feat(proto): consume canonical block/proto as a submodule

Remove core's local proto/ fork and pull the canonical block/proto repo in
as a submodule at the same path. buf.yaml now sources from the submodule's
orchestrator/v1 namespace; everything outside that (blockninja, helpdesk)
is excluded from generation.

This brings the orchestrator's local-only RPCs (PluginScopeService.ListMyPlugins,
PluginRegistryService.SubmitForReview, the full PluginModerationService) into
core's bindings — harmless surface area for the CLI, prerequisite for the
orchestrator to also stop forking the proto.

Side effect: the CLI's account picker now uses the canonical
AccountService.ListMyAccounts in accounts.proto rather than the duplicate
PluginAuthService.ListMyAccounts that lived only in core's fork. The
existing Account message uses Name (no DisplayName / Role), so the picker
output collapses to "slug — Name".

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "proto"]
+	path = proto
+	url = git@git.dev.alexdunmow.com:block/proto.git

buf.yaml

@@ -1,6 +1,14 @@
 version: v2
+# proto/ is a git submodule pointing at block/proto (the canonical shared
+# proto repo). The CLI in this module consumes the orchestrator v1 API
+# surface; everything else under the submodule (blockninja, helpdesk) is
+# excluded from generation. Within orchestrator/v1 only plugin_registry and
+# accounts are wired through the CLI today, but generating the rest is cheap
+# and lets us add new callers without retouching this config.
 modules:
   - path: proto
+    includes:
+      - proto/orchestrator/v1
 lint:
   use:
     - STANDARD

cmd/ninja/cmd/account.go

@@ -37,7 +37,7 @@ func newAccountListCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
-			accts, err := cli.Auth.ListMyAccounts(context.Background(),
+			accts, err := cli.Account.ListMyAccounts(context.Background(),
 				connect.NewRequest(&v1.ListMyAccountsRequest{}))
 			if err != nil {
 				return fmt.Errorf("list accounts: %w", err)
@@ -51,7 +51,7 @@ func newAccountListCmd() *cobra.Command {
 				if a.Id == hc.ActiveAccountID {
 					marker = "* "
 				}
-				fmt.Printf("%s%s — %s (%s)\n", marker, a.Slug, a.DisplayName, a.Role)
+				fmt.Printf("%s%s — %s\n", marker, a.Slug, a.Name)
 			}
 			return nil
 		},
@@ -69,7 +69,7 @@ func newAccountSetCmd() *cobra.Command {
 				return err
 			}
 			slug := strings.TrimPrefix(args[0], "@")
-			accts, err := cli.Auth.ListMyAccounts(context.Background(),
+			accts, err := cli.Account.ListMyAccounts(context.Background(),
 				connect.NewRequest(&v1.ListMyAccountsRequest{}))
 			if err != nil {
 				return fmt.Errorf("list accounts: %w", err)
@@ -82,7 +82,7 @@ func newAccountSetCmd() *cobra.Command {
 					if err := cr.Save(); err != nil {
 						return err
 					}
-					fmt.Printf("Active account: %s (%s)\n", a.Slug, a.DisplayName)
+					fmt.Printf("Active account: %s (%s)\n", a.Slug, a.Name)
 					return nil
 				}
 			}
@@ -135,7 +135,7 @@ func pickAccountInteractive(scanner *bufio.Scanner, accounts []*v1.Account) (*v1
 	}
 	fmt.Println("Select an account:")
 	for i, a := range accounts {
-		fmt.Printf("  %d) %s — %s (%s)\n", i+1, a.Slug, a.DisplayName, a.Role)
+		fmt.Printf("  %d) %s — %s\n", i+1, a.Slug, a.Name)
 	}
 	fmt.Print("> ")
 	if !scanner.Scan() {

cmd/ninja/cmd/login.go

@@ -108,7 +108,7 @@ func newWhoamiCmd() *cobra.Command {
 // user has at least one). With 1 it auto-selects silently. With ≥2 it
 // prompts interactively on stdin.
 func selectActiveAccount(ctx context.Context, cli *orchclient.Client, hc *creds.HostCreds) error {
-	resp, err := cli.Auth.ListMyAccounts(ctx, connect.NewRequest(&v1.ListMyAccountsRequest{}))
+	resp, err := cli.Account.ListMyAccounts(ctx, connect.NewRequest(&v1.ListMyAccountsRequest{}))
 	if err != nil {
 		return fmt.Errorf("list accounts: %w", err)
 	}
@@ -119,7 +119,7 @@ func selectActiveAccount(ctx context.Context, cli *orchclient.Client, hc *creds.
 	case 1:
 		hc.ActiveAccountID = accts[0].Id
 		hc.ActiveAccountSlug = accts[0].Slug
-		fmt.Printf("Active account: %s (%s)\n", accts[0].Slug, accts[0].DisplayName)
+		fmt.Printf("Active account: %s (%s)\n", accts[0].Slug, accts[0].Name)
 		return nil
 	}
 	chosen, err := pickAccountInteractive(bufio.NewScanner(os.Stdin), accts)
@@ -128,7 +128,7 @@ func selectActiveAccount(ctx context.Context, cli *orchclient.Client, hc *creds.
 	}
 	hc.ActiveAccountID = chosen.Id
 	hc.ActiveAccountSlug = chosen.Slug
-	fmt.Printf("Active account: %s (%s)\n", chosen.Slug, chosen.DisplayName)
+	fmt.Printf("Active account: %s (%s)\n", chosen.Slug, chosen.Name)
 	return nil
 }
 

cmd/ninja/internal/orchclient/client.go

@@ -9,12 +9,13 @@ import (
 )
 
 type Client struct {
-	Host  string
-	Token string
-	Auth  orchestratorv1connect.PluginAuthServiceClient
-	Scope orchestratorv1connect.PluginScopeServiceClient
-	Reg   orchestratorv1connect.PluginRegistryServiceClient
-	Pub   orchestratorv1connect.PluginPublishServiceClient
+	Host    string
+	Token   string
+	Auth    orchestratorv1connect.PluginAuthServiceClient
+	Scope   orchestratorv1connect.PluginScopeServiceClient
+	Reg     orchestratorv1connect.PluginRegistryServiceClient
+	Pub     orchestratorv1connect.PluginPublishServiceClient
+	Account orchestratorv1connect.AccountServiceClient
 }
 
 func New(host, token string) *Client {
@@ -27,6 +28,7 @@ func New(host, token string) *Client {
 	c.Scope = orchestratorv1connect.NewPluginScopeServiceClient(httpClient, host, opts...)
 	c.Reg = orchestratorv1connect.NewPluginRegistryServiceClient(httpClient, host, opts...)
 	c.Pub = orchestratorv1connect.NewPluginPublishServiceClient(httpClient, host, opts...)
+	c.Account = orchestratorv1connect.NewAccountServiceClient(httpClient, host, opts...)
 	return c
 }
 

internal/api/orchestrator/v1/email.pb.go

@@ -0,0 +1,448 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: orchestrator/v1/email.proto
+
+package orchestratorv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type QueueEmailRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	InstanceId    string                 `protobuf:"bytes,1,opt,name=instance_id,json=instanceId,proto3" json:"instance_id,omitempty"`
+	ToEmail       string                 `protobuf:"bytes,2,opt,name=to_email,json=toEmail,proto3" json:"to_email,omitempty"`
+	Subject       string                 `protobuf:"bytes,3,opt,name=subject,proto3" json:"subject,omitempty"`
+	HtmlBody      string                 `protobuf:"bytes,4,opt,name=html_body,json=htmlBody,proto3" json:"html_body,omitempty"`
+	TextBody      string                 `protobuf:"bytes,5,opt,name=text_body,json=textBody,proto3" json:"text_body,omitempty"`
+	Tag           string                 `protobuf:"bytes,6,opt,name=tag,proto3" json:"tag,omitempty"`                                          // Email category tag (e.g., "notification", "welcome")
+	RecipientType string                 `protobuf:"bytes,7,opt,name=recipient_type,json=recipientType,proto3" json:"recipient_type,omitempty"` // 'admin', 'domain', 'invitation', 'general'
+	FromEmail     string                 `protobuf:"bytes,8,opt,name=from_email,json=fromEmail,proto3" json:"from_email,omitempty"`             // Optional: override from address
+	FromName      string                 `protobuf:"bytes,9,opt,name=from_name,json=fromName,proto3" json:"from_name,omitempty"`                // Optional: override from name
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *QueueEmailRequest) Reset() {
+	*x = QueueEmailRequest{}
+	mi := &file_orchestrator_v1_email_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *QueueEmailRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*QueueEmailRequest) ProtoMessage() {}
+
+func (x *QueueEmailRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_email_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use QueueEmailRequest.ProtoReflect.Descriptor instead.
+func (*QueueEmailRequest) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_email_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *QueueEmailRequest) GetInstanceId() string {
+	if x != nil {
+		return x.InstanceId
+	}
+	return ""
+}
+
+func (x *QueueEmailRequest) GetToEmail() string {
+	if x != nil {
+		return x.ToEmail
+	}
+	return ""
+}
+
+func (x *QueueEmailRequest) GetSubject() string {
+	if x != nil {
+		return x.Subject
+	}
+	return ""
+}
+
+func (x *QueueEmailRequest) GetHtmlBody() string {
+	if x != nil {
+		return x.HtmlBody
+	}
+	return ""
+}
+
+func (x *QueueEmailRequest) GetTextBody() string {
+	if x != nil {
+		return x.TextBody
+	}
+	return ""
+}
+
+func (x *QueueEmailRequest) GetTag() string {
+	if x != nil {
+		return x.Tag
+	}
+	return ""
+}
+
+func (x *QueueEmailRequest) GetRecipientType() string {
+	if x != nil {
+		return x.RecipientType
+	}
+	return ""
+}
+
+func (x *QueueEmailRequest) GetFromEmail() string {
+	if x != nil {
+		return x.FromEmail
+	}
+	return ""
+}
+
+func (x *QueueEmailRequest) GetFromName() string {
+	if x != nil {
+		return x.FromName
+	}
+	return ""
+}
+
+type QueueEmailResponse struct {
+	state          protoimpl.MessageState `protogen:"open.v1"`
+	Success        bool                   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
+	EmailId        string                 `protobuf:"bytes,2,opt,name=email_id,json=emailId,proto3" json:"email_id,omitempty"`                       // ID of queued email
+	RemainingQuota int32                  `protobuf:"varint,3,opt,name=remaining_quota,json=remainingQuota,proto3" json:"remaining_quota,omitempty"` // Emails remaining this month
+	Error          string                 `protobuf:"bytes,4,opt,name=error,proto3" json:"error,omitempty"`                                          // Error message if failed
+	ErrorCode      string                 `protobuf:"bytes,5,opt,name=error_code,json=errorCode,proto3" json:"error_code,omitempty"`                 // 'quota_exceeded', 'recipient_restricted', etc.
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *QueueEmailResponse) Reset() {
+	*x = QueueEmailResponse{}
+	mi := &file_orchestrator_v1_email_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *QueueEmailResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*QueueEmailResponse) ProtoMessage() {}
+
+func (x *QueueEmailResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_email_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use QueueEmailResponse.ProtoReflect.Descriptor instead.
+func (*QueueEmailResponse) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_email_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *QueueEmailResponse) GetSuccess() bool {
+	if x != nil {
+		return x.Success
+	}
+	return false
+}
+
+func (x *QueueEmailResponse) GetEmailId() string {
+	if x != nil {
+		return x.EmailId
+	}
+	return ""
+}
+
+func (x *QueueEmailResponse) GetRemainingQuota() int32 {
+	if x != nil {
+		return x.RemainingQuota
+	}
+	return 0
+}
+
+func (x *QueueEmailResponse) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
+func (x *QueueEmailResponse) GetErrorCode() string {
+	if x != nil {
+		return x.ErrorCode
+	}
+	return ""
+}
+
+type GetEmailLimitsRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	InstanceId    string                 `protobuf:"bytes,1,opt,name=instance_id,json=instanceId,proto3" json:"instance_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetEmailLimitsRequest) Reset() {
+	*x = GetEmailLimitsRequest{}
+	mi := &file_orchestrator_v1_email_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetEmailLimitsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetEmailLimitsRequest) ProtoMessage() {}
+
+func (x *GetEmailLimitsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_email_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetEmailLimitsRequest.ProtoReflect.Descriptor instead.
+func (*GetEmailLimitsRequest) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_email_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *GetEmailLimitsRequest) GetInstanceId() string {
+	if x != nil {
+		return x.InstanceId
+	}
+	return ""
+}
+
+type GetEmailLimitsResponse struct {
+	state                    protoimpl.MessageState `protogen:"open.v1"`
+	MaxEmailsPerMonth        int32                  `protobuf:"varint,1,opt,name=max_emails_per_month,json=maxEmailsPerMonth,proto3" json:"max_emails_per_month,omitempty"`
+	EmailsSentThisMonth      int32                  `protobuf:"varint,2,opt,name=emails_sent_this_month,json=emailsSentThisMonth,proto3" json:"emails_sent_this_month,omitempty"`
+	EmailsRemaining          int32                  `protobuf:"varint,3,opt,name=emails_remaining,json=emailsRemaining,proto3" json:"emails_remaining,omitempty"`
+	IsOverLimit              bool                   `protobuf:"varint,4,opt,name=is_over_limit,json=isOverLimit,proto3" json:"is_over_limit,omitempty"`
+	EnforcementMode          string                 `protobuf:"bytes,5,opt,name=enforcement_mode,json=enforcementMode,proto3" json:"enforcement_mode,omitempty"`                               // 'hard' (block) or 'soft' (allow with overage)
+	OverageRateCents         int32                  `protobuf:"varint,6,opt,name=overage_rate_cents,json=overageRateCents,proto3" json:"overage_rate_cents,omitempty"`                         // Per 100 emails
+	HasRecipientRestrictions bool                   `protobuf:"varint,7,opt,name=has_recipient_restrictions,json=hasRecipientRestrictions,proto3" json:"has_recipient_restrictions,omitempty"` // True for free tier (admin+domain only)
+	BlockedCount             int32                  `protobuf:"varint,8,opt,name=blocked_count,json=blockedCount,proto3" json:"blocked_count,omitempty"`                                       // Emails blocked this month
+	unknownFields            protoimpl.UnknownFields
+	sizeCache                protoimpl.SizeCache
+}
+
+func (x *GetEmailLimitsResponse) Reset() {
+	*x = GetEmailLimitsResponse{}
+	mi := &file_orchestrator_v1_email_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetEmailLimitsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetEmailLimitsResponse) ProtoMessage() {}
+
+func (x *GetEmailLimitsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_email_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetEmailLimitsResponse.ProtoReflect.Descriptor instead.
+func (*GetEmailLimitsResponse) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_email_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *GetEmailLimitsResponse) GetMaxEmailsPerMonth() int32 {
+	if x != nil {
+		return x.MaxEmailsPerMonth
+	}
+	return 0
+}
+
+func (x *GetEmailLimitsResponse) GetEmailsSentThisMonth() int32 {
+	if x != nil {
+		return x.EmailsSentThisMonth
+	}
+	return 0
+}
+
+func (x *GetEmailLimitsResponse) GetEmailsRemaining() int32 {
+	if x != nil {
+		return x.EmailsRemaining
+	}
+	return 0
+}
+
+func (x *GetEmailLimitsResponse) GetIsOverLimit() bool {
+	if x != nil {
+		return x.IsOverLimit
+	}
+	return false
+}
+
+func (x *GetEmailLimitsResponse) GetEnforcementMode() string {
+	if x != nil {
+		return x.EnforcementMode
+	}
+	return ""
+}
+
+func (x *GetEmailLimitsResponse) GetOverageRateCents() int32 {
+	if x != nil {
+		return x.OverageRateCents
+	}
+	return 0
+}
+
+func (x *GetEmailLimitsResponse) GetHasRecipientRestrictions() bool {
+	if x != nil {
+		return x.HasRecipientRestrictions
+	}
+	return false
+}
+
+func (x *GetEmailLimitsResponse) GetBlockedCount() int32 {
+	if x != nil {
+		return x.BlockedCount
+	}
+	return 0
+}
+
+var File_orchestrator_v1_email_proto protoreflect.FileDescriptor
+
+const file_orchestrator_v1_email_proto_rawDesc = "" +
+	"\n" +
+	"\x1borchestrator/v1/email.proto\x12\x0forchestrator.v1\"\x98\x02\n" +
+	"\x11QueueEmailRequest\x12\x1f\n" +
+	"\vinstance_id\x18\x01 \x01(\tR\n" +
+	"instanceId\x12\x19\n" +
+	"\bto_email\x18\x02 \x01(\tR\atoEmail\x12\x18\n" +
+	"\asubject\x18\x03 \x01(\tR\asubject\x12\x1b\n" +
+	"\thtml_body\x18\x04 \x01(\tR\bhtmlBody\x12\x1b\n" +
+	"\ttext_body\x18\x05 \x01(\tR\btextBody\x12\x10\n" +
+	"\x03tag\x18\x06 \x01(\tR\x03tag\x12%\n" +
+	"\x0erecipient_type\x18\a \x01(\tR\rrecipientType\x12\x1d\n" +
+	"\n" +
+	"from_email\x18\b \x01(\tR\tfromEmail\x12\x1b\n" +
+	"\tfrom_name\x18\t \x01(\tR\bfromName\"\xa7\x01\n" +
+	"\x12QueueEmailResponse\x12\x18\n" +
+	"\asuccess\x18\x01 \x01(\bR\asuccess\x12\x19\n" +
+	"\bemail_id\x18\x02 \x01(\tR\aemailId\x12'\n" +
+	"\x0fremaining_quota\x18\x03 \x01(\x05R\x0eremainingQuota\x12\x14\n" +
+	"\x05error\x18\x04 \x01(\tR\x05error\x12\x1d\n" +
+	"\n" +
+	"error_code\x18\x05 \x01(\tR\terrorCode\"8\n" +
+	"\x15GetEmailLimitsRequest\x12\x1f\n" +
+	"\vinstance_id\x18\x01 \x01(\tR\n" +
+	"instanceId\"\x89\x03\n" +
+	"\x16GetEmailLimitsResponse\x12/\n" +
+	"\x14max_emails_per_month\x18\x01 \x01(\x05R\x11maxEmailsPerMonth\x123\n" +
+	"\x16emails_sent_this_month\x18\x02 \x01(\x05R\x13emailsSentThisMonth\x12)\n" +
+	"\x10emails_remaining\x18\x03 \x01(\x05R\x0femailsRemaining\x12\"\n" +
+	"\ris_over_limit\x18\x04 \x01(\bR\visOverLimit\x12)\n" +
+	"\x10enforcement_mode\x18\x05 \x01(\tR\x0fenforcementMode\x12,\n" +
+	"\x12overage_rate_cents\x18\x06 \x01(\x05R\x10overageRateCents\x12<\n" +
+	"\x1ahas_recipient_restrictions\x18\a \x01(\bR\x18hasRecipientRestrictions\x12#\n" +
+	"\rblocked_count\x18\b \x01(\x05R\fblockedCount2\xc8\x01\n" +
+	"\fEmailService\x12U\n" +
+	"\n" +
+	"QueueEmail\x12\".orchestrator.v1.QueueEmailRequest\x1a#.orchestrator.v1.QueueEmailResponse\x12a\n" +
+	"\x0eGetEmailLimits\x12&.orchestrator.v1.GetEmailLimitsRequest\x1a'.orchestrator.v1.GetEmailLimitsResponseB\xcd\x01\n" +
+	"\x13com.orchestrator.v1B\n" +
+	"EmailProtoP\x01ZMgit.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1;orchestratorv1\xa2\x02\x03OXX\xaa\x02\x0fOrchestrator.V1\xca\x02\x0fOrchestrator\\V1\xe2\x02\x1bOrchestrator\\V1\\GPBMetadata\xea\x02\x10Orchestrator::V1b\x06proto3"
+
+var (
+	file_orchestrator_v1_email_proto_rawDescOnce sync.Once
+	file_orchestrator_v1_email_proto_rawDescData []byte
+)
+
+func file_orchestrator_v1_email_proto_rawDescGZIP() []byte {
+	file_orchestrator_v1_email_proto_rawDescOnce.Do(func() {
+		file_orchestrator_v1_email_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_orchestrator_v1_email_proto_rawDesc), len(file_orchestrator_v1_email_proto_rawDesc)))
+	})
+	return file_orchestrator_v1_email_proto_rawDescData
+}
+
+var file_orchestrator_v1_email_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_orchestrator_v1_email_proto_goTypes = []any{
+	(*QueueEmailRequest)(nil),      // 0: orchestrator.v1.QueueEmailRequest
+	(*QueueEmailResponse)(nil),     // 1: orchestrator.v1.QueueEmailResponse
+	(*GetEmailLimitsRequest)(nil),  // 2: orchestrator.v1.GetEmailLimitsRequest
+	(*GetEmailLimitsResponse)(nil), // 3: orchestrator.v1.GetEmailLimitsResponse
+}
+var file_orchestrator_v1_email_proto_depIdxs = []int32{
+	0, // 0: orchestrator.v1.EmailService.QueueEmail:input_type -> orchestrator.v1.QueueEmailRequest
+	2, // 1: orchestrator.v1.EmailService.GetEmailLimits:input_type -> orchestrator.v1.GetEmailLimitsRequest
+	1, // 2: orchestrator.v1.EmailService.QueueEmail:output_type -> orchestrator.v1.QueueEmailResponse
+	3, // 3: orchestrator.v1.EmailService.GetEmailLimits:output_type -> orchestrator.v1.GetEmailLimitsResponse
+	2, // [2:4] is the sub-list for method output_type
+	0, // [0:2] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_orchestrator_v1_email_proto_init() }
+func file_orchestrator_v1_email_proto_init() {
+	if File_orchestrator_v1_email_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_orchestrator_v1_email_proto_rawDesc), len(file_orchestrator_v1_email_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_orchestrator_v1_email_proto_goTypes,
+		DependencyIndexes: file_orchestrator_v1_email_proto_depIdxs,
+		MessageInfos:      file_orchestrator_v1_email_proto_msgTypes,
+	}.Build()
+	File_orchestrator_v1_email_proto = out.File
+	file_orchestrator_v1_email_proto_goTypes = nil
+	file_orchestrator_v1_email_proto_depIdxs = nil
+}

internal/api/orchestrator/v1/orchestratorv1connect/accounts.connect.go

@@ -0,0 +1,708 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: orchestrator/v1/accounts.proto
+
+package orchestratorv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "git.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// AccountServiceName is the fully-qualified name of the AccountService service.
+	AccountServiceName = "orchestrator.v1.AccountService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// AccountServiceCreateAccountProcedure is the fully-qualified name of the AccountService's
+	// CreateAccount RPC.
+	AccountServiceCreateAccountProcedure = "/orchestrator.v1.AccountService/CreateAccount"
+	// AccountServiceGetAccountProcedure is the fully-qualified name of the AccountService's GetAccount
+	// RPC.
+	AccountServiceGetAccountProcedure = "/orchestrator.v1.AccountService/GetAccount"
+	// AccountServiceListAccountsProcedure is the fully-qualified name of the AccountService's
+	// ListAccounts RPC.
+	AccountServiceListAccountsProcedure = "/orchestrator.v1.AccountService/ListAccounts"
+	// AccountServiceListMyAccountsProcedure is the fully-qualified name of the AccountService's
+	// ListMyAccounts RPC.
+	AccountServiceListMyAccountsProcedure = "/orchestrator.v1.AccountService/ListMyAccounts"
+	// AccountServiceUpdateAccountProcedure is the fully-qualified name of the AccountService's
+	// UpdateAccount RPC.
+	AccountServiceUpdateAccountProcedure = "/orchestrator.v1.AccountService/UpdateAccount"
+	// AccountServiceDeleteAccountProcedure is the fully-qualified name of the AccountService's
+	// DeleteAccount RPC.
+	AccountServiceDeleteAccountProcedure = "/orchestrator.v1.AccountService/DeleteAccount"
+	// AccountServiceCancelAccountDeletionProcedure is the fully-qualified name of the AccountService's
+	// CancelAccountDeletion RPC.
+	AccountServiceCancelAccountDeletionProcedure = "/orchestrator.v1.AccountService/CancelAccountDeletion"
+	// AccountServiceSuspendAccountProcedure is the fully-qualified name of the AccountService's
+	// SuspendAccount RPC.
+	AccountServiceSuspendAccountProcedure = "/orchestrator.v1.AccountService/SuspendAccount"
+	// AccountServiceReactivateAccountProcedure is the fully-qualified name of the AccountService's
+	// ReactivateAccount RPC.
+	AccountServiceReactivateAccountProcedure = "/orchestrator.v1.AccountService/ReactivateAccount"
+	// AccountServiceInviteAccountUserProcedure is the fully-qualified name of the AccountService's
+	// InviteAccountUser RPC.
+	AccountServiceInviteAccountUserProcedure = "/orchestrator.v1.AccountService/InviteAccountUser"
+	// AccountServiceListAccountUsersProcedure is the fully-qualified name of the AccountService's
+	// ListAccountUsers RPC.
+	AccountServiceListAccountUsersProcedure = "/orchestrator.v1.AccountService/ListAccountUsers"
+	// AccountServiceUpdateAccountUserRoleProcedure is the fully-qualified name of the AccountService's
+	// UpdateAccountUserRole RPC.
+	AccountServiceUpdateAccountUserRoleProcedure = "/orchestrator.v1.AccountService/UpdateAccountUserRole"
+	// AccountServiceRemoveAccountUserProcedure is the fully-qualified name of the AccountService's
+	// RemoveAccountUser RPC.
+	AccountServiceRemoveAccountUserProcedure = "/orchestrator.v1.AccountService/RemoveAccountUser"
+	// AccountServiceAcceptAccountInvitationProcedure is the fully-qualified name of the
+	// AccountService's AcceptAccountInvitation RPC.
+	AccountServiceAcceptAccountInvitationProcedure = "/orchestrator.v1.AccountService/AcceptAccountInvitation"
+	// AccountServiceGetAccountDashboardProcedure is the fully-qualified name of the AccountService's
+	// GetAccountDashboard RPC.
+	AccountServiceGetAccountDashboardProcedure = "/orchestrator.v1.AccountService/GetAccountDashboard"
+	// AccountServiceBulkSuspendAccountsProcedure is the fully-qualified name of the AccountService's
+	// BulkSuspendAccounts RPC.
+	AccountServiceBulkSuspendAccountsProcedure = "/orchestrator.v1.AccountService/BulkSuspendAccounts"
+	// AccountServiceBulkReactivateAccountsProcedure is the fully-qualified name of the AccountService's
+	// BulkReactivateAccounts RPC.
+	AccountServiceBulkReactivateAccountsProcedure = "/orchestrator.v1.AccountService/BulkReactivateAccounts"
+	// AccountServiceGetAccountVaultHealthProcedure is the fully-qualified name of the AccountService's
+	// GetAccountVaultHealth RPC.
+	AccountServiceGetAccountVaultHealthProcedure = "/orchestrator.v1.AccountService/GetAccountVaultHealth"
+	// AccountServiceResetAccountVaultKeyProcedure is the fully-qualified name of the AccountService's
+	// ResetAccountVaultKey RPC.
+	AccountServiceResetAccountVaultKeyProcedure = "/orchestrator.v1.AccountService/ResetAccountVaultKey"
+	// AccountServiceRepairAccountVaultProcedure is the fully-qualified name of the AccountService's
+	// RepairAccountVault RPC.
+	AccountServiceRepairAccountVaultProcedure = "/orchestrator.v1.AccountService/RepairAccountVault"
+)
+
+// AccountServiceClient is a client for the orchestrator.v1.AccountService service.
+type AccountServiceClient interface {
+	// Create a new account
+	CreateAccount(context.Context, *connect.Request[v1.CreateAccountRequest]) (*connect.Response[v1.CreateAccountResponse], error)
+	// Get an account by ID
+	GetAccount(context.Context, *connect.Request[v1.GetAccountRequest]) (*connect.Response[v1.GetAccountResponse], error)
+	// List accounts (admin only)
+	ListAccounts(context.Context, *connect.Request[v1.ListAccountsRequest]) (*connect.Response[v1.ListAccountsResponse], error)
+	// List accounts for current user
+	ListMyAccounts(context.Context, *connect.Request[v1.ListMyAccountsRequest]) (*connect.Response[v1.ListMyAccountsResponse], error)
+	// Update an account
+	UpdateAccount(context.Context, *connect.Request[v1.UpdateAccountRequest]) (*connect.Response[v1.UpdateAccountResponse], error)
+	// Delete an account (initiates 48-hour pending deletion period)
+	DeleteAccount(context.Context, *connect.Request[v1.DeleteAccountRequest]) (*connect.Response[v1.DeleteAccountResponse], error)
+	// Cancel a pending account deletion
+	CancelAccountDeletion(context.Context, *connect.Request[v1.CancelAccountDeletionRequest]) (*connect.Response[v1.CancelAccountDeletionResponse], error)
+	// Suspend an account
+	SuspendAccount(context.Context, *connect.Request[v1.SuspendAccountRequest]) (*connect.Response[v1.SuspendAccountResponse], error)
+	// Reactivate a suspended account
+	ReactivateAccount(context.Context, *connect.Request[v1.ReactivateAccountRequest]) (*connect.Response[v1.ReactivateAccountResponse], error)
+	// Team member management
+	// Invite a user to an account
+	InviteAccountUser(context.Context, *connect.Request[v1.InviteAccountUserRequest]) (*connect.Response[v1.InviteAccountUserResponse], error)
+	// List account team members
+	ListAccountUsers(context.Context, *connect.Request[v1.ListAccountUsersRequest]) (*connect.Response[v1.ListAccountUsersResponse], error)
+	// Update a team member's role
+	UpdateAccountUserRole(context.Context, *connect.Request[v1.UpdateAccountUserRoleRequest]) (*connect.Response[v1.UpdateAccountUserRoleResponse], error)
+	// Remove a team member
+	RemoveAccountUser(context.Context, *connect.Request[v1.RemoveAccountUserRequest]) (*connect.Response[v1.RemoveAccountUserResponse], error)
+	// Accept an account invitation
+	AcceptAccountInvitation(context.Context, *connect.Request[v1.AcceptAccountInvitationRequest]) (*connect.Response[v1.AcceptAccountInvitationResponse], error)
+	// Dashboard
+	// Get account dashboard with aggregated metrics
+	GetAccountDashboard(context.Context, *connect.Request[v1.GetAccountDashboardRequest]) (*connect.Response[v1.GetAccountDashboardResponse], error)
+	// Bulk operations
+	// Suspend multiple accounts
+	BulkSuspendAccounts(context.Context, *connect.Request[v1.BulkSuspendAccountsRequest]) (*connect.Response[v1.BulkSuspendAccountsResponse], error)
+	// Reactivate multiple accounts
+	BulkReactivateAccounts(context.Context, *connect.Request[v1.BulkReactivateAccountsRequest]) (*connect.Response[v1.BulkReactivateAccountsResponse], error)
+	// Vault management (superadmin only)
+	// Get vault health status for an account and all its instances
+	GetAccountVaultHealth(context.Context, *connect.Request[v1.GetAccountVaultHealthRequest]) (*connect.Response[v1.GetAccountVaultHealthResponse], error)
+	// Reset the vault AppRole secret_id and recreate all running instances with new credentials
+	ResetAccountVaultKey(context.Context, *connect.Request[v1.ResetAccountVaultKeyRequest]) (*connect.Response[v1.ResetAccountVaultKeyResponse], error)
+	// Repair vault infrastructure: ensure paths, secrets, AppRoles, and policies exist
+	RepairAccountVault(context.Context, *connect.Request[v1.RepairAccountVaultRequest]) (*connect.Response[v1.RepairAccountVaultResponse], error)
+}
+
+// NewAccountServiceClient constructs a client for the orchestrator.v1.AccountService service. By
+// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
+// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewAccountServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) AccountServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	accountServiceMethods := v1.File_orchestrator_v1_accounts_proto.Services().ByName("AccountService").Methods()
+	return &accountServiceClient{
+		createAccount: connect.NewClient[v1.CreateAccountRequest, v1.CreateAccountResponse](
+			httpClient,
+			baseURL+AccountServiceCreateAccountProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("CreateAccount")),
+			connect.WithClientOptions(opts...),
+		),
+		getAccount: connect.NewClient[v1.GetAccountRequest, v1.GetAccountResponse](
+			httpClient,
+			baseURL+AccountServiceGetAccountProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("GetAccount")),
+			connect.WithClientOptions(opts...),
+		),
+		listAccounts: connect.NewClient[v1.ListAccountsRequest, v1.ListAccountsResponse](
+			httpClient,
+			baseURL+AccountServiceListAccountsProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("ListAccounts")),
+			connect.WithClientOptions(opts...),
+		),
+		listMyAccounts: connect.NewClient[v1.ListMyAccountsRequest, v1.ListMyAccountsResponse](
+			httpClient,
+			baseURL+AccountServiceListMyAccountsProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("ListMyAccounts")),
+			connect.WithClientOptions(opts...),
+		),
+		updateAccount: connect.NewClient[v1.UpdateAccountRequest, v1.UpdateAccountResponse](
+			httpClient,
+			baseURL+AccountServiceUpdateAccountProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("UpdateAccount")),
+			connect.WithClientOptions(opts...),
+		),
+		deleteAccount: connect.NewClient[v1.DeleteAccountRequest, v1.DeleteAccountResponse](
+			httpClient,
+			baseURL+AccountServiceDeleteAccountProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("DeleteAccount")),
+			connect.WithClientOptions(opts...),
+		),
+		cancelAccountDeletion: connect.NewClient[v1.CancelAccountDeletionRequest, v1.CancelAccountDeletionResponse](
+			httpClient,
+			baseURL+AccountServiceCancelAccountDeletionProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("CancelAccountDeletion")),
+			connect.WithClientOptions(opts...),
+		),
+		suspendAccount: connect.NewClient[v1.SuspendAccountRequest, v1.SuspendAccountResponse](
+			httpClient,
+			baseURL+AccountServiceSuspendAccountProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("SuspendAccount")),
+			connect.WithClientOptions(opts...),
+		),
+		reactivateAccount: connect.NewClient[v1.ReactivateAccountRequest, v1.ReactivateAccountResponse](
+			httpClient,
+			baseURL+AccountServiceReactivateAccountProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("ReactivateAccount")),
+			connect.WithClientOptions(opts...),
+		),
+		inviteAccountUser: connect.NewClient[v1.InviteAccountUserRequest, v1.InviteAccountUserResponse](
+			httpClient,
+			baseURL+AccountServiceInviteAccountUserProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("InviteAccountUser")),
+			connect.WithClientOptions(opts...),
+		),
+		listAccountUsers: connect.NewClient[v1.ListAccountUsersRequest, v1.ListAccountUsersResponse](
+			httpClient,
+			baseURL+AccountServiceListAccountUsersProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("ListAccountUsers")),
+			connect.WithClientOptions(opts...),
+		),
+		updateAccountUserRole: connect.NewClient[v1.UpdateAccountUserRoleRequest, v1.UpdateAccountUserRoleResponse](
+			httpClient,
+			baseURL+AccountServiceUpdateAccountUserRoleProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("UpdateAccountUserRole")),
+			connect.WithClientOptions(opts...),
+		),
+		removeAccountUser: connect.NewClient[v1.RemoveAccountUserRequest, v1.RemoveAccountUserResponse](
+			httpClient,
+			baseURL+AccountServiceRemoveAccountUserProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("RemoveAccountUser")),
+			connect.WithClientOptions(opts...),
+		),
+		acceptAccountInvitation: connect.NewClient[v1.AcceptAccountInvitationRequest, v1.AcceptAccountInvitationResponse](
+			httpClient,
+			baseURL+AccountServiceAcceptAccountInvitationProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("AcceptAccountInvitation")),
+			connect.WithClientOptions(opts...),
+		),
+		getAccountDashboard: connect.NewClient[v1.GetAccountDashboardRequest, v1.GetAccountDashboardResponse](
+			httpClient,
+			baseURL+AccountServiceGetAccountDashboardProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("GetAccountDashboard")),
+			connect.WithClientOptions(opts...),
+		),
+		bulkSuspendAccounts: connect.NewClient[v1.BulkSuspendAccountsRequest, v1.BulkSuspendAccountsResponse](
+			httpClient,
+			baseURL+AccountServiceBulkSuspendAccountsProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("BulkSuspendAccounts")),
+			connect.WithClientOptions(opts...),
+		),
+		bulkReactivateAccounts: connect.NewClient[v1.BulkReactivateAccountsRequest, v1.BulkReactivateAccountsResponse](
+			httpClient,
+			baseURL+AccountServiceBulkReactivateAccountsProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("BulkReactivateAccounts")),
+			connect.WithClientOptions(opts...),
+		),
+		getAccountVaultHealth: connect.NewClient[v1.GetAccountVaultHealthRequest, v1.GetAccountVaultHealthResponse](
+			httpClient,
+			baseURL+AccountServiceGetAccountVaultHealthProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("GetAccountVaultHealth")),
+			connect.WithClientOptions(opts...),
+		),
+		resetAccountVaultKey: connect.NewClient[v1.ResetAccountVaultKeyRequest, v1.ResetAccountVaultKeyResponse](
+			httpClient,
+			baseURL+AccountServiceResetAccountVaultKeyProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("ResetAccountVaultKey")),
+			connect.WithClientOptions(opts...),
+		),
+		repairAccountVault: connect.NewClient[v1.RepairAccountVaultRequest, v1.RepairAccountVaultResponse](
+			httpClient,
+			baseURL+AccountServiceRepairAccountVaultProcedure,
+			connect.WithSchema(accountServiceMethods.ByName("RepairAccountVault")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// accountServiceClient implements AccountServiceClient.
+type accountServiceClient struct {
+	createAccount           *connect.Client[v1.CreateAccountRequest, v1.CreateAccountResponse]
+	getAccount              *connect.Client[v1.GetAccountRequest, v1.GetAccountResponse]
+	listAccounts            *connect.Client[v1.ListAccountsRequest, v1.ListAccountsResponse]
+	listMyAccounts          *connect.Client[v1.ListMyAccountsRequest, v1.ListMyAccountsResponse]
+	updateAccount           *connect.Client[v1.UpdateAccountRequest, v1.UpdateAccountResponse]
+	deleteAccount           *connect.Client[v1.DeleteAccountRequest, v1.DeleteAccountResponse]
+	cancelAccountDeletion   *connect.Client[v1.CancelAccountDeletionRequest, v1.CancelAccountDeletionResponse]
+	suspendAccount          *connect.Client[v1.SuspendAccountRequest, v1.SuspendAccountResponse]
+	reactivateAccount       *connect.Client[v1.ReactivateAccountRequest, v1.ReactivateAccountResponse]
+	inviteAccountUser       *connect.Client[v1.InviteAccountUserRequest, v1.InviteAccountUserResponse]
+	listAccountUsers        *connect.Client[v1.ListAccountUsersRequest, v1.ListAccountUsersResponse]
+	updateAccountUserRole   *connect.Client[v1.UpdateAccountUserRoleRequest, v1.UpdateAccountUserRoleResponse]
+	removeAccountUser       *connect.Client[v1.RemoveAccountUserRequest, v1.RemoveAccountUserResponse]
+	acceptAccountInvitation *connect.Client[v1.AcceptAccountInvitationRequest, v1.AcceptAccountInvitationResponse]
+	getAccountDashboard     *connect.Client[v1.GetAccountDashboardRequest, v1.GetAccountDashboardResponse]
+	bulkSuspendAccounts     *connect.Client[v1.BulkSuspendAccountsRequest, v1.BulkSuspendAccountsResponse]
+	bulkReactivateAccounts  *connect.Client[v1.BulkReactivateAccountsRequest, v1.BulkReactivateAccountsResponse]
+	getAccountVaultHealth   *connect.Client[v1.GetAccountVaultHealthRequest, v1.GetAccountVaultHealthResponse]
+	resetAccountVaultKey    *connect.Client[v1.ResetAccountVaultKeyRequest, v1.ResetAccountVaultKeyResponse]
+	repairAccountVault      *connect.Client[v1.RepairAccountVaultRequest, v1.RepairAccountVaultResponse]
+}
+
+// CreateAccount calls orchestrator.v1.AccountService.CreateAccount.
+func (c *accountServiceClient) CreateAccount(ctx context.Context, req *connect.Request[v1.CreateAccountRequest]) (*connect.Response[v1.CreateAccountResponse], error) {
+	return c.createAccount.CallUnary(ctx, req)
+}
+
+// GetAccount calls orchestrator.v1.AccountService.GetAccount.
+func (c *accountServiceClient) GetAccount(ctx context.Context, req *connect.Request[v1.GetAccountRequest]) (*connect.Response[v1.GetAccountResponse], error) {
+	return c.getAccount.CallUnary(ctx, req)
+}
+
+// ListAccounts calls orchestrator.v1.AccountService.ListAccounts.
+func (c *accountServiceClient) ListAccounts(ctx context.Context, req *connect.Request[v1.ListAccountsRequest]) (*connect.Response[v1.ListAccountsResponse], error) {
+	return c.listAccounts.CallUnary(ctx, req)
+}
+
+// ListMyAccounts calls orchestrator.v1.AccountService.ListMyAccounts.
+func (c *accountServiceClient) ListMyAccounts(ctx context.Context, req *connect.Request[v1.ListMyAccountsRequest]) (*connect.Response[v1.ListMyAccountsResponse], error) {
+	return c.listMyAccounts.CallUnary(ctx, req)
+}
+
+// UpdateAccount calls orchestrator.v1.AccountService.UpdateAccount.
+func (c *accountServiceClient) UpdateAccount(ctx context.Context, req *connect.Request[v1.UpdateAccountRequest]) (*connect.Response[v1.UpdateAccountResponse], error) {
+	return c.updateAccount.CallUnary(ctx, req)
+}
+
+// DeleteAccount calls orchestrator.v1.AccountService.DeleteAccount.
+func (c *accountServiceClient) DeleteAccount(ctx context.Context, req *connect.Request[v1.DeleteAccountRequest]) (*connect.Response[v1.DeleteAccountResponse], error) {
+	return c.deleteAccount.CallUnary(ctx, req)
+}
+
+// CancelAccountDeletion calls orchestrator.v1.AccountService.CancelAccountDeletion.
+func (c *accountServiceClient) CancelAccountDeletion(ctx context.Context, req *connect.Request[v1.CancelAccountDeletionRequest]) (*connect.Response[v1.CancelAccountDeletionResponse], error) {
+	return c.cancelAccountDeletion.CallUnary(ctx, req)
+}
+
+// SuspendAccount calls orchestrator.v1.AccountService.SuspendAccount.
+func (c *accountServiceClient) SuspendAccount(ctx context.Context, req *connect.Request[v1.SuspendAccountRequest]) (*connect.Response[v1.SuspendAccountResponse], error) {
+	return c.suspendAccount.CallUnary(ctx, req)
+}
+
+// ReactivateAccount calls orchestrator.v1.AccountService.ReactivateAccount.
+func (c *accountServiceClient) ReactivateAccount(ctx context.Context, req *connect.Request[v1.ReactivateAccountRequest]) (*connect.Response[v1.ReactivateAccountResponse], error) {
+	return c.reactivateAccount.CallUnary(ctx, req)
+}
+
+// InviteAccountUser calls orchestrator.v1.AccountService.InviteAccountUser.
+func (c *accountServiceClient) InviteAccountUser(ctx context.Context, req *connect.Request[v1.InviteAccountUserRequest]) (*connect.Response[v1.InviteAccountUserResponse], error) {
+	return c.inviteAccountUser.CallUnary(ctx, req)
+}
+
+// ListAccountUsers calls orchestrator.v1.AccountService.ListAccountUsers.
+func (c *accountServiceClient) ListAccountUsers(ctx context.Context, req *connect.Request[v1.ListAccountUsersRequest]) (*connect.Response[v1.ListAccountUsersResponse], error) {
+	return c.listAccountUsers.CallUnary(ctx, req)
+}
+
+// UpdateAccountUserRole calls orchestrator.v1.AccountService.UpdateAccountUserRole.
+func (c *accountServiceClient) UpdateAccountUserRole(ctx context.Context, req *connect.Request[v1.UpdateAccountUserRoleRequest]) (*connect.Response[v1.UpdateAccountUserRoleResponse], error) {
+	return c.updateAccountUserRole.CallUnary(ctx, req)
+}
+
+// RemoveAccountUser calls orchestrator.v1.AccountService.RemoveAccountUser.
+func (c *accountServiceClient) RemoveAccountUser(ctx context.Context, req *connect.Request[v1.RemoveAccountUserRequest]) (*connect.Response[v1.RemoveAccountUserResponse], error) {
+	return c.removeAccountUser.CallUnary(ctx, req)
+}
+
+// AcceptAccountInvitation calls orchestrator.v1.AccountService.AcceptAccountInvitation.
+func (c *accountServiceClient) AcceptAccountInvitation(ctx context.Context, req *connect.Request[v1.AcceptAccountInvitationRequest]) (*connect.Response[v1.AcceptAccountInvitationResponse], error) {
+	return c.acceptAccountInvitation.CallUnary(ctx, req)
+}
+
+// GetAccountDashboard calls orchestrator.v1.AccountService.GetAccountDashboard.
+func (c *accountServiceClient) GetAccountDashboard(ctx context.Context, req *connect.Request[v1.GetAccountDashboardRequest]) (*connect.Response[v1.GetAccountDashboardResponse], error) {
+	return c.getAccountDashboard.CallUnary(ctx, req)
+}
+
+// BulkSuspendAccounts calls orchestrator.v1.AccountService.BulkSuspendAccounts.
+func (c *accountServiceClient) BulkSuspendAccounts(ctx context.Context, req *connect.Request[v1.BulkSuspendAccountsRequest]) (*connect.Response[v1.BulkSuspendAccountsResponse], error) {
+	return c.bulkSuspendAccounts.CallUnary(ctx, req)
+}
+
+// BulkReactivateAccounts calls orchestrator.v1.AccountService.BulkReactivateAccounts.
+func (c *accountServiceClient) BulkReactivateAccounts(ctx context.Context, req *connect.Request[v1.BulkReactivateAccountsRequest]) (*connect.Response[v1.BulkReactivateAccountsResponse], error) {
+	return c.bulkReactivateAccounts.CallUnary(ctx, req)
+}
+
+// GetAccountVaultHealth calls orchestrator.v1.AccountService.GetAccountVaultHealth.
+func (c *accountServiceClient) GetAccountVaultHealth(ctx context.Context, req *connect.Request[v1.GetAccountVaultHealthRequest]) (*connect.Response[v1.GetAccountVaultHealthResponse], error) {
+	return c.getAccountVaultHealth.CallUnary(ctx, req)
+}
+
+// ResetAccountVaultKey calls orchestrator.v1.AccountService.ResetAccountVaultKey.
+func (c *accountServiceClient) ResetAccountVaultKey(ctx context.Context, req *connect.Request[v1.ResetAccountVaultKeyRequest]) (*connect.Response[v1.ResetAccountVaultKeyResponse], error) {
+	return c.resetAccountVaultKey.CallUnary(ctx, req)
+}
+
+// RepairAccountVault calls orchestrator.v1.AccountService.RepairAccountVault.
+func (c *accountServiceClient) RepairAccountVault(ctx context.Context, req *connect.Request[v1.RepairAccountVaultRequest]) (*connect.Response[v1.RepairAccountVaultResponse], error) {
+	return c.repairAccountVault.CallUnary(ctx, req)
+}
+
+// AccountServiceHandler is an implementation of the orchestrator.v1.AccountService service.
+type AccountServiceHandler interface {
+	// Create a new account
+	CreateAccount(context.Context, *connect.Request[v1.CreateAccountRequest]) (*connect.Response[v1.CreateAccountResponse], error)
+	// Get an account by ID
+	GetAccount(context.Context, *connect.Request[v1.GetAccountRequest]) (*connect.Response[v1.GetAccountResponse], error)
+	// List accounts (admin only)
+	ListAccounts(context.Context, *connect.Request[v1.ListAccountsRequest]) (*connect.Response[v1.ListAccountsResponse], error)
+	// List accounts for current user
+	ListMyAccounts(context.Context, *connect.Request[v1.ListMyAccountsRequest]) (*connect.Response[v1.ListMyAccountsResponse], error)
+	// Update an account
+	UpdateAccount(context.Context, *connect.Request[v1.UpdateAccountRequest]) (*connect.Response[v1.UpdateAccountResponse], error)
+	// Delete an account (initiates 48-hour pending deletion period)
+	DeleteAccount(context.Context, *connect.Request[v1.DeleteAccountRequest]) (*connect.Response[v1.DeleteAccountResponse], error)
+	// Cancel a pending account deletion
+	CancelAccountDeletion(context.Context, *connect.Request[v1.CancelAccountDeletionRequest]) (*connect.Response[v1.CancelAccountDeletionResponse], error)
+	// Suspend an account
+	SuspendAccount(context.Context, *connect.Request[v1.SuspendAccountRequest]) (*connect.Response[v1.SuspendAccountResponse], error)
+	// Reactivate a suspended account
+	ReactivateAccount(context.Context, *connect.Request[v1.ReactivateAccountRequest]) (*connect.Response[v1.ReactivateAccountResponse], error)
+	// Team member management
+	// Invite a user to an account
+	InviteAccountUser(context.Context, *connect.Request[v1.InviteAccountUserRequest]) (*connect.Response[v1.InviteAccountUserResponse], error)
+	// List account team members
+	ListAccountUsers(context.Context, *connect.Request[v1.ListAccountUsersRequest]) (*connect.Response[v1.ListAccountUsersResponse], error)
+	// Update a team member's role
+	UpdateAccountUserRole(context.Context, *connect.Request[v1.UpdateAccountUserRoleRequest]) (*connect.Response[v1.UpdateAccountUserRoleResponse], error)
+	// Remove a team member
+	RemoveAccountUser(context.Context, *connect.Request[v1.RemoveAccountUserRequest]) (*connect.Response[v1.RemoveAccountUserResponse], error)
+	// Accept an account invitation
+	AcceptAccountInvitation(context.Context, *connect.Request[v1.AcceptAccountInvitationRequest]) (*connect.Response[v1.AcceptAccountInvitationResponse], error)
+	// Dashboard
+	// Get account dashboard with aggregated metrics
+	GetAccountDashboard(context.Context, *connect.Request[v1.GetAccountDashboardRequest]) (*connect.Response[v1.GetAccountDashboardResponse], error)
+	// Bulk operations
+	// Suspend multiple accounts
+	BulkSuspendAccounts(context.Context, *connect.Request[v1.BulkSuspendAccountsRequest]) (*connect.Response[v1.BulkSuspendAccountsResponse], error)
+	// Reactivate multiple accounts
+	BulkReactivateAccounts(context.Context, *connect.Request[v1.BulkReactivateAccountsRequest]) (*connect.Response[v1.BulkReactivateAccountsResponse], error)
+	// Vault management (superadmin only)
+	// Get vault health status for an account and all its instances
+	GetAccountVaultHealth(context.Context, *connect.Request[v1.GetAccountVaultHealthRequest]) (*connect.Response[v1.GetAccountVaultHealthResponse], error)
+	// Reset the vault AppRole secret_id and recreate all running instances with new credentials
+	ResetAccountVaultKey(context.Context, *connect.Request[v1.ResetAccountVaultKeyRequest]) (*connect.Response[v1.ResetAccountVaultKeyResponse], error)
+	// Repair vault infrastructure: ensure paths, secrets, AppRoles, and policies exist
+	RepairAccountVault(context.Context, *connect.Request[v1.RepairAccountVaultRequest]) (*connect.Response[v1.RepairAccountVaultResponse], error)
+}
+
+// NewAccountServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewAccountServiceHandler(svc AccountServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	accountServiceMethods := v1.File_orchestrator_v1_accounts_proto.Services().ByName("AccountService").Methods()
+	accountServiceCreateAccountHandler := connect.NewUnaryHandler(
+		AccountServiceCreateAccountProcedure,
+		svc.CreateAccount,
+		connect.WithSchema(accountServiceMethods.ByName("CreateAccount")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceGetAccountHandler := connect.NewUnaryHandler(
+		AccountServiceGetAccountProcedure,
+		svc.GetAccount,
+		connect.WithSchema(accountServiceMethods.ByName("GetAccount")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceListAccountsHandler := connect.NewUnaryHandler(
+		AccountServiceListAccountsProcedure,
+		svc.ListAccounts,
+		connect.WithSchema(accountServiceMethods.ByName("ListAccounts")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceListMyAccountsHandler := connect.NewUnaryHandler(
+		AccountServiceListMyAccountsProcedure,
+		svc.ListMyAccounts,
+		connect.WithSchema(accountServiceMethods.ByName("ListMyAccounts")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceUpdateAccountHandler := connect.NewUnaryHandler(
+		AccountServiceUpdateAccountProcedure,
+		svc.UpdateAccount,
+		connect.WithSchema(accountServiceMethods.ByName("UpdateAccount")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceDeleteAccountHandler := connect.NewUnaryHandler(
+		AccountServiceDeleteAccountProcedure,
+		svc.DeleteAccount,
+		connect.WithSchema(accountServiceMethods.ByName("DeleteAccount")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceCancelAccountDeletionHandler := connect.NewUnaryHandler(
+		AccountServiceCancelAccountDeletionProcedure,
+		svc.CancelAccountDeletion,
+		connect.WithSchema(accountServiceMethods.ByName("CancelAccountDeletion")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceSuspendAccountHandler := connect.NewUnaryHandler(
+		AccountServiceSuspendAccountProcedure,
+		svc.SuspendAccount,
+		connect.WithSchema(accountServiceMethods.ByName("SuspendAccount")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceReactivateAccountHandler := connect.NewUnaryHandler(
+		AccountServiceReactivateAccountProcedure,
+		svc.ReactivateAccount,
+		connect.WithSchema(accountServiceMethods.ByName("ReactivateAccount")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceInviteAccountUserHandler := connect.NewUnaryHandler(
+		AccountServiceInviteAccountUserProcedure,
+		svc.InviteAccountUser,
+		connect.WithSchema(accountServiceMethods.ByName("InviteAccountUser")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceListAccountUsersHandler := connect.NewUnaryHandler(
+		AccountServiceListAccountUsersProcedure,
+		svc.ListAccountUsers,
+		connect.WithSchema(accountServiceMethods.ByName("ListAccountUsers")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceUpdateAccountUserRoleHandler := connect.NewUnaryHandler(
+		AccountServiceUpdateAccountUserRoleProcedure,
+		svc.UpdateAccountUserRole,
+		connect.WithSchema(accountServiceMethods.ByName("UpdateAccountUserRole")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceRemoveAccountUserHandler := connect.NewUnaryHandler(
+		AccountServiceRemoveAccountUserProcedure,
+		svc.RemoveAccountUser,
+		connect.WithSchema(accountServiceMethods.ByName("RemoveAccountUser")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceAcceptAccountInvitationHandler := connect.NewUnaryHandler(
+		AccountServiceAcceptAccountInvitationProcedure,
+		svc.AcceptAccountInvitation,
+		connect.WithSchema(accountServiceMethods.ByName("AcceptAccountInvitation")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceGetAccountDashboardHandler := connect.NewUnaryHandler(
+		AccountServiceGetAccountDashboardProcedure,
+		svc.GetAccountDashboard,
+		connect.WithSchema(accountServiceMethods.ByName("GetAccountDashboard")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceBulkSuspendAccountsHandler := connect.NewUnaryHandler(
+		AccountServiceBulkSuspendAccountsProcedure,
+		svc.BulkSuspendAccounts,
+		connect.WithSchema(accountServiceMethods.ByName("BulkSuspendAccounts")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceBulkReactivateAccountsHandler := connect.NewUnaryHandler(
+		AccountServiceBulkReactivateAccountsProcedure,
+		svc.BulkReactivateAccounts,
+		connect.WithSchema(accountServiceMethods.ByName("BulkReactivateAccounts")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceGetAccountVaultHealthHandler := connect.NewUnaryHandler(
+		AccountServiceGetAccountVaultHealthProcedure,
+		svc.GetAccountVaultHealth,
+		connect.WithSchema(accountServiceMethods.ByName("GetAccountVaultHealth")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceResetAccountVaultKeyHandler := connect.NewUnaryHandler(
+		AccountServiceResetAccountVaultKeyProcedure,
+		svc.ResetAccountVaultKey,
+		connect.WithSchema(accountServiceMethods.ByName("ResetAccountVaultKey")),
+		connect.WithHandlerOptions(opts...),
+	)
+	accountServiceRepairAccountVaultHandler := connect.NewUnaryHandler(
+		AccountServiceRepairAccountVaultProcedure,
+		svc.RepairAccountVault,
+		connect.WithSchema(accountServiceMethods.ByName("RepairAccountVault")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/orchestrator.v1.AccountService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case AccountServiceCreateAccountProcedure:
+			accountServiceCreateAccountHandler.ServeHTTP(w, r)
+		case AccountServiceGetAccountProcedure:
+			accountServiceGetAccountHandler.ServeHTTP(w, r)
+		case AccountServiceListAccountsProcedure:
+			accountServiceListAccountsHandler.ServeHTTP(w, r)
+		case AccountServiceListMyAccountsProcedure:
+			accountServiceListMyAccountsHandler.ServeHTTP(w, r)
+		case AccountServiceUpdateAccountProcedure:
+			accountServiceUpdateAccountHandler.ServeHTTP(w, r)
+		case AccountServiceDeleteAccountProcedure:
+			accountServiceDeleteAccountHandler.ServeHTTP(w, r)
+		case AccountServiceCancelAccountDeletionProcedure:
+			accountServiceCancelAccountDeletionHandler.ServeHTTP(w, r)
+		case AccountServiceSuspendAccountProcedure:
+			accountServiceSuspendAccountHandler.ServeHTTP(w, r)
+		case AccountServiceReactivateAccountProcedure:
+			accountServiceReactivateAccountHandler.ServeHTTP(w, r)
+		case AccountServiceInviteAccountUserProcedure:
+			accountServiceInviteAccountUserHandler.ServeHTTP(w, r)
+		case AccountServiceListAccountUsersProcedure:
+			accountServiceListAccountUsersHandler.ServeHTTP(w, r)
+		case AccountServiceUpdateAccountUserRoleProcedure:
+			accountServiceUpdateAccountUserRoleHandler.ServeHTTP(w, r)
+		case AccountServiceRemoveAccountUserProcedure:
+			accountServiceRemoveAccountUserHandler.ServeHTTP(w, r)
+		case AccountServiceAcceptAccountInvitationProcedure:
+			accountServiceAcceptAccountInvitationHandler.ServeHTTP(w, r)
+		case AccountServiceGetAccountDashboardProcedure:
+			accountServiceGetAccountDashboardHandler.ServeHTTP(w, r)
+		case AccountServiceBulkSuspendAccountsProcedure:
+			accountServiceBulkSuspendAccountsHandler.ServeHTTP(w, r)
+		case AccountServiceBulkReactivateAccountsProcedure:
+			accountServiceBulkReactivateAccountsHandler.ServeHTTP(w, r)
+		case AccountServiceGetAccountVaultHealthProcedure:
+			accountServiceGetAccountVaultHealthHandler.ServeHTTP(w, r)
+		case AccountServiceResetAccountVaultKeyProcedure:
+			accountServiceResetAccountVaultKeyHandler.ServeHTTP(w, r)
+		case AccountServiceRepairAccountVaultProcedure:
+			accountServiceRepairAccountVaultHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedAccountServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedAccountServiceHandler struct{}
+
+func (UnimplementedAccountServiceHandler) CreateAccount(context.Context, *connect.Request[v1.CreateAccountRequest]) (*connect.Response[v1.CreateAccountResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.CreateAccount is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) GetAccount(context.Context, *connect.Request[v1.GetAccountRequest]) (*connect.Response[v1.GetAccountResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.GetAccount is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) ListAccounts(context.Context, *connect.Request[v1.ListAccountsRequest]) (*connect.Response[v1.ListAccountsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.ListAccounts is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) ListMyAccounts(context.Context, *connect.Request[v1.ListMyAccountsRequest]) (*connect.Response[v1.ListMyAccountsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.ListMyAccounts is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) UpdateAccount(context.Context, *connect.Request[v1.UpdateAccountRequest]) (*connect.Response[v1.UpdateAccountResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.UpdateAccount is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) DeleteAccount(context.Context, *connect.Request[v1.DeleteAccountRequest]) (*connect.Response[v1.DeleteAccountResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.DeleteAccount is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) CancelAccountDeletion(context.Context, *connect.Request[v1.CancelAccountDeletionRequest]) (*connect.Response[v1.CancelAccountDeletionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.CancelAccountDeletion is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) SuspendAccount(context.Context, *connect.Request[v1.SuspendAccountRequest]) (*connect.Response[v1.SuspendAccountResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.SuspendAccount is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) ReactivateAccount(context.Context, *connect.Request[v1.ReactivateAccountRequest]) (*connect.Response[v1.ReactivateAccountResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.ReactivateAccount is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) InviteAccountUser(context.Context, *connect.Request[v1.InviteAccountUserRequest]) (*connect.Response[v1.InviteAccountUserResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.InviteAccountUser is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) ListAccountUsers(context.Context, *connect.Request[v1.ListAccountUsersRequest]) (*connect.Response[v1.ListAccountUsersResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.ListAccountUsers is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) UpdateAccountUserRole(context.Context, *connect.Request[v1.UpdateAccountUserRoleRequest]) (*connect.Response[v1.UpdateAccountUserRoleResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.UpdateAccountUserRole is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) RemoveAccountUser(context.Context, *connect.Request[v1.RemoveAccountUserRequest]) (*connect.Response[v1.RemoveAccountUserResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.RemoveAccountUser is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) AcceptAccountInvitation(context.Context, *connect.Request[v1.AcceptAccountInvitationRequest]) (*connect.Response[v1.AcceptAccountInvitationResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.AcceptAccountInvitation is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) GetAccountDashboard(context.Context, *connect.Request[v1.GetAccountDashboardRequest]) (*connect.Response[v1.GetAccountDashboardResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.GetAccountDashboard is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) BulkSuspendAccounts(context.Context, *connect.Request[v1.BulkSuspendAccountsRequest]) (*connect.Response[v1.BulkSuspendAccountsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.BulkSuspendAccounts is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) BulkReactivateAccounts(context.Context, *connect.Request[v1.BulkReactivateAccountsRequest]) (*connect.Response[v1.BulkReactivateAccountsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.BulkReactivateAccounts is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) GetAccountVaultHealth(context.Context, *connect.Request[v1.GetAccountVaultHealthRequest]) (*connect.Response[v1.GetAccountVaultHealthResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.GetAccountVaultHealth is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) ResetAccountVaultKey(context.Context, *connect.Request[v1.ResetAccountVaultKeyRequest]) (*connect.Response[v1.ResetAccountVaultKeyResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.ResetAccountVaultKey is not implemented"))
+}
+
+func (UnimplementedAccountServiceHandler) RepairAccountVault(context.Context, *connect.Request[v1.RepairAccountVaultRequest]) (*connect.Response[v1.RepairAccountVaultResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AccountService.RepairAccountVault is not implemented"))
+}

