Standardize Makefile docker/push targets for MCR

Add MCR and VERSION variables. Tag images with full MCR registry URL
and version. Add push target. Fix docker target to build both
Dockerfile.api and Dockerfile.web (was only building one).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -32,7 +32,7 @@ go test ./internal/server -run TestPushManifest
 ## Tech Stack
 
 - **Language:** Go 1.25+, `CGO_ENABLED=0`, statically linked
-- **Module path:** `git.wntrmute.dev/kyle/mcr`
+- **Module path:** `git.wntrmute.dev/mc/mcr`
 - **Database:** SQLite via `modernc.org/sqlite` (pure-Go, no CGo)
 - **Config:** TOML via `go-toml/v2`, env overrides via `MCR_*`
 - **APIs:** REST (chi) + gRPC (protobuf), kept in sync

Makefile

@@ -1,6 +1,8 @@
-.PHONY: build test vet lint proto proto-lint clean docker all devserver
+.PHONY: build test vet lint proto proto-lint clean docker push all devserver
 
-LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(shell git describe --tags --always --dirty)"
+MCR     := mcr.svc.mcp.metacircular.net:8443
+VERSION := $(shell git describe --tags --always --dirty)
+LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(VERSION)"
 
 mcrsrv:
 	CGO_ENABLED=0 go build $(LDFLAGS) -o mcrsrv ./cmd/mcrsrv
@@ -24,8 +26,8 @@ lint:
 	golangci-lint run ./...
 
 proto:
-	protoc --go_out=. --go_opt=module=git.wntrmute.dev/kyle/mcr \
+	protoc --go_out=. --go_opt=module=git.wntrmute.dev/mc/mcr \
-		--go-grpc_out=. --go-grpc_opt=module=git.wntrmute.dev/kyle/mcr \
+		--go-grpc_out=. --go-grpc_opt=module=git.wntrmute.dev/mc/mcr \
 		proto/mcr/v1/*.proto
 
 proto-lint:
@@ -36,7 +38,12 @@ clean:
 	rm -f mcrsrv mcr-web mcrctl
 
 docker:
-	docker build --build-arg VERSION=$(shell git describe --tags --always --dirty) -t mcr -f Dockerfile .
+	docker build --build-arg VERSION=$(VERSION) -t $(MCR)/mcr:$(VERSION) -f Dockerfile.api .
+	docker build --build-arg VERSION=$(VERSION) -t $(MCR)/mcr-web:$(VERSION) -f Dockerfile.web .
+
+push: docker
+	docker push $(MCR)/mcr:$(VERSION)
+	docker push $(MCR)/mcr-web:$(VERSION)
 
 devserver: mcrsrv
 	@mkdir -p srv

PROGRESS.md

@@ -712,7 +712,7 @@ Lint fix:
 entry points with cobra subcommands.
 
 **Changes:**
-- `go.mod`: module `git.wntrmute.dev/kyle/mcr`, Go 1.25, cobra dependency
+- `go.mod`: module `git.wntrmute.dev/mc/mcr`, Go 1.25, cobra dependency
 - Directory skeleton: `cmd/mcrsrv/`, `cmd/mcr-web/`, `cmd/mcrctl/`,
   `internal/`, `proto/mcr/v1/`, `gen/mcr/v1/`, `web/templates/`,
   `web/static/`, `deploy/docker/`, `deploy/examples/`, `deploy/scripts/`,

PROJECT_PLAN.md

@@ -63,7 +63,7 @@ produces a project that builds and lints cleanly with no functionality.
 ### Step 0.1: Go module and directory structure
 
 **Acceptance criteria:**
-- `go.mod` initialized with module path `git.wntrmute.dev/kyle/mcr`
+- `go.mod` initialized with module path `git.wntrmute.dev/mc/mcr`
 - Directory skeleton created per `ARCHITECTURE.md` §13:
   `cmd/mcrsrv/`, `cmd/mcr-web/`, `cmd/mcrctl/`, `internal/`, `proto/mcr/v1/`,
   `gen/mcr/v1/`, `web/`, `deploy/`

RUNBOOK.md

@@ -361,7 +361,7 @@ active = true
 
 [[components]]
 name = "api"
-image = "mcr.svc.mcp.metacircular.net:8443/mcr:latest"
+image = "mcr.svc.mcp.metacircular.net:8443/mcr:v1.1.0"
 network = "mcpnet"
 user = "0:0"
 restart = "unless-stopped"
@@ -371,7 +371,7 @@ cmd = ["server", "--config", "/srv/mcr/mcr.toml"]
 
 [[components]]
 name = "web"
-image = "mcr.svc.mcp.metacircular.net:8443/mcr-web:latest"
+image = "mcr.svc.mcp.metacircular.net:8443/mcr-web:v1.1.0"
 network = "mcpnet"
 user = "0:0"
 restart = "unless-stopped"

cmd/mcr-web/main.go

@@ -17,10 +17,10 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 
-	mcrv1 "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	mcrv1 "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/config"
+	"git.wntrmute.dev/mc/mcr/internal/config"
-	"git.wntrmute.dev/kyle/mcr/internal/webserver"
+	"git.wntrmute.dev/mc/mcr/internal/webserver"
 )
 
 var version = "dev"
@@ -170,6 +170,7 @@ func runServer(configPath string) error {
 func dialGRPC(cfg *config.Config) (*grpc.ClientConn, error) {
 	tlsCfg := &tls.Config{
 		MinVersion: tls.VersionTLS13,
+		ServerName: cfg.Web.TLSServerName,
 	}
 
 	if cfg.Web.CACert != "" {

cmd/mcrctl/client.go

@@ -14,7 +14,7 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 
-	mcrv1 "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	mcrv1 "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
 )
 
 // apiClient wraps both REST and gRPC transports. When grpcAddr is set

cmd/mcrctl/main.go

@@ -11,7 +11,7 @@ import (
 
 	"github.com/spf13/cobra"
 
-	mcrv1 "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	mcrv1 "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
 )
 
 var version = "dev"
@@ -62,6 +62,7 @@ func main() {
 	root.AddCommand(statusCmd())
 	root.AddCommand(repoCmd())
 	root.AddCommand(gcCmd())
+	root.AddCommand(purgeCmd())
 	root.AddCommand(policyCmd())
 	root.AddCommand(auditCmd())
 	root.AddCommand(snapshotCmd())

cmd/mcrctl/purge.go

@@ -0,0 +1,274 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path"
+	"sort"
+	"strings"
+
+	"github.com/spf13/cobra"
+
+	mcrv1 "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
+)
+
+func purgeCmd() *cobra.Command {
+	var (
+		keep    int
+		repo    string
+		dryRun  bool
+		trigGC  bool
+	)
+
+	cmd := &cobra.Command{
+		Use:   "purge",
+		Short: "Remove old image tags, keeping the last N per repository",
+		Long: `Purge removes old image tags from repositories based on a retention
+policy. The 'latest' tag is always kept. For each repository, tags are
+sorted by updated_at (most recent first) and only the --keep most recent
+are retained. Remaining tags' manifests are deleted, cascading to their
+tag references. Run with --gc to trigger garbage collection afterward.`,
+		RunE: func(_ *cobra.Command, _ []string) error {
+			return runPurge(keep, repo, dryRun, trigGC)
+		},
+	}
+
+	cmd.Flags().IntVar(&keep, "keep", 3, "number of tags to keep per repo (excluding latest)")
+	cmd.Flags().StringVar(&repo, "repo", "", "limit to repositories matching this glob pattern")
+	cmd.Flags().BoolVar(&dryRun, "dry-run", false, "show what would be deleted without deleting")
+	cmd.Flags().BoolVar(&trigGC, "gc", false, "trigger garbage collection after purging")
+
+	return cmd
+}
+
+// tagWithTime is a tag with its timestamp for sorting.
+type tagWithTime struct {
+	Name      string
+	Digest    string
+	UpdatedAt string
+}
+
+func runPurge(keep int, repoPattern string, dryRun, trigGC bool) error {
+	if keep < 0 {
+		return fmt.Errorf("--keep must be non-negative")
+	}
+
+	// List repositories.
+	repos, err := listRepos()
+	if err != nil {
+		return err
+	}
+
+	// Filter by pattern if given.
+	if repoPattern != "" {
+		var filtered []string
+		for _, r := range repos {
+			matched, _ := path.Match(repoPattern, r)
+			if matched {
+				filtered = append(filtered, r)
+			}
+		}
+		repos = filtered
+	}
+
+	if len(repos) == 0 {
+		_, _ = fmt.Fprintln(os.Stdout, "No repositories matched.")
+		return nil
+	}
+
+	totalDeleted := 0
+
+	for _, repoName := range repos {
+		tags, err := listTagsWithTime(repoName)
+		if err != nil {
+			_, _ = fmt.Fprintf(os.Stderr, "warning: skipping %s: %v\n", repoName, err)
+			continue
+		}
+
+		// Separate latest from versioned tags.
+		var latest *tagWithTime
+		var versioned []tagWithTime
+		for _, t := range tags {
+			if t.Name == "latest" {
+				lt := t
+				latest = &lt
+			} else {
+				versioned = append(versioned, t)
+			}
+		}
+
+		// Sort by updated_at descending (most recent first).
+		sort.Slice(versioned, func(i, j int) bool {
+			return versioned[i].UpdatedAt > versioned[j].UpdatedAt
+		})
+
+		// Determine which tags to delete.
+		if len(versioned) <= keep {
+			continue // nothing to purge
+		}
+
+		toDelete := versioned[keep:]
+
+		// Build set of digests that are still referenced by kept tags.
+		keptDigests := make(map[string]bool)
+		if latest != nil {
+			keptDigests[latest.Digest] = true
+		}
+		for _, t := range versioned[:keep] {
+			keptDigests[t.Digest] = true
+		}
+
+		for _, t := range toDelete {
+			if keptDigests[t.Digest] {
+				// Manifest is shared with a kept tag — skip deletion.
+				if dryRun {
+					_, _ = fmt.Fprintf(os.Stdout, "[skip]   %s:%s (manifest shared with kept tag)\n", repoName, t.Name)
+				}
+				continue
+			}
+
+			if dryRun {
+				_, _ = fmt.Fprintf(os.Stdout, "[delete] %s:%s (digest: %s, updated: %s)\n", repoName, t.Name, t.Digest[:12], t.UpdatedAt)
+			} else {
+				if err := deleteManifest(repoName, t.Digest); err != nil {
+					_, _ = fmt.Fprintf(os.Stderr, "warning: failed to delete %s:%s: %v\n", repoName, t.Name, err)
+					continue
+				}
+				_, _ = fmt.Fprintf(os.Stdout, "deleted %s:%s\n", repoName, t.Name)
+			}
+			totalDeleted++
+		}
+	}
+
+	if dryRun {
+		_, _ = fmt.Fprintf(os.Stdout, "\nDry run: %d manifests would be deleted.\n", totalDeleted)
+	} else {
+		_, _ = fmt.Fprintf(os.Stdout, "\nPurged %d manifests.\n", totalDeleted)
+	}
+
+	// Trigger GC if requested and not a dry run.
+	if trigGC && !dryRun && totalDeleted > 0 {
+		_, _ = fmt.Fprintln(os.Stdout, "Triggering garbage collection...")
+		if err := triggerGC(); err != nil {
+			return fmt.Errorf("gc: %w", err)
+		}
+		_, _ = fmt.Fprintln(os.Stdout, "Garbage collection started.")
+	}
+
+	return nil
+}
+
+// listRepos returns all repository names.
+func listRepos() ([]string, error) {
+	if client.useGRPC() {
+		resp, err := client.registry.ListRepositories(context.Background(), &mcrv1.ListRepositoriesRequest{})
+		if err != nil {
+			return nil, fmt.Errorf("list repositories: %w", err)
+		}
+		var names []string
+		for _, r := range resp.GetRepositories() {
+			names = append(names, r.GetName())
+		}
+		return names, nil
+	}
+
+	data, err := client.restDo("GET", "/v1/repositories", nil)
+	if err != nil {
+		return nil, fmt.Errorf("list repositories: %w", err)
+	}
+
+	var repos []struct {
+		Name string `json:"name"`
+	}
+	if err := json.Unmarshal(data, &repos); err != nil {
+		return nil, err
+	}
+
+	var names []string
+	for _, r := range repos {
+		names = append(names, r.Name)
+	}
+	return names, nil
+}
+
+// listTagsWithTime returns tags with timestamps for a repository.
+func listTagsWithTime(repoName string) ([]tagWithTime, error) {
+	if client.useGRPC() {
+		resp, err := client.registry.GetRepository(context.Background(), &mcrv1.GetRepositoryRequest{Name: repoName})
+		if err != nil {
+			return nil, fmt.Errorf("get repository: %w", err)
+		}
+		var tags []tagWithTime
+		for _, t := range resp.GetTags() {
+			tags = append(tags, tagWithTime{
+				Name:      t.GetName(),
+				Digest:    t.GetDigest(),
+				UpdatedAt: t.GetUpdatedAt(),
+			})
+		}
+		return tags, nil
+	}
+
+	data, err := client.restDo("GET", "/v1/repositories/"+repoName, nil)
+	if err != nil {
+		return nil, fmt.Errorf("get repository: %w", err)
+	}
+
+	var detail struct {
+		Tags []struct {
+			Name      string `json:"name"`
+			Digest    string `json:"digest"`
+			UpdatedAt string `json:"updated_at"`
+		} `json:"tags"`
+	}
+	if err := json.Unmarshal(data, &detail); err != nil {
+		return nil, err
+	}
+
+	var tags []tagWithTime
+	for _, t := range detail.Tags {
+		tags = append(tags, tagWithTime{
+			Name:      t.Name,
+			Digest:    t.Digest,
+			UpdatedAt: t.UpdatedAt,
+		})
+	}
+	return tags, nil
+}
+
+// deleteManifest deletes a manifest by digest via the OCI API.
+func deleteManifest(repoName, digest string) error {
+	if client.useGRPC() {
+		// No gRPC RPC for OCI manifest delete — fall back to REST.
+		// The OCI Distribution spec uses DELETE /v2/{name}/manifests/{reference}.
+	}
+
+	// URL-encode the repo name for path segments with slashes.
+	_, err := client.restDo("DELETE", "/v2/"+repoName+"/manifests/"+digest, nil)
+	return err
+}
+
+// triggerGC starts garbage collection.
+func triggerGC() error {
+	if client.useGRPC() {
+		_, err := client.registry.GarbageCollect(context.Background(), &mcrv1.GarbageCollectRequest{})
+		return err
+	}
+
+	_, err := client.restDo("POST", "/v1/gc", nil)
+	return err
+}
+
+// formatRepoName truncates long repo names for display.
+func formatRepoName(name string, maxLen int) string {
+	if len(name) <= maxLen {
+		return name
+	}
+	parts := strings.Split(name, "/")
+	if len(parts) > 1 {
+		return "..." + parts[len(parts)-1]
+	}
+	return name[:maxLen-3] + "..."
+}

cmd/mcrsrv/main.go

@@ -16,17 +16,17 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/config"
+	"git.wntrmute.dev/mc/mcr/internal/config"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/gc"
+	"git.wntrmute.dev/mc/mcr/internal/gc"
-	"git.wntrmute.dev/kyle/mcr/internal/oci"
+	"git.wntrmute.dev/mc/mcr/internal/oci"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
-	"git.wntrmute.dev/kyle/mcr/internal/server"
+	"git.wntrmute.dev/mc/mcr/internal/server"
-	"git.wntrmute.dev/kyle/mcr/internal/storage"
+	"git.wntrmute.dev/mc/mcr/internal/storage"
 
-	"git.wntrmute.dev/kyle/mcr/internal/grpcserver"
+	"git.wntrmute.dev/mc/mcr/internal/grpcserver"
-	mcdsldb "git.wntrmute.dev/kyle/mcdsl/db"
+	mcdsldb "git.wntrmute.dev/mc/mcdsl/db"
 )
 
 var version = "dev"

deploy/examples/mcr.toml

@@ -25,9 +25,10 @@ service_name = "mcr"
 tags         = ["env:restricted"]
 
 [web]
-listen_addr = "127.0.0.1:8080"      # Web UI listen address
+listen_addr     = "127.0.0.1:8080"  # Web UI listen address
-grpc_addr   = "127.0.0.1:9443"      # mcrsrv gRPC address for the web UI
+grpc_addr       = "127.0.0.1:9443"  # mcrsrv gRPC address for the web UI
-ca_cert     = ""                     # CA cert for verifying mcrsrv gRPC TLS
+tls_server_name = ""                # Override TLS server name (when dial address differs from cert SAN)
+ca_cert         = ""                # CA cert for verifying mcrsrv gRPC TLS
 
 [log]
 level = "info"                       # debug, info, warn, error

deploy/mcr-rift.toml

@@ -30,9 +30,10 @@ service_name  = "mcr"
 service_token = "eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL21jaWFzLm1ldGFjaXJjdWxhci5uZXQiLCJzdWIiOiIwYWM3NDk3ZS0wZTE5LTRhOWMtYWI3Yi03YWZjMzc0ZDU3NzIiLCJleHAiOjE4MDYwMzczNzMsIm5iZiI6MTc3NDUwMTM3MywiaWF0IjoxNzc0NTAxMzczLCJqdGkiOiI1NTM0ZDU0OS1kYzY5LTRiNzctYTY5MC0xNzQ3NjE0MDUzYzEiLCJyb2xlcyI6bnVsbH0.bsnoGMrFzJJCIanGuiAvpqmlO2OssvFjYynQgiSt_TPMuLxziRuwuRIL9C_kRnHdF7C6c1mTHncKVj1hkLPiCg"
 
