diff --git a/protos/external/goval/api/signing.pb.go b/protos/external/goval/api/signing.pb.go
index a9aa499..0320a27 100644
--- a/protos/external/goval/api/signing.pb.go
+++ b/protos/external/goval/api/signing.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
-// 	protoc        v4.24.3
+// 	protoc-gen-go v1.36.6
+// 	protoc        v6.30.2
 // source: protos/external/goval/api/signing.proto
 
 package api
@@ -12,6 +12,7 @@ import (
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -107,10 +108,10 @@ const (
 	// list explicitly enumerated by the other claims. If that list is empty, the
 	// cert has no ability to sign any tokens that have a user id.
 	FlagClaim_ANY_USER_ID FlagClaim = 11
-	// Cert has the authority to sign ReplToken messages for any org id. If this
+	// Cert has the authority to sign ReplToken messages for any org. If this
 	// claim is not set, the cert will only be able to emit tokens only for the
 	// list explicitly enumerated by the other claims. If that list is empty, the
-	// cert has no ability to sign any tokens that have a org id.
+	// cert has no ability to sign any tokens that have an org.
 	FlagClaim_ANY_ORG FlagClaim = 12
 	// Cert has the authority to sign ReplToken messages for any cluster. If this
 	// claim is not set, the cert will only be able to emit tokens only for the
@@ -122,6 +123,8 @@ const (
 	// the list explicitly enumerated by the other claims. If that list is empty,
 	// the cert has no ability to sign any tokens that have a subcluster.
 	FlagClaim_ANY_SUBCLUSTER FlagClaim = 9
+	// PROP-220 wildcard for arbitrary CertificateClaim.repl_created_at values.
+	FlagClaim_ANY_REPL_CREATED_AT FlagClaim = 13
 )
 
 // Enum value maps for FlagClaim.
@@ -140,6 +143,7 @@ var (
 		12: "ANY_ORG",
 		4:  "ANY_CLUSTER",
 		9:  "ANY_SUBCLUSTER",
+		13: "ANY_REPL_CREATED_AT",
 	}
 	FlagClaim_value = map[string]int32{
 		"MINT_GOVAL_TOKEN":       0,
@@ -155,6 +159,7 @@ var (
 		"ANY_ORG":                12,
 		"ANY_CLUSTER":            4,
 		"ANY_SUBCLUSTER":         9,
+		"ANY_REPL_CREATED_AT":    13,
 	}
 )
 
@@ -239,11 +244,8 @@ func (Org_OrgType) EnumDescriptor() ([]byte, []int) {
 // GovalSigningAuthority is information about a goval token, that can be used to
 // validate it. It is stored in the footer of the PASETO.
 type GovalSigningAuthority struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// Types that are assignable to Cert:
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Cert:
 	//
 	//	*GovalSigningAuthority_KeyId
 	//	*GovalSigningAuthority_SignedCert
@@ -253,16 +255,16 @@ type GovalSigningAuthority struct {
 	Version TokenVersion `protobuf:"varint,3,opt,name=version,proto3,enum=api.TokenVersion" json:"version,omitempty"`
 	// A string containing the issuer of a token. This is used to track who is
 	// sending tokens with a particular key id, so that we can rotate safely.
-	Issuer string `protobuf:"bytes,4,opt,name=issuer,proto3" json:"issuer,omitempty"`
+	Issuer        string `protobuf:"bytes,4,opt,name=issuer,proto3" json:"issuer,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *GovalSigningAuthority) Reset() {
 	*x = GovalSigningAuthority{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_protos_external_goval_api_signing_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_protos_external_goval_api_signing_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *GovalSigningAuthority) String() string {
@@ -273,7 +275,7 @@ func (*GovalSigningAuthority) ProtoMessage() {}
 
 func (x *GovalSigningAuthority) ProtoReflect() protoreflect.Message {
 	mi := &file_protos_external_goval_api_signing_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -288,23 +290,27 @@ func (*GovalSigningAuthority) Descriptor() ([]byte, []int) {
 	return file_protos_external_goval_api_signing_proto_rawDescGZIP(), []int{0}
 }
 
-func (m *GovalSigningAuthority) GetCert() isGovalSigningAuthority_Cert {
-	if m != nil {
-		return m.Cert
+func (x *GovalSigningAuthority) GetCert() isGovalSigningAuthority_Cert {
+	if x != nil {
+		return x.Cert
 	}
 	return nil
 }
 
 func (x *GovalSigningAuthority) GetKeyId() string {
-	if x, ok := x.GetCert().(*GovalSigningAuthority_KeyId); ok {
-		return x.KeyId
+	if x != nil {
+		if x, ok := x.Cert.(*GovalSigningAuthority_KeyId); ok {
+			return x.KeyId
+		}
 	}
 	return ""
 }
 
 func (x *GovalSigningAuthority) GetSignedCert() string {
-	if x, ok := x.GetCert().(*GovalSigningAuthority_SignedCert); ok {
-		return x.SignedCert
+	if x != nil {
+		if x, ok := x.Cert.(*GovalSigningAuthority_SignedCert); ok {
+			return x.SignedCert
+		}
 	}
 	return ""
 }
@@ -355,11 +361,8 @@ func (*GovalSigningAuthority_SignedCert) isGovalSigningAuthority_Cert() {}
 // apply to any repls owned by the user, or any repls in replid, regardless of
 // the owner).
 type CertificateClaim struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// Types that are assignable to Claim:
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Claim:
 	//
 	//	*CertificateClaim_Replid
 	//	*CertificateClaim_User
@@ -369,16 +372,17 @@ type CertificateClaim struct {
 	//	*CertificateClaim_Subcluster
 	//	*CertificateClaim_Deployment
 	//	*CertificateClaim_Flag
-	Claim isCertificateClaim_Claim `protobuf_oneof:"claim"`
+	//	*CertificateClaim_ReplCreatedAt
+	Claim         isCertificateClaim_Claim `protobuf_oneof:"claim"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *CertificateClaim) Reset() {
 	*x = CertificateClaim{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_protos_external_goval_api_signing_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_protos_external_goval_api_signing_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *CertificateClaim) String() string {
@@ -389,7 +393,7 @@ func (*CertificateClaim) ProtoMessage() {}
 
 func (x *CertificateClaim) ProtoReflect() protoreflect.Message {
 	mi := &file_protos_external_goval_api_signing_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -404,69 +408,94 @@ func (*CertificateClaim) Descriptor() ([]byte, []int) {
 	return file_protos_external_goval_api_signing_proto_rawDescGZIP(), []int{1}
 }
 
