/api/envoy/type/v3alpha/hash_policy.proto
index 06d98be442d96..134f507e0a5da 100644
--- a/api/envoy/type/v3alpha/hash_policy.proto
+++ b/api/envoy/type/v3alpha/hash_policy.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.type.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.type.v3alpha";
-option java_outer_classname = "HashPolicyProto";
-option java_multiple_files = true;
-
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.type.v3alpha";
+option java_outer_classname = "HashPolicyProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Hash Policy]
 
 // Specifies the hash policy
diff --git a/api/envoy/type/v3alpha/http_status.proto b/api/envoy/type/v3alpha/http_status.proto
index 1a29e03dad899..4f32c0562109b 100644
--- a/api/envoy/type/v3alpha/http_status.proto
+++ b/api/envoy/type/v3alpha/http_status.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.type.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.type.v3alpha";
-option java_outer_classname = "HttpStatusProto";
-option java_multiple_files = true;
-
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.type.v3alpha";
+option java_outer_classname = "HttpStatusProto";
+option java_multiple_files = true;
+
 // HTTP response codes supported in Envoy.
 // For more details: https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml
 enum StatusCode {
diff --git a/api/envoy/type/v3alpha/percent.proto b/api/envoy/type/v3alpha/percent.proto
index 56941bff55f88..71f7d3fd157a0 100644
--- a/api/envoy/type/v3alpha/percent.proto
+++ b/api/envoy/type/v3alpha/percent.proto
@@ -2,14 +2,14 @@ syntax = "proto3";
 
 package envoy.type.v3alpha;
 
-option java_package = "io.envoyproxy.envoy.type.v3alpha";
-option java_outer_classname = "PercentProto";
-option java_multiple_files = true;
-
 import "udpa/annotations/versioning.proto";
 
 import "validate/validate.proto";
 
+option java_package = "io.envoyproxy.envoy.type.v3alpha";
+option java_outer_classname = "PercentProto";
+option java_multiple_files = true;
+
 // [#protodoc-title: Percent]
 
 // Identifies a percentage, in the range [0.0, 100.0].
diff --git a/api/envoy/type/v3alpha/range.proto b/api/envoy/type/v3alpha/range.proto
index f8fda4cc28781..350d150716a8d 100644
--- a/api/envoy/type/v3alpha/range.proto
+++ b/api/envoy/type/v3alpha/range.proto
@@ -2,12 +2,12 @@ syntax = "proto3";
 
 package envoy.type.v3alpha;
 
+import "udpa/annotations/versioning.proto";
+
 option java_package = "io.envoyproxy.envoy.type.v3alpha";
 option java_outer_classname = "RangeProto";
 option java_multiple_files = true;
 
-import "udpa/annotations/versioning.proto";
-
 // [#protodoc-title: Range]
 
 // Specifies the int64 start and end of the range using half-open interval semantics [start,
diff --git a/tools/protoxform/protoxform.py b/tools/protoxform/protoxform.py
index 8319e8f57406f..7ebb170a2480d 100755
--- a/tools/protoxform/protoxform.py
+++ b/tools/protoxform/protoxform.py
@@ -223,7 +223,7 @@ def FormatImportBlock(xs):
       map(FormatImportBlock, [envoy_imports, google_imports, misc_imports, infra_imports]))
   comment_block = FormatComments(source_code_info.file_level_comments)
 
-  return ''.join(map(FormatBlock, [file_block, options_block, import_block, comment_block]))
+  return ''.join(map(FormatBlock, [file_block, import_block, options_block, comment_block]))
 
 
 def NormalizeFieldTypeName(type_context, field_fqn):