Standardize Makefile docker/push targets for MCR

Add MCR and VERSION variables. Tag images with full MCR registry URL
and version. Add push target. Fix docker target to build both
Dockerfile.api and Dockerfile.web (was only building one).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ARCHITECTURE.md

@@ -881,6 +881,10 @@ separate binary (`mcr-web`) that communicates with mcrsrv via gRPC.
 - CSRF protection via signed double-submit cookies on all mutating requests.
 - Session cookie: `HttpOnly`, `Secure`, `SameSite=Strict`.
 - All user input escaped by `html/template`.
+- Guest accounts are blocked at login. After MCIAS authentication succeeds,
+  the web UI validates the token and checks roles; accounts with the `guest`
+  role are denied access. This is defense-in-depth alongside the
+  `env:restricted` MCIAS tag.
 
 ---
 
@@ -1059,7 +1063,7 @@ The audit log is append-only. It never contains credentials or token values.
 
 | Threat | Mitigation |
 |--------|------------|
-| Unauthenticated access | All endpoints require MCIAS bearer token; `env:restricted` tag blocks guest/viewer login |
+| Unauthenticated access | All endpoints require MCIAS bearer token; `env:restricted` tag blocks guest/viewer login; web UI additionally rejects `guest` role at login |
 | Unauthorized push/delete | Policy engine enforces per-principal, per-repository access; default-deny for system accounts |
 | Digest mismatch (supply chain) | All uploads verified against client-supplied digest; rejected if mismatch |
 | Blob corruption | Content-addressed storage; digests verified on write. Periodic integrity scrub via `mcrctl scrub` (future) |

CLAUDE.md

@@ -32,7 +32,7 @@ go test ./internal/server -run TestPushManifest
 ## Tech Stack
 
 - **Language:** Go 1.25+, `CGO_ENABLED=0`, statically linked
-- **Module path:** `git.wntrmute.dev/kyle/mcr`
+- **Module path:** `git.wntrmute.dev/mc/mcr`
 - **Database:** SQLite via `modernc.org/sqlite` (pure-Go, no CGo)
 - **Config:** TOML via `go-toml/v2`, env overrides via `MCR_*`
 - **APIs:** REST (chi) + gRPC (protobuf), kept in sync

Makefile

@@ -1,6 +1,8 @@
-.PHONY: build test vet lint proto proto-lint clean docker all devserver
+.PHONY: build test vet lint proto proto-lint clean docker push all devserver
 
-LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(shell git describe --tags --always --dirty)"
+MCR     := mcr.svc.mcp.metacircular.net:8443
+VERSION := $(shell git describe --tags --always --dirty)
+LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(VERSION)"
 
 mcrsrv:
 	CGO_ENABLED=0 go build $(LDFLAGS) -o mcrsrv ./cmd/mcrsrv
@@ -24,8 +26,8 @@ lint:
 	golangci-lint run ./...
 
 proto:
-	protoc --go_out=. --go_opt=module=git.wntrmute.dev/kyle/mcr \
-		--go-grpc_out=. --go-grpc_opt=module=git.wntrmute.dev/kyle/mcr \
+	protoc --go_out=. --go_opt=module=git.wntrmute.dev/mc/mcr \
+		--go-grpc_out=. --go-grpc_opt=module=git.wntrmute.dev/mc/mcr \
 		proto/mcr/v1/*.proto
 
 proto-lint:
@@ -36,7 +38,12 @@ clean:
 	rm -f mcrsrv mcr-web mcrctl
 
 docker:
-	docker build --build-arg VERSION=$(shell git describe --tags --always --dirty) -t mcr -f Dockerfile .
+	docker build --build-arg VERSION=$(VERSION) -t $(MCR)/mcr:$(VERSION) -f Dockerfile.api .
+	docker build --build-arg VERSION=$(VERSION) -t $(MCR)/mcr-web:$(VERSION) -f Dockerfile.web .
+
+push: docker
+	docker push $(MCR)/mcr:$(VERSION)
+	docker push $(MCR)/mcr-web:$(VERSION)
 
 devserver: mcrsrv
 	@mkdir -p srv

PROGRESS.md

@@ -32,6 +32,30 @@ See `PROJECT_PLAN.md` for the implementation roadmap and
 ### Next Steps
 
 1. Deploy to rift (issue MCR service token, generate TLS cert, update mc-proxy routes)
+2. Consider adding roles to MCIAS login response to eliminate the extra ValidateToken round-trip
+
+### 2026-03-26 — Web UI: block guest login
+
+**Task:** Prevent MCIAS guest accounts from logging into the web UI.
+
+**Changes:**
+
+- `internal/webserver/server.go`: Added `ValidateFunc` type; `New()`
+  accepts a validate function to inspect tokens post-login.
+- `internal/webserver/auth.go`: After `loginFn` succeeds, calls
+  `validateFn` to retrieve roles. Rejects accounts with the `guest`
+  role before setting the session cookie.
+- `cmd/mcr-web/main.go`: Wires `ValidateFunc` via `authClient.ValidateToken()`.
+- `internal/webserver/server_test.go`: Added guest/user test accounts,
+  `validateFn` returning role-appropriate responses, `TestLoginDeniesGuest`.
+- `ARCHITECTURE.md`: Updated Web UI security section and threat mitigations
+  to document guest blocking as defense-in-depth.
+
+**Design note:** MCIAS `/v1/auth/login` does not return roles, so the
+web UI makes a second `ValidateToken` call after login to inspect them.
+This is an extra MCIAS round-trip at login time (cached for 30s). A
+future MCIAS change to include roles in the login response would
+eliminate this.
 
 ### 2026-03-25 — Phase 13: Deployment Artifacts
 
@@ -688,7 +712,7 @@ Lint fix:
 entry points with cobra subcommands.
 
 **Changes:**
-- `go.mod`: module `git.wntrmute.dev/kyle/mcr`, Go 1.25, cobra dependency
+- `go.mod`: module `git.wntrmute.dev/mc/mcr`, Go 1.25, cobra dependency
 - Directory skeleton: `cmd/mcrsrv/`, `cmd/mcr-web/`, `cmd/mcrctl/`,
   `internal/`, `proto/mcr/v1/`, `gen/mcr/v1/`, `web/templates/`,
   `web/static/`, `deploy/docker/`, `deploy/examples/`, `deploy/scripts/`,

PROJECT_PLAN.md

@@ -63,7 +63,7 @@ produces a project that builds and lints cleanly with no functionality.
 ### Step 0.1: Go module and directory structure
 
 **Acceptance criteria:**
-- `go.mod` initialized with module path `git.wntrmute.dev/kyle/mcr`
+- `go.mod` initialized with module path `git.wntrmute.dev/mc/mcr`
 - Directory skeleton created per `ARCHITECTURE.md` §13:
   `cmd/mcrsrv/`, `cmd/mcr-web/`, `cmd/mcrctl/`, `internal/`, `proto/mcr/v1/`,
   `gen/mcr/v1/`, `web/`, `deploy/`

README.md

@@ -1,3 +1,59 @@
-MCR is the Metacircular Container Registry
+# MCR
 
-This is a container registry integrated with MCIAS.
+Metacircular Container Registry -- an OCI Distribution Spec-compliant
+container registry for the Metacircular platform. MCR stores and serves
+container images with authentication delegated to MCIAS and a local
+policy engine for fine-grained access control. Metadata is stored in
+SQLite; blobs are stored as content-addressed files on the filesystem.
+
+## Quick Start
+
+Build the binaries:
+
+```bash
+make all
+```
+
+This produces three binaries:
+
+| Binary | Purpose |
+|--------|---------|
+| `mcrsrv` | Registry server (OCI + admin REST + gRPC) |
+| `mcr-web` | Web UI (htmx, communicates with mcrsrv via gRPC) |
+| `mcrctl` | Admin CLI |
+
+Copy and edit the example configuration:
+
+```bash
+cp deploy/examples/mcr.toml /srv/mcr/mcr.toml
+# Edit TLS paths, database path, storage paths, MCIAS URL
+```
+
+Run the server:
+
+```bash
+./mcrsrv server --config /srv/mcr/mcr.toml
+```
+
+The server starts two listeners:
+
+| Port | Protocol | Purpose |
+|------|----------|---------|
+| 8443 | TCP | HTTPS -- OCI Distribution endpoints + admin REST API |
+| 9443 | TCP | gRPC admin API (TLS, MCIAS auth) |
+
+Run the web UI:
+
+```bash
+./mcr-web server --config /srv/mcr/mcr.toml
+```
+
+| Port | Protocol | Purpose |
+|------|----------|---------|
+| 8080 | TCP | HTTP -- web UI (repository browsing, policy management) |
+
+## Documentation
+
+- [ARCHITECTURE.md](ARCHITECTURE.md) -- full technical specification, OCI compliance details, database schema, policy engine, and security model.
+- [RUNBOOK.md](RUNBOOK.md) -- operational procedures, health checks, backup/restore, incident response, and MCP deployment.
+- [CLAUDE.md](CLAUDE.md) -- context for AI-assisted development.

RUNBOOK.md

@@ -0,0 +1,404 @@
+# MCR Runbook
+
+## Service Overview
+
+MCR (Metacircular Container Registry) is an OCI Distribution
+Spec-compliant container registry for the Metacircular platform. It
+stores and serves container images, with authentication delegated to
+MCIAS and a local policy engine for fine-grained access control.
+
+MCR runs as two containers:
+
+- **mcr-api** -- the registry server. Exposes OCI Distribution endpoints
+  and an admin REST API on port 8443 (HTTPS), plus a gRPC admin API on
+  port 9443. Handles blob storage, manifest management, and
+  token-based authentication via MCIAS.
+- **mcr-web** -- the web UI. Communicates with mcr-api via gRPC on port
+  9443. Provides repository/tag browsing and ACL policy management for
+  administrators. Listens on port 8080. Guest accounts are blocked at
+  login; only `admin` and `user` roles can access the web interface.
+
+Both are fronted by MC-Proxy for TLS routing. Metadata is stored in
+SQLite; blobs are stored as content-addressed files on the filesystem
+under `/srv/mcr/layers/`.
+
+## Health Checks
+
+### REST
+
+```bash
+curl -k https://localhost:8443/v1/health
+```
+
+Expected: HTTP 200.
+
+### gRPC
+
+Use the `AdminService.Health` RPC on port 9443. This method is public
+(no auth required).
+
+### OCI Version Check
+
+```bash
+curl -k https://localhost:8443/v2/
+```
+
+Expected: HTTP 401 with `WWW-Authenticate` header (confirms the OCI
+endpoint is alive and responding). An authenticated request returns
+HTTP 200 with `{}`.
+
+### CLI
+
+```bash
+mcrctl status --addr https://localhost:8443
+```
+
+Expected output: `ok`
+
+## Common Operations
+
+### Start the Service (MCP)
+
+1. Deploy via MCP:
+   ```bash
+   mcp deploy mcr
+   ```
+2. Verify health:
+   ```bash
+   curl -k https://localhost:8443/v1/health
+   ```
+
+### Start the Service (Docker Compose)
+
+1. Verify config exists: `ls /srv/mcr/mcr.toml`
+2. Start the containers:
+   ```bash
+   docker compose -f deploy/docker/docker-compose-rift.yml up -d
+   ```
+3. Verify health:
+   ```bash
+   curl -k https://localhost:8443/v1/health
+   ```
+
+### Stop the Service
+
+Via MCP:
+
+```bash
+mcp stop mcr
+```
+
+Via Docker Compose:
+
+```bash
+docker compose -f deploy/docker/docker-compose-rift.yml stop
+```
+
+MCR handles SIGTERM gracefully: it stops accepting new connections,
+drains in-flight requests (including ongoing uploads) for up to 60
+seconds, then force-closes remaining connections and exits.
+
+### Restart the Service
+
+Via MCP:
+
+```bash
+mcp restart mcr
+```
+
+Via Docker Compose:
+
+```bash
+docker compose -f deploy/docker/docker-compose-rift.yml restart
+```
+
+Verify health after restart:
+
+```bash
+curl -k https://localhost:8443/v1/health
+```
+
+### Backup (Snapshot)
+
+MCR backups have two parts: the SQLite database (metadata) and the blob
+filesystem. The database snapshot alone is usable but incomplete --
+missing blobs return 404 on pull.
+
+1. Run the snapshot command:
+   ```bash
+   mcrsrv snapshot --config /srv/mcr/mcr.toml
+   ```
+2. The snapshot is saved to `/srv/mcr/backups/mcr-YYYYMMDD-HHMMSS.db`.
+3. Verify the snapshot file exists and has a reasonable size:
+   ```bash
+   ls -lh /srv/mcr/backups/
+   ```
+4. For a complete backup, also copy the blob directory:
+   ```bash
+   rsync -a /srv/mcr/layers/ /backup/mcr/layers/
+   ```
+
+A systemd timer (`mcr-backup.timer`) runs the database snapshot daily
+at 02:00 UTC with 5-minute jitter.
+
+### Restore from Snapshot
+
+1. Stop the service (see above).
+2. Back up the current database:
+   ```bash
+   cp /srv/mcr/mcr.db /srv/mcr/mcr.db.pre-restore
+   ```
+3. Copy the snapshot into place:
+   ```bash
+   cp /srv/mcr/backups/mcr-YYYYMMDD-HHMMSS.db /srv/mcr/mcr.db
+   ```
+4. If restoring blobs as well:
+   ```bash
+   rsync -a /backup/mcr/layers/ /srv/mcr/layers/
+   ```
+5. Start the service (see above).
+6. Verify the service is healthy:
+   ```bash
+   curl -k https://localhost:8443/v1/health
+   ```
+7. Verify an image pull works:
+   ```bash
+   docker pull mcr.svc.mcp.metacircular.net:8443/<repo>:<tag>
+   ```
+
+### Log Inspection
+
+Container logs (mcr-api):
+
+```bash
+docker compose -f deploy/docker/docker-compose-rift.yml logs --tail 100 mcr-api
+```
+
+Container logs (mcr-web):
+
+```bash
+docker compose -f deploy/docker/docker-compose-rift.yml logs --tail 100 mcr-web
+```
+
+Follow logs in real time:
+
+```bash
+docker compose -f deploy/docker/docker-compose-rift.yml logs -f mcr-api mcr-web
+```
+
+Via MCP:
+
+```bash
+mcp logs mcr
+```
+
+MCR logs to stderr as structured text (slog). Log level is configured
+via `[log] level` in `mcr.toml` (debug, info, warn, error).
+
+### Garbage Collection
+
+Garbage collection removes unreferenced blobs -- blobs no longer
+referenced by any manifest. GC acquires a registry-wide lock that
+blocks new blob uploads for the duration of the mark-and-sweep phase.
+Pulls are not blocked.
+
+1. Trigger GC via CLI:
+   ```bash
+   mcrctl gc --addr https://mcr.svc.mcp.metacircular.net:8443
+   ```
+2. Check GC status:
+   ```bash
+   mcrctl gc status --addr https://mcr.svc.mcp.metacircular.net:8443
+   ```
+3. GC can also be triggered via the REST API:
+   ```bash
+   curl -k -X POST -H "Authorization: Bearer <token>" https://localhost:8443/v1/gc
+   ```
+
+If a previous GC crashed after the database sweep but before filesystem
+cleanup, orphaned files may remain on disk. Run reconciliation to clean
+them up:
+
+```bash
+mcrctl gc --reconcile --addr https://mcr.svc.mcp.metacircular.net:8443
+```
+
+## Incident Procedures
+
+### Database Corruption
+
+Symptoms: server fails to start with SQLite errors, or API requests
+return unexpected errors.
+
+1. Stop the service.
+2. Check for WAL/SHM files alongside the database:
+   ```bash
+   ls -la /srv/mcr/mcr.db*
+   ```
+3. Attempt an integrity check:
+   ```bash
+   sqlite3 /srv/mcr/mcr.db "PRAGMA integrity_check;"
+   ```
+4. If integrity check fails, restore from the most recent snapshot:
+   ```bash
+   cp /srv/mcr/mcr.db /srv/mcr/mcr.db.corrupt
+   cp /srv/mcr/backups/mcr-YYYYMMDD-HHMMSS.db /srv/mcr/mcr.db
+   ```
+5. Start the service and verify health.
+6. Note: blobs on the filesystem are unaffected by database corruption.
+   Images pushed after the snapshot was taken will be missing from
+   metadata. Their blobs remain on disk and will be cleaned up by GC
+   unless the metadata is re-created.
+
+### TLS Certificate Expiry
+
+Symptoms: health check fails with TLS errors, Docker clients get
+certificate verification errors on push/pull.
+
+1. Check certificate expiry:
+   ```bash
+   openssl x509 -in /srv/mcr/certs/cert.pem -noout -enddate
+   ```
+2. Replace the certificate and key files at the paths configured in
+   `mcr.toml` (`[server] tls_cert` and `tls_key`).
+3. Restart the service to load the new certificate.
+4. Verify health:
+   ```bash
+   curl -k https://localhost:8443/v1/health
+   ```
+
+### MCIAS Outage
+
+Symptoms: push/pull fails with 401 or 502 errors. Authentication
+cannot complete.
+
+1. Confirm MCIAS is unreachable:
+   ```bash
+   curl -k https://svc.metacircular.net:8443/v1/health
+   ```
+2. Cached token validation results remain valid for up to 30 seconds
+   after the last successful MCIAS check. Operations using
+   recently-validated tokens may continue briefly.
+3. Once cached tokens expire, all authenticated operations (push, pull,
+   catalog, admin) will fail until MCIAS recovers.
+4. The OCI `/v2/` version check endpoint still responds (confirms MCR
+   itself is running).
+5. Escalate to MCIAS (see Escalation below).
+
+### Disk Full
+
+Symptoms: blob uploads fail, database writes fail, container may crash.
+
+1. Check disk usage:
+   ```bash
+   df -h /srv/mcr/
+   du -sh /srv/mcr/layers/ /srv/mcr/uploads/ /srv/mcr/mcr.db
+   ```
+2. Clean up stale uploads:
+   ```bash
+   ls -la /srv/mcr/uploads/
+   ```
+   Remove upload files that are old and have no matching in-progress
+   upload in the database.
+3. Run garbage collection to reclaim unreferenced blobs:
+   ```bash
+   mcrctl gc --addr https://mcr.svc.mcp.metacircular.net:8443
+   ```
+4. If GC does not free enough space, identify large repositories:
+   ```bash
+   mcrctl repo list --addr https://mcr.svc.mcp.metacircular.net:8443
+   ```
+5. Delete unused tags or repositories to free space, then run GC again.
+6. If the disk is completely full and the service cannot start, manually
+   remove orphaned files from `/srv/mcr/uploads/` to free enough space
+   for the service to start, then run GC.
+
+### Image Push/Pull Failures
+
+Symptoms: `docker push` or `docker pull` returns errors.
+
+1. Verify the service is running and healthy:
+   ```bash
+   curl -k https://localhost:8443/v1/health
+   ```
+2. Test OCI endpoint:
+   ```bash
+   curl -k https://localhost:8443/v2/
+   ```
+   Expected: HTTP 401 with `WWW-Authenticate` header.
+3. Test authentication:
+   ```bash
+   curl -k -u username:password https://localhost:8443/v2/token?service=mcr
+   ```
+   Expected: HTTP 200 with a token response.
+4. Check if the issue is policy-related (403 Denied):
+   ```bash
+   mcrctl policy list --addr https://mcr.svc.mcp.metacircular.net:8443
+   ```
+   Review policy rules for the affected account and repository.
+5. Check audit log for denied requests:
+   ```bash
+   mcrctl audit tail --n 20 --addr https://mcr.svc.mcp.metacircular.net:8443
+   ```
+6. For push failures, verify all referenced blobs exist before pushing
+   the manifest. The error `MANIFEST_BLOB_UNKNOWN` means a layer was
+   not uploaded before the manifest push.
+7. Check logs for detailed error information:
+   ```bash
+   docker compose -f deploy/docker/docker-compose-rift.yml logs --tail 50 mcr-api
+   ```
+
+## MCP Deployment
+
+MCR is deployed via MCP as a two-component service on the `rift` node.
+
+### Service Definition
+
+```toml
+name = "mcr"
+node = "rift"
+active = true
+
+[[components]]
+name = "api"
+image = "mcr.svc.mcp.metacircular.net:8443/mcr:v1.1.0"
+network = "mcpnet"
+user = "0:0"
+restart = "unless-stopped"
+ports = ["127.0.0.1:28443:8443", "127.0.0.1:29443:9443"]
+volumes = ["/srv/mcr:/srv/mcr"]
+cmd = ["server", "--config", "/srv/mcr/mcr.toml"]
+
+[[components]]
+name = "web"
+image = "mcr.svc.mcp.metacircular.net:8443/mcr-web:v1.1.0"
+network = "mcpnet"
+user = "0:0"
+restart = "unless-stopped"
+ports = ["127.0.0.1:28080:8080"]
+volumes = ["/srv/mcr:/srv/mcr"]
+cmd = ["server", "--config", "/srv/mcr/mcr.toml"]
+```
+
+### Port Mapping
+
+| Component | Container Port | Host Port | Purpose |
+|-----------|---------------|-----------|---------|
+| mcr-api | 8443 | 28443 | HTTPS (OCI + admin REST) |
+| mcr-api | 9443 | 29443 | gRPC admin API |
+| mcr-web | 8080 | 28080 | Web UI (HTTP, behind MC-Proxy) |
+
+Both containers share the `/srv/mcr` volume for configuration, database,
+and blob storage. They are connected to the `mcpnet` Docker network.
+
+## Escalation
+
+Escalate when:
+
+- Database corruption cannot be resolved by restoring a snapshot.
+- MCIAS is down and registry operations are urgently needed.
+- Disk full cannot be resolved by GC and cleanup.
+- Push/pull failures persist after following the procedures above.
+- Any issue not covered by this runbook.
+
+Escalation path: Kyle (platform owner).