-func (m *CertificateClaim) GetClaim() isCertificateClaim_Claim {
-	if m != nil {
-		return m.Claim
+func (x *CertificateClaim) GetClaim() isCertificateClaim_Claim {
+	if x != nil {
+		return x.Claim
 	}
 	return nil
 }
 
 func (x *CertificateClaim) GetReplid() string {
-	if x, ok := x.GetClaim().(*CertificateClaim_Replid); ok {
-		return x.Replid
+	if x != nil {
+		if x, ok := x.Claim.(*CertificateClaim_Replid); ok {
+			return x.Replid
+		}
 	}
 	return ""
 }
 
 func (x *CertificateClaim) GetUser() string {
-	if x, ok := x.GetClaim().(*CertificateClaim_User); ok {
-		return x.User
+	if x != nil {
+		if x, ok := x.Claim.(*CertificateClaim_User); ok {
+			return x.User
+		}
 	}
 	return ""
 }
 
 func (x *CertificateClaim) GetUserId() int64 {
-	if x, ok := x.GetClaim().(*CertificateClaim_UserId); ok {
-		return x.UserId
+	if x != nil {
+		if x, ok := x.Claim.(*CertificateClaim_UserId); ok {
+			return x.UserId
+		}
 	}
 	return 0
 }
 
 func (x *CertificateClaim) GetOrg() *Org {
-	if x, ok := x.GetClaim().(*CertificateClaim_Org); ok {
-		return x.Org
+	if x != nil {
+		if x, ok := x.Claim.(*CertificateClaim_Org); ok {
+			return x.Org
+		}
 	}
 	return nil
 }
 
 func (x *CertificateClaim) GetCluster() string {
-	if x, ok := x.GetClaim().(*CertificateClaim_Cluster); ok {
-		return x.Cluster
+	if x != nil {
+		if x, ok := x.Claim.(*CertificateClaim_Cluster); ok {
+			return x.Cluster
+		}
 	}
 	return ""
 }
 
 func (x *CertificateClaim) GetSubcluster() string {
-	if x, ok := x.GetClaim().(*CertificateClaim_Subcluster); ok {
-		return x.Subcluster
+	if x != nil {
+		if x, ok := x.Claim.(*CertificateClaim_Subcluster); ok {
+			return x.Subcluster
+		}
 	}
 	return ""
 }
 
 func (x *CertificateClaim) GetDeployment() bool {
-	if x, ok := x.GetClaim().(*CertificateClaim_Deployment); ok {
-		return x.Deployment
+	if x != nil {
+		if x, ok := x.Claim.(*CertificateClaim_Deployment); ok {
+			return x.Deployment
+		}
 	}
 	return false
 }
 
 func (x *CertificateClaim) GetFlag() FlagClaim {
-	if x, ok := x.GetClaim().(*CertificateClaim_Flag); ok {
-		return x.Flag
+	if x != nil {
+		if x, ok := x.Claim.(*CertificateClaim_Flag); ok {
+			return x.Flag
+		}
 	}
 	return FlagClaim_MINT_GOVAL_TOKEN
 }
 
+func (x *CertificateClaim) GetReplCreatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		if x, ok := x.Claim.(*CertificateClaim_ReplCreatedAt); ok {
+			return x.ReplCreatedAt
+		}
+	}
+	return nil
+}
+
 type isCertificateClaim_Claim interface {
 	isCertificateClaim_Claim()
 }
@@ -513,6 +542,12 @@ type CertificateClaim_Flag struct {
 	Flag FlagClaim `protobuf:"varint,3,opt,name=flag,proto3,enum=api.FlagClaim,oneof"`
 }
 
+type CertificateClaim_ReplCreatedAt struct {
+	// PROP-220: chain-bound repl creation timestamp. The identity
+	// body's repl_created_at must match this claim exactly.
+	ReplCreatedAt *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=repl_created_at,json=replCreatedAt,proto3,oneof"`
+}
+
 func (*CertificateClaim_Replid) isCertificateClaim_Claim() {}
 
 func (*CertificateClaim_User) isCertificateClaim_Claim() {}
@@ -529,6 +564,8 @@ func (*CertificateClaim_Deployment) isCertificateClaim_Claim() {}
 
 func (*CertificateClaim_Flag) isCertificateClaim_Claim() {}
 
+func (*CertificateClaim_ReplCreatedAt) isCertificateClaim_Claim() {}
+
 // GovalCert provides a mechanism of establishing a chain of trust without
 // requiring a single private key to be duplciated to all services that send
 // messages. The processes of generating intermediate certs is as follows:
@@ -555,10 +592,7 @@ func (*CertificateClaim_Flag) isCertificateClaim_Claim() {}
 // the chain (except for the root), the claims of a certificate must be verified
 // to be a subset of the claims of the certificate signing it.
 type GovalCert struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Issue timestamp. Equivalent to JWT's "iat" (Issued At) claim.  Tokens with
 	// no `iat` field will be treated as if they had been issed at the UNIX epoch
 	// (1970-01-01T00:00:00Z).
@@ -572,16 +606,16 @@ type GovalCert struct {
 	// this scope. Must be encoded in either PASERK SID or a PEM PUBLIC KEY
 	// block.  (This key is usally generated in nodejs, and nodejs does not
 	// provide an interface to get the raw key bytes)
-	PublicKey string `protobuf:"bytes,4,opt,name=publicKey,proto3" json:"publicKey,omitempty"`
+	PublicKey     string `protobuf:"bytes,4,opt,name=publicKey,proto3" json:"publicKey,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *GovalCert) Reset() {
 	*x = GovalCert{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_protos_external_goval_api_signing_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_protos_external_goval_api_signing_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *GovalCert) String() string {
@@ -592,7 +626,7 @@ func (*GovalCert) ProtoMessage() {}
 
 func (x *GovalCert) ProtoReflect() protoreflect.Message {
 	mi := &file_protos_external_goval_api_signing_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -637,10 +671,7 @@ func (x *GovalCert) GetPublicKey() string {
 
 // A GovalToken should be the body of any PASETO we send
 type GovalToken struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Issue timestamp. Equivalent to JWT's "iat" (Issued At) claim.  Tokens with
 	// no `iat` field will be treated as if they had been issed at the UNIX epoch
 	// (1970-01-01T00:00:00Z).
@@ -656,20 +687,20 @@ type GovalToken struct {
 	// GovalToken to establish basic validity, and should only add additional
 	// fields. ReplToken has its own iat, exp, and replid for legacy reasons.
 	//
-	// Types that are assignable to Token:
+	// Types that are valid to be assigned to Token:
 	//
 	//	*GovalToken_ReplToken
 	//	*GovalToken_ReplIdentity
-	Token isGovalToken_Token `protobuf_oneof:"Token"`
+	Token         isGovalToken_Token `protobuf_oneof:"Token"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *GovalToken) Reset() {
 	*x = GovalToken{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_protos_external_goval_api_signing_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_protos_external_goval_api_signing_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *GovalToken) String() string {
@@ -680,7 +711,7 @@ func (*GovalToken) ProtoMessage() {}
 
 func (x *GovalToken) ProtoReflect() protoreflect.Message {
 	mi := &file_protos_external_goval_api_signing_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -716,23 +747,27 @@ func (x *GovalToken) GetReplid() string {
 	return ""
 }
 