 [web]
-listen_addr = ":8080"
+listen_addr     = ":8080"
-grpc_addr   = "mcr:9443"
+grpc_addr       = "mcr-api:9443"
-ca_cert     = "/srv/mcr/certs/ca.pem"
+tls_server_name = "mcr.svc.mcp.metacircular.net"
+ca_cert         = "/srv/mcr/certs/ca.pem"
 
 [log]
 level = "info"

flake.nix

@@ -10,7 +10,7 @@
     let
       system = "x86_64-linux";
       pkgs = nixpkgs.legacyPackages.${system};
-      version = "0.1.0";
+      version = "1.2.0";
     in
     {
       packages.${system} = {

gen/mcr/v1/admin.pb.go

@@ -1,14 +1,97 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.32.1
 // source: mcr/v1/admin.proto
 
 package mcrv1
 
-// HealthRequest is the request message for Health.
+import (
-type HealthRequest struct{}
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type HealthRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *HealthRequest) Reset() {
+	*x = HealthRequest{}
+	mi := &file_mcr_v1_admin_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *HealthRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HealthRequest) ProtoMessage() {}
+
+func (x *HealthRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_admin_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HealthRequest.ProtoReflect.Descriptor instead.
+func (*HealthRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_admin_proto_rawDescGZIP(), []int{0}
+}
 
-// HealthResponse is the response message for Health.
 type HealthResponse struct {
-	Status string `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Status        string                 `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *HealthResponse) Reset() {
+	*x = HealthResponse{}
+	mi := &file_mcr_v1_admin_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *HealthResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HealthResponse) ProtoMessage() {}
+
+func (x *HealthResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_admin_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HealthResponse.ProtoReflect.Descriptor instead.
+func (*HealthResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_admin_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *HealthResponse) GetStatus() string {
@@ -17,3 +100,65 @@ func (x *HealthResponse) GetStatus() string {
 	}
 	return ""
 }
+
+var File_mcr_v1_admin_proto protoreflect.FileDescriptor
+
+const file_mcr_v1_admin_proto_rawDesc = "" +
+	"\n" +
+	"\x12mcr/v1/admin.proto\x12\x06mcr.v1\"\x0f\n" +
+	"\rHealthRequest\"(\n" +
+	"\x0eHealthResponse\x12\x16\n" +
+	"\x06status\x18\x01 \x01(\tR\x06status2G\n" +
+	"\fAdminService\x127\n" +
+	"\x06Health\x12\x15.mcr.v1.HealthRequest\x1a\x16.mcr.v1.HealthResponseB*Z(git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1b\x06proto3"
+
+var (
+	file_mcr_v1_admin_proto_rawDescOnce sync.Once
+	file_mcr_v1_admin_proto_rawDescData []byte
+)
+
+func file_mcr_v1_admin_proto_rawDescGZIP() []byte {
+	file_mcr_v1_admin_proto_rawDescOnce.Do(func() {
+		file_mcr_v1_admin_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_mcr_v1_admin_proto_rawDesc), len(file_mcr_v1_admin_proto_rawDesc)))
+	})
+	return file_mcr_v1_admin_proto_rawDescData
+}
+
+var file_mcr_v1_admin_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_mcr_v1_admin_proto_goTypes = []any{
+	(*HealthRequest)(nil),  // 0: mcr.v1.HealthRequest
+	(*HealthResponse)(nil), // 1: mcr.v1.HealthResponse
+}
+var file_mcr_v1_admin_proto_depIdxs = []int32{
+	0, // 0: mcr.v1.AdminService.Health:input_type -> mcr.v1.HealthRequest
+	1, // 1: mcr.v1.AdminService.Health:output_type -> mcr.v1.HealthResponse
+	1, // [1:2] is the sub-list for method output_type
+	0, // [0:1] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_mcr_v1_admin_proto_init() }
+func file_mcr_v1_admin_proto_init() {
+	if File_mcr_v1_admin_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_mcr_v1_admin_proto_rawDesc), len(file_mcr_v1_admin_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_mcr_v1_admin_proto_goTypes,
+		DependencyIndexes: file_mcr_v1_admin_proto_depIdxs,
+		MessageInfos:      file_mcr_v1_admin_proto_msgTypes,
+	}.Build()
+	File_mcr_v1_admin_proto = out.File
+	file_mcr_v1_admin_proto_goTypes = nil
+	file_mcr_v1_admin_proto_depIdxs = nil
+}

gen/mcr/v1/admin_grpc.pb.go

@@ -1,38 +1,92 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             v6.32.1
 // source: mcr/v1/admin.proto
 
 package mcrv1
 
 import (
-	"context"
+	context "context"
-
+	grpc "google.golang.org/grpc"
-	"google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
-	"google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
-	"google.golang.org/grpc/status"
 )
 
-// AdminServiceServer is the server API for AdminService.
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	AdminService_Health_FullMethodName = "/mcr.v1.AdminService/Health"
+)
+
+// AdminServiceClient is the client API for AdminService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type AdminServiceClient interface {
+	Health(ctx context.Context, in *HealthRequest, opts ...grpc.CallOption) (*HealthResponse, error)
+}
+
+type adminServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewAdminServiceClient(cc grpc.ClientConnInterface) AdminServiceClient {
+	return &adminServiceClient{cc}
+}
+
+func (c *adminServiceClient) Health(ctx context.Context, in *HealthRequest, opts ...grpc.CallOption) (*HealthResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(HealthResponse)
+	err := c.cc.Invoke(ctx, AdminService_Health_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// AdminServiceServer is the server API for AdminService service.
+// All implementations must embed UnimplementedAdminServiceServer
+// for forward compatibility.
 type AdminServiceServer interface {
 	Health(context.Context, *HealthRequest) (*HealthResponse, error)
 	mustEmbedUnimplementedAdminServiceServer()
 }
 
-// UnimplementedAdminServiceServer should be embedded to have forward
+// UnimplementedAdminServiceServer must be embedded to have
-// compatible implementations.
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
 type UnimplementedAdminServiceServer struct{}
 
 func (UnimplementedAdminServiceServer) Health(context.Context, *HealthRequest) (*HealthResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Health not implemented")
+	return nil, status.Error(codes.Unimplemented, "method Health not implemented")
+}
+func (UnimplementedAdminServiceServer) mustEmbedUnimplementedAdminServiceServer() {}
+func (UnimplementedAdminServiceServer) testEmbeddedByValue()                      {}
+
+// UnsafeAdminServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to AdminServiceServer will
+// result in compilation errors.
+type UnsafeAdminServiceServer interface {
+	mustEmbedUnimplementedAdminServiceServer()
 }
 
-func (UnimplementedAdminServiceServer) mustEmbedUnimplementedAdminServiceServer() {}
-
-// RegisterAdminServiceServer registers the AdminServiceServer with the grpc.Server.
 func RegisterAdminServiceServer(s grpc.ServiceRegistrar, srv AdminServiceServer) {
+	// If the following call panics, it indicates UnimplementedAdminServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&AdminService_ServiceDesc, srv)
 }
 
-func adminServiceHealthHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
+func _AdminService_Health_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(HealthRequest)
 	if err := dec(in); err != nil {
 		return nil, err
@@ -42,47 +96,26 @@ func adminServiceHealthHandler(srv any, ctx context.Context, dec func(any) error
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/mcr.v1.AdminService/Health",
+		FullMethod: AdminService_Health_FullMethodName,
 	}
-	handler := func(ctx context.Context, req any) (any, error) {
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(AdminServiceServer).Health(ctx, req.(*HealthRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
 
-// AdminService_ServiceDesc is the grpc.ServiceDesc for AdminService.
+// AdminService_ServiceDesc is the grpc.ServiceDesc for AdminService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
 var AdminService_ServiceDesc = grpc.ServiceDesc{
 	ServiceName: "mcr.v1.AdminService",
 	HandlerType: (*AdminServiceServer)(nil),
 	Methods: []grpc.MethodDesc{
 		{
 			MethodName: "Health",
-			Handler:    adminServiceHealthHandler,
+			Handler:    _AdminService_Health_Handler,
 		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "mcr/v1/admin.proto",
 }
-
-// AdminServiceClient is the client API for AdminService.
-type AdminServiceClient interface {
-	Health(ctx context.Context, in *HealthRequest, opts ...grpc.CallOption) (*HealthResponse, error)
-}
-
-type adminServiceClient struct {
-	cc grpc.ClientConnInterface
-}
-
-// NewAdminServiceClient creates a new AdminServiceClient.
-func NewAdminServiceClient(cc grpc.ClientConnInterface) AdminServiceClient {
-	return &adminServiceClient{cc}
-}
-
-func (c *adminServiceClient) Health(ctx context.Context, in *HealthRequest, opts ...grpc.CallOption) (*HealthResponse, error) {
-	out := new(HealthResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.AdminService/Health", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}

gen/mcr/v1/audit.pb.go

@@ -1,18 +1,68 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.32.1
 // source: mcr/v1/audit.proto
 
 package mcrv1
 
-// AuditEvent represents an audit log entry.
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
 type AuditEvent struct {
-	Id        int64             `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`               //nolint:revive,stylecheck // proto field name
+	state         protoimpl.MessageState `protogen:"open.v1"`
-	EventTime string            `protobuf:"bytes,2,opt,name=event_time,json=eventTime,proto3" json:"event_time,omitempty"`
+	Id            int64                  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
-	EventType string            `protobuf:"bytes,3,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"`
+	EventTime     string                 `protobuf:"bytes,2,opt,name=event_time,json=eventTime,proto3" json:"event_time,omitempty"`
-	ActorId   string            `protobuf:"bytes,4,opt,name=actor_id,json=actorId,proto3" json:"actor_id,omitempty"`       //nolint:revive,stylecheck // proto field name
+	EventType     string                 `protobuf:"bytes,3,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"`
-	Repository string           `protobuf:"bytes,5,opt,name=repository,proto3" json:"repository,omitempty"`
+	ActorId       string                 `protobuf:"bytes,4,opt,name=actor_id,json=actorId,proto3" json:"actor_id,omitempty"`
-	Digest    string            `protobuf:"bytes,6,opt,name=digest,proto3" json:"digest,omitempty"`
+	Repository    string                 `protobuf:"bytes,5,opt,name=repository,proto3" json:"repository,omitempty"`
-	IpAddress string            `protobuf:"bytes,7,opt,name=ip_address,json=ipAddress,proto3" json:"ip_address,omitempty"` //nolint:revive,stylecheck // proto field name
+	Digest        string                 `protobuf:"bytes,6,opt,name=digest,proto3" json:"digest,omitempty"`
-	Details   map[string]string `protobuf:"bytes,8,rep,name=details,proto3" json:"details,omitempty"`
+	IpAddress     string                 `protobuf:"bytes,7,opt,name=ip_address,json=ipAddress,proto3" json:"ip_address,omitempty"`
+	Details       map[string]string      `protobuf:"bytes,8,rep,name=details,proto3" json:"details,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AuditEvent) Reset() {
+	*x = AuditEvent{}
+	mi := &file_mcr_v1_audit_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AuditEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuditEvent) ProtoMessage() {}
+
+func (x *AuditEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_audit_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuditEvent.ProtoReflect.Descriptor instead.
+func (*AuditEvent) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_audit_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *AuditEvent) GetId() int64 {
@@ -71,14 +121,46 @@ func (x *AuditEvent) GetDetails() map[string]string {
 	return nil
 }
 
-// ListAuditEventsRequest is the request message for ListAuditEvents.
 type ListAuditEventsRequest struct {
-	Pagination *PaginationRequest `protobuf:"bytes,1,opt,name=pagination,proto3" json:"pagination,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
-	EventType  string             `protobuf:"bytes,2,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"`
+	Pagination    *PaginationRequest     `protobuf:"bytes,1,opt,name=pagination,proto3" json:"pagination,omitempty"`
-	ActorId    string             `protobuf:"bytes,3,opt,name=actor_id,json=actorId,proto3" json:"actor_id,omitempty"` //nolint:revive,stylecheck // proto field name
+	EventType     string                 `protobuf:"bytes,2,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"`
-	Repository string             `protobuf:"bytes,4,opt,name=repository,proto3" json:"repository,omitempty"`
+	ActorId       string                 `protobuf:"bytes,3,opt,name=actor_id,json=actorId,proto3" json:"actor_id,omitempty"`
-	Since      string             `protobuf:"bytes,5,opt,name=since,proto3" json:"since,omitempty"`
+	Repository    string                 `protobuf:"bytes,4,opt,name=repository,proto3" json:"repository,omitempty"`
-	Until      string             `protobuf:"bytes,6,opt,name=until,proto3" json:"until,omitempty"`
+	Since         string                 `protobuf:"bytes,5,opt,name=since,proto3" json:"since,omitempty"`
+	Until         string                 `protobuf:"bytes,6,opt,name=until,proto3" json:"until,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListAuditEventsRequest) Reset() {
+	*x = ListAuditEventsRequest{}
+	mi := &file_mcr_v1_audit_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListAuditEventsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListAuditEventsRequest) ProtoMessage() {}
+
+func (x *ListAuditEventsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_audit_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListAuditEventsRequest.ProtoReflect.Descriptor instead.
+func (*ListAuditEventsRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_audit_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *ListAuditEventsRequest) GetPagination() *PaginationRequest {
@@ -123,9 +205,41 @@ func (x *ListAuditEventsRequest) GetUntil() string {
 	return ""
 }
 
-// ListAuditEventsResponse is the response message for ListAuditEvents.
 type ListAuditEventsResponse struct {
-	Events []*AuditEvent `protobuf:"bytes,1,rep,name=events,proto3" json:"events,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Events        []*AuditEvent          `protobuf:"bytes,1,rep,name=events,proto3" json:"events,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListAuditEventsResponse) Reset() {
+	*x = ListAuditEventsResponse{}
+	mi := &file_mcr_v1_audit_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListAuditEventsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListAuditEventsResponse) ProtoMessage() {}
+
+func (x *ListAuditEventsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_audit_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListAuditEventsResponse.ProtoReflect.Descriptor instead.
+func (*ListAuditEventsResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_audit_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *ListAuditEventsResponse) GetEvents() []*AuditEvent {
@@ -134,3 +248,101 @@ func (x *ListAuditEventsResponse) GetEvents() []*AuditEvent {
 	}
 	return nil
 }
+
+var File_mcr_v1_audit_proto protoreflect.FileDescriptor
+
+const file_mcr_v1_audit_proto_rawDesc = "" +
+	"\n" +
+	"\x12mcr/v1/audit.proto\x12\x06mcr.v1\x1a\x13mcr/v1/common.proto\"\xc3\x02\n" +
+	"\n" +
+	"AuditEvent\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\x03R\x02id\x12\x1d\n" +
+	"\n" +
+	"event_time\x18\x02 \x01(\tR\teventTime\x12\x1d\n" +
+	"\n" +
+	"event_type\x18\x03 \x01(\tR\teventType\x12\x19\n" +
+	"\bactor_id\x18\x04 \x01(\tR\aactorId\x12\x1e\n" +
+	"\n" +
+	"repository\x18\x05 \x01(\tR\n" +
+	"repository\x12\x16\n" +
+	"\x06digest\x18\x06 \x01(\tR\x06digest\x12\x1d\n" +
+	"\n" +
+	"ip_address\x18\a \x01(\tR\tipAddress\x129\n" +
+	"\adetails\x18\b \x03(\v2\x1f.mcr.v1.AuditEvent.DetailsEntryR\adetails\x1a:\n" +
+	"\fDetailsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xd9\x01\n" +
+	"\x16ListAuditEventsRequest\x129\n" +
+	"\n" +
+	"pagination\x18\x01 \x01(\v2\x19.mcr.v1.PaginationRequestR\n" +
+	"pagination\x12\x1d\n" +
+	"\n" +
+	"event_type\x18\x02 \x01(\tR\teventType\x12\x19\n" +
+	"\bactor_id\x18\x03 \x01(\tR\aactorId\x12\x1e\n" +
+	"\n" +
+	"repository\x18\x04 \x01(\tR\n" +
+	"repository\x12\x14\n" +
+	"\x05since\x18\x05 \x01(\tR\x05since\x12\x14\n" +
+	"\x05until\x18\x06 \x01(\tR\x05until\"E\n" +
+	"\x17ListAuditEventsResponse\x12*\n" +
+	"\x06events\x18\x01 \x03(\v2\x12.mcr.v1.AuditEventR\x06events2b\n" +
+	"\fAuditService\x12R\n" +
+	"\x0fListAuditEvents\x12\x1e.mcr.v1.ListAuditEventsRequest\x1a\x1f.mcr.v1.ListAuditEventsResponseB*Z(git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1b\x06proto3"
+
+var (
+	file_mcr_v1_audit_proto_rawDescOnce sync.Once
+	file_mcr_v1_audit_proto_rawDescData []byte
+)
+
+func file_mcr_v1_audit_proto_rawDescGZIP() []byte {
+	file_mcr_v1_audit_proto_rawDescOnce.Do(func() {
+		file_mcr_v1_audit_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_mcr_v1_audit_proto_rawDesc), len(file_mcr_v1_audit_proto_rawDesc)))
+	})
+	return file_mcr_v1_audit_proto_rawDescData
+}
+
+var file_mcr_v1_audit_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_mcr_v1_audit_proto_goTypes = []any{
+	(*AuditEvent)(nil),              // 0: mcr.v1.AuditEvent
+	(*ListAuditEventsRequest)(nil),  // 1: mcr.v1.ListAuditEventsRequest
+	(*ListAuditEventsResponse)(nil), // 2: mcr.v1.ListAuditEventsResponse
+	nil,                             // 3: mcr.v1.AuditEvent.DetailsEntry
+	(*PaginationRequest)(nil),       // 4: mcr.v1.PaginationRequest
+}
+var file_mcr_v1_audit_proto_depIdxs = []int32{
+	3, // 0: mcr.v1.AuditEvent.details:type_name -> mcr.v1.AuditEvent.DetailsEntry
+	4, // 1: mcr.v1.ListAuditEventsRequest.pagination:type_name -> mcr.v1.PaginationRequest
+	0, // 2: mcr.v1.ListAuditEventsResponse.events:type_name -> mcr.v1.AuditEvent
+	1, // 3: mcr.v1.AuditService.ListAuditEvents:input_type -> mcr.v1.ListAuditEventsRequest
+	2, // 4: mcr.v1.AuditService.ListAuditEvents:output_type -> mcr.v1.ListAuditEventsResponse
+	4, // [4:5] is the sub-list for method output_type
+	3, // [3:4] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_mcr_v1_audit_proto_init() }
+func file_mcr_v1_audit_proto_init() {
+	if File_mcr_v1_audit_proto != nil {
+		return
+	}
+	file_mcr_v1_common_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_mcr_v1_audit_proto_rawDesc), len(file_mcr_v1_audit_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_mcr_v1_audit_proto_goTypes,
+		DependencyIndexes: file_mcr_v1_audit_proto_depIdxs,
+		MessageInfos:      file_mcr_v1_audit_proto_msgTypes,
+	}.Build()
+	File_mcr_v1_audit_proto = out.File
+	file_mcr_v1_audit_proto_goTypes = nil
+	file_mcr_v1_audit_proto_depIdxs = nil
+}

gen/mcr/v1/audit_grpc.pb.go

@@ -1,38 +1,92 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             v6.32.1
 // source: mcr/v1/audit.proto
 
 package mcrv1
 
 import (
-	"context"
+	context "context"
-
+	grpc "google.golang.org/grpc"
-	"google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
-	"google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
-	"google.golang.org/grpc/status"
 )
 