cmd/mcr-web/main.go

@@ -17,10 +17,10 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 
-	mcrv1 "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/config"
-	"git.wntrmute.dev/kyle/mcr/internal/webserver"
+	mcrv1 "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/config"
+	"git.wntrmute.dev/mc/mcr/internal/webserver"
 )
 
 var version = "dev"
@@ -99,6 +99,14 @@ func runServer(configPath string) error {
 		return authClient.Login(username, password)
 	}
 
+	validateFn := func(token string) ([]string, error) {
+		claims, err := authClient.ValidateToken(token)
+		if err != nil {
+			return nil, err
+		}
+		return claims.Roles, nil
+	}
+
 	// Generate CSRF key.
 	csrfKey := make([]byte, 32)
 	if _, err := rand.Read(csrfKey); err != nil {
@@ -106,7 +114,7 @@ func runServer(configPath string) error {
 	}
 
 	// Create web server.
-	srv, err := webserver.New(registryClient, policyClient, auditClient, adminClient, loginFn, csrfKey)
+	srv, err := webserver.New(registryClient, policyClient, auditClient, adminClient, loginFn, validateFn, csrfKey)
 	if err != nil {
 		return fmt.Errorf("create web server: %w", err)
 	}
@@ -162,6 +170,7 @@ func runServer(configPath string) error {
 func dialGRPC(cfg *config.Config) (*grpc.ClientConn, error) {
 	tlsCfg := &tls.Config{
 		MinVersion: tls.VersionTLS13,
+		ServerName: cfg.Web.TLSServerName,
 	}
 
 	if cfg.Web.CACert != "" {

cmd/mcrctl/client.go

@@ -14,7 +14,7 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 
-	mcrv1 "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	mcrv1 "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
 )
 
 // apiClient wraps both REST and gRPC transports. When grpcAddr is set

cmd/mcrctl/main.go

@@ -11,7 +11,7 @@ import (
 
 	"github.com/spf13/cobra"
 
-	mcrv1 "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	mcrv1 "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
 )
 
 var version = "dev"
@@ -62,6 +62,7 @@ func main() {
 	root.AddCommand(statusCmd())
 	root.AddCommand(repoCmd())
 	root.AddCommand(gcCmd())
+	root.AddCommand(purgeCmd())
 	root.AddCommand(policyCmd())
 	root.AddCommand(auditCmd())
 	root.AddCommand(snapshotCmd())

cmd/mcrctl/purge.go

@@ -0,0 +1,274 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path"
+	"sort"
+	"strings"
+
+	"github.com/spf13/cobra"
+
+	mcrv1 "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
+)
+
+func purgeCmd() *cobra.Command {
+	var (
+		keep    int
+		repo    string
+		dryRun  bool
+		trigGC  bool
+	)
+
+	cmd := &cobra.Command{
+		Use:   "purge",
+		Short: "Remove old image tags, keeping the last N per repository",
+		Long: `Purge removes old image tags from repositories based on a retention
+policy. The 'latest' tag is always kept. For each repository, tags are
+sorted by updated_at (most recent first) and only the --keep most recent
+are retained. Remaining tags' manifests are deleted, cascading to their
+tag references. Run with --gc to trigger garbage collection afterward.`,
+		RunE: func(_ *cobra.Command, _ []string) error {
+			return runPurge(keep, repo, dryRun, trigGC)
+		},
+	}
+
+	cmd.Flags().IntVar(&keep, "keep", 3, "number of tags to keep per repo (excluding latest)")
+	cmd.Flags().StringVar(&repo, "repo", "", "limit to repositories matching this glob pattern")
+	cmd.Flags().BoolVar(&dryRun, "dry-run", false, "show what would be deleted without deleting")
+	cmd.Flags().BoolVar(&trigGC, "gc", false, "trigger garbage collection after purging")
+
+	return cmd
+}
+
+// tagWithTime is a tag with its timestamp for sorting.
+type tagWithTime struct {
+	Name      string
+	Digest    string
+	UpdatedAt string
+}
+
+func runPurge(keep int, repoPattern string, dryRun, trigGC bool) error {
+	if keep < 0 {
+		return fmt.Errorf("--keep must be non-negative")
+	}
+
+	// List repositories.
+	repos, err := listRepos()
+	if err != nil {
+		return err
+	}
+
+	// Filter by pattern if given.
+	if repoPattern != "" {
+		var filtered []string
+		for _, r := range repos {
+			matched, _ := path.Match(repoPattern, r)
+			if matched {
+				filtered = append(filtered, r)
+			}
+		}
+		repos = filtered
+	}
+
+	if len(repos) == 0 {
+		_, _ = fmt.Fprintln(os.Stdout, "No repositories matched.")
+		return nil
+	}
+
+	totalDeleted := 0
+
+	for _, repoName := range repos {
+		tags, err := listTagsWithTime(repoName)
+		if err != nil {
+			_, _ = fmt.Fprintf(os.Stderr, "warning: skipping %s: %v\n", repoName, err)
+			continue
+		}
+
+		// Separate latest from versioned tags.
+		var latest *tagWithTime
+		var versioned []tagWithTime
+		for _, t := range tags {
+			if t.Name == "latest" {
+				lt := t
+				latest = &lt
+			} else {
+				versioned = append(versioned, t)
+			}
+		}
+
+		// Sort by updated_at descending (most recent first).
+		sort.Slice(versioned, func(i, j int) bool {
+			return versioned[i].UpdatedAt > versioned[j].UpdatedAt
+		})
+
+		// Determine which tags to delete.
+		if len(versioned) <= keep {
+			continue // nothing to purge
+		}
+
+		toDelete := versioned[keep:]
+
+		// Build set of digests that are still referenced by kept tags.
+		keptDigests := make(map[string]bool)
+		if latest != nil {
+			keptDigests[latest.Digest] = true
+		}
+		for _, t := range versioned[:keep] {
+			keptDigests[t.Digest] = true
+		}
+
+		for _, t := range toDelete {
+			if keptDigests[t.Digest] {
+				// Manifest is shared with a kept tag — skip deletion.
+				if dryRun {
+					_, _ = fmt.Fprintf(os.Stdout, "[skip]   %s:%s (manifest shared with kept tag)\n", repoName, t.Name)
+				}
+				continue
+			}
+
+			if dryRun {
+				_, _ = fmt.Fprintf(os.Stdout, "[delete] %s:%s (digest: %s, updated: %s)\n", repoName, t.Name, t.Digest[:12], t.UpdatedAt)
+			} else {
+				if err := deleteManifest(repoName, t.Digest); err != nil {
+					_, _ = fmt.Fprintf(os.Stderr, "warning: failed to delete %s:%s: %v\n", repoName, t.Name, err)
+					continue
+				}
+				_, _ = fmt.Fprintf(os.Stdout, "deleted %s:%s\n", repoName, t.Name)
+			}
+			totalDeleted++
+		}
+	}
+
+	if dryRun {
+		_, _ = fmt.Fprintf(os.Stdout, "\nDry run: %d manifests would be deleted.\n", totalDeleted)
+	} else {
+		_, _ = fmt.Fprintf(os.Stdout, "\nPurged %d manifests.\n", totalDeleted)
+	}
+
+	// Trigger GC if requested and not a dry run.
+	if trigGC && !dryRun && totalDeleted > 0 {
+		_, _ = fmt.Fprintln(os.Stdout, "Triggering garbage collection...")
+		if err := triggerGC(); err != nil {
+			return fmt.Errorf("gc: %w", err)
+		}
+		_, _ = fmt.Fprintln(os.Stdout, "Garbage collection started.")
+	}
+
+	return nil
+}
+
+// listRepos returns all repository names.
+func listRepos() ([]string, error) {
+	if client.useGRPC() {
+		resp, err := client.registry.ListRepositories(context.Background(), &mcrv1.ListRepositoriesRequest{})
+		if err != nil {
+			return nil, fmt.Errorf("list repositories: %w", err)
+		}
+		var names []string
+		for _, r := range resp.GetRepositories() {
+			names = append(names, r.GetName())
+		}
+		return names, nil
+	}
+
+	data, err := client.restDo("GET", "/v1/repositories", nil)
+	if err != nil {
+		return nil, fmt.Errorf("list repositories: %w", err)
+	}
+
+	var repos []struct {
+		Name string `json:"name"`
+	}
+	if err := json.Unmarshal(data, &repos); err != nil {
+		return nil, err
+	}
+
+	var names []string
+	for _, r := range repos {
+		names = append(names, r.Name)
+	}
+	return names, nil
+}
+
+// listTagsWithTime returns tags with timestamps for a repository.
+func listTagsWithTime(repoName string) ([]tagWithTime, error) {
+	if client.useGRPC() {
+		resp, err := client.registry.GetRepository(context.Background(), &mcrv1.GetRepositoryRequest{Name: repoName})
+		if err != nil {
+			return nil, fmt.Errorf("get repository: %w", err)
+		}
+		var tags []tagWithTime
+		for _, t := range resp.GetTags() {
+			tags = append(tags, tagWithTime{
+				Name:      t.GetName(),
+				Digest:    t.GetDigest(),
+				UpdatedAt: t.GetUpdatedAt(),
+			})
+		}
+		return tags, nil
+	}
+
+	data, err := client.restDo("GET", "/v1/repositories/"+repoName, nil)
+	if err != nil {
+		return nil, fmt.Errorf("get repository: %w", err)
+	}
+
+	var detail struct {
+		Tags []struct {
+			Name      string `json:"name"`
+			Digest    string `json:"digest"`
+			UpdatedAt string `json:"updated_at"`
+		} `json:"tags"`
+	}
+	if err := json.Unmarshal(data, &detail); err != nil {
+		return nil, err
+	}
+
+	var tags []tagWithTime
+	for _, t := range detail.Tags {
+		tags = append(tags, tagWithTime{
+			Name:      t.Name,
+			Digest:    t.Digest,
+			UpdatedAt: t.UpdatedAt,
+		})
+	}
+	return tags, nil
+}
+
+// deleteManifest deletes a manifest by digest via the OCI API.
+func deleteManifest(repoName, digest string) error {
+	if client.useGRPC() {
+		// No gRPC RPC for OCI manifest delete — fall back to REST.
+		// The OCI Distribution spec uses DELETE /v2/{name}/manifests/{reference}.
+	}
+
+	// URL-encode the repo name for path segments with slashes.
+	_, err := client.restDo("DELETE", "/v2/"+repoName+"/manifests/"+digest, nil)
+	return err
+}
+
+// triggerGC starts garbage collection.
+func triggerGC() error {
+	if client.useGRPC() {
+		_, err := client.registry.GarbageCollect(context.Background(), &mcrv1.GarbageCollectRequest{})
+		return err
+	}
+
+	_, err := client.restDo("POST", "/v1/gc", nil)
+	return err
+}
+
+// formatRepoName truncates long repo names for display.
+func formatRepoName(name string, maxLen int) string {
+	if len(name) <= maxLen {
+		return name
+	}
+	parts := strings.Split(name, "/")
+	if len(parts) > 1 {
+		return "..." + parts[len(parts)-1]
+	}
+	return name[:maxLen-3] + "..."
+}

cmd/mcrsrv/main.go

@@ -16,17 +16,17 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/config"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/gc"
-	"git.wntrmute.dev/kyle/mcr/internal/oci"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
-	"git.wntrmute.dev/kyle/mcr/internal/server"
-	"git.wntrmute.dev/kyle/mcr/internal/storage"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/config"
+	"git.wntrmute.dev/mc/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/gc"
+	"git.wntrmute.dev/mc/mcr/internal/oci"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/server"
+	"git.wntrmute.dev/mc/mcr/internal/storage"
 
-	"git.wntrmute.dev/kyle/mcr/internal/grpcserver"
-	mcdsldb "git.wntrmute.dev/kyle/mcdsl/db"
+	"git.wntrmute.dev/mc/mcr/internal/grpcserver"
+	mcdsldb "git.wntrmute.dev/mc/mcdsl/db"
 )
 
 var version = "dev"

deploy/examples/mcr.toml

@@ -25,9 +25,10 @@ service_name = "mcr"
 tags         = ["env:restricted"]
 
 [web]
-listen_addr = "127.0.0.1:8080"      # Web UI listen address
-grpc_addr   = "127.0.0.1:9443"      # mcrsrv gRPC address for the web UI
-ca_cert     = ""                     # CA cert for verifying mcrsrv gRPC TLS
+listen_addr     = "127.0.0.1:8080"  # Web UI listen address
+grpc_addr       = "127.0.0.1:9443"  # mcrsrv gRPC address for the web UI
+tls_server_name = ""                # Override TLS server name (when dial address differs from cert SAN)
+ca_cert         = ""                # CA cert for verifying mcrsrv gRPC TLS
 
 [log]
 level = "info"                       # debug, info, warn, error

deploy/mcr-rift.toml

@@ -30,9 +30,10 @@ service_name  = "mcr"
 service_token = "eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL21jaWFzLm1ldGFjaXJjdWxhci5uZXQiLCJzdWIiOiIwYWM3NDk3ZS0wZTE5LTRhOWMtYWI3Yi03YWZjMzc0ZDU3NzIiLCJleHAiOjE4MDYwMzczNzMsIm5iZiI6MTc3NDUwMTM3MywiaWF0IjoxNzc0NTAxMzczLCJqdGkiOiI1NTM0ZDU0OS1kYzY5LTRiNzctYTY5MC0xNzQ3NjE0MDUzYzEiLCJyb2xlcyI6bnVsbH0.bsnoGMrFzJJCIanGuiAvpqmlO2OssvFjYynQgiSt_TPMuLxziRuwuRIL9C_kRnHdF7C6c1mTHncKVj1hkLPiCg"
 
 [web]
-listen_addr = ":8080"
-grpc_addr   = "mcr:9443"
-ca_cert     = "/srv/mcr/certs/ca.pem"
+listen_addr     = ":8080"
+grpc_addr       = "mcr-api:9443"
+tls_server_name = "mcr.svc.mcp.metacircular.net"
+ca_cert         = "/srv/mcr/certs/ca.pem"
 
 [log]
 level = "info"

flake.nix

@@ -10,7 +10,7 @@
     let
       system = "x86_64-linux";
       pkgs = nixpkgs.legacyPackages.${system};
-      version = "0.1.0";
+      version = "1.2.0";
     in
     {
       packages.${system} = {

gen/mcr/v1/admin.pb.go

@@ -1,14 +1,97 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.32.1
 // source: mcr/v1/admin.proto
 
 package mcrv1
 
-// HealthRequest is the request message for Health.
-type HealthRequest struct{}
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type HealthRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *HealthRequest) Reset() {
+	*x = HealthRequest{}
+	mi := &file_mcr_v1_admin_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *HealthRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HealthRequest) ProtoMessage() {}
+
+func (x *HealthRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_admin_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HealthRequest.ProtoReflect.Descriptor instead.
+func (*HealthRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_admin_proto_rawDescGZIP(), []int{0}
+}
 
-// HealthResponse is the response message for Health.
 type HealthResponse struct {
-	Status string `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Status        string                 `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *HealthResponse) Reset() {
+	*x = HealthResponse{}
+	mi := &file_mcr_v1_admin_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *HealthResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HealthResponse) ProtoMessage() {}
+
+func (x *HealthResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_admin_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HealthResponse.ProtoReflect.Descriptor instead.
+func (*HealthResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_admin_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *HealthResponse) GetStatus() string {
@@ -17,3 +100,65 @@ func (x *HealthResponse) GetStatus() string {
 	}
 	return ""
 }
+
+var File_mcr_v1_admin_proto protoreflect.FileDescriptor
+
+const file_mcr_v1_admin_proto_rawDesc = "" +
+	"\n" +
+	"\x12mcr/v1/admin.proto\x12\x06mcr.v1\"\x0f\n" +
+	"\rHealthRequest\"(\n" +
+	"\x0eHealthResponse\x12\x16\n" +
+	"\x06status\x18\x01 \x01(\tR\x06status2G\n" +
+	"\fAdminService\x127\n" +
+	"\x06Health\x12\x15.mcr.v1.HealthRequest\x1a\x16.mcr.v1.HealthResponseB*Z(git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1b\x06proto3"
+
+var (
+	file_mcr_v1_admin_proto_rawDescOnce sync.Once
+	file_mcr_v1_admin_proto_rawDescData []byte
+)
+
+func file_mcr_v1_admin_proto_rawDescGZIP() []byte {
+	file_mcr_v1_admin_proto_rawDescOnce.Do(func() {
+		file_mcr_v1_admin_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_mcr_v1_admin_proto_rawDesc), len(file_mcr_v1_admin_proto_rawDesc)))
+	})
+	return file_mcr_v1_admin_proto_rawDescData
+}
+
+var file_mcr_v1_admin_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_mcr_v1_admin_proto_goTypes = []any{
+	(*HealthRequest)(nil),  // 0: mcr.v1.HealthRequest
+	(*HealthResponse)(nil), // 1: mcr.v1.HealthResponse
+}
+var file_mcr_v1_admin_proto_depIdxs = []int32{
+	0, // 0: mcr.v1.AdminService.Health:input_type -> mcr.v1.HealthRequest
+	1, // 1: mcr.v1.AdminService.Health:output_type -> mcr.v1.HealthResponse
+	1, // [1:2] is the sub-list for method output_type
+	0, // [0:1] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_mcr_v1_admin_proto_init() }
+func file_mcr_v1_admin_proto_init() {
+	if File_mcr_v1_admin_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_mcr_v1_admin_proto_rawDesc), len(file_mcr_v1_admin_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_mcr_v1_admin_proto_goTypes,
+		DependencyIndexes: file_mcr_v1_admin_proto_depIdxs,
+		MessageInfos:      file_mcr_v1_admin_proto_msgTypes,
+	}.Build()
+	File_mcr_v1_admin_proto = out.File
+	file_mcr_v1_admin_proto_goTypes = nil
+	file_mcr_v1_admin_proto_depIdxs = nil
+}

gen/mcr/v1/admin_grpc.pb.go

@@ -1,38 +1,92 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             v6.32.1
 // source: mcr/v1/admin.proto
 
 package mcrv1
 
 import (
-	"context"
-
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
 )
 