internal/api/orchestrator/v1/orchestratorv1connect/auth.connect.go

@@ -0,0 +1,695 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: orchestrator/v1/auth.proto
+
+package orchestratorv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "git.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// AuthServiceName is the fully-qualified name of the AuthService service.
+	AuthServiceName = "orchestrator.v1.AuthService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// AuthServiceLoginProcedure is the fully-qualified name of the AuthService's Login RPC.
+	AuthServiceLoginProcedure = "/orchestrator.v1.AuthService/Login"
+	// AuthServiceLogoutProcedure is the fully-qualified name of the AuthService's Logout RPC.
+	AuthServiceLogoutProcedure = "/orchestrator.v1.AuthService/Logout"
+	// AuthServiceRegisterProcedure is the fully-qualified name of the AuthService's Register RPC.
+	AuthServiceRegisterProcedure = "/orchestrator.v1.AuthService/Register"
+	// AuthServiceRefreshSessionProcedure is the fully-qualified name of the AuthService's
+	// RefreshSession RPC.
+	AuthServiceRefreshSessionProcedure = "/orchestrator.v1.AuthService/RefreshSession"
+	// AuthServiceGetCurrentUserProcedure is the fully-qualified name of the AuthService's
+	// GetCurrentUser RPC.
+	AuthServiceGetCurrentUserProcedure = "/orchestrator.v1.AuthService/GetCurrentUser"
+	// AuthServiceChangePasswordProcedure is the fully-qualified name of the AuthService's
+	// ChangePassword RPC.
+	AuthServiceChangePasswordProcedure = "/orchestrator.v1.AuthService/ChangePassword"
+	// AuthServiceRequestPasswordResetProcedure is the fully-qualified name of the AuthService's
+	// RequestPasswordReset RPC.
+	AuthServiceRequestPasswordResetProcedure = "/orchestrator.v1.AuthService/RequestPasswordReset"
+	// AuthServiceResetPasswordProcedure is the fully-qualified name of the AuthService's ResetPassword
+	// RPC.
+	AuthServiceResetPasswordProcedure = "/orchestrator.v1.AuthService/ResetPassword"
+	// AuthServiceVerifyEmailProcedure is the fully-qualified name of the AuthService's VerifyEmail RPC.
+	AuthServiceVerifyEmailProcedure = "/orchestrator.v1.AuthService/VerifyEmail"
+	// AuthServiceResendVerificationEmailProcedure is the fully-qualified name of the AuthService's
+	// ResendVerificationEmail RPC.
+	AuthServiceResendVerificationEmailProcedure = "/orchestrator.v1.AuthService/ResendVerificationEmail"
+	// AuthServiceUnlockAccountProcedure is the fully-qualified name of the AuthService's UnlockAccount
+	// RPC.
+	AuthServiceUnlockAccountProcedure = "/orchestrator.v1.AuthService/UnlockAccount"
+	// AuthServiceAdminUnlockUserProcedure is the fully-qualified name of the AuthService's
+	// AdminUnlockUser RPC.
+	AuthServiceAdminUnlockUserProcedure = "/orchestrator.v1.AuthService/AdminUnlockUser"
+	// AuthServiceAdminVerifyUserEmailProcedure is the fully-qualified name of the AuthService's
+	// AdminVerifyUserEmail RPC.
+	AuthServiceAdminVerifyUserEmailProcedure = "/orchestrator.v1.AuthService/AdminVerifyUserEmail"
+	// AuthServiceSetupTOTPProcedure is the fully-qualified name of the AuthService's SetupTOTP RPC.
+	AuthServiceSetupTOTPProcedure = "/orchestrator.v1.AuthService/SetupTOTP"
+	// AuthServiceEnableTOTPProcedure is the fully-qualified name of the AuthService's EnableTOTP RPC.
+	AuthServiceEnableTOTPProcedure = "/orchestrator.v1.AuthService/EnableTOTP"
+	// AuthServiceDisableTOTPProcedure is the fully-qualified name of the AuthService's DisableTOTP RPC.
+	AuthServiceDisableTOTPProcedure = "/orchestrator.v1.AuthService/DisableTOTP"
+	// AuthServiceVerifyLoginTOTPProcedure is the fully-qualified name of the AuthService's
+	// VerifyLoginTOTP RPC.
+	AuthServiceVerifyLoginTOTPProcedure = "/orchestrator.v1.AuthService/VerifyLoginTOTP"
+	// AuthServiceGetTOTPStatusProcedure is the fully-qualified name of the AuthService's GetTOTPStatus
+	// RPC.
+	AuthServiceGetTOTPStatusProcedure = "/orchestrator.v1.AuthService/GetTOTPStatus"
+	// AuthServiceRegenerateBackupCodesProcedure is the fully-qualified name of the AuthService's
+	// RegenerateBackupCodes RPC.
+	AuthServiceRegenerateBackupCodesProcedure = "/orchestrator.v1.AuthService/RegenerateBackupCodes"
+	// AuthServiceDismissTOTPPromptProcedure is the fully-qualified name of the AuthService's
+	// DismissTOTPPrompt RPC.
+	AuthServiceDismissTOTPPromptProcedure = "/orchestrator.v1.AuthService/DismissTOTPPrompt"
+)
+
+// AuthServiceClient is a client for the orchestrator.v1.AuthService service.
+type AuthServiceClient interface {
+	// Login with email and password
+	Login(context.Context, *connect.Request[v1.LoginRequest]) (*connect.Response[v1.LoginResponse], error)
+	// Logout and clear session
+	Logout(context.Context, *connect.Request[v1.LogoutRequest]) (*connect.Response[v1.LogoutResponse], error)
+	// Register a new user
+	Register(context.Context, *connect.Request[v1.RegisterRequest]) (*connect.Response[v1.RegisterResponse], error)
+	// Refresh the session
+	RefreshSession(context.Context, *connect.Request[v1.RefreshSessionRequest]) (*connect.Response[v1.RefreshSessionResponse], error)
+	// Get the current user
+	GetCurrentUser(context.Context, *connect.Request[v1.GetCurrentUserRequest]) (*connect.Response[v1.GetCurrentUserResponse], error)
+	// Change password
+	ChangePassword(context.Context, *connect.Request[v1.ChangePasswordRequest]) (*connect.Response[v1.ChangePasswordResponse], error)
+	// Request password reset
+	RequestPasswordReset(context.Context, *connect.Request[v1.RequestPasswordResetRequest]) (*connect.Response[v1.RequestPasswordResetResponse], error)
+	// Reset password with token
+	ResetPassword(context.Context, *connect.Request[v1.ResetPasswordRequest]) (*connect.Response[v1.ResetPasswordResponse], error)
+	// Verify email with token
+	VerifyEmail(context.Context, *connect.Request[v1.VerifyEmailRequest]) (*connect.Response[v1.VerifyEmailResponse], error)
+	// Resend verification email (rate-limited)
+	ResendVerificationEmail(context.Context, *connect.Request[v1.ResendVerificationEmailRequest]) (*connect.Response[v1.ResendVerificationEmailResponse], error)
+	// Account unlock (magic link)
+	UnlockAccount(context.Context, *connect.Request[v1.UnlockAccountRequest]) (*connect.Response[v1.UnlockAccountResponse], error)
+	// Admin: Unlock a user's account (superadmin only)
+	AdminUnlockUser(context.Context, *connect.Request[v1.AdminUnlockUserRequest]) (*connect.Response[v1.AdminUnlockUserResponse], error)
+	// Admin: Manually verify a user's email (superadmin only)
+	AdminVerifyUserEmail(context.Context, *connect.Request[v1.AdminVerifyUserEmailRequest]) (*connect.Response[v1.AdminVerifyUserEmailResponse], error)
+	// TOTP Two-Factor Authentication
+	// Setup TOTP - generates secret and QR code
+	SetupTOTP(context.Context, *connect.Request[v1.SetupTOTPRequest]) (*connect.Response[v1.SetupTOTPResponse], error)
+	// Enable TOTP - verifies the code and enables 2FA
+	EnableTOTP(context.Context, *connect.Request[v1.EnableTOTPRequest]) (*connect.Response[v1.EnableTOTPResponse], error)
+	// Disable TOTP - requires password verification
+	DisableTOTP(context.Context, *connect.Request[v1.DisableTOTPRequest]) (*connect.Response[v1.DisableTOTPResponse], error)
+	// Verify login TOTP - second step after password verification
+	VerifyLoginTOTP(context.Context, *connect.Request[v1.VerifyLoginTOTPRequest]) (*connect.Response[v1.VerifyLoginTOTPResponse], error)
+	// Get TOTP status - check if 2FA is enabled
+	GetTOTPStatus(context.Context, *connect.Request[v1.GetTOTPStatusRequest]) (*connect.Response[v1.GetTOTPStatusResponse], error)
+	// Regenerate backup codes - requires password verification
+	RegenerateBackupCodes(context.Context, *connect.Request[v1.RegenerateBackupCodesRequest]) (*connect.Response[v1.RegenerateBackupCodesResponse], error)
+	// Dismiss the TOTP enrollment prompt for 7 days
+	DismissTOTPPrompt(context.Context, *connect.Request[v1.DismissTOTPPromptRequest]) (*connect.Response[v1.DismissTOTPPromptResponse], error)
+}
+
+// NewAuthServiceClient constructs a client for the orchestrator.v1.AuthService service. By default,
+// it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and
+// sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC()
+// or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewAuthServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) AuthServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	authServiceMethods := v1.File_orchestrator_v1_auth_proto.Services().ByName("AuthService").Methods()
+	return &authServiceClient{
+		login: connect.NewClient[v1.LoginRequest, v1.LoginResponse](
+			httpClient,
+			baseURL+AuthServiceLoginProcedure,
+			connect.WithSchema(authServiceMethods.ByName("Login")),
+			connect.WithClientOptions(opts...),
+		),
+		logout: connect.NewClient[v1.LogoutRequest, v1.LogoutResponse](
+			httpClient,
+			baseURL+AuthServiceLogoutProcedure,
+			connect.WithSchema(authServiceMethods.ByName("Logout")),
+			connect.WithClientOptions(opts...),
+		),
+		register: connect.NewClient[v1.RegisterRequest, v1.RegisterResponse](
+			httpClient,
+			baseURL+AuthServiceRegisterProcedure,
+			connect.WithSchema(authServiceMethods.ByName("Register")),
+			connect.WithClientOptions(opts...),
+		),
+		refreshSession: connect.NewClient[v1.RefreshSessionRequest, v1.RefreshSessionResponse](
+			httpClient,
+			baseURL+AuthServiceRefreshSessionProcedure,
+			connect.WithSchema(authServiceMethods.ByName("RefreshSession")),
+			connect.WithClientOptions(opts...),
+		),
+		getCurrentUser: connect.NewClient[v1.GetCurrentUserRequest, v1.GetCurrentUserResponse](
+			httpClient,
+			baseURL+AuthServiceGetCurrentUserProcedure,
+			connect.WithSchema(authServiceMethods.ByName("GetCurrentUser")),
+			connect.WithClientOptions(opts...),
+		),
+		changePassword: connect.NewClient[v1.ChangePasswordRequest, v1.ChangePasswordResponse](
+			httpClient,
+			baseURL+AuthServiceChangePasswordProcedure,
+			connect.WithSchema(authServiceMethods.ByName("ChangePassword")),
+			connect.WithClientOptions(opts...),
+		),
+		requestPasswordReset: connect.NewClient[v1.RequestPasswordResetRequest, v1.RequestPasswordResetResponse](
+			httpClient,
+			baseURL+AuthServiceRequestPasswordResetProcedure,
+			connect.WithSchema(authServiceMethods.ByName("RequestPasswordReset")),
+			connect.WithClientOptions(opts...),
+		),
+		resetPassword: connect.NewClient[v1.ResetPasswordRequest, v1.ResetPasswordResponse](
+			httpClient,
+			baseURL+AuthServiceResetPasswordProcedure,
+			connect.WithSchema(authServiceMethods.ByName("ResetPassword")),
+			connect.WithClientOptions(opts...),
+		),
+		verifyEmail: connect.NewClient[v1.VerifyEmailRequest, v1.VerifyEmailResponse](
+			httpClient,
+			baseURL+AuthServiceVerifyEmailProcedure,
+			connect.WithSchema(authServiceMethods.ByName("VerifyEmail")),
+			connect.WithClientOptions(opts...),
+		),
+		resendVerificationEmail: connect.NewClient[v1.ResendVerificationEmailRequest, v1.ResendVerificationEmailResponse](
+			httpClient,
+			baseURL+AuthServiceResendVerificationEmailProcedure,
+			connect.WithSchema(authServiceMethods.ByName("ResendVerificationEmail")),
+			connect.WithClientOptions(opts...),
+		),
+		unlockAccount: connect.NewClient[v1.UnlockAccountRequest, v1.UnlockAccountResponse](
+			httpClient,
+			baseURL+AuthServiceUnlockAccountProcedure,
+			connect.WithSchema(authServiceMethods.ByName("UnlockAccount")),
+			connect.WithClientOptions(opts...),
+		),
+		adminUnlockUser: connect.NewClient[v1.AdminUnlockUserRequest, v1.AdminUnlockUserResponse](
+			httpClient,
+			baseURL+AuthServiceAdminUnlockUserProcedure,
+			connect.WithSchema(authServiceMethods.ByName("AdminUnlockUser")),
+			connect.WithClientOptions(opts...),
+		),
+		adminVerifyUserEmail: connect.NewClient[v1.AdminVerifyUserEmailRequest, v1.AdminVerifyUserEmailResponse](
+			httpClient,
+			baseURL+AuthServiceAdminVerifyUserEmailProcedure,
+			connect.WithSchema(authServiceMethods.ByName("AdminVerifyUserEmail")),
+			connect.WithClientOptions(opts...),
+		),
+		setupTOTP: connect.NewClient[v1.SetupTOTPRequest, v1.SetupTOTPResponse](
+			httpClient,
+			baseURL+AuthServiceSetupTOTPProcedure,
+			connect.WithSchema(authServiceMethods.ByName("SetupTOTP")),
+			connect.WithClientOptions(opts...),
+		),
+		enableTOTP: connect.NewClient[v1.EnableTOTPRequest, v1.EnableTOTPResponse](
+			httpClient,
+			baseURL+AuthServiceEnableTOTPProcedure,
+			connect.WithSchema(authServiceMethods.ByName("EnableTOTP")),
+			connect.WithClientOptions(opts...),
+		),
+		disableTOTP: connect.NewClient[v1.DisableTOTPRequest, v1.DisableTOTPResponse](
+			httpClient,
+			baseURL+AuthServiceDisableTOTPProcedure,
+			connect.WithSchema(authServiceMethods.ByName("DisableTOTP")),
+			connect.WithClientOptions(opts...),
+		),
+		verifyLoginTOTP: connect.NewClient[v1.VerifyLoginTOTPRequest, v1.VerifyLoginTOTPResponse](
+			httpClient,
+			baseURL+AuthServiceVerifyLoginTOTPProcedure,
+			connect.WithSchema(authServiceMethods.ByName("VerifyLoginTOTP")),
+			connect.WithClientOptions(opts...),
+		),
+		getTOTPStatus: connect.NewClient[v1.GetTOTPStatusRequest, v1.GetTOTPStatusResponse](
+			httpClient,
+			baseURL+AuthServiceGetTOTPStatusProcedure,
+			connect.WithSchema(authServiceMethods.ByName("GetTOTPStatus")),
+			connect.WithClientOptions(opts...),
+		),
+		regenerateBackupCodes: connect.NewClient[v1.RegenerateBackupCodesRequest, v1.RegenerateBackupCodesResponse](
+			httpClient,
+			baseURL+AuthServiceRegenerateBackupCodesProcedure,
+			connect.WithSchema(authServiceMethods.ByName("RegenerateBackupCodes")),
+			connect.WithClientOptions(opts...),
+		),
+		dismissTOTPPrompt: connect.NewClient[v1.DismissTOTPPromptRequest, v1.DismissTOTPPromptResponse](
+			httpClient,
+			baseURL+AuthServiceDismissTOTPPromptProcedure,
+			connect.WithSchema(authServiceMethods.ByName("DismissTOTPPrompt")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// authServiceClient implements AuthServiceClient.
+type authServiceClient struct {
+	login                   *connect.Client[v1.LoginRequest, v1.LoginResponse]
+	logout                  *connect.Client[v1.LogoutRequest, v1.LogoutResponse]
+	register                *connect.Client[v1.RegisterRequest, v1.RegisterResponse]
+	refreshSession          *connect.Client[v1.RefreshSessionRequest, v1.RefreshSessionResponse]
+	getCurrentUser          *connect.Client[v1.GetCurrentUserRequest, v1.GetCurrentUserResponse]
+	changePassword          *connect.Client[v1.ChangePasswordRequest, v1.ChangePasswordResponse]
+	requestPasswordReset    *connect.Client[v1.RequestPasswordResetRequest, v1.RequestPasswordResetResponse]
+	resetPassword           *connect.Client[v1.ResetPasswordRequest, v1.ResetPasswordResponse]
+	verifyEmail             *connect.Client[v1.VerifyEmailRequest, v1.VerifyEmailResponse]
+	resendVerificationEmail *connect.Client[v1.ResendVerificationEmailRequest, v1.ResendVerificationEmailResponse]
+	unlockAccount           *connect.Client[v1.UnlockAccountRequest, v1.UnlockAccountResponse]
+	adminUnlockUser         *connect.Client[v1.AdminUnlockUserRequest, v1.AdminUnlockUserResponse]
+	adminVerifyUserEmail    *connect.Client[v1.AdminVerifyUserEmailRequest, v1.AdminVerifyUserEmailResponse]
+	setupTOTP               *connect.Client[v1.SetupTOTPRequest, v1.SetupTOTPResponse]
+	enableTOTP              *connect.Client[v1.EnableTOTPRequest, v1.EnableTOTPResponse]
+	disableTOTP             *connect.Client[v1.DisableTOTPRequest, v1.DisableTOTPResponse]
+	verifyLoginTOTP         *connect.Client[v1.VerifyLoginTOTPRequest, v1.VerifyLoginTOTPResponse]
+	getTOTPStatus           *connect.Client[v1.GetTOTPStatusRequest, v1.GetTOTPStatusResponse]
+	regenerateBackupCodes   *connect.Client[v1.RegenerateBackupCodesRequest, v1.RegenerateBackupCodesResponse]
+	dismissTOTPPrompt       *connect.Client[v1.DismissTOTPPromptRequest, v1.DismissTOTPPromptResponse]
+}
+
+// Login calls orchestrator.v1.AuthService.Login.
+func (c *authServiceClient) Login(ctx context.Context, req *connect.Request[v1.LoginRequest]) (*connect.Response[v1.LoginResponse], error) {
+	return c.login.CallUnary(ctx, req)
+}
+
+// Logout calls orchestrator.v1.AuthService.Logout.
+func (c *authServiceClient) Logout(ctx context.Context, req *connect.Request[v1.LogoutRequest]) (*connect.Response[v1.LogoutResponse], error) {
+	return c.logout.CallUnary(ctx, req)
+}
+
+// Register calls orchestrator.v1.AuthService.Register.
+func (c *authServiceClient) Register(ctx context.Context, req *connect.Request[v1.RegisterRequest]) (*connect.Response[v1.RegisterResponse], error) {
+	return c.register.CallUnary(ctx, req)
+}
+
+// RefreshSession calls orchestrator.v1.AuthService.RefreshSession.
+func (c *authServiceClient) RefreshSession(ctx context.Context, req *connect.Request[v1.RefreshSessionRequest]) (*connect.Response[v1.RefreshSessionResponse], error) {
+	return c.refreshSession.CallUnary(ctx, req)
+}
+
+// GetCurrentUser calls orchestrator.v1.AuthService.GetCurrentUser.
+func (c *authServiceClient) GetCurrentUser(ctx context.Context, req *connect.Request[v1.GetCurrentUserRequest]) (*connect.Response[v1.GetCurrentUserResponse], error) {
+	return c.getCurrentUser.CallUnary(ctx, req)
+}
+
+// ChangePassword calls orchestrator.v1.AuthService.ChangePassword.
+func (c *authServiceClient) ChangePassword(ctx context.Context, req *connect.Request[v1.ChangePasswordRequest]) (*connect.Response[v1.ChangePasswordResponse], error) {
+	return c.changePassword.CallUnary(ctx, req)
+}
+
+// RequestPasswordReset calls orchestrator.v1.AuthService.RequestPasswordReset.
+func (c *authServiceClient) RequestPasswordReset(ctx context.Context, req *connect.Request[v1.RequestPasswordResetRequest]) (*connect.Response[v1.RequestPasswordResetResponse], error) {
+	return c.requestPasswordReset.CallUnary(ctx, req)
+}
+
+// ResetPassword calls orchestrator.v1.AuthService.ResetPassword.
+func (c *authServiceClient) ResetPassword(ctx context.Context, req *connect.Request[v1.ResetPasswordRequest]) (*connect.Response[v1.ResetPasswordResponse], error) {
+	return c.resetPassword.CallUnary(ctx, req)
+}
+
+// VerifyEmail calls orchestrator.v1.AuthService.VerifyEmail.
+func (c *authServiceClient) VerifyEmail(ctx context.Context, req *connect.Request[v1.VerifyEmailRequest]) (*connect.Response[v1.VerifyEmailResponse], error) {
+	return c.verifyEmail.CallUnary(ctx, req)
+}
+
+// ResendVerificationEmail calls orchestrator.v1.AuthService.ResendVerificationEmail.
+func (c *authServiceClient) ResendVerificationEmail(ctx context.Context, req *connect.Request[v1.ResendVerificationEmailRequest]) (*connect.Response[v1.ResendVerificationEmailResponse], error) {
+	return c.resendVerificationEmail.CallUnary(ctx, req)
+}
+
+// UnlockAccount calls orchestrator.v1.AuthService.UnlockAccount.
+func (c *authServiceClient) UnlockAccount(ctx context.Context, req *connect.Request[v1.UnlockAccountRequest]) (*connect.Response[v1.UnlockAccountResponse], error) {
+	return c.unlockAccount.CallUnary(ctx, req)
+}
+
+// AdminUnlockUser calls orchestrator.v1.AuthService.AdminUnlockUser.
+func (c *authServiceClient) AdminUnlockUser(ctx context.Context, req *connect.Request[v1.AdminUnlockUserRequest]) (*connect.Response[v1.AdminUnlockUserResponse], error) {
+	return c.adminUnlockUser.CallUnary(ctx, req)
+}
+
+// AdminVerifyUserEmail calls orchestrator.v1.AuthService.AdminVerifyUserEmail.
+func (c *authServiceClient) AdminVerifyUserEmail(ctx context.Context, req *connect.Request[v1.AdminVerifyUserEmailRequest]) (*connect.Response[v1.AdminVerifyUserEmailResponse], error) {
+	return c.adminVerifyUserEmail.CallUnary(ctx, req)
+}
+
+// SetupTOTP calls orchestrator.v1.AuthService.SetupTOTP.
+func (c *authServiceClient) SetupTOTP(ctx context.Context, req *connect.Request[v1.SetupTOTPRequest]) (*connect.Response[v1.SetupTOTPResponse], error) {
+	return c.setupTOTP.CallUnary(ctx, req)
+}
+
+// EnableTOTP calls orchestrator.v1.AuthService.EnableTOTP.
+func (c *authServiceClient) EnableTOTP(ctx context.Context, req *connect.Request[v1.EnableTOTPRequest]) (*connect.Response[v1.EnableTOTPResponse], error) {
+	return c.enableTOTP.CallUnary(ctx, req)
+}
+
+// DisableTOTP calls orchestrator.v1.AuthService.DisableTOTP.
+func (c *authServiceClient) DisableTOTP(ctx context.Context, req *connect.Request[v1.DisableTOTPRequest]) (*connect.Response[v1.DisableTOTPResponse], error) {
+	return c.disableTOTP.CallUnary(ctx, req)
+}
+
+// VerifyLoginTOTP calls orchestrator.v1.AuthService.VerifyLoginTOTP.
+func (c *authServiceClient) VerifyLoginTOTP(ctx context.Context, req *connect.Request[v1.VerifyLoginTOTPRequest]) (*connect.Response[v1.VerifyLoginTOTPResponse], error) {
+	return c.verifyLoginTOTP.CallUnary(ctx, req)
+}
+
+// GetTOTPStatus calls orchestrator.v1.AuthService.GetTOTPStatus.
+func (c *authServiceClient) GetTOTPStatus(ctx context.Context, req *connect.Request[v1.GetTOTPStatusRequest]) (*connect.Response[v1.GetTOTPStatusResponse], error) {
+	return c.getTOTPStatus.CallUnary(ctx, req)
+}
+
+// RegenerateBackupCodes calls orchestrator.v1.AuthService.RegenerateBackupCodes.
+func (c *authServiceClient) RegenerateBackupCodes(ctx context.Context, req *connect.Request[v1.RegenerateBackupCodesRequest]) (*connect.Response[v1.RegenerateBackupCodesResponse], error) {
+	return c.regenerateBackupCodes.CallUnary(ctx, req)
+}
+
+// DismissTOTPPrompt calls orchestrator.v1.AuthService.DismissTOTPPrompt.
+func (c *authServiceClient) DismissTOTPPrompt(ctx context.Context, req *connect.Request[v1.DismissTOTPPromptRequest]) (*connect.Response[v1.DismissTOTPPromptResponse], error) {
+	return c.dismissTOTPPrompt.CallUnary(ctx, req)
+}
+
+// AuthServiceHandler is an implementation of the orchestrator.v1.AuthService service.
+type AuthServiceHandler interface {
+	// Login with email and password
+	Login(context.Context, *connect.Request[v1.LoginRequest]) (*connect.Response[v1.LoginResponse], error)
+	// Logout and clear session
+	Logout(context.Context, *connect.Request[v1.LogoutRequest]) (*connect.Response[v1.LogoutResponse], error)
+	// Register a new user
+	Register(context.Context, *connect.Request[v1.RegisterRequest]) (*connect.Response[v1.RegisterResponse], error)
+	// Refresh the session
+	RefreshSession(context.Context, *connect.Request[v1.RefreshSessionRequest]) (*connect.Response[v1.RefreshSessionResponse], error)
+	// Get the current user
+	GetCurrentUser(context.Context, *connect.Request[v1.GetCurrentUserRequest]) (*connect.Response[v1.GetCurrentUserResponse], error)
+	// Change password
+	ChangePassword(context.Context, *connect.Request[v1.ChangePasswordRequest]) (*connect.Response[v1.ChangePasswordResponse], error)
+	// Request password reset
+	RequestPasswordReset(context.Context, *connect.Request[v1.RequestPasswordResetRequest]) (*connect.Response[v1.RequestPasswordResetResponse], error)
+	// Reset password with token
+	ResetPassword(context.Context, *connect.Request[v1.ResetPasswordRequest]) (*connect.Response[v1.ResetPasswordResponse], error)
+	// Verify email with token
+	VerifyEmail(context.Context, *connect.Request[v1.VerifyEmailRequest]) (*connect.Response[v1.VerifyEmailResponse], error)
+	// Resend verification email (rate-limited)
+	ResendVerificationEmail(context.Context, *connect.Request[v1.ResendVerificationEmailRequest]) (*connect.Response[v1.ResendVerificationEmailResponse], error)
+	// Account unlock (magic link)
+	UnlockAccount(context.Context, *connect.Request[v1.UnlockAccountRequest]) (*connect.Response[v1.UnlockAccountResponse], error)
+	// Admin: Unlock a user's account (superadmin only)
+	AdminUnlockUser(context.Context, *connect.Request[v1.AdminUnlockUserRequest]) (*connect.Response[v1.AdminUnlockUserResponse], error)
+	// Admin: Manually verify a user's email (superadmin only)
+	AdminVerifyUserEmail(context.Context, *connect.Request[v1.AdminVerifyUserEmailRequest]) (*connect.Response[v1.AdminVerifyUserEmailResponse], error)
+	// TOTP Two-Factor Authentication
+	// Setup TOTP - generates secret and QR code
+	SetupTOTP(context.Context, *connect.Request[v1.SetupTOTPRequest]) (*connect.Response[v1.SetupTOTPResponse], error)
+	// Enable TOTP - verifies the code and enables 2FA
+	EnableTOTP(context.Context, *connect.Request[v1.EnableTOTPRequest]) (*connect.Response[v1.EnableTOTPResponse], error)
+	// Disable TOTP - requires password verification
+	DisableTOTP(context.Context, *connect.Request[v1.DisableTOTPRequest]) (*connect.Response[v1.DisableTOTPResponse], error)
+	// Verify login TOTP - second step after password verification
+	VerifyLoginTOTP(context.Context, *connect.Request[v1.VerifyLoginTOTPRequest]) (*connect.Response[v1.VerifyLoginTOTPResponse], error)
+	// Get TOTP status - check if 2FA is enabled
+	GetTOTPStatus(context.Context, *connect.Request[v1.GetTOTPStatusRequest]) (*connect.Response[v1.GetTOTPStatusResponse], error)
+	// Regenerate backup codes - requires password verification
+	RegenerateBackupCodes(context.Context, *connect.Request[v1.RegenerateBackupCodesRequest]) (*connect.Response[v1.RegenerateBackupCodesResponse], error)
+	// Dismiss the TOTP enrollment prompt for 7 days
+	DismissTOTPPrompt(context.Context, *connect.Request[v1.DismissTOTPPromptRequest]) (*connect.Response[v1.DismissTOTPPromptResponse], error)
+}
+
+// NewAuthServiceHandler builds an HTTP handler from the service implementation. It returns the path
+// on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewAuthServiceHandler(svc AuthServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	authServiceMethods := v1.File_orchestrator_v1_auth_proto.Services().ByName("AuthService").Methods()
+	authServiceLoginHandler := connect.NewUnaryHandler(
+		AuthServiceLoginProcedure,
+		svc.Login,
+		connect.WithSchema(authServiceMethods.ByName("Login")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceLogoutHandler := connect.NewUnaryHandler(
+		AuthServiceLogoutProcedure,
+		svc.Logout,
+		connect.WithSchema(authServiceMethods.ByName("Logout")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceRegisterHandler := connect.NewUnaryHandler(
+		AuthServiceRegisterProcedure,
+		svc.Register,
+		connect.WithSchema(authServiceMethods.ByName("Register")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceRefreshSessionHandler := connect.NewUnaryHandler(
+		AuthServiceRefreshSessionProcedure,
+		svc.RefreshSession,
+		connect.WithSchema(authServiceMethods.ByName("RefreshSession")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceGetCurrentUserHandler := connect.NewUnaryHandler(
+		AuthServiceGetCurrentUserProcedure,
+		svc.GetCurrentUser,
+		connect.WithSchema(authServiceMethods.ByName("GetCurrentUser")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceChangePasswordHandler := connect.NewUnaryHandler(
+		AuthServiceChangePasswordProcedure,
+		svc.ChangePassword,
+		connect.WithSchema(authServiceMethods.ByName("ChangePassword")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceRequestPasswordResetHandler := connect.NewUnaryHandler(
+		AuthServiceRequestPasswordResetProcedure,
+		svc.RequestPasswordReset,
+		connect.WithSchema(authServiceMethods.ByName("RequestPasswordReset")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceResetPasswordHandler := connect.NewUnaryHandler(
+		AuthServiceResetPasswordProcedure,
+		svc.ResetPassword,
+		connect.WithSchema(authServiceMethods.ByName("ResetPassword")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceVerifyEmailHandler := connect.NewUnaryHandler(
+		AuthServiceVerifyEmailProcedure,
+		svc.VerifyEmail,
+		connect.WithSchema(authServiceMethods.ByName("VerifyEmail")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceResendVerificationEmailHandler := connect.NewUnaryHandler(
+		AuthServiceResendVerificationEmailProcedure,
+		svc.ResendVerificationEmail,
+		connect.WithSchema(authServiceMethods.ByName("ResendVerificationEmail")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceUnlockAccountHandler := connect.NewUnaryHandler(
+		AuthServiceUnlockAccountProcedure,
+		svc.UnlockAccount,
+		connect.WithSchema(authServiceMethods.ByName("UnlockAccount")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceAdminUnlockUserHandler := connect.NewUnaryHandler(
+		AuthServiceAdminUnlockUserProcedure,
+		svc.AdminUnlockUser,
+		connect.WithSchema(authServiceMethods.ByName("AdminUnlockUser")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceAdminVerifyUserEmailHandler := connect.NewUnaryHandler(
+		AuthServiceAdminVerifyUserEmailProcedure,
+		svc.AdminVerifyUserEmail,
+		connect.WithSchema(authServiceMethods.ByName("AdminVerifyUserEmail")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceSetupTOTPHandler := connect.NewUnaryHandler(
+		AuthServiceSetupTOTPProcedure,
+		svc.SetupTOTP,
+		connect.WithSchema(authServiceMethods.ByName("SetupTOTP")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceEnableTOTPHandler := connect.NewUnaryHandler(
+		AuthServiceEnableTOTPProcedure,
+		svc.EnableTOTP,
+		connect.WithSchema(authServiceMethods.ByName("EnableTOTP")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceDisableTOTPHandler := connect.NewUnaryHandler(
+		AuthServiceDisableTOTPProcedure,
+		svc.DisableTOTP,
+		connect.WithSchema(authServiceMethods.ByName("DisableTOTP")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceVerifyLoginTOTPHandler := connect.NewUnaryHandler(
+		AuthServiceVerifyLoginTOTPProcedure,
+		svc.VerifyLoginTOTP,
+		connect.WithSchema(authServiceMethods.ByName("VerifyLoginTOTP")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceGetTOTPStatusHandler := connect.NewUnaryHandler(
+		AuthServiceGetTOTPStatusProcedure,
+		svc.GetTOTPStatus,
+		connect.WithSchema(authServiceMethods.ByName("GetTOTPStatus")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceRegenerateBackupCodesHandler := connect.NewUnaryHandler(
+		AuthServiceRegenerateBackupCodesProcedure,
+		svc.RegenerateBackupCodes,
+		connect.WithSchema(authServiceMethods.ByName("RegenerateBackupCodes")),
+		connect.WithHandlerOptions(opts...),
+	)
+	authServiceDismissTOTPPromptHandler := connect.NewUnaryHandler(
+		AuthServiceDismissTOTPPromptProcedure,
+		svc.DismissTOTPPrompt,
+		connect.WithSchema(authServiceMethods.ByName("DismissTOTPPrompt")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/orchestrator.v1.AuthService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case AuthServiceLoginProcedure:
+			authServiceLoginHandler.ServeHTTP(w, r)
+		case AuthServiceLogoutProcedure:
+			authServiceLogoutHandler.ServeHTTP(w, r)
+		case AuthServiceRegisterProcedure:
+			authServiceRegisterHandler.ServeHTTP(w, r)
+		case AuthServiceRefreshSessionProcedure:
+			authServiceRefreshSessionHandler.ServeHTTP(w, r)
+		case AuthServiceGetCurrentUserProcedure:
+			authServiceGetCurrentUserHandler.ServeHTTP(w, r)
+		case AuthServiceChangePasswordProcedure:
+			authServiceChangePasswordHandler.ServeHTTP(w, r)
+		case AuthServiceRequestPasswordResetProcedure:
+			authServiceRequestPasswordResetHandler.ServeHTTP(w, r)
+		case AuthServiceResetPasswordProcedure:
+			authServiceResetPasswordHandler.ServeHTTP(w, r)
+		case AuthServiceVerifyEmailProcedure:
+			authServiceVerifyEmailHandler.ServeHTTP(w, r)
+		case AuthServiceResendVerificationEmailProcedure:
+			authServiceResendVerificationEmailHandler.ServeHTTP(w, r)
+		case AuthServiceUnlockAccountProcedure:
+			authServiceUnlockAccountHandler.ServeHTTP(w, r)
+		case AuthServiceAdminUnlockUserProcedure:
+			authServiceAdminUnlockUserHandler.ServeHTTP(w, r)
+		case AuthServiceAdminVerifyUserEmailProcedure:
+			authServiceAdminVerifyUserEmailHandler.ServeHTTP(w, r)
+		case AuthServiceSetupTOTPProcedure:
+			authServiceSetupTOTPHandler.ServeHTTP(w, r)
+		case AuthServiceEnableTOTPProcedure:
+			authServiceEnableTOTPHandler.ServeHTTP(w, r)
+		case AuthServiceDisableTOTPProcedure:
+			authServiceDisableTOTPHandler.ServeHTTP(w, r)
+		case AuthServiceVerifyLoginTOTPProcedure:
+			authServiceVerifyLoginTOTPHandler.ServeHTTP(w, r)
+		case AuthServiceGetTOTPStatusProcedure:
+			authServiceGetTOTPStatusHandler.ServeHTTP(w, r)
+		case AuthServiceRegenerateBackupCodesProcedure:
+			authServiceRegenerateBackupCodesHandler.ServeHTTP(w, r)
+		case AuthServiceDismissTOTPPromptProcedure:
+			authServiceDismissTOTPPromptHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedAuthServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedAuthServiceHandler struct{}
+
+func (UnimplementedAuthServiceHandler) Login(context.Context, *connect.Request[v1.LoginRequest]) (*connect.Response[v1.LoginResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.Login is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) Logout(context.Context, *connect.Request[v1.LogoutRequest]) (*connect.Response[v1.LogoutResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.Logout is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) Register(context.Context, *connect.Request[v1.RegisterRequest]) (*connect.Response[v1.RegisterResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.Register is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) RefreshSession(context.Context, *connect.Request[v1.RefreshSessionRequest]) (*connect.Response[v1.RefreshSessionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.RefreshSession is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) GetCurrentUser(context.Context, *connect.Request[v1.GetCurrentUserRequest]) (*connect.Response[v1.GetCurrentUserResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.GetCurrentUser is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) ChangePassword(context.Context, *connect.Request[v1.ChangePasswordRequest]) (*connect.Response[v1.ChangePasswordResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.ChangePassword is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) RequestPasswordReset(context.Context, *connect.Request[v1.RequestPasswordResetRequest]) (*connect.Response[v1.RequestPasswordResetResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.RequestPasswordReset is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) ResetPassword(context.Context, *connect.Request[v1.ResetPasswordRequest]) (*connect.Response[v1.ResetPasswordResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.ResetPassword is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) VerifyEmail(context.Context, *connect.Request[v1.VerifyEmailRequest]) (*connect.Response[v1.VerifyEmailResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.VerifyEmail is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) ResendVerificationEmail(context.Context, *connect.Request[v1.ResendVerificationEmailRequest]) (*connect.Response[v1.ResendVerificationEmailResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.ResendVerificationEmail is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) UnlockAccount(context.Context, *connect.Request[v1.UnlockAccountRequest]) (*connect.Response[v1.UnlockAccountResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.UnlockAccount is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) AdminUnlockUser(context.Context, *connect.Request[v1.AdminUnlockUserRequest]) (*connect.Response[v1.AdminUnlockUserResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.AdminUnlockUser is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) AdminVerifyUserEmail(context.Context, *connect.Request[v1.AdminVerifyUserEmailRequest]) (*connect.Response[v1.AdminVerifyUserEmailResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.AdminVerifyUserEmail is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) SetupTOTP(context.Context, *connect.Request[v1.SetupTOTPRequest]) (*connect.Response[v1.SetupTOTPResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.SetupTOTP is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) EnableTOTP(context.Context, *connect.Request[v1.EnableTOTPRequest]) (*connect.Response[v1.EnableTOTPResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.EnableTOTP is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) DisableTOTP(context.Context, *connect.Request[v1.DisableTOTPRequest]) (*connect.Response[v1.DisableTOTPResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.DisableTOTP is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) VerifyLoginTOTP(context.Context, *connect.Request[v1.VerifyLoginTOTPRequest]) (*connect.Response[v1.VerifyLoginTOTPResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.VerifyLoginTOTP is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) GetTOTPStatus(context.Context, *connect.Request[v1.GetTOTPStatusRequest]) (*connect.Response[v1.GetTOTPStatusResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.GetTOTPStatus is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) RegenerateBackupCodes(context.Context, *connect.Request[v1.RegenerateBackupCodesRequest]) (*connect.Response[v1.RegenerateBackupCodesResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.RegenerateBackupCodes is not implemented"))
+}
+
+func (UnimplementedAuthServiceHandler) DismissTOTPPrompt(context.Context, *connect.Request[v1.DismissTOTPPromptRequest]) (*connect.Response[v1.DismissTOTPPromptResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.AuthService.DismissTOTPPrompt is not implemented"))
+}