-// AuditServiceServer is the server API for AuditService.
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	AuditService_ListAuditEvents_FullMethodName = "/mcr.v1.AuditService/ListAuditEvents"
+)
+
+// AuditServiceClient is the client API for AuditService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type AuditServiceClient interface {
+	ListAuditEvents(ctx context.Context, in *ListAuditEventsRequest, opts ...grpc.CallOption) (*ListAuditEventsResponse, error)
+}
+
+type auditServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewAuditServiceClient(cc grpc.ClientConnInterface) AuditServiceClient {
+	return &auditServiceClient{cc}
+}
+
+func (c *auditServiceClient) ListAuditEvents(ctx context.Context, in *ListAuditEventsRequest, opts ...grpc.CallOption) (*ListAuditEventsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListAuditEventsResponse)
+	err := c.cc.Invoke(ctx, AuditService_ListAuditEvents_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// AuditServiceServer is the server API for AuditService service.
+// All implementations must embed UnimplementedAuditServiceServer
+// for forward compatibility.
 type AuditServiceServer interface {
 	ListAuditEvents(context.Context, *ListAuditEventsRequest) (*ListAuditEventsResponse, error)
 	mustEmbedUnimplementedAuditServiceServer()
 }
 
-// UnimplementedAuditServiceServer should be embedded to have forward
+// UnimplementedAuditServiceServer must be embedded to have
-// compatible implementations.
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
 type UnimplementedAuditServiceServer struct{}
 
 func (UnimplementedAuditServiceServer) ListAuditEvents(context.Context, *ListAuditEventsRequest) (*ListAuditEventsResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ListAuditEvents not implemented")
+	return nil, status.Error(codes.Unimplemented, "method ListAuditEvents not implemented")
+}
+func (UnimplementedAuditServiceServer) mustEmbedUnimplementedAuditServiceServer() {}
+func (UnimplementedAuditServiceServer) testEmbeddedByValue()                      {}
+
+// UnsafeAuditServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to AuditServiceServer will
+// result in compilation errors.
+type UnsafeAuditServiceServer interface {
+	mustEmbedUnimplementedAuditServiceServer()
 }
 
-func (UnimplementedAuditServiceServer) mustEmbedUnimplementedAuditServiceServer() {}
-
-// RegisterAuditServiceServer registers the AuditServiceServer with the grpc.Server.
 func RegisterAuditServiceServer(s grpc.ServiceRegistrar, srv AuditServiceServer) {
+	// If the following call panics, it indicates UnimplementedAuditServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&AuditService_ServiceDesc, srv)
 }
 
-func auditServiceListAuditEventsHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
+func _AuditService_ListAuditEvents_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(ListAuditEventsRequest)
 	if err := dec(in); err != nil {
 		return nil, err
@@ -42,47 +96,26 @@ func auditServiceListAuditEventsHandler(srv any, ctx context.Context, dec func(a
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/mcr.v1.AuditService/ListAuditEvents",
+		FullMethod: AuditService_ListAuditEvents_FullMethodName,
 	}
-	handler := func(ctx context.Context, req any) (any, error) {
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(AuditServiceServer).ListAuditEvents(ctx, req.(*ListAuditEventsRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
 
-// AuditService_ServiceDesc is the grpc.ServiceDesc for AuditService.
+// AuditService_ServiceDesc is the grpc.ServiceDesc for AuditService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
 var AuditService_ServiceDesc = grpc.ServiceDesc{
 	ServiceName: "mcr.v1.AuditService",
 	HandlerType: (*AuditServiceServer)(nil),
 	Methods: []grpc.MethodDesc{
 		{
 			MethodName: "ListAuditEvents",
-			Handler:    auditServiceListAuditEventsHandler,
+			Handler:    _AuditService_ListAuditEvents_Handler,
 		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "mcr/v1/audit.proto",
 }
-
-// AuditServiceClient is the client API for AuditService.
-type AuditServiceClient interface {
-	ListAuditEvents(ctx context.Context, in *ListAuditEventsRequest, opts ...grpc.CallOption) (*ListAuditEventsResponse, error)
-}
-
-type auditServiceClient struct {
-	cc grpc.ClientConnInterface
-}
-
-// NewAuditServiceClient creates a new AuditServiceClient.
-func NewAuditServiceClient(cc grpc.ClientConnInterface) AuditServiceClient {
-	return &auditServiceClient{cc}
-}
-
-func (c *auditServiceClient) ListAuditEvents(ctx context.Context, in *ListAuditEventsRequest, opts ...grpc.CallOption) (*ListAuditEventsResponse, error) {
-	out := new(ListAuditEventsResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.AuditService/ListAuditEvents", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}

gen/mcr/v1/common.pb.go

@@ -1,12 +1,63 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.32.1
 // source: mcr/v1/common.proto
 
 package mcrv1
 
-// PaginationRequest controls pagination for list RPCs.
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Pagination controls for list RPCs.
 type PaginationRequest struct {
-	Limit  int32 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
-	Offset int32 `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"`
+	Limit         int32                  `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"`
+	Offset        int32                  `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PaginationRequest) Reset() {
+	*x = PaginationRequest{}
+	mi := &file_mcr_v1_common_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PaginationRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PaginationRequest) ProtoMessage() {}
+
+func (x *PaginationRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_common_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PaginationRequest.ProtoReflect.Descriptor instead.
+func (*PaginationRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_common_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *PaginationRequest) GetLimit() int32 {
@@ -22,3 +73,60 @@ func (x *PaginationRequest) GetOffset() int32 {
 	}
 	return 0
 }
+
+var File_mcr_v1_common_proto protoreflect.FileDescriptor
+
+const file_mcr_v1_common_proto_rawDesc = "" +
+	"\n" +
+	"\x13mcr/v1/common.proto\x12\x06mcr.v1\"A\n" +
+	"\x11PaginationRequest\x12\x14\n" +
+	"\x05limit\x18\x01 \x01(\x05R\x05limit\x12\x16\n" +
+	"\x06offset\x18\x02 \x01(\x05R\x06offsetB*Z(git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1b\x06proto3"
+
+var (
+	file_mcr_v1_common_proto_rawDescOnce sync.Once
+	file_mcr_v1_common_proto_rawDescData []byte
+)
+
+func file_mcr_v1_common_proto_rawDescGZIP() []byte {
+	file_mcr_v1_common_proto_rawDescOnce.Do(func() {
+		file_mcr_v1_common_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_mcr_v1_common_proto_rawDesc), len(file_mcr_v1_common_proto_rawDesc)))
+	})
+	return file_mcr_v1_common_proto_rawDescData
+}
+
+var file_mcr_v1_common_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_mcr_v1_common_proto_goTypes = []any{
+	(*PaginationRequest)(nil), // 0: mcr.v1.PaginationRequest
+}
+var file_mcr_v1_common_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_mcr_v1_common_proto_init() }
+func file_mcr_v1_common_proto_init() {
+	if File_mcr_v1_common_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_mcr_v1_common_proto_rawDesc), len(file_mcr_v1_common_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_mcr_v1_common_proto_goTypes,
+		DependencyIndexes: file_mcr_v1_common_proto_depIdxs,
+		MessageInfos:      file_mcr_v1_common_proto_msgTypes,
+	}.Build()
+	File_mcr_v1_common_proto = out.File
+	file_mcr_v1_common_proto_goTypes = nil
+	file_mcr_v1_common_proto_depIdxs = nil
+}

gen/mcr/v1/policy.pb.go

@@ -1,23 +1,73 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.32.1
 // source: mcr/v1/policy.proto
 
 package mcrv1
 
-// PolicyRule represents a policy rule.
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
 type PolicyRule struct {
-	Id           int64    `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`               //nolint:revive,stylecheck // proto field name
+	state         protoimpl.MessageState `protogen:"open.v1"`
-	Priority     int32    `protobuf:"varint,2,opt,name=priority,proto3" json:"priority,omitempty"`
+	Id            int64                  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
-	Description  string   `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
+	Priority      int32                  `protobuf:"varint,2,opt,name=priority,proto3" json:"priority,omitempty"`
-	Effect       string   `protobuf:"bytes,4,opt,name=effect,proto3" json:"effect,omitempty"`
+	Description   string                 `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
-	Roles        []string `protobuf:"bytes,5,rep,name=roles,proto3" json:"roles,omitempty"`
+	Effect        string                 `protobuf:"bytes,4,opt,name=effect,proto3" json:"effect,omitempty"`
-	AccountTypes []string `protobuf:"bytes,6,rep,name=account_types,json=accountTypes,proto3" json:"account_types,omitempty"`
+	Roles         []string               `protobuf:"bytes,5,rep,name=roles,proto3" json:"roles,omitempty"`
-	SubjectUuid  string   `protobuf:"bytes,7,opt,name=subject_uuid,json=subjectUuid,proto3" json:"subject_uuid,omitempty"` //nolint:revive,stylecheck // proto field name
+	AccountTypes  []string               `protobuf:"bytes,6,rep,name=account_types,json=accountTypes,proto3" json:"account_types,omitempty"`
-	Actions      []string `protobuf:"bytes,8,rep,name=actions,proto3" json:"actions,omitempty"`
+	SubjectUuid   string                 `protobuf:"bytes,7,opt,name=subject_uuid,json=subjectUuid,proto3" json:"subject_uuid,omitempty"`
-	Repositories []string `protobuf:"bytes,9,rep,name=repositories,proto3" json:"repositories,omitempty"`
+	Actions       []string               `protobuf:"bytes,8,rep,name=actions,proto3" json:"actions,omitempty"`
-	Enabled      bool     `protobuf:"varint,10,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	Repositories  []string               `protobuf:"bytes,9,rep,name=repositories,proto3" json:"repositories,omitempty"`
-	CreatedBy    string   `protobuf:"bytes,11,opt,name=created_by,json=createdBy,proto3" json:"created_by,omitempty"`
+	Enabled       bool                   `protobuf:"varint,10,opt,name=enabled,proto3" json:"enabled,omitempty"`
-	CreatedAt    string   `protobuf:"bytes,12,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	CreatedBy     string                 `protobuf:"bytes,11,opt,name=created_by,json=createdBy,proto3" json:"created_by,omitempty"`
-	UpdatedAt    string   `protobuf:"bytes,13,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
+	CreatedAt     string                 `protobuf:"bytes,12,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	UpdatedAt     string                 `protobuf:"bytes,13,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PolicyRule) Reset() {
+	*x = PolicyRule{}
+	mi := &file_mcr_v1_policy_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PolicyRule) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PolicyRule) ProtoMessage() {}
+
+func (x *PolicyRule) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_policy_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PolicyRule.ProtoReflect.Descriptor instead.
+func (*PolicyRule) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_policy_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *PolicyRule) GetId() int64 {
@@ -111,9 +161,41 @@ func (x *PolicyRule) GetUpdatedAt() string {
 	return ""
 }
 
-// ListPolicyRulesRequest is the request message for ListPolicyRules.
 type ListPolicyRulesRequest struct {
-	Pagination *PaginationRequest `protobuf:"bytes,1,opt,name=pagination,proto3" json:"pagination,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Pagination    *PaginationRequest     `protobuf:"bytes,1,opt,name=pagination,proto3" json:"pagination,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListPolicyRulesRequest) Reset() {
+	*x = ListPolicyRulesRequest{}
+	mi := &file_mcr_v1_policy_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListPolicyRulesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListPolicyRulesRequest) ProtoMessage() {}
+
+func (x *ListPolicyRulesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_policy_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListPolicyRulesRequest.ProtoReflect.Descriptor instead.
+func (*ListPolicyRulesRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_policy_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *ListPolicyRulesRequest) GetPagination() *PaginationRequest {
@@ -123,9 +205,41 @@ func (x *ListPolicyRulesRequest) GetPagination() *PaginationRequest {
 	return nil
 }
 
-// ListPolicyRulesResponse is the response message for ListPolicyRules.
 type ListPolicyRulesResponse struct {
-	Rules []*PolicyRule `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Rules         []*PolicyRule          `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListPolicyRulesResponse) Reset() {
+	*x = ListPolicyRulesResponse{}
+	mi := &file_mcr_v1_policy_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListPolicyRulesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListPolicyRulesResponse) ProtoMessage() {}
+
+func (x *ListPolicyRulesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_policy_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListPolicyRulesResponse.ProtoReflect.Descriptor instead.
+func (*ListPolicyRulesResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_policy_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *ListPolicyRulesResponse) GetRules() []*PolicyRule {
@@ -135,17 +249,49 @@ func (x *ListPolicyRulesResponse) GetRules() []*PolicyRule {
 	return nil
 }
 
-// CreatePolicyRuleRequest is the request message for CreatePolicyRule.
 type CreatePolicyRuleRequest struct {
-	Priority     int32    `protobuf:"varint,1,opt,name=priority,proto3" json:"priority,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
-	Description  string   `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
+	Priority      int32                  `protobuf:"varint,1,opt,name=priority,proto3" json:"priority,omitempty"`
-	Effect       string   `protobuf:"bytes,3,opt,name=effect,proto3" json:"effect,omitempty"`
+	Description   string                 `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
-	Roles        []string `protobuf:"bytes,4,rep,name=roles,proto3" json:"roles,omitempty"`
+	Effect        string                 `protobuf:"bytes,3,opt,name=effect,proto3" json:"effect,omitempty"`
-	AccountTypes []string `protobuf:"bytes,5,rep,name=account_types,json=accountTypes,proto3" json:"account_types,omitempty"`
+	Roles         []string               `protobuf:"bytes,4,rep,name=roles,proto3" json:"roles,omitempty"`
-	SubjectUuid  string   `protobuf:"bytes,6,opt,name=subject_uuid,json=subjectUuid,proto3" json:"subject_uuid,omitempty"` //nolint:revive,stylecheck // proto field name
+	AccountTypes  []string               `protobuf:"bytes,5,rep,name=account_types,json=accountTypes,proto3" json:"account_types,omitempty"`
-	Actions      []string `protobuf:"bytes,7,rep,name=actions,proto3" json:"actions,omitempty"`
+	SubjectUuid   string                 `protobuf:"bytes,6,opt,name=subject_uuid,json=subjectUuid,proto3" json:"subject_uuid,omitempty"`
-	Repositories []string `protobuf:"bytes,8,rep,name=repositories,proto3" json:"repositories,omitempty"`
+	Actions       []string               `protobuf:"bytes,7,rep,name=actions,proto3" json:"actions,omitempty"`
-	Enabled      bool     `protobuf:"varint,9,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	Repositories  []string               `protobuf:"bytes,8,rep,name=repositories,proto3" json:"repositories,omitempty"`
+	Enabled       bool                   `protobuf:"varint,9,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreatePolicyRuleRequest) Reset() {
+	*x = CreatePolicyRuleRequest{}
+	mi := &file_mcr_v1_policy_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreatePolicyRuleRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreatePolicyRuleRequest) ProtoMessage() {}
+
+func (x *CreatePolicyRuleRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_policy_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreatePolicyRuleRequest.ProtoReflect.Descriptor instead.
+func (*CreatePolicyRuleRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_policy_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *CreatePolicyRuleRequest) GetPriority() int32 {
@@ -211,9 +357,41 @@ func (x *CreatePolicyRuleRequest) GetEnabled() bool {
 	return false
 }
 