-// AdminServiceServer is the server API for AdminService.
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	AdminService_Health_FullMethodName = "/mcr.v1.AdminService/Health"
+)
+
+// AdminServiceClient is the client API for AdminService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type AdminServiceClient interface {
+	Health(ctx context.Context, in *HealthRequest, opts ...grpc.CallOption) (*HealthResponse, error)
+}
+
+type adminServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewAdminServiceClient(cc grpc.ClientConnInterface) AdminServiceClient {
+	return &adminServiceClient{cc}
+}
+
+func (c *adminServiceClient) Health(ctx context.Context, in *HealthRequest, opts ...grpc.CallOption) (*HealthResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(HealthResponse)
+	err := c.cc.Invoke(ctx, AdminService_Health_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// AdminServiceServer is the server API for AdminService service.
+// All implementations must embed UnimplementedAdminServiceServer
+// for forward compatibility.
 type AdminServiceServer interface {
 	Health(context.Context, *HealthRequest) (*HealthResponse, error)
 	mustEmbedUnimplementedAdminServiceServer()
 }
 
-// UnimplementedAdminServiceServer should be embedded to have forward
-// compatible implementations.
+// UnimplementedAdminServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
 type UnimplementedAdminServiceServer struct{}
 
 func (UnimplementedAdminServiceServer) Health(context.Context, *HealthRequest) (*HealthResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Health not implemented")
+	return nil, status.Error(codes.Unimplemented, "method Health not implemented")
+}
+func (UnimplementedAdminServiceServer) mustEmbedUnimplementedAdminServiceServer() {}
+func (UnimplementedAdminServiceServer) testEmbeddedByValue()                      {}
+
+// UnsafeAdminServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to AdminServiceServer will
+// result in compilation errors.
+type UnsafeAdminServiceServer interface {
+	mustEmbedUnimplementedAdminServiceServer()
 }
 
-func (UnimplementedAdminServiceServer) mustEmbedUnimplementedAdminServiceServer() {}
-
-// RegisterAdminServiceServer registers the AdminServiceServer with the grpc.Server.
 func RegisterAdminServiceServer(s grpc.ServiceRegistrar, srv AdminServiceServer) {
+	// If the following call panics, it indicates UnimplementedAdminServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&AdminService_ServiceDesc, srv)
 }
 
-func adminServiceHealthHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
+func _AdminService_Health_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(HealthRequest)
 	if err := dec(in); err != nil {
 		return nil, err
@@ -42,47 +96,26 @@ func adminServiceHealthHandler(srv any, ctx context.Context, dec func(any) error
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/mcr.v1.AdminService/Health",
+		FullMethod: AdminService_Health_FullMethodName,
 	}
-	handler := func(ctx context.Context, req any) (any, error) {
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(AdminServiceServer).Health(ctx, req.(*HealthRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
 
-// AdminService_ServiceDesc is the grpc.ServiceDesc for AdminService.
+// AdminService_ServiceDesc is the grpc.ServiceDesc for AdminService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
 var AdminService_ServiceDesc = grpc.ServiceDesc{
 	ServiceName: "mcr.v1.AdminService",
 	HandlerType: (*AdminServiceServer)(nil),
 	Methods: []grpc.MethodDesc{
 		{
 			MethodName: "Health",
-			Handler:    adminServiceHealthHandler,
+			Handler:    _AdminService_Health_Handler,
 		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "mcr/v1/admin.proto",
 }
-
-// AdminServiceClient is the client API for AdminService.
-type AdminServiceClient interface {
-	Health(ctx context.Context, in *HealthRequest, opts ...grpc.CallOption) (*HealthResponse, error)
-}
-
-type adminServiceClient struct {
-	cc grpc.ClientConnInterface
-}
-
-// NewAdminServiceClient creates a new AdminServiceClient.
-func NewAdminServiceClient(cc grpc.ClientConnInterface) AdminServiceClient {
-	return &adminServiceClient{cc}
-}
-
-func (c *adminServiceClient) Health(ctx context.Context, in *HealthRequest, opts ...grpc.CallOption) (*HealthResponse, error) {
-	out := new(HealthResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.AdminService/Health", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}

gen/mcr/v1/audit.pb.go

@@ -1,18 +1,68 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.32.1
 // source: mcr/v1/audit.proto
 
 package mcrv1
 
-// AuditEvent represents an audit log entry.
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
 type AuditEvent struct {
-	Id        int64             `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`               //nolint:revive,stylecheck // proto field name
-	EventTime string            `protobuf:"bytes,2,opt,name=event_time,json=eventTime,proto3" json:"event_time,omitempty"`
-	EventType string            `protobuf:"bytes,3,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"`
-	ActorId   string            `protobuf:"bytes,4,opt,name=actor_id,json=actorId,proto3" json:"actor_id,omitempty"`       //nolint:revive,stylecheck // proto field name
-	Repository string           `protobuf:"bytes,5,opt,name=repository,proto3" json:"repository,omitempty"`
-	Digest    string            `protobuf:"bytes,6,opt,name=digest,proto3" json:"digest,omitempty"`
-	IpAddress string            `protobuf:"bytes,7,opt,name=ip_address,json=ipAddress,proto3" json:"ip_address,omitempty"` //nolint:revive,stylecheck // proto field name
-	Details   map[string]string `protobuf:"bytes,8,rep,name=details,proto3" json:"details,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Id            int64                  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	EventTime     string                 `protobuf:"bytes,2,opt,name=event_time,json=eventTime,proto3" json:"event_time,omitempty"`
+	EventType     string                 `protobuf:"bytes,3,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"`
+	ActorId       string                 `protobuf:"bytes,4,opt,name=actor_id,json=actorId,proto3" json:"actor_id,omitempty"`
+	Repository    string                 `protobuf:"bytes,5,opt,name=repository,proto3" json:"repository,omitempty"`
+	Digest        string                 `protobuf:"bytes,6,opt,name=digest,proto3" json:"digest,omitempty"`
+	IpAddress     string                 `protobuf:"bytes,7,opt,name=ip_address,json=ipAddress,proto3" json:"ip_address,omitempty"`
+	Details       map[string]string      `protobuf:"bytes,8,rep,name=details,proto3" json:"details,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AuditEvent) Reset() {
+	*x = AuditEvent{}
+	mi := &file_mcr_v1_audit_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AuditEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuditEvent) ProtoMessage() {}
+
+func (x *AuditEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_audit_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuditEvent.ProtoReflect.Descriptor instead.
+func (*AuditEvent) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_audit_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *AuditEvent) GetId() int64 {
@@ -71,14 +121,46 @@ func (x *AuditEvent) GetDetails() map[string]string {
 	return nil
 }
 
-// ListAuditEventsRequest is the request message for ListAuditEvents.
 type ListAuditEventsRequest struct {
-	Pagination *PaginationRequest `protobuf:"bytes,1,opt,name=pagination,proto3" json:"pagination,omitempty"`
-	EventType  string             `protobuf:"bytes,2,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"`
-	ActorId    string             `protobuf:"bytes,3,opt,name=actor_id,json=actorId,proto3" json:"actor_id,omitempty"` //nolint:revive,stylecheck // proto field name
-	Repository string             `protobuf:"bytes,4,opt,name=repository,proto3" json:"repository,omitempty"`
-	Since      string             `protobuf:"bytes,5,opt,name=since,proto3" json:"since,omitempty"`
-	Until      string             `protobuf:"bytes,6,opt,name=until,proto3" json:"until,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Pagination    *PaginationRequest     `protobuf:"bytes,1,opt,name=pagination,proto3" json:"pagination,omitempty"`
+	EventType     string                 `protobuf:"bytes,2,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"`
+	ActorId       string                 `protobuf:"bytes,3,opt,name=actor_id,json=actorId,proto3" json:"actor_id,omitempty"`
+	Repository    string                 `protobuf:"bytes,4,opt,name=repository,proto3" json:"repository,omitempty"`
+	Since         string                 `protobuf:"bytes,5,opt,name=since,proto3" json:"since,omitempty"`
+	Until         string                 `protobuf:"bytes,6,opt,name=until,proto3" json:"until,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListAuditEventsRequest) Reset() {
+	*x = ListAuditEventsRequest{}
+	mi := &file_mcr_v1_audit_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListAuditEventsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListAuditEventsRequest) ProtoMessage() {}
+
+func (x *ListAuditEventsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_audit_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListAuditEventsRequest.ProtoReflect.Descriptor instead.
+func (*ListAuditEventsRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_audit_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *ListAuditEventsRequest) GetPagination() *PaginationRequest {
@@ -123,9 +205,41 @@ func (x *ListAuditEventsRequest) GetUntil() string {
 	return ""
 }
 
-// ListAuditEventsResponse is the response message for ListAuditEvents.
 type ListAuditEventsResponse struct {
-	Events []*AuditEvent `protobuf:"bytes,1,rep,name=events,proto3" json:"events,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Events        []*AuditEvent          `protobuf:"bytes,1,rep,name=events,proto3" json:"events,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListAuditEventsResponse) Reset() {
+	*x = ListAuditEventsResponse{}
+	mi := &file_mcr_v1_audit_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListAuditEventsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListAuditEventsResponse) ProtoMessage() {}
+
+func (x *ListAuditEventsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_audit_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListAuditEventsResponse.ProtoReflect.Descriptor instead.
+func (*ListAuditEventsResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_audit_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *ListAuditEventsResponse) GetEvents() []*AuditEvent {
@@ -134,3 +248,101 @@ func (x *ListAuditEventsResponse) GetEvents() []*AuditEvent {
 	}
 	return nil
 }
+
+var File_mcr_v1_audit_proto protoreflect.FileDescriptor
+
+const file_mcr_v1_audit_proto_rawDesc = "" +
+	"\n" +
+	"\x12mcr/v1/audit.proto\x12\x06mcr.v1\x1a\x13mcr/v1/common.proto\"\xc3\x02\n" +
+	"\n" +
+	"AuditEvent\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\x03R\x02id\x12\x1d\n" +
+	"\n" +
+	"event_time\x18\x02 \x01(\tR\teventTime\x12\x1d\n" +
+	"\n" +
+	"event_type\x18\x03 \x01(\tR\teventType\x12\x19\n" +
+	"\bactor_id\x18\x04 \x01(\tR\aactorId\x12\x1e\n" +
+	"\n" +
+	"repository\x18\x05 \x01(\tR\n" +
+	"repository\x12\x16\n" +
+	"\x06digest\x18\x06 \x01(\tR\x06digest\x12\x1d\n" +
+	"\n" +
+	"ip_address\x18\a \x01(\tR\tipAddress\x129\n" +
+	"\adetails\x18\b \x03(\v2\x1f.mcr.v1.AuditEvent.DetailsEntryR\adetails\x1a:\n" +
+	"\fDetailsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xd9\x01\n" +
+	"\x16ListAuditEventsRequest\x129\n" +
+	"\n" +
+	"pagination\x18\x01 \x01(\v2\x19.mcr.v1.PaginationRequestR\n" +
+	"pagination\x12\x1d\n" +
+	"\n" +
+	"event_type\x18\x02 \x01(\tR\teventType\x12\x19\n" +
+	"\bactor_id\x18\x03 \x01(\tR\aactorId\x12\x1e\n" +
+	"\n" +
+	"repository\x18\x04 \x01(\tR\n" +
+	"repository\x12\x14\n" +
+	"\x05since\x18\x05 \x01(\tR\x05since\x12\x14\n" +
+	"\x05until\x18\x06 \x01(\tR\x05until\"E\n" +
+	"\x17ListAuditEventsResponse\x12*\n" +
+	"\x06events\x18\x01 \x03(\v2\x12.mcr.v1.AuditEventR\x06events2b\n" +
+	"\fAuditService\x12R\n" +
+	"\x0fListAuditEvents\x12\x1e.mcr.v1.ListAuditEventsRequest\x1a\x1f.mcr.v1.ListAuditEventsResponseB*Z(git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1b\x06proto3"
+
+var (
+	file_mcr_v1_audit_proto_rawDescOnce sync.Once
+	file_mcr_v1_audit_proto_rawDescData []byte
+)
+
+func file_mcr_v1_audit_proto_rawDescGZIP() []byte {
+	file_mcr_v1_audit_proto_rawDescOnce.Do(func() {
+		file_mcr_v1_audit_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_mcr_v1_audit_proto_rawDesc), len(file_mcr_v1_audit_proto_rawDesc)))
+	})
+	return file_mcr_v1_audit_proto_rawDescData
+}
+
+var file_mcr_v1_audit_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_mcr_v1_audit_proto_goTypes = []any{
+	(*AuditEvent)(nil),              // 0: mcr.v1.AuditEvent
+	(*ListAuditEventsRequest)(nil),  // 1: mcr.v1.ListAuditEventsRequest
+	(*ListAuditEventsResponse)(nil), // 2: mcr.v1.ListAuditEventsResponse
+	nil,                             // 3: mcr.v1.AuditEvent.DetailsEntry
+	(*PaginationRequest)(nil),       // 4: mcr.v1.PaginationRequest
+}
+var file_mcr_v1_audit_proto_depIdxs = []int32{
+	3, // 0: mcr.v1.AuditEvent.details:type_name -> mcr.v1.AuditEvent.DetailsEntry
+	4, // 1: mcr.v1.ListAuditEventsRequest.pagination:type_name -> mcr.v1.PaginationRequest
+	0, // 2: mcr.v1.ListAuditEventsResponse.events:type_name -> mcr.v1.AuditEvent
+	1, // 3: mcr.v1.AuditService.ListAuditEvents:input_type -> mcr.v1.ListAuditEventsRequest
+	2, // 4: mcr.v1.AuditService.ListAuditEvents:output_type -> mcr.v1.ListAuditEventsResponse
+	4, // [4:5] is the sub-list for method output_type
+	3, // [3:4] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_mcr_v1_audit_proto_init() }
+func file_mcr_v1_audit_proto_init() {
+	if File_mcr_v1_audit_proto != nil {
+		return
+	}
+	file_mcr_v1_common_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_mcr_v1_audit_proto_rawDesc), len(file_mcr_v1_audit_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_mcr_v1_audit_proto_goTypes,
+		DependencyIndexes: file_mcr_v1_audit_proto_depIdxs,
+		MessageInfos:      file_mcr_v1_audit_proto_msgTypes,
+	}.Build()
+	File_mcr_v1_audit_proto = out.File
+	file_mcr_v1_audit_proto_goTypes = nil
+	file_mcr_v1_audit_proto_depIdxs = nil
+}

gen/mcr/v1/audit_grpc.pb.go

@@ -1,38 +1,92 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             v6.32.1
 // source: mcr/v1/audit.proto
 
 package mcrv1
 
 import (
-	"context"
-
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
 )
 
-// AuditServiceServer is the server API for AuditService.
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	AuditService_ListAuditEvents_FullMethodName = "/mcr.v1.AuditService/ListAuditEvents"
+)
+
+// AuditServiceClient is the client API for AuditService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type AuditServiceClient interface {
+	ListAuditEvents(ctx context.Context, in *ListAuditEventsRequest, opts ...grpc.CallOption) (*ListAuditEventsResponse, error)
+}
+
+type auditServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewAuditServiceClient(cc grpc.ClientConnInterface) AuditServiceClient {
+	return &auditServiceClient{cc}
+}
+
+func (c *auditServiceClient) ListAuditEvents(ctx context.Context, in *ListAuditEventsRequest, opts ...grpc.CallOption) (*ListAuditEventsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListAuditEventsResponse)
+	err := c.cc.Invoke(ctx, AuditService_ListAuditEvents_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// AuditServiceServer is the server API for AuditService service.
+// All implementations must embed UnimplementedAuditServiceServer
+// for forward compatibility.
 type AuditServiceServer interface {
 	ListAuditEvents(context.Context, *ListAuditEventsRequest) (*ListAuditEventsResponse, error)
 	mustEmbedUnimplementedAuditServiceServer()
 }
 
-// UnimplementedAuditServiceServer should be embedded to have forward
-// compatible implementations.
+// UnimplementedAuditServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
 type UnimplementedAuditServiceServer struct{}
 
 func (UnimplementedAuditServiceServer) ListAuditEvents(context.Context, *ListAuditEventsRequest) (*ListAuditEventsResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ListAuditEvents not implemented")
+	return nil, status.Error(codes.Unimplemented, "method ListAuditEvents not implemented")
+}
+func (UnimplementedAuditServiceServer) mustEmbedUnimplementedAuditServiceServer() {}
+func (UnimplementedAuditServiceServer) testEmbeddedByValue()                      {}
+
+// UnsafeAuditServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to AuditServiceServer will
+// result in compilation errors.
+type UnsafeAuditServiceServer interface {
+	mustEmbedUnimplementedAuditServiceServer()
 }
 
-func (UnimplementedAuditServiceServer) mustEmbedUnimplementedAuditServiceServer() {}
-
-// RegisterAuditServiceServer registers the AuditServiceServer with the grpc.Server.
 func RegisterAuditServiceServer(s grpc.ServiceRegistrar, srv AuditServiceServer) {
+	// If the following call panics, it indicates UnimplementedAuditServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&AuditService_ServiceDesc, srv)
 }
 
-func auditServiceListAuditEventsHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
+func _AuditService_ListAuditEvents_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(ListAuditEventsRequest)
 	if err := dec(in); err != nil {
 		return nil, err
@@ -42,47 +96,26 @@ func auditServiceListAuditEventsHandler(srv any, ctx context.Context, dec func(a
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/mcr.v1.AuditService/ListAuditEvents",
+		FullMethod: AuditService_ListAuditEvents_FullMethodName,
 	}
-	handler := func(ctx context.Context, req any) (any, error) {
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(AuditServiceServer).ListAuditEvents(ctx, req.(*ListAuditEventsRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
 