internal/api/orchestrator/v1/orchestratorv1connect/billing.connect.go

@@ -0,0 +1,853 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: orchestrator/v1/billing.proto
+
+package orchestratorv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "git.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// BillingServiceName is the fully-qualified name of the BillingService service.
+	BillingServiceName = "orchestrator.v1.BillingService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// BillingServiceListPlansProcedure is the fully-qualified name of the BillingService's ListPlans
+	// RPC.
+	BillingServiceListPlansProcedure = "/orchestrator.v1.BillingService/ListPlans"
+	// BillingServiceListPublicPlansProcedure is the fully-qualified name of the BillingService's
+	// ListPublicPlans RPC.
+	BillingServiceListPublicPlansProcedure = "/orchestrator.v1.BillingService/ListPublicPlans"
+	// BillingServiceGetSubscriptionProcedure is the fully-qualified name of the BillingService's
+	// GetSubscription RPC.
+	BillingServiceGetSubscriptionProcedure = "/orchestrator.v1.BillingService/GetSubscription"
+	// BillingServiceListAccountSubscriptionsProcedure is the fully-qualified name of the
+	// BillingService's ListAccountSubscriptions RPC.
+	BillingServiceListAccountSubscriptionsProcedure = "/orchestrator.v1.BillingService/ListAccountSubscriptions"
+	// BillingServiceCreateSubscriptionProcedure is the fully-qualified name of the BillingService's
+	// CreateSubscription RPC.
+	BillingServiceCreateSubscriptionProcedure = "/orchestrator.v1.BillingService/CreateSubscription"
+	// BillingServiceChangePlanProcedure is the fully-qualified name of the BillingService's ChangePlan
+	// RPC.
+	BillingServiceChangePlanProcedure = "/orchestrator.v1.BillingService/ChangePlan"
+	// BillingServiceCancelSubscriptionProcedure is the fully-qualified name of the BillingService's
+	// CancelSubscription RPC.
+	BillingServiceCancelSubscriptionProcedure = "/orchestrator.v1.BillingService/CancelSubscription"
+	// BillingServiceTerminateSubscriptionProcedure is the fully-qualified name of the BillingService's
+	// TerminateSubscription RPC.
+	BillingServiceTerminateSubscriptionProcedure = "/orchestrator.v1.BillingService/TerminateSubscription"
+	// BillingServiceListInvoicesProcedure is the fully-qualified name of the BillingService's
+	// ListInvoices RPC.
+	BillingServiceListInvoicesProcedure = "/orchestrator.v1.BillingService/ListInvoices"
+	// BillingServiceGetInvoiceProcedure is the fully-qualified name of the BillingService's GetInvoice
+	// RPC.
+	BillingServiceGetInvoiceProcedure = "/orchestrator.v1.BillingService/GetInvoice"
+	// BillingServiceGetUsageProcedure is the fully-qualified name of the BillingService's GetUsage RPC.
+	BillingServiceGetUsageProcedure = "/orchestrator.v1.BillingService/GetUsage"
+	// BillingServiceRecordUsageProcedure is the fully-qualified name of the BillingService's
+	// RecordUsage RPC.
+	BillingServiceRecordUsageProcedure = "/orchestrator.v1.BillingService/RecordUsage"
+	// BillingServiceGetInstanceCapabilitiesProcedure is the fully-qualified name of the
+	// BillingService's GetInstanceCapabilities RPC.
+	BillingServiceGetInstanceCapabilitiesProcedure = "/orchestrator.v1.BillingService/GetInstanceCapabilities"
+	// BillingServiceEnableFeatureProcedure is the fully-qualified name of the BillingService's
+	// EnableFeature RPC.
+	BillingServiceEnableFeatureProcedure = "/orchestrator.v1.BillingService/EnableFeature"
+	// BillingServiceDisableFeatureProcedure is the fully-qualified name of the BillingService's
+	// DisableFeature RPC.
+	BillingServiceDisableFeatureProcedure = "/orchestrator.v1.BillingService/DisableFeature"
+	// BillingServiceUpdatePlanFeaturesProcedure is the fully-qualified name of the BillingService's
+	// UpdatePlanFeatures RPC.
+	BillingServiceUpdatePlanFeaturesProcedure = "/orchestrator.v1.BillingService/UpdatePlanFeatures"
+	// BillingServiceListAvailableFeaturesProcedure is the fully-qualified name of the BillingService's
+	// ListAvailableFeatures RPC.
+	BillingServiceListAvailableFeaturesProcedure = "/orchestrator.v1.BillingService/ListAvailableFeatures"
+	// BillingServiceGetPlanProcedure is the fully-qualified name of the BillingService's GetPlan RPC.
+	BillingServiceGetPlanProcedure = "/orchestrator.v1.BillingService/GetPlan"
+	// BillingServiceCreatePlanProcedure is the fully-qualified name of the BillingService's CreatePlan
+	// RPC.
+	BillingServiceCreatePlanProcedure = "/orchestrator.v1.BillingService/CreatePlan"
+	// BillingServiceUpdatePlanProcedure is the fully-qualified name of the BillingService's UpdatePlan
+	// RPC.
+	BillingServiceUpdatePlanProcedure = "/orchestrator.v1.BillingService/UpdatePlan"
+	// BillingServiceDeletePlanProcedure is the fully-qualified name of the BillingService's DeletePlan
+	// RPC.
+	BillingServiceDeletePlanProcedure = "/orchestrator.v1.BillingService/DeletePlan"
+	// BillingServiceGetPlanDeletionImpactProcedure is the fully-qualified name of the BillingService's
+	// GetPlanDeletionImpact RPC.
+	BillingServiceGetPlanDeletionImpactProcedure = "/orchestrator.v1.BillingService/GetPlanDeletionImpact"
+	// BillingServiceGetPaymentCheckoutURLProcedure is the fully-qualified name of the BillingService's
+	// GetPaymentCheckoutURL RPC.
+	BillingServiceGetPaymentCheckoutURLProcedure = "/orchestrator.v1.BillingService/GetPaymentCheckoutURL"
+	// BillingServiceHasPaymentMethodProcedure is the fully-qualified name of the BillingService's
+	// HasPaymentMethod RPC.
+	BillingServiceHasPaymentMethodProcedure = "/orchestrator.v1.BillingService/HasPaymentMethod"
+	// BillingServiceGetStripeConfigProcedure is the fully-qualified name of the BillingService's
+	// GetStripeConfig RPC.
+	BillingServiceGetStripeConfigProcedure = "/orchestrator.v1.BillingService/GetStripeConfig"
+)
+
+// BillingServiceClient is a client for the orchestrator.v1.BillingService service.
+type BillingServiceClient interface {
+	// List available plans (authenticated)
+	ListPlans(context.Context, *connect.Request[v1.ListPlansRequest]) (*connect.Response[v1.ListPlansResponse], error)
+	// List public plans for pricing page (no auth required)
+	ListPublicPlans(context.Context, *connect.Request[v1.ListPublicPlansRequest]) (*connect.Response[v1.ListPublicPlansResponse], error)
+	// Get the current subscription for an instance
+	GetSubscription(context.Context, *connect.Request[v1.GetSubscriptionRequest]) (*connect.Response[v1.GetSubscriptionResponse], error)
+	// List all subscriptions for an account (billing overview)
+	ListAccountSubscriptions(context.Context, *connect.Request[v1.ListAccountSubscriptionsRequest]) (*connect.Response[v1.ListAccountSubscriptionsResponse], error)
+	// Create a new subscription for an instance
+	CreateSubscription(context.Context, *connect.Request[v1.CreateSubscriptionRequest]) (*connect.Response[v1.CreateSubscriptionResponse], error)
+	// Change subscription plan for an instance
+	ChangePlan(context.Context, *connect.Request[v1.ChangePlanRequest]) (*connect.Response[v1.ChangePlanResponse], error)
+	// Cancel subscription (terminates at period end)
+	CancelSubscription(context.Context, *connect.Request[v1.CancelSubscriptionRequest]) (*connect.Response[v1.CancelSubscriptionResponse], error)
+	// Terminate subscription immediately
+	TerminateSubscription(context.Context, *connect.Request[v1.TerminateSubscriptionRequest]) (*connect.Response[v1.TerminateSubscriptionResponse], error)
+	// List invoices for an account (consolidated billing)
+	ListInvoices(context.Context, *connect.Request[v1.ListInvoicesRequest]) (*connect.Response[v1.ListInvoicesResponse], error)
+	// Get invoice details
+	GetInvoice(context.Context, *connect.Request[v1.GetInvoiceRequest]) (*connect.Response[v1.GetInvoiceResponse], error)
+	// Get current usage metrics for an instance
+	GetUsage(context.Context, *connect.Request[v1.GetUsageRequest]) (*connect.Response[v1.GetUsageResponse], error)
+	// Record a usage event (for internal use by instance service)
+	RecordUsage(context.Context, *connect.Request[v1.RecordUsageRequest]) (*connect.Response[v1.RecordUsageResponse], error)
+	// Get capabilities for an instance (what the plan includes + what's activated)
+	GetInstanceCapabilities(context.Context, *connect.Request[v1.GetInstanceCapabilitiesRequest]) (*connect.Response[v1.GetInstanceCapabilitiesResponse], error)
+	// Enable a sidecar feature (e.g., search) - provisions the sidecar container
+	EnableFeature(context.Context, *connect.Request[v1.EnableFeatureRequest]) (*connect.Response[v1.EnableFeatureResponse], error)
+	// Disable a sidecar feature - deprovisions the sidecar container
+	DisableFeature(context.Context, *connect.Request[v1.DisableFeatureRequest]) (*connect.Response[v1.DisableFeatureResponse], error)
+	// Update features for a plan (superadmin only)
+	UpdatePlanFeatures(context.Context, *connect.Request[v1.UpdatePlanFeaturesRequest]) (*connect.Response[v1.UpdatePlanFeaturesResponse], error)
+	// List all available feature keys (for admin UI)
+	ListAvailableFeatures(context.Context, *connect.Request[v1.ListAvailableFeaturesRequest]) (*connect.Response[v1.ListAvailableFeaturesResponse], error)
+	// Get a single plan by ID
+	GetPlan(context.Context, *connect.Request[v1.GetPlanRequest]) (*connect.Response[v1.GetPlanResponse], error)
+	// Create a new plan
+	CreatePlan(context.Context, *connect.Request[v1.CreatePlanRequest]) (*connect.Response[v1.CreatePlanResponse], error)
+	// Update an existing plan (full update with all fields)
+	UpdatePlan(context.Context, *connect.Request[v1.UpdatePlanRequest]) (*connect.Response[v1.UpdatePlanResponse], error)
+	// Delete a plan (soft delete - deactivate)
+	DeletePlan(context.Context, *connect.Request[v1.DeletePlanRequest]) (*connect.Response[v1.DeletePlanResponse], error)
+	// Get plan deletion impact (count affected subscriptions)
+	GetPlanDeletionImpact(context.Context, *connect.Request[v1.GetPlanDeletionImpactRequest]) (*connect.Response[v1.GetPlanDeletionImpactResponse], error)
+	// Get a checkout URL for adding/updating payment methods
+	GetPaymentCheckoutURL(context.Context, *connect.Request[v1.GetPaymentCheckoutURLRequest]) (*connect.Response[v1.GetPaymentCheckoutURLResponse], error)
+	// Check if an account has a payment method configured
+	HasPaymentMethod(context.Context, *connect.Request[v1.HasPaymentMethodRequest]) (*connect.Response[v1.HasPaymentMethodResponse], error)
+	// Get the Stripe publishable key for frontend use
+	GetStripeConfig(context.Context, *connect.Request[v1.GetStripeConfigRequest]) (*connect.Response[v1.GetStripeConfigResponse], error)
+}
+
+// NewBillingServiceClient constructs a client for the orchestrator.v1.BillingService service. By
+// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
+// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewBillingServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) BillingServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	billingServiceMethods := v1.File_orchestrator_v1_billing_proto.Services().ByName("BillingService").Methods()
+	return &billingServiceClient{
+		listPlans: connect.NewClient[v1.ListPlansRequest, v1.ListPlansResponse](
+			httpClient,
+			baseURL+BillingServiceListPlansProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("ListPlans")),
+			connect.WithClientOptions(opts...),
+		),
+		listPublicPlans: connect.NewClient[v1.ListPublicPlansRequest, v1.ListPublicPlansResponse](
+			httpClient,
+			baseURL+BillingServiceListPublicPlansProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("ListPublicPlans")),
+			connect.WithClientOptions(opts...),
+		),
+		getSubscription: connect.NewClient[v1.GetSubscriptionRequest, v1.GetSubscriptionResponse](
+			httpClient,
+			baseURL+BillingServiceGetSubscriptionProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("GetSubscription")),
+			connect.WithClientOptions(opts...),
+		),
+		listAccountSubscriptions: connect.NewClient[v1.ListAccountSubscriptionsRequest, v1.ListAccountSubscriptionsResponse](
+			httpClient,
+			baseURL+BillingServiceListAccountSubscriptionsProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("ListAccountSubscriptions")),
+			connect.WithClientOptions(opts...),
+		),
+		createSubscription: connect.NewClient[v1.CreateSubscriptionRequest, v1.CreateSubscriptionResponse](
+			httpClient,
+			baseURL+BillingServiceCreateSubscriptionProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("CreateSubscription")),
+			connect.WithClientOptions(opts...),
+		),
+		changePlan: connect.NewClient[v1.ChangePlanRequest, v1.ChangePlanResponse](
+			httpClient,
+			baseURL+BillingServiceChangePlanProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("ChangePlan")),
+			connect.WithClientOptions(opts...),
+		),
+		cancelSubscription: connect.NewClient[v1.CancelSubscriptionRequest, v1.CancelSubscriptionResponse](
+			httpClient,
+			baseURL+BillingServiceCancelSubscriptionProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("CancelSubscription")),
+			connect.WithClientOptions(opts...),
+		),
+		terminateSubscription: connect.NewClient[v1.TerminateSubscriptionRequest, v1.TerminateSubscriptionResponse](
+			httpClient,
+			baseURL+BillingServiceTerminateSubscriptionProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("TerminateSubscription")),
+			connect.WithClientOptions(opts...),
+		),
+		listInvoices: connect.NewClient[v1.ListInvoicesRequest, v1.ListInvoicesResponse](
+			httpClient,
+			baseURL+BillingServiceListInvoicesProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("ListInvoices")),
+			connect.WithClientOptions(opts...),
+		),
+		getInvoice: connect.NewClient[v1.GetInvoiceRequest, v1.GetInvoiceResponse](
+			httpClient,
+			baseURL+BillingServiceGetInvoiceProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("GetInvoice")),
+			connect.WithClientOptions(opts...),
+		),
+		getUsage: connect.NewClient[v1.GetUsageRequest, v1.GetUsageResponse](
+			httpClient,
+			baseURL+BillingServiceGetUsageProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("GetUsage")),
+			connect.WithClientOptions(opts...),
+		),
+		recordUsage: connect.NewClient[v1.RecordUsageRequest, v1.RecordUsageResponse](
+			httpClient,
+			baseURL+BillingServiceRecordUsageProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("RecordUsage")),
+			connect.WithClientOptions(opts...),
+		),
+		getInstanceCapabilities: connect.NewClient[v1.GetInstanceCapabilitiesRequest, v1.GetInstanceCapabilitiesResponse](
+			httpClient,
+			baseURL+BillingServiceGetInstanceCapabilitiesProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("GetInstanceCapabilities")),
+			connect.WithClientOptions(opts...),
+		),
+		enableFeature: connect.NewClient[v1.EnableFeatureRequest, v1.EnableFeatureResponse](
+			httpClient,
+			baseURL+BillingServiceEnableFeatureProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("EnableFeature")),
+			connect.WithClientOptions(opts...),
+		),
+		disableFeature: connect.NewClient[v1.DisableFeatureRequest, v1.DisableFeatureResponse](
+			httpClient,
+			baseURL+BillingServiceDisableFeatureProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("DisableFeature")),
+			connect.WithClientOptions(opts...),
+		),
+		updatePlanFeatures: connect.NewClient[v1.UpdatePlanFeaturesRequest, v1.UpdatePlanFeaturesResponse](
+			httpClient,
+			baseURL+BillingServiceUpdatePlanFeaturesProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("UpdatePlanFeatures")),
+			connect.WithClientOptions(opts...),
+		),
+		listAvailableFeatures: connect.NewClient[v1.ListAvailableFeaturesRequest, v1.ListAvailableFeaturesResponse](
+			httpClient,
+			baseURL+BillingServiceListAvailableFeaturesProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("ListAvailableFeatures")),
+			connect.WithClientOptions(opts...),
+		),
+		getPlan: connect.NewClient[v1.GetPlanRequest, v1.GetPlanResponse](
+			httpClient,
+			baseURL+BillingServiceGetPlanProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("GetPlan")),
+			connect.WithClientOptions(opts...),
+		),
+		createPlan: connect.NewClient[v1.CreatePlanRequest, v1.CreatePlanResponse](
+			httpClient,
+			baseURL+BillingServiceCreatePlanProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("CreatePlan")),
+			connect.WithClientOptions(opts...),
+		),
+		updatePlan: connect.NewClient[v1.UpdatePlanRequest, v1.UpdatePlanResponse](
+			httpClient,
+			baseURL+BillingServiceUpdatePlanProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("UpdatePlan")),
+			connect.WithClientOptions(opts...),
+		),
+		deletePlan: connect.NewClient[v1.DeletePlanRequest, v1.DeletePlanResponse](
+			httpClient,
+			baseURL+BillingServiceDeletePlanProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("DeletePlan")),
+			connect.WithClientOptions(opts...),
+		),
+		getPlanDeletionImpact: connect.NewClient[v1.GetPlanDeletionImpactRequest, v1.GetPlanDeletionImpactResponse](
+			httpClient,
+			baseURL+BillingServiceGetPlanDeletionImpactProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("GetPlanDeletionImpact")),
+			connect.WithClientOptions(opts...),
+		),
+		getPaymentCheckoutURL: connect.NewClient[v1.GetPaymentCheckoutURLRequest, v1.GetPaymentCheckoutURLResponse](
+			httpClient,
+			baseURL+BillingServiceGetPaymentCheckoutURLProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("GetPaymentCheckoutURL")),
+			connect.WithClientOptions(opts...),
+		),
+		hasPaymentMethod: connect.NewClient[v1.HasPaymentMethodRequest, v1.HasPaymentMethodResponse](
+			httpClient,
+			baseURL+BillingServiceHasPaymentMethodProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("HasPaymentMethod")),
+			connect.WithClientOptions(opts...),
+		),
+		getStripeConfig: connect.NewClient[v1.GetStripeConfigRequest, v1.GetStripeConfigResponse](
+			httpClient,
+			baseURL+BillingServiceGetStripeConfigProcedure,
+			connect.WithSchema(billingServiceMethods.ByName("GetStripeConfig")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// billingServiceClient implements BillingServiceClient.
+type billingServiceClient struct {
+	listPlans                *connect.Client[v1.ListPlansRequest, v1.ListPlansResponse]
+	listPublicPlans          *connect.Client[v1.ListPublicPlansRequest, v1.ListPublicPlansResponse]
+	getSubscription          *connect.Client[v1.GetSubscriptionRequest, v1.GetSubscriptionResponse]
+	listAccountSubscriptions *connect.Client[v1.ListAccountSubscriptionsRequest, v1.ListAccountSubscriptionsResponse]
+	createSubscription       *connect.Client[v1.CreateSubscriptionRequest, v1.CreateSubscriptionResponse]
+	changePlan               *connect.Client[v1.ChangePlanRequest, v1.ChangePlanResponse]
+	cancelSubscription       *connect.Client[v1.CancelSubscriptionRequest, v1.CancelSubscriptionResponse]
+	terminateSubscription    *connect.Client[v1.TerminateSubscriptionRequest, v1.TerminateSubscriptionResponse]
+	listInvoices             *connect.Client[v1.ListInvoicesRequest, v1.ListInvoicesResponse]
+	getInvoice               *connect.Client[v1.GetInvoiceRequest, v1.GetInvoiceResponse]
+	getUsage                 *connect.Client[v1.GetUsageRequest, v1.GetUsageResponse]
+	recordUsage              *connect.Client[v1.RecordUsageRequest, v1.RecordUsageResponse]
+	getInstanceCapabilities  *connect.Client[v1.GetInstanceCapabilitiesRequest, v1.GetInstanceCapabilitiesResponse]
+	enableFeature            *connect.Client[v1.EnableFeatureRequest, v1.EnableFeatureResponse]
+	disableFeature           *connect.Client[v1.DisableFeatureRequest, v1.DisableFeatureResponse]
+	updatePlanFeatures       *connect.Client[v1.UpdatePlanFeaturesRequest, v1.UpdatePlanFeaturesResponse]
+	listAvailableFeatures    *connect.Client[v1.ListAvailableFeaturesRequest, v1.ListAvailableFeaturesResponse]
+	getPlan                  *connect.Client[v1.GetPlanRequest, v1.GetPlanResponse]
+	createPlan               *connect.Client[v1.CreatePlanRequest, v1.CreatePlanResponse]
+	updatePlan               *connect.Client[v1.UpdatePlanRequest, v1.UpdatePlanResponse]
+	deletePlan               *connect.Client[v1.DeletePlanRequest, v1.DeletePlanResponse]
+	getPlanDeletionImpact    *connect.Client[v1.GetPlanDeletionImpactRequest, v1.GetPlanDeletionImpactResponse]
+	getPaymentCheckoutURL    *connect.Client[v1.GetPaymentCheckoutURLRequest, v1.GetPaymentCheckoutURLResponse]
+	hasPaymentMethod         *connect.Client[v1.HasPaymentMethodRequest, v1.HasPaymentMethodResponse]
+	getStripeConfig          *connect.Client[v1.GetStripeConfigRequest, v1.GetStripeConfigResponse]
+}
+
+// ListPlans calls orchestrator.v1.BillingService.ListPlans.
+func (c *billingServiceClient) ListPlans(ctx context.Context, req *connect.Request[v1.ListPlansRequest]) (*connect.Response[v1.ListPlansResponse], error) {
+	return c.listPlans.CallUnary(ctx, req)
+}
+
+// ListPublicPlans calls orchestrator.v1.BillingService.ListPublicPlans.
+func (c *billingServiceClient) ListPublicPlans(ctx context.Context, req *connect.Request[v1.ListPublicPlansRequest]) (*connect.Response[v1.ListPublicPlansResponse], error) {
+	return c.listPublicPlans.CallUnary(ctx, req)
+}
+
+// GetSubscription calls orchestrator.v1.BillingService.GetSubscription.
+func (c *billingServiceClient) GetSubscription(ctx context.Context, req *connect.Request[v1.GetSubscriptionRequest]) (*connect.Response[v1.GetSubscriptionResponse], error) {
+	return c.getSubscription.CallUnary(ctx, req)
+}
+
+// ListAccountSubscriptions calls orchestrator.v1.BillingService.ListAccountSubscriptions.
+func (c *billingServiceClient) ListAccountSubscriptions(ctx context.Context, req *connect.Request[v1.ListAccountSubscriptionsRequest]) (*connect.Response[v1.ListAccountSubscriptionsResponse], error) {
+	return c.listAccountSubscriptions.CallUnary(ctx, req)
+}
+
+// CreateSubscription calls orchestrator.v1.BillingService.CreateSubscription.
+func (c *billingServiceClient) CreateSubscription(ctx context.Context, req *connect.Request[v1.CreateSubscriptionRequest]) (*connect.Response[v1.CreateSubscriptionResponse], error) {
+	return c.createSubscription.CallUnary(ctx, req)
+}
+
+// ChangePlan calls orchestrator.v1.BillingService.ChangePlan.
+func (c *billingServiceClient) ChangePlan(ctx context.Context, req *connect.Request[v1.ChangePlanRequest]) (*connect.Response[v1.ChangePlanResponse], error) {
+	return c.changePlan.CallUnary(ctx, req)
+}
+
+// CancelSubscription calls orchestrator.v1.BillingService.CancelSubscription.
+func (c *billingServiceClient) CancelSubscription(ctx context.Context, req *connect.Request[v1.CancelSubscriptionRequest]) (*connect.Response[v1.CancelSubscriptionResponse], error) {
+	return c.cancelSubscription.CallUnary(ctx, req)
+}
+
+// TerminateSubscription calls orchestrator.v1.BillingService.TerminateSubscription.
+func (c *billingServiceClient) TerminateSubscription(ctx context.Context, req *connect.Request[v1.TerminateSubscriptionRequest]) (*connect.Response[v1.TerminateSubscriptionResponse], error) {
+	return c.terminateSubscription.CallUnary(ctx, req)
+}
+
+// ListInvoices calls orchestrator.v1.BillingService.ListInvoices.
+func (c *billingServiceClient) ListInvoices(ctx context.Context, req *connect.Request[v1.ListInvoicesRequest]) (*connect.Response[v1.ListInvoicesResponse], error) {
+	return c.listInvoices.CallUnary(ctx, req)
+}
+
+// GetInvoice calls orchestrator.v1.BillingService.GetInvoice.
+func (c *billingServiceClient) GetInvoice(ctx context.Context, req *connect.Request[v1.GetInvoiceRequest]) (*connect.Response[v1.GetInvoiceResponse], error) {
+	return c.getInvoice.CallUnary(ctx, req)
+}
+
+// GetUsage calls orchestrator.v1.BillingService.GetUsage.
+func (c *billingServiceClient) GetUsage(ctx context.Context, req *connect.Request[v1.GetUsageRequest]) (*connect.Response[v1.GetUsageResponse], error) {
+	return c.getUsage.CallUnary(ctx, req)
+}
+
+// RecordUsage calls orchestrator.v1.BillingService.RecordUsage.
+func (c *billingServiceClient) RecordUsage(ctx context.Context, req *connect.Request[v1.RecordUsageRequest]) (*connect.Response[v1.RecordUsageResponse], error) {
+	return c.recordUsage.CallUnary(ctx, req)
+}
+
+// GetInstanceCapabilities calls orchestrator.v1.BillingService.GetInstanceCapabilities.
+func (c *billingServiceClient) GetInstanceCapabilities(ctx context.Context, req *connect.Request[v1.GetInstanceCapabilitiesRequest]) (*connect.Response[v1.GetInstanceCapabilitiesResponse], error) {
+	return c.getInstanceCapabilities.CallUnary(ctx, req)
+}
+
+// EnableFeature calls orchestrator.v1.BillingService.EnableFeature.
+func (c *billingServiceClient) EnableFeature(ctx context.Context, req *connect.Request[v1.EnableFeatureRequest]) (*connect.Response[v1.EnableFeatureResponse], error) {
+	return c.enableFeature.CallUnary(ctx, req)
+}
+
+// DisableFeature calls orchestrator.v1.BillingService.DisableFeature.
+func (c *billingServiceClient) DisableFeature(ctx context.Context, req *connect.Request[v1.DisableFeatureRequest]) (*connect.Response[v1.DisableFeatureResponse], error) {
+	return c.disableFeature.CallUnary(ctx, req)
+}
+
+// UpdatePlanFeatures calls orchestrator.v1.BillingService.UpdatePlanFeatures.
+func (c *billingServiceClient) UpdatePlanFeatures(ctx context.Context, req *connect.Request[v1.UpdatePlanFeaturesRequest]) (*connect.Response[v1.UpdatePlanFeaturesResponse], error) {
+	return c.updatePlanFeatures.CallUnary(ctx, req)
+}
+
+// ListAvailableFeatures calls orchestrator.v1.BillingService.ListAvailableFeatures.
+func (c *billingServiceClient) ListAvailableFeatures(ctx context.Context, req *connect.Request[v1.ListAvailableFeaturesRequest]) (*connect.Response[v1.ListAvailableFeaturesResponse], error) {
+	return c.listAvailableFeatures.CallUnary(ctx, req)
+}
+
+// GetPlan calls orchestrator.v1.BillingService.GetPlan.
+func (c *billingServiceClient) GetPlan(ctx context.Context, req *connect.Request[v1.GetPlanRequest]) (*connect.Response[v1.GetPlanResponse], error) {
+	return c.getPlan.CallUnary(ctx, req)
+}
+
+// CreatePlan calls orchestrator.v1.BillingService.CreatePlan.
+func (c *billingServiceClient) CreatePlan(ctx context.Context, req *connect.Request[v1.CreatePlanRequest]) (*connect.Response[v1.CreatePlanResponse], error) {
+	return c.createPlan.CallUnary(ctx, req)
+}
+
+// UpdatePlan calls orchestrator.v1.BillingService.UpdatePlan.
+func (c *billingServiceClient) UpdatePlan(ctx context.Context, req *connect.Request[v1.UpdatePlanRequest]) (*connect.Response[v1.UpdatePlanResponse], error) {
+	return c.updatePlan.CallUnary(ctx, req)
+}
+
+// DeletePlan calls orchestrator.v1.BillingService.DeletePlan.
+func (c *billingServiceClient) DeletePlan(ctx context.Context, req *connect.Request[v1.DeletePlanRequest]) (*connect.Response[v1.DeletePlanResponse], error) {
+	return c.deletePlan.CallUnary(ctx, req)
+}
+
+// GetPlanDeletionImpact calls orchestrator.v1.BillingService.GetPlanDeletionImpact.
+func (c *billingServiceClient) GetPlanDeletionImpact(ctx context.Context, req *connect.Request[v1.GetPlanDeletionImpactRequest]) (*connect.Response[v1.GetPlanDeletionImpactResponse], error) {
+	return c.getPlanDeletionImpact.CallUnary(ctx, req)
+}
+
+// GetPaymentCheckoutURL calls orchestrator.v1.BillingService.GetPaymentCheckoutURL.
+func (c *billingServiceClient) GetPaymentCheckoutURL(ctx context.Context, req *connect.Request[v1.GetPaymentCheckoutURLRequest]) (*connect.Response[v1.GetPaymentCheckoutURLResponse], error) {
+	return c.getPaymentCheckoutURL.CallUnary(ctx, req)
+}
+
+// HasPaymentMethod calls orchestrator.v1.BillingService.HasPaymentMethod.
+func (c *billingServiceClient) HasPaymentMethod(ctx context.Context, req *connect.Request[v1.HasPaymentMethodRequest]) (*connect.Response[v1.HasPaymentMethodResponse], error) {
+	return c.hasPaymentMethod.CallUnary(ctx, req)
+}
+
+// GetStripeConfig calls orchestrator.v1.BillingService.GetStripeConfig.
+func (c *billingServiceClient) GetStripeConfig(ctx context.Context, req *connect.Request[v1.GetStripeConfigRequest]) (*connect.Response[v1.GetStripeConfigResponse], error) {
+	return c.getStripeConfig.CallUnary(ctx, req)
+}
+
+// BillingServiceHandler is an implementation of the orchestrator.v1.BillingService service.
+type BillingServiceHandler interface {
+	// List available plans (authenticated)
+	ListPlans(context.Context, *connect.Request[v1.ListPlansRequest]) (*connect.Response[v1.ListPlansResponse], error)
+	// List public plans for pricing page (no auth required)
+	ListPublicPlans(context.Context, *connect.Request[v1.ListPublicPlansRequest]) (*connect.Response[v1.ListPublicPlansResponse], error)
+	// Get the current subscription for an instance
+	GetSubscription(context.Context, *connect.Request[v1.GetSubscriptionRequest]) (*connect.Response[v1.GetSubscriptionResponse], error)
+	// List all subscriptions for an account (billing overview)
+	ListAccountSubscriptions(context.Context, *connect.Request[v1.ListAccountSubscriptionsRequest]) (*connect.Response[v1.ListAccountSubscriptionsResponse], error)
+	// Create a new subscription for an instance
+	CreateSubscription(context.Context, *connect.Request[v1.CreateSubscriptionRequest]) (*connect.Response[v1.CreateSubscriptionResponse], error)
+	// Change subscription plan for an instance
+	ChangePlan(context.Context, *connect.Request[v1.ChangePlanRequest]) (*connect.Response[v1.ChangePlanResponse], error)
+	// Cancel subscription (terminates at period end)
+	CancelSubscription(context.Context, *connect.Request[v1.CancelSubscriptionRequest]) (*connect.Response[v1.CancelSubscriptionResponse], error)
+	// Terminate subscription immediately
+	TerminateSubscription(context.Context, *connect.Request[v1.TerminateSubscriptionRequest]) (*connect.Response[v1.TerminateSubscriptionResponse], error)
+	// List invoices for an account (consolidated billing)
+	ListInvoices(context.Context, *connect.Request[v1.ListInvoicesRequest]) (*connect.Response[v1.ListInvoicesResponse], error)
+	// Get invoice details
+	GetInvoice(context.Context, *connect.Request[v1.GetInvoiceRequest]) (*connect.Response[v1.GetInvoiceResponse], error)
+	// Get current usage metrics for an instance
+	GetUsage(context.Context, *connect.Request[v1.GetUsageRequest]) (*connect.Response[v1.GetUsageResponse], error)
+	// Record a usage event (for internal use by instance service)
+	RecordUsage(context.Context, *connect.Request[v1.RecordUsageRequest]) (*connect.Response[v1.RecordUsageResponse], error)
+	// Get capabilities for an instance (what the plan includes + what's activated)
+	GetInstanceCapabilities(context.Context, *connect.Request[v1.GetInstanceCapabilitiesRequest]) (*connect.Response[v1.GetInstanceCapabilitiesResponse], error)
+	// Enable a sidecar feature (e.g., search) - provisions the sidecar container
+	EnableFeature(context.Context, *connect.Request[v1.EnableFeatureRequest]) (*connect.Response[v1.EnableFeatureResponse], error)
+	// Disable a sidecar feature - deprovisions the sidecar container
+	DisableFeature(context.Context, *connect.Request[v1.DisableFeatureRequest]) (*connect.Response[v1.DisableFeatureResponse], error)
+	// Update features for a plan (superadmin only)
+	UpdatePlanFeatures(context.Context, *connect.Request[v1.UpdatePlanFeaturesRequest]) (*connect.Response[v1.UpdatePlanFeaturesResponse], error)
+	// List all available feature keys (for admin UI)
+	ListAvailableFeatures(context.Context, *connect.Request[v1.ListAvailableFeaturesRequest]) (*connect.Response[v1.ListAvailableFeaturesResponse], error)
+	// Get a single plan by ID
+	GetPlan(context.Context, *connect.Request[v1.GetPlanRequest]) (*connect.Response[v1.GetPlanResponse], error)
+	// Create a new plan
+	CreatePlan(context.Context, *connect.Request[v1.CreatePlanRequest]) (*connect.Response[v1.CreatePlanResponse], error)
+	// Update an existing plan (full update with all fields)
+	UpdatePlan(context.Context, *connect.Request[v1.UpdatePlanRequest]) (*connect.Response[v1.UpdatePlanResponse], error)
+	// Delete a plan (soft delete - deactivate)
+	DeletePlan(context.Context, *connect.Request[v1.DeletePlanRequest]) (*connect.Response[v1.DeletePlanResponse], error)
+	// Get plan deletion impact (count affected subscriptions)
+	GetPlanDeletionImpact(context.Context, *connect.Request[v1.GetPlanDeletionImpactRequest]) (*connect.Response[v1.GetPlanDeletionImpactResponse], error)
+	// Get a checkout URL for adding/updating payment methods
+	GetPaymentCheckoutURL(context.Context, *connect.Request[v1.GetPaymentCheckoutURLRequest]) (*connect.Response[v1.GetPaymentCheckoutURLResponse], error)
+	// Check if an account has a payment method configured
+	HasPaymentMethod(context.Context, *connect.Request[v1.HasPaymentMethodRequest]) (*connect.Response[v1.HasPaymentMethodResponse], error)
+	// Get the Stripe publishable key for frontend use
+	GetStripeConfig(context.Context, *connect.Request[v1.GetStripeConfigRequest]) (*connect.Response[v1.GetStripeConfigResponse], error)
+}
+
+// NewBillingServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewBillingServiceHandler(svc BillingServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	billingServiceMethods := v1.File_orchestrator_v1_billing_proto.Services().ByName("BillingService").Methods()
+	billingServiceListPlansHandler := connect.NewUnaryHandler(
+		BillingServiceListPlansProcedure,
+		svc.ListPlans,
+		connect.WithSchema(billingServiceMethods.ByName("ListPlans")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceListPublicPlansHandler := connect.NewUnaryHandler(
+		BillingServiceListPublicPlansProcedure,
+		svc.ListPublicPlans,
+		connect.WithSchema(billingServiceMethods.ByName("ListPublicPlans")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceGetSubscriptionHandler := connect.NewUnaryHandler(
+		BillingServiceGetSubscriptionProcedure,
+		svc.GetSubscription,
+		connect.WithSchema(billingServiceMethods.ByName("GetSubscription")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceListAccountSubscriptionsHandler := connect.NewUnaryHandler(
+		BillingServiceListAccountSubscriptionsProcedure,
+		svc.ListAccountSubscriptions,
+		connect.WithSchema(billingServiceMethods.ByName("ListAccountSubscriptions")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceCreateSubscriptionHandler := connect.NewUnaryHandler(
+		BillingServiceCreateSubscriptionProcedure,
+		svc.CreateSubscription,
+		connect.WithSchema(billingServiceMethods.ByName("CreateSubscription")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceChangePlanHandler := connect.NewUnaryHandler(
+		BillingServiceChangePlanProcedure,
+		svc.ChangePlan,
+		connect.WithSchema(billingServiceMethods.ByName("ChangePlan")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceCancelSubscriptionHandler := connect.NewUnaryHandler(
+		BillingServiceCancelSubscriptionProcedure,
+		svc.CancelSubscription,
+		connect.WithSchema(billingServiceMethods.ByName("CancelSubscription")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceTerminateSubscriptionHandler := connect.NewUnaryHandler(
+		BillingServiceTerminateSubscriptionProcedure,
+		svc.TerminateSubscription,
+		connect.WithSchema(billingServiceMethods.ByName("TerminateSubscription")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceListInvoicesHandler := connect.NewUnaryHandler(
+		BillingServiceListInvoicesProcedure,
+		svc.ListInvoices,
+		connect.WithSchema(billingServiceMethods.ByName("ListInvoices")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceGetInvoiceHandler := connect.NewUnaryHandler(
+		BillingServiceGetInvoiceProcedure,
+		svc.GetInvoice,
+		connect.WithSchema(billingServiceMethods.ByName("GetInvoice")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceGetUsageHandler := connect.NewUnaryHandler(
+		BillingServiceGetUsageProcedure,
+		svc.GetUsage,
+		connect.WithSchema(billingServiceMethods.ByName("GetUsage")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceRecordUsageHandler := connect.NewUnaryHandler(
+		BillingServiceRecordUsageProcedure,
+		svc.RecordUsage,
+		connect.WithSchema(billingServiceMethods.ByName("RecordUsage")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceGetInstanceCapabilitiesHandler := connect.NewUnaryHandler(
+		BillingServiceGetInstanceCapabilitiesProcedure,
+		svc.GetInstanceCapabilities,
+		connect.WithSchema(billingServiceMethods.ByName("GetInstanceCapabilities")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceEnableFeatureHandler := connect.NewUnaryHandler(
+		BillingServiceEnableFeatureProcedure,
+		svc.EnableFeature,
+		connect.WithSchema(billingServiceMethods.ByName("EnableFeature")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceDisableFeatureHandler := connect.NewUnaryHandler(
+		BillingServiceDisableFeatureProcedure,
+		svc.DisableFeature,
+		connect.WithSchema(billingServiceMethods.ByName("DisableFeature")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceUpdatePlanFeaturesHandler := connect.NewUnaryHandler(
+		BillingServiceUpdatePlanFeaturesProcedure,
+		svc.UpdatePlanFeatures,
+		connect.WithSchema(billingServiceMethods.ByName("UpdatePlanFeatures")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceListAvailableFeaturesHandler := connect.NewUnaryHandler(
+		BillingServiceListAvailableFeaturesProcedure,
+		svc.ListAvailableFeatures,
+		connect.WithSchema(billingServiceMethods.ByName("ListAvailableFeatures")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceGetPlanHandler := connect.NewUnaryHandler(
+		BillingServiceGetPlanProcedure,
+		svc.GetPlan,
+		connect.WithSchema(billingServiceMethods.ByName("GetPlan")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceCreatePlanHandler := connect.NewUnaryHandler(
+		BillingServiceCreatePlanProcedure,
+		svc.CreatePlan,
+		connect.WithSchema(billingServiceMethods.ByName("CreatePlan")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceUpdatePlanHandler := connect.NewUnaryHandler(
+		BillingServiceUpdatePlanProcedure,
+		svc.UpdatePlan,
+		connect.WithSchema(billingServiceMethods.ByName("UpdatePlan")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceDeletePlanHandler := connect.NewUnaryHandler(
+		BillingServiceDeletePlanProcedure,
+		svc.DeletePlan,
+		connect.WithSchema(billingServiceMethods.ByName("DeletePlan")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceGetPlanDeletionImpactHandler := connect.NewUnaryHandler(
+		BillingServiceGetPlanDeletionImpactProcedure,
+		svc.GetPlanDeletionImpact,
+		connect.WithSchema(billingServiceMethods.ByName("GetPlanDeletionImpact")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceGetPaymentCheckoutURLHandler := connect.NewUnaryHandler(
+		BillingServiceGetPaymentCheckoutURLProcedure,
+		svc.GetPaymentCheckoutURL,
+		connect.WithSchema(billingServiceMethods.ByName("GetPaymentCheckoutURL")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceHasPaymentMethodHandler := connect.NewUnaryHandler(
+		BillingServiceHasPaymentMethodProcedure,
+		svc.HasPaymentMethod,
+		connect.WithSchema(billingServiceMethods.ByName("HasPaymentMethod")),
+		connect.WithHandlerOptions(opts...),
+	)
+	billingServiceGetStripeConfigHandler := connect.NewUnaryHandler(
+		BillingServiceGetStripeConfigProcedure,
+		svc.GetStripeConfig,
+		connect.WithSchema(billingServiceMethods.ByName("GetStripeConfig")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/orchestrator.v1.BillingService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case BillingServiceListPlansProcedure:
+			billingServiceListPlansHandler.ServeHTTP(w, r)
+		case BillingServiceListPublicPlansProcedure:
+			billingServiceListPublicPlansHandler.ServeHTTP(w, r)
+		case BillingServiceGetSubscriptionProcedure:
+			billingServiceGetSubscriptionHandler.ServeHTTP(w, r)
+		case BillingServiceListAccountSubscriptionsProcedure:
+			billingServiceListAccountSubscriptionsHandler.ServeHTTP(w, r)
+		case BillingServiceCreateSubscriptionProcedure:
+			billingServiceCreateSubscriptionHandler.ServeHTTP(w, r)
+		case BillingServiceChangePlanProcedure:
+			billingServiceChangePlanHandler.ServeHTTP(w, r)
+		case BillingServiceCancelSubscriptionProcedure:
+			billingServiceCancelSubscriptionHandler.ServeHTTP(w, r)
+		case BillingServiceTerminateSubscriptionProcedure:
+			billingServiceTerminateSubscriptionHandler.ServeHTTP(w, r)
+		case BillingServiceListInvoicesProcedure:
+			billingServiceListInvoicesHandler.ServeHTTP(w, r)
+		case BillingServiceGetInvoiceProcedure:
+			billingServiceGetInvoiceHandler.ServeHTTP(w, r)
+		case BillingServiceGetUsageProcedure:
+			billingServiceGetUsageHandler.ServeHTTP(w, r)
+		case BillingServiceRecordUsageProcedure:
+			billingServiceRecordUsageHandler.ServeHTTP(w, r)
+		case BillingServiceGetInstanceCapabilitiesProcedure:
+			billingServiceGetInstanceCapabilitiesHandler.ServeHTTP(w, r)
+		case BillingServiceEnableFeatureProcedure:
+			billingServiceEnableFeatureHandler.ServeHTTP(w, r)
+		case BillingServiceDisableFeatureProcedure:
+			billingServiceDisableFeatureHandler.ServeHTTP(w, r)
+		case BillingServiceUpdatePlanFeaturesProcedure:
+			billingServiceUpdatePlanFeaturesHandler.ServeHTTP(w, r)
+		case BillingServiceListAvailableFeaturesProcedure:
+			billingServiceListAvailableFeaturesHandler.ServeHTTP(w, r)
+		case BillingServiceGetPlanProcedure:
+			billingServiceGetPlanHandler.ServeHTTP(w, r)
+		case BillingServiceCreatePlanProcedure:
+			billingServiceCreatePlanHandler.ServeHTTP(w, r)
+		case BillingServiceUpdatePlanProcedure:
+			billingServiceUpdatePlanHandler.ServeHTTP(w, r)
+		case BillingServiceDeletePlanProcedure:
+			billingServiceDeletePlanHandler.ServeHTTP(w, r)
+		case BillingServiceGetPlanDeletionImpactProcedure:
+			billingServiceGetPlanDeletionImpactHandler.ServeHTTP(w, r)
+		case BillingServiceGetPaymentCheckoutURLProcedure:
+			billingServiceGetPaymentCheckoutURLHandler.ServeHTTP(w, r)
+		case BillingServiceHasPaymentMethodProcedure:
+			billingServiceHasPaymentMethodHandler.ServeHTTP(w, r)
+		case BillingServiceGetStripeConfigProcedure:
+			billingServiceGetStripeConfigHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedBillingServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedBillingServiceHandler struct{}
+
+func (UnimplementedBillingServiceHandler) ListPlans(context.Context, *connect.Request[v1.ListPlansRequest]) (*connect.Response[v1.ListPlansResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.ListPlans is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) ListPublicPlans(context.Context, *connect.Request[v1.ListPublicPlansRequest]) (*connect.Response[v1.ListPublicPlansResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.ListPublicPlans is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) GetSubscription(context.Context, *connect.Request[v1.GetSubscriptionRequest]) (*connect.Response[v1.GetSubscriptionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.GetSubscription is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) ListAccountSubscriptions(context.Context, *connect.Request[v1.ListAccountSubscriptionsRequest]) (*connect.Response[v1.ListAccountSubscriptionsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.ListAccountSubscriptions is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) CreateSubscription(context.Context, *connect.Request[v1.CreateSubscriptionRequest]) (*connect.Response[v1.CreateSubscriptionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.CreateSubscription is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) ChangePlan(context.Context, *connect.Request[v1.ChangePlanRequest]) (*connect.Response[v1.ChangePlanResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.ChangePlan is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) CancelSubscription(context.Context, *connect.Request[v1.CancelSubscriptionRequest]) (*connect.Response[v1.CancelSubscriptionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.CancelSubscription is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) TerminateSubscription(context.Context, *connect.Request[v1.TerminateSubscriptionRequest]) (*connect.Response[v1.TerminateSubscriptionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.TerminateSubscription is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) ListInvoices(context.Context, *connect.Request[v1.ListInvoicesRequest]) (*connect.Response[v1.ListInvoicesResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.ListInvoices is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) GetInvoice(context.Context, *connect.Request[v1.GetInvoiceRequest]) (*connect.Response[v1.GetInvoiceResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.GetInvoice is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) GetUsage(context.Context, *connect.Request[v1.GetUsageRequest]) (*connect.Response[v1.GetUsageResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.GetUsage is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) RecordUsage(context.Context, *connect.Request[v1.RecordUsageRequest]) (*connect.Response[v1.RecordUsageResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.RecordUsage is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) GetInstanceCapabilities(context.Context, *connect.Request[v1.GetInstanceCapabilitiesRequest]) (*connect.Response[v1.GetInstanceCapabilitiesResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.GetInstanceCapabilities is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) EnableFeature(context.Context, *connect.Request[v1.EnableFeatureRequest]) (*connect.Response[v1.EnableFeatureResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.EnableFeature is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) DisableFeature(context.Context, *connect.Request[v1.DisableFeatureRequest]) (*connect.Response[v1.DisableFeatureResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.DisableFeature is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) UpdatePlanFeatures(context.Context, *connect.Request[v1.UpdatePlanFeaturesRequest]) (*connect.Response[v1.UpdatePlanFeaturesResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.UpdatePlanFeatures is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) ListAvailableFeatures(context.Context, *connect.Request[v1.ListAvailableFeaturesRequest]) (*connect.Response[v1.ListAvailableFeaturesResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.ListAvailableFeatures is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) GetPlan(context.Context, *connect.Request[v1.GetPlanRequest]) (*connect.Response[v1.GetPlanResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.GetPlan is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) CreatePlan(context.Context, *connect.Request[v1.CreatePlanRequest]) (*connect.Response[v1.CreatePlanResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.CreatePlan is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) UpdatePlan(context.Context, *connect.Request[v1.UpdatePlanRequest]) (*connect.Response[v1.UpdatePlanResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.UpdatePlan is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) DeletePlan(context.Context, *connect.Request[v1.DeletePlanRequest]) (*connect.Response[v1.DeletePlanResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.DeletePlan is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) GetPlanDeletionImpact(context.Context, *connect.Request[v1.GetPlanDeletionImpactRequest]) (*connect.Response[v1.GetPlanDeletionImpactResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.GetPlanDeletionImpact is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) GetPaymentCheckoutURL(context.Context, *connect.Request[v1.GetPaymentCheckoutURLRequest]) (*connect.Response[v1.GetPaymentCheckoutURLResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.GetPaymentCheckoutURL is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) HasPaymentMethod(context.Context, *connect.Request[v1.HasPaymentMethodRequest]) (*connect.Response[v1.HasPaymentMethodResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.HasPaymentMethod is not implemented"))
+}
+
+func (UnimplementedBillingServiceHandler) GetStripeConfig(context.Context, *connect.Request[v1.GetStripeConfigRequest]) (*connect.Response[v1.GetStripeConfigResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.BillingService.GetStripeConfig is not implemented"))
+}