-// GetPolicyRuleRequest is the request message for GetPolicyRule.
 type GetPolicyRuleRequest struct {
-	Id int64 `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"` //nolint:revive,stylecheck // proto field name
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Id            int64                  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetPolicyRuleRequest) Reset() {
+	*x = GetPolicyRuleRequest{}
+	mi := &file_mcr_v1_policy_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetPolicyRuleRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetPolicyRuleRequest) ProtoMessage() {}
+
+func (x *GetPolicyRuleRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_policy_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetPolicyRuleRequest.ProtoReflect.Descriptor instead.
+func (*GetPolicyRuleRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_policy_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *GetPolicyRuleRequest) GetId() int64 {
@@ -223,19 +401,52 @@ func (x *GetPolicyRuleRequest) GetId() int64 {
 	return 0
 }
 
-// UpdatePolicyRuleRequest is the request message for UpdatePolicyRule.
 type UpdatePolicyRuleRequest struct {
-	Id           int64    `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`               //nolint:revive,stylecheck // proto field name
+	state        protoimpl.MessageState `protogen:"open.v1"`
-	Priority     int32    `protobuf:"varint,2,opt,name=priority,proto3" json:"priority,omitempty"`
+	Id           int64                  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
-	Description  string   `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
+	Priority     int32                  `protobuf:"varint,2,opt,name=priority,proto3" json:"priority,omitempty"`
-	Effect       string   `protobuf:"bytes,4,opt,name=effect,proto3" json:"effect,omitempty"`
+	Description  string                 `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
-	Roles        []string `protobuf:"bytes,5,rep,name=roles,proto3" json:"roles,omitempty"`
+	Effect       string                 `protobuf:"bytes,4,opt,name=effect,proto3" json:"effect,omitempty"`
-	AccountTypes []string `protobuf:"bytes,6,rep,name=account_types,json=accountTypes,proto3" json:"account_types,omitempty"`
+	Roles        []string               `protobuf:"bytes,5,rep,name=roles,proto3" json:"roles,omitempty"`
-	SubjectUuid  string   `protobuf:"bytes,7,opt,name=subject_uuid,json=subjectUuid,proto3" json:"subject_uuid,omitempty"` //nolint:revive,stylecheck // proto field name
+	AccountTypes []string               `protobuf:"bytes,6,rep,name=account_types,json=accountTypes,proto3" json:"account_types,omitempty"`
-	Actions      []string `protobuf:"bytes,8,rep,name=actions,proto3" json:"actions,omitempty"`
+	SubjectUuid  string                 `protobuf:"bytes,7,opt,name=subject_uuid,json=subjectUuid,proto3" json:"subject_uuid,omitempty"`
-	Repositories []string `protobuf:"bytes,9,rep,name=repositories,proto3" json:"repositories,omitempty"`
+	Actions      []string               `protobuf:"bytes,8,rep,name=actions,proto3" json:"actions,omitempty"`
-	Enabled      bool     `protobuf:"varint,10,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	Repositories []string               `protobuf:"bytes,9,rep,name=repositories,proto3" json:"repositories,omitempty"`
-	UpdateMask   []string `protobuf:"bytes,11,rep,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
+	Enabled      bool                   `protobuf:"varint,10,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	// Field mask for partial updates — only fields listed here are applied.
+	UpdateMask    []string `protobuf:"bytes,11,rep,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdatePolicyRuleRequest) Reset() {
+	*x = UpdatePolicyRuleRequest{}
+	mi := &file_mcr_v1_policy_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdatePolicyRuleRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdatePolicyRuleRequest) ProtoMessage() {}
+
+func (x *UpdatePolicyRuleRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_policy_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdatePolicyRuleRequest.ProtoReflect.Descriptor instead.
+func (*UpdatePolicyRuleRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_policy_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *UpdatePolicyRuleRequest) GetId() int64 {
@@ -315,9 +526,41 @@ func (x *UpdatePolicyRuleRequest) GetUpdateMask() []string {
 	return nil
 }
 
-// DeletePolicyRuleRequest is the request message for DeletePolicyRule.
 type DeletePolicyRuleRequest struct {
-	Id int64 `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"` //nolint:revive,stylecheck // proto field name
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Id            int64                  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeletePolicyRuleRequest) Reset() {
+	*x = DeletePolicyRuleRequest{}
+	mi := &file_mcr_v1_policy_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeletePolicyRuleRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeletePolicyRuleRequest) ProtoMessage() {}
+
+func (x *DeletePolicyRuleRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_policy_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeletePolicyRuleRequest.ProtoReflect.Descriptor instead.
+func (*DeletePolicyRuleRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_policy_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *DeletePolicyRuleRequest) GetId() int64 {
@@ -327,5 +570,173 @@ func (x *DeletePolicyRuleRequest) GetId() int64 {
 	return 0
 }
 
-// DeletePolicyRuleResponse is the response message for DeletePolicyRule.
+type DeletePolicyRuleResponse struct {
-type DeletePolicyRuleResponse struct{}
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeletePolicyRuleResponse) Reset() {
+	*x = DeletePolicyRuleResponse{}
+	mi := &file_mcr_v1_policy_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeletePolicyRuleResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeletePolicyRuleResponse) ProtoMessage() {}
+
+func (x *DeletePolicyRuleResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_policy_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeletePolicyRuleResponse.ProtoReflect.Descriptor instead.
+func (*DeletePolicyRuleResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_policy_proto_rawDescGZIP(), []int{7}
+}
+
+var File_mcr_v1_policy_proto protoreflect.FileDescriptor
+
+const file_mcr_v1_policy_proto_rawDesc = "" +
+	"\n" +
+	"\x13mcr/v1/policy.proto\x12\x06mcr.v1\x1a\x13mcr/v1/common.proto\"\x85\x03\n" +
+	"\n" +
+	"PolicyRule\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\x03R\x02id\x12\x1a\n" +
+	"\bpriority\x18\x02 \x01(\x05R\bpriority\x12 \n" +
+	"\vdescription\x18\x03 \x01(\tR\vdescription\x12\x16\n" +
+	"\x06effect\x18\x04 \x01(\tR\x06effect\x12\x14\n" +
+	"\x05roles\x18\x05 \x03(\tR\x05roles\x12#\n" +
+	"\raccount_types\x18\x06 \x03(\tR\faccountTypes\x12!\n" +
+	"\fsubject_uuid\x18\a \x01(\tR\vsubjectUuid\x12\x18\n" +
+	"\aactions\x18\b \x03(\tR\aactions\x12\"\n" +
+	"\frepositories\x18\t \x03(\tR\frepositories\x12\x18\n" +
+	"\aenabled\x18\n" +
+	" \x01(\bR\aenabled\x12\x1d\n" +
+	"\n" +
+	"created_by\x18\v \x01(\tR\tcreatedBy\x12\x1d\n" +
+	"\n" +
+	"created_at\x18\f \x01(\tR\tcreatedAt\x12\x1d\n" +
+	"\n" +
+	"updated_at\x18\r \x01(\tR\tupdatedAt\"S\n" +
+	"\x16ListPolicyRulesRequest\x129\n" +
+	"\n" +
+	"pagination\x18\x01 \x01(\v2\x19.mcr.v1.PaginationRequestR\n" +
+	"pagination\"C\n" +
+	"\x17ListPolicyRulesResponse\x12(\n" +
+	"\x05rules\x18\x01 \x03(\v2\x12.mcr.v1.PolicyRuleR\x05rules\"\xa5\x02\n" +
+	"\x17CreatePolicyRuleRequest\x12\x1a\n" +
+	"\bpriority\x18\x01 \x01(\x05R\bpriority\x12 \n" +
+	"\vdescription\x18\x02 \x01(\tR\vdescription\x12\x16\n" +
+	"\x06effect\x18\x03 \x01(\tR\x06effect\x12\x14\n" +
+	"\x05roles\x18\x04 \x03(\tR\x05roles\x12#\n" +
+	"\raccount_types\x18\x05 \x03(\tR\faccountTypes\x12!\n" +
+	"\fsubject_uuid\x18\x06 \x01(\tR\vsubjectUuid\x12\x18\n" +
+	"\aactions\x18\a \x03(\tR\aactions\x12\"\n" +
+	"\frepositories\x18\b \x03(\tR\frepositories\x12\x18\n" +
+	"\aenabled\x18\t \x01(\bR\aenabled\"&\n" +
+	"\x14GetPolicyRuleRequest\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\x03R\x02id\"\xd6\x02\n" +
+	"\x17UpdatePolicyRuleRequest\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\x03R\x02id\x12\x1a\n" +
+	"\bpriority\x18\x02 \x01(\x05R\bpriority\x12 \n" +
+	"\vdescription\x18\x03 \x01(\tR\vdescription\x12\x16\n" +
+	"\x06effect\x18\x04 \x01(\tR\x06effect\x12\x14\n" +
+	"\x05roles\x18\x05 \x03(\tR\x05roles\x12#\n" +
+	"\raccount_types\x18\x06 \x03(\tR\faccountTypes\x12!\n" +
+	"\fsubject_uuid\x18\a \x01(\tR\vsubjectUuid\x12\x18\n" +
+	"\aactions\x18\b \x03(\tR\aactions\x12\"\n" +
+	"\frepositories\x18\t \x03(\tR\frepositories\x12\x18\n" +
+	"\aenabled\x18\n" +
+	" \x01(\bR\aenabled\x12\x1f\n" +
+	"\vupdate_mask\x18\v \x03(\tR\n" +
+	"updateMask\")\n" +
+	"\x17DeletePolicyRuleRequest\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\x03R\x02id\"\x1a\n" +
+	"\x18DeletePolicyRuleResponse2\x8f\x03\n" +
+	"\rPolicyService\x12R\n" +
+	"\x0fListPolicyRules\x12\x1e.mcr.v1.ListPolicyRulesRequest\x1a\x1f.mcr.v1.ListPolicyRulesResponse\x12G\n" +
+	"\x10CreatePolicyRule\x12\x1f.mcr.v1.CreatePolicyRuleRequest\x1a\x12.mcr.v1.PolicyRule\x12A\n" +
+	"\rGetPolicyRule\x12\x1c.mcr.v1.GetPolicyRuleRequest\x1a\x12.mcr.v1.PolicyRule\x12G\n" +
+	"\x10UpdatePolicyRule\x12\x1f.mcr.v1.UpdatePolicyRuleRequest\x1a\x12.mcr.v1.PolicyRule\x12U\n" +
+	"\x10DeletePolicyRule\x12\x1f.mcr.v1.DeletePolicyRuleRequest\x1a .mcr.v1.DeletePolicyRuleResponseB*Z(git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1b\x06proto3"
+
+var (
+	file_mcr_v1_policy_proto_rawDescOnce sync.Once
+	file_mcr_v1_policy_proto_rawDescData []byte
+)
+
+func file_mcr_v1_policy_proto_rawDescGZIP() []byte {
+	file_mcr_v1_policy_proto_rawDescOnce.Do(func() {
+		file_mcr_v1_policy_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_mcr_v1_policy_proto_rawDesc), len(file_mcr_v1_policy_proto_rawDesc)))
+	})
+	return file_mcr_v1_policy_proto_rawDescData
+}
+
+var file_mcr_v1_policy_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_mcr_v1_policy_proto_goTypes = []any{
+	(*PolicyRule)(nil),               // 0: mcr.v1.PolicyRule
+	(*ListPolicyRulesRequest)(nil),   // 1: mcr.v1.ListPolicyRulesRequest
+	(*ListPolicyRulesResponse)(nil),  // 2: mcr.v1.ListPolicyRulesResponse
+	(*CreatePolicyRuleRequest)(nil),  // 3: mcr.v1.CreatePolicyRuleRequest
+	(*GetPolicyRuleRequest)(nil),     // 4: mcr.v1.GetPolicyRuleRequest
+	(*UpdatePolicyRuleRequest)(nil),  // 5: mcr.v1.UpdatePolicyRuleRequest
+	(*DeletePolicyRuleRequest)(nil),  // 6: mcr.v1.DeletePolicyRuleRequest
+	(*DeletePolicyRuleResponse)(nil), // 7: mcr.v1.DeletePolicyRuleResponse
+	(*PaginationRequest)(nil),        // 8: mcr.v1.PaginationRequest
+}
+var file_mcr_v1_policy_proto_depIdxs = []int32{
+	8, // 0: mcr.v1.ListPolicyRulesRequest.pagination:type_name -> mcr.v1.PaginationRequest
+	0, // 1: mcr.v1.ListPolicyRulesResponse.rules:type_name -> mcr.v1.PolicyRule
+	1, // 2: mcr.v1.PolicyService.ListPolicyRules:input_type -> mcr.v1.ListPolicyRulesRequest
+	3, // 3: mcr.v1.PolicyService.CreatePolicyRule:input_type -> mcr.v1.CreatePolicyRuleRequest
+	4, // 4: mcr.v1.PolicyService.GetPolicyRule:input_type -> mcr.v1.GetPolicyRuleRequest
+	5, // 5: mcr.v1.PolicyService.UpdatePolicyRule:input_type -> mcr.v1.UpdatePolicyRuleRequest
+	6, // 6: mcr.v1.PolicyService.DeletePolicyRule:input_type -> mcr.v1.DeletePolicyRuleRequest
+	2, // 7: mcr.v1.PolicyService.ListPolicyRules:output_type -> mcr.v1.ListPolicyRulesResponse
+	0, // 8: mcr.v1.PolicyService.CreatePolicyRule:output_type -> mcr.v1.PolicyRule
+	0, // 9: mcr.v1.PolicyService.GetPolicyRule:output_type -> mcr.v1.PolicyRule
+	0, // 10: mcr.v1.PolicyService.UpdatePolicyRule:output_type -> mcr.v1.PolicyRule
+	7, // 11: mcr.v1.PolicyService.DeletePolicyRule:output_type -> mcr.v1.DeletePolicyRuleResponse
+	7, // [7:12] is the sub-list for method output_type
+	2, // [2:7] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_mcr_v1_policy_proto_init() }
+func file_mcr_v1_policy_proto_init() {
+	if File_mcr_v1_policy_proto != nil {
+		return
+	}
+	file_mcr_v1_common_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_mcr_v1_policy_proto_rawDesc), len(file_mcr_v1_policy_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   8,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_mcr_v1_policy_proto_goTypes,
+		DependencyIndexes: file_mcr_v1_policy_proto_depIdxs,
+		MessageInfos:      file_mcr_v1_policy_proto_msgTypes,
+	}.Build()
+	File_mcr_v1_policy_proto = out.File
+	file_mcr_v1_policy_proto_goTypes = nil
+	file_mcr_v1_policy_proto_depIdxs = nil
+}

gen/mcr/v1/policy_grpc.pb.go

@@ -1,178 +1,34 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             v6.32.1
 // source: mcr/v1/policy.proto
 
 package mcrv1
 
 import (
-	"context"
+	context "context"
-
+	grpc "google.golang.org/grpc"
-	"google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
-	"google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
-	"google.golang.org/grpc/status"
 )
 
-// PolicyServiceServer is the server API for PolicyService.
+// This is a compile-time assertion to ensure that this generated file
-type PolicyServiceServer interface {
+// is compatible with the grpc package it is being compiled against.
-	ListPolicyRules(context.Context, *ListPolicyRulesRequest) (*ListPolicyRulesResponse, error)
+// Requires gRPC-Go v1.64.0 or later.
-	CreatePolicyRule(context.Context, *CreatePolicyRuleRequest) (*PolicyRule, error)
+const _ = grpc.SupportPackageIsVersion9
-	GetPolicyRule(context.Context, *GetPolicyRuleRequest) (*PolicyRule, error)
-	UpdatePolicyRule(context.Context, *UpdatePolicyRuleRequest) (*PolicyRule, error)
-	DeletePolicyRule(context.Context, *DeletePolicyRuleRequest) (*DeletePolicyRuleResponse, error)
-	mustEmbedUnimplementedPolicyServiceServer()
-}
 
-// UnimplementedPolicyServiceServer should be embedded to have forward
+const (
-// compatible implementations.
+	PolicyService_ListPolicyRules_FullMethodName  = "/mcr.v1.PolicyService/ListPolicyRules"
-type UnimplementedPolicyServiceServer struct{}
+	PolicyService_CreatePolicyRule_FullMethodName = "/mcr.v1.PolicyService/CreatePolicyRule"
+	PolicyService_GetPolicyRule_FullMethodName    = "/mcr.v1.PolicyService/GetPolicyRule"
+	PolicyService_UpdatePolicyRule_FullMethodName = "/mcr.v1.PolicyService/UpdatePolicyRule"
+	PolicyService_DeletePolicyRule_FullMethodName = "/mcr.v1.PolicyService/DeletePolicyRule"
+)
 