-// AuditService_ServiceDesc is the grpc.ServiceDesc for AuditService.
+// AuditService_ServiceDesc is the grpc.ServiceDesc for AuditService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
 var AuditService_ServiceDesc = grpc.ServiceDesc{
 	ServiceName: "mcr.v1.AuditService",
 	HandlerType: (*AuditServiceServer)(nil),
 	Methods: []grpc.MethodDesc{
 		{
 			MethodName: "ListAuditEvents",
-			Handler:    auditServiceListAuditEventsHandler,
+			Handler:    _AuditService_ListAuditEvents_Handler,
 		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "mcr/v1/audit.proto",
 }
-
-// AuditServiceClient is the client API for AuditService.
-type AuditServiceClient interface {
-	ListAuditEvents(ctx context.Context, in *ListAuditEventsRequest, opts ...grpc.CallOption) (*ListAuditEventsResponse, error)
-}
-
-type auditServiceClient struct {
-	cc grpc.ClientConnInterface
-}
-
-// NewAuditServiceClient creates a new AuditServiceClient.
-func NewAuditServiceClient(cc grpc.ClientConnInterface) AuditServiceClient {
-	return &auditServiceClient{cc}
-}
-
-func (c *auditServiceClient) ListAuditEvents(ctx context.Context, in *ListAuditEventsRequest, opts ...grpc.CallOption) (*ListAuditEventsResponse, error) {
-	out := new(ListAuditEventsResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.AuditService/ListAuditEvents", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}

gen/mcr/v1/common.pb.go

@@ -1,12 +1,63 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.32.1
 // source: mcr/v1/common.proto
 
 package mcrv1
 
-// PaginationRequest controls pagination for list RPCs.
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Pagination controls for list RPCs.
 type PaginationRequest struct {
-	Limit  int32 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"`
-	Offset int32 `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Limit         int32                  `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"`
+	Offset        int32                  `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PaginationRequest) Reset() {
+	*x = PaginationRequest{}
+	mi := &file_mcr_v1_common_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PaginationRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PaginationRequest) ProtoMessage() {}
+
+func (x *PaginationRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_common_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PaginationRequest.ProtoReflect.Descriptor instead.
+func (*PaginationRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_common_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *PaginationRequest) GetLimit() int32 {
@@ -22,3 +73,60 @@ func (x *PaginationRequest) GetOffset() int32 {
 	}
 	return 0
 }
+
+var File_mcr_v1_common_proto protoreflect.FileDescriptor
+
+const file_mcr_v1_common_proto_rawDesc = "" +
+	"\n" +
+	"\x13mcr/v1/common.proto\x12\x06mcr.v1\"A\n" +
+	"\x11PaginationRequest\x12\x14\n" +
+	"\x05limit\x18\x01 \x01(\x05R\x05limit\x12\x16\n" +
+	"\x06offset\x18\x02 \x01(\x05R\x06offsetB*Z(git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1b\x06proto3"
+
+var (
+	file_mcr_v1_common_proto_rawDescOnce sync.Once
+	file_mcr_v1_common_proto_rawDescData []byte
+)
+
+func file_mcr_v1_common_proto_rawDescGZIP() []byte {
+	file_mcr_v1_common_proto_rawDescOnce.Do(func() {
+		file_mcr_v1_common_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_mcr_v1_common_proto_rawDesc), len(file_mcr_v1_common_proto_rawDesc)))
+	})
+	return file_mcr_v1_common_proto_rawDescData
+}
+
+var file_mcr_v1_common_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_mcr_v1_common_proto_goTypes = []any{
+	(*PaginationRequest)(nil), // 0: mcr.v1.PaginationRequest
+}
+var file_mcr_v1_common_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_mcr_v1_common_proto_init() }
+func file_mcr_v1_common_proto_init() {
+	if File_mcr_v1_common_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_mcr_v1_common_proto_rawDesc), len(file_mcr_v1_common_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_mcr_v1_common_proto_goTypes,
+		DependencyIndexes: file_mcr_v1_common_proto_depIdxs,
+		MessageInfos:      file_mcr_v1_common_proto_msgTypes,
+	}.Build()
+	File_mcr_v1_common_proto = out.File
+	file_mcr_v1_common_proto_goTypes = nil
+	file_mcr_v1_common_proto_depIdxs = nil
+}

gen/mcr/v1/policy.pb.go

@@ -1,23 +1,73 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.32.1
 // source: mcr/v1/policy.proto
 
 package mcrv1
 
-// PolicyRule represents a policy rule.
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
 type PolicyRule struct {
-	Id           int64    `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`               //nolint:revive,stylecheck // proto field name
-	Priority     int32    `protobuf:"varint,2,opt,name=priority,proto3" json:"priority,omitempty"`
-	Description  string   `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
-	Effect       string   `protobuf:"bytes,4,opt,name=effect,proto3" json:"effect,omitempty"`
-	Roles        []string `protobuf:"bytes,5,rep,name=roles,proto3" json:"roles,omitempty"`
-	AccountTypes []string `protobuf:"bytes,6,rep,name=account_types,json=accountTypes,proto3" json:"account_types,omitempty"`
-	SubjectUuid  string   `protobuf:"bytes,7,opt,name=subject_uuid,json=subjectUuid,proto3" json:"subject_uuid,omitempty"` //nolint:revive,stylecheck // proto field name
-	Actions      []string `protobuf:"bytes,8,rep,name=actions,proto3" json:"actions,omitempty"`
-	Repositories []string `protobuf:"bytes,9,rep,name=repositories,proto3" json:"repositories,omitempty"`
-	Enabled      bool     `protobuf:"varint,10,opt,name=enabled,proto3" json:"enabled,omitempty"`
-	CreatedBy    string   `protobuf:"bytes,11,opt,name=created_by,json=createdBy,proto3" json:"created_by,omitempty"`
-	CreatedAt    string   `protobuf:"bytes,12,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
-	UpdatedAt    string   `protobuf:"bytes,13,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Id            int64                  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	Priority      int32                  `protobuf:"varint,2,opt,name=priority,proto3" json:"priority,omitempty"`
+	Description   string                 `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
+	Effect        string                 `protobuf:"bytes,4,opt,name=effect,proto3" json:"effect,omitempty"`
+	Roles         []string               `protobuf:"bytes,5,rep,name=roles,proto3" json:"roles,omitempty"`
+	AccountTypes  []string               `protobuf:"bytes,6,rep,name=account_types,json=accountTypes,proto3" json:"account_types,omitempty"`
+	SubjectUuid   string                 `protobuf:"bytes,7,opt,name=subject_uuid,json=subjectUuid,proto3" json:"subject_uuid,omitempty"`
+	Actions       []string               `protobuf:"bytes,8,rep,name=actions,proto3" json:"actions,omitempty"`
+	Repositories  []string               `protobuf:"bytes,9,rep,name=repositories,proto3" json:"repositories,omitempty"`
+	Enabled       bool                   `protobuf:"varint,10,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	CreatedBy     string                 `protobuf:"bytes,11,opt,name=created_by,json=createdBy,proto3" json:"created_by,omitempty"`
+	CreatedAt     string                 `protobuf:"bytes,12,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	UpdatedAt     string                 `protobuf:"bytes,13,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PolicyRule) Reset() {
+	*x = PolicyRule{}
+	mi := &file_mcr_v1_policy_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PolicyRule) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PolicyRule) ProtoMessage() {}
+
+func (x *PolicyRule) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_policy_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PolicyRule.ProtoReflect.Descriptor instead.
+func (*PolicyRule) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_policy_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *PolicyRule) GetId() int64 {
@@ -111,9 +161,41 @@ func (x *PolicyRule) GetUpdatedAt() string {
 	return ""
 }
 
-// ListPolicyRulesRequest is the request message for ListPolicyRules.
 type ListPolicyRulesRequest struct {
-	Pagination *PaginationRequest `protobuf:"bytes,1,opt,name=pagination,proto3" json:"pagination,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Pagination    *PaginationRequest     `protobuf:"bytes,1,opt,name=pagination,proto3" json:"pagination,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListPolicyRulesRequest) Reset() {
+	*x = ListPolicyRulesRequest{}
+	mi := &file_mcr_v1_policy_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListPolicyRulesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListPolicyRulesRequest) ProtoMessage() {}
+
+func (x *ListPolicyRulesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_policy_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListPolicyRulesRequest.ProtoReflect.Descriptor instead.
+func (*ListPolicyRulesRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_policy_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *ListPolicyRulesRequest) GetPagination() *PaginationRequest {
@@ -123,9 +205,41 @@ func (x *ListPolicyRulesRequest) GetPagination() *PaginationRequest {
 	return nil
 }
 
-// ListPolicyRulesResponse is the response message for ListPolicyRules.
 type ListPolicyRulesResponse struct {
-	Rules []*PolicyRule `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Rules         []*PolicyRule          `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListPolicyRulesResponse) Reset() {
+	*x = ListPolicyRulesResponse{}
+	mi := &file_mcr_v1_policy_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListPolicyRulesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListPolicyRulesResponse) ProtoMessage() {}
+
+func (x *ListPolicyRulesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_policy_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListPolicyRulesResponse.ProtoReflect.Descriptor instead.
+func (*ListPolicyRulesResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_policy_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *ListPolicyRulesResponse) GetRules() []*PolicyRule {
@@ -135,17 +249,49 @@ func (x *ListPolicyRulesResponse) GetRules() []*PolicyRule {
 	return nil
 }
 
-// CreatePolicyRuleRequest is the request message for CreatePolicyRule.
 type CreatePolicyRuleRequest struct {
-	Priority     int32    `protobuf:"varint,1,opt,name=priority,proto3" json:"priority,omitempty"`
-	Description  string   `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
-	Effect       string   `protobuf:"bytes,3,opt,name=effect,proto3" json:"effect,omitempty"`
-	Roles        []string `protobuf:"bytes,4,rep,name=roles,proto3" json:"roles,omitempty"`
-	AccountTypes []string `protobuf:"bytes,5,rep,name=account_types,json=accountTypes,proto3" json:"account_types,omitempty"`
-	SubjectUuid  string   `protobuf:"bytes,6,opt,name=subject_uuid,json=subjectUuid,proto3" json:"subject_uuid,omitempty"` //nolint:revive,stylecheck // proto field name
-	Actions      []string `protobuf:"bytes,7,rep,name=actions,proto3" json:"actions,omitempty"`
-	Repositories []string `protobuf:"bytes,8,rep,name=repositories,proto3" json:"repositories,omitempty"`
-	Enabled      bool     `protobuf:"varint,9,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Priority      int32                  `protobuf:"varint,1,opt,name=priority,proto3" json:"priority,omitempty"`
+	Description   string                 `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
+	Effect        string                 `protobuf:"bytes,3,opt,name=effect,proto3" json:"effect,omitempty"`
+	Roles         []string               `protobuf:"bytes,4,rep,name=roles,proto3" json:"roles,omitempty"`
+	AccountTypes  []string               `protobuf:"bytes,5,rep,name=account_types,json=accountTypes,proto3" json:"account_types,omitempty"`
+	SubjectUuid   string                 `protobuf:"bytes,6,opt,name=subject_uuid,json=subjectUuid,proto3" json:"subject_uuid,omitempty"`
+	Actions       []string               `protobuf:"bytes,7,rep,name=actions,proto3" json:"actions,omitempty"`
+	Repositories  []string               `protobuf:"bytes,8,rep,name=repositories,proto3" json:"repositories,omitempty"`
+	Enabled       bool                   `protobuf:"varint,9,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreatePolicyRuleRequest) Reset() {
+	*x = CreatePolicyRuleRequest{}
+	mi := &file_mcr_v1_policy_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreatePolicyRuleRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreatePolicyRuleRequest) ProtoMessage() {}
+
+func (x *CreatePolicyRuleRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_policy_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreatePolicyRuleRequest.ProtoReflect.Descriptor instead.
+func (*CreatePolicyRuleRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_policy_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *CreatePolicyRuleRequest) GetPriority() int32 {
@@ -211,9 +357,41 @@ func (x *CreatePolicyRuleRequest) GetEnabled() bool {
 	return false
 }
 
-// GetPolicyRuleRequest is the request message for GetPolicyRule.
 type GetPolicyRuleRequest struct {
-	Id int64 `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"` //nolint:revive,stylecheck // proto field name
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Id            int64                  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetPolicyRuleRequest) Reset() {
+	*x = GetPolicyRuleRequest{}
+	mi := &file_mcr_v1_policy_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetPolicyRuleRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetPolicyRuleRequest) ProtoMessage() {}
+
+func (x *GetPolicyRuleRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_policy_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetPolicyRuleRequest.ProtoReflect.Descriptor instead.
+func (*GetPolicyRuleRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_policy_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *GetPolicyRuleRequest) GetId() int64 {
@@ -223,19 +401,52 @@ func (x *GetPolicyRuleRequest) GetId() int64 {
 	return 0
 }
 
-// UpdatePolicyRuleRequest is the request message for UpdatePolicyRule.
 type UpdatePolicyRuleRequest struct {
-	Id           int64    `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`               //nolint:revive,stylecheck // proto field name
-	Priority     int32    `protobuf:"varint,2,opt,name=priority,proto3" json:"priority,omitempty"`
-	Description  string   `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
-	Effect       string   `protobuf:"bytes,4,opt,name=effect,proto3" json:"effect,omitempty"`
-	Roles        []string `protobuf:"bytes,5,rep,name=roles,proto3" json:"roles,omitempty"`
-	AccountTypes []string `protobuf:"bytes,6,rep,name=account_types,json=accountTypes,proto3" json:"account_types,omitempty"`
-	SubjectUuid  string   `protobuf:"bytes,7,opt,name=subject_uuid,json=subjectUuid,proto3" json:"subject_uuid,omitempty"` //nolint:revive,stylecheck // proto field name
-	Actions      []string `protobuf:"bytes,8,rep,name=actions,proto3" json:"actions,omitempty"`
-	Repositories []string `protobuf:"bytes,9,rep,name=repositories,proto3" json:"repositories,omitempty"`
-	Enabled      bool     `protobuf:"varint,10,opt,name=enabled,proto3" json:"enabled,omitempty"`
-	UpdateMask   []string `protobuf:"bytes,11,rep,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
+	state        protoimpl.MessageState `protogen:"open.v1"`
+	Id           int64                  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	Priority     int32                  `protobuf:"varint,2,opt,name=priority,proto3" json:"priority,omitempty"`
+	Description  string                 `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
+	Effect       string                 `protobuf:"bytes,4,opt,name=effect,proto3" json:"effect,omitempty"`
+	Roles        []string               `protobuf:"bytes,5,rep,name=roles,proto3" json:"roles,omitempty"`
+	AccountTypes []string               `protobuf:"bytes,6,rep,name=account_types,json=accountTypes,proto3" json:"account_types,omitempty"`
+	SubjectUuid  string                 `protobuf:"bytes,7,opt,name=subject_uuid,json=subjectUuid,proto3" json:"subject_uuid,omitempty"`
+	Actions      []string               `protobuf:"bytes,8,rep,name=actions,proto3" json:"actions,omitempty"`
+	Repositories []string               `protobuf:"bytes,9,rep,name=repositories,proto3" json:"repositories,omitempty"`
+	Enabled      bool                   `protobuf:"varint,10,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	// Field mask for partial updates — only fields listed here are applied.
+	UpdateMask    []string `protobuf:"bytes,11,rep,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdatePolicyRuleRequest) Reset() {
+	*x = UpdatePolicyRuleRequest{}
+	mi := &file_mcr_v1_policy_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdatePolicyRuleRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdatePolicyRuleRequest) ProtoMessage() {}
+
+func (x *UpdatePolicyRuleRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_policy_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdatePolicyRuleRequest.ProtoReflect.Descriptor instead.
+func (*UpdatePolicyRuleRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_policy_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *UpdatePolicyRuleRequest) GetId() int64 {
@@ -315,9 +526,41 @@ func (x *UpdatePolicyRuleRequest) GetUpdateMask() []string {
 	return nil
 }
 
-// DeletePolicyRuleRequest is the request message for DeletePolicyRule.
 type DeletePolicyRuleRequest struct {
-	Id int64 `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"` //nolint:revive,stylecheck // proto field name
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Id            int64                  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeletePolicyRuleRequest) Reset() {
+	*x = DeletePolicyRuleRequest{}
+	mi := &file_mcr_v1_policy_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeletePolicyRuleRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeletePolicyRuleRequest) ProtoMessage() {}
+
+func (x *DeletePolicyRuleRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_policy_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeletePolicyRuleRequest.ProtoReflect.Descriptor instead.
+func (*DeletePolicyRuleRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_policy_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *DeletePolicyRuleRequest) GetId() int64 {
@@ -327,5 +570,173 @@ func (x *DeletePolicyRuleRequest) GetId() int64 {
 	return 0
 }
 
-// DeletePolicyRuleResponse is the response message for DeletePolicyRule.
-type DeletePolicyRuleResponse struct{}
+type DeletePolicyRuleResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeletePolicyRuleResponse) Reset() {
+	*x = DeletePolicyRuleResponse{}
+	mi := &file_mcr_v1_policy_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeletePolicyRuleResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeletePolicyRuleResponse) ProtoMessage() {}
+
+func (x *DeletePolicyRuleResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_policy_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeletePolicyRuleResponse.ProtoReflect.Descriptor instead.
+func (*DeletePolicyRuleResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_policy_proto_rawDescGZIP(), []int{7}
+}
+
+var File_mcr_v1_policy_proto protoreflect.FileDescriptor
+
+const file_mcr_v1_policy_proto_rawDesc = "" +
+	"\n" +
+	"\x13mcr/v1/policy.proto\x12\x06mcr.v1\x1a\x13mcr/v1/common.proto\"\x85\x03\n" +
+	"\n" +
+	"PolicyRule\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\x03R\x02id\x12\x1a\n" +
+	"\bpriority\x18\x02 \x01(\x05R\bpriority\x12 \n" +
+	"\vdescription\x18\x03 \x01(\tR\vdescription\x12\x16\n" +
+	"\x06effect\x18\x04 \x01(\tR\x06effect\x12\x14\n" +
+	"\x05roles\x18\x05 \x03(\tR\x05roles\x12#\n" +
+	"\raccount_types\x18\x06 \x03(\tR\faccountTypes\x12!\n" +
+	"\fsubject_uuid\x18\a \x01(\tR\vsubjectUuid\x12\x18\n" +
+	"\aactions\x18\b \x03(\tR\aactions\x12\"\n" +
+	"\frepositories\x18\t \x03(\tR\frepositories\x12\x18\n" +
+	"\aenabled\x18\n" +
+	" \x01(\bR\aenabled\x12\x1d\n" +
+	"\n" +
+	"created_by\x18\v \x01(\tR\tcreatedBy\x12\x1d\n" +
+	"\n" +
+	"created_at\x18\f \x01(\tR\tcreatedAt\x12\x1d\n" +
+	"\n" +
+	"updated_at\x18\r \x01(\tR\tupdatedAt\"S\n" +
+	"\x16ListPolicyRulesRequest\x129\n" +
+	"\n" +
+	"pagination\x18\x01 \x01(\v2\x19.mcr.v1.PaginationRequestR\n" +
+	"pagination\"C\n" +
+	"\x17ListPolicyRulesResponse\x12(\n" +
+	"\x05rules\x18\x01 \x03(\v2\x12.mcr.v1.PolicyRuleR\x05rules\"\xa5\x02\n" +
+	"\x17CreatePolicyRuleRequest\x12\x1a\n" +
+	"\bpriority\x18\x01 \x01(\x05R\bpriority\x12 \n" +
+	"\vdescription\x18\x02 \x01(\tR\vdescription\x12\x16\n" +
+	"\x06effect\x18\x03 \x01(\tR\x06effect\x12\x14\n" +
+	"\x05roles\x18\x04 \x03(\tR\x05roles\x12#\n" +
+	"\raccount_types\x18\x05 \x03(\tR\faccountTypes\x12!\n" +
+	"\fsubject_uuid\x18\x06 \x01(\tR\vsubjectUuid\x12\x18\n" +
+	"\aactions\x18\a \x03(\tR\aactions\x12\"\n" +
+	"\frepositories\x18\b \x03(\tR\frepositories\x12\x18\n" +
+	"\aenabled\x18\t \x01(\bR\aenabled\"&\n" +
+	"\x14GetPolicyRuleRequest\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\x03R\x02id\"\xd6\x02\n" +
+	"\x17UpdatePolicyRuleRequest\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\x03R\x02id\x12\x1a\n" +
+	"\bpriority\x18\x02 \x01(\x05R\bpriority\x12 \n" +
+	"\vdescription\x18\x03 \x01(\tR\vdescription\x12\x16\n" +
+	"\x06effect\x18\x04 \x01(\tR\x06effect\x12\x14\n" +
+	"\x05roles\x18\x05 \x03(\tR\x05roles\x12#\n" +
+	"\raccount_types\x18\x06 \x03(\tR\faccountTypes\x12!\n" +
+	"\fsubject_uuid\x18\a \x01(\tR\vsubjectUuid\x12\x18\n" +
+	"\aactions\x18\b \x03(\tR\aactions\x12\"\n" +
+	"\frepositories\x18\t \x03(\tR\frepositories\x12\x18\n" +
+	"\aenabled\x18\n" +
+	" \x01(\bR\aenabled\x12\x1f\n" +
+	"\vupdate_mask\x18\v \x03(\tR\n" +
+	"updateMask\")\n" +
+	"\x17DeletePolicyRuleRequest\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\x03R\x02id\"\x1a\n" +
+	"\x18DeletePolicyRuleResponse2\x8f\x03\n" +
+	"\rPolicyService\x12R\n" +
+	"\x0fListPolicyRules\x12\x1e.mcr.v1.ListPolicyRulesRequest\x1a\x1f.mcr.v1.ListPolicyRulesResponse\x12G\n" +
+	"\x10CreatePolicyRule\x12\x1f.mcr.v1.CreatePolicyRuleRequest\x1a\x12.mcr.v1.PolicyRule\x12A\n" +
+	"\rGetPolicyRule\x12\x1c.mcr.v1.GetPolicyRuleRequest\x1a\x12.mcr.v1.PolicyRule\x12G\n" +
+	"\x10UpdatePolicyRule\x12\x1f.mcr.v1.UpdatePolicyRuleRequest\x1a\x12.mcr.v1.PolicyRule\x12U\n" +
+	"\x10DeletePolicyRule\x12\x1f.mcr.v1.DeletePolicyRuleRequest\x1a .mcr.v1.DeletePolicyRuleResponseB*Z(git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1b\x06proto3"
+
+var (
+	file_mcr_v1_policy_proto_rawDescOnce sync.Once
+	file_mcr_v1_policy_proto_rawDescData []byte
+)
+
+func file_mcr_v1_policy_proto_rawDescGZIP() []byte {
+	file_mcr_v1_policy_proto_rawDescOnce.Do(func() {
+		file_mcr_v1_policy_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_mcr_v1_policy_proto_rawDesc), len(file_mcr_v1_policy_proto_rawDesc)))
+	})
+	return file_mcr_v1_policy_proto_rawDescData
+}
+
+var file_mcr_v1_policy_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_mcr_v1_policy_proto_goTypes = []any{
+	(*PolicyRule)(nil),               // 0: mcr.v1.PolicyRule
+	(*ListPolicyRulesRequest)(nil),   // 1: mcr.v1.ListPolicyRulesRequest
+	(*ListPolicyRulesResponse)(nil),  // 2: mcr.v1.ListPolicyRulesResponse
+	(*CreatePolicyRuleRequest)(nil),  // 3: mcr.v1.CreatePolicyRuleRequest
+	(*GetPolicyRuleRequest)(nil),     // 4: mcr.v1.GetPolicyRuleRequest
+	(*UpdatePolicyRuleRequest)(nil),  // 5: mcr.v1.UpdatePolicyRuleRequest
+	(*DeletePolicyRuleRequest)(nil),  // 6: mcr.v1.DeletePolicyRuleRequest
+	(*DeletePolicyRuleResponse)(nil), // 7: mcr.v1.DeletePolicyRuleResponse
+	(*PaginationRequest)(nil),        // 8: mcr.v1.PaginationRequest
+}
+var file_mcr_v1_policy_proto_depIdxs = []int32{
+	8, // 0: mcr.v1.ListPolicyRulesRequest.pagination:type_name -> mcr.v1.PaginationRequest
+	0, // 1: mcr.v1.ListPolicyRulesResponse.rules:type_name -> mcr.v1.PolicyRule
+	1, // 2: mcr.v1.PolicyService.ListPolicyRules:input_type -> mcr.v1.ListPolicyRulesRequest
+	3, // 3: mcr.v1.PolicyService.CreatePolicyRule:input_type -> mcr.v1.CreatePolicyRuleRequest
+	4, // 4: mcr.v1.PolicyService.GetPolicyRule:input_type -> mcr.v1.GetPolicyRuleRequest
+	5, // 5: mcr.v1.PolicyService.UpdatePolicyRule:input_type -> mcr.v1.UpdatePolicyRuleRequest
+	6, // 6: mcr.v1.PolicyService.DeletePolicyRule:input_type -> mcr.v1.DeletePolicyRuleRequest
+	2, // 7: mcr.v1.PolicyService.ListPolicyRules:output_type -> mcr.v1.ListPolicyRulesResponse
+	0, // 8: mcr.v1.PolicyService.CreatePolicyRule:output_type -> mcr.v1.PolicyRule
+	0, // 9: mcr.v1.PolicyService.GetPolicyRule:output_type -> mcr.v1.PolicyRule
+	0, // 10: mcr.v1.PolicyService.UpdatePolicyRule:output_type -> mcr.v1.PolicyRule
+	7, // 11: mcr.v1.PolicyService.DeletePolicyRule:output_type -> mcr.v1.DeletePolicyRuleResponse
+	7, // [7:12] is the sub-list for method output_type
+	2, // [2:7] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_mcr_v1_policy_proto_init() }
+func file_mcr_v1_policy_proto_init() {
+	if File_mcr_v1_policy_proto != nil {
+		return
+	}
+	file_mcr_v1_common_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_mcr_v1_policy_proto_rawDesc), len(file_mcr_v1_policy_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   8,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_mcr_v1_policy_proto_goTypes,
+		DependencyIndexes: file_mcr_v1_policy_proto_depIdxs,
+		MessageInfos:      file_mcr_v1_policy_proto_msgTypes,
+	}.Build()
+	File_mcr_v1_policy_proto = out.File
+	file_mcr_v1_policy_proto_goTypes = nil
+	file_mcr_v1_policy_proto_depIdxs = nil
+}