-func (m *GovalToken) GetToken() isGovalToken_Token {
-	if m != nil {
-		return m.Token
+func (x *GovalToken) GetToken() isGovalToken_Token {
+	if x != nil {
+		return x.Token
 	}
 	return nil
 }
 
 func (x *GovalToken) GetReplToken() *ReplToken {
-	if x, ok := x.GetToken().(*GovalToken_ReplToken); ok {
-		return x.ReplToken
+	if x != nil {
+		if x, ok := x.Token.(*GovalToken_ReplToken); ok {
+			return x.ReplToken
+		}
 	}
 	return nil
 }
 
 func (x *GovalToken) GetReplIdentity() *GovalReplIdentity {
-	if x, ok := x.GetToken().(*GovalToken_ReplIdentity); ok {
-		return x.ReplIdentity
+	if x != nil {
+		if x, ok := x.Token.(*GovalToken_ReplIdentity); ok {
+			return x.ReplIdentity
+		}
 	}
 	return nil
 }
@@ -758,10 +793,7 @@ func (*GovalToken_ReplIdentity) isGovalToken_Token() {}
 // A GovalReplIdentity is used in identity PASETO tokens which are used for
 // authentication between repls.
 type GovalReplIdentity struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// This identity has this Repl ID
 	Replid string `protobuf:"bytes,1,opt,name=replid,proto3" json:"replid,omitempty"`
 	// This identity is in the context of this user
@@ -790,7 +822,7 @@ type GovalReplIdentity struct {
 	Roles []string `protobuf:"bytes,10,rep,name=roles,proto3" json:"roles,omitempty"`
 	// Runtime information about the Repl.
 	//
-	// Types that are assignable to Runtime:
+	// Types that are valid to be assigned to Runtime:
 	//
 	//	*GovalReplIdentity_Interactive
 	//	*GovalReplIdentity_Hosting
@@ -798,15 +830,17 @@ type GovalReplIdentity struct {
 	Runtime isGovalReplIdentity_Runtime `protobuf_oneof:"runtime"`
 	// The organization that owns the Repl
 	Org *Org `protobuf:"bytes,14,opt,name=org,proto3" json:"org,omitempty"`
+	// When the Repl was created. Optional. See PROP-220.
+	ReplCreatedAt *timestamppb.Timestamp `protobuf:"bytes,15,opt,name=repl_created_at,json=replCreatedAt,proto3" json:"repl_created_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *GovalReplIdentity) Reset() {
 	*x = GovalReplIdentity{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_protos_external_goval_api_signing_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_protos_external_goval_api_signing_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *GovalReplIdentity) String() string {
@@ -817,7 +851,7 @@ func (*GovalReplIdentity) ProtoMessage() {}
 
 func (x *GovalReplIdentity) ProtoReflect() protoreflect.Message {
 	mi := &file_protos_external_goval_api_signing_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -902,30 +936,36 @@ func (x *GovalReplIdentity) GetRoles() []string {
 	return nil
 }
 
-func (m *GovalReplIdentity) GetRuntime() isGovalReplIdentity_Runtime {
-	if m != nil {
-		return m.Runtime
+func (x *GovalReplIdentity) GetRuntime() isGovalReplIdentity_Runtime {
+	if x != nil {
+		return x.Runtime
 	}
 	return nil
 }
 
 func (x *GovalReplIdentity) GetInteractive() *ReplRuntimeInteractive {
-	if x, ok := x.GetRuntime().(*GovalReplIdentity_Interactive); ok {
-		return x.Interactive
+	if x != nil {
+		if x, ok := x.Runtime.(*GovalReplIdentity_Interactive); ok {
+			return x.Interactive
+		}
 	}
 	return nil
 }
 
 func (x *GovalReplIdentity) GetHosting() *ReplRuntimeHosting {
-	if x, ok := x.GetRuntime().(*GovalReplIdentity_Hosting); ok {
-		return x.Hosting
+	if x != nil {
+		if x, ok := x.Runtime.(*GovalReplIdentity_Hosting); ok {
+			return x.Hosting
+		}
 	}
 	return nil
 }
 
 func (x *GovalReplIdentity) GetDeployment() *ReplRuntimeDeployment {
-	if x, ok := x.GetRuntime().(*GovalReplIdentity_Deployment); ok {
-		return x.Deployment
+	if x != nil {
+		if x, ok := x.Runtime.(*GovalReplIdentity_Deployment); ok {
+			return x.Deployment
+		}
 	}
 	return nil
 }
@@ -937,6 +977,13 @@ func (x *GovalReplIdentity) GetOrg() *Org {
 	return nil
 }
 
+func (x *GovalReplIdentity) GetReplCreatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.ReplCreatedAt
+	}
+	return nil
+}
+
 type isGovalReplIdentity_Runtime interface {
 	isGovalReplIdentity_Runtime()
 }
@@ -966,10 +1013,7 @@ func (*GovalReplIdentity_Deployment) isGovalReplIdentity_Runtime() {}
 // BuildInfo includes information about which deployment this repl is allowed to
 // create or update.
 type BuildInfo struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// ID is a unique identitifier for the deployment that this builder repl is
 	// allowed to push to.
 	DeploymentId string `protobuf:"bytes,1,opt,name=deployment_id,json=deploymentId,proto3" json:"deployment_id,omitempty"`
@@ -978,16 +1022,16 @@ type BuildInfo struct {
 	// Build ID is a unique identifier for this particular deployment build
 	BuildId string `protobuf:"bytes,3,opt,name=build_id,json=buildId,proto3" json:"build_id,omitempty"`
 	// Tier refers to the GCE machine tier that will be used for the build
-	MachineTier string `protobuf:"bytes,4,opt,name=machine_tier,json=machineTier,proto3" json:"machine_tier,omitempty"`
+	MachineTier   string `protobuf:"bytes,4,opt,name=machine_tier,json=machineTier,proto3" json:"machine_tier,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *BuildInfo) Reset() {
 	*x = BuildInfo{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_protos_external_goval_api_signing_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_protos_external_goval_api_signing_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *BuildInfo) String() string {
@@ -998,7 +1042,7 @@ func (*BuildInfo) ProtoMessage() {}
 
 func (x *BuildInfo) ProtoReflect() protoreflect.Message {
 	mi := &file_protos_external_goval_api_signing_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1042,23 +1086,20 @@ func (x *BuildInfo) GetMachineTier() string {
 }
 
 type ReplRuntimeInteractive struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The cluster in which this Repl is running.
 	Cluster string `protobuf:"bytes,1,opt,name=cluster,proto3" json:"cluster,omitempty"`
 	// The subcluster in which this Repl is running.
-	Subcluster string `protobuf:"bytes,2,opt,name=subcluster,proto3" json:"subcluster,omitempty"`
+	Subcluster    string `protobuf:"bytes,2,opt,name=subcluster,proto3" json:"subcluster,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ReplRuntimeInteractive) Reset() {
 	*x = ReplRuntimeInteractive{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_protos_external_goval_api_signing_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_protos_external_goval_api_signing_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ReplRuntimeInteractive) String() string {
@@ -1069,7 +1110,7 @@ func (*ReplRuntimeInteractive) ProtoMessage() {}
 
