code: func (impl *repoImpl) CreateRef(c context.Context, r *api.Ref) (resp *empty.Empty, err error) {
  	defer func() { err = grpcutil.GRPCifyAndLogErr(c, err) }()
  
  	// Validate the request.
  	if err := common.ValidatePackageRef(r.Name); err != nil {
  		return nil, status.Errorf(codes.InvalidArgument, "bad 'name' - %s", err)
  	}
  	if err := common.ValidatePackageName(r.Package); err != nil {
  		return nil, status.Errorf(codes.InvalidArgument, "bad 'package' - %s", err)
  	}
  	if err := common.ValidateObjectRef(r.Instance, common.KnownHash); err != nil {
  		return nil, status.Errorf(codes.InvalidArgument, "bad 'instance' - %s", err)
  	}
  
  	// Check ACLs.
  	if _, err := impl.checkRole(c, r.Package, api.Role_WRITER); err != nil {
  		return nil, err
  	}
  
  	// Actually create or move the ref. This will also transactionally check the
  	// instance exists and it has passed the processing successfully.
  	inst := &model.Instance{
  		InstanceID: common.ObjectRefToInstanceID(r.Instance),
  		Package:    model.PackageKey(c, r.Package),
  	}
  	if err := model.SetRef(c, r.Name, inst); err != nil {
  		return nil, err
  	}
  	return &empty.Empty{}, nil
  }
docs: ////////////////////////////////////////////////////////////////////////////////
  // Refs support.
  // CreateRef implements the corresponding RPC method, see the proto doc.