gen/mcr/v1/policy_grpc.pb.go

@@ -1,178 +1,34 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             v6.32.1
 // source: mcr/v1/policy.proto
 
 package mcrv1
 
 import (
-	"context"
-
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
 )
 
-// PolicyServiceServer is the server API for PolicyService.
-type PolicyServiceServer interface {
-	ListPolicyRules(context.Context, *ListPolicyRulesRequest) (*ListPolicyRulesResponse, error)
-	CreatePolicyRule(context.Context, *CreatePolicyRuleRequest) (*PolicyRule, error)
-	GetPolicyRule(context.Context, *GetPolicyRuleRequest) (*PolicyRule, error)
-	UpdatePolicyRule(context.Context, *UpdatePolicyRuleRequest) (*PolicyRule, error)
-	DeletePolicyRule(context.Context, *DeletePolicyRuleRequest) (*DeletePolicyRuleResponse, error)
-	mustEmbedUnimplementedPolicyServiceServer()
-}
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
-// UnimplementedPolicyServiceServer should be embedded to have forward
-// compatible implementations.
-type UnimplementedPolicyServiceServer struct{}
+const (
+	PolicyService_ListPolicyRules_FullMethodName  = "/mcr.v1.PolicyService/ListPolicyRules"
+	PolicyService_CreatePolicyRule_FullMethodName = "/mcr.v1.PolicyService/CreatePolicyRule"
+	PolicyService_GetPolicyRule_FullMethodName    = "/mcr.v1.PolicyService/GetPolicyRule"
+	PolicyService_UpdatePolicyRule_FullMethodName = "/mcr.v1.PolicyService/UpdatePolicyRule"
+	PolicyService_DeletePolicyRule_FullMethodName = "/mcr.v1.PolicyService/DeletePolicyRule"
+)
 
-func (UnimplementedPolicyServiceServer) ListPolicyRules(context.Context, *ListPolicyRulesRequest) (*ListPolicyRulesResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ListPolicyRules not implemented")
-}
-
-func (UnimplementedPolicyServiceServer) CreatePolicyRule(context.Context, *CreatePolicyRuleRequest) (*PolicyRule, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method CreatePolicyRule not implemented")
-}
-
-func (UnimplementedPolicyServiceServer) GetPolicyRule(context.Context, *GetPolicyRuleRequest) (*PolicyRule, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetPolicyRule not implemented")
-}
-
-func (UnimplementedPolicyServiceServer) UpdatePolicyRule(context.Context, *UpdatePolicyRuleRequest) (*PolicyRule, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method UpdatePolicyRule not implemented")
-}
-
-func (UnimplementedPolicyServiceServer) DeletePolicyRule(context.Context, *DeletePolicyRuleRequest) (*DeletePolicyRuleResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DeletePolicyRule not implemented")
-}
-
-func (UnimplementedPolicyServiceServer) mustEmbedUnimplementedPolicyServiceServer() {}
-
-// RegisterPolicyServiceServer registers the PolicyServiceServer with the grpc.Server.
-func RegisterPolicyServiceServer(s grpc.ServiceRegistrar, srv PolicyServiceServer) {
-	s.RegisterService(&PolicyService_ServiceDesc, srv)
-}
-
-func policyServiceListPolicyRulesHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(ListPolicyRulesRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(PolicyServiceServer).ListPolicyRules(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.PolicyService/ListPolicyRules",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(PolicyServiceServer).ListPolicyRules(ctx, req.(*ListPolicyRulesRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func policyServiceCreatePolicyRuleHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(CreatePolicyRuleRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(PolicyServiceServer).CreatePolicyRule(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.PolicyService/CreatePolicyRule",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(PolicyServiceServer).CreatePolicyRule(ctx, req.(*CreatePolicyRuleRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func policyServiceGetPolicyRuleHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(GetPolicyRuleRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(PolicyServiceServer).GetPolicyRule(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.PolicyService/GetPolicyRule",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(PolicyServiceServer).GetPolicyRule(ctx, req.(*GetPolicyRuleRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func policyServiceUpdatePolicyRuleHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(UpdatePolicyRuleRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(PolicyServiceServer).UpdatePolicyRule(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.PolicyService/UpdatePolicyRule",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(PolicyServiceServer).UpdatePolicyRule(ctx, req.(*UpdatePolicyRuleRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func policyServiceDeletePolicyRuleHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(DeletePolicyRuleRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(PolicyServiceServer).DeletePolicyRule(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.PolicyService/DeletePolicyRule",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(PolicyServiceServer).DeletePolicyRule(ctx, req.(*DeletePolicyRuleRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-// PolicyService_ServiceDesc is the grpc.ServiceDesc for PolicyService.
-var PolicyService_ServiceDesc = grpc.ServiceDesc{
-	ServiceName: "mcr.v1.PolicyService",
-	HandlerType: (*PolicyServiceServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "ListPolicyRules",
-			Handler:    policyServiceListPolicyRulesHandler,
-		},
-		{
-			MethodName: "CreatePolicyRule",
-			Handler:    policyServiceCreatePolicyRuleHandler,
-		},
-		{
-			MethodName: "GetPolicyRule",
-			Handler:    policyServiceGetPolicyRuleHandler,
-		},
-		{
-			MethodName: "UpdatePolicyRule",
-			Handler:    policyServiceUpdatePolicyRuleHandler,
-		},
-		{
-			MethodName: "DeletePolicyRule",
-			Handler:    policyServiceDeletePolicyRuleHandler,
-		},
-	},
-	Streams:  []grpc.StreamDesc{},
-	Metadata: "mcr/v1/policy.proto",
-}
-
-// PolicyServiceClient is the client API for PolicyService.
+// PolicyServiceClient is the client API for PolicyService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type PolicyServiceClient interface {
 	ListPolicyRules(ctx context.Context, in *ListPolicyRulesRequest, opts ...grpc.CallOption) (*ListPolicyRulesResponse, error)
 	CreatePolicyRule(ctx context.Context, in *CreatePolicyRuleRequest, opts ...grpc.CallOption) (*PolicyRule, error)
@@ -185,14 +41,14 @@ type policyServiceClient struct {
 	cc grpc.ClientConnInterface
 }
 
-// NewPolicyServiceClient creates a new PolicyServiceClient.
 func NewPolicyServiceClient(cc grpc.ClientConnInterface) PolicyServiceClient {
 	return &policyServiceClient{cc}
 }
 
 func (c *policyServiceClient) ListPolicyRules(ctx context.Context, in *ListPolicyRulesRequest, opts ...grpc.CallOption) (*ListPolicyRulesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListPolicyRulesResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.PolicyService/ListPolicyRules", in, out, opts...)
+	err := c.cc.Invoke(ctx, PolicyService_ListPolicyRules_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -200,8 +56,9 @@ func (c *policyServiceClient) ListPolicyRules(ctx context.Context, in *ListPolic
 }
 
 func (c *policyServiceClient) CreatePolicyRule(ctx context.Context, in *CreatePolicyRuleRequest, opts ...grpc.CallOption) (*PolicyRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(PolicyRule)
-	err := c.cc.Invoke(ctx, "/mcr.v1.PolicyService/CreatePolicyRule", in, out, opts...)
+	err := c.cc.Invoke(ctx, PolicyService_CreatePolicyRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -209,8 +66,9 @@ func (c *policyServiceClient) CreatePolicyRule(ctx context.Context, in *CreatePo
 }
 
 func (c *policyServiceClient) GetPolicyRule(ctx context.Context, in *GetPolicyRuleRequest, opts ...grpc.CallOption) (*PolicyRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(PolicyRule)
-	err := c.cc.Invoke(ctx, "/mcr.v1.PolicyService/GetPolicyRule", in, out, opts...)
+	err := c.cc.Invoke(ctx, PolicyService_GetPolicyRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -218,8 +76,9 @@ func (c *policyServiceClient) GetPolicyRule(ctx context.Context, in *GetPolicyRu
 }
 
 func (c *policyServiceClient) UpdatePolicyRule(ctx context.Context, in *UpdatePolicyRuleRequest, opts ...grpc.CallOption) (*PolicyRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(PolicyRule)
-	err := c.cc.Invoke(ctx, "/mcr.v1.PolicyService/UpdatePolicyRule", in, out, opts...)
+	err := c.cc.Invoke(ctx, PolicyService_UpdatePolicyRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -227,10 +86,188 @@ func (c *policyServiceClient) UpdatePolicyRule(ctx context.Context, in *UpdatePo
 }
 
 func (c *policyServiceClient) DeletePolicyRule(ctx context.Context, in *DeletePolicyRuleRequest, opts ...grpc.CallOption) (*DeletePolicyRuleResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DeletePolicyRuleResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.PolicyService/DeletePolicyRule", in, out, opts...)
+	err := c.cc.Invoke(ctx, PolicyService_DeletePolicyRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
+
+// PolicyServiceServer is the server API for PolicyService service.
+// All implementations must embed UnimplementedPolicyServiceServer
+// for forward compatibility.
+type PolicyServiceServer interface {
+	ListPolicyRules(context.Context, *ListPolicyRulesRequest) (*ListPolicyRulesResponse, error)
+	CreatePolicyRule(context.Context, *CreatePolicyRuleRequest) (*PolicyRule, error)
+	GetPolicyRule(context.Context, *GetPolicyRuleRequest) (*PolicyRule, error)
+	UpdatePolicyRule(context.Context, *UpdatePolicyRuleRequest) (*PolicyRule, error)
+	DeletePolicyRule(context.Context, *DeletePolicyRuleRequest) (*DeletePolicyRuleResponse, error)
+	mustEmbedUnimplementedPolicyServiceServer()
+}
+
+// UnimplementedPolicyServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedPolicyServiceServer struct{}
+
+func (UnimplementedPolicyServiceServer) ListPolicyRules(context.Context, *ListPolicyRulesRequest) (*ListPolicyRulesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListPolicyRules not implemented")
+}
+func (UnimplementedPolicyServiceServer) CreatePolicyRule(context.Context, *CreatePolicyRuleRequest) (*PolicyRule, error) {
+	return nil, status.Error(codes.Unimplemented, "method CreatePolicyRule not implemented")
+}
+func (UnimplementedPolicyServiceServer) GetPolicyRule(context.Context, *GetPolicyRuleRequest) (*PolicyRule, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetPolicyRule not implemented")
+}
+func (UnimplementedPolicyServiceServer) UpdatePolicyRule(context.Context, *UpdatePolicyRuleRequest) (*PolicyRule, error) {
+	return nil, status.Error(codes.Unimplemented, "method UpdatePolicyRule not implemented")
+}
+func (UnimplementedPolicyServiceServer) DeletePolicyRule(context.Context, *DeletePolicyRuleRequest) (*DeletePolicyRuleResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method DeletePolicyRule not implemented")
+}
+func (UnimplementedPolicyServiceServer) mustEmbedUnimplementedPolicyServiceServer() {}
+func (UnimplementedPolicyServiceServer) testEmbeddedByValue()                       {}
+
+// UnsafePolicyServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to PolicyServiceServer will
+// result in compilation errors.
+type UnsafePolicyServiceServer interface {
+	mustEmbedUnimplementedPolicyServiceServer()
+}
+
+func RegisterPolicyServiceServer(s grpc.ServiceRegistrar, srv PolicyServiceServer) {
+	// If the following call panics, it indicates UnimplementedPolicyServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&PolicyService_ServiceDesc, srv)
+}
+
+func _PolicyService_ListPolicyRules_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListPolicyRulesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PolicyServiceServer).ListPolicyRules(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PolicyService_ListPolicyRules_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PolicyServiceServer).ListPolicyRules(ctx, req.(*ListPolicyRulesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _PolicyService_CreatePolicyRule_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreatePolicyRuleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PolicyServiceServer).CreatePolicyRule(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PolicyService_CreatePolicyRule_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PolicyServiceServer).CreatePolicyRule(ctx, req.(*CreatePolicyRuleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _PolicyService_GetPolicyRule_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetPolicyRuleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PolicyServiceServer).GetPolicyRule(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PolicyService_GetPolicyRule_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PolicyServiceServer).GetPolicyRule(ctx, req.(*GetPolicyRuleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _PolicyService_UpdatePolicyRule_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdatePolicyRuleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PolicyServiceServer).UpdatePolicyRule(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PolicyService_UpdatePolicyRule_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PolicyServiceServer).UpdatePolicyRule(ctx, req.(*UpdatePolicyRuleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _PolicyService_DeletePolicyRule_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeletePolicyRuleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PolicyServiceServer).DeletePolicyRule(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PolicyService_DeletePolicyRule_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PolicyServiceServer).DeletePolicyRule(ctx, req.(*DeletePolicyRuleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// PolicyService_ServiceDesc is the grpc.ServiceDesc for PolicyService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var PolicyService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "mcr.v1.PolicyService",
+	HandlerType: (*PolicyServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "ListPolicyRules",
+			Handler:    _PolicyService_ListPolicyRules_Handler,
+		},
+		{
+			MethodName: "CreatePolicyRule",
+			Handler:    _PolicyService_CreatePolicyRule_Handler,
+		},
+		{
+			MethodName: "GetPolicyRule",
+			Handler:    _PolicyService_GetPolicyRule_Handler,
+		},
+		{
+			MethodName: "UpdatePolicyRule",
+			Handler:    _PolicyService_UpdatePolicyRule_Handler,
+		},
+		{
+			MethodName: "DeletePolicyRule",
+			Handler:    _PolicyService_DeletePolicyRule_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "mcr/v1/policy.proto",
+}

gen/mcr/v1/registry.pb.go

@@ -1,15 +1,65 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.32.1
 // source: mcr/v1/registry.proto
 
 package mcrv1
 
-// RepositoryMetadata is a repository summary for listing.
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
 type RepositoryMetadata struct {
-	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
-	TagCount      int32  `protobuf:"varint,2,opt,name=tag_count,json=tagCount,proto3" json:"tag_count,omitempty"`
-	ManifestCount int32  `protobuf:"varint,3,opt,name=manifest_count,json=manifestCount,proto3" json:"manifest_count,omitempty"`
-	TotalSize     int64  `protobuf:"varint,4,opt,name=total_size,json=totalSize,proto3" json:"total_size,omitempty"`
-	CreatedAt     string `protobuf:"bytes,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	TagCount      int32                  `protobuf:"varint,2,opt,name=tag_count,json=tagCount,proto3" json:"tag_count,omitempty"`
+	ManifestCount int32                  `protobuf:"varint,3,opt,name=manifest_count,json=manifestCount,proto3" json:"manifest_count,omitempty"`
+	TotalSize     int64                  `protobuf:"varint,4,opt,name=total_size,json=totalSize,proto3" json:"total_size,omitempty"`
+	CreatedAt     string                 `protobuf:"bytes,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RepositoryMetadata) Reset() {
+	*x = RepositoryMetadata{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RepositoryMetadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RepositoryMetadata) ProtoMessage() {}
+
+func (x *RepositoryMetadata) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RepositoryMetadata.ProtoReflect.Descriptor instead.
+func (*RepositoryMetadata) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *RepositoryMetadata) GetName() string {
@@ -47,10 +97,43 @@ func (x *RepositoryMetadata) GetCreatedAt() string {
 	return ""
 }
 
-// TagInfo is a tag with its manifest digest.
 type TagInfo struct {
-	Name   string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
-	Digest string `protobuf:"bytes,2,opt,name=digest,proto3" json:"digest,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Digest        string                 `protobuf:"bytes,2,opt,name=digest,proto3" json:"digest,omitempty"`
+	UpdatedAt     string                 `protobuf:"bytes,3,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TagInfo) Reset() {
+	*x = TagInfo{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TagInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TagInfo) ProtoMessage() {}
+
+func (x *TagInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TagInfo.ProtoReflect.Descriptor instead.
+func (*TagInfo) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *TagInfo) GetName() string {
@@ -67,12 +150,51 @@ func (x *TagInfo) GetDigest() string {
 	return ""
 }
 