 func (x *ReplRuntimeInteractive) ProtoReflect() protoreflect.Message {
 	mi := &file_protos_external_goval_api_signing_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1099,23 +1140,20 @@ func (x *ReplRuntimeInteractive) GetSubcluster() string {
 }
 
 type ReplRuntimeHosting struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The cluster in which this Repl is running.
 	Cluster string `protobuf:"bytes,1,opt,name=cluster,proto3" json:"cluster,omitempty"`
 	// The subcluster in which this Repl is running.
-	Subcluster string `protobuf:"bytes,2,opt,name=subcluster,proto3" json:"subcluster,omitempty"`
+	Subcluster    string `protobuf:"bytes,2,opt,name=subcluster,proto3" json:"subcluster,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ReplRuntimeHosting) Reset() {
 	*x = ReplRuntimeHosting{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_protos_external_goval_api_signing_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_protos_external_goval_api_signing_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ReplRuntimeHosting) String() string {
@@ -1126,7 +1164,7 @@ func (*ReplRuntimeHosting) ProtoMessage() {}
 
 func (x *ReplRuntimeHosting) ProtoReflect() protoreflect.Message {
 	mi := &file_protos_external_goval_api_signing_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1156,18 +1194,16 @@ func (x *ReplRuntimeHosting) GetSubcluster() string {
 }
 
 type ReplRuntimeDeployment struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ReplRuntimeDeployment) Reset() {
 	*x = ReplRuntimeDeployment{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_protos_external_goval_api_signing_proto_msgTypes[8]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_protos_external_goval_api_signing_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ReplRuntimeDeployment) String() string {
@@ -1178,7 +1214,7 @@ func (*ReplRuntimeDeployment) ProtoMessage() {}
 
 func (x *ReplRuntimeDeployment) ProtoReflect() protoreflect.Message {
 	mi := &file_protos_external_goval_api_signing_proto_msgTypes[8]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1195,21 +1231,18 @@ func (*ReplRuntimeDeployment) Descriptor() ([]byte, []int) {
 
 // Org contains information about the org to which a Repl belongs.
 type Org struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Type          Org_OrgType            `protobuf:"varint,2,opt,name=type,proto3,enum=api.Org_OrgType" json:"type,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Id   string      `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	Type Org_OrgType `protobuf:"varint,2,opt,name=type,proto3,enum=api.Org_OrgType" json:"type,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Org) Reset() {
 	*x = Org{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_protos_external_goval_api_signing_proto_msgTypes[9]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_protos_external_goval_api_signing_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Org) String() string {
@@ -1220,7 +1253,7 @@ func (*Org) ProtoMessage() {}
 
 func (x *Org) ProtoReflect() protoreflect.Message {
 	mi := &file_protos_external_goval_api_signing_proto_msgTypes[9]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1251,169 +1284,125 @@ func (x *Org) GetType() Org_OrgType {
 