internal/api/orchestrator/v1/orchestratorv1connect/dns.connect.go

@@ -0,0 +1,512 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: orchestrator/v1/dns.proto
+
+package orchestratorv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "git.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// DNSServiceName is the fully-qualified name of the DNSService service.
+	DNSServiceName = "orchestrator.v1.DNSService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// DNSServiceEnableDNSHostingProcedure is the fully-qualified name of the DNSService's
+	// EnableDNSHosting RPC.
+	DNSServiceEnableDNSHostingProcedure = "/orchestrator.v1.DNSService/EnableDNSHosting"
+	// DNSServiceDisableDNSHostingProcedure is the fully-qualified name of the DNSService's
+	// DisableDNSHosting RPC.
+	DNSServiceDisableDNSHostingProcedure = "/orchestrator.v1.DNSService/DisableDNSHosting"
+	// DNSServiceCheckDelegationProcedure is the fully-qualified name of the DNSService's
+	// CheckDelegation RPC.
+	DNSServiceCheckDelegationProcedure = "/orchestrator.v1.DNSService/CheckDelegation"
+	// DNSServiceGetZoneProcedure is the fully-qualified name of the DNSService's GetZone RPC.
+	DNSServiceGetZoneProcedure = "/orchestrator.v1.DNSService/GetZone"
+	// DNSServiceGetPlatformZoneProcedure is the fully-qualified name of the DNSService's
+	// GetPlatformZone RPC.
+	DNSServiceGetPlatformZoneProcedure = "/orchestrator.v1.DNSService/GetPlatformZone"
+	// DNSServiceListRecordsProcedure is the fully-qualified name of the DNSService's ListRecords RPC.
+	DNSServiceListRecordsProcedure = "/orchestrator.v1.DNSService/ListRecords"
+	// DNSServiceCreateRecordProcedure is the fully-qualified name of the DNSService's CreateRecord RPC.
+	DNSServiceCreateRecordProcedure = "/orchestrator.v1.DNSService/CreateRecord"
+	// DNSServiceUpdateRecordProcedure is the fully-qualified name of the DNSService's UpdateRecord RPC.
+	DNSServiceUpdateRecordProcedure = "/orchestrator.v1.DNSService/UpdateRecord"
+	// DNSServiceDeleteRecordProcedure is the fully-qualified name of the DNSService's DeleteRecord RPC.
+	DNSServiceDeleteRecordProcedure = "/orchestrator.v1.DNSService/DeleteRecord"
+	// DNSServicePreviewRecordChangeProcedure is the fully-qualified name of the DNSService's
+	// PreviewRecordChange RPC.
+	DNSServicePreviewRecordChangeProcedure = "/orchestrator.v1.DNSService/PreviewRecordChange"
+	// DNSServiceProvisionNameserverProcedure is the fully-qualified name of the DNSService's
+	// ProvisionNameserver RPC.
+	DNSServiceProvisionNameserverProcedure = "/orchestrator.v1.DNSService/ProvisionNameserver"
+	// DNSServiceListNameserversProcedure is the fully-qualified name of the DNSService's
+	// ListNameservers RPC.
+	DNSServiceListNameserversProcedure = "/orchestrator.v1.DNSService/ListNameservers"
+	// DNSServiceGetNameserverInstallScriptProcedure is the fully-qualified name of the DNSService's
+	// GetNameserverInstallScript RPC.
+	DNSServiceGetNameserverInstallScriptProcedure = "/orchestrator.v1.DNSService/GetNameserverInstallScript"
+	// DNSServiceDecommissionNameserverProcedure is the fully-qualified name of the DNSService's
+	// DecommissionNameserver RPC.
+	DNSServiceDecommissionNameserverProcedure = "/orchestrator.v1.DNSService/DecommissionNameserver"
+	// DNSServiceGeneratePrimaryInstallScriptProcedure is the fully-qualified name of the DNSService's
+	// GeneratePrimaryInstallScript RPC.
+	DNSServiceGeneratePrimaryInstallScriptProcedure = "/orchestrator.v1.DNSService/GeneratePrimaryInstallScript"
+)
+
+// DNSServiceClient is a client for the orchestrator.v1.DNSService service.
+type DNSServiceClient interface {
+	EnableDNSHosting(context.Context, *connect.Request[v1.EnableDNSHostingRequest]) (*connect.Response[v1.EnableDNSHostingResponse], error)
+	DisableDNSHosting(context.Context, *connect.Request[v1.DisableDNSHostingRequest]) (*connect.Response[v1.DisableDNSHostingResponse], error)
+	CheckDelegation(context.Context, *connect.Request[v1.CheckDelegationRequest]) (*connect.Response[v1.CheckDelegationResponse], error)
+	GetZone(context.Context, *connect.Request[v1.GetZoneRequest]) (*connect.Response[v1.GetZoneResponse], error)
+	GetPlatformZone(context.Context, *connect.Request[v1.GetPlatformZoneRequest]) (*connect.Response[v1.GetPlatformZoneResponse], error)
+	ListRecords(context.Context, *connect.Request[v1.ListRecordsRequest]) (*connect.Response[v1.ListRecordsResponse], error)
+	CreateRecord(context.Context, *connect.Request[v1.CreateRecordRequest]) (*connect.Response[v1.CreateRecordResponse], error)
+	UpdateRecord(context.Context, *connect.Request[v1.UpdateRecordRequest]) (*connect.Response[v1.UpdateRecordResponse], error)
+	DeleteRecord(context.Context, *connect.Request[v1.DeleteRecordRequest]) (*connect.Response[v1.DeleteRecordResponse], error)
+	PreviewRecordChange(context.Context, *connect.Request[v1.PreviewRecordChangeRequest]) (*connect.Response[v1.PreviewRecordChangeResponse], error)
+	// Nameserver management (superadmin only)
+	ProvisionNameserver(context.Context, *connect.Request[v1.ProvisionNameserverRequest]) (*connect.Response[v1.ProvisionNameserverResponse], error)
+	ListNameservers(context.Context, *connect.Request[v1.ListNameserversRequest]) (*connect.Response[v1.ListNameserversResponse], error)
+	GetNameserverInstallScript(context.Context, *connect.Request[v1.GetNameserverInstallScriptRequest]) (*connect.Response[v1.GetNameserverInstallScriptResponse], error)
+	DecommissionNameserver(context.Context, *connect.Request[v1.DecommissionNameserverRequest]) (*connect.Response[v1.DecommissionNameserverResponse], error)
+	GeneratePrimaryInstallScript(context.Context, *connect.Request[v1.GeneratePrimaryInstallScriptRequest]) (*connect.Response[v1.GeneratePrimaryInstallScriptResponse], error)
+}
+
+// NewDNSServiceClient constructs a client for the orchestrator.v1.DNSService service. By default,
+// it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and
+// sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC()
+// or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewDNSServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) DNSServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	dNSServiceMethods := v1.File_orchestrator_v1_dns_proto.Services().ByName("DNSService").Methods()
+	return &dNSServiceClient{
+		enableDNSHosting: connect.NewClient[v1.EnableDNSHostingRequest, v1.EnableDNSHostingResponse](
+			httpClient,
+			baseURL+DNSServiceEnableDNSHostingProcedure,
+			connect.WithSchema(dNSServiceMethods.ByName("EnableDNSHosting")),
+			connect.WithClientOptions(opts...),
+		),
+		disableDNSHosting: connect.NewClient[v1.DisableDNSHostingRequest, v1.DisableDNSHostingResponse](
+			httpClient,
+			baseURL+DNSServiceDisableDNSHostingProcedure,
+			connect.WithSchema(dNSServiceMethods.ByName("DisableDNSHosting")),
+			connect.WithClientOptions(opts...),
+		),
+		checkDelegation: connect.NewClient[v1.CheckDelegationRequest, v1.CheckDelegationResponse](
+			httpClient,
+			baseURL+DNSServiceCheckDelegationProcedure,
+			connect.WithSchema(dNSServiceMethods.ByName("CheckDelegation")),
+			connect.WithClientOptions(opts...),
+		),
+		getZone: connect.NewClient[v1.GetZoneRequest, v1.GetZoneResponse](
+			httpClient,
+			baseURL+DNSServiceGetZoneProcedure,
+			connect.WithSchema(dNSServiceMethods.ByName("GetZone")),
+			connect.WithClientOptions(opts...),
+		),
+		getPlatformZone: connect.NewClient[v1.GetPlatformZoneRequest, v1.GetPlatformZoneResponse](
+			httpClient,
+			baseURL+DNSServiceGetPlatformZoneProcedure,
+			connect.WithSchema(dNSServiceMethods.ByName("GetPlatformZone")),
+			connect.WithClientOptions(opts...),
+		),
+		listRecords: connect.NewClient[v1.ListRecordsRequest, v1.ListRecordsResponse](
+			httpClient,
+			baseURL+DNSServiceListRecordsProcedure,
+			connect.WithSchema(dNSServiceMethods.ByName("ListRecords")),
+			connect.WithClientOptions(opts...),
+		),
+		createRecord: connect.NewClient[v1.CreateRecordRequest, v1.CreateRecordResponse](
+			httpClient,
+			baseURL+DNSServiceCreateRecordProcedure,
+			connect.WithSchema(dNSServiceMethods.ByName("CreateRecord")),
+			connect.WithClientOptions(opts...),
+		),
+		updateRecord: connect.NewClient[v1.UpdateRecordRequest, v1.UpdateRecordResponse](
+			httpClient,
+			baseURL+DNSServiceUpdateRecordProcedure,
+			connect.WithSchema(dNSServiceMethods.ByName("UpdateRecord")),
+			connect.WithClientOptions(opts...),
+		),
+		deleteRecord: connect.NewClient[v1.DeleteRecordRequest, v1.DeleteRecordResponse](
+			httpClient,
+			baseURL+DNSServiceDeleteRecordProcedure,
+			connect.WithSchema(dNSServiceMethods.ByName("DeleteRecord")),
+			connect.WithClientOptions(opts...),
+		),
+		previewRecordChange: connect.NewClient[v1.PreviewRecordChangeRequest, v1.PreviewRecordChangeResponse](
+			httpClient,
+			baseURL+DNSServicePreviewRecordChangeProcedure,
+			connect.WithSchema(dNSServiceMethods.ByName("PreviewRecordChange")),
+			connect.WithClientOptions(opts...),
+		),
+		provisionNameserver: connect.NewClient[v1.ProvisionNameserverRequest, v1.ProvisionNameserverResponse](
+			httpClient,
+			baseURL+DNSServiceProvisionNameserverProcedure,
+			connect.WithSchema(dNSServiceMethods.ByName("ProvisionNameserver")),
+			connect.WithClientOptions(opts...),
+		),
+		listNameservers: connect.NewClient[v1.ListNameserversRequest, v1.ListNameserversResponse](
+			httpClient,
+			baseURL+DNSServiceListNameserversProcedure,
+			connect.WithSchema(dNSServiceMethods.ByName("ListNameservers")),
+			connect.WithClientOptions(opts...),
+		),
+		getNameserverInstallScript: connect.NewClient[v1.GetNameserverInstallScriptRequest, v1.GetNameserverInstallScriptResponse](
+			httpClient,
+			baseURL+DNSServiceGetNameserverInstallScriptProcedure,
+			connect.WithSchema(dNSServiceMethods.ByName("GetNameserverInstallScript")),
+			connect.WithClientOptions(opts...),
+		),
+		decommissionNameserver: connect.NewClient[v1.DecommissionNameserverRequest, v1.DecommissionNameserverResponse](
+			httpClient,
+			baseURL+DNSServiceDecommissionNameserverProcedure,
+			connect.WithSchema(dNSServiceMethods.ByName("DecommissionNameserver")),
+			connect.WithClientOptions(opts...),
+		),
+		generatePrimaryInstallScript: connect.NewClient[v1.GeneratePrimaryInstallScriptRequest, v1.GeneratePrimaryInstallScriptResponse](
+			httpClient,
+			baseURL+DNSServiceGeneratePrimaryInstallScriptProcedure,
+			connect.WithSchema(dNSServiceMethods.ByName("GeneratePrimaryInstallScript")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// dNSServiceClient implements DNSServiceClient.
+type dNSServiceClient struct {
+	enableDNSHosting             *connect.Client[v1.EnableDNSHostingRequest, v1.EnableDNSHostingResponse]
+	disableDNSHosting            *connect.Client[v1.DisableDNSHostingRequest, v1.DisableDNSHostingResponse]
+	checkDelegation              *connect.Client[v1.CheckDelegationRequest, v1.CheckDelegationResponse]
+	getZone                      *connect.Client[v1.GetZoneRequest, v1.GetZoneResponse]
+	getPlatformZone              *connect.Client[v1.GetPlatformZoneRequest, v1.GetPlatformZoneResponse]
+	listRecords                  *connect.Client[v1.ListRecordsRequest, v1.ListRecordsResponse]
+	createRecord                 *connect.Client[v1.CreateRecordRequest, v1.CreateRecordResponse]
+	updateRecord                 *connect.Client[v1.UpdateRecordRequest, v1.UpdateRecordResponse]
+	deleteRecord                 *connect.Client[v1.DeleteRecordRequest, v1.DeleteRecordResponse]
+	previewRecordChange          *connect.Client[v1.PreviewRecordChangeRequest, v1.PreviewRecordChangeResponse]
+	provisionNameserver          *connect.Client[v1.ProvisionNameserverRequest, v1.ProvisionNameserverResponse]
+	listNameservers              *connect.Client[v1.ListNameserversRequest, v1.ListNameserversResponse]
+	getNameserverInstallScript   *connect.Client[v1.GetNameserverInstallScriptRequest, v1.GetNameserverInstallScriptResponse]
+	decommissionNameserver       *connect.Client[v1.DecommissionNameserverRequest, v1.DecommissionNameserverResponse]
+	generatePrimaryInstallScript *connect.Client[v1.GeneratePrimaryInstallScriptRequest, v1.GeneratePrimaryInstallScriptResponse]
+}
+
+// EnableDNSHosting calls orchestrator.v1.DNSService.EnableDNSHosting.
+func (c *dNSServiceClient) EnableDNSHosting(ctx context.Context, req *connect.Request[v1.EnableDNSHostingRequest]) (*connect.Response[v1.EnableDNSHostingResponse], error) {
+	return c.enableDNSHosting.CallUnary(ctx, req)
+}
+
+// DisableDNSHosting calls orchestrator.v1.DNSService.DisableDNSHosting.
+func (c *dNSServiceClient) DisableDNSHosting(ctx context.Context, req *connect.Request[v1.DisableDNSHostingRequest]) (*connect.Response[v1.DisableDNSHostingResponse], error) {
+	return c.disableDNSHosting.CallUnary(ctx, req)
+}
+
+// CheckDelegation calls orchestrator.v1.DNSService.CheckDelegation.
+func (c *dNSServiceClient) CheckDelegation(ctx context.Context, req *connect.Request[v1.CheckDelegationRequest]) (*connect.Response[v1.CheckDelegationResponse], error) {
+	return c.checkDelegation.CallUnary(ctx, req)
+}
+
+// GetZone calls orchestrator.v1.DNSService.GetZone.
+func (c *dNSServiceClient) GetZone(ctx context.Context, req *connect.Request[v1.GetZoneRequest]) (*connect.Response[v1.GetZoneResponse], error) {
+	return c.getZone.CallUnary(ctx, req)
+}
+
+// GetPlatformZone calls orchestrator.v1.DNSService.GetPlatformZone.
+func (c *dNSServiceClient) GetPlatformZone(ctx context.Context, req *connect.Request[v1.GetPlatformZoneRequest]) (*connect.Response[v1.GetPlatformZoneResponse], error) {
+	return c.getPlatformZone.CallUnary(ctx, req)
+}
+
+// ListRecords calls orchestrator.v1.DNSService.ListRecords.
+func (c *dNSServiceClient) ListRecords(ctx context.Context, req *connect.Request[v1.ListRecordsRequest]) (*connect.Response[v1.ListRecordsResponse], error) {
+	return c.listRecords.CallUnary(ctx, req)
+}
+
+// CreateRecord calls orchestrator.v1.DNSService.CreateRecord.
+func (c *dNSServiceClient) CreateRecord(ctx context.Context, req *connect.Request[v1.CreateRecordRequest]) (*connect.Response[v1.CreateRecordResponse], error) {
+	return c.createRecord.CallUnary(ctx, req)
+}
+
+// UpdateRecord calls orchestrator.v1.DNSService.UpdateRecord.
+func (c *dNSServiceClient) UpdateRecord(ctx context.Context, req *connect.Request[v1.UpdateRecordRequest]) (*connect.Response[v1.UpdateRecordResponse], error) {
+	return c.updateRecord.CallUnary(ctx, req)
+}
+
+// DeleteRecord calls orchestrator.v1.DNSService.DeleteRecord.
+func (c *dNSServiceClient) DeleteRecord(ctx context.Context, req *connect.Request[v1.DeleteRecordRequest]) (*connect.Response[v1.DeleteRecordResponse], error) {
+	return c.deleteRecord.CallUnary(ctx, req)
+}
+
+// PreviewRecordChange calls orchestrator.v1.DNSService.PreviewRecordChange.
+func (c *dNSServiceClient) PreviewRecordChange(ctx context.Context, req *connect.Request[v1.PreviewRecordChangeRequest]) (*connect.Response[v1.PreviewRecordChangeResponse], error) {
+	return c.previewRecordChange.CallUnary(ctx, req)
+}
+
+// ProvisionNameserver calls orchestrator.v1.DNSService.ProvisionNameserver.
+func (c *dNSServiceClient) ProvisionNameserver(ctx context.Context, req *connect.Request[v1.ProvisionNameserverRequest]) (*connect.Response[v1.ProvisionNameserverResponse], error) {
+	return c.provisionNameserver.CallUnary(ctx, req)
+}
+
+// ListNameservers calls orchestrator.v1.DNSService.ListNameservers.
+func (c *dNSServiceClient) ListNameservers(ctx context.Context, req *connect.Request[v1.ListNameserversRequest]) (*connect.Response[v1.ListNameserversResponse], error) {
+	return c.listNameservers.CallUnary(ctx, req)
+}
+
+// GetNameserverInstallScript calls orchestrator.v1.DNSService.GetNameserverInstallScript.
+func (c *dNSServiceClient) GetNameserverInstallScript(ctx context.Context, req *connect.Request[v1.GetNameserverInstallScriptRequest]) (*connect.Response[v1.GetNameserverInstallScriptResponse], error) {
+	return c.getNameserverInstallScript.CallUnary(ctx, req)
+}
+
+// DecommissionNameserver calls orchestrator.v1.DNSService.DecommissionNameserver.
+func (c *dNSServiceClient) DecommissionNameserver(ctx context.Context, req *connect.Request[v1.DecommissionNameserverRequest]) (*connect.Response[v1.DecommissionNameserverResponse], error) {
+	return c.decommissionNameserver.CallUnary(ctx, req)
+}
+
+// GeneratePrimaryInstallScript calls orchestrator.v1.DNSService.GeneratePrimaryInstallScript.
+func (c *dNSServiceClient) GeneratePrimaryInstallScript(ctx context.Context, req *connect.Request[v1.GeneratePrimaryInstallScriptRequest]) (*connect.Response[v1.GeneratePrimaryInstallScriptResponse], error) {
+	return c.generatePrimaryInstallScript.CallUnary(ctx, req)
+}
+
+// DNSServiceHandler is an implementation of the orchestrator.v1.DNSService service.
+type DNSServiceHandler interface {
+	EnableDNSHosting(context.Context, *connect.Request[v1.EnableDNSHostingRequest]) (*connect.Response[v1.EnableDNSHostingResponse], error)
+	DisableDNSHosting(context.Context, *connect.Request[v1.DisableDNSHostingRequest]) (*connect.Response[v1.DisableDNSHostingResponse], error)
+	CheckDelegation(context.Context, *connect.Request[v1.CheckDelegationRequest]) (*connect.Response[v1.CheckDelegationResponse], error)
+	GetZone(context.Context, *connect.Request[v1.GetZoneRequest]) (*connect.Response[v1.GetZoneResponse], error)
+	GetPlatformZone(context.Context, *connect.Request[v1.GetPlatformZoneRequest]) (*connect.Response[v1.GetPlatformZoneResponse], error)
+	ListRecords(context.Context, *connect.Request[v1.ListRecordsRequest]) (*connect.Response[v1.ListRecordsResponse], error)
+	CreateRecord(context.Context, *connect.Request[v1.CreateRecordRequest]) (*connect.Response[v1.CreateRecordResponse], error)
+	UpdateRecord(context.Context, *connect.Request[v1.UpdateRecordRequest]) (*connect.Response[v1.UpdateRecordResponse], error)
+	DeleteRecord(context.Context, *connect.Request[v1.DeleteRecordRequest]) (*connect.Response[v1.DeleteRecordResponse], error)
+	PreviewRecordChange(context.Context, *connect.Request[v1.PreviewRecordChangeRequest]) (*connect.Response[v1.PreviewRecordChangeResponse], error)
+	// Nameserver management (superadmin only)
+	ProvisionNameserver(context.Context, *connect.Request[v1.ProvisionNameserverRequest]) (*connect.Response[v1.ProvisionNameserverResponse], error)
+	ListNameservers(context.Context, *connect.Request[v1.ListNameserversRequest]) (*connect.Response[v1.ListNameserversResponse], error)
+	GetNameserverInstallScript(context.Context, *connect.Request[v1.GetNameserverInstallScriptRequest]) (*connect.Response[v1.GetNameserverInstallScriptResponse], error)
+	DecommissionNameserver(context.Context, *connect.Request[v1.DecommissionNameserverRequest]) (*connect.Response[v1.DecommissionNameserverResponse], error)
+	GeneratePrimaryInstallScript(context.Context, *connect.Request[v1.GeneratePrimaryInstallScriptRequest]) (*connect.Response[v1.GeneratePrimaryInstallScriptResponse], error)
+}
+
+// NewDNSServiceHandler builds an HTTP handler from the service implementation. It returns the path
+// on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewDNSServiceHandler(svc DNSServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	dNSServiceMethods := v1.File_orchestrator_v1_dns_proto.Services().ByName("DNSService").Methods()
+	dNSServiceEnableDNSHostingHandler := connect.NewUnaryHandler(
+		DNSServiceEnableDNSHostingProcedure,
+		svc.EnableDNSHosting,
+		connect.WithSchema(dNSServiceMethods.ByName("EnableDNSHosting")),
+		connect.WithHandlerOptions(opts...),
+	)
+	dNSServiceDisableDNSHostingHandler := connect.NewUnaryHandler(
+		DNSServiceDisableDNSHostingProcedure,
+		svc.DisableDNSHosting,
+		connect.WithSchema(dNSServiceMethods.ByName("DisableDNSHosting")),
+		connect.WithHandlerOptions(opts...),
+	)
+	dNSServiceCheckDelegationHandler := connect.NewUnaryHandler(
+		DNSServiceCheckDelegationProcedure,
+		svc.CheckDelegation,
+		connect.WithSchema(dNSServiceMethods.ByName("CheckDelegation")),
+		connect.WithHandlerOptions(opts...),
+	)
+	dNSServiceGetZoneHandler := connect.NewUnaryHandler(
+		DNSServiceGetZoneProcedure,
+		svc.GetZone,
+		connect.WithSchema(dNSServiceMethods.ByName("GetZone")),
+		connect.WithHandlerOptions(opts...),
+	)
+	dNSServiceGetPlatformZoneHandler := connect.NewUnaryHandler(
+		DNSServiceGetPlatformZoneProcedure,
+		svc.GetPlatformZone,
+		connect.WithSchema(dNSServiceMethods.ByName("GetPlatformZone")),
+		connect.WithHandlerOptions(opts...),
+	)
+	dNSServiceListRecordsHandler := connect.NewUnaryHandler(
+		DNSServiceListRecordsProcedure,
+		svc.ListRecords,
+		connect.WithSchema(dNSServiceMethods.ByName("ListRecords")),
+		connect.WithHandlerOptions(opts...),
+	)
+	dNSServiceCreateRecordHandler := connect.NewUnaryHandler(
+		DNSServiceCreateRecordProcedure,
+		svc.CreateRecord,
+		connect.WithSchema(dNSServiceMethods.ByName("CreateRecord")),
+		connect.WithHandlerOptions(opts...),
+	)
+	dNSServiceUpdateRecordHandler := connect.NewUnaryHandler(
+		DNSServiceUpdateRecordProcedure,
+		svc.UpdateRecord,
+		connect.WithSchema(dNSServiceMethods.ByName("UpdateRecord")),
+		connect.WithHandlerOptions(opts...),
+	)
+	dNSServiceDeleteRecordHandler := connect.NewUnaryHandler(
+		DNSServiceDeleteRecordProcedure,
+		svc.DeleteRecord,
+		connect.WithSchema(dNSServiceMethods.ByName("DeleteRecord")),
+		connect.WithHandlerOptions(opts...),
+	)
+	dNSServicePreviewRecordChangeHandler := connect.NewUnaryHandler(
+		DNSServicePreviewRecordChangeProcedure,
+		svc.PreviewRecordChange,
+		connect.WithSchema(dNSServiceMethods.ByName("PreviewRecordChange")),
+		connect.WithHandlerOptions(opts...),
+	)
+	dNSServiceProvisionNameserverHandler := connect.NewUnaryHandler(
+		DNSServiceProvisionNameserverProcedure,
+		svc.ProvisionNameserver,
+		connect.WithSchema(dNSServiceMethods.ByName("ProvisionNameserver")),
+		connect.WithHandlerOptions(opts...),
+	)
+	dNSServiceListNameserversHandler := connect.NewUnaryHandler(
+		DNSServiceListNameserversProcedure,
+		svc.ListNameservers,
+		connect.WithSchema(dNSServiceMethods.ByName("ListNameservers")),
+		connect.WithHandlerOptions(opts...),
+	)
+	dNSServiceGetNameserverInstallScriptHandler := connect.NewUnaryHandler(
+		DNSServiceGetNameserverInstallScriptProcedure,
+		svc.GetNameserverInstallScript,
+		connect.WithSchema(dNSServiceMethods.ByName("GetNameserverInstallScript")),
+		connect.WithHandlerOptions(opts...),
+	)
+	dNSServiceDecommissionNameserverHandler := connect.NewUnaryHandler(
+		DNSServiceDecommissionNameserverProcedure,
+		svc.DecommissionNameserver,
+		connect.WithSchema(dNSServiceMethods.ByName("DecommissionNameserver")),
+		connect.WithHandlerOptions(opts...),
+	)
+	dNSServiceGeneratePrimaryInstallScriptHandler := connect.NewUnaryHandler(
+		DNSServiceGeneratePrimaryInstallScriptProcedure,
+		svc.GeneratePrimaryInstallScript,
+		connect.WithSchema(dNSServiceMethods.ByName("GeneratePrimaryInstallScript")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/orchestrator.v1.DNSService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case DNSServiceEnableDNSHostingProcedure:
+			dNSServiceEnableDNSHostingHandler.ServeHTTP(w, r)
+		case DNSServiceDisableDNSHostingProcedure:
+			dNSServiceDisableDNSHostingHandler.ServeHTTP(w, r)
+		case DNSServiceCheckDelegationProcedure:
+			dNSServiceCheckDelegationHandler.ServeHTTP(w, r)
+		case DNSServiceGetZoneProcedure:
+			dNSServiceGetZoneHandler.ServeHTTP(w, r)
+		case DNSServiceGetPlatformZoneProcedure:
+			dNSServiceGetPlatformZoneHandler.ServeHTTP(w, r)
+		case DNSServiceListRecordsProcedure:
+			dNSServiceListRecordsHandler.ServeHTTP(w, r)
+		case DNSServiceCreateRecordProcedure:
+			dNSServiceCreateRecordHandler.ServeHTTP(w, r)
+		case DNSServiceUpdateRecordProcedure:
+			dNSServiceUpdateRecordHandler.ServeHTTP(w, r)
+		case DNSServiceDeleteRecordProcedure:
+			dNSServiceDeleteRecordHandler.ServeHTTP(w, r)
+		case DNSServicePreviewRecordChangeProcedure:
+			dNSServicePreviewRecordChangeHandler.ServeHTTP(w, r)
+		case DNSServiceProvisionNameserverProcedure:
+			dNSServiceProvisionNameserverHandler.ServeHTTP(w, r)
+		case DNSServiceListNameserversProcedure:
+			dNSServiceListNameserversHandler.ServeHTTP(w, r)
+		case DNSServiceGetNameserverInstallScriptProcedure:
+			dNSServiceGetNameserverInstallScriptHandler.ServeHTTP(w, r)
+		case DNSServiceDecommissionNameserverProcedure:
+			dNSServiceDecommissionNameserverHandler.ServeHTTP(w, r)
+		case DNSServiceGeneratePrimaryInstallScriptProcedure:
+			dNSServiceGeneratePrimaryInstallScriptHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedDNSServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedDNSServiceHandler struct{}
+
+func (UnimplementedDNSServiceHandler) EnableDNSHosting(context.Context, *connect.Request[v1.EnableDNSHostingRequest]) (*connect.Response[v1.EnableDNSHostingResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DNSService.EnableDNSHosting is not implemented"))
+}
+
+func (UnimplementedDNSServiceHandler) DisableDNSHosting(context.Context, *connect.Request[v1.DisableDNSHostingRequest]) (*connect.Response[v1.DisableDNSHostingResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DNSService.DisableDNSHosting is not implemented"))
+}
+
+func (UnimplementedDNSServiceHandler) CheckDelegation(context.Context, *connect.Request[v1.CheckDelegationRequest]) (*connect.Response[v1.CheckDelegationResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DNSService.CheckDelegation is not implemented"))
+}
+
+func (UnimplementedDNSServiceHandler) GetZone(context.Context, *connect.Request[v1.GetZoneRequest]) (*connect.Response[v1.GetZoneResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DNSService.GetZone is not implemented"))
+}
+
+func (UnimplementedDNSServiceHandler) GetPlatformZone(context.Context, *connect.Request[v1.GetPlatformZoneRequest]) (*connect.Response[v1.GetPlatformZoneResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DNSService.GetPlatformZone is not implemented"))
+}
+
+func (UnimplementedDNSServiceHandler) ListRecords(context.Context, *connect.Request[v1.ListRecordsRequest]) (*connect.Response[v1.ListRecordsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DNSService.ListRecords is not implemented"))
+}
+
+func (UnimplementedDNSServiceHandler) CreateRecord(context.Context, *connect.Request[v1.CreateRecordRequest]) (*connect.Response[v1.CreateRecordResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DNSService.CreateRecord is not implemented"))
+}
+
+func (UnimplementedDNSServiceHandler) UpdateRecord(context.Context, *connect.Request[v1.UpdateRecordRequest]) (*connect.Response[v1.UpdateRecordResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DNSService.UpdateRecord is not implemented"))
+}
+
+func (UnimplementedDNSServiceHandler) DeleteRecord(context.Context, *connect.Request[v1.DeleteRecordRequest]) (*connect.Response[v1.DeleteRecordResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DNSService.DeleteRecord is not implemented"))
+}
+
+func (UnimplementedDNSServiceHandler) PreviewRecordChange(context.Context, *connect.Request[v1.PreviewRecordChangeRequest]) (*connect.Response[v1.PreviewRecordChangeResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DNSService.PreviewRecordChange is not implemented"))
+}
+
+func (UnimplementedDNSServiceHandler) ProvisionNameserver(context.Context, *connect.Request[v1.ProvisionNameserverRequest]) (*connect.Response[v1.ProvisionNameserverResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DNSService.ProvisionNameserver is not implemented"))
+}
+
+func (UnimplementedDNSServiceHandler) ListNameservers(context.Context, *connect.Request[v1.ListNameserversRequest]) (*connect.Response[v1.ListNameserversResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DNSService.ListNameservers is not implemented"))
+}
+
+func (UnimplementedDNSServiceHandler) GetNameserverInstallScript(context.Context, *connect.Request[v1.GetNameserverInstallScriptRequest]) (*connect.Response[v1.GetNameserverInstallScriptResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DNSService.GetNameserverInstallScript is not implemented"))
+}
+
+func (UnimplementedDNSServiceHandler) DecommissionNameserver(context.Context, *connect.Request[v1.DecommissionNameserverRequest]) (*connect.Response[v1.DecommissionNameserverResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DNSService.DecommissionNameserver is not implemented"))
+}
+
+func (UnimplementedDNSServiceHandler) GeneratePrimaryInstallScript(context.Context, *connect.Request[v1.GeneratePrimaryInstallScriptRequest]) (*connect.Response[v1.GeneratePrimaryInstallScriptResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DNSService.GeneratePrimaryInstallScript is not implemented"))
+}

internal/api/orchestrator/v1/orchestratorv1connect/domains.connect.go

@@ -0,0 +1,698 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: orchestrator/v1/domains.proto
+
+package orchestratorv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "git.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// DomainServiceName is the fully-qualified name of the DomainService service.
+	DomainServiceName = "orchestrator.v1.DomainService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// DomainServiceAddDomainProcedure is the fully-qualified name of the DomainService's AddDomain RPC.
+	DomainServiceAddDomainProcedure = "/orchestrator.v1.DomainService/AddDomain"
+	// DomainServiceRemoveDomainProcedure is the fully-qualified name of the DomainService's
+	// RemoveDomain RPC.
+	DomainServiceRemoveDomainProcedure = "/orchestrator.v1.DomainService/RemoveDomain"
+	// DomainServiceListDomainsProcedure is the fully-qualified name of the DomainService's ListDomains
+	// RPC.
+	DomainServiceListDomainsProcedure = "/orchestrator.v1.DomainService/ListDomains"
+	// DomainServiceGetDomainProcedure is the fully-qualified name of the DomainService's GetDomain RPC.
+	DomainServiceGetDomainProcedure = "/orchestrator.v1.DomainService/GetDomain"
+	// DomainServiceVerifyDomainProcedure is the fully-qualified name of the DomainService's
+	// VerifyDomain RPC.
+	DomainServiceVerifyDomainProcedure = "/orchestrator.v1.DomainService/VerifyDomain"
+	// DomainServiceSetPrimaryDomainProcedure is the fully-qualified name of the DomainService's
+	// SetPrimaryDomain RPC.
+	DomainServiceSetPrimaryDomainProcedure = "/orchestrator.v1.DomainService/SetPrimaryDomain"
+	// DomainServiceGetDNSRecordsProcedure is the fully-qualified name of the DomainService's
+	// GetDNSRecords RPC.
+	DomainServiceGetDNSRecordsProcedure = "/orchestrator.v1.DomainService/GetDNSRecords"
+	// DomainServiceRequestSSLProcedure is the fully-qualified name of the DomainService's RequestSSL
+	// RPC.
+	DomainServiceRequestSSLProcedure = "/orchestrator.v1.DomainService/RequestSSL"
+	// DomainServiceRefreshSSLProcedure is the fully-qualified name of the DomainService's RefreshSSL
+	// RPC.
+	DomainServiceRefreshSSLProcedure = "/orchestrator.v1.DomainService/RefreshSSL"
+	// DomainServiceListAccountDomainsProcedure is the fully-qualified name of the DomainService's
+	// ListAccountDomains RPC.
+	DomainServiceListAccountDomainsProcedure = "/orchestrator.v1.DomainService/ListAccountDomains"
+	// DomainServiceAttachDomainProcedure is the fully-qualified name of the DomainService's
+	// AttachDomain RPC.
+	DomainServiceAttachDomainProcedure = "/orchestrator.v1.DomainService/AttachDomain"
+	// DomainServiceDetachDomainProcedure is the fully-qualified name of the DomainService's
+	// DetachDomain RPC.
+	DomainServiceDetachDomainProcedure = "/orchestrator.v1.DomainService/DetachDomain"
+	// DomainServiceUpdateDomainSettingsProcedure is the fully-qualified name of the DomainService's
+	// UpdateDomainSettings RPC.
+	DomainServiceUpdateDomainSettingsProcedure = "/orchestrator.v1.DomainService/UpdateDomainSettings"
+	// DomainServiceCheckDomainAvailabilityProcedure is the fully-qualified name of the DomainService's
+	// CheckDomainAvailability RPC.
+	DomainServiceCheckDomainAvailabilityProcedure = "/orchestrator.v1.DomainService/CheckDomainAvailability"
+	// DomainServicePurchaseDomainProcedure is the fully-qualified name of the DomainService's
+	// PurchaseDomain RPC.
+	DomainServicePurchaseDomainProcedure = "/orchestrator.v1.DomainService/PurchaseDomain"
+	// DomainServiceConfigureDNSProcedure is the fully-qualified name of the DomainService's
+	// ConfigureDNS RPC.
+	DomainServiceConfigureDNSProcedure = "/orchestrator.v1.DomainService/ConfigureDNS"
+	// DomainServiceGetDefaultRegistrantContactProcedure is the fully-qualified name of the
+	// DomainService's GetDefaultRegistrantContact RPC.
+	DomainServiceGetDefaultRegistrantContactProcedure = "/orchestrator.v1.DomainService/GetDefaultRegistrantContact"
+	// DomainServiceSaveDefaultRegistrantContactProcedure is the fully-qualified name of the
+	// DomainService's SaveDefaultRegistrantContact RPC.
+	DomainServiceSaveDefaultRegistrantContactProcedure = "/orchestrator.v1.DomainService/SaveDefaultRegistrantContact"
+	// DomainServiceGetDomainEventsProcedure is the fully-qualified name of the DomainService's
+	// GetDomainEvents RPC.
+	DomainServiceGetDomainEventsProcedure = "/orchestrator.v1.DomainService/GetDomainEvents"
+	// DomainServiceGetDNSGuidanceProcedure is the fully-qualified name of the DomainService's
+	// GetDNSGuidance RPC.
+	DomainServiceGetDNSGuidanceProcedure = "/orchestrator.v1.DomainService/GetDNSGuidance"
+)
+
+// DomainServiceClient is a client for the orchestrator.v1.DomainService service.
+type DomainServiceClient interface {
+	// Add a domain to an instance
+	AddDomain(context.Context, *connect.Request[v1.AddDomainRequest]) (*connect.Response[v1.AddDomainResponse], error)
+	// Remove a domain
+	RemoveDomain(context.Context, *connect.Request[v1.RemoveDomainRequest]) (*connect.Response[v1.RemoveDomainResponse], error)
+	// List domains for an instance
+	ListDomains(context.Context, *connect.Request[v1.ListDomainsRequest]) (*connect.Response[v1.ListDomainsResponse], error)
+	// Get domain details
+	GetDomain(context.Context, *connect.Request[v1.GetDomainRequest]) (*connect.Response[v1.GetDomainResponse], error)
+	// Verify domain ownership
+	VerifyDomain(context.Context, *connect.Request[v1.VerifyDomainRequest]) (*connect.Response[v1.VerifyDomainResponse], error)
+	// Set a domain as primary
+	SetPrimaryDomain(context.Context, *connect.Request[v1.SetPrimaryDomainRequest]) (*connect.Response[v1.SetPrimaryDomainResponse], error)
+	// Get DNS records for verification
+	GetDNSRecords(context.Context, *connect.Request[v1.GetDNSRecordsRequest]) (*connect.Response[v1.GetDNSRecordsResponse], error)
+	// Request SSL certificate
+	RequestSSL(context.Context, *connect.Request[v1.RequestSSLRequest]) (*connect.Response[v1.RequestSSLResponse], error)
+	// Probe a domain's TLS endpoint and update its SSL status
+	RefreshSSL(context.Context, *connect.Request[v1.RefreshSSLRequest]) (*connect.Response[v1.RefreshSSLResponse], error)
+	// List all domains for the current user's account
+	ListAccountDomains(context.Context, *connect.Request[v1.ListAccountDomainsRequest]) (*connect.Response[v1.ListAccountDomainsResponse], error)
+	// Attach a domain to an instance
+	AttachDomain(context.Context, *connect.Request[v1.AttachDomainRequest]) (*connect.Response[v1.AttachDomainResponse], error)
+	// Detach a domain from an instance
+	DetachDomain(context.Context, *connect.Request[v1.DetachDomainRequest]) (*connect.Response[v1.DetachDomainResponse], error)
+	// Update domain settings (www redirect, auto-renew)
+	UpdateDomainSettings(context.Context, *connect.Request[v1.UpdateDomainSettingsRequest]) (*connect.Response[v1.UpdateDomainSettingsResponse], error)
+	// Check if domains are available for purchase
+	CheckDomainAvailability(context.Context, *connect.Request[v1.CheckDomainAvailabilityRequest]) (*connect.Response[v1.CheckDomainAvailabilityResponse], error)
+	// Purchase a domain via Namecheap
+	PurchaseDomain(context.Context, *connect.Request[v1.PurchaseDomainRequest]) (*connect.Response[v1.PurchaseDomainResponse], error)
+	// Configure DNS for a purchased domain
+	ConfigureDNS(context.Context, *connect.Request[v1.ConfigureDNSRequest]) (*connect.Response[v1.ConfigureDNSResponse], error)
+	// Get the default registrant contact for the account
+	GetDefaultRegistrantContact(context.Context, *connect.Request[v1.GetDefaultRegistrantContactRequest]) (*connect.Response[v1.GetDefaultRegistrantContactResponse], error)
+	// Save or update the default registrant contact
+	SaveDefaultRegistrantContact(context.Context, *connect.Request[v1.SaveDefaultRegistrantContactRequest]) (*connect.Response[v1.SaveDefaultRegistrantContactResponse], error)
+	// Get domain events (SSL, DNS verification, etc.)
+	GetDomainEvents(context.Context, *connect.Request[v1.GetDomainEventsRequest]) (*connect.Response[v1.GetDomainEventsResponse], error)
+	// Get DNS configuration guidance for a domain
+	GetDNSGuidance(context.Context, *connect.Request[v1.GetDNSGuidanceRequest]) (*connect.Response[v1.GetDNSGuidanceResponse], error)
+}
+
+// NewDomainServiceClient constructs a client for the orchestrator.v1.DomainService service. By
+// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
+// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewDomainServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) DomainServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	domainServiceMethods := v1.File_orchestrator_v1_domains_proto.Services().ByName("DomainService").Methods()
+	return &domainServiceClient{
+		addDomain: connect.NewClient[v1.AddDomainRequest, v1.AddDomainResponse](
+			httpClient,
+			baseURL+DomainServiceAddDomainProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("AddDomain")),
+			connect.WithClientOptions(opts...),
+		),
+		removeDomain: connect.NewClient[v1.RemoveDomainRequest, v1.RemoveDomainResponse](
+			httpClient,
+			baseURL+DomainServiceRemoveDomainProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("RemoveDomain")),
+			connect.WithClientOptions(opts...),
+		),
+		listDomains: connect.NewClient[v1.ListDomainsRequest, v1.ListDomainsResponse](
+			httpClient,
+			baseURL+DomainServiceListDomainsProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("ListDomains")),
+			connect.WithClientOptions(opts...),
+		),
+		getDomain: connect.NewClient[v1.GetDomainRequest, v1.GetDomainResponse](
+			httpClient,
+			baseURL+DomainServiceGetDomainProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("GetDomain")),
+			connect.WithClientOptions(opts...),
+		),
+		verifyDomain: connect.NewClient[v1.VerifyDomainRequest, v1.VerifyDomainResponse](
+			httpClient,
+			baseURL+DomainServiceVerifyDomainProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("VerifyDomain")),
+			connect.WithClientOptions(opts...),
+		),
+		setPrimaryDomain: connect.NewClient[v1.SetPrimaryDomainRequest, v1.SetPrimaryDomainResponse](
+			httpClient,
+			baseURL+DomainServiceSetPrimaryDomainProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("SetPrimaryDomain")),
+			connect.WithClientOptions(opts...),
+		),
+		getDNSRecords: connect.NewClient[v1.GetDNSRecordsRequest, v1.GetDNSRecordsResponse](
+			httpClient,
+			baseURL+DomainServiceGetDNSRecordsProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("GetDNSRecords")),
+			connect.WithClientOptions(opts...),
+		),
+		requestSSL: connect.NewClient[v1.RequestSSLRequest, v1.RequestSSLResponse](
+			httpClient,
+			baseURL+DomainServiceRequestSSLProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("RequestSSL")),
+			connect.WithClientOptions(opts...),
+		),
+		refreshSSL: connect.NewClient[v1.RefreshSSLRequest, v1.RefreshSSLResponse](
+			httpClient,
+			baseURL+DomainServiceRefreshSSLProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("RefreshSSL")),
+			connect.WithClientOptions(opts...),
+		),
+		listAccountDomains: connect.NewClient[v1.ListAccountDomainsRequest, v1.ListAccountDomainsResponse](
+			httpClient,
+			baseURL+DomainServiceListAccountDomainsProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("ListAccountDomains")),
+			connect.WithClientOptions(opts...),
+		),
+		attachDomain: connect.NewClient[v1.AttachDomainRequest, v1.AttachDomainResponse](
+			httpClient,
+			baseURL+DomainServiceAttachDomainProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("AttachDomain")),
+			connect.WithClientOptions(opts...),
+		),
+		detachDomain: connect.NewClient[v1.DetachDomainRequest, v1.DetachDomainResponse](
+			httpClient,
+			baseURL+DomainServiceDetachDomainProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("DetachDomain")),
+			connect.WithClientOptions(opts...),
+		),
+		updateDomainSettings: connect.NewClient[v1.UpdateDomainSettingsRequest, v1.UpdateDomainSettingsResponse](
+			httpClient,
+			baseURL+DomainServiceUpdateDomainSettingsProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("UpdateDomainSettings")),
+			connect.WithClientOptions(opts...),
+		),
+		checkDomainAvailability: connect.NewClient[v1.CheckDomainAvailabilityRequest, v1.CheckDomainAvailabilityResponse](
+			httpClient,
+			baseURL+DomainServiceCheckDomainAvailabilityProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("CheckDomainAvailability")),
+			connect.WithClientOptions(opts...),
+		),
+		purchaseDomain: connect.NewClient[v1.PurchaseDomainRequest, v1.PurchaseDomainResponse](
+			httpClient,
+			baseURL+DomainServicePurchaseDomainProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("PurchaseDomain")),
+			connect.WithClientOptions(opts...),
+		),
+		configureDNS: connect.NewClient[v1.ConfigureDNSRequest, v1.ConfigureDNSResponse](
+			httpClient,
+			baseURL+DomainServiceConfigureDNSProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("ConfigureDNS")),
+			connect.WithClientOptions(opts...),
+		),
+		getDefaultRegistrantContact: connect.NewClient[v1.GetDefaultRegistrantContactRequest, v1.GetDefaultRegistrantContactResponse](
+			httpClient,
+			baseURL+DomainServiceGetDefaultRegistrantContactProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("GetDefaultRegistrantContact")),
+			connect.WithClientOptions(opts...),
+		),
+		saveDefaultRegistrantContact: connect.NewClient[v1.SaveDefaultRegistrantContactRequest, v1.SaveDefaultRegistrantContactResponse](
+			httpClient,
+			baseURL+DomainServiceSaveDefaultRegistrantContactProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("SaveDefaultRegistrantContact")),
+			connect.WithClientOptions(opts...),
+		),
+		getDomainEvents: connect.NewClient[v1.GetDomainEventsRequest, v1.GetDomainEventsResponse](
+			httpClient,
+			baseURL+DomainServiceGetDomainEventsProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("GetDomainEvents")),
+			connect.WithClientOptions(opts...),
+		),
+		getDNSGuidance: connect.NewClient[v1.GetDNSGuidanceRequest, v1.GetDNSGuidanceResponse](
+			httpClient,
+			baseURL+DomainServiceGetDNSGuidanceProcedure,
+			connect.WithSchema(domainServiceMethods.ByName("GetDNSGuidance")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// domainServiceClient implements DomainServiceClient.
+type domainServiceClient struct {
+	addDomain                    *connect.Client[v1.AddDomainRequest, v1.AddDomainResponse]
+	removeDomain                 *connect.Client[v1.RemoveDomainRequest, v1.RemoveDomainResponse]
+	listDomains                  *connect.Client[v1.ListDomainsRequest, v1.ListDomainsResponse]
+	getDomain                    *connect.Client[v1.GetDomainRequest, v1.GetDomainResponse]
+	verifyDomain                 *connect.Client[v1.VerifyDomainRequest, v1.VerifyDomainResponse]
+	setPrimaryDomain             *connect.Client[v1.SetPrimaryDomainRequest, v1.SetPrimaryDomainResponse]
+	getDNSRecords                *connect.Client[v1.GetDNSRecordsRequest, v1.GetDNSRecordsResponse]
+	requestSSL                   *connect.Client[v1.RequestSSLRequest, v1.RequestSSLResponse]
+	refreshSSL                   *connect.Client[v1.RefreshSSLRequest, v1.RefreshSSLResponse]
+	listAccountDomains           *connect.Client[v1.ListAccountDomainsRequest, v1.ListAccountDomainsResponse]
+	attachDomain                 *connect.Client[v1.AttachDomainRequest, v1.AttachDomainResponse]
+	detachDomain                 *connect.Client[v1.DetachDomainRequest, v1.DetachDomainResponse]
+	updateDomainSettings         *connect.Client[v1.UpdateDomainSettingsRequest, v1.UpdateDomainSettingsResponse]
+	checkDomainAvailability      *connect.Client[v1.CheckDomainAvailabilityRequest, v1.CheckDomainAvailabilityResponse]
+	purchaseDomain               *connect.Client[v1.PurchaseDomainRequest, v1.PurchaseDomainResponse]
+	configureDNS                 *connect.Client[v1.ConfigureDNSRequest, v1.ConfigureDNSResponse]
+	getDefaultRegistrantContact  *connect.Client[v1.GetDefaultRegistrantContactRequest, v1.GetDefaultRegistrantContactResponse]
+	saveDefaultRegistrantContact *connect.Client[v1.SaveDefaultRegistrantContactRequest, v1.SaveDefaultRegistrantContactResponse]
+	getDomainEvents              *connect.Client[v1.GetDomainEventsRequest, v1.GetDomainEventsResponse]
+	getDNSGuidance               *connect.Client[v1.GetDNSGuidanceRequest, v1.GetDNSGuidanceResponse]
+}
+
+// AddDomain calls orchestrator.v1.DomainService.AddDomain.
+func (c *domainServiceClient) AddDomain(ctx context.Context, req *connect.Request[v1.AddDomainRequest]) (*connect.Response[v1.AddDomainResponse], error) {
+	return c.addDomain.CallUnary(ctx, req)
+}
+
+// RemoveDomain calls orchestrator.v1.DomainService.RemoveDomain.
+func (c *domainServiceClient) RemoveDomain(ctx context.Context, req *connect.Request[v1.RemoveDomainRequest]) (*connect.Response[v1.RemoveDomainResponse], error) {
+	return c.removeDomain.CallUnary(ctx, req)
+}
+
+// ListDomains calls orchestrator.v1.DomainService.ListDomains.
+func (c *domainServiceClient) ListDomains(ctx context.Context, req *connect.Request[v1.ListDomainsRequest]) (*connect.Response[v1.ListDomainsResponse], error) {
+	return c.listDomains.CallUnary(ctx, req)
+}
+
+// GetDomain calls orchestrator.v1.DomainService.GetDomain.
+func (c *domainServiceClient) GetDomain(ctx context.Context, req *connect.Request[v1.GetDomainRequest]) (*connect.Response[v1.GetDomainResponse], error) {
+	return c.getDomain.CallUnary(ctx, req)
+}
+
+// VerifyDomain calls orchestrator.v1.DomainService.VerifyDomain.
+func (c *domainServiceClient) VerifyDomain(ctx context.Context, req *connect.Request[v1.VerifyDomainRequest]) (*connect.Response[v1.VerifyDomainResponse], error) {
+	return c.verifyDomain.CallUnary(ctx, req)
+}
+
+// SetPrimaryDomain calls orchestrator.v1.DomainService.SetPrimaryDomain.
+func (c *domainServiceClient) SetPrimaryDomain(ctx context.Context, req *connect.Request[v1.SetPrimaryDomainRequest]) (*connect.Response[v1.SetPrimaryDomainResponse], error) {
+	return c.setPrimaryDomain.CallUnary(ctx, req)
+}
+
+// GetDNSRecords calls orchestrator.v1.DomainService.GetDNSRecords.
+func (c *domainServiceClient) GetDNSRecords(ctx context.Context, req *connect.Request[v1.GetDNSRecordsRequest]) (*connect.Response[v1.GetDNSRecordsResponse], error) {
+	return c.getDNSRecords.CallUnary(ctx, req)
+}
+
+// RequestSSL calls orchestrator.v1.DomainService.RequestSSL.
+func (c *domainServiceClient) RequestSSL(ctx context.Context, req *connect.Request[v1.RequestSSLRequest]) (*connect.Response[v1.RequestSSLResponse], error) {
+	return c.requestSSL.CallUnary(ctx, req)
+}
+
+// RefreshSSL calls orchestrator.v1.DomainService.RefreshSSL.
+func (c *domainServiceClient) RefreshSSL(ctx context.Context, req *connect.Request[v1.RefreshSSLRequest]) (*connect.Response[v1.RefreshSSLResponse], error) {
+	return c.refreshSSL.CallUnary(ctx, req)
+}
+
+// ListAccountDomains calls orchestrator.v1.DomainService.ListAccountDomains.
+func (c *domainServiceClient) ListAccountDomains(ctx context.Context, req *connect.Request[v1.ListAccountDomainsRequest]) (*connect.Response[v1.ListAccountDomainsResponse], error) {
+	return c.listAccountDomains.CallUnary(ctx, req)
+}
+
+// AttachDomain calls orchestrator.v1.DomainService.AttachDomain.
+func (c *domainServiceClient) AttachDomain(ctx context.Context, req *connect.Request[v1.AttachDomainRequest]) (*connect.Response[v1.AttachDomainResponse], error) {
+	return c.attachDomain.CallUnary(ctx, req)
+}
+
+// DetachDomain calls orchestrator.v1.DomainService.DetachDomain.
+func (c *domainServiceClient) DetachDomain(ctx context.Context, req *connect.Request[v1.DetachDomainRequest]) (*connect.Response[v1.DetachDomainResponse], error) {
+	return c.detachDomain.CallUnary(ctx, req)
+}
+
+// UpdateDomainSettings calls orchestrator.v1.DomainService.UpdateDomainSettings.
+func (c *domainServiceClient) UpdateDomainSettings(ctx context.Context, req *connect.Request[v1.UpdateDomainSettingsRequest]) (*connect.Response[v1.UpdateDomainSettingsResponse], error) {
+	return c.updateDomainSettings.CallUnary(ctx, req)
+}
+
+// CheckDomainAvailability calls orchestrator.v1.DomainService.CheckDomainAvailability.
+func (c *domainServiceClient) CheckDomainAvailability(ctx context.Context, req *connect.Request[v1.CheckDomainAvailabilityRequest]) (*connect.Response[v1.CheckDomainAvailabilityResponse], error) {
+	return c.checkDomainAvailability.CallUnary(ctx, req)
+}
+
+// PurchaseDomain calls orchestrator.v1.DomainService.PurchaseDomain.
+func (c *domainServiceClient) PurchaseDomain(ctx context.Context, req *connect.Request[v1.PurchaseDomainRequest]) (*connect.Response[v1.PurchaseDomainResponse], error) {
+	return c.purchaseDomain.CallUnary(ctx, req)
+}
+
+// ConfigureDNS calls orchestrator.v1.DomainService.ConfigureDNS.
+func (c *domainServiceClient) ConfigureDNS(ctx context.Context, req *connect.Request[v1.ConfigureDNSRequest]) (*connect.Response[v1.ConfigureDNSResponse], error) {
+	return c.configureDNS.CallUnary(ctx, req)
+}
+
+// GetDefaultRegistrantContact calls orchestrator.v1.DomainService.GetDefaultRegistrantContact.
+func (c *domainServiceClient) GetDefaultRegistrantContact(ctx context.Context, req *connect.Request[v1.GetDefaultRegistrantContactRequest]) (*connect.Response[v1.GetDefaultRegistrantContactResponse], error) {
+	return c.getDefaultRegistrantContact.CallUnary(ctx, req)
+}
+
+// SaveDefaultRegistrantContact calls orchestrator.v1.DomainService.SaveDefaultRegistrantContact.
+func (c *domainServiceClient) SaveDefaultRegistrantContact(ctx context.Context, req *connect.Request[v1.SaveDefaultRegistrantContactRequest]) (*connect.Response[v1.SaveDefaultRegistrantContactResponse], error) {
+	return c.saveDefaultRegistrantContact.CallUnary(ctx, req)
+}
+
+// GetDomainEvents calls orchestrator.v1.DomainService.GetDomainEvents.
+func (c *domainServiceClient) GetDomainEvents(ctx context.Context, req *connect.Request[v1.GetDomainEventsRequest]) (*connect.Response[v1.GetDomainEventsResponse], error) {
+	return c.getDomainEvents.CallUnary(ctx, req)
+}
+
+// GetDNSGuidance calls orchestrator.v1.DomainService.GetDNSGuidance.
+func (c *domainServiceClient) GetDNSGuidance(ctx context.Context, req *connect.Request[v1.GetDNSGuidanceRequest]) (*connect.Response[v1.GetDNSGuidanceResponse], error) {
+	return c.getDNSGuidance.CallUnary(ctx, req)
+}
+
+// DomainServiceHandler is an implementation of the orchestrator.v1.DomainService service.
+type DomainServiceHandler interface {
+	// Add a domain to an instance
+	AddDomain(context.Context, *connect.Request[v1.AddDomainRequest]) (*connect.Response[v1.AddDomainResponse], error)
+	// Remove a domain
+	RemoveDomain(context.Context, *connect.Request[v1.RemoveDomainRequest]) (*connect.Response[v1.RemoveDomainResponse], error)
+	// List domains for an instance
+	ListDomains(context.Context, *connect.Request[v1.ListDomainsRequest]) (*connect.Response[v1.ListDomainsResponse], error)
+	// Get domain details
+	GetDomain(context.Context, *connect.Request[v1.GetDomainRequest]) (*connect.Response[v1.GetDomainResponse], error)
+	// Verify domain ownership
+	VerifyDomain(context.Context, *connect.Request[v1.VerifyDomainRequest]) (*connect.Response[v1.VerifyDomainResponse], error)
+	// Set a domain as primary
+	SetPrimaryDomain(context.Context, *connect.Request[v1.SetPrimaryDomainRequest]) (*connect.Response[v1.SetPrimaryDomainResponse], error)
+	// Get DNS records for verification
+	GetDNSRecords(context.Context, *connect.Request[v1.GetDNSRecordsRequest]) (*connect.Response[v1.GetDNSRecordsResponse], error)
+	// Request SSL certificate
+	RequestSSL(context.Context, *connect.Request[v1.RequestSSLRequest]) (*connect.Response[v1.RequestSSLResponse], error)
+	// Probe a domain's TLS endpoint and update its SSL status
+	RefreshSSL(context.Context, *connect.Request[v1.RefreshSSLRequest]) (*connect.Response[v1.RefreshSSLResponse], error)
+	// List all domains for the current user's account
+	ListAccountDomains(context.Context, *connect.Request[v1.ListAccountDomainsRequest]) (*connect.Response[v1.ListAccountDomainsResponse], error)
+	// Attach a domain to an instance
+	AttachDomain(context.Context, *connect.Request[v1.AttachDomainRequest]) (*connect.Response[v1.AttachDomainResponse], error)
+	// Detach a domain from an instance
+	DetachDomain(context.Context, *connect.Request[v1.DetachDomainRequest]) (*connect.Response[v1.DetachDomainResponse], error)
+	// Update domain settings (www redirect, auto-renew)
+	UpdateDomainSettings(context.Context, *connect.Request[v1.UpdateDomainSettingsRequest]) (*connect.Response[v1.UpdateDomainSettingsResponse], error)
+	// Check if domains are available for purchase
+	CheckDomainAvailability(context.Context, *connect.Request[v1.CheckDomainAvailabilityRequest]) (*connect.Response[v1.CheckDomainAvailabilityResponse], error)
+	// Purchase a domain via Namecheap
+	PurchaseDomain(context.Context, *connect.Request[v1.PurchaseDomainRequest]) (*connect.Response[v1.PurchaseDomainResponse], error)
+	// Configure DNS for a purchased domain
+	ConfigureDNS(context.Context, *connect.Request[v1.ConfigureDNSRequest]) (*connect.Response[v1.ConfigureDNSResponse], error)
+	// Get the default registrant contact for the account
+	GetDefaultRegistrantContact(context.Context, *connect.Request[v1.GetDefaultRegistrantContactRequest]) (*connect.Response[v1.GetDefaultRegistrantContactResponse], error)
+	// Save or update the default registrant contact
+	SaveDefaultRegistrantContact(context.Context, *connect.Request[v1.SaveDefaultRegistrantContactRequest]) (*connect.Response[v1.SaveDefaultRegistrantContactResponse], error)
+	// Get domain events (SSL, DNS verification, etc.)
+	GetDomainEvents(context.Context, *connect.Request[v1.GetDomainEventsRequest]) (*connect.Response[v1.GetDomainEventsResponse], error)
+	// Get DNS configuration guidance for a domain
+	GetDNSGuidance(context.Context, *connect.Request[v1.GetDNSGuidanceRequest]) (*connect.Response[v1.GetDNSGuidanceResponse], error)
+}
+
+// NewDomainServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewDomainServiceHandler(svc DomainServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	domainServiceMethods := v1.File_orchestrator_v1_domains_proto.Services().ByName("DomainService").Methods()
+	domainServiceAddDomainHandler := connect.NewUnaryHandler(
+		DomainServiceAddDomainProcedure,
+		svc.AddDomain,
+		connect.WithSchema(domainServiceMethods.ByName("AddDomain")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceRemoveDomainHandler := connect.NewUnaryHandler(
+		DomainServiceRemoveDomainProcedure,
+		svc.RemoveDomain,
+		connect.WithSchema(domainServiceMethods.ByName("RemoveDomain")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceListDomainsHandler := connect.NewUnaryHandler(
+		DomainServiceListDomainsProcedure,
+		svc.ListDomains,
+		connect.WithSchema(domainServiceMethods.ByName("ListDomains")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceGetDomainHandler := connect.NewUnaryHandler(
+		DomainServiceGetDomainProcedure,
+		svc.GetDomain,
+		connect.WithSchema(domainServiceMethods.ByName("GetDomain")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceVerifyDomainHandler := connect.NewUnaryHandler(
+		DomainServiceVerifyDomainProcedure,
+		svc.VerifyDomain,
+		connect.WithSchema(domainServiceMethods.ByName("VerifyDomain")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceSetPrimaryDomainHandler := connect.NewUnaryHandler(
+		DomainServiceSetPrimaryDomainProcedure,
+		svc.SetPrimaryDomain,
+		connect.WithSchema(domainServiceMethods.ByName("SetPrimaryDomain")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceGetDNSRecordsHandler := connect.NewUnaryHandler(
+		DomainServiceGetDNSRecordsProcedure,
+		svc.GetDNSRecords,
+		connect.WithSchema(domainServiceMethods.ByName("GetDNSRecords")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceRequestSSLHandler := connect.NewUnaryHandler(
+		DomainServiceRequestSSLProcedure,
+		svc.RequestSSL,
+		connect.WithSchema(domainServiceMethods.ByName("RequestSSL")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceRefreshSSLHandler := connect.NewUnaryHandler(
+		DomainServiceRefreshSSLProcedure,
+		svc.RefreshSSL,
+		connect.WithSchema(domainServiceMethods.ByName("RefreshSSL")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceListAccountDomainsHandler := connect.NewUnaryHandler(
+		DomainServiceListAccountDomainsProcedure,
+		svc.ListAccountDomains,
+		connect.WithSchema(domainServiceMethods.ByName("ListAccountDomains")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceAttachDomainHandler := connect.NewUnaryHandler(
+		DomainServiceAttachDomainProcedure,
+		svc.AttachDomain,
+		connect.WithSchema(domainServiceMethods.ByName("AttachDomain")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceDetachDomainHandler := connect.NewUnaryHandler(
+		DomainServiceDetachDomainProcedure,
+		svc.DetachDomain,
+		connect.WithSchema(domainServiceMethods.ByName("DetachDomain")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceUpdateDomainSettingsHandler := connect.NewUnaryHandler(
+		DomainServiceUpdateDomainSettingsProcedure,
+		svc.UpdateDomainSettings,
+		connect.WithSchema(domainServiceMethods.ByName("UpdateDomainSettings")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceCheckDomainAvailabilityHandler := connect.NewUnaryHandler(
+		DomainServiceCheckDomainAvailabilityProcedure,
+		svc.CheckDomainAvailability,
+		connect.WithSchema(domainServiceMethods.ByName("CheckDomainAvailability")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServicePurchaseDomainHandler := connect.NewUnaryHandler(
+		DomainServicePurchaseDomainProcedure,
+		svc.PurchaseDomain,
+		connect.WithSchema(domainServiceMethods.ByName("PurchaseDomain")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceConfigureDNSHandler := connect.NewUnaryHandler(
+		DomainServiceConfigureDNSProcedure,
+		svc.ConfigureDNS,
+		connect.WithSchema(domainServiceMethods.ByName("ConfigureDNS")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceGetDefaultRegistrantContactHandler := connect.NewUnaryHandler(
+		DomainServiceGetDefaultRegistrantContactProcedure,
+		svc.GetDefaultRegistrantContact,
+		connect.WithSchema(domainServiceMethods.ByName("GetDefaultRegistrantContact")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceSaveDefaultRegistrantContactHandler := connect.NewUnaryHandler(
+		DomainServiceSaveDefaultRegistrantContactProcedure,
+		svc.SaveDefaultRegistrantContact,
+		connect.WithSchema(domainServiceMethods.ByName("SaveDefaultRegistrantContact")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceGetDomainEventsHandler := connect.NewUnaryHandler(
+		DomainServiceGetDomainEventsProcedure,
+		svc.GetDomainEvents,
+		connect.WithSchema(domainServiceMethods.ByName("GetDomainEvents")),
+		connect.WithHandlerOptions(opts...),
+	)
+	domainServiceGetDNSGuidanceHandler := connect.NewUnaryHandler(
+		DomainServiceGetDNSGuidanceProcedure,
+		svc.GetDNSGuidance,
+		connect.WithSchema(domainServiceMethods.ByName("GetDNSGuidance")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/orchestrator.v1.DomainService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case DomainServiceAddDomainProcedure:
+			domainServiceAddDomainHandler.ServeHTTP(w, r)
+		case DomainServiceRemoveDomainProcedure:
+			domainServiceRemoveDomainHandler.ServeHTTP(w, r)
+		case DomainServiceListDomainsProcedure:
+			domainServiceListDomainsHandler.ServeHTTP(w, r)
+		case DomainServiceGetDomainProcedure:
+			domainServiceGetDomainHandler.ServeHTTP(w, r)
+		case DomainServiceVerifyDomainProcedure:
+			domainServiceVerifyDomainHandler.ServeHTTP(w, r)
+		case DomainServiceSetPrimaryDomainProcedure:
+			domainServiceSetPrimaryDomainHandler.ServeHTTP(w, r)
+		case DomainServiceGetDNSRecordsProcedure:
+			domainServiceGetDNSRecordsHandler.ServeHTTP(w, r)
+		case DomainServiceRequestSSLProcedure:
+			domainServiceRequestSSLHandler.ServeHTTP(w, r)
+		case DomainServiceRefreshSSLProcedure:
+			domainServiceRefreshSSLHandler.ServeHTTP(w, r)
+		case DomainServiceListAccountDomainsProcedure:
+			domainServiceListAccountDomainsHandler.ServeHTTP(w, r)
+		case DomainServiceAttachDomainProcedure:
+			domainServiceAttachDomainHandler.ServeHTTP(w, r)
+		case DomainServiceDetachDomainProcedure:
+			domainServiceDetachDomainHandler.ServeHTTP(w, r)
+		case DomainServiceUpdateDomainSettingsProcedure:
+			domainServiceUpdateDomainSettingsHandler.ServeHTTP(w, r)
+		case DomainServiceCheckDomainAvailabilityProcedure:
+			domainServiceCheckDomainAvailabilityHandler.ServeHTTP(w, r)
+		case DomainServicePurchaseDomainProcedure:
+			domainServicePurchaseDomainHandler.ServeHTTP(w, r)
+		case DomainServiceConfigureDNSProcedure:
+			domainServiceConfigureDNSHandler.ServeHTTP(w, r)
+		case DomainServiceGetDefaultRegistrantContactProcedure:
+			domainServiceGetDefaultRegistrantContactHandler.ServeHTTP(w, r)
+		case DomainServiceSaveDefaultRegistrantContactProcedure:
+			domainServiceSaveDefaultRegistrantContactHandler.ServeHTTP(w, r)
+		case DomainServiceGetDomainEventsProcedure:
+			domainServiceGetDomainEventsHandler.ServeHTTP(w, r)
+		case DomainServiceGetDNSGuidanceProcedure:
+			domainServiceGetDNSGuidanceHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedDomainServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedDomainServiceHandler struct{}
+
+func (UnimplementedDomainServiceHandler) AddDomain(context.Context, *connect.Request[v1.AddDomainRequest]) (*connect.Response[v1.AddDomainResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.AddDomain is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) RemoveDomain(context.Context, *connect.Request[v1.RemoveDomainRequest]) (*connect.Response[v1.RemoveDomainResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.RemoveDomain is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) ListDomains(context.Context, *connect.Request[v1.ListDomainsRequest]) (*connect.Response[v1.ListDomainsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.ListDomains is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) GetDomain(context.Context, *connect.Request[v1.GetDomainRequest]) (*connect.Response[v1.GetDomainResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.GetDomain is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) VerifyDomain(context.Context, *connect.Request[v1.VerifyDomainRequest]) (*connect.Response[v1.VerifyDomainResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.VerifyDomain is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) SetPrimaryDomain(context.Context, *connect.Request[v1.SetPrimaryDomainRequest]) (*connect.Response[v1.SetPrimaryDomainResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.SetPrimaryDomain is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) GetDNSRecords(context.Context, *connect.Request[v1.GetDNSRecordsRequest]) (*connect.Response[v1.GetDNSRecordsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.GetDNSRecords is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) RequestSSL(context.Context, *connect.Request[v1.RequestSSLRequest]) (*connect.Response[v1.RequestSSLResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.RequestSSL is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) RefreshSSL(context.Context, *connect.Request[v1.RefreshSSLRequest]) (*connect.Response[v1.RefreshSSLResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.RefreshSSL is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) ListAccountDomains(context.Context, *connect.Request[v1.ListAccountDomainsRequest]) (*connect.Response[v1.ListAccountDomainsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.ListAccountDomains is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) AttachDomain(context.Context, *connect.Request[v1.AttachDomainRequest]) (*connect.Response[v1.AttachDomainResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.AttachDomain is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) DetachDomain(context.Context, *connect.Request[v1.DetachDomainRequest]) (*connect.Response[v1.DetachDomainResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.DetachDomain is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) UpdateDomainSettings(context.Context, *connect.Request[v1.UpdateDomainSettingsRequest]) (*connect.Response[v1.UpdateDomainSettingsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.UpdateDomainSettings is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) CheckDomainAvailability(context.Context, *connect.Request[v1.CheckDomainAvailabilityRequest]) (*connect.Response[v1.CheckDomainAvailabilityResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.CheckDomainAvailability is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) PurchaseDomain(context.Context, *connect.Request[v1.PurchaseDomainRequest]) (*connect.Response[v1.PurchaseDomainResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.PurchaseDomain is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) ConfigureDNS(context.Context, *connect.Request[v1.ConfigureDNSRequest]) (*connect.Response[v1.ConfigureDNSResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.ConfigureDNS is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) GetDefaultRegistrantContact(context.Context, *connect.Request[v1.GetDefaultRegistrantContactRequest]) (*connect.Response[v1.GetDefaultRegistrantContactResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.GetDefaultRegistrantContact is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) SaveDefaultRegistrantContact(context.Context, *connect.Request[v1.SaveDefaultRegistrantContactRequest]) (*connect.Response[v1.SaveDefaultRegistrantContactResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.SaveDefaultRegistrantContact is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) GetDomainEvents(context.Context, *connect.Request[v1.GetDomainEventsRequest]) (*connect.Response[v1.GetDomainEventsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.GetDomainEvents is not implemented"))
+}
+
+func (UnimplementedDomainServiceHandler) GetDNSGuidance(context.Context, *connect.Request[v1.GetDNSGuidanceRequest]) (*connect.Response[v1.GetDNSGuidanceResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.DomainService.GetDNSGuidance is not implemented"))
+}