-// ManifestInfo is a manifest summary.
+func (x *TagInfo) GetUpdatedAt() string {
+	if x != nil {
+		return x.UpdatedAt
+	}
+	return ""
+}
+
 type ManifestInfo struct {
-	Digest    string `protobuf:"bytes,1,opt,name=digest,proto3" json:"digest,omitempty"`
-	MediaType string `protobuf:"bytes,2,opt,name=media_type,json=mediaType,proto3" json:"media_type,omitempty"`
-	Size      int64  `protobuf:"varint,3,opt,name=size,proto3" json:"size,omitempty"`
-	CreatedAt string `protobuf:"bytes,4,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Digest        string                 `protobuf:"bytes,1,opt,name=digest,proto3" json:"digest,omitempty"`
+	MediaType     string                 `protobuf:"bytes,2,opt,name=media_type,json=mediaType,proto3" json:"media_type,omitempty"`
+	Size          int64                  `protobuf:"varint,3,opt,name=size,proto3" json:"size,omitempty"`
+	CreatedAt     string                 `protobuf:"bytes,4,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ManifestInfo) Reset() {
+	*x = ManifestInfo{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ManifestInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ManifestInfo) ProtoMessage() {}
+
+func (x *ManifestInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ManifestInfo.ProtoReflect.Descriptor instead.
+func (*ManifestInfo) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *ManifestInfo) GetDigest() string {
@@ -103,9 +225,41 @@ func (x *ManifestInfo) GetCreatedAt() string {
 	return ""
 }
 
-// ListRepositoriesRequest is the request message for ListRepositories.
 type ListRepositoriesRequest struct {
-	Pagination *PaginationRequest `protobuf:"bytes,1,opt,name=pagination,proto3" json:"pagination,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Pagination    *PaginationRequest     `protobuf:"bytes,1,opt,name=pagination,proto3" json:"pagination,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRepositoriesRequest) Reset() {
+	*x = ListRepositoriesRequest{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRepositoriesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRepositoriesRequest) ProtoMessage() {}
+
+func (x *ListRepositoriesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRepositoriesRequest.ProtoReflect.Descriptor instead.
+func (*ListRepositoriesRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *ListRepositoriesRequest) GetPagination() *PaginationRequest {
@@ -115,9 +269,41 @@ func (x *ListRepositoriesRequest) GetPagination() *PaginationRequest {
 	return nil
 }
 
-// ListRepositoriesResponse is the response message for ListRepositories.
 type ListRepositoriesResponse struct {
-	Repositories []*RepositoryMetadata `protobuf:"bytes,1,rep,name=repositories,proto3" json:"repositories,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Repositories  []*RepositoryMetadata  `protobuf:"bytes,1,rep,name=repositories,proto3" json:"repositories,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRepositoriesResponse) Reset() {
+	*x = ListRepositoriesResponse{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRepositoriesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRepositoriesResponse) ProtoMessage() {}
+
+func (x *ListRepositoriesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRepositoriesResponse.ProtoReflect.Descriptor instead.
+func (*ListRepositoriesResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *ListRepositoriesResponse) GetRepositories() []*RepositoryMetadata {
@@ -127,9 +313,41 @@ func (x *ListRepositoriesResponse) GetRepositories() []*RepositoryMetadata {
 	return nil
 }
 
-// GetRepositoryRequest is the request message for GetRepository.
 type GetRepositoryRequest struct {
-	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetRepositoryRequest) Reset() {
+	*x = GetRepositoryRequest{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetRepositoryRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetRepositoryRequest) ProtoMessage() {}
+
+func (x *GetRepositoryRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetRepositoryRequest.ProtoReflect.Descriptor instead.
+func (*GetRepositoryRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *GetRepositoryRequest) GetName() string {
@@ -139,13 +357,45 @@ func (x *GetRepositoryRequest) GetName() string {
 	return ""
 }
 
-// GetRepositoryResponse is the response message for GetRepository.
 type GetRepositoryResponse struct {
-	Name      string          `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
-	Tags      []*TagInfo      `protobuf:"bytes,2,rep,name=tags,proto3" json:"tags,omitempty"`
-	Manifests []*ManifestInfo `protobuf:"bytes,3,rep,name=manifests,proto3" json:"manifests,omitempty"`
-	TotalSize int64           `protobuf:"varint,4,opt,name=total_size,json=totalSize,proto3" json:"total_size,omitempty"`
-	CreatedAt string          `protobuf:"bytes,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Tags          []*TagInfo             `protobuf:"bytes,2,rep,name=tags,proto3" json:"tags,omitempty"`
+	Manifests     []*ManifestInfo        `protobuf:"bytes,3,rep,name=manifests,proto3" json:"manifests,omitempty"`
+	TotalSize     int64                  `protobuf:"varint,4,opt,name=total_size,json=totalSize,proto3" json:"total_size,omitempty"`
+	CreatedAt     string                 `protobuf:"bytes,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetRepositoryResponse) Reset() {
+	*x = GetRepositoryResponse{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetRepositoryResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetRepositoryResponse) ProtoMessage() {}
+
+func (x *GetRepositoryResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetRepositoryResponse.ProtoReflect.Descriptor instead.
+func (*GetRepositoryResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *GetRepositoryResponse) GetName() string {
@@ -183,9 +433,41 @@ func (x *GetRepositoryResponse) GetCreatedAt() string {
 	return ""
 }
 
-// DeleteRepositoryRequest is the request message for DeleteRepository.
 type DeleteRepositoryRequest struct {
-	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteRepositoryRequest) Reset() {
+	*x = DeleteRepositoryRequest{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteRepositoryRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteRepositoryRequest) ProtoMessage() {}
+
+func (x *DeleteRepositoryRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteRepositoryRequest.ProtoReflect.Descriptor instead.
+func (*DeleteRepositoryRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *DeleteRepositoryRequest) GetName() string {
@@ -195,15 +477,113 @@ func (x *DeleteRepositoryRequest) GetName() string {
 	return ""
 }
 
-// DeleteRepositoryResponse is the response message for DeleteRepository.
-type DeleteRepositoryResponse struct{}
+type DeleteRepositoryResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
 
-// GarbageCollectRequest is the request message for GarbageCollect.
-type GarbageCollectRequest struct{}
+func (x *DeleteRepositoryResponse) Reset() {
+	*x = DeleteRepositoryResponse{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteRepositoryResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteRepositoryResponse) ProtoMessage() {}
+
+func (x *DeleteRepositoryResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteRepositoryResponse.ProtoReflect.Descriptor instead.
+func (*DeleteRepositoryResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{8}
+}
+
+type GarbageCollectRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GarbageCollectRequest) Reset() {
+	*x = GarbageCollectRequest{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GarbageCollectRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GarbageCollectRequest) ProtoMessage() {}
+
+func (x *GarbageCollectRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GarbageCollectRequest.ProtoReflect.Descriptor instead.
+func (*GarbageCollectRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{9}
+}
 
-// GarbageCollectResponse is the response message for GarbageCollect.
 type GarbageCollectResponse struct {
-	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` //nolint:revive,stylecheck // proto field name
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GarbageCollectResponse) Reset() {
+	*x = GarbageCollectResponse{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GarbageCollectResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GarbageCollectResponse) ProtoMessage() {}
+
+func (x *GarbageCollectResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GarbageCollectResponse.ProtoReflect.Descriptor instead.
+func (*GarbageCollectResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *GarbageCollectResponse) GetId() string {
@@ -213,15 +593,80 @@ func (x *GarbageCollectResponse) GetId() string {
 	return ""
 }
 
-// GetGCStatusRequest is the request message for GetGCStatus.
-type GetGCStatusRequest struct{}
+type GetGCStatusRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetGCStatusRequest) Reset() {
+	*x = GetGCStatusRequest{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetGCStatusRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetGCStatusRequest) ProtoMessage() {}
+
+func (x *GetGCStatusRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[11]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetGCStatusRequest.ProtoReflect.Descriptor instead.
+func (*GetGCStatusRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{11}
+}
 
-// GCLastRun records the result of the last garbage collection run.
 type GCLastRun struct {
-	StartedAt   string `protobuf:"bytes,1,opt,name=started_at,json=startedAt,proto3" json:"started_at,omitempty"`
-	CompletedAt string `protobuf:"bytes,2,opt,name=completed_at,json=completedAt,proto3" json:"completed_at,omitempty"`
-	BlobsRemoved int32  `protobuf:"varint,3,opt,name=blobs_removed,json=blobsRemoved,proto3" json:"blobs_removed,omitempty"`
-	BytesFreed  int64  `protobuf:"varint,4,opt,name=bytes_freed,json=bytesFreed,proto3" json:"bytes_freed,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	StartedAt     string                 `protobuf:"bytes,1,opt,name=started_at,json=startedAt,proto3" json:"started_at,omitempty"`
+	CompletedAt   string                 `protobuf:"bytes,2,opt,name=completed_at,json=completedAt,proto3" json:"completed_at,omitempty"`
+	BlobsRemoved  int32                  `protobuf:"varint,3,opt,name=blobs_removed,json=blobsRemoved,proto3" json:"blobs_removed,omitempty"`
+	BytesFreed    int64                  `protobuf:"varint,4,opt,name=bytes_freed,json=bytesFreed,proto3" json:"bytes_freed,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GCLastRun) Reset() {
+	*x = GCLastRun{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GCLastRun) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GCLastRun) ProtoMessage() {}
+
+func (x *GCLastRun) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[12]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GCLastRun.ProtoReflect.Descriptor instead.
+func (*GCLastRun) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *GCLastRun) GetStartedAt() string {
@@ -252,10 +697,42 @@ func (x *GCLastRun) GetBytesFreed() int64 {
 	return 0
 }
 
-// GetGCStatusResponse is the response message for GetGCStatus.
 type GetGCStatusResponse struct {
-	Running bool      `protobuf:"varint,1,opt,name=running,proto3" json:"running,omitempty"`
-	LastRun *GCLastRun `protobuf:"bytes,2,opt,name=last_run,json=lastRun,proto3" json:"last_run,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Running       bool                   `protobuf:"varint,1,opt,name=running,proto3" json:"running,omitempty"`
+	LastRun       *GCLastRun             `protobuf:"bytes,2,opt,name=last_run,json=lastRun,proto3" json:"last_run,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetGCStatusResponse) Reset() {
+	*x = GetGCStatusResponse{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetGCStatusResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetGCStatusResponse) ProtoMessage() {}
+
+func (x *GetGCStatusResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[13]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetGCStatusResponse.ProtoReflect.Descriptor instead.
+func (*GetGCStatusResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *GetGCStatusResponse) GetRunning() bool {
@@ -271,3 +748,146 @@ func (x *GetGCStatusResponse) GetLastRun() *GCLastRun {
 	}
 	return nil
 }
+
+var File_mcr_v1_registry_proto protoreflect.FileDescriptor
+
+const file_mcr_v1_registry_proto_rawDesc = "" +
+	"\n" +
+	"\x15mcr/v1/registry.proto\x12\x06mcr.v1\x1a\x13mcr/v1/common.proto\"\xaa\x01\n" +
+	"\x12RepositoryMetadata\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1b\n" +
+	"\ttag_count\x18\x02 \x01(\x05R\btagCount\x12%\n" +
+	"\x0emanifest_count\x18\x03 \x01(\x05R\rmanifestCount\x12\x1d\n" +
+	"\n" +
+	"total_size\x18\x04 \x01(\x03R\ttotalSize\x12\x1d\n" +
+	"\n" +
+	"created_at\x18\x05 \x01(\tR\tcreatedAt\"T\n" +
+	"\aTagInfo\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x16\n" +
+	"\x06digest\x18\x02 \x01(\tR\x06digest\x12\x1d\n" +
+	"\n" +
+	"updated_at\x18\x03 \x01(\tR\tupdatedAt\"x\n" +
+	"\fManifestInfo\x12\x16\n" +
+	"\x06digest\x18\x01 \x01(\tR\x06digest\x12\x1d\n" +
+	"\n" +
+	"media_type\x18\x02 \x01(\tR\tmediaType\x12\x12\n" +
+	"\x04size\x18\x03 \x01(\x03R\x04size\x12\x1d\n" +
+	"\n" +
+	"created_at\x18\x04 \x01(\tR\tcreatedAt\"T\n" +
+	"\x17ListRepositoriesRequest\x129\n" +
+	"\n" +
+	"pagination\x18\x01 \x01(\v2\x19.mcr.v1.PaginationRequestR\n" +
+	"pagination\"Z\n" +
+	"\x18ListRepositoriesResponse\x12>\n" +
+	"\frepositories\x18\x01 \x03(\v2\x1a.mcr.v1.RepositoryMetadataR\frepositories\"*\n" +
+	"\x14GetRepositoryRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"\xc2\x01\n" +
+	"\x15GetRepositoryResponse\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12#\n" +
+	"\x04tags\x18\x02 \x03(\v2\x0f.mcr.v1.TagInfoR\x04tags\x122\n" +
+	"\tmanifests\x18\x03 \x03(\v2\x14.mcr.v1.ManifestInfoR\tmanifests\x12\x1d\n" +
+	"\n" +
+	"total_size\x18\x04 \x01(\x03R\ttotalSize\x12\x1d\n" +
+	"\n" +
+	"created_at\x18\x05 \x01(\tR\tcreatedAt\"-\n" +
+	"\x17DeleteRepositoryRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"\x1a\n" +
+	"\x18DeleteRepositoryResponse\"\x17\n" +
+	"\x15GarbageCollectRequest\"(\n" +
+	"\x16GarbageCollectResponse\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\"\x14\n" +
+	"\x12GetGCStatusRequest\"\x93\x01\n" +
+	"\tGCLastRun\x12\x1d\n" +
+	"\n" +
+	"started_at\x18\x01 \x01(\tR\tstartedAt\x12!\n" +
+	"\fcompleted_at\x18\x02 \x01(\tR\vcompletedAt\x12#\n" +
+	"\rblobs_removed\x18\x03 \x01(\x05R\fblobsRemoved\x12\x1f\n" +
+	"\vbytes_freed\x18\x04 \x01(\x03R\n" +
+	"bytesFreed\"]\n" +
+	"\x13GetGCStatusResponse\x12\x18\n" +
+	"\arunning\x18\x01 \x01(\bR\arunning\x12,\n" +
+	"\blast_run\x18\x02 \x01(\v2\x11.mcr.v1.GCLastRunR\alastRun2\xa6\x03\n" +
+	"\x0fRegistryService\x12U\n" +
+	"\x10ListRepositories\x12\x1f.mcr.v1.ListRepositoriesRequest\x1a .mcr.v1.ListRepositoriesResponse\x12L\n" +
+	"\rGetRepository\x12\x1c.mcr.v1.GetRepositoryRequest\x1a\x1d.mcr.v1.GetRepositoryResponse\x12U\n" +
+	"\x10DeleteRepository\x12\x1f.mcr.v1.DeleteRepositoryRequest\x1a .mcr.v1.DeleteRepositoryResponse\x12O\n" +
+	"\x0eGarbageCollect\x12\x1d.mcr.v1.GarbageCollectRequest\x1a\x1e.mcr.v1.GarbageCollectResponse\x12F\n" +
+	"\vGetGCStatus\x12\x1a.mcr.v1.GetGCStatusRequest\x1a\x1b.mcr.v1.GetGCStatusResponseB*Z(git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1b\x06proto3"
+
+var (
+	file_mcr_v1_registry_proto_rawDescOnce sync.Once
+	file_mcr_v1_registry_proto_rawDescData []byte
+)
+
+func file_mcr_v1_registry_proto_rawDescGZIP() []byte {
+	file_mcr_v1_registry_proto_rawDescOnce.Do(func() {
+		file_mcr_v1_registry_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_mcr_v1_registry_proto_rawDesc), len(file_mcr_v1_registry_proto_rawDesc)))
+	})
+	return file_mcr_v1_registry_proto_rawDescData
+}
+
+var file_mcr_v1_registry_proto_msgTypes = make([]protoimpl.MessageInfo, 14)
+var file_mcr_v1_registry_proto_goTypes = []any{
+	(*RepositoryMetadata)(nil),       // 0: mcr.v1.RepositoryMetadata
+	(*TagInfo)(nil),                  // 1: mcr.v1.TagInfo
+	(*ManifestInfo)(nil),             // 2: mcr.v1.ManifestInfo
+	(*ListRepositoriesRequest)(nil),  // 3: mcr.v1.ListRepositoriesRequest
+	(*ListRepositoriesResponse)(nil), // 4: mcr.v1.ListRepositoriesResponse
+	(*GetRepositoryRequest)(nil),     // 5: mcr.v1.GetRepositoryRequest
+	(*GetRepositoryResponse)(nil),    // 6: mcr.v1.GetRepositoryResponse
+	(*DeleteRepositoryRequest)(nil),  // 7: mcr.v1.DeleteRepositoryRequest
+	(*DeleteRepositoryResponse)(nil), // 8: mcr.v1.DeleteRepositoryResponse
+	(*GarbageCollectRequest)(nil),    // 9: mcr.v1.GarbageCollectRequest
+	(*GarbageCollectResponse)(nil),   // 10: mcr.v1.GarbageCollectResponse
+	(*GetGCStatusRequest)(nil),       // 11: mcr.v1.GetGCStatusRequest
+	(*GCLastRun)(nil),                // 12: mcr.v1.GCLastRun
+	(*GetGCStatusResponse)(nil),      // 13: mcr.v1.GetGCStatusResponse
+	(*PaginationRequest)(nil),        // 14: mcr.v1.PaginationRequest
+}
+var file_mcr_v1_registry_proto_depIdxs = []int32{
+	14, // 0: mcr.v1.ListRepositoriesRequest.pagination:type_name -> mcr.v1.PaginationRequest
+	0,  // 1: mcr.v1.ListRepositoriesResponse.repositories:type_name -> mcr.v1.RepositoryMetadata
+	1,  // 2: mcr.v1.GetRepositoryResponse.tags:type_name -> mcr.v1.TagInfo
+	2,  // 3: mcr.v1.GetRepositoryResponse.manifests:type_name -> mcr.v1.ManifestInfo
+	12, // 4: mcr.v1.GetGCStatusResponse.last_run:type_name -> mcr.v1.GCLastRun
+	3,  // 5: mcr.v1.RegistryService.ListRepositories:input_type -> mcr.v1.ListRepositoriesRequest
+	5,  // 6: mcr.v1.RegistryService.GetRepository:input_type -> mcr.v1.GetRepositoryRequest
+	7,  // 7: mcr.v1.RegistryService.DeleteRepository:input_type -> mcr.v1.DeleteRepositoryRequest
+	9,  // 8: mcr.v1.RegistryService.GarbageCollect:input_type -> mcr.v1.GarbageCollectRequest
+	11, // 9: mcr.v1.RegistryService.GetGCStatus:input_type -> mcr.v1.GetGCStatusRequest
+	4,  // 10: mcr.v1.RegistryService.ListRepositories:output_type -> mcr.v1.ListRepositoriesResponse
+	6,  // 11: mcr.v1.RegistryService.GetRepository:output_type -> mcr.v1.GetRepositoryResponse
+	8,  // 12: mcr.v1.RegistryService.DeleteRepository:output_type -> mcr.v1.DeleteRepositoryResponse
+	10, // 13: mcr.v1.RegistryService.GarbageCollect:output_type -> mcr.v1.GarbageCollectResponse
+	13, // 14: mcr.v1.RegistryService.GetGCStatus:output_type -> mcr.v1.GetGCStatusResponse
+	10, // [10:15] is the sub-list for method output_type
+	5,  // [5:10] is the sub-list for method input_type
+	5,  // [5:5] is the sub-list for extension type_name
+	5,  // [5:5] is the sub-list for extension extendee
+	0,  // [0:5] is the sub-list for field type_name
+}
+
+func init() { file_mcr_v1_registry_proto_init() }
+func file_mcr_v1_registry_proto_init() {
+	if File_mcr_v1_registry_proto != nil {
+		return
+	}
+	file_mcr_v1_common_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_mcr_v1_registry_proto_rawDesc), len(file_mcr_v1_registry_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   14,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_mcr_v1_registry_proto_goTypes,
+		DependencyIndexes: file_mcr_v1_registry_proto_depIdxs,
+		MessageInfos:      file_mcr_v1_registry_proto_msgTypes,
+	}.Build()
+	File_mcr_v1_registry_proto = out.File
+	file_mcr_v1_registry_proto_goTypes = nil
+	file_mcr_v1_registry_proto_depIdxs = nil
+}

gen/mcr/v1/registry_grpc.pb.go

@@ -1,178 +1,34 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             v6.32.1
 // source: mcr/v1/registry.proto
 
 package mcrv1
 
 import (
-	"context"
-
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
 )
 