 var File_protos_external_goval_api_signing_proto protoreflect.FileDescriptor
 
-var file_protos_external_goval_api_signing_proto_rawDesc = []byte{
-	0x0a, 0x27, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x73, 0x2f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61,
-	0x6c, 0x2f, 0x67, 0x6f, 0x76, 0x61, 0x6c, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x73, 0x69, 0x67, 0x6e,
-	0x69, 0x6e, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x03, 0x61, 0x70, 0x69, 0x1a, 0x1f,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f,
-	0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a,
-	0x26, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x73, 0x2f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
-	0x2f, 0x67, 0x6f, 0x76, 0x61, 0x6c, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e,
-	0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xa0, 0x01, 0x0a, 0x15, 0x47, 0x6f, 0x76, 0x61,
-	0x6c, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74,
-	0x79, 0x12, 0x17, 0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x48, 0x00, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0b, 0x73, 0x69,
-	0x67, 0x6e, 0x65, 0x64, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48,
-	0x00, 0x52, 0x0a, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x43, 0x65, 0x72, 0x74, 0x12, 0x2b, 0x0a,
-	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x11,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f,
-	0x6e, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x0a, 0x06, 0x69, 0x73,
-	0x73, 0x75, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x69, 0x73, 0x73, 0x75,
-	0x65, 0x72, 0x42, 0x06, 0x0a, 0x04, 0x63, 0x65, 0x72, 0x74, 0x22, 0x8a, 0x02, 0x0a, 0x10, 0x43,
-	0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x12,
-	0x18, 0x0a, 0x06, 0x72, 0x65, 0x70, 0x6c, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48,
-	0x00, 0x52, 0x06, 0x72, 0x65, 0x70, 0x6c, 0x69, 0x64, 0x12, 0x14, 0x0a, 0x04, 0x75, 0x73, 0x65,
-	0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x12,
-	0x19, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x03,
-	0x48, 0x00, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1c, 0x0a, 0x03, 0x6f, 0x72,
-	0x67, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x08, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4f, 0x72,
-	0x67, 0x48, 0x00, 0x52, 0x03, 0x6f, 0x72, 0x67, 0x12, 0x1a, 0x0a, 0x07, 0x63, 0x6c, 0x75, 0x73,
-	0x74, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x07, 0x63, 0x6c, 0x75,
-	0x73, 0x74, 0x65, 0x72, 0x12, 0x20, 0x0a, 0x0a, 0x73, 0x75, 0x62, 0x63, 0x6c, 0x75, 0x73, 0x74,
-	0x65, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0a, 0x73, 0x75, 0x62, 0x63,
-	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x20, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x6c, 0x6f, 0x79,
-	0x6d, 0x65, 0x6e, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x0a, 0x64, 0x65,
-	0x70, 0x6c, 0x6f, 0x79, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x24, 0x0a, 0x04, 0x66, 0x6c, 0x61, 0x67,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x46, 0x6c, 0x61,
-	0x67, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x48, 0x00, 0x52, 0x04, 0x66, 0x6c, 0x61, 0x67, 0x42, 0x07,
-	0x0a, 0x05, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x22, 0xb4, 0x01, 0x0a, 0x09, 0x47, 0x6f, 0x76, 0x61,
-	0x6c, 0x43, 0x65, 0x72, 0x74, 0x12, 0x2c, 0x0a, 0x03, 0x69, 0x61, 0x74, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x03,
-	0x69, 0x61, 0x74, 0x12, 0x2c, 0x0a, 0x03, 0x65, 0x78, 0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x03, 0x65, 0x78,
-	0x70, 0x12, 0x2d, 0x0a, 0x06, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
-	0x61, 0x74, 0x65, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x52, 0x06, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x73,
-	0x12, 0x1c, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x18, 0x04, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x22, 0xf9,
-	0x01, 0x0a, 0x0a, 0x47, 0x6f, 0x76, 0x61, 0x6c, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2c, 0x0a,
-	0x03, 0x69, 0x61, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d,
-	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x03, 0x69, 0x61, 0x74, 0x12, 0x2c, 0x0a, 0x03, 0x65,
-	0x78, 0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x52, 0x03, 0x65, 0x78, 0x70, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65, 0x70,
-	0x6c, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x72, 0x65, 0x70, 0x6c, 0x69,
-	0x64, 0x12, 0x2f, 0x0a, 0x0a, 0x72, 0x65, 0x70, 0x6c, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x70, 0x6c,
-	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x48, 0x00, 0x52, 0x09, 0x72, 0x65, 0x70, 0x6c, 0x54, 0x6f, 0x6b,
-	0x65, 0x6e, 0x12, 0x3d, 0x0a, 0x0d, 0x72, 0x65, 0x70, 0x6c, 0x5f, 0x69, 0x64, 0x65, 0x6e, 0x74,
-	0x69, 0x74, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x47, 0x6f, 0x76, 0x61, 0x6c, 0x52, 0x65, 0x70, 0x6c, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74,
-	0x79, 0x48, 0x00, 0x52, 0x0c, 0x72, 0x65, 0x70, 0x6c, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74,
-	0x79, 0x42, 0x07, 0x0a, 0x05, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xf9, 0x03, 0x0a, 0x11, 0x47,
-	0x6f, 0x76, 0x61, 0x6c, 0x52, 0x65, 0x70, 0x6c, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79,
-	0x12, 0x16, 0x0a, 0x06, 0x72, 0x65, 0x70, 0x6c, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x06, 0x72, 0x65, 0x70, 0x6c, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x12, 0x12, 0x0a, 0x04,
-	0x73, 0x6c, 0x75, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x73, 0x6c, 0x75, 0x67,