internal/api/orchestrator/v1/orchestratorv1connect/email.connect.go

@@ -0,0 +1,141 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: orchestrator/v1/email.proto
+
+package orchestratorv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "git.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// EmailServiceName is the fully-qualified name of the EmailService service.
+	EmailServiceName = "orchestrator.v1.EmailService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// EmailServiceQueueEmailProcedure is the fully-qualified name of the EmailService's QueueEmail RPC.
+	EmailServiceQueueEmailProcedure = "/orchestrator.v1.EmailService/QueueEmail"
+	// EmailServiceGetEmailLimitsProcedure is the fully-qualified name of the EmailService's
+	// GetEmailLimits RPC.
+	EmailServiceGetEmailLimitsProcedure = "/orchestrator.v1.EmailService/GetEmailLimits"
+)
+
+// EmailServiceClient is a client for the orchestrator.v1.EmailService service.
+type EmailServiceClient interface {
+	// Queue an email from a CMS instance
+	QueueEmail(context.Context, *connect.Request[v1.QueueEmailRequest]) (*connect.Response[v1.QueueEmailResponse], error)
+	// Check email quota and limits for an instance
+	GetEmailLimits(context.Context, *connect.Request[v1.GetEmailLimitsRequest]) (*connect.Response[v1.GetEmailLimitsResponse], error)
+}
+
+// NewEmailServiceClient constructs a client for the orchestrator.v1.EmailService service. By
+// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
+// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewEmailServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) EmailServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	emailServiceMethods := v1.File_orchestrator_v1_email_proto.Services().ByName("EmailService").Methods()
+	return &emailServiceClient{
+		queueEmail: connect.NewClient[v1.QueueEmailRequest, v1.QueueEmailResponse](
+			httpClient,
+			baseURL+EmailServiceQueueEmailProcedure,
+			connect.WithSchema(emailServiceMethods.ByName("QueueEmail")),
+			connect.WithClientOptions(opts...),
+		),
+		getEmailLimits: connect.NewClient[v1.GetEmailLimitsRequest, v1.GetEmailLimitsResponse](
+			httpClient,
+			baseURL+EmailServiceGetEmailLimitsProcedure,
+			connect.WithSchema(emailServiceMethods.ByName("GetEmailLimits")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// emailServiceClient implements EmailServiceClient.
+type emailServiceClient struct {
+	queueEmail     *connect.Client[v1.QueueEmailRequest, v1.QueueEmailResponse]
+	getEmailLimits *connect.Client[v1.GetEmailLimitsRequest, v1.GetEmailLimitsResponse]
+}
+
+// QueueEmail calls orchestrator.v1.EmailService.QueueEmail.
+func (c *emailServiceClient) QueueEmail(ctx context.Context, req *connect.Request[v1.QueueEmailRequest]) (*connect.Response[v1.QueueEmailResponse], error) {
+	return c.queueEmail.CallUnary(ctx, req)
+}
+
+// GetEmailLimits calls orchestrator.v1.EmailService.GetEmailLimits.
+func (c *emailServiceClient) GetEmailLimits(ctx context.Context, req *connect.Request[v1.GetEmailLimitsRequest]) (*connect.Response[v1.GetEmailLimitsResponse], error) {
+	return c.getEmailLimits.CallUnary(ctx, req)
+}
+
+// EmailServiceHandler is an implementation of the orchestrator.v1.EmailService service.
+type EmailServiceHandler interface {
+	// Queue an email from a CMS instance
+	QueueEmail(context.Context, *connect.Request[v1.QueueEmailRequest]) (*connect.Response[v1.QueueEmailResponse], error)
+	// Check email quota and limits for an instance
+	GetEmailLimits(context.Context, *connect.Request[v1.GetEmailLimitsRequest]) (*connect.Response[v1.GetEmailLimitsResponse], error)
+}
+
+// NewEmailServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewEmailServiceHandler(svc EmailServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	emailServiceMethods := v1.File_orchestrator_v1_email_proto.Services().ByName("EmailService").Methods()
+	emailServiceQueueEmailHandler := connect.NewUnaryHandler(
+		EmailServiceQueueEmailProcedure,
+		svc.QueueEmail,
+		connect.WithSchema(emailServiceMethods.ByName("QueueEmail")),
+		connect.WithHandlerOptions(opts...),
+	)
+	emailServiceGetEmailLimitsHandler := connect.NewUnaryHandler(
+		EmailServiceGetEmailLimitsProcedure,
+		svc.GetEmailLimits,
+		connect.WithSchema(emailServiceMethods.ByName("GetEmailLimits")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/orchestrator.v1.EmailService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case EmailServiceQueueEmailProcedure:
+			emailServiceQueueEmailHandler.ServeHTTP(w, r)
+		case EmailServiceGetEmailLimitsProcedure:
+			emailServiceGetEmailLimitsHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedEmailServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedEmailServiceHandler struct{}
+
+func (UnimplementedEmailServiceHandler) QueueEmail(context.Context, *connect.Request[v1.QueueEmailRequest]) (*connect.Response[v1.QueueEmailResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.EmailService.QueueEmail is not implemented"))
+}
+
+func (UnimplementedEmailServiceHandler) GetEmailLimits(context.Context, *connect.Request[v1.GetEmailLimitsRequest]) (*connect.Response[v1.GetEmailLimitsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.EmailService.GetEmailLimits is not implemented"))
+}

internal/api/orchestrator/v1/orchestratorv1connect/nodes.connect.go

@@ -0,0 +1,571 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: orchestrator/v1/nodes.proto
+
+package orchestratorv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "git.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// NodeServiceName is the fully-qualified name of the NodeService service.
+	NodeServiceName = "orchestrator.v1.NodeService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// NodeServiceCreateNodeProcedure is the fully-qualified name of the NodeService's CreateNode RPC.
+	NodeServiceCreateNodeProcedure = "/orchestrator.v1.NodeService/CreateNode"
+	// NodeServiceGetNodeProcedure is the fully-qualified name of the NodeService's GetNode RPC.
+	NodeServiceGetNodeProcedure = "/orchestrator.v1.NodeService/GetNode"
+	// NodeServiceListNodesProcedure is the fully-qualified name of the NodeService's ListNodes RPC.
+	NodeServiceListNodesProcedure = "/orchestrator.v1.NodeService/ListNodes"
+	// NodeServiceUpdateNodeProcedure is the fully-qualified name of the NodeService's UpdateNode RPC.
+	NodeServiceUpdateNodeProcedure = "/orchestrator.v1.NodeService/UpdateNode"
+	// NodeServiceUpdateNodeSSHKeyProcedure is the fully-qualified name of the NodeService's
+	// UpdateNodeSSHKey RPC.
+	NodeServiceUpdateNodeSSHKeyProcedure = "/orchestrator.v1.NodeService/UpdateNodeSSHKey"
+	// NodeServiceDeleteNodeProcedure is the fully-qualified name of the NodeService's DeleteNode RPC.
+	NodeServiceDeleteNodeProcedure = "/orchestrator.v1.NodeService/DeleteNode"
+	// NodeServiceHealthCheckNodeProcedure is the fully-qualified name of the NodeService's
+	// HealthCheckNode RPC.
+	NodeServiceHealthCheckNodeProcedure = "/orchestrator.v1.NodeService/HealthCheckNode"
+	// NodeServiceDrainNodeProcedure is the fully-qualified name of the NodeService's DrainNode RPC.
+	NodeServiceDrainNodeProcedure = "/orchestrator.v1.NodeService/DrainNode"
+	// NodeServiceActivateNodeProcedure is the fully-qualified name of the NodeService's ActivateNode
+	// RPC.
+	NodeServiceActivateNodeProcedure = "/orchestrator.v1.NodeService/ActivateNode"
+	// NodeServiceOfflineNodeProcedure is the fully-qualified name of the NodeService's OfflineNode RPC.
+	NodeServiceOfflineNodeProcedure = "/orchestrator.v1.NodeService/OfflineNode"
+	// NodeServiceTestNodeConnectionProcedure is the fully-qualified name of the NodeService's
+	// TestNodeConnection RPC.
+	NodeServiceTestNodeConnectionProcedure = "/orchestrator.v1.NodeService/TestNodeConnection"
+	// NodeServiceDeployTenantDBProcedure is the fully-qualified name of the NodeService's
+	// DeployTenantDB RPC.
+	NodeServiceDeployTenantDBProcedure = "/orchestrator.v1.NodeService/DeployTenantDB"
+	// NodeServiceGenerateNodeRegistrationKeyProcedure is the fully-qualified name of the NodeService's
+	// GenerateNodeRegistrationKey RPC.
+	NodeServiceGenerateNodeRegistrationKeyProcedure = "/orchestrator.v1.NodeService/GenerateNodeRegistrationKey"
+	// NodeServiceListNodeRegistrationsProcedure is the fully-qualified name of the NodeService's
+	// ListNodeRegistrations RPC.
+	NodeServiceListNodeRegistrationsProcedure = "/orchestrator.v1.NodeService/ListNodeRegistrations"
+	// NodeServiceDeleteNodeRegistrationProcedure is the fully-qualified name of the NodeService's
+	// DeleteNodeRegistration RPC.
+	NodeServiceDeleteNodeRegistrationProcedure = "/orchestrator.v1.NodeService/DeleteNodeRegistration"
+	// NodeServiceRegisterNodeProcedure is the fully-qualified name of the NodeService's RegisterNode
+	// RPC.
+	NodeServiceRegisterNodeProcedure = "/orchestrator.v1.NodeService/RegisterNode"
+)
+
+// NodeServiceClient is a client for the orchestrator.v1.NodeService service.
+type NodeServiceClient interface {
+	// Create a new node
+	CreateNode(context.Context, *connect.Request[v1.CreateNodeRequest]) (*connect.Response[v1.CreateNodeResponse], error)
+	// Get a node by ID
+	GetNode(context.Context, *connect.Request[v1.GetNodeRequest]) (*connect.Response[v1.GetNodeResponse], error)
+	// List all nodes
+	ListNodes(context.Context, *connect.Request[v1.ListNodesRequest]) (*connect.Response[v1.ListNodesResponse], error)
+	// Update node configuration
+	UpdateNode(context.Context, *connect.Request[v1.UpdateNodeRequest]) (*connect.Response[v1.UpdateNodeResponse], error)
+	// Update node SSH credentials
+	UpdateNodeSSHKey(context.Context, *connect.Request[v1.UpdateNodeSSHKeyRequest]) (*connect.Response[v1.UpdateNodeSSHKeyResponse], error)
+	// Delete a node (soft delete)
+	DeleteNode(context.Context, *connect.Request[v1.DeleteNodeRequest]) (*connect.Response[v1.DeleteNodeResponse], error)
+	// Perform health check on a node
+	HealthCheckNode(context.Context, *connect.Request[v1.HealthCheckNodeRequest]) (*connect.Response[v1.HealthCheckNodeResponse], error)
+	// Set node to draining mode (no new instances)
+	DrainNode(context.Context, *connect.Request[v1.DrainNodeRequest]) (*connect.Response[v1.DrainNodeResponse], error)
+	// Activate a node (accept new instances)
+	ActivateNode(context.Context, *connect.Request[v1.ActivateNodeRequest]) (*connect.Response[v1.ActivateNodeResponse], error)
+	// Take a node offline
+	OfflineNode(context.Context, *connect.Request[v1.OfflineNodeRequest]) (*connect.Response[v1.OfflineNodeResponse], error)
+	// Test node connectivity
+	TestNodeConnection(context.Context, *connect.Request[v1.TestNodeConnectionRequest]) (*connect.Response[v1.TestNodeConnectionResponse], error)
+	// Deploy or redeploy the tenant database on a node
+	DeployTenantDB(context.Context, *connect.Request[v1.DeployTenantDBRequest]) (*connect.Response[v1.DeployTenantDBResponse], error)
+	// --- Node Registration ---
+	// Generate a one-time registration key for automated node setup (Superadmin only)
+	GenerateNodeRegistrationKey(context.Context, *connect.Request[v1.GenerateNodeRegistrationKeyRequest]) (*connect.Response[v1.GenerateNodeRegistrationKeyResponse], error)
+	// List registration keys (Admin)
+	ListNodeRegistrations(context.Context, *connect.Request[v1.ListNodeRegistrationsRequest]) (*connect.Response[v1.ListNodeRegistrationsResponse], error)
+	// Delete an unused registration key (Superadmin only)
+	DeleteNodeRegistration(context.Context, *connect.Request[v1.DeleteNodeRegistrationRequest]) (*connect.Response[v1.DeleteNodeRegistrationResponse], error)
+	// Register a node using a key (Public - validated by key)
+	RegisterNode(context.Context, *connect.Request[v1.RegisterNodeRequest]) (*connect.Response[v1.RegisterNodeResponse], error)
+}
+
+// NewNodeServiceClient constructs a client for the orchestrator.v1.NodeService service. By default,
+// it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and
+// sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC()
+// or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewNodeServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) NodeServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	nodeServiceMethods := v1.File_orchestrator_v1_nodes_proto.Services().ByName("NodeService").Methods()
+	return &nodeServiceClient{
+		createNode: connect.NewClient[v1.CreateNodeRequest, v1.CreateNodeResponse](
+			httpClient,
+			baseURL+NodeServiceCreateNodeProcedure,
+			connect.WithSchema(nodeServiceMethods.ByName("CreateNode")),
+			connect.WithClientOptions(opts...),
+		),
+		getNode: connect.NewClient[v1.GetNodeRequest, v1.GetNodeResponse](
+			httpClient,
+			baseURL+NodeServiceGetNodeProcedure,
+			connect.WithSchema(nodeServiceMethods.ByName("GetNode")),
+			connect.WithClientOptions(opts...),
+		),
+		listNodes: connect.NewClient[v1.ListNodesRequest, v1.ListNodesResponse](
+			httpClient,
+			baseURL+NodeServiceListNodesProcedure,
+			connect.WithSchema(nodeServiceMethods.ByName("ListNodes")),
+			connect.WithClientOptions(opts...),
+		),
+		updateNode: connect.NewClient[v1.UpdateNodeRequest, v1.UpdateNodeResponse](
+			httpClient,
+			baseURL+NodeServiceUpdateNodeProcedure,
+			connect.WithSchema(nodeServiceMethods.ByName("UpdateNode")),
+			connect.WithClientOptions(opts...),
+		),
+		updateNodeSSHKey: connect.NewClient[v1.UpdateNodeSSHKeyRequest, v1.UpdateNodeSSHKeyResponse](
+			httpClient,
+			baseURL+NodeServiceUpdateNodeSSHKeyProcedure,
+			connect.WithSchema(nodeServiceMethods.ByName("UpdateNodeSSHKey")),
+			connect.WithClientOptions(opts...),
+		),
+		deleteNode: connect.NewClient[v1.DeleteNodeRequest, v1.DeleteNodeResponse](
+			httpClient,
+			baseURL+NodeServiceDeleteNodeProcedure,
+			connect.WithSchema(nodeServiceMethods.ByName("DeleteNode")),
+			connect.WithClientOptions(opts...),
+		),
+		healthCheckNode: connect.NewClient[v1.HealthCheckNodeRequest, v1.HealthCheckNodeResponse](
+			httpClient,
+			baseURL+NodeServiceHealthCheckNodeProcedure,
+			connect.WithSchema(nodeServiceMethods.ByName("HealthCheckNode")),
+			connect.WithClientOptions(opts...),
+		),
+		drainNode: connect.NewClient[v1.DrainNodeRequest, v1.DrainNodeResponse](
+			httpClient,
+			baseURL+NodeServiceDrainNodeProcedure,
+			connect.WithSchema(nodeServiceMethods.ByName("DrainNode")),
+			connect.WithClientOptions(opts...),
+		),
+		activateNode: connect.NewClient[v1.ActivateNodeRequest, v1.ActivateNodeResponse](
+			httpClient,
+			baseURL+NodeServiceActivateNodeProcedure,
+			connect.WithSchema(nodeServiceMethods.ByName("ActivateNode")),
+			connect.WithClientOptions(opts...),
+		),
+		offlineNode: connect.NewClient[v1.OfflineNodeRequest, v1.OfflineNodeResponse](
+			httpClient,
+			baseURL+NodeServiceOfflineNodeProcedure,
+			connect.WithSchema(nodeServiceMethods.ByName("OfflineNode")),
+			connect.WithClientOptions(opts...),
+		),
+		testNodeConnection: connect.NewClient[v1.TestNodeConnectionRequest, v1.TestNodeConnectionResponse](
+			httpClient,
+			baseURL+NodeServiceTestNodeConnectionProcedure,
+			connect.WithSchema(nodeServiceMethods.ByName("TestNodeConnection")),
+			connect.WithClientOptions(opts...),
+		),
+		deployTenantDB: connect.NewClient[v1.DeployTenantDBRequest, v1.DeployTenantDBResponse](
+			httpClient,
+			baseURL+NodeServiceDeployTenantDBProcedure,
+			connect.WithSchema(nodeServiceMethods.ByName("DeployTenantDB")),
+			connect.WithClientOptions(opts...),
+		),
+		generateNodeRegistrationKey: connect.NewClient[v1.GenerateNodeRegistrationKeyRequest, v1.GenerateNodeRegistrationKeyResponse](
+			httpClient,
+			baseURL+NodeServiceGenerateNodeRegistrationKeyProcedure,
+			connect.WithSchema(nodeServiceMethods.ByName("GenerateNodeRegistrationKey")),
+			connect.WithClientOptions(opts...),
+		),
+		listNodeRegistrations: connect.NewClient[v1.ListNodeRegistrationsRequest, v1.ListNodeRegistrationsResponse](
+			httpClient,
+			baseURL+NodeServiceListNodeRegistrationsProcedure,
+			connect.WithSchema(nodeServiceMethods.ByName("ListNodeRegistrations")),
+			connect.WithClientOptions(opts...),
+		),
+		deleteNodeRegistration: connect.NewClient[v1.DeleteNodeRegistrationRequest, v1.DeleteNodeRegistrationResponse](
+			httpClient,
+			baseURL+NodeServiceDeleteNodeRegistrationProcedure,
+			connect.WithSchema(nodeServiceMethods.ByName("DeleteNodeRegistration")),
+			connect.WithClientOptions(opts...),
+		),
+		registerNode: connect.NewClient[v1.RegisterNodeRequest, v1.RegisterNodeResponse](
+			httpClient,
+			baseURL+NodeServiceRegisterNodeProcedure,
+			connect.WithSchema(nodeServiceMethods.ByName("RegisterNode")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// nodeServiceClient implements NodeServiceClient.
+type nodeServiceClient struct {
+	createNode                  *connect.Client[v1.CreateNodeRequest, v1.CreateNodeResponse]
+	getNode                     *connect.Client[v1.GetNodeRequest, v1.GetNodeResponse]
+	listNodes                   *connect.Client[v1.ListNodesRequest, v1.ListNodesResponse]
+	updateNode                  *connect.Client[v1.UpdateNodeRequest, v1.UpdateNodeResponse]
+	updateNodeSSHKey            *connect.Client[v1.UpdateNodeSSHKeyRequest, v1.UpdateNodeSSHKeyResponse]
+	deleteNode                  *connect.Client[v1.DeleteNodeRequest, v1.DeleteNodeResponse]
+	healthCheckNode             *connect.Client[v1.HealthCheckNodeRequest, v1.HealthCheckNodeResponse]
+	drainNode                   *connect.Client[v1.DrainNodeRequest, v1.DrainNodeResponse]
+	activateNode                *connect.Client[v1.ActivateNodeRequest, v1.ActivateNodeResponse]
+	offlineNode                 *connect.Client[v1.OfflineNodeRequest, v1.OfflineNodeResponse]
+	testNodeConnection          *connect.Client[v1.TestNodeConnectionRequest, v1.TestNodeConnectionResponse]
+	deployTenantDB              *connect.Client[v1.DeployTenantDBRequest, v1.DeployTenantDBResponse]
+	generateNodeRegistrationKey *connect.Client[v1.GenerateNodeRegistrationKeyRequest, v1.GenerateNodeRegistrationKeyResponse]
+	listNodeRegistrations       *connect.Client[v1.ListNodeRegistrationsRequest, v1.ListNodeRegistrationsResponse]
+	deleteNodeRegistration      *connect.Client[v1.DeleteNodeRegistrationRequest, v1.DeleteNodeRegistrationResponse]
+	registerNode                *connect.Client[v1.RegisterNodeRequest, v1.RegisterNodeResponse]
+}
+
+// CreateNode calls orchestrator.v1.NodeService.CreateNode.
+func (c *nodeServiceClient) CreateNode(ctx context.Context, req *connect.Request[v1.CreateNodeRequest]) (*connect.Response[v1.CreateNodeResponse], error) {
+	return c.createNode.CallUnary(ctx, req)
+}
+
+// GetNode calls orchestrator.v1.NodeService.GetNode.
+func (c *nodeServiceClient) GetNode(ctx context.Context, req *connect.Request[v1.GetNodeRequest]) (*connect.Response[v1.GetNodeResponse], error) {
+	return c.getNode.CallUnary(ctx, req)
+}
+
+// ListNodes calls orchestrator.v1.NodeService.ListNodes.
+func (c *nodeServiceClient) ListNodes(ctx context.Context, req *connect.Request[v1.ListNodesRequest]) (*connect.Response[v1.ListNodesResponse], error) {
+	return c.listNodes.CallUnary(ctx, req)
+}
+
+// UpdateNode calls orchestrator.v1.NodeService.UpdateNode.
+func (c *nodeServiceClient) UpdateNode(ctx context.Context, req *connect.Request[v1.UpdateNodeRequest]) (*connect.Response[v1.UpdateNodeResponse], error) {
+	return c.updateNode.CallUnary(ctx, req)
+}
+
+// UpdateNodeSSHKey calls orchestrator.v1.NodeService.UpdateNodeSSHKey.
+func (c *nodeServiceClient) UpdateNodeSSHKey(ctx context.Context, req *connect.Request[v1.UpdateNodeSSHKeyRequest]) (*connect.Response[v1.UpdateNodeSSHKeyResponse], error) {
+	return c.updateNodeSSHKey.CallUnary(ctx, req)
+}
+
+// DeleteNode calls orchestrator.v1.NodeService.DeleteNode.
+func (c *nodeServiceClient) DeleteNode(ctx context.Context, req *connect.Request[v1.DeleteNodeRequest]) (*connect.Response[v1.DeleteNodeResponse], error) {
+	return c.deleteNode.CallUnary(ctx, req)
+}
+
+// HealthCheckNode calls orchestrator.v1.NodeService.HealthCheckNode.
+func (c *nodeServiceClient) HealthCheckNode(ctx context.Context, req *connect.Request[v1.HealthCheckNodeRequest]) (*connect.Response[v1.HealthCheckNodeResponse], error) {
+	return c.healthCheckNode.CallUnary(ctx, req)
+}
+
+// DrainNode calls orchestrator.v1.NodeService.DrainNode.
+func (c *nodeServiceClient) DrainNode(ctx context.Context, req *connect.Request[v1.DrainNodeRequest]) (*connect.Response[v1.DrainNodeResponse], error) {
+	return c.drainNode.CallUnary(ctx, req)
+}
+
+// ActivateNode calls orchestrator.v1.NodeService.ActivateNode.
+func (c *nodeServiceClient) ActivateNode(ctx context.Context, req *connect.Request[v1.ActivateNodeRequest]) (*connect.Response[v1.ActivateNodeResponse], error) {
+	return c.activateNode.CallUnary(ctx, req)
+}
+
+// OfflineNode calls orchestrator.v1.NodeService.OfflineNode.
+func (c *nodeServiceClient) OfflineNode(ctx context.Context, req *connect.Request[v1.OfflineNodeRequest]) (*connect.Response[v1.OfflineNodeResponse], error) {
+	return c.offlineNode.CallUnary(ctx, req)
+}
+
+// TestNodeConnection calls orchestrator.v1.NodeService.TestNodeConnection.
+func (c *nodeServiceClient) TestNodeConnection(ctx context.Context, req *connect.Request[v1.TestNodeConnectionRequest]) (*connect.Response[v1.TestNodeConnectionResponse], error) {
+	return c.testNodeConnection.CallUnary(ctx, req)
+}
+
+// DeployTenantDB calls orchestrator.v1.NodeService.DeployTenantDB.
+func (c *nodeServiceClient) DeployTenantDB(ctx context.Context, req *connect.Request[v1.DeployTenantDBRequest]) (*connect.Response[v1.DeployTenantDBResponse], error) {
+	return c.deployTenantDB.CallUnary(ctx, req)
+}
+
+// GenerateNodeRegistrationKey calls orchestrator.v1.NodeService.GenerateNodeRegistrationKey.
+func (c *nodeServiceClient) GenerateNodeRegistrationKey(ctx context.Context, req *connect.Request[v1.GenerateNodeRegistrationKeyRequest]) (*connect.Response[v1.GenerateNodeRegistrationKeyResponse], error) {
+	return c.generateNodeRegistrationKey.CallUnary(ctx, req)
+}
+
+// ListNodeRegistrations calls orchestrator.v1.NodeService.ListNodeRegistrations.
+func (c *nodeServiceClient) ListNodeRegistrations(ctx context.Context, req *connect.Request[v1.ListNodeRegistrationsRequest]) (*connect.Response[v1.ListNodeRegistrationsResponse], error) {
+	return c.listNodeRegistrations.CallUnary(ctx, req)
+}
+
+// DeleteNodeRegistration calls orchestrator.v1.NodeService.DeleteNodeRegistration.
+func (c *nodeServiceClient) DeleteNodeRegistration(ctx context.Context, req *connect.Request[v1.DeleteNodeRegistrationRequest]) (*connect.Response[v1.DeleteNodeRegistrationResponse], error) {
+	return c.deleteNodeRegistration.CallUnary(ctx, req)
+}
+
+// RegisterNode calls orchestrator.v1.NodeService.RegisterNode.
+func (c *nodeServiceClient) RegisterNode(ctx context.Context, req *connect.Request[v1.RegisterNodeRequest]) (*connect.Response[v1.RegisterNodeResponse], error) {
+	return c.registerNode.CallUnary(ctx, req)
+}
+
+// NodeServiceHandler is an implementation of the orchestrator.v1.NodeService service.
+type NodeServiceHandler interface {
+	// Create a new node
+	CreateNode(context.Context, *connect.Request[v1.CreateNodeRequest]) (*connect.Response[v1.CreateNodeResponse], error)
+	// Get a node by ID
+	GetNode(context.Context, *connect.Request[v1.GetNodeRequest]) (*connect.Response[v1.GetNodeResponse], error)
+	// List all nodes
+	ListNodes(context.Context, *connect.Request[v1.ListNodesRequest]) (*connect.Response[v1.ListNodesResponse], error)
+	// Update node configuration
+	UpdateNode(context.Context, *connect.Request[v1.UpdateNodeRequest]) (*connect.Response[v1.UpdateNodeResponse], error)
+	// Update node SSH credentials
+	UpdateNodeSSHKey(context.Context, *connect.Request[v1.UpdateNodeSSHKeyRequest]) (*connect.Response[v1.UpdateNodeSSHKeyResponse], error)
+	// Delete a node (soft delete)
+	DeleteNode(context.Context, *connect.Request[v1.DeleteNodeRequest]) (*connect.Response[v1.DeleteNodeResponse], error)
+	// Perform health check on a node
+	HealthCheckNode(context.Context, *connect.Request[v1.HealthCheckNodeRequest]) (*connect.Response[v1.HealthCheckNodeResponse], error)
+	// Set node to draining mode (no new instances)
+	DrainNode(context.Context, *connect.Request[v1.DrainNodeRequest]) (*connect.Response[v1.DrainNodeResponse], error)
+	// Activate a node (accept new instances)
+	ActivateNode(context.Context, *connect.Request[v1.ActivateNodeRequest]) (*connect.Response[v1.ActivateNodeResponse], error)
+	// Take a node offline
+	OfflineNode(context.Context, *connect.Request[v1.OfflineNodeRequest]) (*connect.Response[v1.OfflineNodeResponse], error)
+	// Test node connectivity
+	TestNodeConnection(context.Context, *connect.Request[v1.TestNodeConnectionRequest]) (*connect.Response[v1.TestNodeConnectionResponse], error)
+	// Deploy or redeploy the tenant database on a node
+	DeployTenantDB(context.Context, *connect.Request[v1.DeployTenantDBRequest]) (*connect.Response[v1.DeployTenantDBResponse], error)
+	// --- Node Registration ---
+	// Generate a one-time registration key for automated node setup (Superadmin only)
+	GenerateNodeRegistrationKey(context.Context, *connect.Request[v1.GenerateNodeRegistrationKeyRequest]) (*connect.Response[v1.GenerateNodeRegistrationKeyResponse], error)
+	// List registration keys (Admin)
+	ListNodeRegistrations(context.Context, *connect.Request[v1.ListNodeRegistrationsRequest]) (*connect.Response[v1.ListNodeRegistrationsResponse], error)
+	// Delete an unused registration key (Superadmin only)
+	DeleteNodeRegistration(context.Context, *connect.Request[v1.DeleteNodeRegistrationRequest]) (*connect.Response[v1.DeleteNodeRegistrationResponse], error)
+	// Register a node using a key (Public - validated by key)
+	RegisterNode(context.Context, *connect.Request[v1.RegisterNodeRequest]) (*connect.Response[v1.RegisterNodeResponse], error)
+}
+
+// NewNodeServiceHandler builds an HTTP handler from the service implementation. It returns the path
+// on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewNodeServiceHandler(svc NodeServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	nodeServiceMethods := v1.File_orchestrator_v1_nodes_proto.Services().ByName("NodeService").Methods()
+	nodeServiceCreateNodeHandler := connect.NewUnaryHandler(
+		NodeServiceCreateNodeProcedure,
+		svc.CreateNode,
+		connect.WithSchema(nodeServiceMethods.ByName("CreateNode")),
+		connect.WithHandlerOptions(opts...),
+	)
+	nodeServiceGetNodeHandler := connect.NewUnaryHandler(
+		NodeServiceGetNodeProcedure,
+		svc.GetNode,
+		connect.WithSchema(nodeServiceMethods.ByName("GetNode")),
+		connect.WithHandlerOptions(opts...),
+	)
+	nodeServiceListNodesHandler := connect.NewUnaryHandler(
+		NodeServiceListNodesProcedure,
+		svc.ListNodes,
+		connect.WithSchema(nodeServiceMethods.ByName("ListNodes")),
+		connect.WithHandlerOptions(opts...),
+	)
+	nodeServiceUpdateNodeHandler := connect.NewUnaryHandler(
+		NodeServiceUpdateNodeProcedure,
+		svc.UpdateNode,
+		connect.WithSchema(nodeServiceMethods.ByName("UpdateNode")),
+		connect.WithHandlerOptions(opts...),
+	)
+	nodeServiceUpdateNodeSSHKeyHandler := connect.NewUnaryHandler(
+		NodeServiceUpdateNodeSSHKeyProcedure,
+		svc.UpdateNodeSSHKey,
+		connect.WithSchema(nodeServiceMethods.ByName("UpdateNodeSSHKey")),
+		connect.WithHandlerOptions(opts...),
+	)
+	nodeServiceDeleteNodeHandler := connect.NewUnaryHandler(
+		NodeServiceDeleteNodeProcedure,
+		svc.DeleteNode,
+		connect.WithSchema(nodeServiceMethods.ByName("DeleteNode")),
+		connect.WithHandlerOptions(opts...),
+	)
+	nodeServiceHealthCheckNodeHandler := connect.NewUnaryHandler(
+		NodeServiceHealthCheckNodeProcedure,
+		svc.HealthCheckNode,
+		connect.WithSchema(nodeServiceMethods.ByName("HealthCheckNode")),
+		connect.WithHandlerOptions(opts...),
+	)
+	nodeServiceDrainNodeHandler := connect.NewUnaryHandler(
+		NodeServiceDrainNodeProcedure,
+		svc.DrainNode,
+		connect.WithSchema(nodeServiceMethods.ByName("DrainNode")),
+		connect.WithHandlerOptions(opts...),
+	)
+	nodeServiceActivateNodeHandler := connect.NewUnaryHandler(
+		NodeServiceActivateNodeProcedure,
+		svc.ActivateNode,
+		connect.WithSchema(nodeServiceMethods.ByName("ActivateNode")),
+		connect.WithHandlerOptions(opts...),
+	)
+	nodeServiceOfflineNodeHandler := connect.NewUnaryHandler(
+		NodeServiceOfflineNodeProcedure,
+		svc.OfflineNode,
+		connect.WithSchema(nodeServiceMethods.ByName("OfflineNode")),
+		connect.WithHandlerOptions(opts...),
+	)
+	nodeServiceTestNodeConnectionHandler := connect.NewUnaryHandler(
+		NodeServiceTestNodeConnectionProcedure,
+		svc.TestNodeConnection,
+		connect.WithSchema(nodeServiceMethods.ByName("TestNodeConnection")),
+		connect.WithHandlerOptions(opts...),
+	)
+	nodeServiceDeployTenantDBHandler := connect.NewUnaryHandler(
+		NodeServiceDeployTenantDBProcedure,
+		svc.DeployTenantDB,
+		connect.WithSchema(nodeServiceMethods.ByName("DeployTenantDB")),
+		connect.WithHandlerOptions(opts...),
+	)
+	nodeServiceGenerateNodeRegistrationKeyHandler := connect.NewUnaryHandler(
+		NodeServiceGenerateNodeRegistrationKeyProcedure,
+		svc.GenerateNodeRegistrationKey,
+		connect.WithSchema(nodeServiceMethods.ByName("GenerateNodeRegistrationKey")),
+		connect.WithHandlerOptions(opts...),
+	)
+	nodeServiceListNodeRegistrationsHandler := connect.NewUnaryHandler(
+		NodeServiceListNodeRegistrationsProcedure,
+		svc.ListNodeRegistrations,
+		connect.WithSchema(nodeServiceMethods.ByName("ListNodeRegistrations")),
+		connect.WithHandlerOptions(opts...),
+	)
+	nodeServiceDeleteNodeRegistrationHandler := connect.NewUnaryHandler(
+		NodeServiceDeleteNodeRegistrationProcedure,
+		svc.DeleteNodeRegistration,
+		connect.WithSchema(nodeServiceMethods.ByName("DeleteNodeRegistration")),
+		connect.WithHandlerOptions(opts...),
+	)
+	nodeServiceRegisterNodeHandler := connect.NewUnaryHandler(
+		NodeServiceRegisterNodeProcedure,
+		svc.RegisterNode,
+		connect.WithSchema(nodeServiceMethods.ByName("RegisterNode")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/orchestrator.v1.NodeService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case NodeServiceCreateNodeProcedure:
+			nodeServiceCreateNodeHandler.ServeHTTP(w, r)
+		case NodeServiceGetNodeProcedure:
+			nodeServiceGetNodeHandler.ServeHTTP(w, r)
+		case NodeServiceListNodesProcedure:
+			nodeServiceListNodesHandler.ServeHTTP(w, r)
+		case NodeServiceUpdateNodeProcedure:
+			nodeServiceUpdateNodeHandler.ServeHTTP(w, r)
+		case NodeServiceUpdateNodeSSHKeyProcedure:
+			nodeServiceUpdateNodeSSHKeyHandler.ServeHTTP(w, r)
+		case NodeServiceDeleteNodeProcedure:
+			nodeServiceDeleteNodeHandler.ServeHTTP(w, r)
+		case NodeServiceHealthCheckNodeProcedure:
+			nodeServiceHealthCheckNodeHandler.ServeHTTP(w, r)
+		case NodeServiceDrainNodeProcedure:
+			nodeServiceDrainNodeHandler.ServeHTTP(w, r)
+		case NodeServiceActivateNodeProcedure:
+			nodeServiceActivateNodeHandler.ServeHTTP(w, r)
+		case NodeServiceOfflineNodeProcedure:
+			nodeServiceOfflineNodeHandler.ServeHTTP(w, r)
+		case NodeServiceTestNodeConnectionProcedure:
+			nodeServiceTestNodeConnectionHandler.ServeHTTP(w, r)
+		case NodeServiceDeployTenantDBProcedure:
+			nodeServiceDeployTenantDBHandler.ServeHTTP(w, r)
+		case NodeServiceGenerateNodeRegistrationKeyProcedure:
+			nodeServiceGenerateNodeRegistrationKeyHandler.ServeHTTP(w, r)
+		case NodeServiceListNodeRegistrationsProcedure:
+			nodeServiceListNodeRegistrationsHandler.ServeHTTP(w, r)
+		case NodeServiceDeleteNodeRegistrationProcedure:
+			nodeServiceDeleteNodeRegistrationHandler.ServeHTTP(w, r)
+		case NodeServiceRegisterNodeProcedure:
+			nodeServiceRegisterNodeHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedNodeServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedNodeServiceHandler struct{}
+
+func (UnimplementedNodeServiceHandler) CreateNode(context.Context, *connect.Request[v1.CreateNodeRequest]) (*connect.Response[v1.CreateNodeResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.NodeService.CreateNode is not implemented"))
+}
+
+func (UnimplementedNodeServiceHandler) GetNode(context.Context, *connect.Request[v1.GetNodeRequest]) (*connect.Response[v1.GetNodeResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.NodeService.GetNode is not implemented"))
+}
+
+func (UnimplementedNodeServiceHandler) ListNodes(context.Context, *connect.Request[v1.ListNodesRequest]) (*connect.Response[v1.ListNodesResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.NodeService.ListNodes is not implemented"))
+}
+
+func (UnimplementedNodeServiceHandler) UpdateNode(context.Context, *connect.Request[v1.UpdateNodeRequest]) (*connect.Response[v1.UpdateNodeResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.NodeService.UpdateNode is not implemented"))
+}
+
+func (UnimplementedNodeServiceHandler) UpdateNodeSSHKey(context.Context, *connect.Request[v1.UpdateNodeSSHKeyRequest]) (*connect.Response[v1.UpdateNodeSSHKeyResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.NodeService.UpdateNodeSSHKey is not implemented"))
+}
+
+func (UnimplementedNodeServiceHandler) DeleteNode(context.Context, *connect.Request[v1.DeleteNodeRequest]) (*connect.Response[v1.DeleteNodeResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.NodeService.DeleteNode is not implemented"))
+}
+
+func (UnimplementedNodeServiceHandler) HealthCheckNode(context.Context, *connect.Request[v1.HealthCheckNodeRequest]) (*connect.Response[v1.HealthCheckNodeResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.NodeService.HealthCheckNode is not implemented"))
+}
+
+func (UnimplementedNodeServiceHandler) DrainNode(context.Context, *connect.Request[v1.DrainNodeRequest]) (*connect.Response[v1.DrainNodeResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.NodeService.DrainNode is not implemented"))
+}
+
+func (UnimplementedNodeServiceHandler) ActivateNode(context.Context, *connect.Request[v1.ActivateNodeRequest]) (*connect.Response[v1.ActivateNodeResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.NodeService.ActivateNode is not implemented"))
+}
+
+func (UnimplementedNodeServiceHandler) OfflineNode(context.Context, *connect.Request[v1.OfflineNodeRequest]) (*connect.Response[v1.OfflineNodeResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.NodeService.OfflineNode is not implemented"))
+}
+
+func (UnimplementedNodeServiceHandler) TestNodeConnection(context.Context, *connect.Request[v1.TestNodeConnectionRequest]) (*connect.Response[v1.TestNodeConnectionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.NodeService.TestNodeConnection is not implemented"))
+}
+
+func (UnimplementedNodeServiceHandler) DeployTenantDB(context.Context, *connect.Request[v1.DeployTenantDBRequest]) (*connect.Response[v1.DeployTenantDBResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.NodeService.DeployTenantDB is not implemented"))
+}
+
+func (UnimplementedNodeServiceHandler) GenerateNodeRegistrationKey(context.Context, *connect.Request[v1.GenerateNodeRegistrationKeyRequest]) (*connect.Response[v1.GenerateNodeRegistrationKeyResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.NodeService.GenerateNodeRegistrationKey is not implemented"))
+}
+
+func (UnimplementedNodeServiceHandler) ListNodeRegistrations(context.Context, *connect.Request[v1.ListNodeRegistrationsRequest]) (*connect.Response[v1.ListNodeRegistrationsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.NodeService.ListNodeRegistrations is not implemented"))
+}
+
+func (UnimplementedNodeServiceHandler) DeleteNodeRegistration(context.Context, *connect.Request[v1.DeleteNodeRegistrationRequest]) (*connect.Response[v1.DeleteNodeRegistrationResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.NodeService.DeleteNodeRegistration is not implemented"))
+}
+
+func (UnimplementedNodeServiceHandler) RegisterNode(context.Context, *connect.Request[v1.RegisterNodeRequest]) (*connect.Response[v1.RegisterNodeResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.NodeService.RegisterNode is not implemented"))
+}

internal/api/orchestrator/v1/orchestratorv1connect/plugin_builds.connect.go

@@ -0,0 +1,115 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: orchestrator/v1/plugin_builds.proto
+
+package orchestratorv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "git.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// PluginBuildServiceName is the fully-qualified name of the PluginBuildService service.
+	PluginBuildServiceName = "orchestrator.v1.PluginBuildService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// PluginBuildServiceBuildPluginImageProcedure is the fully-qualified name of the
+	// PluginBuildService's BuildPluginImage RPC.
+	PluginBuildServiceBuildPluginImageProcedure = "/orchestrator.v1.PluginBuildService/BuildPluginImage"
+)
+
+// PluginBuildServiceClient is a client for the orchestrator.v1.PluginBuildService service.
+type PluginBuildServiceClient interface {
+	// Build a custom CMS image with the specified plugins injected.
+	// Called by a CMS instance (authenticated via X-CMS-Secret).
+	// Streams build progress and returns the built image tag in the final message.
+	BuildPluginImage(context.Context, *connect.Request[v1.BuildPluginImageRequest]) (*connect.ServerStreamForClient[v1.OperationProgress], error)
+}
+
+// NewPluginBuildServiceClient constructs a client for the orchestrator.v1.PluginBuildService
+// service. By default, it uses the Connect protocol with the binary Protobuf Codec, asks for
+// gzipped responses, and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply
+// the connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewPluginBuildServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) PluginBuildServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	pluginBuildServiceMethods := v1.File_orchestrator_v1_plugin_builds_proto.Services().ByName("PluginBuildService").Methods()
+	return &pluginBuildServiceClient{
+		buildPluginImage: connect.NewClient[v1.BuildPluginImageRequest, v1.OperationProgress](
+			httpClient,
+			baseURL+PluginBuildServiceBuildPluginImageProcedure,
+			connect.WithSchema(pluginBuildServiceMethods.ByName("BuildPluginImage")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// pluginBuildServiceClient implements PluginBuildServiceClient.
+type pluginBuildServiceClient struct {
+	buildPluginImage *connect.Client[v1.BuildPluginImageRequest, v1.OperationProgress]
+}
+
+// BuildPluginImage calls orchestrator.v1.PluginBuildService.BuildPluginImage.
+func (c *pluginBuildServiceClient) BuildPluginImage(ctx context.Context, req *connect.Request[v1.BuildPluginImageRequest]) (*connect.ServerStreamForClient[v1.OperationProgress], error) {
+	return c.buildPluginImage.CallServerStream(ctx, req)
+}
+
+// PluginBuildServiceHandler is an implementation of the orchestrator.v1.PluginBuildService service.
+type PluginBuildServiceHandler interface {
+	// Build a custom CMS image with the specified plugins injected.
+	// Called by a CMS instance (authenticated via X-CMS-Secret).
+	// Streams build progress and returns the built image tag in the final message.
+	BuildPluginImage(context.Context, *connect.Request[v1.BuildPluginImageRequest], *connect.ServerStream[v1.OperationProgress]) error
+}
+
+// NewPluginBuildServiceHandler builds an HTTP handler from the service implementation. It returns
+// the path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewPluginBuildServiceHandler(svc PluginBuildServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	pluginBuildServiceMethods := v1.File_orchestrator_v1_plugin_builds_proto.Services().ByName("PluginBuildService").Methods()
+	pluginBuildServiceBuildPluginImageHandler := connect.NewServerStreamHandler(
+		PluginBuildServiceBuildPluginImageProcedure,
+		svc.BuildPluginImage,
+		connect.WithSchema(pluginBuildServiceMethods.ByName("BuildPluginImage")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/orchestrator.v1.PluginBuildService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case PluginBuildServiceBuildPluginImageProcedure:
+			pluginBuildServiceBuildPluginImageHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedPluginBuildServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedPluginBuildServiceHandler struct{}
+
+func (UnimplementedPluginBuildServiceHandler) BuildPluginImage(context.Context, *connect.Request[v1.BuildPluginImageRequest], *connect.ServerStream[v1.OperationProgress]) error {
+	return connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginBuildService.BuildPluginImage is not implemented"))
+}

internal/api/orchestrator/v1/orchestratorv1connect/plugin_registry.connect.go

@@ -25,6 +25,8 @@ const (
 	PluginScopeServiceName = "orchestrator.v1.PluginScopeService"
 	// PluginRegistryServiceName is the fully-qualified name of the PluginRegistryService service.
 	PluginRegistryServiceName = "orchestrator.v1.PluginRegistryService"
+	// PluginModerationServiceName is the fully-qualified name of the PluginModerationService service.
+	PluginModerationServiceName = "orchestrator.v1.PluginModerationService"
 	// PluginPublishServiceName is the fully-qualified name of the PluginPublishService service.
 	PluginPublishServiceName = "orchestrator.v1.PluginPublishService"
 	// PluginAuthServiceName is the fully-qualified name of the PluginAuthService service.
@@ -48,6 +50,9 @@ const (
 	// PluginScopeServiceGetScopeProcedure is the fully-qualified name of the PluginScopeService's
 	// GetScope RPC.
 	PluginScopeServiceGetScopeProcedure = "/orchestrator.v1.PluginScopeService/GetScope"
+	// PluginScopeServiceListMyPluginsProcedure is the fully-qualified name of the PluginScopeService's
+	// ListMyPlugins RPC.
+	PluginScopeServiceListMyPluginsProcedure = "/orchestrator.v1.PluginScopeService/ListMyPlugins"
 	// PluginRegistryServiceCreatePluginProcedure is the fully-qualified name of the
 	// PluginRegistryService's CreatePlugin RPC.
 	PluginRegistryServiceCreatePluginProcedure = "/orchestrator.v1.PluginRegistryService/CreatePlugin"
@@ -66,6 +71,9 @@ const (
 	// PluginRegistryServiceListCategoriesProcedure is the fully-qualified name of the
 	// PluginRegistryService's ListCategories RPC.
 	PluginRegistryServiceListCategoriesProcedure = "/orchestrator.v1.PluginRegistryService/ListCategories"
+	// PluginRegistryServiceSubmitForReviewProcedure is the fully-qualified name of the
+	// PluginRegistryService's SubmitForReview RPC.
+	PluginRegistryServiceSubmitForReviewProcedure = "/orchestrator.v1.PluginRegistryService/SubmitForReview"
 	// PluginRegistryServiceListPrivatePluginsProcedure is the fully-qualified name of the
 	// PluginRegistryService's ListPrivatePlugins RPC.
 	PluginRegistryServiceListPrivatePluginsProcedure = "/orchestrator.v1.PluginRegistryService/ListPrivatePlugins"
@@ -78,6 +86,18 @@ const (
 	// PluginRegistryServiceListPrivatePluginInstallSitesProcedure is the fully-qualified name of the
 	// PluginRegistryService's ListPrivatePluginInstallSites RPC.
 	PluginRegistryServiceListPrivatePluginInstallSitesProcedure = "/orchestrator.v1.PluginRegistryService/ListPrivatePluginInstallSites"
+	// PluginModerationServiceListPendingReviewsProcedure is the fully-qualified name of the
+	// PluginModerationService's ListPendingReviews RPC.
+	PluginModerationServiceListPendingReviewsProcedure = "/orchestrator.v1.PluginModerationService/ListPendingReviews"
+	// PluginModerationServiceApproveSubmissionProcedure is the fully-qualified name of the
+	// PluginModerationService's ApproveSubmission RPC.
+	PluginModerationServiceApproveSubmissionProcedure = "/orchestrator.v1.PluginModerationService/ApproveSubmission"
+	// PluginModerationServiceRejectSubmissionProcedure is the fully-qualified name of the
+	// PluginModerationService's RejectSubmission RPC.
+	PluginModerationServiceRejectSubmissionProcedure = "/orchestrator.v1.PluginModerationService/RejectSubmission"
+	// PluginModerationServiceRequestChangesProcedure is the fully-qualified name of the
+	// PluginModerationService's RequestChanges RPC.
+	PluginModerationServiceRequestChangesProcedure = "/orchestrator.v1.PluginModerationService/RequestChanges"
 	// PluginPublishServicePublishVersionProcedure is the fully-qualified name of the
 	// PluginPublishService's PublishVersion RPC.
 	PluginPublishServicePublishVersionProcedure = "/orchestrator.v1.PluginPublishService/PublishVersion"
@@ -99,9 +119,6 @@ const (
 	// PluginAuthServiceWhoamiProcedure is the fully-qualified name of the PluginAuthService's Whoami
 	// RPC.
 	PluginAuthServiceWhoamiProcedure = "/orchestrator.v1.PluginAuthService/Whoami"
-	// PluginAuthServiceListMyAccountsProcedure is the fully-qualified name of the PluginAuthService's
-	// ListMyAccounts RPC.
-	PluginAuthServiceListMyAccountsProcedure = "/orchestrator.v1.PluginAuthService/ListMyAccounts"
 )
 
