diff --git a/api/agentmesh.pb.go b/api/agentmesh.pb.go
index f75184d7..d06b591a 100644
--- a/api/agentmesh.pb.go
+++ b/api/agentmesh.pb.go
@@ -4791,7 +4791,7 @@ func (x *NodeServices) GetReportTime() *timestamppb.Timestamp {
 }
 
 // AdminStatusResponse answers GET /admin/status: everything the console
-// shows an administrator.
+// shows an administrator, except expired nodes (see GET /user/nodes).
 type AdminStatusResponse struct {
 	state              protoimpl.MessageState `protogen:"open.v1"`
 	Users              []*User                `protobuf:"bytes,1,rep,name=users,proto3" json:"users,omitempty"`
@@ -4885,9 +4885,9 @@ func (x *AdminStatusResponse) GetNodeCatalog() map[string]*NodeServices {
 	return nil
 }
 
-// UserStatusResponse answers GET /user/status: the caller and what it owns.
-// The router fleet and the mesh policy describe the whole mesh and are set
-// for an administrator only.
+// UserStatusResponse answers GET /user/status: the caller and what it owns,
+// except expired nodes (see GET /user/nodes). The router fleet and the mesh
+// policy describe the whole mesh and are set for an administrator only.
 type UserStatusResponse struct {
 	state           protoimpl.MessageState `protogen:"open.v1"`
 	User            *User                  `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
@@ -4964,6 +4964,63 @@ func (x *UserStatusResponse) GetPolicy() *PolicyConfig {
 	return nil
 }
 
+// NodeListResponse answers GET /user/nodes: enrolled nodes, newest enrollment
+// first, page_size (default 50, at most 200) at a time. state (admitted,
+// expired or banned, repeatable) and role narrow the list. An administrator
+// sees every owner's nodes and may pick one with owner_id; a user sees its own.
+type NodeListResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	Nodes []*EnrolledNode        `protobuf:"bytes,1,rep,name=nodes,proto3" json:"nodes,omitempty"`
+	// Pass as page_token for the next page; empty on the last page.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *NodeListResponse) Reset() {
+	*x = NodeListResponse{}
+	mi := &file_api_agentmesh_proto_msgTypes[61]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *NodeListResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NodeListResponse) ProtoMessage() {}
+
+func (x *NodeListResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_agentmesh_proto_msgTypes[61]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NodeListResponse.ProtoReflect.Descriptor instead.
+func (*NodeListResponse) Descriptor() ([]byte, []int) {
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{61}
+}
+
+func (x *NodeListResponse) GetNodes() []*EnrolledNode {
+	if x != nil {
+		return x.Nodes
+	}
+	return nil
+}
+
+func (x *NodeListResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
 type IdentityEvidenceResponse struct {
 	state                   protoimpl.MessageState `protogen:"open.v1"`
 	PeerId                  string                 `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
@@ -4978,7 +5035,7 @@ type IdentityEvidenceResponse struct {
 
 func (x *IdentityEvidenceResponse) Reset() {
 	*x = IdentityEvidenceResponse{}
-	mi := &file_api_agentmesh_proto_msgTypes[61]
+	mi := &file_api_agentmesh_proto_msgTypes[62]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4990,7 +5047,7 @@ func (x *IdentityEvidenceResponse) String() string {
 func (*IdentityEvidenceResponse) ProtoMessage() {}
 
 func (x *IdentityEvidenceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[61]
+	mi := &file_api_agentmesh_proto_msgTypes[62]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5003,7 +5060,7 @@ func (x *IdentityEvidenceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IdentityEvidenceResponse.ProtoReflect.Descriptor instead.
 func (*IdentityEvidenceResponse) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{61}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{62}
 }
 
 func (x *IdentityEvidenceResponse) GetPeerId() string {
@@ -5064,7 +5121,7 @@ type PeerEvidenceResponse struct {
 
 func (x *PeerEvidenceResponse) Reset() {
 	*x = PeerEvidenceResponse{}
-	mi := &file_api_agentmesh_proto_msgTypes[62]
+	mi := &file_api_agentmesh_proto_msgTypes[63]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5076,7 +5133,7 @@ func (x *PeerEvidenceResponse) String() string {
 func (*PeerEvidenceResponse) ProtoMessage() {}
 
 func (x *PeerEvidenceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[62]
+	mi := &file_api_agentmesh_proto_msgTypes[63]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5089,7 +5146,7 @@ func (x *PeerEvidenceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PeerEvidenceResponse.ProtoReflect.Descriptor instead.
 func (*PeerEvidenceResponse) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{62}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{63}
 }
 
 func (x *PeerEvidenceResponse) GetPeerId() string {
@@ -5174,7 +5231,7 @@ type MemberCredential struct {
 