-	0x12, 0x10, 0x0a, 0x03, 0x61, 0x75, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x61,
-	0x75, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c,
-	0x12, 0x22, 0x0a, 0x0c, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x70, 0x6c, 0x69, 0x64,
-	0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x52, 0x65,
-	0x70, 0x6c, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x2d, 0x0a,
-	0x0a, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x08, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x49, 0x6e, 0x66,
-	0x6f, 0x52, 0x09, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x17, 0x0a, 0x07,
-	0x69, 0x73, 0x5f, 0x74, 0x65, 0x61, 0x6d, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x69,
-	0x73, 0x54, 0x65, 0x61, 0x6d, 0x12, 0x14, 0x0a, 0x05, 0x72, 0x6f, 0x6c, 0x65, 0x73, 0x18, 0x0a,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x72, 0x6f, 0x6c, 0x65, 0x73, 0x12, 0x3f, 0x0a, 0x0b, 0x69,
-	0x6e, 0x74, 0x65, 0x72, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x70, 0x6c, 0x52, 0x75, 0x6e, 0x74, 0x69,
-	0x6d, 0x65, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x48, 0x00, 0x52,
-	0x0b, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x12, 0x33, 0x0a, 0x07,
-	0x68, 0x6f, 0x73, 0x74, 0x69, 0x6e, 0x67, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x70, 0x6c, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x48,
-	0x6f, 0x73, 0x74, 0x69, 0x6e, 0x67, 0x48, 0x00, 0x52, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x69, 0x6e,
-	0x67, 0x12, 0x3c, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x6d, 0x65, 0x6e, 0x74, 0x18,
-	0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x70, 0x6c,
-	0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x44, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x6d, 0x65, 0x6e,
-	0x74, 0x48, 0x00, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x6d, 0x65, 0x6e, 0x74, 0x12,
-	0x1a, 0x0a, 0x03, 0x6f, 0x72, 0x67, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x08, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x4f, 0x72, 0x67, 0x52, 0x03, 0x6f, 0x72, 0x67, 0x42, 0x09, 0x0a, 0x07, 0x72,
-	0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x22, 0x80, 0x01, 0x0a, 0x09, 0x42, 0x75, 0x69, 0x6c, 0x64,
-	0x49, 0x6e, 0x66, 0x6f, 0x12, 0x23, 0x0a, 0x0d, 0x64, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x6d, 0x65,
-	0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x70,
-	0x6c, 0x6f, 0x79, 0x6d, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x19, 0x0a, 0x08, 0x62,
-	0x75, 0x69, 0x6c, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x62,
-	0x75, 0x69, 0x6c, 0x64, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e,
-	0x65, 0x5f, 0x74, 0x69, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6d, 0x61,
-	0x63, 0x68, 0x69, 0x6e, 0x65, 0x54, 0x69, 0x65, 0x72, 0x22, 0x52, 0x0a, 0x16, 0x52, 0x65, 0x70,
-	0x6c, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x61, 0x63, 0x74,
-	0x69, 0x76, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x1e, 0x0a,
-	0x0a, 0x73, 0x75, 0x62, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0a, 0x73, 0x75, 0x62, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x22, 0x4e, 0x0a,
-	0x12, 0x52, 0x65, 0x70, 0x6c, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x48, 0x6f, 0x73, 0x74,
-	0x69, 0x6e, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x1e, 0x0a,
-	0x0a, 0x73, 0x75, 0x62, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0a, 0x73, 0x75, 0x62, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x22, 0x17, 0x0a,
-	0x15, 0x52, 0x65, 0x70, 0x6c, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x44, 0x65, 0x70, 0x6c,
-	0x6f, 0x79, 0x6d, 0x65, 0x6e, 0x74, 0x22, 0x74, 0x0a, 0x03, 0x4f, 0x72, 0x67, 0x12, 0x0e, 0x0a,
-	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x24, 0x0a,
-	0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x10, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x4f, 0x72, 0x67, 0x2e, 0x4f, 0x72, 0x67, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74,
-	0x79, 0x70, 0x65, 0x22, 0x37, 0x0a, 0x07, 0x4f, 0x72, 0x67, 0x54, 0x79, 0x70, 0x65, 0x12, 0x14,
-	0x0a, 0x10, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49,
-	0x45, 0x44, 0x10, 0x00, 0x12, 0x0c, 0x0a, 0x08, 0x50, 0x45, 0x52, 0x53, 0x4f, 0x4e, 0x41, 0x4c,
-	0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x54, 0x45, 0x41, 0x4d, 0x10, 0x02, 0x2a, 0x39, 0x0a, 0x0c,
-	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x13, 0x0a, 0x0f,
-	0x42, 0x41, 0x52, 0x45, 0x5f, 0x52, 0x45, 0x50, 0x4c, 0x5f, 0x54, 0x4f, 0x4b, 0x45, 0x4e, 0x10,
-	0x00, 0x12, 0x14, 0x0a, 0x10, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x41, 0x57, 0x41, 0x52, 0x45, 0x5f,
-	0x54, 0x4f, 0x4b, 0x45, 0x4e, 0x10, 0x01, 0x2a, 0xf0, 0x01, 0x0a, 0x09, 0x46, 0x6c, 0x61, 0x67,
-	0x43, 0x6c, 0x61, 0x69, 0x6d, 0x12, 0x14, 0x0a, 0x10, 0x4d, 0x49, 0x4e, 0x54, 0x5f, 0x47, 0x4f,
-	0x56, 0x41, 0x4c, 0x5f, 0x54, 0x4f, 0x4b, 0x45, 0x4e, 0x10, 0x00, 0x12, 0x1a, 0x0a, 0x16, 0x53,
-	0x49, 0x47, 0x4e, 0x5f, 0x49, 0x4e, 0x54, 0x45, 0x52, 0x4d, 0x45, 0x44, 0x49, 0x41, 0x54, 0x45,
-	0x5f, 0x43, 0x45, 0x52, 0x54, 0x10, 0x01, 0x12, 0x0c, 0x0a, 0x08, 0x49, 0x44, 0x45, 0x4e, 0x54,
-	0x49, 0x54, 0x59, 0x10, 0x05, 0x12, 0x0f, 0x0a, 0x0b, 0x47, 0x48, 0x4f, 0x53, 0x54, 0x57, 0x52,
-	0x49, 0x54, 0x45, 0x52, 0x10, 0x06, 0x12, 0x12, 0x0a, 0x0e, 0x52, 0x45, 0x4e, 0x45, 0x57, 0x5f,
-	0x49, 0x44, 0x45, 0x4e, 0x54, 0x49, 0x54, 0x59, 0x10, 0x07, 0x12, 0x0c, 0x0a, 0x08, 0x52, 0x45,
-	0x4e, 0x45, 0x57, 0x5f, 0x4b, 0x56, 0x10, 0x08, 0x12, 0x0f, 0x0a, 0x0b, 0x44, 0x45, 0x50, 0x4c,
-	0x4f, 0x59, 0x4d, 0x45, 0x4e, 0x54, 0x53, 0x10, 0x0a, 0x12, 0x0e, 0x0a, 0x0a, 0x41, 0x4e, 0x59,