 // PluginScopeServiceClient is a client for the orchestrator.v1.PluginScopeService service.
@@ -109,6 +126,7 @@ type PluginScopeServiceClient interface {
 	CreateScope(context.Context, *connect.Request[v1.CreateScopeRequest]) (*connect.Response[v1.CreateScopeResponse], error)
 	ListMyScopes(context.Context, *connect.Request[v1.ListMyScopesRequest]) (*connect.Response[v1.ListMyScopesResponse], error)
 	GetScope(context.Context, *connect.Request[v1.GetScopeRequest]) (*connect.Response[v1.GetScopeResponse], error)
+	ListMyPlugins(context.Context, *connect.Request[v1.ListMyPluginsRequest]) (*connect.Response[v1.ListMyPluginsResponse], error)
 }
 
 // NewPluginScopeServiceClient constructs a client for the orchestrator.v1.PluginScopeService
@@ -140,14 +158,21 @@ func NewPluginScopeServiceClient(httpClient connect.HTTPClient, baseURL string,
 			connect.WithSchema(pluginScopeServiceMethods.ByName("GetScope")),
 			connect.WithClientOptions(opts...),
 		),
+		listMyPlugins: connect.NewClient[v1.ListMyPluginsRequest, v1.ListMyPluginsResponse](
+			httpClient,
+			baseURL+PluginScopeServiceListMyPluginsProcedure,
+			connect.WithSchema(pluginScopeServiceMethods.ByName("ListMyPlugins")),
+			connect.WithClientOptions(opts...),
+		),
 	}
 }
 
 // pluginScopeServiceClient implements PluginScopeServiceClient.
 type pluginScopeServiceClient struct {
-	createScope  *connect.Client[v1.CreateScopeRequest, v1.CreateScopeResponse]
-	listMyScopes *connect.Client[v1.ListMyScopesRequest, v1.ListMyScopesResponse]
-	getScope     *connect.Client[v1.GetScopeRequest, v1.GetScopeResponse]
+	createScope   *connect.Client[v1.CreateScopeRequest, v1.CreateScopeResponse]
+	listMyScopes  *connect.Client[v1.ListMyScopesRequest, v1.ListMyScopesResponse]
+	getScope      *connect.Client[v1.GetScopeRequest, v1.GetScopeResponse]
+	listMyPlugins *connect.Client[v1.ListMyPluginsRequest, v1.ListMyPluginsResponse]
 }
 
 // CreateScope calls orchestrator.v1.PluginScopeService.CreateScope.
@@ -165,11 +190,17 @@ func (c *pluginScopeServiceClient) GetScope(ctx context.Context, req *connect.Re
 	return c.getScope.CallUnary(ctx, req)
 }
 
+// ListMyPlugins calls orchestrator.v1.PluginScopeService.ListMyPlugins.
+func (c *pluginScopeServiceClient) ListMyPlugins(ctx context.Context, req *connect.Request[v1.ListMyPluginsRequest]) (*connect.Response[v1.ListMyPluginsResponse], error) {
+	return c.listMyPlugins.CallUnary(ctx, req)
+}
+
 // PluginScopeServiceHandler is an implementation of the orchestrator.v1.PluginScopeService service.
 type PluginScopeServiceHandler interface {
 	CreateScope(context.Context, *connect.Request[v1.CreateScopeRequest]) (*connect.Response[v1.CreateScopeResponse], error)
 	ListMyScopes(context.Context, *connect.Request[v1.ListMyScopesRequest]) (*connect.Response[v1.ListMyScopesResponse], error)
 	GetScope(context.Context, *connect.Request[v1.GetScopeRequest]) (*connect.Response[v1.GetScopeResponse], error)
+	ListMyPlugins(context.Context, *connect.Request[v1.ListMyPluginsRequest]) (*connect.Response[v1.ListMyPluginsResponse], error)
 }
 
 // NewPluginScopeServiceHandler builds an HTTP handler from the service implementation. It returns
@@ -197,6 +228,12 @@ func NewPluginScopeServiceHandler(svc PluginScopeServiceHandler, opts ...connect
 		connect.WithSchema(pluginScopeServiceMethods.ByName("GetScope")),
 		connect.WithHandlerOptions(opts...),
 	)
+	pluginScopeServiceListMyPluginsHandler := connect.NewUnaryHandler(
+		PluginScopeServiceListMyPluginsProcedure,
+		svc.ListMyPlugins,
+		connect.WithSchema(pluginScopeServiceMethods.ByName("ListMyPlugins")),
+		connect.WithHandlerOptions(opts...),
+	)
 	return "/orchestrator.v1.PluginScopeService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
 		case PluginScopeServiceCreateScopeProcedure:
@@ -205,6 +242,8 @@ func NewPluginScopeServiceHandler(svc PluginScopeServiceHandler, opts ...connect
 			pluginScopeServiceListMyScopesHandler.ServeHTTP(w, r)
 		case PluginScopeServiceGetScopeProcedure:
 			pluginScopeServiceGetScopeHandler.ServeHTTP(w, r)
+		case PluginScopeServiceListMyPluginsProcedure:
+			pluginScopeServiceListMyPluginsHandler.ServeHTTP(w, r)
 		default:
 			http.NotFound(w, r)
 		}
@@ -226,6 +265,10 @@ func (UnimplementedPluginScopeServiceHandler) GetScope(context.Context, *connect
 	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginScopeService.GetScope is not implemented"))
 }
 
+func (UnimplementedPluginScopeServiceHandler) ListMyPlugins(context.Context, *connect.Request[v1.ListMyPluginsRequest]) (*connect.Response[v1.ListMyPluginsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginScopeService.ListMyPlugins is not implemented"))
+}
+
 // PluginRegistryServiceClient is a client for the orchestrator.v1.PluginRegistryService service.
 type PluginRegistryServiceClient interface {
 	CreatePlugin(context.Context, *connect.Request[v1.CreatePluginRequest]) (*connect.Response[v1.CreatePluginResponse], error)
@@ -234,6 +277,7 @@ type PluginRegistryServiceClient interface {
 	GetVersion(context.Context, *connect.Request[v1.GetVersionRequest]) (*connect.Response[v1.GetVersionResponse], error)
 	ResolveInstall(context.Context, *connect.Request[v1.ResolveInstallRequest]) (*connect.Response[v1.ResolveInstallResponse], error)
 	ListCategories(context.Context, *connect.Request[v1.ListCategoriesRequest]) (*connect.Response[v1.ListCategoriesResponse], error)
+	SubmitForReview(context.Context, *connect.Request[v1.SubmitForReviewRequest]) (*connect.Response[v1.SubmitForReviewResponse], error)
 	// Private-plugin RPCs. All require the caller to be a member of the target
 	// account; the server resolves account membership from the bearer token.
 	ListPrivatePlugins(context.Context, *connect.Request[v1.ListPrivatePluginsRequest]) (*connect.Response[v1.ListPrivatePluginsResponse], error)
@@ -289,6 +333,12 @@ func NewPluginRegistryServiceClient(httpClient connect.HTTPClient, baseURL strin
 			connect.WithSchema(pluginRegistryServiceMethods.ByName("ListCategories")),
 			connect.WithClientOptions(opts...),
 		),
+		submitForReview: connect.NewClient[v1.SubmitForReviewRequest, v1.SubmitForReviewResponse](
+			httpClient,
+			baseURL+PluginRegistryServiceSubmitForReviewProcedure,
+			connect.WithSchema(pluginRegistryServiceMethods.ByName("SubmitForReview")),
+			connect.WithClientOptions(opts...),
+		),
 		listPrivatePlugins: connect.NewClient[v1.ListPrivatePluginsRequest, v1.ListPrivatePluginsResponse](
 			httpClient,
 			baseURL+PluginRegistryServiceListPrivatePluginsProcedure,
@@ -324,6 +374,7 @@ type pluginRegistryServiceClient struct {
 	getVersion                    *connect.Client[v1.GetVersionRequest, v1.GetVersionResponse]
 	resolveInstall                *connect.Client[v1.ResolveInstallRequest, v1.ResolveInstallResponse]
 	listCategories                *connect.Client[v1.ListCategoriesRequest, v1.ListCategoriesResponse]
+	submitForReview               *connect.Client[v1.SubmitForReviewRequest, v1.SubmitForReviewResponse]
 	listPrivatePlugins            *connect.Client[v1.ListPrivatePluginsRequest, v1.ListPrivatePluginsResponse]
 	deletePrivatePlugin           *connect.Client[v1.DeletePrivatePluginRequest, v1.DeletePrivatePluginResponse]
 	deletePrivatePluginVersion    *connect.Client[v1.DeletePrivatePluginVersionRequest, v1.DeletePrivatePluginVersionResponse]
@@ -360,6 +411,11 @@ func (c *pluginRegistryServiceClient) ListCategories(ctx context.Context, req *c
 	return c.listCategories.CallUnary(ctx, req)
 }
 
+// SubmitForReview calls orchestrator.v1.PluginRegistryService.SubmitForReview.
+func (c *pluginRegistryServiceClient) SubmitForReview(ctx context.Context, req *connect.Request[v1.SubmitForReviewRequest]) (*connect.Response[v1.SubmitForReviewResponse], error) {
+	return c.submitForReview.CallUnary(ctx, req)
+}
+
 // ListPrivatePlugins calls orchestrator.v1.PluginRegistryService.ListPrivatePlugins.
 func (c *pluginRegistryServiceClient) ListPrivatePlugins(ctx context.Context, req *connect.Request[v1.ListPrivatePluginsRequest]) (*connect.Response[v1.ListPrivatePluginsResponse], error) {
 	return c.listPrivatePlugins.CallUnary(ctx, req)
@@ -391,6 +447,7 @@ type PluginRegistryServiceHandler interface {
 	GetVersion(context.Context, *connect.Request[v1.GetVersionRequest]) (*connect.Response[v1.GetVersionResponse], error)
 	ResolveInstall(context.Context, *connect.Request[v1.ResolveInstallRequest]) (*connect.Response[v1.ResolveInstallResponse], error)
 	ListCategories(context.Context, *connect.Request[v1.ListCategoriesRequest]) (*connect.Response[v1.ListCategoriesResponse], error)
+	SubmitForReview(context.Context, *connect.Request[v1.SubmitForReviewRequest]) (*connect.Response[v1.SubmitForReviewResponse], error)
 	// Private-plugin RPCs. All require the caller to be a member of the target
 	// account; the server resolves account membership from the bearer token.
 	ListPrivatePlugins(context.Context, *connect.Request[v1.ListPrivatePluginsRequest]) (*connect.Response[v1.ListPrivatePluginsResponse], error)
@@ -442,6 +499,12 @@ func NewPluginRegistryServiceHandler(svc PluginRegistryServiceHandler, opts ...c
 		connect.WithSchema(pluginRegistryServiceMethods.ByName("ListCategories")),
 		connect.WithHandlerOptions(opts...),
 	)
+	pluginRegistryServiceSubmitForReviewHandler := connect.NewUnaryHandler(
+		PluginRegistryServiceSubmitForReviewProcedure,
+		svc.SubmitForReview,
+		connect.WithSchema(pluginRegistryServiceMethods.ByName("SubmitForReview")),
+		connect.WithHandlerOptions(opts...),
+	)
 	pluginRegistryServiceListPrivatePluginsHandler := connect.NewUnaryHandler(
 		PluginRegistryServiceListPrivatePluginsProcedure,
 		svc.ListPrivatePlugins,
@@ -480,6 +543,8 @@ func NewPluginRegistryServiceHandler(svc PluginRegistryServiceHandler, opts ...c
 			pluginRegistryServiceResolveInstallHandler.ServeHTTP(w, r)
 		case PluginRegistryServiceListCategoriesProcedure:
 			pluginRegistryServiceListCategoriesHandler.ServeHTTP(w, r)
+		case PluginRegistryServiceSubmitForReviewProcedure:
+			pluginRegistryServiceSubmitForReviewHandler.ServeHTTP(w, r)
 		case PluginRegistryServiceListPrivatePluginsProcedure:
 			pluginRegistryServiceListPrivatePluginsHandler.ServeHTTP(w, r)
 		case PluginRegistryServiceDeletePrivatePluginProcedure:
@@ -521,6 +586,10 @@ func (UnimplementedPluginRegistryServiceHandler) ListCategories(context.Context,
 	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginRegistryService.ListCategories is not implemented"))
 }
 
+func (UnimplementedPluginRegistryServiceHandler) SubmitForReview(context.Context, *connect.Request[v1.SubmitForReviewRequest]) (*connect.Response[v1.SubmitForReviewResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginRegistryService.SubmitForReview is not implemented"))
+}
+
 func (UnimplementedPluginRegistryServiceHandler) ListPrivatePlugins(context.Context, *connect.Request[v1.ListPrivatePluginsRequest]) (*connect.Response[v1.ListPrivatePluginsResponse], error) {
 	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginRegistryService.ListPrivatePlugins is not implemented"))
 }
@@ -537,6 +606,156 @@ func (UnimplementedPluginRegistryServiceHandler) ListPrivatePluginInstallSites(c
 	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginRegistryService.ListPrivatePluginInstallSites is not implemented"))
 }
 
+// PluginModerationServiceClient is a client for the orchestrator.v1.PluginModerationService
+// service.
+type PluginModerationServiceClient interface {
+	ListPendingReviews(context.Context, *connect.Request[v1.ListPendingReviewsRequest]) (*connect.Response[v1.ListPendingReviewsResponse], error)
+	ApproveSubmission(context.Context, *connect.Request[v1.ApproveSubmissionRequest]) (*connect.Response[v1.ApproveSubmissionResponse], error)
+	RejectSubmission(context.Context, *connect.Request[v1.RejectSubmissionRequest]) (*connect.Response[v1.RejectSubmissionResponse], error)
+	RequestChanges(context.Context, *connect.Request[v1.RequestChangesRequest]) (*connect.Response[v1.RequestChangesResponse], error)
+}
+
+// NewPluginModerationServiceClient constructs a client for the
+// orchestrator.v1.PluginModerationService service. By default, it uses the Connect protocol with
+// the binary Protobuf Codec, asks for gzipped responses, and sends uncompressed requests. To use
+// the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewPluginModerationServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) PluginModerationServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	pluginModerationServiceMethods := v1.File_orchestrator_v1_plugin_registry_proto.Services().ByName("PluginModerationService").Methods()
+	return &pluginModerationServiceClient{
+		listPendingReviews: connect.NewClient[v1.ListPendingReviewsRequest, v1.ListPendingReviewsResponse](
+			httpClient,
+			baseURL+PluginModerationServiceListPendingReviewsProcedure,
+			connect.WithSchema(pluginModerationServiceMethods.ByName("ListPendingReviews")),
+			connect.WithClientOptions(opts...),
+		),
+		approveSubmission: connect.NewClient[v1.ApproveSubmissionRequest, v1.ApproveSubmissionResponse](
+			httpClient,
+			baseURL+PluginModerationServiceApproveSubmissionProcedure,
+			connect.WithSchema(pluginModerationServiceMethods.ByName("ApproveSubmission")),
+			connect.WithClientOptions(opts...),
+		),
+		rejectSubmission: connect.NewClient[v1.RejectSubmissionRequest, v1.RejectSubmissionResponse](
+			httpClient,
+			baseURL+PluginModerationServiceRejectSubmissionProcedure,
+			connect.WithSchema(pluginModerationServiceMethods.ByName("RejectSubmission")),
+			connect.WithClientOptions(opts...),
+		),
+		requestChanges: connect.NewClient[v1.RequestChangesRequest, v1.RequestChangesResponse](
+			httpClient,
+			baseURL+PluginModerationServiceRequestChangesProcedure,
+			connect.WithSchema(pluginModerationServiceMethods.ByName("RequestChanges")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// pluginModerationServiceClient implements PluginModerationServiceClient.
+type pluginModerationServiceClient struct {
+	listPendingReviews *connect.Client[v1.ListPendingReviewsRequest, v1.ListPendingReviewsResponse]
+	approveSubmission  *connect.Client[v1.ApproveSubmissionRequest, v1.ApproveSubmissionResponse]
+	rejectSubmission   *connect.Client[v1.RejectSubmissionRequest, v1.RejectSubmissionResponse]
+	requestChanges     *connect.Client[v1.RequestChangesRequest, v1.RequestChangesResponse]
+}
+
+// ListPendingReviews calls orchestrator.v1.PluginModerationService.ListPendingReviews.
+func (c *pluginModerationServiceClient) ListPendingReviews(ctx context.Context, req *connect.Request[v1.ListPendingReviewsRequest]) (*connect.Response[v1.ListPendingReviewsResponse], error) {
+	return c.listPendingReviews.CallUnary(ctx, req)
+}
+
+// ApproveSubmission calls orchestrator.v1.PluginModerationService.ApproveSubmission.
+func (c *pluginModerationServiceClient) ApproveSubmission(ctx context.Context, req *connect.Request[v1.ApproveSubmissionRequest]) (*connect.Response[v1.ApproveSubmissionResponse], error) {
+	return c.approveSubmission.CallUnary(ctx, req)
+}
+
+// RejectSubmission calls orchestrator.v1.PluginModerationService.RejectSubmission.
+func (c *pluginModerationServiceClient) RejectSubmission(ctx context.Context, req *connect.Request[v1.RejectSubmissionRequest]) (*connect.Response[v1.RejectSubmissionResponse], error) {
+	return c.rejectSubmission.CallUnary(ctx, req)
+}
+
+// RequestChanges calls orchestrator.v1.PluginModerationService.RequestChanges.
+func (c *pluginModerationServiceClient) RequestChanges(ctx context.Context, req *connect.Request[v1.RequestChangesRequest]) (*connect.Response[v1.RequestChangesResponse], error) {
+	return c.requestChanges.CallUnary(ctx, req)
+}
+
+// PluginModerationServiceHandler is an implementation of the
+// orchestrator.v1.PluginModerationService service.
+type PluginModerationServiceHandler interface {
+	ListPendingReviews(context.Context, *connect.Request[v1.ListPendingReviewsRequest]) (*connect.Response[v1.ListPendingReviewsResponse], error)
+	ApproveSubmission(context.Context, *connect.Request[v1.ApproveSubmissionRequest]) (*connect.Response[v1.ApproveSubmissionResponse], error)
+	RejectSubmission(context.Context, *connect.Request[v1.RejectSubmissionRequest]) (*connect.Response[v1.RejectSubmissionResponse], error)
+	RequestChanges(context.Context, *connect.Request[v1.RequestChangesRequest]) (*connect.Response[v1.RequestChangesResponse], error)
+}
+
+// NewPluginModerationServiceHandler builds an HTTP handler from the service implementation. It
+// returns the path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewPluginModerationServiceHandler(svc PluginModerationServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	pluginModerationServiceMethods := v1.File_orchestrator_v1_plugin_registry_proto.Services().ByName("PluginModerationService").Methods()
+	pluginModerationServiceListPendingReviewsHandler := connect.NewUnaryHandler(
+		PluginModerationServiceListPendingReviewsProcedure,
+		svc.ListPendingReviews,
+		connect.WithSchema(pluginModerationServiceMethods.ByName("ListPendingReviews")),
+		connect.WithHandlerOptions(opts...),
+	)
+	pluginModerationServiceApproveSubmissionHandler := connect.NewUnaryHandler(
+		PluginModerationServiceApproveSubmissionProcedure,
+		svc.ApproveSubmission,
+		connect.WithSchema(pluginModerationServiceMethods.ByName("ApproveSubmission")),
+		connect.WithHandlerOptions(opts...),
+	)
+	pluginModerationServiceRejectSubmissionHandler := connect.NewUnaryHandler(
+		PluginModerationServiceRejectSubmissionProcedure,
+		svc.RejectSubmission,
+		connect.WithSchema(pluginModerationServiceMethods.ByName("RejectSubmission")),
+		connect.WithHandlerOptions(opts...),
+	)
+	pluginModerationServiceRequestChangesHandler := connect.NewUnaryHandler(
+		PluginModerationServiceRequestChangesProcedure,
+		svc.RequestChanges,
+		connect.WithSchema(pluginModerationServiceMethods.ByName("RequestChanges")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/orchestrator.v1.PluginModerationService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case PluginModerationServiceListPendingReviewsProcedure:
+			pluginModerationServiceListPendingReviewsHandler.ServeHTTP(w, r)
+		case PluginModerationServiceApproveSubmissionProcedure:
+			pluginModerationServiceApproveSubmissionHandler.ServeHTTP(w, r)
+		case PluginModerationServiceRejectSubmissionProcedure:
+			pluginModerationServiceRejectSubmissionHandler.ServeHTTP(w, r)
+		case PluginModerationServiceRequestChangesProcedure:
+			pluginModerationServiceRequestChangesHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedPluginModerationServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedPluginModerationServiceHandler struct{}
+
+func (UnimplementedPluginModerationServiceHandler) ListPendingReviews(context.Context, *connect.Request[v1.ListPendingReviewsRequest]) (*connect.Response[v1.ListPendingReviewsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginModerationService.ListPendingReviews is not implemented"))
+}
+
+func (UnimplementedPluginModerationServiceHandler) ApproveSubmission(context.Context, *connect.Request[v1.ApproveSubmissionRequest]) (*connect.Response[v1.ApproveSubmissionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginModerationService.ApproveSubmission is not implemented"))
+}
+
+func (UnimplementedPluginModerationServiceHandler) RejectSubmission(context.Context, *connect.Request[v1.RejectSubmissionRequest]) (*connect.Response[v1.RejectSubmissionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginModerationService.RejectSubmission is not implemented"))
+}
+
+func (UnimplementedPluginModerationServiceHandler) RequestChanges(context.Context, *connect.Request[v1.RequestChangesRequest]) (*connect.Response[v1.RequestChangesResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginModerationService.RequestChanges is not implemented"))
+}
+
 // PluginPublishServiceClient is a client for the orchestrator.v1.PluginPublishService service.
 type PluginPublishServiceClient interface {
 	PublishVersion(context.Context, *connect.Request[v1.PublishVersionRequest]) (*connect.Response[v1.PublishVersionResponse], error)
@@ -616,10 +835,6 @@ type PluginAuthServiceClient interface {
 	DenyDevice(context.Context, *connect.Request[v1.DenyDeviceRequest]) (*connect.Response[v1.DenyDeviceResponse], error)
 	GetDeviceStatus(context.Context, *connect.Request[v1.GetDeviceStatusRequest]) (*connect.Response[v1.GetDeviceStatusResponse], error)
 	Whoami(context.Context, *connect.Request[v1.WhoamiRequest]) (*connect.Response[v1.WhoamiResponse], error)
-	// ListMyAccounts returns the accounts the authenticated user belongs to.
-	// Used by `ninja login` (forced selection when multiple) and
-	// `ninja account list`.
-	ListMyAccounts(context.Context, *connect.Request[v1.ListMyAccountsRequest]) (*connect.Response[v1.ListMyAccountsResponse], error)
 }
 
 // NewPluginAuthServiceClient constructs a client for the orchestrator.v1.PluginAuthService service.
@@ -669,12 +884,6 @@ func NewPluginAuthServiceClient(httpClient connect.HTTPClient, baseURL string, o
 			connect.WithSchema(pluginAuthServiceMethods.ByName("Whoami")),
 			connect.WithClientOptions(opts...),
 		),
-		listMyAccounts: connect.NewClient[v1.ListMyAccountsRequest, v1.ListMyAccountsResponse](
-			httpClient,
-			baseURL+PluginAuthServiceListMyAccountsProcedure,
-			connect.WithSchema(pluginAuthServiceMethods.ByName("ListMyAccounts")),
-			connect.WithClientOptions(opts...),
-		),
 	}
 }
 
@@ -686,7 +895,6 @@ type pluginAuthServiceClient struct {
 	denyDevice      *connect.Client[v1.DenyDeviceRequest, v1.DenyDeviceResponse]
 	getDeviceStatus *connect.Client[v1.GetDeviceStatusRequest, v1.GetDeviceStatusResponse]
 	whoami          *connect.Client[v1.WhoamiRequest, v1.WhoamiResponse]
-	listMyAccounts  *connect.Client[v1.ListMyAccountsRequest, v1.ListMyAccountsResponse]
 }
 
 // StartDevice calls orchestrator.v1.PluginAuthService.StartDevice.
@@ -719,11 +927,6 @@ func (c *pluginAuthServiceClient) Whoami(ctx context.Context, req *connect.Reque
 	return c.whoami.CallUnary(ctx, req)
 }
 
-// ListMyAccounts calls orchestrator.v1.PluginAuthService.ListMyAccounts.
-func (c *pluginAuthServiceClient) ListMyAccounts(ctx context.Context, req *connect.Request[v1.ListMyAccountsRequest]) (*connect.Response[v1.ListMyAccountsResponse], error) {
-	return c.listMyAccounts.CallUnary(ctx, req)
-}
-
 // PluginAuthServiceHandler is an implementation of the orchestrator.v1.PluginAuthService service.
 type PluginAuthServiceHandler interface {
 	StartDevice(context.Context, *connect.Request[v1.StartDeviceRequest]) (*connect.Response[v1.StartDeviceResponse], error)
@@ -732,10 +935,6 @@ type PluginAuthServiceHandler interface {
 	DenyDevice(context.Context, *connect.Request[v1.DenyDeviceRequest]) (*connect.Response[v1.DenyDeviceResponse], error)
 	GetDeviceStatus(context.Context, *connect.Request[v1.GetDeviceStatusRequest]) (*connect.Response[v1.GetDeviceStatusResponse], error)
 	Whoami(context.Context, *connect.Request[v1.WhoamiRequest]) (*connect.Response[v1.WhoamiResponse], error)
-	// ListMyAccounts returns the accounts the authenticated user belongs to.
-	// Used by `ninja login` (forced selection when multiple) and
-	// `ninja account list`.
-	ListMyAccounts(context.Context, *connect.Request[v1.ListMyAccountsRequest]) (*connect.Response[v1.ListMyAccountsResponse], error)
 }
 
 // NewPluginAuthServiceHandler builds an HTTP handler from the service implementation. It returns
@@ -781,12 +980,6 @@ func NewPluginAuthServiceHandler(svc PluginAuthServiceHandler, opts ...connect.H
 		connect.WithSchema(pluginAuthServiceMethods.ByName("Whoami")),
 		connect.WithHandlerOptions(opts...),
 	)
-	pluginAuthServiceListMyAccountsHandler := connect.NewUnaryHandler(
-		PluginAuthServiceListMyAccountsProcedure,
-		svc.ListMyAccounts,
-		connect.WithSchema(pluginAuthServiceMethods.ByName("ListMyAccounts")),
-		connect.WithHandlerOptions(opts...),
-	)
 	return "/orchestrator.v1.PluginAuthService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
 		case PluginAuthServiceStartDeviceProcedure:
@@ -801,8 +994,6 @@ func NewPluginAuthServiceHandler(svc PluginAuthServiceHandler, opts ...connect.H
 			pluginAuthServiceGetDeviceStatusHandler.ServeHTTP(w, r)
 		case PluginAuthServiceWhoamiProcedure:
 			pluginAuthServiceWhoamiHandler.ServeHTTP(w, r)
-		case PluginAuthServiceListMyAccountsProcedure:
-			pluginAuthServiceListMyAccountsHandler.ServeHTTP(w, r)
 		default:
 			http.NotFound(w, r)
 		}
@@ -835,7 +1026,3 @@ func (UnimplementedPluginAuthServiceHandler) GetDeviceStatus(context.Context, *c
 func (UnimplementedPluginAuthServiceHandler) Whoami(context.Context, *connect.Request[v1.WhoamiRequest]) (*connect.Response[v1.WhoamiResponse], error) {
 	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginAuthService.Whoami is not implemented"))
 }
-
-func (UnimplementedPluginAuthServiceHandler) ListMyAccounts(context.Context, *connect.Request[v1.ListMyAccountsRequest]) (*connect.Response[v1.ListMyAccountsResponse], error) {
-	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginAuthService.ListMyAccounts is not implemented"))
-}

internal/api/orchestrator/v1/orchestratorv1connect/push.connect.go

@@ -0,0 +1,210 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: orchestrator/v1/push.proto
+
+package orchestratorv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "git.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// PushServiceName is the fully-qualified name of the PushService service.
+	PushServiceName = "orchestrator.v1.PushService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// PushServiceStartDeviceAuthProcedure is the fully-qualified name of the PushService's
+	// StartDeviceAuth RPC.
+	PushServiceStartDeviceAuthProcedure = "/orchestrator.v1.PushService/StartDeviceAuth"
+	// PushServicePollDeviceAuthProcedure is the fully-qualified name of the PushService's
+	// PollDeviceAuth RPC.
+	PushServicePollDeviceAuthProcedure = "/orchestrator.v1.PushService/PollDeviceAuth"
+	// PushServiceProvisionFromBackupProcedure is the fully-qualified name of the PushService's
+	// ProvisionFromBackup RPC.
+	PushServiceProvisionFromBackupProcedure = "/orchestrator.v1.PushService/ProvisionFromBackup"
+	// PushServiceGetProvisioningStatusProcedure is the fully-qualified name of the PushService's
+	// GetProvisioningStatus RPC.
+	PushServiceGetProvisioningStatusProcedure = "/orchestrator.v1.PushService/GetProvisioningStatus"
+)
+
+// PushServiceClient is a client for the orchestrator.v1.PushService service.
+type PushServiceClient interface {
+	// StartDeviceAuth initiates the OAuth device authorization flow.
+	// Returns a device code and user code for CLI authentication.
+	StartDeviceAuth(context.Context, *connect.Request[v1.StartDeviceAuthRequest]) (*connect.Response[v1.StartDeviceAuthResponse], error)
+	// PollDeviceAuth checks if the user has authorized the device.
+	// Called repeatedly by CLI until authorization is complete or expired.
+	PollDeviceAuth(context.Context, *connect.Request[v1.PollDeviceAuthRequest]) (*connect.Response[v1.PollDeviceAuthResponse], error)
+	// ProvisionFromBackup creates a new instance from an uploaded backup.
+	// The backup must have been uploaded via the HTTP upload endpoint first.
+	ProvisionFromBackup(context.Context, *connect.Request[v1.ProvisionFromBackupRequest]) (*connect.Response[v1.ProvisionFromBackupResponse], error)
+	// GetProvisioningStatus returns the current status of a provisioning operation.
+	GetProvisioningStatus(context.Context, *connect.Request[v1.GetProvisioningStatusRequest]) (*connect.Response[v1.GetProvisioningStatusResponse], error)
+}
+
+// NewPushServiceClient constructs a client for the orchestrator.v1.PushService service. By default,
+// it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and
+// sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC()
+// or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewPushServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) PushServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	pushServiceMethods := v1.File_orchestrator_v1_push_proto.Services().ByName("PushService").Methods()
+	return &pushServiceClient{
+		startDeviceAuth: connect.NewClient[v1.StartDeviceAuthRequest, v1.StartDeviceAuthResponse](
+			httpClient,
+			baseURL+PushServiceStartDeviceAuthProcedure,
+			connect.WithSchema(pushServiceMethods.ByName("StartDeviceAuth")),
+			connect.WithClientOptions(opts...),
+		),
+		pollDeviceAuth: connect.NewClient[v1.PollDeviceAuthRequest, v1.PollDeviceAuthResponse](
+			httpClient,
+			baseURL+PushServicePollDeviceAuthProcedure,
+			connect.WithSchema(pushServiceMethods.ByName("PollDeviceAuth")),
+			connect.WithClientOptions(opts...),
+		),
+		provisionFromBackup: connect.NewClient[v1.ProvisionFromBackupRequest, v1.ProvisionFromBackupResponse](
+			httpClient,
+			baseURL+PushServiceProvisionFromBackupProcedure,
+			connect.WithSchema(pushServiceMethods.ByName("ProvisionFromBackup")),
+			connect.WithClientOptions(opts...),
+		),
+		getProvisioningStatus: connect.NewClient[v1.GetProvisioningStatusRequest, v1.GetProvisioningStatusResponse](
+			httpClient,
+			baseURL+PushServiceGetProvisioningStatusProcedure,
+			connect.WithSchema(pushServiceMethods.ByName("GetProvisioningStatus")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// pushServiceClient implements PushServiceClient.
+type pushServiceClient struct {
+	startDeviceAuth       *connect.Client[v1.StartDeviceAuthRequest, v1.StartDeviceAuthResponse]
+	pollDeviceAuth        *connect.Client[v1.PollDeviceAuthRequest, v1.PollDeviceAuthResponse]
+	provisionFromBackup   *connect.Client[v1.ProvisionFromBackupRequest, v1.ProvisionFromBackupResponse]
+	getProvisioningStatus *connect.Client[v1.GetProvisioningStatusRequest, v1.GetProvisioningStatusResponse]
+}
+
+// StartDeviceAuth calls orchestrator.v1.PushService.StartDeviceAuth.
+func (c *pushServiceClient) StartDeviceAuth(ctx context.Context, req *connect.Request[v1.StartDeviceAuthRequest]) (*connect.Response[v1.StartDeviceAuthResponse], error) {
+	return c.startDeviceAuth.CallUnary(ctx, req)
+}
+
+// PollDeviceAuth calls orchestrator.v1.PushService.PollDeviceAuth.
+func (c *pushServiceClient) PollDeviceAuth(ctx context.Context, req *connect.Request[v1.PollDeviceAuthRequest]) (*connect.Response[v1.PollDeviceAuthResponse], error) {
+	return c.pollDeviceAuth.CallUnary(ctx, req)
+}
+
+// ProvisionFromBackup calls orchestrator.v1.PushService.ProvisionFromBackup.
+func (c *pushServiceClient) ProvisionFromBackup(ctx context.Context, req *connect.Request[v1.ProvisionFromBackupRequest]) (*connect.Response[v1.ProvisionFromBackupResponse], error) {
+	return c.provisionFromBackup.CallUnary(ctx, req)
+}
+
+// GetProvisioningStatus calls orchestrator.v1.PushService.GetProvisioningStatus.
+func (c *pushServiceClient) GetProvisioningStatus(ctx context.Context, req *connect.Request[v1.GetProvisioningStatusRequest]) (*connect.Response[v1.GetProvisioningStatusResponse], error) {
+	return c.getProvisioningStatus.CallUnary(ctx, req)
+}
+
+// PushServiceHandler is an implementation of the orchestrator.v1.PushService service.
+type PushServiceHandler interface {
+	// StartDeviceAuth initiates the OAuth device authorization flow.
+	// Returns a device code and user code for CLI authentication.
+	StartDeviceAuth(context.Context, *connect.Request[v1.StartDeviceAuthRequest]) (*connect.Response[v1.StartDeviceAuthResponse], error)
+	// PollDeviceAuth checks if the user has authorized the device.
+	// Called repeatedly by CLI until authorization is complete or expired.
+	PollDeviceAuth(context.Context, *connect.Request[v1.PollDeviceAuthRequest]) (*connect.Response[v1.PollDeviceAuthResponse], error)
+	// ProvisionFromBackup creates a new instance from an uploaded backup.
+	// The backup must have been uploaded via the HTTP upload endpoint first.
+	ProvisionFromBackup(context.Context, *connect.Request[v1.ProvisionFromBackupRequest]) (*connect.Response[v1.ProvisionFromBackupResponse], error)
+	// GetProvisioningStatus returns the current status of a provisioning operation.
+	GetProvisioningStatus(context.Context, *connect.Request[v1.GetProvisioningStatusRequest]) (*connect.Response[v1.GetProvisioningStatusResponse], error)
+}
+
+// NewPushServiceHandler builds an HTTP handler from the service implementation. It returns the path
+// on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewPushServiceHandler(svc PushServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	pushServiceMethods := v1.File_orchestrator_v1_push_proto.Services().ByName("PushService").Methods()
+	pushServiceStartDeviceAuthHandler := connect.NewUnaryHandler(
+		PushServiceStartDeviceAuthProcedure,
+		svc.StartDeviceAuth,
+		connect.WithSchema(pushServiceMethods.ByName("StartDeviceAuth")),
+		connect.WithHandlerOptions(opts...),
+	)
+	pushServicePollDeviceAuthHandler := connect.NewUnaryHandler(
+		PushServicePollDeviceAuthProcedure,
+		svc.PollDeviceAuth,
+		connect.WithSchema(pushServiceMethods.ByName("PollDeviceAuth")),
+		connect.WithHandlerOptions(opts...),
+	)
+	pushServiceProvisionFromBackupHandler := connect.NewUnaryHandler(
+		PushServiceProvisionFromBackupProcedure,
+		svc.ProvisionFromBackup,
+		connect.WithSchema(pushServiceMethods.ByName("ProvisionFromBackup")),
+		connect.WithHandlerOptions(opts...),
+	)
+	pushServiceGetProvisioningStatusHandler := connect.NewUnaryHandler(
+		PushServiceGetProvisioningStatusProcedure,
+		svc.GetProvisioningStatus,
+		connect.WithSchema(pushServiceMethods.ByName("GetProvisioningStatus")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/orchestrator.v1.PushService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case PushServiceStartDeviceAuthProcedure:
+			pushServiceStartDeviceAuthHandler.ServeHTTP(w, r)
+		case PushServicePollDeviceAuthProcedure:
+			pushServicePollDeviceAuthHandler.ServeHTTP(w, r)
+		case PushServiceProvisionFromBackupProcedure:
+			pushServiceProvisionFromBackupHandler.ServeHTTP(w, r)
+		case PushServiceGetProvisioningStatusProcedure:
+			pushServiceGetProvisioningStatusHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedPushServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedPushServiceHandler struct{}
+
+func (UnimplementedPushServiceHandler) StartDeviceAuth(context.Context, *connect.Request[v1.StartDeviceAuthRequest]) (*connect.Response[v1.StartDeviceAuthResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PushService.StartDeviceAuth is not implemented"))
+}
+
+func (UnimplementedPushServiceHandler) PollDeviceAuth(context.Context, *connect.Request[v1.PollDeviceAuthRequest]) (*connect.Response[v1.PollDeviceAuthResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PushService.PollDeviceAuth is not implemented"))
+}
+
+func (UnimplementedPushServiceHandler) ProvisionFromBackup(context.Context, *connect.Request[v1.ProvisionFromBackupRequest]) (*connect.Response[v1.ProvisionFromBackupResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PushService.ProvisionFromBackup is not implemented"))
+}
+
+func (UnimplementedPushServiceHandler) GetProvisioningStatus(context.Context, *connect.Request[v1.GetProvisioningStatusRequest]) (*connect.Response[v1.GetProvisioningStatusResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PushService.GetProvisioningStatus is not implemented"))
+}

internal/api/orchestrator/v1/orchestratorv1connect/registry.connect.go

@@ -0,0 +1,266 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: orchestrator/v1/registry.proto
+
+package orchestratorv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "git.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// RegistryServiceName is the fully-qualified name of the RegistryService service.
+	RegistryServiceName = "orchestrator.v1.RegistryService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// RegistryServiceListPackagesProcedure is the fully-qualified name of the RegistryService's
+	// ListPackages RPC.
+	RegistryServiceListPackagesProcedure = "/orchestrator.v1.RegistryService/ListPackages"
+	// RegistryServiceListPackageVersionsProcedure is the fully-qualified name of the RegistryService's
+	// ListPackageVersions RPC.
+	RegistryServiceListPackageVersionsProcedure = "/orchestrator.v1.RegistryService/ListPackageVersions"
+	// RegistryServiceDeletePackageVersionProcedure is the fully-qualified name of the RegistryService's
+	// DeletePackageVersion RPC.
+	RegistryServiceDeletePackageVersionProcedure = "/orchestrator.v1.RegistryService/DeletePackageVersion"
+	// RegistryServiceBulkDeletePackageVersionsProcedure is the fully-qualified name of the
+	// RegistryService's BulkDeletePackageVersions RPC.
+	RegistryServiceBulkDeletePackageVersionsProcedure = "/orchestrator.v1.RegistryService/BulkDeletePackageVersions"
+	// RegistryServiceGetRegistryStatsProcedure is the fully-qualified name of the RegistryService's
+	// GetRegistryStats RPC.
+	RegistryServiceGetRegistryStatsProcedure = "/orchestrator.v1.RegistryService/GetRegistryStats"
+	// RegistryServiceGetContainerStatsProcedure is the fully-qualified name of the RegistryService's
+	// GetContainerStats RPC.
+	RegistryServiceGetContainerStatsProcedure = "/orchestrator.v1.RegistryService/GetContainerStats"
+)
+
+// RegistryServiceClient is a client for the orchestrator.v1.RegistryService service.
+type RegistryServiceClient interface {
+	// List all packages in the registry
+	ListPackages(context.Context, *connect.Request[v1.ListPackagesRequest]) (*connect.Response[v1.ListPackagesResponse], error)
+	// List versions/tags for a specific package
+	ListPackageVersions(context.Context, *connect.Request[v1.ListPackageVersionsRequest]) (*connect.Response[v1.ListPackageVersionsResponse], error)
+	// Delete a specific package version
+	DeletePackageVersion(context.Context, *connect.Request[v1.DeletePackageVersionRequest]) (*connect.Response[v1.DeletePackageVersionResponse], error)
+	// Bulk delete package versions
+	BulkDeletePackageVersions(context.Context, *connect.Request[v1.BulkDeletePackageVersionsRequest]) (*connect.Response[v1.BulkDeletePackageVersionsResponse], error)
+	// Get registry stats
+	GetRegistryStats(context.Context, *connect.Request[v1.GetRegistryStatsRequest]) (*connect.Response[v1.GetRegistryStatsResponse], error)
+	// Get live container stats from all nodes via Podman
+	GetContainerStats(context.Context, *connect.Request[v1.GetContainerStatsRequest]) (*connect.Response[v1.GetContainerStatsResponse], error)
+}
+
+// NewRegistryServiceClient constructs a client for the orchestrator.v1.RegistryService service. By
+// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
+// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewRegistryServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) RegistryServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	registryServiceMethods := v1.File_orchestrator_v1_registry_proto.Services().ByName("RegistryService").Methods()
+	return &registryServiceClient{
+		listPackages: connect.NewClient[v1.ListPackagesRequest, v1.ListPackagesResponse](
+			httpClient,
+			baseURL+RegistryServiceListPackagesProcedure,
+			connect.WithSchema(registryServiceMethods.ByName("ListPackages")),
+			connect.WithClientOptions(opts...),
+		),
+		listPackageVersions: connect.NewClient[v1.ListPackageVersionsRequest, v1.ListPackageVersionsResponse](
+			httpClient,
+			baseURL+RegistryServiceListPackageVersionsProcedure,
+			connect.WithSchema(registryServiceMethods.ByName("ListPackageVersions")),
+			connect.WithClientOptions(opts...),
+		),
+		deletePackageVersion: connect.NewClient[v1.DeletePackageVersionRequest, v1.DeletePackageVersionResponse](
+			httpClient,
+			baseURL+RegistryServiceDeletePackageVersionProcedure,
+			connect.WithSchema(registryServiceMethods.ByName("DeletePackageVersion")),
+			connect.WithClientOptions(opts...),
+		),
+		bulkDeletePackageVersions: connect.NewClient[v1.BulkDeletePackageVersionsRequest, v1.BulkDeletePackageVersionsResponse](
+			httpClient,
+			baseURL+RegistryServiceBulkDeletePackageVersionsProcedure,
+			connect.WithSchema(registryServiceMethods.ByName("BulkDeletePackageVersions")),
+			connect.WithClientOptions(opts...),
+		),
+		getRegistryStats: connect.NewClient[v1.GetRegistryStatsRequest, v1.GetRegistryStatsResponse](
+			httpClient,
+			baseURL+RegistryServiceGetRegistryStatsProcedure,
+			connect.WithSchema(registryServiceMethods.ByName("GetRegistryStats")),
+			connect.WithClientOptions(opts...),
+		),
+		getContainerStats: connect.NewClient[v1.GetContainerStatsRequest, v1.GetContainerStatsResponse](
+			httpClient,
+			baseURL+RegistryServiceGetContainerStatsProcedure,
+			connect.WithSchema(registryServiceMethods.ByName("GetContainerStats")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// registryServiceClient implements RegistryServiceClient.
+type registryServiceClient struct {
+	listPackages              *connect.Client[v1.ListPackagesRequest, v1.ListPackagesResponse]
+	listPackageVersions       *connect.Client[v1.ListPackageVersionsRequest, v1.ListPackageVersionsResponse]
+	deletePackageVersion      *connect.Client[v1.DeletePackageVersionRequest, v1.DeletePackageVersionResponse]
+	bulkDeletePackageVersions *connect.Client[v1.BulkDeletePackageVersionsRequest, v1.BulkDeletePackageVersionsResponse]
+	getRegistryStats          *connect.Client[v1.GetRegistryStatsRequest, v1.GetRegistryStatsResponse]
+	getContainerStats         *connect.Client[v1.GetContainerStatsRequest, v1.GetContainerStatsResponse]
+}
+
+// ListPackages calls orchestrator.v1.RegistryService.ListPackages.
+func (c *registryServiceClient) ListPackages(ctx context.Context, req *connect.Request[v1.ListPackagesRequest]) (*connect.Response[v1.ListPackagesResponse], error) {
+	return c.listPackages.CallUnary(ctx, req)
+}
+
+// ListPackageVersions calls orchestrator.v1.RegistryService.ListPackageVersions.
+func (c *registryServiceClient) ListPackageVersions(ctx context.Context, req *connect.Request[v1.ListPackageVersionsRequest]) (*connect.Response[v1.ListPackageVersionsResponse], error) {
+	return c.listPackageVersions.CallUnary(ctx, req)
+}
+
+// DeletePackageVersion calls orchestrator.v1.RegistryService.DeletePackageVersion.
+func (c *registryServiceClient) DeletePackageVersion(ctx context.Context, req *connect.Request[v1.DeletePackageVersionRequest]) (*connect.Response[v1.DeletePackageVersionResponse], error) {
+	return c.deletePackageVersion.CallUnary(ctx, req)
+}
+
+// BulkDeletePackageVersions calls orchestrator.v1.RegistryService.BulkDeletePackageVersions.
+func (c *registryServiceClient) BulkDeletePackageVersions(ctx context.Context, req *connect.Request[v1.BulkDeletePackageVersionsRequest]) (*connect.Response[v1.BulkDeletePackageVersionsResponse], error) {
+	return c.bulkDeletePackageVersions.CallUnary(ctx, req)
+}
+
+// GetRegistryStats calls orchestrator.v1.RegistryService.GetRegistryStats.
+func (c *registryServiceClient) GetRegistryStats(ctx context.Context, req *connect.Request[v1.GetRegistryStatsRequest]) (*connect.Response[v1.GetRegistryStatsResponse], error) {
+	return c.getRegistryStats.CallUnary(ctx, req)
+}
+
+// GetContainerStats calls orchestrator.v1.RegistryService.GetContainerStats.
+func (c *registryServiceClient) GetContainerStats(ctx context.Context, req *connect.Request[v1.GetContainerStatsRequest]) (*connect.Response[v1.GetContainerStatsResponse], error) {
+	return c.getContainerStats.CallUnary(ctx, req)
+}
+
+// RegistryServiceHandler is an implementation of the orchestrator.v1.RegistryService service.
+type RegistryServiceHandler interface {
+	// List all packages in the registry
+	ListPackages(context.Context, *connect.Request[v1.ListPackagesRequest]) (*connect.Response[v1.ListPackagesResponse], error)
+	// List versions/tags for a specific package
+	ListPackageVersions(context.Context, *connect.Request[v1.ListPackageVersionsRequest]) (*connect.Response[v1.ListPackageVersionsResponse], error)
+	// Delete a specific package version
+	DeletePackageVersion(context.Context, *connect.Request[v1.DeletePackageVersionRequest]) (*connect.Response[v1.DeletePackageVersionResponse], error)
+	// Bulk delete package versions
+	BulkDeletePackageVersions(context.Context, *connect.Request[v1.BulkDeletePackageVersionsRequest]) (*connect.Response[v1.BulkDeletePackageVersionsResponse], error)
+	// Get registry stats
+	GetRegistryStats(context.Context, *connect.Request[v1.GetRegistryStatsRequest]) (*connect.Response[v1.GetRegistryStatsResponse], error)
+	// Get live container stats from all nodes via Podman
+	GetContainerStats(context.Context, *connect.Request[v1.GetContainerStatsRequest]) (*connect.Response[v1.GetContainerStatsResponse], error)
+}
+
+// NewRegistryServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewRegistryServiceHandler(svc RegistryServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	registryServiceMethods := v1.File_orchestrator_v1_registry_proto.Services().ByName("RegistryService").Methods()
+	registryServiceListPackagesHandler := connect.NewUnaryHandler(
+		RegistryServiceListPackagesProcedure,
+		svc.ListPackages,
+		connect.WithSchema(registryServiceMethods.ByName("ListPackages")),
+		connect.WithHandlerOptions(opts...),
+	)
+	registryServiceListPackageVersionsHandler := connect.NewUnaryHandler(
+		RegistryServiceListPackageVersionsProcedure,
+		svc.ListPackageVersions,
+		connect.WithSchema(registryServiceMethods.ByName("ListPackageVersions")),
+		connect.WithHandlerOptions(opts...),
+	)
+	registryServiceDeletePackageVersionHandler := connect.NewUnaryHandler(
+		RegistryServiceDeletePackageVersionProcedure,
+		svc.DeletePackageVersion,
+		connect.WithSchema(registryServiceMethods.ByName("DeletePackageVersion")),
+		connect.WithHandlerOptions(opts...),
+	)
+	registryServiceBulkDeletePackageVersionsHandler := connect.NewUnaryHandler(
+		RegistryServiceBulkDeletePackageVersionsProcedure,
+		svc.BulkDeletePackageVersions,
+		connect.WithSchema(registryServiceMethods.ByName("BulkDeletePackageVersions")),
+		connect.WithHandlerOptions(opts...),
+	)
+	registryServiceGetRegistryStatsHandler := connect.NewUnaryHandler(
+		RegistryServiceGetRegistryStatsProcedure,
+		svc.GetRegistryStats,
+		connect.WithSchema(registryServiceMethods.ByName("GetRegistryStats")),
+		connect.WithHandlerOptions(opts...),
+	)
+	registryServiceGetContainerStatsHandler := connect.NewUnaryHandler(
+		RegistryServiceGetContainerStatsProcedure,
+		svc.GetContainerStats,
+		connect.WithSchema(registryServiceMethods.ByName("GetContainerStats")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/orchestrator.v1.RegistryService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case RegistryServiceListPackagesProcedure:
+			registryServiceListPackagesHandler.ServeHTTP(w, r)
+		case RegistryServiceListPackageVersionsProcedure:
+			registryServiceListPackageVersionsHandler.ServeHTTP(w, r)
+		case RegistryServiceDeletePackageVersionProcedure:
+			registryServiceDeletePackageVersionHandler.ServeHTTP(w, r)
+		case RegistryServiceBulkDeletePackageVersionsProcedure:
+			registryServiceBulkDeletePackageVersionsHandler.ServeHTTP(w, r)
+		case RegistryServiceGetRegistryStatsProcedure:
+			registryServiceGetRegistryStatsHandler.ServeHTTP(w, r)
+		case RegistryServiceGetContainerStatsProcedure:
+			registryServiceGetContainerStatsHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedRegistryServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedRegistryServiceHandler struct{}
+
+func (UnimplementedRegistryServiceHandler) ListPackages(context.Context, *connect.Request[v1.ListPackagesRequest]) (*connect.Response[v1.ListPackagesResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.RegistryService.ListPackages is not implemented"))
+}
+
+func (UnimplementedRegistryServiceHandler) ListPackageVersions(context.Context, *connect.Request[v1.ListPackageVersionsRequest]) (*connect.Response[v1.ListPackageVersionsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.RegistryService.ListPackageVersions is not implemented"))
+}
+
+func (UnimplementedRegistryServiceHandler) DeletePackageVersion(context.Context, *connect.Request[v1.DeletePackageVersionRequest]) (*connect.Response[v1.DeletePackageVersionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.RegistryService.DeletePackageVersion is not implemented"))
+}
+
+func (UnimplementedRegistryServiceHandler) BulkDeletePackageVersions(context.Context, *connect.Request[v1.BulkDeletePackageVersionsRequest]) (*connect.Response[v1.BulkDeletePackageVersionsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.RegistryService.BulkDeletePackageVersions is not implemented"))
+}
+
+func (UnimplementedRegistryServiceHandler) GetRegistryStats(context.Context, *connect.Request[v1.GetRegistryStatsRequest]) (*connect.Response[v1.GetRegistryStatsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.RegistryService.GetRegistryStats is not implemented"))
+}
+
+func (UnimplementedRegistryServiceHandler) GetContainerStats(context.Context, *connect.Request[v1.GetContainerStatsRequest]) (*connect.Response[v1.GetContainerStatsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.RegistryService.GetContainerStats is not implemented"))
+}