-func (UnimplementedPolicyServiceServer) ListPolicyRules(context.Context, *ListPolicyRulesRequest) (*ListPolicyRulesResponse, error) {
+// PolicyServiceClient is the client API for PolicyService service.
-	return nil, status.Errorf(codes.Unimplemented, "method ListPolicyRules not implemented")
+//
-}
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
-
-func (UnimplementedPolicyServiceServer) CreatePolicyRule(context.Context, *CreatePolicyRuleRequest) (*PolicyRule, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method CreatePolicyRule not implemented")
-}
-
-func (UnimplementedPolicyServiceServer) GetPolicyRule(context.Context, *GetPolicyRuleRequest) (*PolicyRule, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetPolicyRule not implemented")
-}
-
-func (UnimplementedPolicyServiceServer) UpdatePolicyRule(context.Context, *UpdatePolicyRuleRequest) (*PolicyRule, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method UpdatePolicyRule not implemented")
-}
-
-func (UnimplementedPolicyServiceServer) DeletePolicyRule(context.Context, *DeletePolicyRuleRequest) (*DeletePolicyRuleResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DeletePolicyRule not implemented")
-}
-
-func (UnimplementedPolicyServiceServer) mustEmbedUnimplementedPolicyServiceServer() {}
-
-// RegisterPolicyServiceServer registers the PolicyServiceServer with the grpc.Server.
-func RegisterPolicyServiceServer(s grpc.ServiceRegistrar, srv PolicyServiceServer) {
-	s.RegisterService(&PolicyService_ServiceDesc, srv)
-}
-
-func policyServiceListPolicyRulesHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(ListPolicyRulesRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(PolicyServiceServer).ListPolicyRules(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.PolicyService/ListPolicyRules",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(PolicyServiceServer).ListPolicyRules(ctx, req.(*ListPolicyRulesRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func policyServiceCreatePolicyRuleHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(CreatePolicyRuleRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(PolicyServiceServer).CreatePolicyRule(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.PolicyService/CreatePolicyRule",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(PolicyServiceServer).CreatePolicyRule(ctx, req.(*CreatePolicyRuleRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func policyServiceGetPolicyRuleHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(GetPolicyRuleRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(PolicyServiceServer).GetPolicyRule(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.PolicyService/GetPolicyRule",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(PolicyServiceServer).GetPolicyRule(ctx, req.(*GetPolicyRuleRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func policyServiceUpdatePolicyRuleHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(UpdatePolicyRuleRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(PolicyServiceServer).UpdatePolicyRule(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.PolicyService/UpdatePolicyRule",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(PolicyServiceServer).UpdatePolicyRule(ctx, req.(*UpdatePolicyRuleRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func policyServiceDeletePolicyRuleHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(DeletePolicyRuleRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(PolicyServiceServer).DeletePolicyRule(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.PolicyService/DeletePolicyRule",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(PolicyServiceServer).DeletePolicyRule(ctx, req.(*DeletePolicyRuleRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-// PolicyService_ServiceDesc is the grpc.ServiceDesc for PolicyService.
-var PolicyService_ServiceDesc = grpc.ServiceDesc{
-	ServiceName: "mcr.v1.PolicyService",
-	HandlerType: (*PolicyServiceServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "ListPolicyRules",
-			Handler:    policyServiceListPolicyRulesHandler,
-		},
-		{
-			MethodName: "CreatePolicyRule",
-			Handler:    policyServiceCreatePolicyRuleHandler,
-		},
-		{
-			MethodName: "GetPolicyRule",
-			Handler:    policyServiceGetPolicyRuleHandler,
-		},
-		{
-			MethodName: "UpdatePolicyRule",
-			Handler:    policyServiceUpdatePolicyRuleHandler,
-		},
-		{
-			MethodName: "DeletePolicyRule",
-			Handler:    policyServiceDeletePolicyRuleHandler,
-		},
-	},
-	Streams:  []grpc.StreamDesc{},
-	Metadata: "mcr/v1/policy.proto",
-}
-
-// PolicyServiceClient is the client API for PolicyService.
 type PolicyServiceClient interface {
 	ListPolicyRules(ctx context.Context, in *ListPolicyRulesRequest, opts ...grpc.CallOption) (*ListPolicyRulesResponse, error)
 	CreatePolicyRule(ctx context.Context, in *CreatePolicyRuleRequest, opts ...grpc.CallOption) (*PolicyRule, error)
@@ -185,14 +41,14 @@ type policyServiceClient struct {
 	cc grpc.ClientConnInterface
 }
 
-// NewPolicyServiceClient creates a new PolicyServiceClient.
 func NewPolicyServiceClient(cc grpc.ClientConnInterface) PolicyServiceClient {
 	return &policyServiceClient{cc}
 }
 
 func (c *policyServiceClient) ListPolicyRules(ctx context.Context, in *ListPolicyRulesRequest, opts ...grpc.CallOption) (*ListPolicyRulesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListPolicyRulesResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.PolicyService/ListPolicyRules", in, out, opts...)
+	err := c.cc.Invoke(ctx, PolicyService_ListPolicyRules_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -200,8 +56,9 @@ func (c *policyServiceClient) ListPolicyRules(ctx context.Context, in *ListPolic
 }
 
 func (c *policyServiceClient) CreatePolicyRule(ctx context.Context, in *CreatePolicyRuleRequest, opts ...grpc.CallOption) (*PolicyRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(PolicyRule)
-	err := c.cc.Invoke(ctx, "/mcr.v1.PolicyService/CreatePolicyRule", in, out, opts...)
+	err := c.cc.Invoke(ctx, PolicyService_CreatePolicyRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -209,8 +66,9 @@ func (c *policyServiceClient) CreatePolicyRule(ctx context.Context, in *CreatePo
 }
 
 func (c *policyServiceClient) GetPolicyRule(ctx context.Context, in *GetPolicyRuleRequest, opts ...grpc.CallOption) (*PolicyRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(PolicyRule)
-	err := c.cc.Invoke(ctx, "/mcr.v1.PolicyService/GetPolicyRule", in, out, opts...)
+	err := c.cc.Invoke(ctx, PolicyService_GetPolicyRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -218,8 +76,9 @@ func (c *policyServiceClient) GetPolicyRule(ctx context.Context, in *GetPolicyRu
 }
 
 func (c *policyServiceClient) UpdatePolicyRule(ctx context.Context, in *UpdatePolicyRuleRequest, opts ...grpc.CallOption) (*PolicyRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(PolicyRule)
-	err := c.cc.Invoke(ctx, "/mcr.v1.PolicyService/UpdatePolicyRule", in, out, opts...)
+	err := c.cc.Invoke(ctx, PolicyService_UpdatePolicyRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -227,10 +86,188 @@ func (c *policyServiceClient) UpdatePolicyRule(ctx context.Context, in *UpdatePo
 }
 
 func (c *policyServiceClient) DeletePolicyRule(ctx context.Context, in *DeletePolicyRuleRequest, opts ...grpc.CallOption) (*DeletePolicyRuleResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DeletePolicyRuleResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.PolicyService/DeletePolicyRule", in, out, opts...)
+	err := c.cc.Invoke(ctx, PolicyService_DeletePolicyRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
+
+// PolicyServiceServer is the server API for PolicyService service.
+// All implementations must embed UnimplementedPolicyServiceServer
+// for forward compatibility.
+type PolicyServiceServer interface {
+	ListPolicyRules(context.Context, *ListPolicyRulesRequest) (*ListPolicyRulesResponse, error)
+	CreatePolicyRule(context.Context, *CreatePolicyRuleRequest) (*PolicyRule, error)
+	GetPolicyRule(context.Context, *GetPolicyRuleRequest) (*PolicyRule, error)
+	UpdatePolicyRule(context.Context, *UpdatePolicyRuleRequest) (*PolicyRule, error)
+	DeletePolicyRule(context.Context, *DeletePolicyRuleRequest) (*DeletePolicyRuleResponse, error)
+	mustEmbedUnimplementedPolicyServiceServer()
+}
+
+// UnimplementedPolicyServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedPolicyServiceServer struct{}
+
+func (UnimplementedPolicyServiceServer) ListPolicyRules(context.Context, *ListPolicyRulesRequest) (*ListPolicyRulesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListPolicyRules not implemented")
+}
+func (UnimplementedPolicyServiceServer) CreatePolicyRule(context.Context, *CreatePolicyRuleRequest) (*PolicyRule, error) {
+	return nil, status.Error(codes.Unimplemented, "method CreatePolicyRule not implemented")
+}
+func (UnimplementedPolicyServiceServer) GetPolicyRule(context.Context, *GetPolicyRuleRequest) (*PolicyRule, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetPolicyRule not implemented")
+}
+func (UnimplementedPolicyServiceServer) UpdatePolicyRule(context.Context, *UpdatePolicyRuleRequest) (*PolicyRule, error) {
+	return nil, status.Error(codes.Unimplemented, "method UpdatePolicyRule not implemented")
+}
+func (UnimplementedPolicyServiceServer) DeletePolicyRule(context.Context, *DeletePolicyRuleRequest) (*DeletePolicyRuleResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method DeletePolicyRule not implemented")
+}
+func (UnimplementedPolicyServiceServer) mustEmbedUnimplementedPolicyServiceServer() {}
+func (UnimplementedPolicyServiceServer) testEmbeddedByValue()                       {}
+
+// UnsafePolicyServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to PolicyServiceServer will
+// result in compilation errors.
+type UnsafePolicyServiceServer interface {
+	mustEmbedUnimplementedPolicyServiceServer()
+}
+
+func RegisterPolicyServiceServer(s grpc.ServiceRegistrar, srv PolicyServiceServer) {
+	// If the following call panics, it indicates UnimplementedPolicyServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&PolicyService_ServiceDesc, srv)
+}
+
+func _PolicyService_ListPolicyRules_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListPolicyRulesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PolicyServiceServer).ListPolicyRules(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PolicyService_ListPolicyRules_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PolicyServiceServer).ListPolicyRules(ctx, req.(*ListPolicyRulesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _PolicyService_CreatePolicyRule_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreatePolicyRuleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PolicyServiceServer).CreatePolicyRule(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PolicyService_CreatePolicyRule_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PolicyServiceServer).CreatePolicyRule(ctx, req.(*CreatePolicyRuleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _PolicyService_GetPolicyRule_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetPolicyRuleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PolicyServiceServer).GetPolicyRule(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PolicyService_GetPolicyRule_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PolicyServiceServer).GetPolicyRule(ctx, req.(*GetPolicyRuleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _PolicyService_UpdatePolicyRule_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdatePolicyRuleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PolicyServiceServer).UpdatePolicyRule(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PolicyService_UpdatePolicyRule_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PolicyServiceServer).UpdatePolicyRule(ctx, req.(*UpdatePolicyRuleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _PolicyService_DeletePolicyRule_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeletePolicyRuleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(PolicyServiceServer).DeletePolicyRule(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: PolicyService_DeletePolicyRule_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(PolicyServiceServer).DeletePolicyRule(ctx, req.(*DeletePolicyRuleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// PolicyService_ServiceDesc is the grpc.ServiceDesc for PolicyService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var PolicyService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "mcr.v1.PolicyService",
+	HandlerType: (*PolicyServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "ListPolicyRules",
+			Handler:    _PolicyService_ListPolicyRules_Handler,
+		},
+		{
+			MethodName: "CreatePolicyRule",
+			Handler:    _PolicyService_CreatePolicyRule_Handler,
+		},
+		{
+			MethodName: "GetPolicyRule",
+			Handler:    _PolicyService_GetPolicyRule_Handler,
+		},
+		{
+			MethodName: "UpdatePolicyRule",
+			Handler:    _PolicyService_UpdatePolicyRule_Handler,
+		},
+		{
+			MethodName: "DeletePolicyRule",
+			Handler:    _PolicyService_DeletePolicyRule_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "mcr/v1/policy.proto",
+}

gen/mcr/v1/registry.pb.go

@@ -1,15 +1,65 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.32.1
 // source: mcr/v1/registry.proto
 
 package mcrv1
 
-// RepositoryMetadata is a repository summary for listing.
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
 type RepositoryMetadata struct {
-	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
-	TagCount      int32  `protobuf:"varint,2,opt,name=tag_count,json=tagCount,proto3" json:"tag_count,omitempty"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
-	ManifestCount int32  `protobuf:"varint,3,opt,name=manifest_count,json=manifestCount,proto3" json:"manifest_count,omitempty"`
+	TagCount      int32                  `protobuf:"varint,2,opt,name=tag_count,json=tagCount,proto3" json:"tag_count,omitempty"`
-	TotalSize     int64  `protobuf:"varint,4,opt,name=total_size,json=totalSize,proto3" json:"total_size,omitempty"`
+	ManifestCount int32                  `protobuf:"varint,3,opt,name=manifest_count,json=manifestCount,proto3" json:"manifest_count,omitempty"`
-	CreatedAt     string `protobuf:"bytes,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	TotalSize     int64                  `protobuf:"varint,4,opt,name=total_size,json=totalSize,proto3" json:"total_size,omitempty"`
+	CreatedAt     string                 `protobuf:"bytes,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RepositoryMetadata) Reset() {
+	*x = RepositoryMetadata{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RepositoryMetadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RepositoryMetadata) ProtoMessage() {}
+
+func (x *RepositoryMetadata) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RepositoryMetadata.ProtoReflect.Descriptor instead.
+func (*RepositoryMetadata) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *RepositoryMetadata) GetName() string {
@@ -47,10 +97,43 @@ func (x *RepositoryMetadata) GetCreatedAt() string {
 	return ""
 }
 
-// TagInfo is a tag with its manifest digest.
 type TagInfo struct {
-	Name   string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
-	Digest string `protobuf:"bytes,2,opt,name=digest,proto3" json:"digest,omitempty"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Digest        string                 `protobuf:"bytes,2,opt,name=digest,proto3" json:"digest,omitempty"`
+	UpdatedAt     string                 `protobuf:"bytes,3,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TagInfo) Reset() {
+	*x = TagInfo{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TagInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TagInfo) ProtoMessage() {}
+
+func (x *TagInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TagInfo.ProtoReflect.Descriptor instead.
+func (*TagInfo) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *TagInfo) GetName() string {
@@ -67,12 +150,51 @@ func (x *TagInfo) GetDigest() string {
 	return ""
 }
 
-// ManifestInfo is a manifest summary.
+func (x *TagInfo) GetUpdatedAt() string {
+	if x != nil {
+		return x.UpdatedAt
+	}
+	return ""
+}
+
 type ManifestInfo struct {
-	Digest    string `protobuf:"bytes,1,opt,name=digest,proto3" json:"digest,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
-	MediaType string `protobuf:"bytes,2,opt,name=media_type,json=mediaType,proto3" json:"media_type,omitempty"`
+	Digest        string                 `protobuf:"bytes,1,opt,name=digest,proto3" json:"digest,omitempty"`
-	Size      int64  `protobuf:"varint,3,opt,name=size,proto3" json:"size,omitempty"`
+	MediaType     string                 `protobuf:"bytes,2,opt,name=media_type,json=mediaType,proto3" json:"media_type,omitempty"`
-	CreatedAt string `protobuf:"bytes,4,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	Size          int64                  `protobuf:"varint,3,opt,name=size,proto3" json:"size,omitempty"`
+	CreatedAt     string                 `protobuf:"bytes,4,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ManifestInfo) Reset() {
+	*x = ManifestInfo{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ManifestInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ManifestInfo) ProtoMessage() {}
+
+func (x *ManifestInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ManifestInfo.ProtoReflect.Descriptor instead.
+func (*ManifestInfo) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *ManifestInfo) GetDigest() string {
@@ -103,9 +225,41 @@ func (x *ManifestInfo) GetCreatedAt() string {
 	return ""
 }
 
-// ListRepositoriesRequest is the request message for ListRepositories.
 type ListRepositoriesRequest struct {
-	Pagination *PaginationRequest `protobuf:"bytes,1,opt,name=pagination,proto3" json:"pagination,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Pagination    *PaginationRequest     `protobuf:"bytes,1,opt,name=pagination,proto3" json:"pagination,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRepositoriesRequest) Reset() {
+	*x = ListRepositoriesRequest{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRepositoriesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRepositoriesRequest) ProtoMessage() {}
+
+func (x *ListRepositoriesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRepositoriesRequest.ProtoReflect.Descriptor instead.
+func (*ListRepositoriesRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *ListRepositoriesRequest) GetPagination() *PaginationRequest {
@@ -115,9 +269,41 @@ func (x *ListRepositoriesRequest) GetPagination() *PaginationRequest {
 	return nil
 }
 
-// ListRepositoriesResponse is the response message for ListRepositories.
 type ListRepositoriesResponse struct {
-	Repositories []*RepositoryMetadata `protobuf:"bytes,1,rep,name=repositories,proto3" json:"repositories,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Repositories  []*RepositoryMetadata  `protobuf:"bytes,1,rep,name=repositories,proto3" json:"repositories,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRepositoriesResponse) Reset() {
+	*x = ListRepositoriesResponse{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRepositoriesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRepositoriesResponse) ProtoMessage() {}
+
+func (x *ListRepositoriesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRepositoriesResponse.ProtoReflect.Descriptor instead.
+func (*ListRepositoriesResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *ListRepositoriesResponse) GetRepositories() []*RepositoryMetadata {
@@ -127,9 +313,41 @@ func (x *ListRepositoriesResponse) GetRepositories() []*RepositoryMetadata {
 	return nil
 }
 
-// GetRepositoryRequest is the request message for GetRepository.
 type GetRepositoryRequest struct {
-	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetRepositoryRequest) Reset() {
+	*x = GetRepositoryRequest{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetRepositoryRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetRepositoryRequest) ProtoMessage() {}
+
+func (x *GetRepositoryRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetRepositoryRequest.ProtoReflect.Descriptor instead.
+func (*GetRepositoryRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *GetRepositoryRequest) GetName() string {
@@ -139,13 +357,45 @@ func (x *GetRepositoryRequest) GetName() string {
 	return ""
 }
 