-	0x5f, 0x52, 0x45, 0x50, 0x4c, 0x49, 0x44, 0x10, 0x02, 0x12, 0x0c, 0x0a, 0x08, 0x41, 0x4e, 0x59,
-	0x5f, 0x55, 0x53, 0x45, 0x52, 0x10, 0x03, 0x12, 0x0f, 0x0a, 0x0b, 0x41, 0x4e, 0x59, 0x5f, 0x55,
-	0x53, 0x45, 0x52, 0x5f, 0x49, 0x44, 0x10, 0x0b, 0x12, 0x0b, 0x0a, 0x07, 0x41, 0x4e, 0x59, 0x5f,
-	0x4f, 0x52, 0x47, 0x10, 0x0c, 0x12, 0x0f, 0x0a, 0x0b, 0x41, 0x4e, 0x59, 0x5f, 0x43, 0x4c, 0x55,
-	0x53, 0x54, 0x45, 0x52, 0x10, 0x04, 0x12, 0x12, 0x0a, 0x0e, 0x41, 0x4e, 0x59, 0x5f, 0x53, 0x55,
-	0x42, 0x43, 0x4c, 0x55, 0x53, 0x54, 0x45, 0x52, 0x10, 0x09, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69,
-	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x72, 0x65, 0x70, 0x6c, 0x69, 0x74, 0x2f,
-	0x67, 0x6f, 0x2d, 0x72, 0x65, 0x70, 0x6c, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x2f,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x73, 0x2f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f,
-	0x67, 0x6f, 0x76, 0x61, 0x6c, 0x2f, 0x61, 0x70, 0x69, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x33,
-}
+const file_protos_external_goval_api_signing_proto_rawDesc = "" +
+	"\n" +
+	"'protos/external/goval/api/signing.proto\x12\x03api\x1a\x1fgoogle/protobuf/timestamp.proto\x1a&protos/external/goval/api/client.proto\"\xa0\x01\n" +
+	"\x15GovalSigningAuthority\x12\x17\n" +
+	"\x06key_id\x18\x01 \x01(\tH\x00R\x05keyId\x12!\n" +
+	"\vsigned_cert\x18\x02 \x01(\tH\x00R\n" +
+	"signedCert\x12+\n" +
+	"\aversion\x18\x03 \x01(\x0e2\x11.api.TokenVersionR\aversion\x12\x16\n" +
+	"\x06issuer\x18\x04 \x01(\tR\x06issuerB\x06\n" +
+	"\x04cert\"\xd0\x02\n" +
+	"\x10CertificateClaim\x12\x18\n" +
+	"\x06replid\x18\x01 \x01(\tH\x00R\x06replid\x12\x14\n" +
+	"\x04user\x18\x02 \x01(\tH\x00R\x04user\x12\x19\n" +
+	"\auser_id\x18\a \x01(\x03H\x00R\x06userId\x12\x1c\n" +
+	"\x03org\x18\b \x01(\v2\b.api.OrgH\x00R\x03org\x12\x1a\n" +
+	"\acluster\x18\x04 \x01(\tH\x00R\acluster\x12 \n" +
+	"\n" +
+	"subcluster\x18\x05 \x01(\tH\x00R\n" +
+	"subcluster\x12 \n" +
+	"\n" +
+	"deployment\x18\x06 \x01(\bH\x00R\n" +
+	"deployment\x12$\n" +
+	"\x04flag\x18\x03 \x01(\x0e2\x0e.api.FlagClaimH\x00R\x04flag\x12D\n" +
+	"\x0frepl_created_at\x18\t \x01(\v2\x1a.google.protobuf.TimestampH\x00R\rreplCreatedAtB\a\n" +
+	"\x05claim\"\xb4\x01\n" +
+	"\tGovalCert\x12,\n" +
+	"\x03iat\x18\x01 \x01(\v2\x1a.google.protobuf.TimestampR\x03iat\x12,\n" +
+	"\x03exp\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\x03exp\x12-\n" +
+	"\x06claims\x18\x03 \x03(\v2\x15.api.CertificateClaimR\x06claims\x12\x1c\n" +
+	"\tpublicKey\x18\x04 \x01(\tR\tpublicKey\"\xf9\x01\n" +
+	"\n" +
+	"GovalToken\x12,\n" +
+	"\x03iat\x18\x01 \x01(\v2\x1a.google.protobuf.TimestampR\x03iat\x12,\n" +
+	"\x03exp\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\x03exp\x12\x16\n" +
+	"\x06replid\x18\x03 \x01(\tR\x06replid\x12/\n" +
+	"\n" +
+	"repl_token\x18\x04 \x01(\v2\x0e.api.ReplTokenH\x00R\treplToken\x12=\n" +
+	"\rrepl_identity\x18\x05 \x01(\v2\x16.api.GovalReplIdentityH\x00R\freplIdentityB\a\n" +
+	"\x05Token\"\xbd\x04\n" +
+	"\x11GovalReplIdentity\x12\x16\n" +
+	"\x06replid\x18\x01 \x01(\tR\x06replid\x12\x12\n" +
+	"\x04user\x18\x02 \x01(\tR\x04user\x12\x12\n" +
+	"\x04slug\x18\x03 \x01(\tR\x04slug\x12\x10\n" +
+	"\x03aud\x18\x04 \x01(\tR\x03aud\x12\x1c\n" +
+	"\tephemeral\x18\x05 \x01(\bR\tephemeral\x12\"\n" +
+	"\foriginReplid\x18\x06 \x01(\tR\foriginReplid\x12\x17\n" +
+	"\auser_id\x18\a \x01(\x03R\x06userId\x12-\n" +
+	"\n" +
+	"build_info\x18\b \x01(\v2\x0e.api.BuildInfoR\tbuildInfo\x12\x17\n" +
+	"\ais_team\x18\t \x01(\bR\x06isTeam\x12\x14\n" +
+	"\x05roles\x18\n" +
+	" \x03(\tR\x05roles\x12?\n" +
+	"\vinteractive\x18\v \x01(\v2\x1b.api.ReplRuntimeInteractiveH\x00R\vinteractive\x123\n" +
+	"\ahosting\x18\r \x01(\v2\x17.api.ReplRuntimeHostingH\x00R\ahosting\x12<\n" +
+	"\n" +
+	"deployment\x18\f \x01(\v2\x1a.api.ReplRuntimeDeploymentH\x00R\n" +
+	"deployment\x12\x1a\n" +
+	"\x03org\x18\x0e \x01(\v2\b.api.OrgR\x03org\x12B\n" +
+	"\x0frepl_created_at\x18\x0f \x01(\v2\x1a.google.protobuf.TimestampR\rreplCreatedAtB\t\n" +
+	"\aruntime\"\x80\x01\n" +
+	"\tBuildInfo\x12#\n" +
+	"\rdeployment_id\x18\x01 \x01(\tR\fdeploymentId\x12\x10\n" +
+	"\x03url\x18\x02 \x01(\tR\x03url\x12\x19\n" +
+	"\bbuild_id\x18\x03 \x01(\tR\abuildId\x12!\n" +
+	"\fmachine_tier\x18\x04 \x01(\tR\vmachineTier\"R\n" +
+	"\x16ReplRuntimeInteractive\x12\x18\n" +
+	"\acluster\x18\x01 \x01(\tR\acluster\x12\x1e\n" +
+	"\n" +
+	"subcluster\x18\x02 \x01(\tR\n" +
+	"subcluster\"N\n" +
+	"\x12ReplRuntimeHosting\x12\x18\n" +
+	"\acluster\x18\x01 \x01(\tR\acluster\x12\x1e\n" +
+	"\n" +
+	"subcluster\x18\x02 \x01(\tR\n" +
+	"subcluster\"\x17\n" +
+	"\x15ReplRuntimeDeployment\"t\n" +
+	"\x03Org\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x12$\n" +
+	"\x04type\x18\x02 \x01(\x0e2\x10.api.Org.OrgTypeR\x04type\"7\n" +
+	"\aOrgType\x12\x14\n" +
+	"\x10TYPE_UNSPECIFIED\x10\x00\x12\f\n" +
+	"\bPERSONAL\x10\x01\x12\b\n" +
+	"\x04TEAM\x10\x02*9\n" +
+	"\fTokenVersion\x12\x13\n" +
+	"\x0fBARE_REPL_TOKEN\x10\x00\x12\x14\n" +
+	"\x10TYPE_AWARE_TOKEN\x10\x01*\x89\x02\n" +
+	"\tFlagClaim\x12\x14\n" +
+	"\x10MINT_GOVAL_TOKEN\x10\x00\x12\x1a\n" +
+	"\x16SIGN_INTERMEDIATE_CERT\x10\x01\x12\f\n" +
+	"\bIDENTITY\x10\x05\x12\x0f\n" +
+	"\vGHOSTWRITER\x10\x06\x12\x12\n" +
+	"\x0eRENEW_IDENTITY\x10\a\x12\f\n" +
+	"\bRENEW_KV\x10\b\x12\x0f\n" +
+	"\vDEPLOYMENTS\x10\n" +
+	"\x12\x0e\n" +
+	"\n" +
+	"ANY_REPLID\x10\x02\x12\f\n" +
+	"\bANY_USER\x10\x03\x12\x0f\n" +
+	"\vANY_USER_ID\x10\v\x12\v\n" +
+	"\aANY_ORG\x10\f\x12\x0f\n" +
+	"\vANY_CLUSTER\x10\x04\x12\x12\n" +
+	"\x0eANY_SUBCLUSTER\x10\t\x12\x17\n" +
+	"\x13ANY_REPL_CREATED_AT\x10\rB=Z;github.com/replit/go-replidentity/protos/external/goval/apib\x06proto3"
 