internal/api/orchestrator/v1/orchestratorv1connect/reporting.connect.go

@@ -0,0 +1,361 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: orchestrator/v1/reporting.proto
+
+package orchestratorv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "git.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// InstanceReportingServiceName is the fully-qualified name of the InstanceReportingService service.
+	InstanceReportingServiceName = "orchestrator.v1.InstanceReportingService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// InstanceReportingServiceSubmitReportProcedure is the fully-qualified name of the
+	// InstanceReportingService's SubmitReport RPC.
+	InstanceReportingServiceSubmitReportProcedure = "/orchestrator.v1.InstanceReportingService/SubmitReport"
+	// InstanceReportingServiceHeartbeatProcedure is the fully-qualified name of the
+	// InstanceReportingService's Heartbeat RPC.
+	InstanceReportingServiceHeartbeatProcedure = "/orchestrator.v1.InstanceReportingService/Heartbeat"
+	// InstanceReportingServiceReportIncidentProcedure is the fully-qualified name of the
+	// InstanceReportingService's ReportIncident RPC.
+	InstanceReportingServiceReportIncidentProcedure = "/orchestrator.v1.InstanceReportingService/ReportIncident"
+	// InstanceReportingServiceListIncidentsProcedure is the fully-qualified name of the
+	// InstanceReportingService's ListIncidents RPC.
+	InstanceReportingServiceListIncidentsProcedure = "/orchestrator.v1.InstanceReportingService/ListIncidents"
+	// InstanceReportingServiceAcknowledgeIncidentProcedure is the fully-qualified name of the
+	// InstanceReportingService's AcknowledgeIncident RPC.
+	InstanceReportingServiceAcknowledgeIncidentProcedure = "/orchestrator.v1.InstanceReportingService/AcknowledgeIncident"
+	// InstanceReportingServiceResolveIncidentProcedure is the fully-qualified name of the
+	// InstanceReportingService's ResolveIncident RPC.
+	InstanceReportingServiceResolveIncidentProcedure = "/orchestrator.v1.InstanceReportingService/ResolveIncident"
+	// InstanceReportingServiceGetInstanceHealthProcedure is the fully-qualified name of the
+	// InstanceReportingService's GetInstanceHealth RPC.
+	InstanceReportingServiceGetInstanceHealthProcedure = "/orchestrator.v1.InstanceReportingService/GetInstanceHealth"
+	// InstanceReportingServiceGetHealthHistoryProcedure is the fully-qualified name of the
+	// InstanceReportingService's GetHealthHistory RPC.
+	InstanceReportingServiceGetHealthHistoryProcedure = "/orchestrator.v1.InstanceReportingService/GetHealthHistory"
+	// InstanceReportingServiceInstanceReadyProcedure is the fully-qualified name of the
+	// InstanceReportingService's InstanceReady RPC.
+	InstanceReportingServiceInstanceReadyProcedure = "/orchestrator.v1.InstanceReportingService/InstanceReady"
+)
+
+// InstanceReportingServiceClient is a client for the orchestrator.v1.InstanceReportingService
+// service.
+type InstanceReportingServiceClient interface {
+	// Submit a full health report (called every 5 minutes)
+	SubmitReport(context.Context, *connect.Request[v1.SubmitReportRequest]) (*connect.Response[v1.SubmitReportResponse], error)
+	// Send a quick heartbeat (called every 1 minute)
+	Heartbeat(context.Context, *connect.Request[v1.HeartbeatRequest]) (*connect.Response[v1.HeartbeatResponse], error)
+	// Report an incident/error (called immediately when issues occur)
+	ReportIncident(context.Context, *connect.Request[v1.ReportIncidentRequest]) (*connect.Response[v1.ReportIncidentResponse], error)
+	// List incidents for an instance (admin UI)
+	ListIncidents(context.Context, *connect.Request[v1.ListIncidentsRequest]) (*connect.Response[v1.ListIncidentsResponse], error)
+	// Acknowledge an incident (admin UI)
+	AcknowledgeIncident(context.Context, *connect.Request[v1.AcknowledgeIncidentRequest]) (*connect.Response[v1.AcknowledgeIncidentResponse], error)
+	// Resolve an incident (admin UI)
+	ResolveIncident(context.Context, *connect.Request[v1.ResolveIncidentRequest]) (*connect.Response[v1.ResolveIncidentResponse], error)
+	// Get current health status for an instance
+	GetInstanceHealth(context.Context, *connect.Request[v1.GetInstanceHealthRequest]) (*connect.Response[v1.GetInstanceHealthResponse], error)
+	// Get health history for trending
+	GetHealthHistory(context.Context, *connect.Request[v1.GetHealthHistoryRequest]) (*connect.Response[v1.GetHealthHistoryResponse], error)
+	// Called by CMS instance when it has started and is ready to serve
+	InstanceReady(context.Context, *connect.Request[v1.InstanceReadyRequest]) (*connect.Response[v1.InstanceReadyResponse], error)
+}
+
+// NewInstanceReportingServiceClient constructs a client for the
+// orchestrator.v1.InstanceReportingService service. By default, it uses the Connect protocol with
+// the binary Protobuf Codec, asks for gzipped responses, and sends uncompressed requests. To use
+// the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewInstanceReportingServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) InstanceReportingServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	instanceReportingServiceMethods := v1.File_orchestrator_v1_reporting_proto.Services().ByName("InstanceReportingService").Methods()
+	return &instanceReportingServiceClient{
+		submitReport: connect.NewClient[v1.SubmitReportRequest, v1.SubmitReportResponse](
+			httpClient,
+			baseURL+InstanceReportingServiceSubmitReportProcedure,
+			connect.WithSchema(instanceReportingServiceMethods.ByName("SubmitReport")),
+			connect.WithClientOptions(opts...),
+		),
+		heartbeat: connect.NewClient[v1.HeartbeatRequest, v1.HeartbeatResponse](
+			httpClient,
+			baseURL+InstanceReportingServiceHeartbeatProcedure,
+			connect.WithSchema(instanceReportingServiceMethods.ByName("Heartbeat")),
+			connect.WithClientOptions(opts...),
+		),
+		reportIncident: connect.NewClient[v1.ReportIncidentRequest, v1.ReportIncidentResponse](
+			httpClient,
+			baseURL+InstanceReportingServiceReportIncidentProcedure,
+			connect.WithSchema(instanceReportingServiceMethods.ByName("ReportIncident")),
+			connect.WithClientOptions(opts...),
+		),
+		listIncidents: connect.NewClient[v1.ListIncidentsRequest, v1.ListIncidentsResponse](
+			httpClient,
+			baseURL+InstanceReportingServiceListIncidentsProcedure,
+			connect.WithSchema(instanceReportingServiceMethods.ByName("ListIncidents")),
+			connect.WithClientOptions(opts...),
+		),
+		acknowledgeIncident: connect.NewClient[v1.AcknowledgeIncidentRequest, v1.AcknowledgeIncidentResponse](
+			httpClient,
+			baseURL+InstanceReportingServiceAcknowledgeIncidentProcedure,
+			connect.WithSchema(instanceReportingServiceMethods.ByName("AcknowledgeIncident")),
+			connect.WithClientOptions(opts...),
+		),
+		resolveIncident: connect.NewClient[v1.ResolveIncidentRequest, v1.ResolveIncidentResponse](
+			httpClient,
+			baseURL+InstanceReportingServiceResolveIncidentProcedure,
+			connect.WithSchema(instanceReportingServiceMethods.ByName("ResolveIncident")),
+			connect.WithClientOptions(opts...),
+		),
+		getInstanceHealth: connect.NewClient[v1.GetInstanceHealthRequest, v1.GetInstanceHealthResponse](
+			httpClient,
+			baseURL+InstanceReportingServiceGetInstanceHealthProcedure,
+			connect.WithSchema(instanceReportingServiceMethods.ByName("GetInstanceHealth")),
+			connect.WithClientOptions(opts...),
+		),
+		getHealthHistory: connect.NewClient[v1.GetHealthHistoryRequest, v1.GetHealthHistoryResponse](
+			httpClient,
+			baseURL+InstanceReportingServiceGetHealthHistoryProcedure,
+			connect.WithSchema(instanceReportingServiceMethods.ByName("GetHealthHistory")),
+			connect.WithClientOptions(opts...),
+		),
+		instanceReady: connect.NewClient[v1.InstanceReadyRequest, v1.InstanceReadyResponse](
+			httpClient,
+			baseURL+InstanceReportingServiceInstanceReadyProcedure,
+			connect.WithSchema(instanceReportingServiceMethods.ByName("InstanceReady")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// instanceReportingServiceClient implements InstanceReportingServiceClient.
+type instanceReportingServiceClient struct {
+	submitReport        *connect.Client[v1.SubmitReportRequest, v1.SubmitReportResponse]
+	heartbeat           *connect.Client[v1.HeartbeatRequest, v1.HeartbeatResponse]
+	reportIncident      *connect.Client[v1.ReportIncidentRequest, v1.ReportIncidentResponse]
+	listIncidents       *connect.Client[v1.ListIncidentsRequest, v1.ListIncidentsResponse]
+	acknowledgeIncident *connect.Client[v1.AcknowledgeIncidentRequest, v1.AcknowledgeIncidentResponse]
+	resolveIncident     *connect.Client[v1.ResolveIncidentRequest, v1.ResolveIncidentResponse]
+	getInstanceHealth   *connect.Client[v1.GetInstanceHealthRequest, v1.GetInstanceHealthResponse]
+	getHealthHistory    *connect.Client[v1.GetHealthHistoryRequest, v1.GetHealthHistoryResponse]
+	instanceReady       *connect.Client[v1.InstanceReadyRequest, v1.InstanceReadyResponse]
+}
+
+// SubmitReport calls orchestrator.v1.InstanceReportingService.SubmitReport.
+func (c *instanceReportingServiceClient) SubmitReport(ctx context.Context, req *connect.Request[v1.SubmitReportRequest]) (*connect.Response[v1.SubmitReportResponse], error) {
+	return c.submitReport.CallUnary(ctx, req)
+}
+
+// Heartbeat calls orchestrator.v1.InstanceReportingService.Heartbeat.
+func (c *instanceReportingServiceClient) Heartbeat(ctx context.Context, req *connect.Request[v1.HeartbeatRequest]) (*connect.Response[v1.HeartbeatResponse], error) {
+	return c.heartbeat.CallUnary(ctx, req)
+}
+
+// ReportIncident calls orchestrator.v1.InstanceReportingService.ReportIncident.
+func (c *instanceReportingServiceClient) ReportIncident(ctx context.Context, req *connect.Request[v1.ReportIncidentRequest]) (*connect.Response[v1.ReportIncidentResponse], error) {
+	return c.reportIncident.CallUnary(ctx, req)
+}
+
+// ListIncidents calls orchestrator.v1.InstanceReportingService.ListIncidents.
+func (c *instanceReportingServiceClient) ListIncidents(ctx context.Context, req *connect.Request[v1.ListIncidentsRequest]) (*connect.Response[v1.ListIncidentsResponse], error) {
+	return c.listIncidents.CallUnary(ctx, req)
+}
+
+// AcknowledgeIncident calls orchestrator.v1.InstanceReportingService.AcknowledgeIncident.
+func (c *instanceReportingServiceClient) AcknowledgeIncident(ctx context.Context, req *connect.Request[v1.AcknowledgeIncidentRequest]) (*connect.Response[v1.AcknowledgeIncidentResponse], error) {
+	return c.acknowledgeIncident.CallUnary(ctx, req)
+}
+
+// ResolveIncident calls orchestrator.v1.InstanceReportingService.ResolveIncident.
+func (c *instanceReportingServiceClient) ResolveIncident(ctx context.Context, req *connect.Request[v1.ResolveIncidentRequest]) (*connect.Response[v1.ResolveIncidentResponse], error) {
+	return c.resolveIncident.CallUnary(ctx, req)
+}
+
+// GetInstanceHealth calls orchestrator.v1.InstanceReportingService.GetInstanceHealth.
+func (c *instanceReportingServiceClient) GetInstanceHealth(ctx context.Context, req *connect.Request[v1.GetInstanceHealthRequest]) (*connect.Response[v1.GetInstanceHealthResponse], error) {
+	return c.getInstanceHealth.CallUnary(ctx, req)
+}
+
+// GetHealthHistory calls orchestrator.v1.InstanceReportingService.GetHealthHistory.
+func (c *instanceReportingServiceClient) GetHealthHistory(ctx context.Context, req *connect.Request[v1.GetHealthHistoryRequest]) (*connect.Response[v1.GetHealthHistoryResponse], error) {
+	return c.getHealthHistory.CallUnary(ctx, req)
+}
+
+// InstanceReady calls orchestrator.v1.InstanceReportingService.InstanceReady.
+func (c *instanceReportingServiceClient) InstanceReady(ctx context.Context, req *connect.Request[v1.InstanceReadyRequest]) (*connect.Response[v1.InstanceReadyResponse], error) {
+	return c.instanceReady.CallUnary(ctx, req)
+}
+
+// InstanceReportingServiceHandler is an implementation of the
+// orchestrator.v1.InstanceReportingService service.
+type InstanceReportingServiceHandler interface {
+	// Submit a full health report (called every 5 minutes)
+	SubmitReport(context.Context, *connect.Request[v1.SubmitReportRequest]) (*connect.Response[v1.SubmitReportResponse], error)
+	// Send a quick heartbeat (called every 1 minute)
+	Heartbeat(context.Context, *connect.Request[v1.HeartbeatRequest]) (*connect.Response[v1.HeartbeatResponse], error)
+	// Report an incident/error (called immediately when issues occur)
+	ReportIncident(context.Context, *connect.Request[v1.ReportIncidentRequest]) (*connect.Response[v1.ReportIncidentResponse], error)
+	// List incidents for an instance (admin UI)
+	ListIncidents(context.Context, *connect.Request[v1.ListIncidentsRequest]) (*connect.Response[v1.ListIncidentsResponse], error)
+	// Acknowledge an incident (admin UI)
+	AcknowledgeIncident(context.Context, *connect.Request[v1.AcknowledgeIncidentRequest]) (*connect.Response[v1.AcknowledgeIncidentResponse], error)
+	// Resolve an incident (admin UI)
+	ResolveIncident(context.Context, *connect.Request[v1.ResolveIncidentRequest]) (*connect.Response[v1.ResolveIncidentResponse], error)
+	// Get current health status for an instance
+	GetInstanceHealth(context.Context, *connect.Request[v1.GetInstanceHealthRequest]) (*connect.Response[v1.GetInstanceHealthResponse], error)
+	// Get health history for trending
+	GetHealthHistory(context.Context, *connect.Request[v1.GetHealthHistoryRequest]) (*connect.Response[v1.GetHealthHistoryResponse], error)
+	// Called by CMS instance when it has started and is ready to serve
+	InstanceReady(context.Context, *connect.Request[v1.InstanceReadyRequest]) (*connect.Response[v1.InstanceReadyResponse], error)
+}
+
+// NewInstanceReportingServiceHandler builds an HTTP handler from the service implementation. It
+// returns the path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewInstanceReportingServiceHandler(svc InstanceReportingServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	instanceReportingServiceMethods := v1.File_orchestrator_v1_reporting_proto.Services().ByName("InstanceReportingService").Methods()
+	instanceReportingServiceSubmitReportHandler := connect.NewUnaryHandler(
+		InstanceReportingServiceSubmitReportProcedure,
+		svc.SubmitReport,
+		connect.WithSchema(instanceReportingServiceMethods.ByName("SubmitReport")),
+		connect.WithHandlerOptions(opts...),
+	)
+	instanceReportingServiceHeartbeatHandler := connect.NewUnaryHandler(
+		InstanceReportingServiceHeartbeatProcedure,
+		svc.Heartbeat,
+		connect.WithSchema(instanceReportingServiceMethods.ByName("Heartbeat")),
+		connect.WithHandlerOptions(opts...),
+	)
+	instanceReportingServiceReportIncidentHandler := connect.NewUnaryHandler(
+		InstanceReportingServiceReportIncidentProcedure,
+		svc.ReportIncident,
+		connect.WithSchema(instanceReportingServiceMethods.ByName("ReportIncident")),
+		connect.WithHandlerOptions(opts...),
+	)
+	instanceReportingServiceListIncidentsHandler := connect.NewUnaryHandler(
+		InstanceReportingServiceListIncidentsProcedure,
+		svc.ListIncidents,
+		connect.WithSchema(instanceReportingServiceMethods.ByName("ListIncidents")),
+		connect.WithHandlerOptions(opts...),
+	)
+	instanceReportingServiceAcknowledgeIncidentHandler := connect.NewUnaryHandler(
+		InstanceReportingServiceAcknowledgeIncidentProcedure,
+		svc.AcknowledgeIncident,
+		connect.WithSchema(instanceReportingServiceMethods.ByName("AcknowledgeIncident")),
+		connect.WithHandlerOptions(opts...),
+	)
+	instanceReportingServiceResolveIncidentHandler := connect.NewUnaryHandler(
+		InstanceReportingServiceResolveIncidentProcedure,
+		svc.ResolveIncident,
+		connect.WithSchema(instanceReportingServiceMethods.ByName("ResolveIncident")),
+		connect.WithHandlerOptions(opts...),
+	)
+	instanceReportingServiceGetInstanceHealthHandler := connect.NewUnaryHandler(
+		InstanceReportingServiceGetInstanceHealthProcedure,
+		svc.GetInstanceHealth,
+		connect.WithSchema(instanceReportingServiceMethods.ByName("GetInstanceHealth")),
+		connect.WithHandlerOptions(opts...),
+	)
+	instanceReportingServiceGetHealthHistoryHandler := connect.NewUnaryHandler(
+		InstanceReportingServiceGetHealthHistoryProcedure,
+		svc.GetHealthHistory,
+		connect.WithSchema(instanceReportingServiceMethods.ByName("GetHealthHistory")),
+		connect.WithHandlerOptions(opts...),
+	)
+	instanceReportingServiceInstanceReadyHandler := connect.NewUnaryHandler(
+		InstanceReportingServiceInstanceReadyProcedure,
+		svc.InstanceReady,
+		connect.WithSchema(instanceReportingServiceMethods.ByName("InstanceReady")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/orchestrator.v1.InstanceReportingService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case InstanceReportingServiceSubmitReportProcedure:
+			instanceReportingServiceSubmitReportHandler.ServeHTTP(w, r)
+		case InstanceReportingServiceHeartbeatProcedure:
+			instanceReportingServiceHeartbeatHandler.ServeHTTP(w, r)
+		case InstanceReportingServiceReportIncidentProcedure:
+			instanceReportingServiceReportIncidentHandler.ServeHTTP(w, r)
+		case InstanceReportingServiceListIncidentsProcedure:
+			instanceReportingServiceListIncidentsHandler.ServeHTTP(w, r)
+		case InstanceReportingServiceAcknowledgeIncidentProcedure:
+			instanceReportingServiceAcknowledgeIncidentHandler.ServeHTTP(w, r)
+		case InstanceReportingServiceResolveIncidentProcedure:
+			instanceReportingServiceResolveIncidentHandler.ServeHTTP(w, r)
+		case InstanceReportingServiceGetInstanceHealthProcedure:
+			instanceReportingServiceGetInstanceHealthHandler.ServeHTTP(w, r)
+		case InstanceReportingServiceGetHealthHistoryProcedure:
+			instanceReportingServiceGetHealthHistoryHandler.ServeHTTP(w, r)
+		case InstanceReportingServiceInstanceReadyProcedure:
+			instanceReportingServiceInstanceReadyHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedInstanceReportingServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedInstanceReportingServiceHandler struct{}
+
+func (UnimplementedInstanceReportingServiceHandler) SubmitReport(context.Context, *connect.Request[v1.SubmitReportRequest]) (*connect.Response[v1.SubmitReportResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.InstanceReportingService.SubmitReport is not implemented"))
+}
+
+func (UnimplementedInstanceReportingServiceHandler) Heartbeat(context.Context, *connect.Request[v1.HeartbeatRequest]) (*connect.Response[v1.HeartbeatResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.InstanceReportingService.Heartbeat is not implemented"))
+}
+
+func (UnimplementedInstanceReportingServiceHandler) ReportIncident(context.Context, *connect.Request[v1.ReportIncidentRequest]) (*connect.Response[v1.ReportIncidentResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.InstanceReportingService.ReportIncident is not implemented"))
+}
+
+func (UnimplementedInstanceReportingServiceHandler) ListIncidents(context.Context, *connect.Request[v1.ListIncidentsRequest]) (*connect.Response[v1.ListIncidentsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.InstanceReportingService.ListIncidents is not implemented"))
+}
+
+func (UnimplementedInstanceReportingServiceHandler) AcknowledgeIncident(context.Context, *connect.Request[v1.AcknowledgeIncidentRequest]) (*connect.Response[v1.AcknowledgeIncidentResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.InstanceReportingService.AcknowledgeIncident is not implemented"))
+}
+
+func (UnimplementedInstanceReportingServiceHandler) ResolveIncident(context.Context, *connect.Request[v1.ResolveIncidentRequest]) (*connect.Response[v1.ResolveIncidentResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.InstanceReportingService.ResolveIncident is not implemented"))
+}
+
+func (UnimplementedInstanceReportingServiceHandler) GetInstanceHealth(context.Context, *connect.Request[v1.GetInstanceHealthRequest]) (*connect.Response[v1.GetInstanceHealthResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.InstanceReportingService.GetInstanceHealth is not implemented"))
+}
+
+func (UnimplementedInstanceReportingServiceHandler) GetHealthHistory(context.Context, *connect.Request[v1.GetHealthHistoryRequest]) (*connect.Response[v1.GetHealthHistoryResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.InstanceReportingService.GetHealthHistory is not implemented"))
+}
+
+func (UnimplementedInstanceReportingServiceHandler) InstanceReady(context.Context, *connect.Request[v1.InstanceReadyRequest]) (*connect.Response[v1.InstanceReadyResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.InstanceReportingService.InstanceReady is not implemented"))
+}

internal/api/orchestrator/v1/orchestratorv1connect/settings.connect.go

@@ -0,0 +1,173 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: orchestrator/v1/settings.proto
+
+package orchestratorv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "git.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// SettingsServiceName is the fully-qualified name of the SettingsService service.
+	SettingsServiceName = "orchestrator.v1.SettingsService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// SettingsServiceGetPlatformSettingProcedure is the fully-qualified name of the SettingsService's
+	// GetPlatformSetting RPC.
+	SettingsServiceGetPlatformSettingProcedure = "/orchestrator.v1.SettingsService/GetPlatformSetting"
+	// SettingsServiceUpdatePlatformSettingProcedure is the fully-qualified name of the
+	// SettingsService's UpdatePlatformSetting RPC.
+	SettingsServiceUpdatePlatformSettingProcedure = "/orchestrator.v1.SettingsService/UpdatePlatformSetting"
+	// SettingsServiceListPlatformSettingsProcedure is the fully-qualified name of the SettingsService's
+	// ListPlatformSettings RPC.
+	SettingsServiceListPlatformSettingsProcedure = "/orchestrator.v1.SettingsService/ListPlatformSettings"
+)
+
+// SettingsServiceClient is a client for the orchestrator.v1.SettingsService service.
+type SettingsServiceClient interface {
+	// Get a platform setting
+	GetPlatformSetting(context.Context, *connect.Request[v1.GetPlatformSettingRequest]) (*connect.Response[v1.GetPlatformSettingResponse], error)
+	// Update a platform setting
+	UpdatePlatformSetting(context.Context, *connect.Request[v1.UpdatePlatformSettingRequest]) (*connect.Response[v1.UpdatePlatformSettingResponse], error)
+	// List all platform settings
+	ListPlatformSettings(context.Context, *connect.Request[v1.ListPlatformSettingsRequest]) (*connect.Response[v1.ListPlatformSettingsResponse], error)
+}
+
+// NewSettingsServiceClient constructs a client for the orchestrator.v1.SettingsService service. By
+// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
+// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewSettingsServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) SettingsServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	settingsServiceMethods := v1.File_orchestrator_v1_settings_proto.Services().ByName("SettingsService").Methods()
+	return &settingsServiceClient{
+		getPlatformSetting: connect.NewClient[v1.GetPlatformSettingRequest, v1.GetPlatformSettingResponse](
+			httpClient,
+			baseURL+SettingsServiceGetPlatformSettingProcedure,
+			connect.WithSchema(settingsServiceMethods.ByName("GetPlatformSetting")),
+			connect.WithClientOptions(opts...),
+		),
+		updatePlatformSetting: connect.NewClient[v1.UpdatePlatformSettingRequest, v1.UpdatePlatformSettingResponse](
+			httpClient,
+			baseURL+SettingsServiceUpdatePlatformSettingProcedure,
+			connect.WithSchema(settingsServiceMethods.ByName("UpdatePlatformSetting")),
+			connect.WithClientOptions(opts...),
+		),
+		listPlatformSettings: connect.NewClient[v1.ListPlatformSettingsRequest, v1.ListPlatformSettingsResponse](
+			httpClient,
+			baseURL+SettingsServiceListPlatformSettingsProcedure,
+			connect.WithSchema(settingsServiceMethods.ByName("ListPlatformSettings")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// settingsServiceClient implements SettingsServiceClient.
+type settingsServiceClient struct {
+	getPlatformSetting    *connect.Client[v1.GetPlatformSettingRequest, v1.GetPlatformSettingResponse]
+	updatePlatformSetting *connect.Client[v1.UpdatePlatformSettingRequest, v1.UpdatePlatformSettingResponse]
+	listPlatformSettings  *connect.Client[v1.ListPlatformSettingsRequest, v1.ListPlatformSettingsResponse]
+}
+
+// GetPlatformSetting calls orchestrator.v1.SettingsService.GetPlatformSetting.
+func (c *settingsServiceClient) GetPlatformSetting(ctx context.Context, req *connect.Request[v1.GetPlatformSettingRequest]) (*connect.Response[v1.GetPlatformSettingResponse], error) {
+	return c.getPlatformSetting.CallUnary(ctx, req)
+}
+
+// UpdatePlatformSetting calls orchestrator.v1.SettingsService.UpdatePlatformSetting.
+func (c *settingsServiceClient) UpdatePlatformSetting(ctx context.Context, req *connect.Request[v1.UpdatePlatformSettingRequest]) (*connect.Response[v1.UpdatePlatformSettingResponse], error) {
+	return c.updatePlatformSetting.CallUnary(ctx, req)
+}
+
+// ListPlatformSettings calls orchestrator.v1.SettingsService.ListPlatformSettings.
+func (c *settingsServiceClient) ListPlatformSettings(ctx context.Context, req *connect.Request[v1.ListPlatformSettingsRequest]) (*connect.Response[v1.ListPlatformSettingsResponse], error) {
+	return c.listPlatformSettings.CallUnary(ctx, req)
+}
+
+// SettingsServiceHandler is an implementation of the orchestrator.v1.SettingsService service.
+type SettingsServiceHandler interface {
+	// Get a platform setting
+	GetPlatformSetting(context.Context, *connect.Request[v1.GetPlatformSettingRequest]) (*connect.Response[v1.GetPlatformSettingResponse], error)
+	// Update a platform setting
+	UpdatePlatformSetting(context.Context, *connect.Request[v1.UpdatePlatformSettingRequest]) (*connect.Response[v1.UpdatePlatformSettingResponse], error)
+	// List all platform settings
+	ListPlatformSettings(context.Context, *connect.Request[v1.ListPlatformSettingsRequest]) (*connect.Response[v1.ListPlatformSettingsResponse], error)
+}
+
+// NewSettingsServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewSettingsServiceHandler(svc SettingsServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	settingsServiceMethods := v1.File_orchestrator_v1_settings_proto.Services().ByName("SettingsService").Methods()
+	settingsServiceGetPlatformSettingHandler := connect.NewUnaryHandler(
+		SettingsServiceGetPlatformSettingProcedure,
+		svc.GetPlatformSetting,
+		connect.WithSchema(settingsServiceMethods.ByName("GetPlatformSetting")),
+		connect.WithHandlerOptions(opts...),
+	)
+	settingsServiceUpdatePlatformSettingHandler := connect.NewUnaryHandler(
+		SettingsServiceUpdatePlatformSettingProcedure,
+		svc.UpdatePlatformSetting,
+		connect.WithSchema(settingsServiceMethods.ByName("UpdatePlatformSetting")),
+		connect.WithHandlerOptions(opts...),
+	)
+	settingsServiceListPlatformSettingsHandler := connect.NewUnaryHandler(
+		SettingsServiceListPlatformSettingsProcedure,
+		svc.ListPlatformSettings,
+		connect.WithSchema(settingsServiceMethods.ByName("ListPlatformSettings")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/orchestrator.v1.SettingsService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case SettingsServiceGetPlatformSettingProcedure:
+			settingsServiceGetPlatformSettingHandler.ServeHTTP(w, r)
+		case SettingsServiceUpdatePlatformSettingProcedure:
+			settingsServiceUpdatePlatformSettingHandler.ServeHTTP(w, r)
+		case SettingsServiceListPlatformSettingsProcedure:
+			settingsServiceListPlatformSettingsHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedSettingsServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedSettingsServiceHandler struct{}
+
+func (UnimplementedSettingsServiceHandler) GetPlatformSetting(context.Context, *connect.Request[v1.GetPlatformSettingRequest]) (*connect.Response[v1.GetPlatformSettingResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.SettingsService.GetPlatformSetting is not implemented"))
+}
+
+func (UnimplementedSettingsServiceHandler) UpdatePlatformSetting(context.Context, *connect.Request[v1.UpdatePlatformSettingRequest]) (*connect.Response[v1.UpdatePlatformSettingResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.SettingsService.UpdatePlatformSetting is not implemented"))
+}
+
+func (UnimplementedSettingsServiceHandler) ListPlatformSettings(context.Context, *connect.Request[v1.ListPlatformSettingsRequest]) (*connect.Response[v1.ListPlatformSettingsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.SettingsService.ListPlatformSettings is not implemented"))
+}

internal/api/orchestrator/v1/orchestratorv1connect/sso.connect.go

@@ -0,0 +1,142 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: orchestrator/v1/sso.proto
+
+package orchestratorv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1 "git.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// SSOServiceName is the fully-qualified name of the SSOService service.
+	SSOServiceName = "orchestrator.v1.SSOService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// SSOServiceGenerateSSOTokenProcedure is the fully-qualified name of the SSOService's
+	// GenerateSSOToken RPC.
+	SSOServiceGenerateSSOTokenProcedure = "/orchestrator.v1.SSOService/GenerateSSOToken"
+	// SSOServiceExchangeSSOTokenProcedure is the fully-qualified name of the SSOService's
+	// ExchangeSSOToken RPC.
+	SSOServiceExchangeSSOTokenProcedure = "/orchestrator.v1.SSOService/ExchangeSSOToken"
+)
+
+// SSOServiceClient is a client for the orchestrator.v1.SSOService service.
+type SSOServiceClient interface {
+	// Generate an SSO token for redirecting to an instance
+	GenerateSSOToken(context.Context, *connect.Request[v1.GenerateSSOTokenRequest]) (*connect.Response[v1.GenerateSSOTokenResponse], error)
+	// Exchange an SSO token for user claims (called by instance)
+	ExchangeSSOToken(context.Context, *connect.Request[v1.ExchangeSSOTokenRequest]) (*connect.Response[v1.ExchangeSSOTokenResponse], error)
+}
+
+// NewSSOServiceClient constructs a client for the orchestrator.v1.SSOService service. By default,
+// it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and
+// sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC()
+// or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewSSOServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) SSOServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	sSOServiceMethods := v1.File_orchestrator_v1_sso_proto.Services().ByName("SSOService").Methods()
+	return &sSOServiceClient{
+		generateSSOToken: connect.NewClient[v1.GenerateSSOTokenRequest, v1.GenerateSSOTokenResponse](
+			httpClient,
+			baseURL+SSOServiceGenerateSSOTokenProcedure,
+			connect.WithSchema(sSOServiceMethods.ByName("GenerateSSOToken")),
+			connect.WithClientOptions(opts...),
+		),
+		exchangeSSOToken: connect.NewClient[v1.ExchangeSSOTokenRequest, v1.ExchangeSSOTokenResponse](
+			httpClient,
+			baseURL+SSOServiceExchangeSSOTokenProcedure,
+			connect.WithSchema(sSOServiceMethods.ByName("ExchangeSSOToken")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// sSOServiceClient implements SSOServiceClient.
+type sSOServiceClient struct {
+	generateSSOToken *connect.Client[v1.GenerateSSOTokenRequest, v1.GenerateSSOTokenResponse]
+	exchangeSSOToken *connect.Client[v1.ExchangeSSOTokenRequest, v1.ExchangeSSOTokenResponse]
+}
+
+// GenerateSSOToken calls orchestrator.v1.SSOService.GenerateSSOToken.
+func (c *sSOServiceClient) GenerateSSOToken(ctx context.Context, req *connect.Request[v1.GenerateSSOTokenRequest]) (*connect.Response[v1.GenerateSSOTokenResponse], error) {
+	return c.generateSSOToken.CallUnary(ctx, req)
+}
+
+// ExchangeSSOToken calls orchestrator.v1.SSOService.ExchangeSSOToken.
+func (c *sSOServiceClient) ExchangeSSOToken(ctx context.Context, req *connect.Request[v1.ExchangeSSOTokenRequest]) (*connect.Response[v1.ExchangeSSOTokenResponse], error) {
+	return c.exchangeSSOToken.CallUnary(ctx, req)
+}
+
+// SSOServiceHandler is an implementation of the orchestrator.v1.SSOService service.
+type SSOServiceHandler interface {
+	// Generate an SSO token for redirecting to an instance
+	GenerateSSOToken(context.Context, *connect.Request[v1.GenerateSSOTokenRequest]) (*connect.Response[v1.GenerateSSOTokenResponse], error)
+	// Exchange an SSO token for user claims (called by instance)
+	ExchangeSSOToken(context.Context, *connect.Request[v1.ExchangeSSOTokenRequest]) (*connect.Response[v1.ExchangeSSOTokenResponse], error)
+}
+
+// NewSSOServiceHandler builds an HTTP handler from the service implementation. It returns the path
+// on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewSSOServiceHandler(svc SSOServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	sSOServiceMethods := v1.File_orchestrator_v1_sso_proto.Services().ByName("SSOService").Methods()
+	sSOServiceGenerateSSOTokenHandler := connect.NewUnaryHandler(
+		SSOServiceGenerateSSOTokenProcedure,
+		svc.GenerateSSOToken,
+		connect.WithSchema(sSOServiceMethods.ByName("GenerateSSOToken")),
+		connect.WithHandlerOptions(opts...),
+	)
+	sSOServiceExchangeSSOTokenHandler := connect.NewUnaryHandler(
+		SSOServiceExchangeSSOTokenProcedure,
+		svc.ExchangeSSOToken,
+		connect.WithSchema(sSOServiceMethods.ByName("ExchangeSSOToken")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/orchestrator.v1.SSOService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case SSOServiceGenerateSSOTokenProcedure:
+			sSOServiceGenerateSSOTokenHandler.ServeHTTP(w, r)
+		case SSOServiceExchangeSSOTokenProcedure:
+			sSOServiceExchangeSSOTokenHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedSSOServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedSSOServiceHandler struct{}
+
+func (UnimplementedSSOServiceHandler) GenerateSSOToken(context.Context, *connect.Request[v1.GenerateSSOTokenRequest]) (*connect.Response[v1.GenerateSSOTokenResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.SSOService.GenerateSSOToken is not implemented"))
+}
+
+func (UnimplementedSSOServiceHandler) ExchangeSSOToken(context.Context, *connect.Request[v1.ExchangeSSOTokenRequest]) (*connect.Response[v1.ExchangeSSOTokenResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.SSOService.ExchangeSSOToken is not implemented"))
+}

internal/api/orchestrator/v1/plugin_builds.pb.go

@@ -0,0 +1,235 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: orchestrator/v1/plugin_builds.proto
+
+package orchestratorv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type BuildPluginImageRequest struct {
+	state      protoimpl.MessageState `protogen:"open.v1"`
+	InstanceId string                 `protobuf:"bytes,1,opt,name=instance_id,json=instanceId,proto3" json:"instance_id,omitempty"`
+	Plugins    []*PluginBuildSpec     `protobuf:"bytes,2,rep,name=plugins,proto3" json:"plugins,omitempty"`
+	// Base CMS version (e.g., "v1.2.3") — determines which builder/runtime images to use
+	BaseVersion   string `protobuf:"bytes,3,opt,name=base_version,json=baseVersion,proto3" json:"base_version,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *BuildPluginImageRequest) Reset() {
+	*x = BuildPluginImageRequest{}
+	mi := &file_orchestrator_v1_plugin_builds_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *BuildPluginImageRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BuildPluginImageRequest) ProtoMessage() {}
+
+func (x *BuildPluginImageRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_plugin_builds_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BuildPluginImageRequest.ProtoReflect.Descriptor instead.
+func (*BuildPluginImageRequest) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_plugin_builds_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *BuildPluginImageRequest) GetInstanceId() string {
+	if x != nil {
+		return x.InstanceId
+	}
+	return ""
+}
+
+func (x *BuildPluginImageRequest) GetPlugins() []*PluginBuildSpec {
+	if x != nil {
+		return x.Plugins
+	}
+	return nil
+}
+
+func (x *BuildPluginImageRequest) GetBaseVersion() string {
+	if x != nil {
+		return x.BaseVersion
+	}
+	return ""
+}
+
+type PluginBuildSpec struct {
+	state  protoimpl.MessageState `protogen:"open.v1"`
+	Name   string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	GitUrl string                 `protobuf:"bytes,2,opt,name=git_url,json=gitUrl,proto3" json:"git_url,omitempty"`
+	Branch string                 `protobuf:"bytes,3,opt,name=branch,proto3" json:"branch,omitempty"`
+	// Decrypted SSH private key for cloning (PEM format).
+	// Sent server-to-server over TLS, never exposed to browser.
+	SshPrivateKey string `protobuf:"bytes,4,opt,name=ssh_private_key,json=sshPrivateKey,proto3" json:"ssh_private_key,omitempty"`
+	SshPort       int32  `protobuf:"varint,5,opt,name=ssh_port,json=sshPort,proto3" json:"ssh_port,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PluginBuildSpec) Reset() {
+	*x = PluginBuildSpec{}
+	mi := &file_orchestrator_v1_plugin_builds_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PluginBuildSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PluginBuildSpec) ProtoMessage() {}
+
+func (x *PluginBuildSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_plugin_builds_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PluginBuildSpec.ProtoReflect.Descriptor instead.
+func (*PluginBuildSpec) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_plugin_builds_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *PluginBuildSpec) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *PluginBuildSpec) GetGitUrl() string {
+	if x != nil {
+		return x.GitUrl
+	}
+	return ""
+}
+
+func (x *PluginBuildSpec) GetBranch() string {
+	if x != nil {
+		return x.Branch
+	}
+	return ""
+}
+
+func (x *PluginBuildSpec) GetSshPrivateKey() string {
+	if x != nil {
+		return x.SshPrivateKey
+	}
+	return ""
+}
+
+func (x *PluginBuildSpec) GetSshPort() int32 {
+	if x != nil {
+		return x.SshPort
+	}
+	return 0
+}
+
+var File_orchestrator_v1_plugin_builds_proto protoreflect.FileDescriptor
+
+const file_orchestrator_v1_plugin_builds_proto_rawDesc = "" +
+	"\n" +
+	"#orchestrator/v1/plugin_builds.proto\x12\x0forchestrator.v1\x1a\x1forchestrator/v1/instances.proto\"\x99\x01\n" +
+	"\x17BuildPluginImageRequest\x12\x1f\n" +
+	"\vinstance_id\x18\x01 \x01(\tR\n" +
+	"instanceId\x12:\n" +
+	"\aplugins\x18\x02 \x03(\v2 .orchestrator.v1.PluginBuildSpecR\aplugins\x12!\n" +
+	"\fbase_version\x18\x03 \x01(\tR\vbaseVersion\"\x99\x01\n" +
+	"\x0fPluginBuildSpec\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x17\n" +
+	"\agit_url\x18\x02 \x01(\tR\x06gitUrl\x12\x16\n" +
+	"\x06branch\x18\x03 \x01(\tR\x06branch\x12&\n" +
+	"\x0fssh_private_key\x18\x04 \x01(\tR\rsshPrivateKey\x12\x19\n" +
+	"\bssh_port\x18\x05 \x01(\x05R\asshPort2x\n" +
+	"\x12PluginBuildService\x12b\n" +
+	"\x10BuildPluginImage\x12(.orchestrator.v1.BuildPluginImageRequest\x1a\".orchestrator.v1.OperationProgress0\x01B\xd4\x01\n" +
+	"\x13com.orchestrator.v1B\x11PluginBuildsProtoP\x01ZMgit.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1;orchestratorv1\xa2\x02\x03OXX\xaa\x02\x0fOrchestrator.V1\xca\x02\x0fOrchestrator\\V1\xe2\x02\x1bOrchestrator\\V1\\GPBMetadata\xea\x02\x10Orchestrator::V1b\x06proto3"
+
+var (
+	file_orchestrator_v1_plugin_builds_proto_rawDescOnce sync.Once
+	file_orchestrator_v1_plugin_builds_proto_rawDescData []byte
+)
+
+func file_orchestrator_v1_plugin_builds_proto_rawDescGZIP() []byte {
+	file_orchestrator_v1_plugin_builds_proto_rawDescOnce.Do(func() {
+		file_orchestrator_v1_plugin_builds_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_orchestrator_v1_plugin_builds_proto_rawDesc), len(file_orchestrator_v1_plugin_builds_proto_rawDesc)))
+	})
+	return file_orchestrator_v1_plugin_builds_proto_rawDescData
+}
+
+var file_orchestrator_v1_plugin_builds_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_orchestrator_v1_plugin_builds_proto_goTypes = []any{
+	(*BuildPluginImageRequest)(nil), // 0: orchestrator.v1.BuildPluginImageRequest
+	(*PluginBuildSpec)(nil),         // 1: orchestrator.v1.PluginBuildSpec
+	(*OperationProgress)(nil),       // 2: orchestrator.v1.OperationProgress
+}
+var file_orchestrator_v1_plugin_builds_proto_depIdxs = []int32{
+	1, // 0: orchestrator.v1.BuildPluginImageRequest.plugins:type_name -> orchestrator.v1.PluginBuildSpec
+	0, // 1: orchestrator.v1.PluginBuildService.BuildPluginImage:input_type -> orchestrator.v1.BuildPluginImageRequest
+	2, // 2: orchestrator.v1.PluginBuildService.BuildPluginImage:output_type -> orchestrator.v1.OperationProgress
+	2, // [2:3] is the sub-list for method output_type
+	1, // [1:2] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_orchestrator_v1_plugin_builds_proto_init() }
+func file_orchestrator_v1_plugin_builds_proto_init() {
+	if File_orchestrator_v1_plugin_builds_proto != nil {
+		return
+	}
+	file_orchestrator_v1_instances_proto_init()
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_orchestrator_v1_plugin_builds_proto_rawDesc), len(file_orchestrator_v1_plugin_builds_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_orchestrator_v1_plugin_builds_proto_goTypes,
+		DependencyIndexes: file_orchestrator_v1_plugin_builds_proto_depIdxs,
+		MessageInfos:      file_orchestrator_v1_plugin_builds_proto_msgTypes,
+	}.Build()
+	File_orchestrator_v1_plugin_builds_proto = out.File
+	file_orchestrator_v1_plugin_builds_proto_goTypes = nil
+	file_orchestrator_v1_plugin_builds_proto_depIdxs = nil
+}