-// GetRepositoryResponse is the response message for GetRepository.
 type GetRepositoryResponse struct {
-	Name      string          `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
-	Tags      []*TagInfo      `protobuf:"bytes,2,rep,name=tags,proto3" json:"tags,omitempty"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
-	Manifests []*ManifestInfo `protobuf:"bytes,3,rep,name=manifests,proto3" json:"manifests,omitempty"`
+	Tags          []*TagInfo             `protobuf:"bytes,2,rep,name=tags,proto3" json:"tags,omitempty"`
-	TotalSize int64           `protobuf:"varint,4,opt,name=total_size,json=totalSize,proto3" json:"total_size,omitempty"`
+	Manifests     []*ManifestInfo        `protobuf:"bytes,3,rep,name=manifests,proto3" json:"manifests,omitempty"`
-	CreatedAt string          `protobuf:"bytes,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	TotalSize     int64                  `protobuf:"varint,4,opt,name=total_size,json=totalSize,proto3" json:"total_size,omitempty"`
+	CreatedAt     string                 `protobuf:"bytes,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetRepositoryResponse) Reset() {
+	*x = GetRepositoryResponse{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetRepositoryResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetRepositoryResponse) ProtoMessage() {}
+
+func (x *GetRepositoryResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetRepositoryResponse.ProtoReflect.Descriptor instead.
+func (*GetRepositoryResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *GetRepositoryResponse) GetName() string {
@@ -183,9 +433,41 @@ func (x *GetRepositoryResponse) GetCreatedAt() string {
 	return ""
 }
 
-// DeleteRepositoryRequest is the request message for DeleteRepository.
 type DeleteRepositoryRequest struct {
-	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteRepositoryRequest) Reset() {
+	*x = DeleteRepositoryRequest{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteRepositoryRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteRepositoryRequest) ProtoMessage() {}
+
+func (x *DeleteRepositoryRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteRepositoryRequest.ProtoReflect.Descriptor instead.
+func (*DeleteRepositoryRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *DeleteRepositoryRequest) GetName() string {
@@ -195,15 +477,113 @@ func (x *DeleteRepositoryRequest) GetName() string {
 	return ""
 }
 
-// DeleteRepositoryResponse is the response message for DeleteRepository.
+type DeleteRepositoryResponse struct {
-type DeleteRepositoryResponse struct{}
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
 
-// GarbageCollectRequest is the request message for GarbageCollect.
+func (x *DeleteRepositoryResponse) Reset() {
-type GarbageCollectRequest struct{}
+	*x = DeleteRepositoryResponse{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteRepositoryResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteRepositoryResponse) ProtoMessage() {}
+
+func (x *DeleteRepositoryResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteRepositoryResponse.ProtoReflect.Descriptor instead.
+func (*DeleteRepositoryResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{8}
+}
+
+type GarbageCollectRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GarbageCollectRequest) Reset() {
+	*x = GarbageCollectRequest{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GarbageCollectRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GarbageCollectRequest) ProtoMessage() {}
+
+func (x *GarbageCollectRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GarbageCollectRequest.ProtoReflect.Descriptor instead.
+func (*GarbageCollectRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{9}
+}
 
-// GarbageCollectResponse is the response message for GarbageCollect.
 type GarbageCollectResponse struct {
-	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` //nolint:revive,stylecheck // proto field name
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GarbageCollectResponse) Reset() {
+	*x = GarbageCollectResponse{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GarbageCollectResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GarbageCollectResponse) ProtoMessage() {}
+
+func (x *GarbageCollectResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GarbageCollectResponse.ProtoReflect.Descriptor instead.
+func (*GarbageCollectResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *GarbageCollectResponse) GetId() string {
@@ -213,15 +593,80 @@ func (x *GarbageCollectResponse) GetId() string {
 	return ""
 }
 
-// GetGCStatusRequest is the request message for GetGCStatus.
+type GetGCStatusRequest struct {
-type GetGCStatusRequest struct{}
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetGCStatusRequest) Reset() {
+	*x = GetGCStatusRequest{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetGCStatusRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetGCStatusRequest) ProtoMessage() {}
+
+func (x *GetGCStatusRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[11]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetGCStatusRequest.ProtoReflect.Descriptor instead.
+func (*GetGCStatusRequest) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{11}
+}
 
-// GCLastRun records the result of the last garbage collection run.
 type GCLastRun struct {
-	StartedAt   string `protobuf:"bytes,1,opt,name=started_at,json=startedAt,proto3" json:"started_at,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
-	CompletedAt string `protobuf:"bytes,2,opt,name=completed_at,json=completedAt,proto3" json:"completed_at,omitempty"`
+	StartedAt     string                 `protobuf:"bytes,1,opt,name=started_at,json=startedAt,proto3" json:"started_at,omitempty"`
-	BlobsRemoved int32  `protobuf:"varint,3,opt,name=blobs_removed,json=blobsRemoved,proto3" json:"blobs_removed,omitempty"`
+	CompletedAt   string                 `protobuf:"bytes,2,opt,name=completed_at,json=completedAt,proto3" json:"completed_at,omitempty"`
-	BytesFreed  int64  `protobuf:"varint,4,opt,name=bytes_freed,json=bytesFreed,proto3" json:"bytes_freed,omitempty"`
+	BlobsRemoved  int32                  `protobuf:"varint,3,opt,name=blobs_removed,json=blobsRemoved,proto3" json:"blobs_removed,omitempty"`
+	BytesFreed    int64                  `protobuf:"varint,4,opt,name=bytes_freed,json=bytesFreed,proto3" json:"bytes_freed,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GCLastRun) Reset() {
+	*x = GCLastRun{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GCLastRun) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GCLastRun) ProtoMessage() {}
+
+func (x *GCLastRun) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[12]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GCLastRun.ProtoReflect.Descriptor instead.
+func (*GCLastRun) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *GCLastRun) GetStartedAt() string {
@@ -252,10 +697,42 @@ func (x *GCLastRun) GetBytesFreed() int64 {
 	return 0
 }
 
-// GetGCStatusResponse is the response message for GetGCStatus.
 type GetGCStatusResponse struct {
-	Running bool      `protobuf:"varint,1,opt,name=running,proto3" json:"running,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
-	LastRun *GCLastRun `protobuf:"bytes,2,opt,name=last_run,json=lastRun,proto3" json:"last_run,omitempty"`
+	Running       bool                   `protobuf:"varint,1,opt,name=running,proto3" json:"running,omitempty"`
+	LastRun       *GCLastRun             `protobuf:"bytes,2,opt,name=last_run,json=lastRun,proto3" json:"last_run,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetGCStatusResponse) Reset() {
+	*x = GetGCStatusResponse{}
+	mi := &file_mcr_v1_registry_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetGCStatusResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetGCStatusResponse) ProtoMessage() {}
+
+func (x *GetGCStatusResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcr_v1_registry_proto_msgTypes[13]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetGCStatusResponse.ProtoReflect.Descriptor instead.
+func (*GetGCStatusResponse) Descriptor() ([]byte, []int) {
+	return file_mcr_v1_registry_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *GetGCStatusResponse) GetRunning() bool {
@@ -271,3 +748,146 @@ func (x *GetGCStatusResponse) GetLastRun() *GCLastRun {
 	}
 	return nil
 }
+
+var File_mcr_v1_registry_proto protoreflect.FileDescriptor
+
+const file_mcr_v1_registry_proto_rawDesc = "" +
+	"\n" +
+	"\x15mcr/v1/registry.proto\x12\x06mcr.v1\x1a\x13mcr/v1/common.proto\"\xaa\x01\n" +
+	"\x12RepositoryMetadata\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1b\n" +
+	"\ttag_count\x18\x02 \x01(\x05R\btagCount\x12%\n" +
+	"\x0emanifest_count\x18\x03 \x01(\x05R\rmanifestCount\x12\x1d\n" +
+	"\n" +
+	"total_size\x18\x04 \x01(\x03R\ttotalSize\x12\x1d\n" +
+	"\n" +
+	"created_at\x18\x05 \x01(\tR\tcreatedAt\"T\n" +
+	"\aTagInfo\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x16\n" +
+	"\x06digest\x18\x02 \x01(\tR\x06digest\x12\x1d\n" +
+	"\n" +
+	"updated_at\x18\x03 \x01(\tR\tupdatedAt\"x\n" +
+	"\fManifestInfo\x12\x16\n" +
+	"\x06digest\x18\x01 \x01(\tR\x06digest\x12\x1d\n" +
+	"\n" +
+	"media_type\x18\x02 \x01(\tR\tmediaType\x12\x12\n" +
+	"\x04size\x18\x03 \x01(\x03R\x04size\x12\x1d\n" +
+	"\n" +
+	"created_at\x18\x04 \x01(\tR\tcreatedAt\"T\n" +
+	"\x17ListRepositoriesRequest\x129\n" +
+	"\n" +
+	"pagination\x18\x01 \x01(\v2\x19.mcr.v1.PaginationRequestR\n" +
+	"pagination\"Z\n" +
+	"\x18ListRepositoriesResponse\x12>\n" +
+	"\frepositories\x18\x01 \x03(\v2\x1a.mcr.v1.RepositoryMetadataR\frepositories\"*\n" +
+	"\x14GetRepositoryRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"\xc2\x01\n" +
+	"\x15GetRepositoryResponse\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12#\n" +
+	"\x04tags\x18\x02 \x03(\v2\x0f.mcr.v1.TagInfoR\x04tags\x122\n" +
+	"\tmanifests\x18\x03 \x03(\v2\x14.mcr.v1.ManifestInfoR\tmanifests\x12\x1d\n" +
+	"\n" +
+	"total_size\x18\x04 \x01(\x03R\ttotalSize\x12\x1d\n" +
+	"\n" +
+	"created_at\x18\x05 \x01(\tR\tcreatedAt\"-\n" +
+	"\x17DeleteRepositoryRequest\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"\x1a\n" +
+	"\x18DeleteRepositoryResponse\"\x17\n" +
+	"\x15GarbageCollectRequest\"(\n" +
+	"\x16GarbageCollectResponse\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\"\x14\n" +
+	"\x12GetGCStatusRequest\"\x93\x01\n" +
+	"\tGCLastRun\x12\x1d\n" +
+	"\n" +
+	"started_at\x18\x01 \x01(\tR\tstartedAt\x12!\n" +
+	"\fcompleted_at\x18\x02 \x01(\tR\vcompletedAt\x12#\n" +
+	"\rblobs_removed\x18\x03 \x01(\x05R\fblobsRemoved\x12\x1f\n" +
+	"\vbytes_freed\x18\x04 \x01(\x03R\n" +
+	"bytesFreed\"]\n" +
+	"\x13GetGCStatusResponse\x12\x18\n" +
+	"\arunning\x18\x01 \x01(\bR\arunning\x12,\n" +
+	"\blast_run\x18\x02 \x01(\v2\x11.mcr.v1.GCLastRunR\alastRun2\xa6\x03\n" +
+	"\x0fRegistryService\x12U\n" +
+	"\x10ListRepositories\x12\x1f.mcr.v1.ListRepositoriesRequest\x1a .mcr.v1.ListRepositoriesResponse\x12L\n" +
+	"\rGetRepository\x12\x1c.mcr.v1.GetRepositoryRequest\x1a\x1d.mcr.v1.GetRepositoryResponse\x12U\n" +
+	"\x10DeleteRepository\x12\x1f.mcr.v1.DeleteRepositoryRequest\x1a .mcr.v1.DeleteRepositoryResponse\x12O\n" +
+	"\x0eGarbageCollect\x12\x1d.mcr.v1.GarbageCollectRequest\x1a\x1e.mcr.v1.GarbageCollectResponse\x12F\n" +
+	"\vGetGCStatus\x12\x1a.mcr.v1.GetGCStatusRequest\x1a\x1b.mcr.v1.GetGCStatusResponseB*Z(git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1b\x06proto3"
+
+var (
+	file_mcr_v1_registry_proto_rawDescOnce sync.Once
+	file_mcr_v1_registry_proto_rawDescData []byte
+)
+
+func file_mcr_v1_registry_proto_rawDescGZIP() []byte {
+	file_mcr_v1_registry_proto_rawDescOnce.Do(func() {
+		file_mcr_v1_registry_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_mcr_v1_registry_proto_rawDesc), len(file_mcr_v1_registry_proto_rawDesc)))
+	})
+	return file_mcr_v1_registry_proto_rawDescData
+}
+
+var file_mcr_v1_registry_proto_msgTypes = make([]protoimpl.MessageInfo, 14)
+var file_mcr_v1_registry_proto_goTypes = []any{
+	(*RepositoryMetadata)(nil),       // 0: mcr.v1.RepositoryMetadata
+	(*TagInfo)(nil),                  // 1: mcr.v1.TagInfo
+	(*ManifestInfo)(nil),             // 2: mcr.v1.ManifestInfo
+	(*ListRepositoriesRequest)(nil),  // 3: mcr.v1.ListRepositoriesRequest
+	(*ListRepositoriesResponse)(nil), // 4: mcr.v1.ListRepositoriesResponse
+	(*GetRepositoryRequest)(nil),     // 5: mcr.v1.GetRepositoryRequest
+	(*GetRepositoryResponse)(nil),    // 6: mcr.v1.GetRepositoryResponse
+	(*DeleteRepositoryRequest)(nil),  // 7: mcr.v1.DeleteRepositoryRequest
+	(*DeleteRepositoryResponse)(nil), // 8: mcr.v1.DeleteRepositoryResponse
+	(*GarbageCollectRequest)(nil),    // 9: mcr.v1.GarbageCollectRequest
+	(*GarbageCollectResponse)(nil),   // 10: mcr.v1.GarbageCollectResponse
+	(*GetGCStatusRequest)(nil),       // 11: mcr.v1.GetGCStatusRequest
+	(*GCLastRun)(nil),                // 12: mcr.v1.GCLastRun
+	(*GetGCStatusResponse)(nil),      // 13: mcr.v1.GetGCStatusResponse
+	(*PaginationRequest)(nil),        // 14: mcr.v1.PaginationRequest
+}
+var file_mcr_v1_registry_proto_depIdxs = []int32{
+	14, // 0: mcr.v1.ListRepositoriesRequest.pagination:type_name -> mcr.v1.PaginationRequest
+	0,  // 1: mcr.v1.ListRepositoriesResponse.repositories:type_name -> mcr.v1.RepositoryMetadata
+	1,  // 2: mcr.v1.GetRepositoryResponse.tags:type_name -> mcr.v1.TagInfo
+	2,  // 3: mcr.v1.GetRepositoryResponse.manifests:type_name -> mcr.v1.ManifestInfo
+	12, // 4: mcr.v1.GetGCStatusResponse.last_run:type_name -> mcr.v1.GCLastRun
+	3,  // 5: mcr.v1.RegistryService.ListRepositories:input_type -> mcr.v1.ListRepositoriesRequest
+	5,  // 6: mcr.v1.RegistryService.GetRepository:input_type -> mcr.v1.GetRepositoryRequest
+	7,  // 7: mcr.v1.RegistryService.DeleteRepository:input_type -> mcr.v1.DeleteRepositoryRequest
+	9,  // 8: mcr.v1.RegistryService.GarbageCollect:input_type -> mcr.v1.GarbageCollectRequest
+	11, // 9: mcr.v1.RegistryService.GetGCStatus:input_type -> mcr.v1.GetGCStatusRequest
+	4,  // 10: mcr.v1.RegistryService.ListRepositories:output_type -> mcr.v1.ListRepositoriesResponse
+	6,  // 11: mcr.v1.RegistryService.GetRepository:output_type -> mcr.v1.GetRepositoryResponse
+	8,  // 12: mcr.v1.RegistryService.DeleteRepository:output_type -> mcr.v1.DeleteRepositoryResponse
+	10, // 13: mcr.v1.RegistryService.GarbageCollect:output_type -> mcr.v1.GarbageCollectResponse
+	13, // 14: mcr.v1.RegistryService.GetGCStatus:output_type -> mcr.v1.GetGCStatusResponse
+	10, // [10:15] is the sub-list for method output_type
+	5,  // [5:10] is the sub-list for method input_type
+	5,  // [5:5] is the sub-list for extension type_name
+	5,  // [5:5] is the sub-list for extension extendee
+	0,  // [0:5] is the sub-list for field type_name
+}
+
+func init() { file_mcr_v1_registry_proto_init() }
+func file_mcr_v1_registry_proto_init() {
+	if File_mcr_v1_registry_proto != nil {
+		return
+	}
+	file_mcr_v1_common_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_mcr_v1_registry_proto_rawDesc), len(file_mcr_v1_registry_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   14,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_mcr_v1_registry_proto_goTypes,
+		DependencyIndexes: file_mcr_v1_registry_proto_depIdxs,
+		MessageInfos:      file_mcr_v1_registry_proto_msgTypes,
+	}.Build()
+	File_mcr_v1_registry_proto = out.File
+	file_mcr_v1_registry_proto_goTypes = nil
+	file_mcr_v1_registry_proto_depIdxs = nil
+}

gen/mcr/v1/registry_grpc.pb.go

@@ -1,178 +1,34 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             v6.32.1
 // source: mcr/v1/registry.proto
 
 package mcrv1
 
 import (
-	"context"
+	context "context"
-
+	grpc "google.golang.org/grpc"
-	"google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
-	"google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
-	"google.golang.org/grpc/status"
 )
 