-// RegistryServiceServer is the server API for RegistryService.
-type RegistryServiceServer interface {
-	ListRepositories(context.Context, *ListRepositoriesRequest) (*ListRepositoriesResponse, error)
-	GetRepository(context.Context, *GetRepositoryRequest) (*GetRepositoryResponse, error)
-	DeleteRepository(context.Context, *DeleteRepositoryRequest) (*DeleteRepositoryResponse, error)
-	GarbageCollect(context.Context, *GarbageCollectRequest) (*GarbageCollectResponse, error)
-	GetGCStatus(context.Context, *GetGCStatusRequest) (*GetGCStatusResponse, error)
-	mustEmbedUnimplementedRegistryServiceServer()
-}
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
-// UnimplementedRegistryServiceServer should be embedded to have forward
-// compatible implementations.
-type UnimplementedRegistryServiceServer struct{}
+const (
+	RegistryService_ListRepositories_FullMethodName = "/mcr.v1.RegistryService/ListRepositories"
+	RegistryService_GetRepository_FullMethodName    = "/mcr.v1.RegistryService/GetRepository"
+	RegistryService_DeleteRepository_FullMethodName = "/mcr.v1.RegistryService/DeleteRepository"
+	RegistryService_GarbageCollect_FullMethodName   = "/mcr.v1.RegistryService/GarbageCollect"
+	RegistryService_GetGCStatus_FullMethodName      = "/mcr.v1.RegistryService/GetGCStatus"
+)
 
-func (UnimplementedRegistryServiceServer) ListRepositories(context.Context, *ListRepositoriesRequest) (*ListRepositoriesResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ListRepositories not implemented")
-}
-
-func (UnimplementedRegistryServiceServer) GetRepository(context.Context, *GetRepositoryRequest) (*GetRepositoryResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetRepository not implemented")
-}
-
-func (UnimplementedRegistryServiceServer) DeleteRepository(context.Context, *DeleteRepositoryRequest) (*DeleteRepositoryResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DeleteRepository not implemented")
-}
-
-func (UnimplementedRegistryServiceServer) GarbageCollect(context.Context, *GarbageCollectRequest) (*GarbageCollectResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GarbageCollect not implemented")
-}
-
-func (UnimplementedRegistryServiceServer) GetGCStatus(context.Context, *GetGCStatusRequest) (*GetGCStatusResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetGCStatus not implemented")
-}
-
-func (UnimplementedRegistryServiceServer) mustEmbedUnimplementedRegistryServiceServer() {}
-
-// RegisterRegistryServiceServer registers the RegistryServiceServer with the grpc.Server.
-func RegisterRegistryServiceServer(s grpc.ServiceRegistrar, srv RegistryServiceServer) {
-	s.RegisterService(&RegistryService_ServiceDesc, srv)
-}
-
-func registryServiceListRepositoriesHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(ListRepositoriesRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(RegistryServiceServer).ListRepositories(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.RegistryService/ListRepositories",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(RegistryServiceServer).ListRepositories(ctx, req.(*ListRepositoriesRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func registryServiceGetRepositoryHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(GetRepositoryRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(RegistryServiceServer).GetRepository(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.RegistryService/GetRepository",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(RegistryServiceServer).GetRepository(ctx, req.(*GetRepositoryRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func registryServiceDeleteRepositoryHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(DeleteRepositoryRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(RegistryServiceServer).DeleteRepository(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.RegistryService/DeleteRepository",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(RegistryServiceServer).DeleteRepository(ctx, req.(*DeleteRepositoryRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func registryServiceGarbageCollectHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(GarbageCollectRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(RegistryServiceServer).GarbageCollect(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.RegistryService/GarbageCollect",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(RegistryServiceServer).GarbageCollect(ctx, req.(*GarbageCollectRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func registryServiceGetGCStatusHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(GetGCStatusRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(RegistryServiceServer).GetGCStatus(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.RegistryService/GetGCStatus",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(RegistryServiceServer).GetGCStatus(ctx, req.(*GetGCStatusRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-// RegistryService_ServiceDesc is the grpc.ServiceDesc for RegistryService.
-var RegistryService_ServiceDesc = grpc.ServiceDesc{
-	ServiceName: "mcr.v1.RegistryService",
-	HandlerType: (*RegistryServiceServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "ListRepositories",
-			Handler:    registryServiceListRepositoriesHandler,
-		},
-		{
-			MethodName: "GetRepository",
-			Handler:    registryServiceGetRepositoryHandler,
-		},
-		{
-			MethodName: "DeleteRepository",
-			Handler:    registryServiceDeleteRepositoryHandler,
-		},
-		{
-			MethodName: "GarbageCollect",
-			Handler:    registryServiceGarbageCollectHandler,
-		},
-		{
-			MethodName: "GetGCStatus",
-			Handler:    registryServiceGetGCStatusHandler,
-		},
-	},
-	Streams:  []grpc.StreamDesc{},
-	Metadata: "mcr/v1/registry.proto",
-}
-
-// RegistryServiceClient is the client API for RegistryService.
+// RegistryServiceClient is the client API for RegistryService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type RegistryServiceClient interface {
 	ListRepositories(ctx context.Context, in *ListRepositoriesRequest, opts ...grpc.CallOption) (*ListRepositoriesResponse, error)
 	GetRepository(ctx context.Context, in *GetRepositoryRequest, opts ...grpc.CallOption) (*GetRepositoryResponse, error)
@@ -185,14 +41,14 @@ type registryServiceClient struct {
 	cc grpc.ClientConnInterface
 }
 
-// NewRegistryServiceClient creates a new RegistryServiceClient.
 func NewRegistryServiceClient(cc grpc.ClientConnInterface) RegistryServiceClient {
 	return &registryServiceClient{cc}
 }
 
 func (c *registryServiceClient) ListRepositories(ctx context.Context, in *ListRepositoriesRequest, opts ...grpc.CallOption) (*ListRepositoriesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListRepositoriesResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.RegistryService/ListRepositories", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistryService_ListRepositories_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -200,8 +56,9 @@ func (c *registryServiceClient) ListRepositories(ctx context.Context, in *ListRe
 }
 
 func (c *registryServiceClient) GetRepository(ctx context.Context, in *GetRepositoryRequest, opts ...grpc.CallOption) (*GetRepositoryResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetRepositoryResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.RegistryService/GetRepository", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistryService_GetRepository_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -209,8 +66,9 @@ func (c *registryServiceClient) GetRepository(ctx context.Context, in *GetReposi
 }
 
 func (c *registryServiceClient) DeleteRepository(ctx context.Context, in *DeleteRepositoryRequest, opts ...grpc.CallOption) (*DeleteRepositoryResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DeleteRepositoryResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.RegistryService/DeleteRepository", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistryService_DeleteRepository_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -218,8 +76,9 @@ func (c *registryServiceClient) DeleteRepository(ctx context.Context, in *Delete
 }
 
 func (c *registryServiceClient) GarbageCollect(ctx context.Context, in *GarbageCollectRequest, opts ...grpc.CallOption) (*GarbageCollectResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GarbageCollectResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.RegistryService/GarbageCollect", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistryService_GarbageCollect_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -227,10 +86,188 @@ func (c *registryServiceClient) GarbageCollect(ctx context.Context, in *GarbageC
 }
 
 func (c *registryServiceClient) GetGCStatus(ctx context.Context, in *GetGCStatusRequest, opts ...grpc.CallOption) (*GetGCStatusResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetGCStatusResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.RegistryService/GetGCStatus", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistryService_GetGCStatus_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
+
+// RegistryServiceServer is the server API for RegistryService service.
+// All implementations must embed UnimplementedRegistryServiceServer
+// for forward compatibility.
+type RegistryServiceServer interface {
+	ListRepositories(context.Context, *ListRepositoriesRequest) (*ListRepositoriesResponse, error)
+	GetRepository(context.Context, *GetRepositoryRequest) (*GetRepositoryResponse, error)
+	DeleteRepository(context.Context, *DeleteRepositoryRequest) (*DeleteRepositoryResponse, error)
+	GarbageCollect(context.Context, *GarbageCollectRequest) (*GarbageCollectResponse, error)
+	GetGCStatus(context.Context, *GetGCStatusRequest) (*GetGCStatusResponse, error)
+	mustEmbedUnimplementedRegistryServiceServer()
+}
+
+// UnimplementedRegistryServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedRegistryServiceServer struct{}
+
+func (UnimplementedRegistryServiceServer) ListRepositories(context.Context, *ListRepositoriesRequest) (*ListRepositoriesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListRepositories not implemented")
+}
+func (UnimplementedRegistryServiceServer) GetRepository(context.Context, *GetRepositoryRequest) (*GetRepositoryResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetRepository not implemented")
+}
+func (UnimplementedRegistryServiceServer) DeleteRepository(context.Context, *DeleteRepositoryRequest) (*DeleteRepositoryResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method DeleteRepository not implemented")
+}
+func (UnimplementedRegistryServiceServer) GarbageCollect(context.Context, *GarbageCollectRequest) (*GarbageCollectResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GarbageCollect not implemented")
+}
+func (UnimplementedRegistryServiceServer) GetGCStatus(context.Context, *GetGCStatusRequest) (*GetGCStatusResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetGCStatus not implemented")
+}
+func (UnimplementedRegistryServiceServer) mustEmbedUnimplementedRegistryServiceServer() {}
+func (UnimplementedRegistryServiceServer) testEmbeddedByValue()                         {}
+
+// UnsafeRegistryServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to RegistryServiceServer will
+// result in compilation errors.
+type UnsafeRegistryServiceServer interface {
+	mustEmbedUnimplementedRegistryServiceServer()
+}
+
+func RegisterRegistryServiceServer(s grpc.ServiceRegistrar, srv RegistryServiceServer) {
+	// If the following call panics, it indicates UnimplementedRegistryServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&RegistryService_ServiceDesc, srv)
+}
+
+func _RegistryService_ListRepositories_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListRepositoriesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RegistryServiceServer).ListRepositories(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RegistryService_ListRepositories_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RegistryServiceServer).ListRepositories(ctx, req.(*ListRepositoriesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RegistryService_GetRepository_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetRepositoryRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RegistryServiceServer).GetRepository(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RegistryService_GetRepository_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RegistryServiceServer).GetRepository(ctx, req.(*GetRepositoryRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RegistryService_DeleteRepository_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteRepositoryRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RegistryServiceServer).DeleteRepository(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RegistryService_DeleteRepository_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RegistryServiceServer).DeleteRepository(ctx, req.(*DeleteRepositoryRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RegistryService_GarbageCollect_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GarbageCollectRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RegistryServiceServer).GarbageCollect(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RegistryService_GarbageCollect_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RegistryServiceServer).GarbageCollect(ctx, req.(*GarbageCollectRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RegistryService_GetGCStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetGCStatusRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RegistryServiceServer).GetGCStatus(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RegistryService_GetGCStatus_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RegistryServiceServer).GetGCStatus(ctx, req.(*GetGCStatusRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// RegistryService_ServiceDesc is the grpc.ServiceDesc for RegistryService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var RegistryService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "mcr.v1.RegistryService",
+	HandlerType: (*RegistryServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "ListRepositories",
+			Handler:    _RegistryService_ListRepositories_Handler,
+		},
+		{
+			MethodName: "GetRepository",
+			Handler:    _RegistryService_GetRepository_Handler,
+		},
+		{
+			MethodName: "DeleteRepository",
+			Handler:    _RegistryService_DeleteRepository_Handler,
+		},
+		{
+			MethodName: "GarbageCollect",
+			Handler:    _RegistryService_GarbageCollect_Handler,
+		},
+		{
+			MethodName: "GetGCStatus",
+			Handler:    _RegistryService_GetGCStatus_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "mcr/v1/registry.proto",
+}

go.mod

@@ -1,13 +1,14 @@
-module git.wntrmute.dev/kyle/mcr
+module git.wntrmute.dev/mc/mcr
 
 go 1.25.7
 
 require (
-	git.wntrmute.dev/kyle/mcdsl v1.0.0
+	git.wntrmute.dev/mc/mcdsl v1.2.0
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/google/uuid v1.6.0
 	github.com/spf13/cobra v1.10.2
 	google.golang.org/grpc v1.79.3
+	google.golang.org/protobuf v1.36.11
 )
 
 require (
@@ -22,7 +23,6 @@ require (
 	golang.org/x/sys v0.42.0 // indirect
 	golang.org/x/text v0.32.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
 	modernc.org/libc v1.70.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect

go.sum

@@ -1,5 +1,5 @@
-git.wntrmute.dev/kyle/mcdsl v1.0.0 h1:YB7dx4gdNYKKcVySpL6UkwHqdCJ9Nl1yS0+eHk0hNtk=
-git.wntrmute.dev/kyle/mcdsl v1.0.0/go.mod h1:wo0tGfUAxci3XnOe4/rFmR0RjUElKdYUazc+Np986sg=
+git.wntrmute.dev/mc/mcdsl v1.2.0 h1:41hep7/PNZJfN0SN/nM+rQpyF1GSZcvNNjyVG81DI7U=
+git.wntrmute.dev/mc/mcdsl v1.2.0/go.mod h1:lXYrAt74ZUix6rx9oVN8d2zH1YJoyp4uxPVKQ+SSxuM=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=

internal/auth/client.go

@@ -4,7 +4,7 @@ import (
 	"errors"
 	"log/slog"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
 )
 
 // Client communicates with an MCIAS server for authentication and token

internal/config/config.go

@@ -5,7 +5,7 @@ import (
 	"os"
 	"path/filepath"
 
-	mcdslconfig "git.wntrmute.dev/kyle/mcdsl/config"
+	mcdslconfig "git.wntrmute.dev/mc/mcdsl/config"
 )
 
 // Config is the top-level MCR configuration. It embeds config.Base for
@@ -24,9 +24,10 @@ type StorageConfig struct {
 
 // WebConfig holds the web UI server settings.
 type WebConfig struct {
-	ListenAddr string `toml:"listen_addr"`
-	GRPCAddr   string `toml:"grpc_addr"`
-	CACert     string `toml:"ca_cert"`
+	ListenAddr    string `toml:"listen_addr"`
+	GRPCAddr      string `toml:"grpc_addr"`
+	CACert        string `toml:"ca_cert"`
+	TLSServerName string `toml:"tls_server_name"`
 }
 
 // Load reads a TOML config file, applies environment variable overrides

internal/db/admin.go

@@ -23,8 +23,9 @@ type RepoMetadata struct {
 
 // TagInfo is a tag with its manifest digest for repo detail.
 type TagInfo struct {
-	Name   string `json:"name"`
-	Digest string `json:"digest"`
+	Name      string `json:"name"`
+	Digest    string `json:"digest"`
+	UpdatedAt string `json:"updated_at"`
 }
 
 // ManifestInfo is a manifest summary for repo detail.
@@ -112,7 +113,7 @@ func (d *DB) GetRepositoryDetail(name string) (*RepoDetail, error) {
 
 	// Tags with manifest digests.
 	tagRows, err := d.Query(
-		`SELECT t.name, m.digest
+		`SELECT t.name, m.digest, t.updated_at
 		 FROM tags t JOIN manifests m ON m.id = t.manifest_id
 		 WHERE t.repository_id = ?
 		 ORDER BY t.name ASC`, repoID,
@@ -124,7 +125,7 @@ func (d *DB) GetRepositoryDetail(name string) (*RepoDetail, error) {
 
 	for tagRows.Next() {
 		var ti TagInfo
-		if err := tagRows.Scan(&ti.Name, &ti.Digest); err != nil {
+		if err := tagRows.Scan(&ti.Name, &ti.Digest, &ti.UpdatedAt); err != nil {
 			return nil, fmt.Errorf("db: scan tag: %w", err)
 		}
 		detail.Tags = append(detail.Tags, ti)

internal/db/db.go

@@ -4,7 +4,7 @@ import (
 	"database/sql"
 	"fmt"
 
-	mcdsldb "git.wntrmute.dev/kyle/mcdsl/db"
+	mcdsldb "git.wntrmute.dev/mc/mcdsl/db"
 )
 
 // DB wraps a SQLite database connection.

internal/db/gc.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"fmt"
 
-	"git.wntrmute.dev/kyle/mcr/internal/gc"
+	"git.wntrmute.dev/mc/mcr/internal/gc"
 )
 
 // FindAndDeleteUnreferencedBlobs finds all blob rows with no manifest_blobs

internal/db/migrate.go

@@ -1,7 +1,7 @@
 package db
 
 import (
-	mcdsldb "git.wntrmute.dev/kyle/mcdsl/db"
+	mcdsldb "git.wntrmute.dev/mc/mcdsl/db"
 )
 
 // Migrations is the ordered list of MCR schema migrations.

internal/db/policy.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 // ruleBody is the JSON structure stored in the rule_json column.

internal/db/policy_test.go

@@ -3,7 +3,7 @@ package db
 import (
 	"testing"
 
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 func TestLoadEnabledPolicyRules(t *testing.T) {

internal/grpcserver/admin.go

@@ -3,7 +3,7 @@ package grpcserver
 import (
 	"context"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
 )
 
 // adminService implements pb.AdminServiceServer.

internal/grpcserver/admin_test.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"testing"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
 )
 
 func TestHealthReturnsOk(t *testing.T) {

internal/grpcserver/audit.go

@@ -6,8 +6,8 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
+	"git.wntrmute.dev/mc/mcr/internal/db"
 )
 
 // auditService implements pb.AuditServiceServer.

internal/grpcserver/audit_test.go

@@ -3,7 +3,7 @@ package grpcserver
 import (
 	"testing"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
 )
 
 func TestListAuditEventsEmpty(t *testing.T) {

internal/grpcserver/interceptors.go

@@ -1,7 +1,7 @@
 package grpcserver
 
 import (
-	mcdslgrpc "git.wntrmute.dev/kyle/mcdsl/grpcserver"
+	mcdslgrpc "git.wntrmute.dev/mc/mcdsl/grpcserver"
 )
 
 // methodMap builds the mcdsl grpcserver.MethodMap for MCR.

internal/grpcserver/interceptors_test.go

@@ -16,10 +16,10 @@ import (
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
+	"git.wntrmute.dev/mc/mcr/internal/db"
 )
 
 // mockMCIAS starts a fake MCIAS HTTP server for token validation.

internal/grpcserver/policy.go

@@ -9,11 +9,11 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
+	"git.wntrmute.dev/mc/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 var validActions = map[string]bool{

internal/grpcserver/policy_test.go

@@ -6,8 +6,8 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 type fakePolicyReloader struct {

internal/grpcserver/registry.go

@@ -11,11 +11,11 @@ import (
 
 	"github.com/google/uuid"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/gc"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
+	"git.wntrmute.dev/mc/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/gc"
 )
 
 // registryService implements pb.RegistryServiceServer.
@@ -78,8 +78,9 @@ func (s *registryService) GetRepository(_ context.Context, req *pb.GetRepository
 	}
 	for _, t := range detail.Tags {
 		resp.Tags = append(resp.Tags, &pb.TagInfo{
-			Name:   t.Name,
-			Digest: t.Digest,
+			Name:      t.Name,
+			Digest:    t.Digest,
+			UpdatedAt: t.UpdatedAt,
 		})
 	}
 	for _, m := range detail.Manifests {

internal/grpcserver/registry_test.go

@@ -8,9 +8,9 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
 )
 
 // testMCIAS is a package-level variable set by adminDeps for reuse.

internal/grpcserver/server.go

@@ -11,13 +11,13 @@ import (
 	"net"
 	"sync"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
-	mcdslgrpc "git.wntrmute.dev/kyle/mcdsl/grpcserver"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
+	mcdslgrpc "git.wntrmute.dev/mc/mcdsl/grpcserver"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/gc"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
+	"git.wntrmute.dev/mc/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/gc"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 // AuditFunc is a callback for recording audit events. It follows the same
@@ -65,7 +65,7 @@ type Server struct {
 //
 // If certFile or keyFile is empty, TLS is skipped (for testing only).
 func New(certFile, keyFile string, deps Deps, logger *slog.Logger) (*Server, error) {
-	srv, err := mcdslgrpc.New(certFile, keyFile, deps.Authenticator, methodMap(), logger)
+	srv, err := mcdslgrpc.New(certFile, keyFile, deps.Authenticator, methodMap(), logger, nil)
 	if err != nil {
 		return nil, err
 	}

internal/oci/blob.go

@@ -7,8 +7,8 @@ import (
 	"net/http"
 	"strconv"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 func (h *Handler) handleBlobGet(w http.ResponseWriter, r *http.Request, repo, digest string) {

internal/oci/catalog.go

@@ -6,7 +6,7 @@ import (
 	"net/http"
 	"strconv"
 