internal/api/orchestrator/v1/push.pb.go

@@ -0,0 +1,876 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: orchestrator/v1/push.proto
+
+package orchestratorv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Authorization status
+type PollDeviceAuthResponse_Status int32
+
+const (
+	PollDeviceAuthResponse_STATUS_UNSPECIFIED PollDeviceAuthResponse_Status = 0
+	// Still waiting for user to authorize
+	PollDeviceAuthResponse_STATUS_PENDING PollDeviceAuthResponse_Status = 1
+	// User authorized, tokens are available
+	PollDeviceAuthResponse_STATUS_AUTHORIZED PollDeviceAuthResponse_Status = 2
+	// Device code expired
+	PollDeviceAuthResponse_STATUS_EXPIRED PollDeviceAuthResponse_Status = 3
+	// User denied authorization
+	PollDeviceAuthResponse_STATUS_DENIED PollDeviceAuthResponse_Status = 4
+)
+
+// Enum value maps for PollDeviceAuthResponse_Status.
+var (
+	PollDeviceAuthResponse_Status_name = map[int32]string{
+		0: "STATUS_UNSPECIFIED",
+		1: "STATUS_PENDING",
+		2: "STATUS_AUTHORIZED",
+		3: "STATUS_EXPIRED",
+		4: "STATUS_DENIED",
+	}
+	PollDeviceAuthResponse_Status_value = map[string]int32{
+		"STATUS_UNSPECIFIED": 0,
+		"STATUS_PENDING":     1,
+		"STATUS_AUTHORIZED":  2,
+		"STATUS_EXPIRED":     3,
+		"STATUS_DENIED":      4,
+	}
+)
+
+func (x PollDeviceAuthResponse_Status) Enum() *PollDeviceAuthResponse_Status {
+	p := new(PollDeviceAuthResponse_Status)
+	*p = x
+	return p
+}
+
+func (x PollDeviceAuthResponse_Status) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (PollDeviceAuthResponse_Status) Descriptor() protoreflect.EnumDescriptor {
+	return file_orchestrator_v1_push_proto_enumTypes[0].Descriptor()
+}
+
+func (PollDeviceAuthResponse_Status) Type() protoreflect.EnumType {
+	return &file_orchestrator_v1_push_proto_enumTypes[0]
+}
+
+func (x PollDeviceAuthResponse_Status) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use PollDeviceAuthResponse_Status.Descriptor instead.
+func (PollDeviceAuthResponse_Status) EnumDescriptor() ([]byte, []int) {
+	return file_orchestrator_v1_push_proto_rawDescGZIP(), []int{3, 0}
+}
+
+// Provisioning status
+type GetProvisioningStatusResponse_Status int32
+
+const (
+	GetProvisioningStatusResponse_STATUS_UNSPECIFIED GetProvisioningStatusResponse_Status = 0
+	// Validating backup file
+	GetProvisioningStatusResponse_STATUS_VALIDATING GetProvisioningStatusResponse_Status = 1
+	// Creating container and database
+	GetProvisioningStatusResponse_STATUS_PROVISIONING GetProvisioningStatusResponse_Status = 2
+	// Restoring backup data
+	GetProvisioningStatusResponse_STATUS_RESTORING GetProvisioningStatusResponse_Status = 3
+	// Configuring routing (Traefik)
+	GetProvisioningStatusResponse_STATUS_CONFIGURING GetProvisioningStatusResponse_Status = 4
+	// Successfully completed
+	GetProvisioningStatusResponse_STATUS_COMPLETED GetProvisioningStatusResponse_Status = 5
+	// Failed with error
+	GetProvisioningStatusResponse_STATUS_FAILED GetProvisioningStatusResponse_Status = 6
+)
+
+// Enum value maps for GetProvisioningStatusResponse_Status.
+var (
+	GetProvisioningStatusResponse_Status_name = map[int32]string{
+		0: "STATUS_UNSPECIFIED",
+		1: "STATUS_VALIDATING",
+		2: "STATUS_PROVISIONING",
+		3: "STATUS_RESTORING",
+		4: "STATUS_CONFIGURING",
+		5: "STATUS_COMPLETED",
+		6: "STATUS_FAILED",
+	}
+	GetProvisioningStatusResponse_Status_value = map[string]int32{
+		"STATUS_UNSPECIFIED":  0,
+		"STATUS_VALIDATING":   1,
+		"STATUS_PROVISIONING": 2,
+		"STATUS_RESTORING":    3,
+		"STATUS_CONFIGURING":  4,
+		"STATUS_COMPLETED":    5,
+		"STATUS_FAILED":       6,
+	}
+)
+
+func (x GetProvisioningStatusResponse_Status) Enum() *GetProvisioningStatusResponse_Status {
+	p := new(GetProvisioningStatusResponse_Status)
+	*p = x
+	return p
+}
+
+func (x GetProvisioningStatusResponse_Status) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (GetProvisioningStatusResponse_Status) Descriptor() protoreflect.EnumDescriptor {
+	return file_orchestrator_v1_push_proto_enumTypes[1].Descriptor()
+}
+
+func (GetProvisioningStatusResponse_Status) Type() protoreflect.EnumType {
+	return &file_orchestrator_v1_push_proto_enumTypes[1]
+}
+
+func (x GetProvisioningStatusResponse_Status) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use GetProvisioningStatusResponse_Status.Descriptor instead.
+func (GetProvisioningStatusResponse_Status) EnumDescriptor() ([]byte, []int) {
+	return file_orchestrator_v1_push_proto_rawDescGZIP(), []int{7, 0}
+}
+
+// StartDeviceAuthRequest initiates device authorization.
+type StartDeviceAuthRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Client identifier (e.g., "blockninja-cli")
+	ClientId      string `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StartDeviceAuthRequest) Reset() {
+	*x = StartDeviceAuthRequest{}
+	mi := &file_orchestrator_v1_push_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StartDeviceAuthRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StartDeviceAuthRequest) ProtoMessage() {}
+
+func (x *StartDeviceAuthRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_push_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StartDeviceAuthRequest.ProtoReflect.Descriptor instead.
+func (*StartDeviceAuthRequest) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_push_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *StartDeviceAuthRequest) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+// StartDeviceAuthResponse contains codes for device authorization.
+type StartDeviceAuthResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Unique device code for polling (kept secret, used by CLI)
+	DeviceCode string `protobuf:"bytes,1,opt,name=device_code,json=deviceCode,proto3" json:"device_code,omitempty"`
+	// Short user code displayed in browser (e.g., "ABCD-1234")
+	UserCode string `protobuf:"bytes,2,opt,name=user_code,json=userCode,proto3" json:"user_code,omitempty"`
+	// URL where user should authorize (e.g., "https://my.blockninjacms.com/oauth/device")
+	VerificationUrl string `protobuf:"bytes,3,opt,name=verification_url,json=verificationUrl,proto3" json:"verification_url,omitempty"`
+	// Seconds until device_code expires (typically 900 = 15 minutes)
+	ExpiresIn int32 `protobuf:"varint,4,opt,name=expires_in,json=expiresIn,proto3" json:"expires_in,omitempty"`
+	// Recommended polling interval in seconds (typically 5)
+	Interval      int32 `protobuf:"varint,5,opt,name=interval,proto3" json:"interval,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StartDeviceAuthResponse) Reset() {
+	*x = StartDeviceAuthResponse{}
+	mi := &file_orchestrator_v1_push_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StartDeviceAuthResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StartDeviceAuthResponse) ProtoMessage() {}
+
+func (x *StartDeviceAuthResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_push_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StartDeviceAuthResponse.ProtoReflect.Descriptor instead.
+func (*StartDeviceAuthResponse) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_push_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *StartDeviceAuthResponse) GetDeviceCode() string {
+	if x != nil {
+		return x.DeviceCode
+	}
+	return ""
+}
+
+func (x *StartDeviceAuthResponse) GetUserCode() string {
+	if x != nil {
+		return x.UserCode
+	}
+	return ""
+}
+
+func (x *StartDeviceAuthResponse) GetVerificationUrl() string {
+	if x != nil {
+		return x.VerificationUrl
+	}
+	return ""
+}
+
+func (x *StartDeviceAuthResponse) GetExpiresIn() int32 {
+	if x != nil {
+		return x.ExpiresIn
+	}
+	return 0
+}
+
+func (x *StartDeviceAuthResponse) GetInterval() int32 {
+	if x != nil {
+		return x.Interval
+	}
+	return 0
+}
+
+// PollDeviceAuthRequest checks authorization status.
+type PollDeviceAuthRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Device code from StartDeviceAuthResponse
+	DeviceCode string `protobuf:"bytes,1,opt,name=device_code,json=deviceCode,proto3" json:"device_code,omitempty"`
+	// Client identifier (must match StartDeviceAuthRequest)
+	ClientId      string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PollDeviceAuthRequest) Reset() {
+	*x = PollDeviceAuthRequest{}
+	mi := &file_orchestrator_v1_push_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PollDeviceAuthRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PollDeviceAuthRequest) ProtoMessage() {}
+
+func (x *PollDeviceAuthRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_push_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PollDeviceAuthRequest.ProtoReflect.Descriptor instead.
+func (*PollDeviceAuthRequest) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_push_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *PollDeviceAuthRequest) GetDeviceCode() string {
+	if x != nil {
+		return x.DeviceCode
+	}
+	return ""
+}
+
+func (x *PollDeviceAuthRequest) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+// PollDeviceAuthResponse returns authorization status and tokens.
+type PollDeviceAuthResponse struct {
+	state  protoimpl.MessageState        `protogen:"open.v1"`
+	Status PollDeviceAuthResponse_Status `protobuf:"varint,1,opt,name=status,proto3,enum=orchestrator.v1.PollDeviceAuthResponse_Status" json:"status,omitempty"`
+	// JWT access token (only set when status = AUTHORIZED)
+	AccessToken *string `protobuf:"bytes,2,opt,name=access_token,json=accessToken,proto3,oneof" json:"access_token,omitempty"`
+	// JWT refresh token (only set when status = AUTHORIZED)
+	RefreshToken *string `protobuf:"bytes,3,opt,name=refresh_token,json=refreshToken,proto3,oneof" json:"refresh_token,omitempty"`
+	// Token expiration time (only set when status = AUTHORIZED)
+	ExpiresAt *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=expires_at,json=expiresAt,proto3,oneof" json:"expires_at,omitempty"`
+	// Error message if status is EXPIRED or DENIED
+	Error *string `protobuf:"bytes,5,opt,name=error,proto3,oneof" json:"error,omitempty"`
+	// User email (only set when status = AUTHORIZED)
+	UserEmail     *string `protobuf:"bytes,6,opt,name=user_email,json=userEmail,proto3,oneof" json:"user_email,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PollDeviceAuthResponse) Reset() {
+	*x = PollDeviceAuthResponse{}
+	mi := &file_orchestrator_v1_push_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PollDeviceAuthResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PollDeviceAuthResponse) ProtoMessage() {}
+
+func (x *PollDeviceAuthResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_push_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PollDeviceAuthResponse.ProtoReflect.Descriptor instead.
+func (*PollDeviceAuthResponse) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_push_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *PollDeviceAuthResponse) GetStatus() PollDeviceAuthResponse_Status {
+	if x != nil {
+		return x.Status
+	}
+	return PollDeviceAuthResponse_STATUS_UNSPECIFIED
+}
+
+func (x *PollDeviceAuthResponse) GetAccessToken() string {
+	if x != nil && x.AccessToken != nil {
+		return *x.AccessToken
+	}
+	return ""
+}
+
+func (x *PollDeviceAuthResponse) GetRefreshToken() string {
+	if x != nil && x.RefreshToken != nil {
+		return *x.RefreshToken
+	}
+	return ""
+}
+
+func (x *PollDeviceAuthResponse) GetExpiresAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.ExpiresAt
+	}
+	return nil
+}
+
+func (x *PollDeviceAuthResponse) GetError() string {
+	if x != nil && x.Error != nil {
+		return *x.Error
+	}
+	return ""
+}
+
+func (x *PollDeviceAuthResponse) GetUserEmail() string {
+	if x != nil && x.UserEmail != nil {
+		return *x.UserEmail
+	}
+	return ""
+}
+
+// ProvisionFromBackupRequest creates an instance from an uploaded backup.
+type ProvisionFromBackupRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Target account ID (must have access)
+	AccountId string `protobuf:"bytes,1,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
+	// Upload key from HTTP upload response
+	UploadKey string `protobuf:"bytes,2,opt,name=upload_key,json=uploadKey,proto3" json:"upload_key,omitempty"`
+	// Password to decrypt the backup
+	BackupPassword string `protobuf:"bytes,3,opt,name=backup_password,json=backupPassword,proto3" json:"backup_password,omitempty"`
+	// Instance display name
+	InstanceName string `protobuf:"bytes,4,opt,name=instance_name,json=instanceName,proto3" json:"instance_name,omitempty"`
+	// Instance slug (URL-safe identifier)
+	InstanceSlug string `protobuf:"bytes,5,opt,name=instance_slug,json=instanceSlug,proto3" json:"instance_slug,omitempty"`
+	// Optional plan ID (defaults to free plan)
+	PlanId        *string `protobuf:"bytes,6,opt,name=plan_id,json=planId,proto3,oneof" json:"plan_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ProvisionFromBackupRequest) Reset() {
+	*x = ProvisionFromBackupRequest{}
+	mi := &file_orchestrator_v1_push_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ProvisionFromBackupRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ProvisionFromBackupRequest) ProtoMessage() {}
+
+func (x *ProvisionFromBackupRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_push_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ProvisionFromBackupRequest.ProtoReflect.Descriptor instead.
+func (*ProvisionFromBackupRequest) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_push_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ProvisionFromBackupRequest) GetAccountId() string {
+	if x != nil {
+		return x.AccountId
+	}
+	return ""
+}
+
+func (x *ProvisionFromBackupRequest) GetUploadKey() string {
+	if x != nil {
+		return x.UploadKey
+	}
+	return ""
+}
+
+func (x *ProvisionFromBackupRequest) GetBackupPassword() string {
+	if x != nil {
+		return x.BackupPassword
+	}
+	return ""
+}
+
+func (x *ProvisionFromBackupRequest) GetInstanceName() string {
+	if x != nil {
+		return x.InstanceName
+	}
+	return ""
+}
+
+func (x *ProvisionFromBackupRequest) GetInstanceSlug() string {
+	if x != nil {
+		return x.InstanceSlug
+	}
+	return ""
+}
+
+func (x *ProvisionFromBackupRequest) GetPlanId() string {
+	if x != nil && x.PlanId != nil {
+		return *x.PlanId
+	}
+	return ""
+}
+
+// ProvisionFromBackupResponse returns tracking information.
+type ProvisionFromBackupResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// New instance ID
+	InstanceId string `protobuf:"bytes,1,opt,name=instance_id,json=instanceId,proto3" json:"instance_id,omitempty"`
+	// Tracking ID for status polling
+	TrackingId    string `protobuf:"bytes,2,opt,name=tracking_id,json=trackingId,proto3" json:"tracking_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ProvisionFromBackupResponse) Reset() {
+	*x = ProvisionFromBackupResponse{}
+	mi := &file_orchestrator_v1_push_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ProvisionFromBackupResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ProvisionFromBackupResponse) ProtoMessage() {}
+
+func (x *ProvisionFromBackupResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_push_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ProvisionFromBackupResponse.ProtoReflect.Descriptor instead.
+func (*ProvisionFromBackupResponse) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_push_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *ProvisionFromBackupResponse) GetInstanceId() string {
+	if x != nil {
+		return x.InstanceId
+	}
+	return ""
+}
+
+func (x *ProvisionFromBackupResponse) GetTrackingId() string {
+	if x != nil {
+		return x.TrackingId
+	}
+	return ""
+}
+
+// GetProvisioningStatusRequest queries provisioning progress.
+type GetProvisioningStatusRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Tracking ID from ProvisionFromBackupResponse
+	TrackingId    string `protobuf:"bytes,1,opt,name=tracking_id,json=trackingId,proto3" json:"tracking_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetProvisioningStatusRequest) Reset() {
+	*x = GetProvisioningStatusRequest{}
+	mi := &file_orchestrator_v1_push_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetProvisioningStatusRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetProvisioningStatusRequest) ProtoMessage() {}
+
+func (x *GetProvisioningStatusRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_push_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetProvisioningStatusRequest.ProtoReflect.Descriptor instead.
+func (*GetProvisioningStatusRequest) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_push_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *GetProvisioningStatusRequest) GetTrackingId() string {
+	if x != nil {
+		return x.TrackingId
+	}
+	return ""
+}
+
+// GetProvisioningStatusResponse returns current provisioning status.
+type GetProvisioningStatusResponse struct {
+	state  protoimpl.MessageState               `protogen:"open.v1"`
+	Status GetProvisioningStatusResponse_Status `protobuf:"varint,1,opt,name=status,proto3,enum=orchestrator.v1.GetProvisioningStatusResponse_Status" json:"status,omitempty"`
+	// Progress percentage (0-100)
+	ProgressPercent int32 `protobuf:"varint,2,opt,name=progress_percent,json=progressPercent,proto3" json:"progress_percent,omitempty"`
+	// Current step description (e.g., "Creating database...")
+	CurrentStep string `protobuf:"bytes,3,opt,name=current_step,json=currentStep,proto3" json:"current_step,omitempty"`
+	// Error message if status = FAILED
+	Error *string `protobuf:"bytes,4,opt,name=error,proto3,oneof" json:"error,omitempty"`
+	// Instance ID (set when status = COMPLETED)
+	InstanceId *string `protobuf:"bytes,5,opt,name=instance_id,json=instanceId,proto3,oneof" json:"instance_id,omitempty"`
+	// Site URL (set when status = COMPLETED)
+	SiteUrl *string `protobuf:"bytes,6,opt,name=site_url,json=siteUrl,proto3,oneof" json:"site_url,omitempty"`
+	// Admin URL (set when status = COMPLETED)
+	AdminUrl      *string `protobuf:"bytes,7,opt,name=admin_url,json=adminUrl,proto3,oneof" json:"admin_url,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetProvisioningStatusResponse) Reset() {
+	*x = GetProvisioningStatusResponse{}
+	mi := &file_orchestrator_v1_push_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetProvisioningStatusResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetProvisioningStatusResponse) ProtoMessage() {}
+
+func (x *GetProvisioningStatusResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_push_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetProvisioningStatusResponse.ProtoReflect.Descriptor instead.
+func (*GetProvisioningStatusResponse) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_push_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *GetProvisioningStatusResponse) GetStatus() GetProvisioningStatusResponse_Status {
+	if x != nil {
+		return x.Status
+	}
+	return GetProvisioningStatusResponse_STATUS_UNSPECIFIED
+}
+
+func (x *GetProvisioningStatusResponse) GetProgressPercent() int32 {
+	if x != nil {
+		return x.ProgressPercent
+	}
+	return 0
+}
+
+func (x *GetProvisioningStatusResponse) GetCurrentStep() string {
+	if x != nil {
+		return x.CurrentStep
+	}
+	return ""
+}
+
+func (x *GetProvisioningStatusResponse) GetError() string {
+	if x != nil && x.Error != nil {
+		return *x.Error
+	}
+	return ""
+}
+
+func (x *GetProvisioningStatusResponse) GetInstanceId() string {
+	if x != nil && x.InstanceId != nil {
+		return *x.InstanceId
+	}
+	return ""
+}
+
+func (x *GetProvisioningStatusResponse) GetSiteUrl() string {
+	if x != nil && x.SiteUrl != nil {
+		return *x.SiteUrl
+	}
+	return ""
+}
+
+func (x *GetProvisioningStatusResponse) GetAdminUrl() string {
+	if x != nil && x.AdminUrl != nil {
+		return *x.AdminUrl
+	}
+	return ""
+}
+
+var File_orchestrator_v1_push_proto protoreflect.FileDescriptor
+
+const file_orchestrator_v1_push_proto_rawDesc = "" +
+	"\n" +
+	"\x1aorchestrator/v1/push.proto\x12\x0forchestrator.v1\x1a\x1fgoogle/protobuf/timestamp.proto\"5\n" +
+	"\x16StartDeviceAuthRequest\x12\x1b\n" +
+	"\tclient_id\x18\x01 \x01(\tR\bclientId\"\xbd\x01\n" +
+	"\x17StartDeviceAuthResponse\x12\x1f\n" +
+	"\vdevice_code\x18\x01 \x01(\tR\n" +
+	"deviceCode\x12\x1b\n" +
+	"\tuser_code\x18\x02 \x01(\tR\buserCode\x12)\n" +
+	"\x10verification_url\x18\x03 \x01(\tR\x0fverificationUrl\x12\x1d\n" +
+	"\n" +
+	"expires_in\x18\x04 \x01(\x05R\texpiresIn\x12\x1a\n" +
+	"\binterval\x18\x05 \x01(\x05R\binterval\"U\n" +
+	"\x15PollDeviceAuthRequest\x12\x1f\n" +
+	"\vdevice_code\x18\x01 \x01(\tR\n" +
+	"deviceCode\x12\x1b\n" +
+	"\tclient_id\x18\x02 \x01(\tR\bclientId\"\xf0\x03\n" +
+	"\x16PollDeviceAuthResponse\x12F\n" +
+	"\x06status\x18\x01 \x01(\x0e2..orchestrator.v1.PollDeviceAuthResponse.StatusR\x06status\x12&\n" +
+	"\faccess_token\x18\x02 \x01(\tH\x00R\vaccessToken\x88\x01\x01\x12(\n" +
+	"\rrefresh_token\x18\x03 \x01(\tH\x01R\frefreshToken\x88\x01\x01\x12>\n" +
+	"\n" +
+	"expires_at\x18\x04 \x01(\v2\x1a.google.protobuf.TimestampH\x02R\texpiresAt\x88\x01\x01\x12\x19\n" +
+	"\x05error\x18\x05 \x01(\tH\x03R\x05error\x88\x01\x01\x12\"\n" +
+	"\n" +
+	"user_email\x18\x06 \x01(\tH\x04R\tuserEmail\x88\x01\x01\"r\n" +
+	"\x06Status\x12\x16\n" +
+	"\x12STATUS_UNSPECIFIED\x10\x00\x12\x12\n" +
+	"\x0eSTATUS_PENDING\x10\x01\x12\x15\n" +
+	"\x11STATUS_AUTHORIZED\x10\x02\x12\x12\n" +
+	"\x0eSTATUS_EXPIRED\x10\x03\x12\x11\n" +
+	"\rSTATUS_DENIED\x10\x04B\x0f\n" +
+	"\r_access_tokenB\x10\n" +
+	"\x0e_refresh_tokenB\r\n" +
+	"\v_expires_atB\b\n" +
+	"\x06_errorB\r\n" +
+	"\v_user_email\"\xf7\x01\n" +
+	"\x1aProvisionFromBackupRequest\x12\x1d\n" +
+	"\n" +
+	"account_id\x18\x01 \x01(\tR\taccountId\x12\x1d\n" +
+	"\n" +
+	"upload_key\x18\x02 \x01(\tR\tuploadKey\x12'\n" +
+	"\x0fbackup_password\x18\x03 \x01(\tR\x0ebackupPassword\x12#\n" +
+	"\rinstance_name\x18\x04 \x01(\tR\finstanceName\x12#\n" +
+	"\rinstance_slug\x18\x05 \x01(\tR\finstanceSlug\x12\x1c\n" +
+	"\aplan_id\x18\x06 \x01(\tH\x00R\x06planId\x88\x01\x01B\n" +
+	"\n" +
+	"\b_plan_id\"_\n" +
+	"\x1bProvisionFromBackupResponse\x12\x1f\n" +
+	"\vinstance_id\x18\x01 \x01(\tR\n" +
+	"instanceId\x12\x1f\n" +
+	"\vtracking_id\x18\x02 \x01(\tR\n" +
+	"trackingId\"?\n" +
+	"\x1cGetProvisioningStatusRequest\x12\x1f\n" +
+	"\vtracking_id\x18\x01 \x01(\tR\n" +
+	"trackingId\"\x9e\x04\n" +
+	"\x1dGetProvisioningStatusResponse\x12M\n" +
+	"\x06status\x18\x01 \x01(\x0e25.orchestrator.v1.GetProvisioningStatusResponse.StatusR\x06status\x12)\n" +
+	"\x10progress_percent\x18\x02 \x01(\x05R\x0fprogressPercent\x12!\n" +
+	"\fcurrent_step\x18\x03 \x01(\tR\vcurrentStep\x12\x19\n" +
+	"\x05error\x18\x04 \x01(\tH\x00R\x05error\x88\x01\x01\x12$\n" +
+	"\vinstance_id\x18\x05 \x01(\tH\x01R\n" +
+	"instanceId\x88\x01\x01\x12\x1e\n" +
+	"\bsite_url\x18\x06 \x01(\tH\x02R\asiteUrl\x88\x01\x01\x12 \n" +
+	"\tadmin_url\x18\a \x01(\tH\x03R\badminUrl\x88\x01\x01\"\xa7\x01\n" +
+	"\x06Status\x12\x16\n" +
+	"\x12STATUS_UNSPECIFIED\x10\x00\x12\x15\n" +
+	"\x11STATUS_VALIDATING\x10\x01\x12\x17\n" +
+	"\x13STATUS_PROVISIONING\x10\x02\x12\x14\n" +
+	"\x10STATUS_RESTORING\x10\x03\x12\x16\n" +
+	"\x12STATUS_CONFIGURING\x10\x04\x12\x14\n" +
+	"\x10STATUS_COMPLETED\x10\x05\x12\x11\n" +
+	"\rSTATUS_FAILED\x10\x06B\b\n" +
+	"\x06_errorB\x0e\n" +
+	"\f_instance_idB\v\n" +
+	"\t_site_urlB\f\n" +
+	"\n" +
+	"_admin_url2\xc0\x03\n" +
+	"\vPushService\x12d\n" +
+	"\x0fStartDeviceAuth\x12'.orchestrator.v1.StartDeviceAuthRequest\x1a(.orchestrator.v1.StartDeviceAuthResponse\x12a\n" +
+	"\x0ePollDeviceAuth\x12&.orchestrator.v1.PollDeviceAuthRequest\x1a'.orchestrator.v1.PollDeviceAuthResponse\x12p\n" +
+	"\x13ProvisionFromBackup\x12+.orchestrator.v1.ProvisionFromBackupRequest\x1a,.orchestrator.v1.ProvisionFromBackupResponse\x12v\n" +
+	"\x15GetProvisioningStatus\x12-.orchestrator.v1.GetProvisioningStatusRequest\x1a..orchestrator.v1.GetProvisioningStatusResponseB\xcc\x01\n" +
+	"\x13com.orchestrator.v1B\tPushProtoP\x01ZMgit.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1;orchestratorv1\xa2\x02\x03OXX\xaa\x02\x0fOrchestrator.V1\xca\x02\x0fOrchestrator\\V1\xe2\x02\x1bOrchestrator\\V1\\GPBMetadata\xea\x02\x10Orchestrator::V1b\x06proto3"
+
+var (
+	file_orchestrator_v1_push_proto_rawDescOnce sync.Once
+	file_orchestrator_v1_push_proto_rawDescData []byte
+)
+
+func file_orchestrator_v1_push_proto_rawDescGZIP() []byte {
+	file_orchestrator_v1_push_proto_rawDescOnce.Do(func() {
+		file_orchestrator_v1_push_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_orchestrator_v1_push_proto_rawDesc), len(file_orchestrator_v1_push_proto_rawDesc)))
+	})
+	return file_orchestrator_v1_push_proto_rawDescData
+}
+
+var file_orchestrator_v1_push_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
+var file_orchestrator_v1_push_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_orchestrator_v1_push_proto_goTypes = []any{
+	(PollDeviceAuthResponse_Status)(0),        // 0: orchestrator.v1.PollDeviceAuthResponse.Status
+	(GetProvisioningStatusResponse_Status)(0), // 1: orchestrator.v1.GetProvisioningStatusResponse.Status
+	(*StartDeviceAuthRequest)(nil),            // 2: orchestrator.v1.StartDeviceAuthRequest
+	(*StartDeviceAuthResponse)(nil),           // 3: orchestrator.v1.StartDeviceAuthResponse
+	(*PollDeviceAuthRequest)(nil),             // 4: orchestrator.v1.PollDeviceAuthRequest
+	(*PollDeviceAuthResponse)(nil),            // 5: orchestrator.v1.PollDeviceAuthResponse
+	(*ProvisionFromBackupRequest)(nil),        // 6: orchestrator.v1.ProvisionFromBackupRequest
+	(*ProvisionFromBackupResponse)(nil),       // 7: orchestrator.v1.ProvisionFromBackupResponse
+	(*GetProvisioningStatusRequest)(nil),      // 8: orchestrator.v1.GetProvisioningStatusRequest
+	(*GetProvisioningStatusResponse)(nil),     // 9: orchestrator.v1.GetProvisioningStatusResponse
+	(*timestamppb.Timestamp)(nil),             // 10: google.protobuf.Timestamp
+}
+var file_orchestrator_v1_push_proto_depIdxs = []int32{
+	0,  // 0: orchestrator.v1.PollDeviceAuthResponse.status:type_name -> orchestrator.v1.PollDeviceAuthResponse.Status
+	10, // 1: orchestrator.v1.PollDeviceAuthResponse.expires_at:type_name -> google.protobuf.Timestamp
+	1,  // 2: orchestrator.v1.GetProvisioningStatusResponse.status:type_name -> orchestrator.v1.GetProvisioningStatusResponse.Status
+	2,  // 3: orchestrator.v1.PushService.StartDeviceAuth:input_type -> orchestrator.v1.StartDeviceAuthRequest
+	4,  // 4: orchestrator.v1.PushService.PollDeviceAuth:input_type -> orchestrator.v1.PollDeviceAuthRequest
+	6,  // 5: orchestrator.v1.PushService.ProvisionFromBackup:input_type -> orchestrator.v1.ProvisionFromBackupRequest
+	8,  // 6: orchestrator.v1.PushService.GetProvisioningStatus:input_type -> orchestrator.v1.GetProvisioningStatusRequest
+	3,  // 7: orchestrator.v1.PushService.StartDeviceAuth:output_type -> orchestrator.v1.StartDeviceAuthResponse
+	5,  // 8: orchestrator.v1.PushService.PollDeviceAuth:output_type -> orchestrator.v1.PollDeviceAuthResponse
+	7,  // 9: orchestrator.v1.PushService.ProvisionFromBackup:output_type -> orchestrator.v1.ProvisionFromBackupResponse
+	9,  // 10: orchestrator.v1.PushService.GetProvisioningStatus:output_type -> orchestrator.v1.GetProvisioningStatusResponse
+	7,  // [7:11] is the sub-list for method output_type
+	3,  // [3:7] is the sub-list for method input_type
+	3,  // [3:3] is the sub-list for extension type_name
+	3,  // [3:3] is the sub-list for extension extendee
+	0,  // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_orchestrator_v1_push_proto_init() }
+func file_orchestrator_v1_push_proto_init() {
+	if File_orchestrator_v1_push_proto != nil {
+		return
+	}
+	file_orchestrator_v1_push_proto_msgTypes[3].OneofWrappers = []any{}
+	file_orchestrator_v1_push_proto_msgTypes[4].OneofWrappers = []any{}
+	file_orchestrator_v1_push_proto_msgTypes[7].OneofWrappers = []any{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_orchestrator_v1_push_proto_rawDesc), len(file_orchestrator_v1_push_proto_rawDesc)),
+			NumEnums:      2,
+			NumMessages:   8,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_orchestrator_v1_push_proto_goTypes,
+		DependencyIndexes: file_orchestrator_v1_push_proto_depIdxs,
+		EnumInfos:         file_orchestrator_v1_push_proto_enumTypes,
+		MessageInfos:      file_orchestrator_v1_push_proto_msgTypes,
+	}.Build()
+	File_orchestrator_v1_push_proto = out.File
+	file_orchestrator_v1_push_proto_goTypes = nil
+	file_orchestrator_v1_push_proto_depIdxs = nil
+}

internal/api/orchestrator/v1/settings.pb.go

@@ -0,0 +1,437 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: orchestrator/v1/settings.proto
+
+package orchestratorv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// PlatformSetting represents a platform-wide setting
+type PlatformSetting struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Key           string                 `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	Value         string                 `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+	Description   string                 `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PlatformSetting) Reset() {
+	*x = PlatformSetting{}
+	mi := &file_orchestrator_v1_settings_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PlatformSetting) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PlatformSetting) ProtoMessage() {}
+
+func (x *PlatformSetting) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_settings_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PlatformSetting.ProtoReflect.Descriptor instead.
+func (*PlatformSetting) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_settings_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *PlatformSetting) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *PlatformSetting) GetValue() string {
+	if x != nil {
+		return x.Value
+	}
+	return ""
+}
+
+func (x *PlatformSetting) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+type GetPlatformSettingRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Key           string                 `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetPlatformSettingRequest) Reset() {
+	*x = GetPlatformSettingRequest{}
+	mi := &file_orchestrator_v1_settings_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetPlatformSettingRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetPlatformSettingRequest) ProtoMessage() {}
+
+func (x *GetPlatformSettingRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_settings_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetPlatformSettingRequest.ProtoReflect.Descriptor instead.
+func (*GetPlatformSettingRequest) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_settings_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *GetPlatformSettingRequest) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+type GetPlatformSettingResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Setting       *PlatformSetting       `protobuf:"bytes,1,opt,name=setting,proto3" json:"setting,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetPlatformSettingResponse) Reset() {
+	*x = GetPlatformSettingResponse{}
+	mi := &file_orchestrator_v1_settings_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetPlatformSettingResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetPlatformSettingResponse) ProtoMessage() {}
+
+func (x *GetPlatformSettingResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_settings_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetPlatformSettingResponse.ProtoReflect.Descriptor instead.
+func (*GetPlatformSettingResponse) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_settings_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *GetPlatformSettingResponse) GetSetting() *PlatformSetting {
+	if x != nil {
+		return x.Setting
+	}
+	return nil
+}
+
+type UpdatePlatformSettingRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Key           string                 `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	Value         string                 `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdatePlatformSettingRequest) Reset() {
+	*x = UpdatePlatformSettingRequest{}
+	mi := &file_orchestrator_v1_settings_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdatePlatformSettingRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdatePlatformSettingRequest) ProtoMessage() {}
+
+func (x *UpdatePlatformSettingRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_settings_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdatePlatformSettingRequest.ProtoReflect.Descriptor instead.
+func (*UpdatePlatformSettingRequest) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_settings_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *UpdatePlatformSettingRequest) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *UpdatePlatformSettingRequest) GetValue() string {
+	if x != nil {
+		return x.Value
+	}
+	return ""
+}
+
+type UpdatePlatformSettingResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Setting       *PlatformSetting       `protobuf:"bytes,1,opt,name=setting,proto3" json:"setting,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdatePlatformSettingResponse) Reset() {
+	*x = UpdatePlatformSettingResponse{}
+	mi := &file_orchestrator_v1_settings_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdatePlatformSettingResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdatePlatformSettingResponse) ProtoMessage() {}
+
+func (x *UpdatePlatformSettingResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_settings_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdatePlatformSettingResponse.ProtoReflect.Descriptor instead.
+func (*UpdatePlatformSettingResponse) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_settings_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *UpdatePlatformSettingResponse) GetSetting() *PlatformSetting {
+	if x != nil {
+		return x.Setting
+	}
+	return nil
+}
+
+type ListPlatformSettingsRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListPlatformSettingsRequest) Reset() {
+	*x = ListPlatformSettingsRequest{}
+	mi := &file_orchestrator_v1_settings_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListPlatformSettingsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListPlatformSettingsRequest) ProtoMessage() {}
+
+func (x *ListPlatformSettingsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_settings_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListPlatformSettingsRequest.ProtoReflect.Descriptor instead.
+func (*ListPlatformSettingsRequest) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_settings_proto_rawDescGZIP(), []int{5}
+}
+
+type ListPlatformSettingsResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Settings      []*PlatformSetting     `protobuf:"bytes,1,rep,name=settings,proto3" json:"settings,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListPlatformSettingsResponse) Reset() {
+	*x = ListPlatformSettingsResponse{}
+	mi := &file_orchestrator_v1_settings_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListPlatformSettingsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListPlatformSettingsResponse) ProtoMessage() {}
+
+func (x *ListPlatformSettingsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_settings_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListPlatformSettingsResponse.ProtoReflect.Descriptor instead.
+func (*ListPlatformSettingsResponse) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_settings_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *ListPlatformSettingsResponse) GetSettings() []*PlatformSetting {
+	if x != nil {
+		return x.Settings
+	}
+	return nil
+}
+
+var File_orchestrator_v1_settings_proto protoreflect.FileDescriptor
+
+const file_orchestrator_v1_settings_proto_rawDesc = "" +
+	"\n" +
+	"\x1eorchestrator/v1/settings.proto\x12\x0forchestrator.v1\"[\n" +
+	"\x0fPlatformSetting\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value\x12 \n" +
+	"\vdescription\x18\x03 \x01(\tR\vdescription\"-\n" +
+	"\x19GetPlatformSettingRequest\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\"X\n" +
+	"\x1aGetPlatformSettingResponse\x12:\n" +
+	"\asetting\x18\x01 \x01(\v2 .orchestrator.v1.PlatformSettingR\asetting\"F\n" +
+	"\x1cUpdatePlatformSettingRequest\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value\"[\n" +
+	"\x1dUpdatePlatformSettingResponse\x12:\n" +
+	"\asetting\x18\x01 \x01(\v2 .orchestrator.v1.PlatformSettingR\asetting\"\x1d\n" +
+	"\x1bListPlatformSettingsRequest\"\\\n" +
+	"\x1cListPlatformSettingsResponse\x12<\n" +
+	"\bsettings\x18\x01 \x03(\v2 .orchestrator.v1.PlatformSettingR\bsettings2\xed\x02\n" +
+	"\x0fSettingsService\x12m\n" +
+	"\x12GetPlatformSetting\x12*.orchestrator.v1.GetPlatformSettingRequest\x1a+.orchestrator.v1.GetPlatformSettingResponse\x12v\n" +
+	"\x15UpdatePlatformSetting\x12-.orchestrator.v1.UpdatePlatformSettingRequest\x1a..orchestrator.v1.UpdatePlatformSettingResponse\x12s\n" +
+	"\x14ListPlatformSettings\x12,.orchestrator.v1.ListPlatformSettingsRequest\x1a-.orchestrator.v1.ListPlatformSettingsResponseB\xd0\x01\n" +
+	"\x13com.orchestrator.v1B\rSettingsProtoP\x01ZMgit.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1;orchestratorv1\xa2\x02\x03OXX\xaa\x02\x0fOrchestrator.V1\xca\x02\x0fOrchestrator\\V1\xe2\x02\x1bOrchestrator\\V1\\GPBMetadata\xea\x02\x10Orchestrator::V1b\x06proto3"
+
+var (
+	file_orchestrator_v1_settings_proto_rawDescOnce sync.Once
+	file_orchestrator_v1_settings_proto_rawDescData []byte
+)
+
+func file_orchestrator_v1_settings_proto_rawDescGZIP() []byte {
+	file_orchestrator_v1_settings_proto_rawDescOnce.Do(func() {
+		file_orchestrator_v1_settings_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_orchestrator_v1_settings_proto_rawDesc), len(file_orchestrator_v1_settings_proto_rawDesc)))
+	})
+	return file_orchestrator_v1_settings_proto_rawDescData
+}
+
+var file_orchestrator_v1_settings_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
+var file_orchestrator_v1_settings_proto_goTypes = []any{
+	(*PlatformSetting)(nil),               // 0: orchestrator.v1.PlatformSetting
+	(*GetPlatformSettingRequest)(nil),     // 1: orchestrator.v1.GetPlatformSettingRequest
+	(*GetPlatformSettingResponse)(nil),    // 2: orchestrator.v1.GetPlatformSettingResponse
+	(*UpdatePlatformSettingRequest)(nil),  // 3: orchestrator.v1.UpdatePlatformSettingRequest
+	(*UpdatePlatformSettingResponse)(nil), // 4: orchestrator.v1.UpdatePlatformSettingResponse
+	(*ListPlatformSettingsRequest)(nil),   // 5: orchestrator.v1.ListPlatformSettingsRequest
+	(*ListPlatformSettingsResponse)(nil),  // 6: orchestrator.v1.ListPlatformSettingsResponse
+}
+var file_orchestrator_v1_settings_proto_depIdxs = []int32{
+	0, // 0: orchestrator.v1.GetPlatformSettingResponse.setting:type_name -> orchestrator.v1.PlatformSetting
+	0, // 1: orchestrator.v1.UpdatePlatformSettingResponse.setting:type_name -> orchestrator.v1.PlatformSetting
+	0, // 2: orchestrator.v1.ListPlatformSettingsResponse.settings:type_name -> orchestrator.v1.PlatformSetting
+	1, // 3: orchestrator.v1.SettingsService.GetPlatformSetting:input_type -> orchestrator.v1.GetPlatformSettingRequest
+	3, // 4: orchestrator.v1.SettingsService.UpdatePlatformSetting:input_type -> orchestrator.v1.UpdatePlatformSettingRequest
+	5, // 5: orchestrator.v1.SettingsService.ListPlatformSettings:input_type -> orchestrator.v1.ListPlatformSettingsRequest
+	2, // 6: orchestrator.v1.SettingsService.GetPlatformSetting:output_type -> orchestrator.v1.GetPlatformSettingResponse
+	4, // 7: orchestrator.v1.SettingsService.UpdatePlatformSetting:output_type -> orchestrator.v1.UpdatePlatformSettingResponse
+	6, // 8: orchestrator.v1.SettingsService.ListPlatformSettings:output_type -> orchestrator.v1.ListPlatformSettingsResponse
+	6, // [6:9] is the sub-list for method output_type
+	3, // [3:6] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_orchestrator_v1_settings_proto_init() }
+func file_orchestrator_v1_settings_proto_init() {
+	if File_orchestrator_v1_settings_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_orchestrator_v1_settings_proto_rawDesc), len(file_orchestrator_v1_settings_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   7,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_orchestrator_v1_settings_proto_goTypes,
+		DependencyIndexes: file_orchestrator_v1_settings_proto_depIdxs,
+		MessageInfos:      file_orchestrator_v1_settings_proto_msgTypes,
+	}.Build()
+	File_orchestrator_v1_settings_proto = out.File
+	file_orchestrator_v1_settings_proto_goTypes = nil
+	file_orchestrator_v1_settings_proto_depIdxs = nil
+}

internal/api/orchestrator/v1/sso.pb.go

@@ -0,0 +1,343 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: orchestrator/v1/sso.proto
+
+package orchestratorv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type GenerateSSOTokenRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	InstanceId    string                 `protobuf:"bytes,1,opt,name=instance_id,json=instanceId,proto3" json:"instance_id,omitempty"`
+	RedirectPath  *string                `protobuf:"bytes,2,opt,name=redirect_path,json=redirectPath,proto3,oneof" json:"redirect_path,omitempty"` // Path to redirect to after auth (default: /admin)
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GenerateSSOTokenRequest) Reset() {
+	*x = GenerateSSOTokenRequest{}
+	mi := &file_orchestrator_v1_sso_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GenerateSSOTokenRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GenerateSSOTokenRequest) ProtoMessage() {}
+
+func (x *GenerateSSOTokenRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_sso_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GenerateSSOTokenRequest.ProtoReflect.Descriptor instead.
+func (*GenerateSSOTokenRequest) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_sso_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *GenerateSSOTokenRequest) GetInstanceId() string {
+	if x != nil {
+		return x.InstanceId
+	}
+	return ""
+}
+
+func (x *GenerateSSOTokenRequest) GetRedirectPath() string {
+	if x != nil && x.RedirectPath != nil {
+		return *x.RedirectPath
+	}
+	return ""
+}
+
+type GenerateSSOTokenResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Token         string                 `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
+	RedirectUrl   string                 `protobuf:"bytes,2,opt,name=redirect_url,json=redirectUrl,proto3" json:"redirect_url,omitempty"` // Full URL to redirect to
+	ExpiresAt     *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GenerateSSOTokenResponse) Reset() {
+	*x = GenerateSSOTokenResponse{}
+	mi := &file_orchestrator_v1_sso_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GenerateSSOTokenResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GenerateSSOTokenResponse) ProtoMessage() {}
+
+func (x *GenerateSSOTokenResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_sso_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GenerateSSOTokenResponse.ProtoReflect.Descriptor instead.
+func (*GenerateSSOTokenResponse) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_sso_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *GenerateSSOTokenResponse) GetToken() string {
+	if x != nil {
+		return x.Token
+	}
+	return ""
+}
+
+func (x *GenerateSSOTokenResponse) GetRedirectUrl() string {
+	if x != nil {
+		return x.RedirectUrl
+	}
+	return ""
+}
+
+func (x *GenerateSSOTokenResponse) GetExpiresAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.ExpiresAt
+	}
+	return nil
+}
+
+type ExchangeSSOTokenRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Token         string                 `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExchangeSSOTokenRequest) Reset() {
+	*x = ExchangeSSOTokenRequest{}
+	mi := &file_orchestrator_v1_sso_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExchangeSSOTokenRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExchangeSSOTokenRequest) ProtoMessage() {}
+
+func (x *ExchangeSSOTokenRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_sso_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExchangeSSOTokenRequest.ProtoReflect.Descriptor instead.
+func (*ExchangeSSOTokenRequest) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_sso_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ExchangeSSOTokenRequest) GetToken() string {
+	if x != nil {
+		return x.Token
+	}
+	return ""
+}
+
+type ExchangeSSOTokenResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	UserId        string                 `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	Email         string                 `protobuf:"bytes,2,opt,name=email,proto3" json:"email,omitempty"`
+	FirstName     string                 `protobuf:"bytes,3,opt,name=first_name,json=firstName,proto3" json:"first_name,omitempty"`
+	LastName      string                 `protobuf:"bytes,4,opt,name=last_name,json=lastName,proto3" json:"last_name,omitempty"`
+	Role          string                 `protobuf:"bytes,5,opt,name=role,proto3" json:"role,omitempty"` // The user's role in this instance
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExchangeSSOTokenResponse) Reset() {
+	*x = ExchangeSSOTokenResponse{}
+	mi := &file_orchestrator_v1_sso_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExchangeSSOTokenResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExchangeSSOTokenResponse) ProtoMessage() {}
+
+func (x *ExchangeSSOTokenResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_sso_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExchangeSSOTokenResponse.ProtoReflect.Descriptor instead.
+func (*ExchangeSSOTokenResponse) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_sso_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ExchangeSSOTokenResponse) GetUserId() string {
+	if x != nil {
+		return x.UserId
+	}
+	return ""
+}
+
+func (x *ExchangeSSOTokenResponse) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *ExchangeSSOTokenResponse) GetFirstName() string {
+	if x != nil {
+		return x.FirstName
+	}
+	return ""
+}
+
+func (x *ExchangeSSOTokenResponse) GetLastName() string {
+	if x != nil {
+		return x.LastName
+	}
+	return ""
+}
+
+func (x *ExchangeSSOTokenResponse) GetRole() string {
+	if x != nil {
+		return x.Role
+	}
+	return ""
+}
+
+var File_orchestrator_v1_sso_proto protoreflect.FileDescriptor
+
+const file_orchestrator_v1_sso_proto_rawDesc = "" +
+	"\n" +
+	"\x19orchestrator/v1/sso.proto\x12\x0forchestrator.v1\x1a\x1fgoogle/protobuf/timestamp.proto\"v\n" +
+	"\x17GenerateSSOTokenRequest\x12\x1f\n" +
+	"\vinstance_id\x18\x01 \x01(\tR\n" +
+	"instanceId\x12(\n" +
+	"\rredirect_path\x18\x02 \x01(\tH\x00R\fredirectPath\x88\x01\x01B\x10\n" +
+	"\x0e_redirect_path\"\x8e\x01\n" +
+	"\x18GenerateSSOTokenResponse\x12\x14\n" +
+	"\x05token\x18\x01 \x01(\tR\x05token\x12!\n" +
+	"\fredirect_url\x18\x02 \x01(\tR\vredirectUrl\x129\n" +
+	"\n" +
+	"expires_at\x18\x03 \x01(\v2\x1a.google.protobuf.TimestampR\texpiresAt\"/\n" +
+	"\x17ExchangeSSOTokenRequest\x12\x14\n" +
+	"\x05token\x18\x01 \x01(\tR\x05token\"\x99\x01\n" +
+	"\x18ExchangeSSOTokenResponse\x12\x17\n" +
+	"\auser_id\x18\x01 \x01(\tR\x06userId\x12\x14\n" +
+	"\x05email\x18\x02 \x01(\tR\x05email\x12\x1d\n" +
+	"\n" +
+	"first_name\x18\x03 \x01(\tR\tfirstName\x12\x1b\n" +
+	"\tlast_name\x18\x04 \x01(\tR\blastName\x12\x12\n" +
+	"\x04role\x18\x05 \x01(\tR\x04role2\xde\x01\n" +
+	"\n" +
+	"SSOService\x12g\n" +
+	"\x10GenerateSSOToken\x12(.orchestrator.v1.GenerateSSOTokenRequest\x1a).orchestrator.v1.GenerateSSOTokenResponse\x12g\n" +
+	"\x10ExchangeSSOToken\x12(.orchestrator.v1.ExchangeSSOTokenRequest\x1a).orchestrator.v1.ExchangeSSOTokenResponseB\xcb\x01\n" +
+	"\x13com.orchestrator.v1B\bSsoProtoP\x01ZMgit.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1;orchestratorv1\xa2\x02\x03OXX\xaa\x02\x0fOrchestrator.V1\xca\x02\x0fOrchestrator\\V1\xe2\x02\x1bOrchestrator\\V1\\GPBMetadata\xea\x02\x10Orchestrator::V1b\x06proto3"
+
+var (
+	file_orchestrator_v1_sso_proto_rawDescOnce sync.Once
+	file_orchestrator_v1_sso_proto_rawDescData []byte
+)
+
+func file_orchestrator_v1_sso_proto_rawDescGZIP() []byte {
+	file_orchestrator_v1_sso_proto_rawDescOnce.Do(func() {
+		file_orchestrator_v1_sso_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_orchestrator_v1_sso_proto_rawDesc), len(file_orchestrator_v1_sso_proto_rawDesc)))
+	})
+	return file_orchestrator_v1_sso_proto_rawDescData
+}
+
+var file_orchestrator_v1_sso_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_orchestrator_v1_sso_proto_goTypes = []any{
+	(*GenerateSSOTokenRequest)(nil),  // 0: orchestrator.v1.GenerateSSOTokenRequest
+	(*GenerateSSOTokenResponse)(nil), // 1: orchestrator.v1.GenerateSSOTokenResponse
+	(*ExchangeSSOTokenRequest)(nil),  // 2: orchestrator.v1.ExchangeSSOTokenRequest
+	(*ExchangeSSOTokenResponse)(nil), // 3: orchestrator.v1.ExchangeSSOTokenResponse
+	(*timestamppb.Timestamp)(nil),    // 4: google.protobuf.Timestamp
+}
+var file_orchestrator_v1_sso_proto_depIdxs = []int32{
+	4, // 0: orchestrator.v1.GenerateSSOTokenResponse.expires_at:type_name -> google.protobuf.Timestamp
+	0, // 1: orchestrator.v1.SSOService.GenerateSSOToken:input_type -> orchestrator.v1.GenerateSSOTokenRequest
+	2, // 2: orchestrator.v1.SSOService.ExchangeSSOToken:input_type -> orchestrator.v1.ExchangeSSOTokenRequest
+	1, // 3: orchestrator.v1.SSOService.GenerateSSOToken:output_type -> orchestrator.v1.GenerateSSOTokenResponse
+	3, // 4: orchestrator.v1.SSOService.ExchangeSSOToken:output_type -> orchestrator.v1.ExchangeSSOTokenResponse
+	3, // [3:5] is the sub-list for method output_type
+	1, // [1:3] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_orchestrator_v1_sso_proto_init() }
+func file_orchestrator_v1_sso_proto_init() {
+	if File_orchestrator_v1_sso_proto != nil {
+		return
+	}
+	file_orchestrator_v1_sso_proto_msgTypes[0].OneofWrappers = []any{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_orchestrator_v1_sso_proto_rawDesc), len(file_orchestrator_v1_sso_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_orchestrator_v1_sso_proto_goTypes,
+		DependencyIndexes: file_orchestrator_v1_sso_proto_depIdxs,
+		MessageInfos:      file_orchestrator_v1_sso_proto_msgTypes,
+	}.Build()
+	File_orchestrator_v1_sso_proto = out.File
+	file_orchestrator_v1_sso_proto_goTypes = nil
+	file_orchestrator_v1_sso_proto_depIdxs = nil
+}

proto

@@ -0,0 +1 @@
+Subproject commit 824ee9b15e15c47f44da567cff57c0e9fc87045b

proto/orchestrator/v1/plugin_registry.proto

@@ -1,322 +0,0 @@
-syntax = "proto3";
-
-package orchestrator.v1;
-
-import "google/protobuf/timestamp.proto";
-
-option go_package = "git.dev.alexdunmow.com/block/ninja/orchestrator/internal/api/orchestrator/v1;orchestratorv1";
-
-// PluginScopeService manages @scope namespaces.
-service PluginScopeService {
-  rpc CreateScope(CreateScopeRequest) returns (CreateScopeResponse);
-  rpc ListMyScopes(ListMyScopesRequest) returns (ListMyScopesResponse);
-  rpc GetScope(GetScopeRequest) returns (GetScopeResponse);
-}
-
-// PluginRegistryService is the read-side public API plus CreatePlugin.
-service PluginRegistryService {
-  rpc CreatePlugin(CreatePluginRequest) returns (CreatePluginResponse);
-  rpc GetPlugin(GetPluginRequest) returns (GetPluginResponse);
-  rpc ListPlugins(ListPluginsRequest) returns (ListPluginsResponse);
-  rpc GetVersion(GetVersionRequest) returns (GetVersionResponse);
-  rpc ResolveInstall(ResolveInstallRequest) returns (ResolveInstallResponse);
-  rpc ListCategories(ListCategoriesRequest) returns (ListCategoriesResponse);
-
-  // Private-plugin RPCs. All require the caller to be a member of the target
-  // account; the server resolves account membership from the bearer token.
-  rpc ListPrivatePlugins(ListPrivatePluginsRequest) returns (ListPrivatePluginsResponse);
-  rpc DeletePrivatePlugin(DeletePrivatePluginRequest) returns (DeletePrivatePluginResponse);
-  rpc DeletePrivatePluginVersion(DeletePrivatePluginVersionRequest) returns (DeletePrivatePluginVersionResponse);
-  rpc ListPrivatePluginInstallSites(ListPrivatePluginInstallSitesRequest) returns (ListPrivatePluginInstallSitesResponse);
-}
-
-// PluginPublishService is called by the ninja CLI to publish a version.
-service PluginPublishService {
-  rpc PublishVersion(PublishVersionRequest) returns (PublishVersionResponse);
-}
-
-// PluginAuthService handles OAuth device flow used by ninja CLI.
-service PluginAuthService {
-  rpc StartDevice(StartDeviceRequest) returns (StartDeviceResponse);
-  rpc PollDevice(PollDeviceRequest) returns (PollDeviceResponse);
-  rpc ApproveDevice(ApproveDeviceRequest) returns (ApproveDeviceResponse);
-  rpc DenyDevice(DenyDeviceRequest) returns (DenyDeviceResponse);
-  rpc GetDeviceStatus(GetDeviceStatusRequest) returns (GetDeviceStatusResponse);
-  rpc Whoami(WhoamiRequest) returns (WhoamiResponse);
-  // ListMyAccounts returns the accounts the authenticated user belongs to.
-  // Used by `ninja login` (forced selection when multiple) and
-  // `ninja account list`.
-  rpc ListMyAccounts(ListMyAccountsRequest) returns (ListMyAccountsResponse);
-}
-
-// --- Shared messages ---
-
-message Scope {
-  string id = 1;
-  string slug = 2;
-  string display_name = 3;
-  google.protobuf.Timestamp created_at = 4;
-}
-
-// PluginVisibility is the lifecycle/access state of a plugin in the registry.
-// PRIVATE plugins are scoped to a single account; PUBLIC plugins are visible
-// to all. UNDER_REVIEW / REJECTED / TAKEN_DOWN are public-registry moderation
-// states and do not apply to private plugins.
-enum PluginVisibility {
-  PLUGIN_VISIBILITY_UNSPECIFIED = 0;
-  PLUGIN_VISIBILITY_PRIVATE = 1;
-  PLUGIN_VISIBILITY_UNDER_REVIEW = 2;
-  PLUGIN_VISIBILITY_PUBLIC = 3;
-  PLUGIN_VISIBILITY_REJECTED = 4;
-  PLUGIN_VISIBILITY_TAKEN_DOWN = 5;
-}
-
-message Plugin {
-  string id = 1;
-  string scope_slug = 2;
-  string name = 3;
-  PluginVisibility visibility = 4;
-  bool premium = 5;
-  string description = 6;
-  string homepage_url = 7;
-  repeated string categories = 8;
-  google.protobuf.Timestamp updated_at = 9;
-  string kind = 10;
-  string display_name = 11;
-  // owner_account_id is set for private plugins and identifies the account
-  // that owns the plugin. Empty for public plugins.
-  string owner_account_id = 12;
-}
-
-// Account is a multi-user organisational unit in the orchestrator. The
-// authenticated user may belong to one or more accounts via account_users.
-message Account {
-  string id = 1;
-  string slug = 2;
-  string display_name = 3;
-  // role of the authenticated caller in this account: owner | manager | member.
-  string role = 4;
-}
-
-message Category {
-  string slug = 1;
-  string display_name = 2;
-  string description = 3;
-  int32 sort_order = 4;
-}
-
-message Version {
-  string id = 1;
-  string plugin_id = 2;
-  string version = 3;
-  google.protobuf.Timestamp published_at = 6;
-  bool yanked = 7;
-  string sdk_constraint = 8;
-  string source_archive_sha256 = 9;
-  int64  source_archive_size = 10;
-}
-
-message Requirement {
-  string scope_slug = 1;
-  string name = 2;
-  string constraint_expr = 3;
-}
-
-// --- Scope service ---
-
-message CreateScopeRequest { string slug = 1; string display_name = 2; }
-message CreateScopeResponse { Scope scope = 1; }
-message ListMyScopesRequest {}
-message ListMyScopesResponse { repeated Scope scopes = 1; }
-message GetScopeRequest { string slug = 1; }
-message GetScopeResponse { Scope scope = 1; repeated Plugin plugins = 2; }
-
-// --- Registry service ---
-
-message CreatePluginRequest {
-  string scope_slug = 1;
-  string name = 2;
-  string description = 3;
-  string kind = 4;
-  repeated string categories = 5;
-  string display_name = 6;
-  // visibility is the requested visibility of the plugin. UNSPECIFIED defers
-  // to the registry's default (public for explicit scopes, private for the
-  // "@private" sentinel).
-  PluginVisibility visibility = 7;
-  // active_account_id is required when visibility = PRIVATE; the server
-  // verifies the caller is a member of this account before creating the
-  // private plugin under it.
-  string active_account_id = 8;
-}
-message CreatePluginResponse {
-  Plugin plugin = 1;
-}
-
-message GetPluginRequest {
-  string scope_slug = 1;
-  string name = 2;
-  // active_account_id is required when scope_slug = "private" so the server
-  // can resolve (account_id, name) instead of (scope_id, name). Ignored
-  // otherwise.
-  string active_account_id = 3;
-}
-message GetPluginResponse {
-  Plugin plugin = 1;
-  repeated Version versions = 2;
-  map<string,string> channels = 3;
-}
-
-message ListPluginsRequest {
-  int32 limit = 1;
-  int32 offset = 2;
-  string query = 3;
-  string kind = 4;
-  repeated string categories = 5;
-}
-message ListPluginsResponse { repeated Plugin plugins = 1; }
-
-message ListCategoriesRequest {}
-message ListCategoriesResponse { repeated Category categories = 1; }
-
-// --- Private plugin RPC messages ---
-
-message ListPrivatePluginsRequest {
-  // account_id selects which account's private plugins to list. The caller
-  // must be a member of this account.
-  string account_id = 1;
-}
-message ListPrivatePluginsResponse {
-  repeated PrivatePluginSummary plugins = 1;
-}
-
-// PrivatePluginSummary is the row shape used by the publisher dashboard and
-// by the CMS "Private" installer tab. It bundles a Plugin with the latest
-// version per channel and an installation count.
-message PrivatePluginSummary {
-  Plugin plugin = 1;
-  // channel_versions maps channel name -> latest version string published on
-  // that channel (e.g. "latest" -> "0.3.0", "beta" -> "0.4.0-beta.1").
-  map<string,string> channel_versions = 2;
-  // installed_site_count is the number of CMS sites in the owning account
-  // that currently have any version of this plugin installed. Used to gate
-  // delete-plugin in the dashboard.
-  int32 installed_site_count = 3;
-}
-
-message DeletePrivatePluginRequest {
-  string account_id = 1;
-  string plugin_name = 2;
-}
-message DeletePrivatePluginResponse {}
-
-message DeletePrivatePluginVersionRequest {
-  string account_id = 1;
-  string plugin_name = 2;
-  string version = 3;
-}
-message DeletePrivatePluginVersionResponse {}
-
-message ListPrivatePluginInstallSitesRequest {
-  string account_id = 1;
-  string plugin_name = 2;
-}
-message ListPrivatePluginInstallSitesResponse {
-  repeated PrivatePluginInstallSite sites = 1;
-}
-message PrivatePluginInstallSite {
-  string instance_id = 1;
-  string site_display_name = 2;
-  string installed_version = 3;
-  string pinned_channel = 4;
-}
-
-message GetVersionRequest {
-  string scope_slug = 1;
-  string plugin_name = 2;
-  string version = 3;
-}
-message GetVersionResponse {
-  Version version = 1;
-  repeated Requirement requires = 2;
-  string readme_md = 3;
-  string changelog_md = 4;
-}
-
-message ResolveInstallRequest {
-  string scope_slug = 1;
-  string plugin_name = 2;
-  string version_or_channel = 3;
-}
-message ResolveInstallResponse {
-  string version_id = 1;
-  string scope_slug = 2;
-  string plugin_name = 3;
-  string version = 4;
-  string channel_pinned = 5;
-  string archive_url = 6;
-  string archive_sha256 = 7;
-  string sdk_constraint = 8;
-  repeated Requirement requires = 9;
-  bool   yanked = 10;
-  repeated string warnings = 11;
-}
-
-// --- Publish service ---
-
-message PublishVersionRequest {
-  string plugin_id = 1;
-  string version = 2;
-  string channel = 3;
-  bytes archive = 4;
-  string readme_md = 5;
-  string changelog_md = 6;
-}
-message PublishVersionResponse {
-  Version version = 1;
-  string archive_url = 2;
-  repeated string warnings = 3;
-}
-
-// --- Auth service (device flow) ---
-
-message StartDeviceRequest { repeated string scopes = 1; }
-message StartDeviceResponse {
-  string device_code = 1;
-  string user_code = 2;
-  string verification_uri = 3;
-  int32  interval_seconds = 4;
-  int32  expires_in_seconds = 5;
-}
-
-message PollDeviceRequest { string device_code = 1; }
-message PollDeviceResponse {
-  string access_token = 1;
-  string status = 2;
-}
-
-message ApproveDeviceRequest { string user_code = 1; }
-message ApproveDeviceResponse {}
-
-message DenyDeviceRequest { string user_code = 1; }
-message DenyDeviceResponse {}
-
-message GetDeviceStatusRequest { string user_code = 1; }
-message GetDeviceStatusResponse {
-  bool valid = 1;
-  bool authorized = 2;
-  bool denied = 3;
-  string client_id = 4;
-}
-
-message WhoamiRequest {}
-message WhoamiResponse {
-  string user_id = 1;
-  string email = 2;
-  string display_name = 3;
-}
-
-message ListMyAccountsRequest {}
-message ListMyAccountsResponse {
-  repeated Account accounts = 1;
-}