-// RegistryServiceServer is the server API for RegistryService.
+// This is a compile-time assertion to ensure that this generated file
-type RegistryServiceServer interface {
+// is compatible with the grpc package it is being compiled against.
-	ListRepositories(context.Context, *ListRepositoriesRequest) (*ListRepositoriesResponse, error)
+// Requires gRPC-Go v1.64.0 or later.
-	GetRepository(context.Context, *GetRepositoryRequest) (*GetRepositoryResponse, error)
+const _ = grpc.SupportPackageIsVersion9
-	DeleteRepository(context.Context, *DeleteRepositoryRequest) (*DeleteRepositoryResponse, error)
-	GarbageCollect(context.Context, *GarbageCollectRequest) (*GarbageCollectResponse, error)
-	GetGCStatus(context.Context, *GetGCStatusRequest) (*GetGCStatusResponse, error)
-	mustEmbedUnimplementedRegistryServiceServer()
-}
 
-// UnimplementedRegistryServiceServer should be embedded to have forward
+const (
-// compatible implementations.
+	RegistryService_ListRepositories_FullMethodName = "/mcr.v1.RegistryService/ListRepositories"
-type UnimplementedRegistryServiceServer struct{}
+	RegistryService_GetRepository_FullMethodName    = "/mcr.v1.RegistryService/GetRepository"
+	RegistryService_DeleteRepository_FullMethodName = "/mcr.v1.RegistryService/DeleteRepository"
+	RegistryService_GarbageCollect_FullMethodName   = "/mcr.v1.RegistryService/GarbageCollect"
+	RegistryService_GetGCStatus_FullMethodName      = "/mcr.v1.RegistryService/GetGCStatus"
+)
 
-func (UnimplementedRegistryServiceServer) ListRepositories(context.Context, *ListRepositoriesRequest) (*ListRepositoriesResponse, error) {
+// RegistryServiceClient is the client API for RegistryService service.
-	return nil, status.Errorf(codes.Unimplemented, "method ListRepositories not implemented")
+//
-}
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
-
-func (UnimplementedRegistryServiceServer) GetRepository(context.Context, *GetRepositoryRequest) (*GetRepositoryResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetRepository not implemented")
-}
-
-func (UnimplementedRegistryServiceServer) DeleteRepository(context.Context, *DeleteRepositoryRequest) (*DeleteRepositoryResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DeleteRepository not implemented")
-}
-
-func (UnimplementedRegistryServiceServer) GarbageCollect(context.Context, *GarbageCollectRequest) (*GarbageCollectResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GarbageCollect not implemented")
-}
-
-func (UnimplementedRegistryServiceServer) GetGCStatus(context.Context, *GetGCStatusRequest) (*GetGCStatusResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetGCStatus not implemented")
-}
-
-func (UnimplementedRegistryServiceServer) mustEmbedUnimplementedRegistryServiceServer() {}
-
-// RegisterRegistryServiceServer registers the RegistryServiceServer with the grpc.Server.
-func RegisterRegistryServiceServer(s grpc.ServiceRegistrar, srv RegistryServiceServer) {
-	s.RegisterService(&RegistryService_ServiceDesc, srv)
-}
-
-func registryServiceListRepositoriesHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(ListRepositoriesRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(RegistryServiceServer).ListRepositories(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.RegistryService/ListRepositories",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(RegistryServiceServer).ListRepositories(ctx, req.(*ListRepositoriesRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func registryServiceGetRepositoryHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(GetRepositoryRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(RegistryServiceServer).GetRepository(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.RegistryService/GetRepository",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(RegistryServiceServer).GetRepository(ctx, req.(*GetRepositoryRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func registryServiceDeleteRepositoryHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(DeleteRepositoryRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(RegistryServiceServer).DeleteRepository(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.RegistryService/DeleteRepository",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(RegistryServiceServer).DeleteRepository(ctx, req.(*DeleteRepositoryRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func registryServiceGarbageCollectHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(GarbageCollectRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(RegistryServiceServer).GarbageCollect(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.RegistryService/GarbageCollect",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(RegistryServiceServer).GarbageCollect(ctx, req.(*GarbageCollectRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func registryServiceGetGCStatusHandler(srv any, ctx context.Context, dec func(any) error, interceptor grpc.UnaryServerInterceptor) (any, error) {
-	in := new(GetGCStatusRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(RegistryServiceServer).GetGCStatus(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/mcr.v1.RegistryService/GetGCStatus",
-	}
-	handler := func(ctx context.Context, req any) (any, error) {
-		return srv.(RegistryServiceServer).GetGCStatus(ctx, req.(*GetGCStatusRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-// RegistryService_ServiceDesc is the grpc.ServiceDesc for RegistryService.
-var RegistryService_ServiceDesc = grpc.ServiceDesc{
-	ServiceName: "mcr.v1.RegistryService",
-	HandlerType: (*RegistryServiceServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "ListRepositories",
-			Handler:    registryServiceListRepositoriesHandler,
-		},
-		{
-			MethodName: "GetRepository",
-			Handler:    registryServiceGetRepositoryHandler,
-		},
-		{
-			MethodName: "DeleteRepository",
-			Handler:    registryServiceDeleteRepositoryHandler,
-		},
-		{
-			MethodName: "GarbageCollect",
-			Handler:    registryServiceGarbageCollectHandler,
-		},
-		{
-			MethodName: "GetGCStatus",
-			Handler:    registryServiceGetGCStatusHandler,
-		},
-	},
-	Streams:  []grpc.StreamDesc{},
-	Metadata: "mcr/v1/registry.proto",
-}
-
-// RegistryServiceClient is the client API for RegistryService.
 type RegistryServiceClient interface {
 	ListRepositories(ctx context.Context, in *ListRepositoriesRequest, opts ...grpc.CallOption) (*ListRepositoriesResponse, error)
 	GetRepository(ctx context.Context, in *GetRepositoryRequest, opts ...grpc.CallOption) (*GetRepositoryResponse, error)
@@ -185,14 +41,14 @@ type registryServiceClient struct {
 	cc grpc.ClientConnInterface
 }
 
-// NewRegistryServiceClient creates a new RegistryServiceClient.
 func NewRegistryServiceClient(cc grpc.ClientConnInterface) RegistryServiceClient {
 	return &registryServiceClient{cc}
 }
 
 func (c *registryServiceClient) ListRepositories(ctx context.Context, in *ListRepositoriesRequest, opts ...grpc.CallOption) (*ListRepositoriesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListRepositoriesResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.RegistryService/ListRepositories", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistryService_ListRepositories_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -200,8 +56,9 @@ func (c *registryServiceClient) ListRepositories(ctx context.Context, in *ListRe
 }
 
 func (c *registryServiceClient) GetRepository(ctx context.Context, in *GetRepositoryRequest, opts ...grpc.CallOption) (*GetRepositoryResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetRepositoryResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.RegistryService/GetRepository", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistryService_GetRepository_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -209,8 +66,9 @@ func (c *registryServiceClient) GetRepository(ctx context.Context, in *GetReposi
 }
 
 func (c *registryServiceClient) DeleteRepository(ctx context.Context, in *DeleteRepositoryRequest, opts ...grpc.CallOption) (*DeleteRepositoryResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DeleteRepositoryResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.RegistryService/DeleteRepository", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistryService_DeleteRepository_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -218,8 +76,9 @@ func (c *registryServiceClient) DeleteRepository(ctx context.Context, in *Delete
 }
 
 func (c *registryServiceClient) GarbageCollect(ctx context.Context, in *GarbageCollectRequest, opts ...grpc.CallOption) (*GarbageCollectResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GarbageCollectResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.RegistryService/GarbageCollect", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistryService_GarbageCollect_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -227,10 +86,188 @@ func (c *registryServiceClient) GarbageCollect(ctx context.Context, in *GarbageC
 }
 
 func (c *registryServiceClient) GetGCStatus(ctx context.Context, in *GetGCStatusRequest, opts ...grpc.CallOption) (*GetGCStatusResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetGCStatusResponse)
-	err := c.cc.Invoke(ctx, "/mcr.v1.RegistryService/GetGCStatus", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistryService_GetGCStatus_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
+
+// RegistryServiceServer is the server API for RegistryService service.
+// All implementations must embed UnimplementedRegistryServiceServer
+// for forward compatibility.
+type RegistryServiceServer interface {
+	ListRepositories(context.Context, *ListRepositoriesRequest) (*ListRepositoriesResponse, error)
+	GetRepository(context.Context, *GetRepositoryRequest) (*GetRepositoryResponse, error)
+	DeleteRepository(context.Context, *DeleteRepositoryRequest) (*DeleteRepositoryResponse, error)
+	GarbageCollect(context.Context, *GarbageCollectRequest) (*GarbageCollectResponse, error)
+	GetGCStatus(context.Context, *GetGCStatusRequest) (*GetGCStatusResponse, error)
+	mustEmbedUnimplementedRegistryServiceServer()
+}
+
+// UnimplementedRegistryServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedRegistryServiceServer struct{}
+
+func (UnimplementedRegistryServiceServer) ListRepositories(context.Context, *ListRepositoriesRequest) (*ListRepositoriesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListRepositories not implemented")
+}
+func (UnimplementedRegistryServiceServer) GetRepository(context.Context, *GetRepositoryRequest) (*GetRepositoryResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetRepository not implemented")
+}
+func (UnimplementedRegistryServiceServer) DeleteRepository(context.Context, *DeleteRepositoryRequest) (*DeleteRepositoryResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method DeleteRepository not implemented")
+}
+func (UnimplementedRegistryServiceServer) GarbageCollect(context.Context, *GarbageCollectRequest) (*GarbageCollectResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GarbageCollect not implemented")
+}
+func (UnimplementedRegistryServiceServer) GetGCStatus(context.Context, *GetGCStatusRequest) (*GetGCStatusResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetGCStatus not implemented")
+}
+func (UnimplementedRegistryServiceServer) mustEmbedUnimplementedRegistryServiceServer() {}
+func (UnimplementedRegistryServiceServer) testEmbeddedByValue()                         {}
+
+// UnsafeRegistryServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to RegistryServiceServer will
+// result in compilation errors.
+type UnsafeRegistryServiceServer interface {
+	mustEmbedUnimplementedRegistryServiceServer()
+}
+
+func RegisterRegistryServiceServer(s grpc.ServiceRegistrar, srv RegistryServiceServer) {
+	// If the following call panics, it indicates UnimplementedRegistryServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&RegistryService_ServiceDesc, srv)
+}
+
+func _RegistryService_ListRepositories_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListRepositoriesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RegistryServiceServer).ListRepositories(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RegistryService_ListRepositories_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RegistryServiceServer).ListRepositories(ctx, req.(*ListRepositoriesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RegistryService_GetRepository_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetRepositoryRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RegistryServiceServer).GetRepository(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RegistryService_GetRepository_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RegistryServiceServer).GetRepository(ctx, req.(*GetRepositoryRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RegistryService_DeleteRepository_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteRepositoryRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RegistryServiceServer).DeleteRepository(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RegistryService_DeleteRepository_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RegistryServiceServer).DeleteRepository(ctx, req.(*DeleteRepositoryRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RegistryService_GarbageCollect_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GarbageCollectRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RegistryServiceServer).GarbageCollect(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RegistryService_GarbageCollect_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RegistryServiceServer).GarbageCollect(ctx, req.(*GarbageCollectRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RegistryService_GetGCStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetGCStatusRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RegistryServiceServer).GetGCStatus(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RegistryService_GetGCStatus_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RegistryServiceServer).GetGCStatus(ctx, req.(*GetGCStatusRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// RegistryService_ServiceDesc is the grpc.ServiceDesc for RegistryService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var RegistryService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "mcr.v1.RegistryService",
+	HandlerType: (*RegistryServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "ListRepositories",
+			Handler:    _RegistryService_ListRepositories_Handler,
+		},
+		{
+			MethodName: "GetRepository",
+			Handler:    _RegistryService_GetRepository_Handler,
+		},
+		{
+			MethodName: "DeleteRepository",
+			Handler:    _RegistryService_DeleteRepository_Handler,
+		},
+		{
+			MethodName: "GarbageCollect",
+			Handler:    _RegistryService_GarbageCollect_Handler,
+		},
+		{
+			MethodName: "GetGCStatus",
+			Handler:    _RegistryService_GetGCStatus_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "mcr/v1/registry.proto",
+}

go.mod

@@ -1,13 +1,14 @@
-module git.wntrmute.dev/kyle/mcr
+module git.wntrmute.dev/mc/mcr
 
 go 1.25.7
 
 require (
-	git.wntrmute.dev/kyle/mcdsl v1.0.0
+	git.wntrmute.dev/mc/mcdsl v1.2.0
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/google/uuid v1.6.0
 	github.com/spf13/cobra v1.10.2
 	google.golang.org/grpc v1.79.3
+	google.golang.org/protobuf v1.36.11
 )
 
 require (
@@ -22,7 +23,6 @@ require (
 	golang.org/x/sys v0.42.0 // indirect
 	golang.org/x/text v0.32.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
 	modernc.org/libc v1.70.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect

go.sum

@@ -1,5 +1,5 @@
-git.wntrmute.dev/kyle/mcdsl v1.0.0 h1:YB7dx4gdNYKKcVySpL6UkwHqdCJ9Nl1yS0+eHk0hNtk=
+git.wntrmute.dev/mc/mcdsl v1.2.0 h1:41hep7/PNZJfN0SN/nM+rQpyF1GSZcvNNjyVG81DI7U=
-git.wntrmute.dev/kyle/mcdsl v1.0.0/go.mod h1:wo0tGfUAxci3XnOe4/rFmR0RjUElKdYUazc+Np986sg=
+git.wntrmute.dev/mc/mcdsl v1.2.0/go.mod h1:lXYrAt74ZUix6rx9oVN8d2zH1YJoyp4uxPVKQ+SSxuM=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=

internal/auth/client.go

@@ -4,7 +4,7 @@ import (
 	"errors"
 	"log/slog"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
 )
 
 // Client communicates with an MCIAS server for authentication and token

internal/config/config.go

@@ -5,7 +5,7 @@ import (
 	"os"
 	"path/filepath"
 
-	mcdslconfig "git.wntrmute.dev/kyle/mcdsl/config"
+	mcdslconfig "git.wntrmute.dev/mc/mcdsl/config"
 )
 
 // Config is the top-level MCR configuration. It embeds config.Base for
@@ -24,9 +24,10 @@ type StorageConfig struct {
 
 // WebConfig holds the web UI server settings.
 type WebConfig struct {
-	ListenAddr string `toml:"listen_addr"`
+	ListenAddr    string `toml:"listen_addr"`
-	GRPCAddr   string `toml:"grpc_addr"`
+	GRPCAddr      string `toml:"grpc_addr"`
-	CACert     string `toml:"ca_cert"`
+	CACert        string `toml:"ca_cert"`
+	TLSServerName string `toml:"tls_server_name"`
 }
 
 // Load reads a TOML config file, applies environment variable overrides

internal/db/admin.go

@@ -23,8 +23,9 @@ type RepoMetadata struct {
 
 // TagInfo is a tag with its manifest digest for repo detail.
 type TagInfo struct {
-	Name   string `json:"name"`
+	Name      string `json:"name"`
-	Digest string `json:"digest"`
+	Digest    string `json:"digest"`
+	UpdatedAt string `json:"updated_at"`
 }
 
 // ManifestInfo is a manifest summary for repo detail.
@@ -112,7 +113,7 @@ func (d *DB) GetRepositoryDetail(name string) (*RepoDetail, error) {
 
 	// Tags with manifest digests.
 	tagRows, err := d.Query(
-		`SELECT t.name, m.digest
+		`SELECT t.name, m.digest, t.updated_at
 		 FROM tags t JOIN manifests m ON m.id = t.manifest_id
 		 WHERE t.repository_id = ?
 		 ORDER BY t.name ASC`, repoID,
@@ -124,7 +125,7 @@ func (d *DB) GetRepositoryDetail(name string) (*RepoDetail, error) {
 
 	for tagRows.Next() {
 		var ti TagInfo
-		if err := tagRows.Scan(&ti.Name, &ti.Digest); err != nil {
+		if err := tagRows.Scan(&ti.Name, &ti.Digest, &ti.UpdatedAt); err != nil {
 			return nil, fmt.Errorf("db: scan tag: %w", err)
 		}
 		detail.Tags = append(detail.Tags, ti)

internal/db/db.go

@@ -4,7 +4,7 @@ import (
 	"database/sql"
 	"fmt"
 
-	mcdsldb "git.wntrmute.dev/kyle/mcdsl/db"
+	mcdsldb "git.wntrmute.dev/mc/mcdsl/db"
 )
 
 // DB wraps a SQLite database connection.

internal/db/gc.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"fmt"
 
-	"git.wntrmute.dev/kyle/mcr/internal/gc"
+	"git.wntrmute.dev/mc/mcr/internal/gc"
 )
 
 // FindAndDeleteUnreferencedBlobs finds all blob rows with no manifest_blobs

internal/db/migrate.go

@@ -1,7 +1,7 @@
 package db
 
 import (
-	mcdsldb "git.wntrmute.dev/kyle/mcdsl/db"
+	mcdsldb "git.wntrmute.dev/mc/mcdsl/db"
 )
 
 // Migrations is the ordered list of MCR schema migrations.

internal/db/policy.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 // ruleBody is the JSON structure stored in the rule_json column.

internal/db/policy_test.go

@@ -3,7 +3,7 @@ package db
 import (
 	"testing"
 
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 func TestLoadEnabledPolicyRules(t *testing.T) {

internal/grpcserver/admin.go

@@ -3,7 +3,7 @@ package grpcserver
 import (
 	"context"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
 )
 
 // adminService implements pb.AdminServiceServer.

internal/grpcserver/admin_test.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"testing"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
 )
 
 func TestHealthReturnsOk(t *testing.T) {

internal/grpcserver/audit.go

@@ -6,8 +6,8 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
 )
 