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 type catalogResponse struct {

internal/oci/delete.go

@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"net/http"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 // handleManifestDelete handles DELETE /v2/<name>/manifests/<digest>.

internal/oci/handler.go

@@ -6,10 +6,10 @@ import (
 	"net/http"
 	"strings"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
-	"git.wntrmute.dev/kyle/mcr/internal/storage"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/storage"
 )
 
 // DBQuerier provides the database operations needed by OCI handlers.

internal/oci/handler_test.go

@@ -10,10 +10,10 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
-	"git.wntrmute.dev/kyle/mcr/internal/storage"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/storage"
 )
 
 // manifestKey uniquely identifies a manifest for test lookup.

internal/oci/manifest.go

@@ -10,9 +10,9 @@ import (
 	"net/http"
 	"strconv"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 func (h *Handler) handleManifestGet(w http.ResponseWriter, r *http.Request, repo, reference string) {

internal/oci/tags.go

@@ -7,8 +7,8 @@ import (
 	"net/http"
 	"strconv"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 type tagListResponse struct {

internal/oci/upload.go

@@ -8,9 +8,9 @@ import (
 	"net/http"
 	"sync"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
-	"git.wntrmute.dev/kyle/mcr/internal/storage"
+	"git.wntrmute.dev/mc/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/storage"
 )
 
 // uploadManager tracks in-progress blob writers by UUID.

internal/oci/upload_test.go

@@ -12,8 +12,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/storage"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/storage"
 )
 
 // testHandlerWithStorage creates a handler with real storage in t.TempDir().

internal/server/admin.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"net/http"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
 )
 
 type adminErrorResponse struct {

internal/server/admin_audit.go

@@ -4,7 +4,7 @@ import (
 	"net/http"
 	"strconv"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
 )
 
 // AdminListAuditHandler handles GET /v1/audit.

internal/server/admin_audit_test.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"testing"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
 )
 
 func TestAdminListAuditEvents(t *testing.T) {

internal/server/admin_auth_test.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
 )
 
 func TestAdminHealthHandler(t *testing.T) {

internal/server/admin_gc.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/google/uuid"
 
-	"git.wntrmute.dev/kyle/mcr/internal/gc"
+	"git.wntrmute.dev/mc/mcr/internal/gc"
 )
 
 // GCLastRun records the result of the last GC run.

internal/server/admin_policy.go

@@ -9,9 +9,9 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 // PolicyReloader can reload policy rules from a store.

internal/server/admin_policy_test.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"testing"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
 )
 
 func TestAdminPolicyCRUDCycle(t *testing.T) {

internal/server/admin_repo.go

@@ -7,8 +7,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/db"
 )
 
 // AdminListReposHandler handles GET /v1/repositories.

internal/server/admin_repo_test.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"testing"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
 )
 
 // seedRepoForAdmin inserts a repository with a manifest and tags into the test DB.

internal/server/admin_routes.go

@@ -3,7 +3,7 @@ package server
 import (
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
 )
 
 // AdminDeps holds the dependencies needed by admin routes.

internal/server/admin_test.go

@@ -10,9 +10,9 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 func openAdminTestDB(t *testing.T) *db.DB {

internal/server/middleware.go

@@ -5,7 +5,7 @@ import (
 	"net/http"
 	"strings"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
 )
 
 // TokenValidator abstracts token validation so the middleware can work

internal/server/middleware_test.go

@@ -6,7 +6,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
 )
 
 type fakeValidator struct {

internal/server/policy.go

@@ -5,8 +5,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 // PolicyEvaluator abstracts the policy engine for testability.

internal/server/policy_test.go

@@ -8,8 +8,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 type fakePolicyEvaluator struct {

internal/server/routes_test.go

@@ -6,7 +6,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
 )
 
 func TestRoutesV2Authenticated(t *testing.T) {

internal/server/token_test.go

@@ -6,7 +6,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
 )
 
 type fakeLoginClient struct {

internal/webserver/auth.go

@@ -8,6 +8,7 @@ import (
 	"encoding/hex"
 	"log"
 	"net/http"
+	"slices"
 	"strings"
 )
 
@@ -93,6 +94,31 @@ func (s *Server) handleLoginSubmit(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Validate the token to check roles. Guest accounts are not
+	// permitted to use the web interface.
+	roles, err := s.validateFn(token)
+	if err != nil {
+		log.Printf("login token validation failed for user %q: %v", username, err)
+		csrf := s.generateCSRFToken(w)
+		s.templates.render(w, "login", map[string]any{
+			"Error":     "Login failed. Please try again.",
+			"CSRFToken": csrf,
+			"Session":   false,
+		})
+		return
+	}
+
+	if slices.Contains(roles, "guest") {
+		log.Printf("login denied for guest user %q", username)
+		csrf := s.generateCSRFToken(w)
+		s.templates.render(w, "login", map[string]any{
+			"Error":     "Guest accounts are not permitted to access the web interface.",
+			"CSRFToken": csrf,
+			"Session":   false,
+		})
+		return
+	}
+
 	http.SetCookie(w, &http.Cookie{
 		Name:     "mcr_session",
 		Value:    token,

internal/webserver/handlers.go

@@ -7,7 +7,7 @@ import (
 	"strconv"
 	"strings"
 
-	mcrv1 "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	mcrv1 "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
 
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"

internal/webserver/server.go

@@ -14,23 +14,27 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 
-	mcrv1 "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
-	"git.wntrmute.dev/kyle/mcr/web"
+	mcrv1 "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
+	"git.wntrmute.dev/mc/mcr/web"
 )
 
 // LoginFunc authenticates a user and returns a bearer token.
 type LoginFunc func(username, password string) (token string, expiresIn int, err error)
 
+// ValidateFunc validates a bearer token and returns the user's roles.
+type ValidateFunc func(token string) (roles []string, err error)
+
 // Server is the MCR web UI server.
 type Server struct {
-	router    chi.Router
-	templates *templateSet
-	registry  mcrv1.RegistryServiceClient
-	policy    mcrv1.PolicyServiceClient
-	audit     mcrv1.AuditServiceClient
-	admin     mcrv1.AdminServiceClient
-	loginFn   LoginFunc
-	csrfKey   []byte // 32-byte key for HMAC signing
+	router     chi.Router
+	templates  *templateSet
+	registry   mcrv1.RegistryServiceClient
+	policy     mcrv1.PolicyServiceClient
+	audit      mcrv1.AuditServiceClient
+	admin      mcrv1.AdminServiceClient
+	loginFn    LoginFunc
+	validateFn ValidateFunc
+	csrfKey    []byte // 32-byte key for HMAC signing
 }
 
 // New creates a new web UI server with the given gRPC clients and login function.
@@ -40,6 +44,7 @@ func New(
 	audit mcrv1.AuditServiceClient,
 	admin mcrv1.AdminServiceClient,
 	loginFn LoginFunc,
+	validateFn ValidateFunc,
 	csrfKey []byte,
 ) (*Server, error) {
 	tmpl, err := loadTemplates()
@@ -48,13 +53,14 @@ func New(
 	}
 
 	s := &Server{
-		templates: tmpl,
-		registry:  registry,
-		policy:    policy,
-		audit:     audit,
-		admin:     admin,
-		loginFn:   loginFn,
-		csrfKey:   csrfKey,
+		templates:  tmpl,
+		registry:   registry,
+		policy:     policy,
+		audit:      audit,
+		admin:      admin,
+		loginFn:    loginFn,
+		validateFn: validateFn,
+		csrfKey:    csrfKey,
 	}
 
 	s.router = s.buildRouter()

internal/webserver/server_test.go

@@ -15,7 +15,7 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/status"
 
-	mcrv1 "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	mcrv1 "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
 )
 
 // fakeRegistryService implements RegistryServiceServer for testing.
@@ -183,15 +183,35 @@ func setupTestEnv(t *testing.T) *testEnv {
 		if username == "admin" && password == "secret" {
 			return "test-token-12345", 3600, nil
 		}
+		if username == "guest" && password == "secret" {
+			return "test-token-guest", 3600, nil
+		}
+		if username == "user" && password == "secret" {
+			return "test-token-user", 3600, nil
+		}
 		return "", 0, fmt.Errorf("invalid credentials")
 	}
 
+	validateFn := func(token string) ([]string, error) {
+		switch token {
+		case "test-token-12345":
+			return []string{"admin"}, nil
+		case "test-token-guest":
+			return []string{"guest"}, nil
+		case "test-token-user":
+			return []string{"user"}, nil
+		default:
+			return nil, fmt.Errorf("invalid token")
+		}
+	}
+
 	srv, err := New(
 		mcrv1.NewRegistryServiceClient(conn),
 		mcrv1.NewPolicyServiceClient(conn),
 		mcrv1.NewAuditServiceClient(conn),
 		mcrv1.NewAdminServiceClient(conn),
 		loginFn,
+		validateFn,
 		csrfKey,
 	)
 	if err != nil {
@@ -543,6 +563,59 @@ func TestTruncate(t *testing.T) {
 	}
 }
 
+func TestLoginDeniesGuest(t *testing.T) {
+	env := setupTestEnv(t)
+	defer env.close()
+
+	// Get CSRF token.
+	getReq := httptest.NewRequest(http.MethodGet, "/login", nil)
+	getRec := httptest.NewRecorder()
+	env.server.Handler().ServeHTTP(getRec, getReq)
+
+	var csrfCookie *http.Cookie
+	for _, c := range getRec.Result().Cookies() {
+		if c.Name == "csrf_token" {
+			csrfCookie = c
+			break
+		}
+	}
+	if csrfCookie == nil {
+		t.Fatal("no csrf_token cookie")
+	}
+
+	parts := strings.SplitN(csrfCookie.Value, ".", 2)
+	csrfToken := parts[0]
+
+	form := url.Values{
+		"username": {"guest"},
+		"password": {"secret"},
+		"_csrf":    {csrfToken},
+	}
+
+	postReq := httptest.NewRequest(http.MethodPost, "/login", strings.NewReader(form.Encode()))
+	postReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	postReq.AddCookie(csrfCookie)
+	postRec := httptest.NewRecorder()
+
+	env.server.Handler().ServeHTTP(postRec, postReq)
+
+	if postRec.Code != http.StatusOK {
+		t.Fatalf("POST /login as guest: status %d, want %d", postRec.Code, http.StatusOK)
+	}
+
+	body := postRec.Body.String()
+	if !strings.Contains(body, "Guest accounts are not permitted") {
+		t.Error("response does not contain guest denial message")
+	}
+
+	// Verify no session cookie was set.
+	for _, c := range postRec.Result().Cookies() {
+		if c.Name == "mcr_session" {
+			t.Error("session cookie should not be set for guest login")
+		}
+	}
+}
+
 func TestLoginSuccessSetsCookie(t *testing.T) {
 	env := setupTestEnv(t)
 	defer env.close()

internal/webserver/templates.go

@@ -8,7 +8,7 @@ import (
 	"strings"
 	"time"
 
-	"git.wntrmute.dev/kyle/mcr/web"
+	"git.wntrmute.dev/mc/mcr/web"
 )
 
 // templateSet wraps parsed templates and provides a render method.

proto/mcr/v1/admin.proto

@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package mcr.v1;
 
-option go_package = "git.wntrmute.dev/kyle/mcr/gen/mcr/v1;mcrv1";
+option go_package = "git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1";
 
 service AdminService {
   rpc Health(HealthRequest) returns (HealthResponse);

proto/mcr/v1/audit.proto

@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package mcr.v1;
 
-option go_package = "git.wntrmute.dev/kyle/mcr/gen/mcr/v1;mcrv1";
+option go_package = "git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1";
 
 import "mcr/v1/common.proto";
 

proto/mcr/v1/common.proto

@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package mcr.v1;
 
-option go_package = "git.wntrmute.dev/kyle/mcr/gen/mcr/v1;mcrv1";
+option go_package = "git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1";
 
 // Pagination controls for list RPCs.
 message PaginationRequest {

proto/mcr/v1/policy.proto

@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package mcr.v1;
 
-option go_package = "git.wntrmute.dev/kyle/mcr/gen/mcr/v1;mcrv1";
+option go_package = "git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1";
 
 import "mcr/v1/common.proto";
 

proto/mcr/v1/registry.proto

@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package mcr.v1;
 
-option go_package = "git.wntrmute.dev/kyle/mcr/gen/mcr/v1;mcrv1";
+option go_package = "git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1";
 
 import "mcr/v1/common.proto";
 
@@ -25,6 +25,7 @@ message RepositoryMetadata {
 message TagInfo {
   string name = 1;
   string digest = 2;
+  string updated_at = 3;
 }
 
 message ManifestInfo {

vendor/git.wntrmute.dev/mc/mcdsl/config/config.go

@@ -34,7 +34,7 @@ import (
 
 	"github.com/pelletier/go-toml/v2"
 
-	"git.wntrmute.dev/kyle/mcdsl/auth"
+	"git.wntrmute.dev/mc/mcdsl/auth"
 )
 
 // Base contains the configuration sections common to all Metacircular
@@ -144,6 +144,8 @@ func Load[T any](path string, envPrefix string) (*T, error) {
 		applyEnvToStruct(reflect.ValueOf(&cfg).Elem(), envPrefix)
 	}
 
+	applyPortEnv(&cfg)
+
 	applyBaseDefaults(&cfg)
 
 	if err := validateBase(&cfg); err != nil {
@@ -239,6 +241,70 @@ func findBase(cfg any) *Base {
 	return nil
 }
 
+// applyPortEnv overrides ServerConfig.ListenAddr and ServerConfig.GRPCAddr
+// from $PORT and $PORT_GRPC respectively. These environment variables are
+// set by the MCP agent to assign authoritative port bindings, so they take
+// precedence over both TOML values and generic env overrides.
+func applyPortEnv(cfg any) {
+	sc := findServerConfig(cfg)
+	if sc == nil {
+		return
+	}
+
+	if port, ok := os.LookupEnv("PORT"); ok {
+		sc.ListenAddr = ":" + port
+	}
+	if port, ok := os.LookupEnv("PORT_GRPC"); ok {
+		sc.GRPCAddr = ":" + port
+	}
+}
+
+// findServerConfig returns a pointer to the ServerConfig in the config
+// struct. It first checks for an embedded Base (which contains Server),
+// then walks the struct tree via reflection to find any ServerConfig field
+// directly (e.g., the Metacrypt pattern where ServerConfig is embedded
+// without Base).
+func findServerConfig(cfg any) *ServerConfig {
+	if base := findBase(cfg); base != nil {
+		return &base.Server
+	}
+
+	return findServerConfigReflect(reflect.ValueOf(cfg))
+}
+
+// findServerConfigReflect walks the struct tree to find a ServerConfig field.
+func findServerConfigReflect(v reflect.Value) *ServerConfig {
+	if v.Kind() == reflect.Ptr {
+		v = v.Elem()
+	}
+	if v.Kind() != reflect.Struct {
+		return nil
+	}
+
+	scType := reflect.TypeOf(ServerConfig{})
+	t := v.Type()
+	for i := range t.NumField() {
+		field := t.Field(i)
+		fv := v.Field(i)
+
+		if field.Type == scType {
+			sc, ok := fv.Addr().Interface().(*ServerConfig)
+			if ok {
+				return sc
+			}
+		}
+
+		// Recurse into embedded or nested structs.
+		if fv.Kind() == reflect.Struct && field.Type != scType {
+			if sc := findServerConfigReflect(fv); sc != nil {
+				return sc
+			}
+		}
+	}
+
+	return nil
+}
+
 // applyEnvToStruct recursively walks a struct and overrides field values
 // from environment variables. The env variable name is built from the
 // prefix and the toml tag: PREFIX_SECTION_FIELD (uppercased).

vendor/git.wntrmute.dev/mc/mcdsl/grpcserver/server.go

@@ -21,7 +21,7 @@ import (
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
 
-	"git.wntrmute.dev/kyle/mcdsl/auth"
+	"git.wntrmute.dev/mc/mcdsl/auth"
 )
 
 // MethodMap classifies gRPC methods for access control.
@@ -48,21 +48,45 @@ type Server struct {
 	listener net.Listener
 }
 
+// Options configures optional behavior for the gRPC server.
+type Options struct {
+	// PreInterceptors run before the logging and auth interceptors.
+	// Use for lifecycle gates like seal checks that should reject
+	// requests before any auth validation occurs.
+	PreInterceptors []grpc.UnaryServerInterceptor
+
+	// PostInterceptors run after auth but before the handler.
+	// Use for audit logging, rate limiting, or other cross-cutting
+	// concerns that need access to the authenticated identity.
+	PostInterceptors []grpc.UnaryServerInterceptor
+}
+
 // New creates a gRPC server with TLS (if certFile and keyFile are
-// non-empty) and an interceptor chain: logging → auth → handler.
+// non-empty) and an interceptor chain:
+//
+//	[pre-interceptors] → logging → auth → [post-interceptors] → handler
 //
 // The auth interceptor uses methods to determine the access level for
 // each RPC. Methods not in any map are denied by default.
 //
 // If certFile and keyFile are empty, TLS is skipped (for testing).
-func New(certFile, keyFile string, authenticator *auth.Authenticator, methods MethodMap, logger *slog.Logger) (*Server, error) {
-	chain := grpc.ChainUnaryInterceptor(
+// opts is optional; pass nil for the default chain (logging + auth only).
+func New(certFile, keyFile string, authenticator *auth.Authenticator, methods MethodMap, logger *slog.Logger, opts *Options) (*Server, error) {
+	var interceptors []grpc.UnaryServerInterceptor
+	if opts != nil {
+		interceptors = append(interceptors, opts.PreInterceptors...)
+	}
+	interceptors = append(interceptors,
 		loggingInterceptor(logger),
 		authInterceptor(authenticator, methods),
 	)
+	if opts != nil {
+		interceptors = append(interceptors, opts.PostInterceptors...)
+	}
+	chain := grpc.ChainUnaryInterceptor(interceptors...)
 
-	var opts []grpc.ServerOption
-	opts = append(opts, chain)
+	var serverOpts []grpc.ServerOption
+	serverOpts = append(serverOpts, chain)
 
 	if certFile != "" && keyFile != "" {
 		cert, err := tls.LoadX509KeyPair(certFile, keyFile)
@@ -73,11 +97,11 @@ func New(certFile, keyFile string, authenticator *auth.Authenticator, methods Me
 			Certificates: []tls.Certificate{cert},
 			MinVersion:   tls.VersionTLS13,
 		}
-		opts = append(opts, grpc.Creds(credentials.NewTLS(tlsCfg)))
+		serverOpts = append(serverOpts, grpc.Creds(credentials.NewTLS(tlsCfg)))
 	}
 
 	return &Server{
-		GRPCServer: grpc.NewServer(opts...),
+		GRPCServer: grpc.NewServer(serverOpts...),
 		Logger:     logger,
 	}, nil
 }

vendor/modules.txt

@@ -1,9 +1,9 @@
-# git.wntrmute.dev/kyle/mcdsl v1.0.0
+# git.wntrmute.dev/mc/mcdsl v1.2.0
 ## explicit; go 1.25.7
-git.wntrmute.dev/kyle/mcdsl/auth
-git.wntrmute.dev/kyle/mcdsl/config
-git.wntrmute.dev/kyle/mcdsl/db
-git.wntrmute.dev/kyle/mcdsl/grpcserver
+git.wntrmute.dev/mc/mcdsl/auth
+git.wntrmute.dev/mc/mcdsl/config
+git.wntrmute.dev/mc/mcdsl/db
+git.wntrmute.dev/mc/mcdsl/grpcserver
 # github.com/dustin/go-humanize v1.0.1
 ## explicit; go 1.16
 github.com/dustin/go-humanize