 var (
 	file_protos_external_goval_api_signing_proto_rawDescOnce sync.Once
-	file_protos_external_goval_api_signing_proto_rawDescData = file_protos_external_goval_api_signing_proto_rawDesc
+	file_protos_external_goval_api_signing_proto_rawDescData []byte
 )
 
 func file_protos_external_goval_api_signing_proto_rawDescGZIP() []byte {
 	file_protos_external_goval_api_signing_proto_rawDescOnce.Do(func() {
-		file_protos_external_goval_api_signing_proto_rawDescData = protoimpl.X.CompressGZIP(file_protos_external_goval_api_signing_proto_rawDescData)
+		file_protos_external_goval_api_signing_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_protos_external_goval_api_signing_proto_rawDesc), len(file_protos_external_goval_api_signing_proto_rawDesc)))
 	})
 	return file_protos_external_goval_api_signing_proto_rawDescData
 }
 
 var file_protos_external_goval_api_signing_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
 var file_protos_external_goval_api_signing_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
-var file_protos_external_goval_api_signing_proto_goTypes = []interface{}{
+var file_protos_external_goval_api_signing_proto_goTypes = []any{
 	(TokenVersion)(0),              // 0: api.TokenVersion
 	(FlagClaim)(0),                 // 1: api.FlagClaim
 	(Org_OrgType)(0),               // 2: api.Org.OrgType
@@ -1434,24 +1423,26 @@ var file_protos_external_goval_api_signing_proto_depIdxs = []int32{
 	0,  // 0: api.GovalSigningAuthority.version:type_name -> api.TokenVersion
 	12, // 1: api.CertificateClaim.org:type_name -> api.Org
 	1,  // 2: api.CertificateClaim.flag:type_name -> api.FlagClaim
-	13, // 3: api.GovalCert.iat:type_name -> google.protobuf.Timestamp
-	13, // 4: api.GovalCert.exp:type_name -> google.protobuf.Timestamp
-	4,  // 5: api.GovalCert.claims:type_name -> api.CertificateClaim
-	13, // 6: api.GovalToken.iat:type_name -> google.protobuf.Timestamp
-	13, // 7: api.GovalToken.exp:type_name -> google.protobuf.Timestamp
-	14, // 8: api.GovalToken.repl_token:type_name -> api.ReplToken
-	7,  // 9: api.GovalToken.repl_identity:type_name -> api.GovalReplIdentity
-	8,  // 10: api.GovalReplIdentity.build_info:type_name -> api.BuildInfo
-	9,  // 11: api.GovalReplIdentity.interactive:type_name -> api.ReplRuntimeInteractive
-	10, // 12: api.GovalReplIdentity.hosting:type_name -> api.ReplRuntimeHosting
-	11, // 13: api.GovalReplIdentity.deployment:type_name -> api.ReplRuntimeDeployment
-	12, // 14: api.GovalReplIdentity.org:type_name -> api.Org
-	2,  // 15: api.Org.type:type_name -> api.Org.OrgType
-	16, // [16:16] is the sub-list for method output_type
-	16, // [16:16] is the sub-list for method input_type
-	16, // [16:16] is the sub-list for extension type_name
-	16, // [16:16] is the sub-list for extension extendee
-	0,  // [0:16] is the sub-list for field type_name
+	13, // 3: api.CertificateClaim.repl_created_at:type_name -> google.protobuf.Timestamp
+	13, // 4: api.GovalCert.iat:type_name -> google.protobuf.Timestamp
+	13, // 5: api.GovalCert.exp:type_name -> google.protobuf.Timestamp
+	4,  // 6: api.GovalCert.claims:type_name -> api.CertificateClaim
+	13, // 7: api.GovalToken.iat:type_name -> google.protobuf.Timestamp
+	13, // 8: api.GovalToken.exp:type_name -> google.protobuf.Timestamp
+	14, // 9: api.GovalToken.repl_token:type_name -> api.ReplToken
+	7,  // 10: api.GovalToken.repl_identity:type_name -> api.GovalReplIdentity
+	8,  // 11: api.GovalReplIdentity.build_info:type_name -> api.BuildInfo
+	9,  // 12: api.GovalReplIdentity.interactive:type_name -> api.ReplRuntimeInteractive
+	10, // 13: api.GovalReplIdentity.hosting:type_name -> api.ReplRuntimeHosting
+	11, // 14: api.GovalReplIdentity.deployment:type_name -> api.ReplRuntimeDeployment
+	12, // 15: api.GovalReplIdentity.org:type_name -> api.Org
+	13, // 16: api.GovalReplIdentity.repl_created_at:type_name -> google.protobuf.Timestamp
+	2,  // 17: api.Org.type:type_name -> api.Org.OrgType
+	18, // [18:18] is the sub-list for method output_type
+	18, // [18:18] is the sub-list for method input_type
+	18, // [18:18] is the sub-list for extension type_name
+	18, // [18:18] is the sub-list for extension extendee
+	0,  // [0:18] is the sub-list for field type_name
 }
 
 func init() { file_protos_external_goval_api_signing_proto_init() }
@@ -1460,133 +1451,11 @@ func file_protos_external_goval_api_signing_proto_init() {
 		return
 	}
 	file_protos_external_goval_api_client_proto_init()
-	if !protoimpl.UnsafeEnabled {
-		file_protos_external_goval_api_signing_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GovalSigningAuthority); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_protos_external_goval_api_signing_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CertificateClaim); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_protos_external_goval_api_signing_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GovalCert); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_protos_external_goval_api_signing_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GovalToken); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_protos_external_goval_api_signing_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GovalReplIdentity); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_protos_external_goval_api_signing_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*BuildInfo); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_protos_external_goval_api_signing_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReplRuntimeInteractive); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_protos_external_goval_api_signing_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReplRuntimeHosting); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_protos_external_goval_api_signing_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReplRuntimeDeployment); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_protos_external_goval_api_signing_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Org); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
-	file_protos_external_goval_api_signing_proto_msgTypes[0].OneofWrappers = []interface{}{
+	file_protos_external_goval_api_signing_proto_msgTypes[0].OneofWrappers = []any{
 		(*GovalSigningAuthority_KeyId)(nil),
 		(*GovalSigningAuthority_SignedCert)(nil),
 	}
-	file_protos_external_goval_api_signing_proto_msgTypes[1].OneofWrappers = []interface{}{
+	file_protos_external_goval_api_signing_proto_msgTypes[1].OneofWrappers = []any{
 		(*CertificateClaim_Replid)(nil),
 		(*CertificateClaim_User)(nil),
 		(*CertificateClaim_UserId)(nil),
@@ -1595,12 +1464,13 @@ func file_protos_external_goval_api_signing_proto_init() {
 		(*CertificateClaim_Subcluster)(nil),
 		(*CertificateClaim_Deployment)(nil),
 		(*CertificateClaim_Flag)(nil),
+		(*CertificateClaim_ReplCreatedAt)(nil),
 	}
-	file_protos_external_goval_api_signing_proto_msgTypes[3].OneofWrappers = []interface{}{
+	file_protos_external_goval_api_signing_proto_msgTypes[3].OneofWrappers = []any{
 		(*GovalToken_ReplToken)(nil),
 		(*GovalToken_ReplIdentity)(nil),
 	}
-	file_protos_external_goval_api_signing_proto_msgTypes[4].OneofWrappers = []interface{}{
+	file_protos_external_goval_api_signing_proto_msgTypes[4].OneofWrappers = []any{
 		(*GovalReplIdentity_Interactive)(nil),
 		(*GovalReplIdentity_Hosting)(nil),
 		(*GovalReplIdentity_Deployment)(nil),
@@ -1609,7 +1479,7 @@ func file_protos_external_goval_api_signing_proto_init() {
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_protos_external_goval_api_signing_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_protos_external_goval_api_signing_proto_rawDesc), len(file_protos_external_goval_api_signing_proto_rawDesc)),
 			NumEnums:      3,
 			NumMessages:   10,
 			NumExtensions: 0,
@@ -1621,7 +1491,6 @@ func file_protos_external_goval_api_signing_proto_init() {
 		MessageInfos:      file_protos_external_goval_api_signing_proto_msgTypes,
 	}.Build()
 	File_protos_external_goval_api_signing_proto = out.File
-	file_protos_external_goval_api_signing_proto_rawDesc = nil
 	file_protos_external_goval_api_signing_proto_goTypes = nil
 	file_protos_external_goval_api_signing_proto_depIdxs = nil
 }
diff --git a/protos/external/goval/api/signing.proto b/protos/external/goval/api/signing.proto
index 4881648..9d238de 100644
--- a/protos/external/goval/api/signing.proto
+++ b/protos/external/goval/api/signing.proto
@@ -98,6 +98,9 @@ enum FlagClaim {
   // the list explicitly enumerated by the other claims. If that list is empty,
   // the cert has no ability to sign any tokens that have a subcluster.
   ANY_SUBCLUSTER = 9;
+
+  // PROP-220 wildcard for arbitrary CertificateClaim.repl_created_at values.
+  ANY_REPL_CREATED_AT = 13;
 }
 
 // Claims are actions that a cert is allowed to do. Claims can be repeated (e.g.
@@ -132,6 +135,9 @@ message CertificateClaim {
     // This cert has the authority to perform an action as described in
     // FlagClaim
     FlagClaim flag = 3;
+    // PROP-220: chain-bound repl creation timestamp. The identity
+    // body's repl_created_at must match this claim exactly.
+    google.protobuf.Timestamp repl_created_at = 9;
   }
 }
 
@@ -248,6 +254,8 @@ message GovalReplIdentity {
   }
   // The organization that owns the Repl
   Org org = 14;
+  // When the Repl was created. Optional. See PROP-220.
+  google.protobuf.Timestamp repl_created_at = 15;
 }
 
 // BuildInfo includes information about which deployment this repl is allowed to