 // auditService implements pb.AuditServiceServer.

internal/grpcserver/audit_test.go

@@ -3,7 +3,7 @@ package grpcserver
 import (
 	"testing"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
 )
 
 func TestListAuditEventsEmpty(t *testing.T) {

internal/grpcserver/interceptors.go

@@ -1,7 +1,7 @@
 package grpcserver
 
 import (
-	mcdslgrpc "git.wntrmute.dev/kyle/mcdsl/grpcserver"
+	mcdslgrpc "git.wntrmute.dev/mc/mcdsl/grpcserver"
 )
 
 // methodMap builds the mcdsl grpcserver.MethodMap for MCR.

internal/grpcserver/interceptors_test.go

@@ -16,10 +16,10 @@ import (
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
 )
 
 // mockMCIAS starts a fake MCIAS HTTP server for token validation.

internal/grpcserver/policy.go

@@ -9,11 +9,11 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 var validActions = map[string]bool{

internal/grpcserver/policy_test.go

@@ -6,8 +6,8 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 type fakePolicyReloader struct {

internal/grpcserver/registry.go

@@ -11,11 +11,11 @@ import (
 
 	"github.com/google/uuid"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/gc"
+	"git.wntrmute.dev/mc/mcr/internal/gc"
 )
 
 // registryService implements pb.RegistryServiceServer.
@@ -78,8 +78,9 @@ func (s *registryService) GetRepository(_ context.Context, req *pb.GetRepository
 	}
 	for _, t := range detail.Tags {
 		resp.Tags = append(resp.Tags, &pb.TagInfo{
-			Name:   t.Name,
+			Name:      t.Name,
-			Digest: t.Digest,
+			Digest:    t.Digest,
+			UpdatedAt: t.UpdatedAt,
 		})
 	}
 	for _, m := range detail.Manifests {

internal/grpcserver/registry_test.go

@@ -8,9 +8,9 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
 )
 
 // testMCIAS is a package-level variable set by adminDeps for reuse.

internal/grpcserver/server.go

@@ -11,13 +11,13 @@ import (
 	"net"
 	"sync"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
-	mcdslgrpc "git.wntrmute.dev/kyle/mcdsl/grpcserver"
+	mcdslgrpc "git.wntrmute.dev/mc/mcdsl/grpcserver"
 
-	pb "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	pb "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/gc"
+	"git.wntrmute.dev/mc/mcr/internal/gc"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 // AuditFunc is a callback for recording audit events. It follows the same
@@ -65,7 +65,7 @@ type Server struct {
 //
 // If certFile or keyFile is empty, TLS is skipped (for testing only).
 func New(certFile, keyFile string, deps Deps, logger *slog.Logger) (*Server, error) {
-	srv, err := mcdslgrpc.New(certFile, keyFile, deps.Authenticator, methodMap(), logger)
+	srv, err := mcdslgrpc.New(certFile, keyFile, deps.Authenticator, methodMap(), logger, nil)
 	if err != nil {
 		return nil, err
 	}

internal/oci/blob.go

@@ -7,8 +7,8 @@ import (
 	"net/http"
 	"strconv"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 func (h *Handler) handleBlobGet(w http.ResponseWriter, r *http.Request, repo, digest string) {

internal/oci/catalog.go

@@ -6,7 +6,7 @@ import (
 	"net/http"
 	"strconv"
 
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 type catalogResponse struct {

internal/oci/delete.go

@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"net/http"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 // handleManifestDelete handles DELETE /v2/<name>/manifests/<digest>.

internal/oci/handler.go

@@ -6,10 +6,10 @@ import (
 	"net/http"
 	"strings"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
-	"git.wntrmute.dev/kyle/mcr/internal/storage"
+	"git.wntrmute.dev/mc/mcr/internal/storage"
 )
 
 // DBQuerier provides the database operations needed by OCI handlers.

internal/oci/handler_test.go

@@ -10,10 +10,10 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
-	"git.wntrmute.dev/kyle/mcr/internal/storage"
+	"git.wntrmute.dev/mc/mcr/internal/storage"
 )
 
 // manifestKey uniquely identifies a manifest for test lookup.

internal/oci/manifest.go

@@ -10,9 +10,9 @@ import (
 	"net/http"
 	"strconv"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 func (h *Handler) handleManifestGet(w http.ResponseWriter, r *http.Request, repo, reference string) {

internal/oci/tags.go

@@ -7,8 +7,8 @@ import (
 	"net/http"
 	"strconv"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 type tagListResponse struct {

internal/oci/upload.go

@@ -8,9 +8,9 @@ import (
 	"net/http"
 	"sync"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
-	"git.wntrmute.dev/kyle/mcr/internal/storage"
+	"git.wntrmute.dev/mc/mcr/internal/storage"
 )
 
 // uploadManager tracks in-progress blob writers by UUID.

internal/oci/upload_test.go

@@ -12,8 +12,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/storage"
+	"git.wntrmute.dev/mc/mcr/internal/storage"
 )
 
 // testHandlerWithStorage creates a handler with real storage in t.TempDir().

internal/server/admin.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"net/http"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
 )
 
 type adminErrorResponse struct {

internal/server/admin_audit.go

@@ -4,7 +4,7 @@ import (
 	"net/http"
 	"strconv"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
 )
 
 // AdminListAuditHandler handles GET /v1/audit.

internal/server/admin_audit_test.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"testing"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
 )
 
 func TestAdminListAuditEvents(t *testing.T) {

internal/server/admin_auth_test.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
 )
 
 func TestAdminHealthHandler(t *testing.T) {

internal/server/admin_gc.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/google/uuid"
 
-	"git.wntrmute.dev/kyle/mcr/internal/gc"
+	"git.wntrmute.dev/mc/mcr/internal/gc"
 )
 
 // GCLastRun records the result of the last GC run.

internal/server/admin_policy.go

@@ -9,9 +9,9 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 // PolicyReloader can reload policy rules from a store.

internal/server/admin_policy_test.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"testing"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
 )
 
 func TestAdminPolicyCRUDCycle(t *testing.T) {

internal/server/admin_repo.go

@@ -7,8 +7,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
 )
 
 // AdminListReposHandler handles GET /v1/repositories.

internal/server/admin_repo_test.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"testing"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
 )
 
 // seedRepoForAdmin inserts a repository with a manifest and tags into the test DB.

internal/server/admin_routes.go

@@ -3,7 +3,7 @@ package server
 import (
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
 )
 
 // AdminDeps holds the dependencies needed by admin routes.

internal/server/admin_test.go

@@ -10,9 +10,9 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/db"
+	"git.wntrmute.dev/mc/mcr/internal/db"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 func openAdminTestDB(t *testing.T) *db.DB {

internal/server/middleware.go

@@ -5,7 +5,7 @@ import (
 	"net/http"
 	"strings"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
 )
 
 // TokenValidator abstracts token validation so the middleware can work

internal/server/middleware_test.go

@@ -6,7 +6,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
 )
 
 type fakeValidator struct {

internal/server/policy.go

@@ -5,8 +5,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 // PolicyEvaluator abstracts the policy engine for testability.

internal/server/policy_test.go

@@ -8,8 +8,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
-	"git.wntrmute.dev/kyle/mcr/internal/policy"
+	"git.wntrmute.dev/mc/mcr/internal/policy"
 )
 
 type fakePolicyEvaluator struct {

internal/server/routes_test.go

@@ -6,7 +6,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
 )
 
 func TestRoutesV2Authenticated(t *testing.T) {

internal/server/token_test.go

@@ -6,7 +6,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"git.wntrmute.dev/kyle/mcr/internal/auth"
+	"git.wntrmute.dev/mc/mcr/internal/auth"
 )
 
 type fakeLoginClient struct {

internal/webserver/handlers.go

@@ -7,7 +7,7 @@ import (
 	"strconv"
 	"strings"
 
-	mcrv1 "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	mcrv1 "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
 
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"

internal/webserver/server.go

@@ -14,8 +14,8 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 
-	mcrv1 "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	mcrv1 "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
-	"git.wntrmute.dev/kyle/mcr/web"
+	"git.wntrmute.dev/mc/mcr/web"
 )
 
 // LoginFunc authenticates a user and returns a bearer token.

internal/webserver/server_test.go

@@ -15,7 +15,7 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/status"
 
-	mcrv1 "git.wntrmute.dev/kyle/mcr/gen/mcr/v1"
+	mcrv1 "git.wntrmute.dev/mc/mcr/gen/mcr/v1"
 )
 
 // fakeRegistryService implements RegistryServiceServer for testing.

internal/webserver/templates.go

@@ -8,7 +8,7 @@ import (
 	"strings"
 	"time"
 
-	"git.wntrmute.dev/kyle/mcr/web"
+	"git.wntrmute.dev/mc/mcr/web"
 )
 
 // templateSet wraps parsed templates and provides a render method.

proto/mcr/v1/admin.proto

@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package mcr.v1;
 
-option go_package = "git.wntrmute.dev/kyle/mcr/gen/mcr/v1;mcrv1";
+option go_package = "git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1";
 
 service AdminService {
   rpc Health(HealthRequest) returns (HealthResponse);

proto/mcr/v1/audit.proto

@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package mcr.v1;
 
-option go_package = "git.wntrmute.dev/kyle/mcr/gen/mcr/v1;mcrv1";
+option go_package = "git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1";
 
 import "mcr/v1/common.proto";
 

proto/mcr/v1/common.proto

@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package mcr.v1;
 
-option go_package = "git.wntrmute.dev/kyle/mcr/gen/mcr/v1;mcrv1";
+option go_package = "git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1";
 
 // Pagination controls for list RPCs.
 message PaginationRequest {

proto/mcr/v1/policy.proto

@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package mcr.v1;
 
-option go_package = "git.wntrmute.dev/kyle/mcr/gen/mcr/v1;mcrv1";
+option go_package = "git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1";
 
 import "mcr/v1/common.proto";
 

proto/mcr/v1/registry.proto

@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package mcr.v1;
 
-option go_package = "git.wntrmute.dev/kyle/mcr/gen/mcr/v1;mcrv1";
+option go_package = "git.wntrmute.dev/mc/mcr/gen/mcr/v1;mcrv1";
 
 import "mcr/v1/common.proto";
 
@@ -25,6 +25,7 @@ message RepositoryMetadata {
 message TagInfo {
   string name = 1;
   string digest = 2;
+  string updated_at = 3;
 }
 
 message ManifestInfo {

vendor/git.wntrmute.dev/mc/mcdsl/config/config.go

@@ -34,7 +34,7 @@ import (
 
 	"github.com/pelletier/go-toml/v2"
 
-	"git.wntrmute.dev/kyle/mcdsl/auth"
+	"git.wntrmute.dev/mc/mcdsl/auth"
 )
 
 // Base contains the configuration sections common to all Metacircular
@@ -144,6 +144,8 @@ func Load[T any](path string, envPrefix string) (*T, error) {
 		applyEnvToStruct(reflect.ValueOf(&cfg).Elem(), envPrefix)
 	}
 
+	applyPortEnv(&cfg)
+
 	applyBaseDefaults(&cfg)
 
 	if err := validateBase(&cfg); err != nil {
@@ -239,6 +241,70 @@ func findBase(cfg any) *Base {
 	return nil
 }
 
+// applyPortEnv overrides ServerConfig.ListenAddr and ServerConfig.GRPCAddr
+// from $PORT and $PORT_GRPC respectively. These environment variables are
+// set by the MCP agent to assign authoritative port bindings, so they take
+// precedence over both TOML values and generic env overrides.
+func applyPortEnv(cfg any) {
+	sc := findServerConfig(cfg)
+	if sc == nil {
+		return
+	}
+
+	if port, ok := os.LookupEnv("PORT"); ok {
+		sc.ListenAddr = ":" + port
+	}
+	if port, ok := os.LookupEnv("PORT_GRPC"); ok {
+		sc.GRPCAddr = ":" + port
+	}
+}
+
+// findServerConfig returns a pointer to the ServerConfig in the config
+// struct. It first checks for an embedded Base (which contains Server),
+// then walks the struct tree via reflection to find any ServerConfig field
+// directly (e.g., the Metacrypt pattern where ServerConfig is embedded
+// without Base).
+func findServerConfig(cfg any) *ServerConfig {
+	if base := findBase(cfg); base != nil {
+		return &base.Server
+	}
+
+	return findServerConfigReflect(reflect.ValueOf(cfg))
+}
+
+// findServerConfigReflect walks the struct tree to find a ServerConfig field.
+func findServerConfigReflect(v reflect.Value) *ServerConfig {
+	if v.Kind() == reflect.Ptr {
+		v = v.Elem()
+	}
+	if v.Kind() != reflect.Struct {
+		return nil
+	}
+
+	scType := reflect.TypeOf(ServerConfig{})
+	t := v.Type()
+	for i := range t.NumField() {
+		field := t.Field(i)
+		fv := v.Field(i)
+
+		if field.Type == scType {
+			sc, ok := fv.Addr().Interface().(*ServerConfig)
+			if ok {
+				return sc
+			}
+		}
+
+		// Recurse into embedded or nested structs.
+		if fv.Kind() == reflect.Struct && field.Type != scType {
+			if sc := findServerConfigReflect(fv); sc != nil {
+				return sc
+			}
+		}
+	}
+
+	return nil
+}
+
 // applyEnvToStruct recursively walks a struct and overrides field values
 // from environment variables. The env variable name is built from the
 // prefix and the toml tag: PREFIX_SECTION_FIELD (uppercased).

vendor/git.wntrmute.dev/mc/mcdsl/grpcserver/server.go

@@ -21,7 +21,7 @@ import (
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
 
-	"git.wntrmute.dev/kyle/mcdsl/auth"
+	"git.wntrmute.dev/mc/mcdsl/auth"
 )
 
 // MethodMap classifies gRPC methods for access control.
@@ -48,21 +48,45 @@ type Server struct {
 	listener net.Listener
 }
 
+// Options configures optional behavior for the gRPC server.
+type Options struct {
+	// PreInterceptors run before the logging and auth interceptors.
+	// Use for lifecycle gates like seal checks that should reject
+	// requests before any auth validation occurs.
+	PreInterceptors []grpc.UnaryServerInterceptor
+
+	// PostInterceptors run after auth but before the handler.
+	// Use for audit logging, rate limiting, or other cross-cutting
+	// concerns that need access to the authenticated identity.
+	PostInterceptors []grpc.UnaryServerInterceptor
+}
+
 // New creates a gRPC server with TLS (if certFile and keyFile are
-// non-empty) and an interceptor chain: logging → auth → handler.
+// non-empty) and an interceptor chain:
+//
+//	[pre-interceptors] → logging → auth → [post-interceptors] → handler
 //
 // The auth interceptor uses methods to determine the access level for
 // each RPC. Methods not in any map are denied by default.
 //
 // If certFile and keyFile are empty, TLS is skipped (for testing).
-func New(certFile, keyFile string, authenticator *auth.Authenticator, methods MethodMap, logger *slog.Logger) (*Server, error) {
+// opts is optional; pass nil for the default chain (logging + auth only).
-	chain := grpc.ChainUnaryInterceptor(
+func New(certFile, keyFile string, authenticator *auth.Authenticator, methods MethodMap, logger *slog.Logger, opts *Options) (*Server, error) {
+	var interceptors []grpc.UnaryServerInterceptor
+	if opts != nil {
+		interceptors = append(interceptors, opts.PreInterceptors...)
+	}
+	interceptors = append(interceptors,
 		loggingInterceptor(logger),
 		authInterceptor(authenticator, methods),
 	)
+	if opts != nil {
+		interceptors = append(interceptors, opts.PostInterceptors...)
+	}
+	chain := grpc.ChainUnaryInterceptor(interceptors...)
 
-	var opts []grpc.ServerOption
+	var serverOpts []grpc.ServerOption
-	opts = append(opts, chain)
+	serverOpts = append(serverOpts, chain)
 
 	if certFile != "" && keyFile != "" {
 		cert, err := tls.LoadX509KeyPair(certFile, keyFile)
@@ -73,11 +97,11 @@ func New(certFile, keyFile string, authenticator *auth.Authenticator, methods Me
 			Certificates: []tls.Certificate{cert},
 			MinVersion:   tls.VersionTLS13,
 		}
-		opts = append(opts, grpc.Creds(credentials.NewTLS(tlsCfg)))
+		serverOpts = append(serverOpts, grpc.Creds(credentials.NewTLS(tlsCfg)))
 	}
 
 	return &Server{
-		GRPCServer: grpc.NewServer(opts...),
+		GRPCServer: grpc.NewServer(serverOpts...),
 		Logger:     logger,
 	}, nil
 }

vendor/modules.txt

@@ -1,9 +1,9 @@
-# git.wntrmute.dev/kyle/mcdsl v1.0.0
+# git.wntrmute.dev/mc/mcdsl v1.2.0
 ## explicit; go 1.25.7
-git.wntrmute.dev/kyle/mcdsl/auth
+git.wntrmute.dev/mc/mcdsl/auth
-git.wntrmute.dev/kyle/mcdsl/config
+git.wntrmute.dev/mc/mcdsl/config
-git.wntrmute.dev/kyle/mcdsl/db
+git.wntrmute.dev/mc/mcdsl/db
-git.wntrmute.dev/kyle/mcdsl/grpcserver
+git.wntrmute.dev/mc/mcdsl/grpcserver
 # github.com/dustin/go-humanize v1.0.1
 ## explicit; go 1.16
 github.com/dustin/go-humanize