 func (x *MemberCredential) Reset() {
 	*x = MemberCredential{}
-	mi := &file_api_agentmesh_proto_msgTypes[63]
+	mi := &file_api_agentmesh_proto_msgTypes[64]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5186,7 +5243,7 @@ func (x *MemberCredential) String() string {
 func (*MemberCredential) ProtoMessage() {}
 
 func (x *MemberCredential) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[63]
+	mi := &file_api_agentmesh_proto_msgTypes[64]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5199,7 +5256,7 @@ func (x *MemberCredential) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MemberCredential.ProtoReflect.Descriptor instead.
 func (*MemberCredential) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{63}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{64}
 }
 
 func (x *MemberCredential) GetControlPlaneUrl() string {
@@ -5264,7 +5321,7 @@ type TrustedSigningKey struct {
 
 func (x *TrustedSigningKey) Reset() {
 	*x = TrustedSigningKey{}
-	mi := &file_api_agentmesh_proto_msgTypes[64]
+	mi := &file_api_agentmesh_proto_msgTypes[65]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5276,7 +5333,7 @@ func (x *TrustedSigningKey) String() string {
 func (*TrustedSigningKey) ProtoMessage() {}
 
 func (x *TrustedSigningKey) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[64]
+	mi := &file_api_agentmesh_proto_msgTypes[65]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5289,7 +5346,7 @@ func (x *TrustedSigningKey) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TrustedSigningKey.ProtoReflect.Descriptor instead.
 func (*TrustedSigningKey) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{64}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{65}
 }
 
 func (x *TrustedSigningKey) GetPublicKey() []byte {
@@ -5318,7 +5375,7 @@ type OIDCSession struct {
 
 func (x *OIDCSession) Reset() {
 	*x = OIDCSession{}
-	mi := &file_api_agentmesh_proto_msgTypes[65]
+	mi := &file_api_agentmesh_proto_msgTypes[66]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5330,7 +5387,7 @@ func (x *OIDCSession) String() string {
 func (*OIDCSession) ProtoMessage() {}
 
 func (x *OIDCSession) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[65]
+	mi := &file_api_agentmesh_proto_msgTypes[66]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5343,7 +5400,7 @@ func (x *OIDCSession) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OIDCSession.ProtoReflect.Descriptor instead.
 func (*OIDCSession) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{65}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{66}
 }
 
 func (x *OIDCSession) GetIssuer() string {
@@ -5395,7 +5452,7 @@ type TaskAuthorizationRule struct {
 
 func (x *TaskAuthorizationRule) Reset() {
 	*x = TaskAuthorizationRule{}
-	mi := &file_api_agentmesh_proto_msgTypes[66]
+	mi := &file_api_agentmesh_proto_msgTypes[67]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5407,7 +5464,7 @@ func (x *TaskAuthorizationRule) String() string {
 func (*TaskAuthorizationRule) ProtoMessage() {}
 
 func (x *TaskAuthorizationRule) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[66]
+	mi := &file_api_agentmesh_proto_msgTypes[67]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5420,7 +5477,7 @@ func (x *TaskAuthorizationRule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TaskAuthorizationRule.ProtoReflect.Descriptor instead.
 func (*TaskAuthorizationRule) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{66}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{67}
 }
 
 func (x *TaskAuthorizationRule) GetName() string {
@@ -5472,7 +5529,7 @@ type TaskRule struct {
 
 func (x *TaskRule) Reset() {
 	*x = TaskRule{}
-	mi := &file_api_agentmesh_proto_msgTypes[67]
+	mi := &file_api_agentmesh_proto_msgTypes[68]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5484,7 +5541,7 @@ func (x *TaskRule) String() string {
 func (*TaskRule) ProtoMessage() {}
 
 func (x *TaskRule) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[67]
+	mi := &file_api_agentmesh_proto_msgTypes[68]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5497,7 +5554,7 @@ func (x *TaskRule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TaskRule.ProtoReflect.Descriptor instead.
 func (*TaskRule) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{67}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{68}
 }
 
 func (x *TaskRule) GetDescription() string {
@@ -5546,7 +5603,7 @@ type TaskOperation struct {
 
 func (x *TaskOperation) Reset() {
 	*x = TaskOperation{}
-	mi := &file_api_agentmesh_proto_msgTypes[68]
+	mi := &file_api_agentmesh_proto_msgTypes[69]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5558,7 +5615,7 @@ func (x *TaskOperation) String() string {
 func (*TaskOperation) ProtoMessage() {}
 
 func (x *TaskOperation) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[68]
+	mi := &file_api_agentmesh_proto_msgTypes[69]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5571,7 +5628,7 @@ func (x *TaskOperation) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TaskOperation.ProtoReflect.Descriptor instead.
 func (*TaskOperation) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{68}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{69}
 }
 
 func (x *TaskOperation) GetAllowedTools() []string {
@@ -5631,7 +5688,7 @@ type TokenExchangeRequest struct {
 
 func (x *TokenExchangeRequest) Reset() {
 	*x = TokenExchangeRequest{}
-	mi := &file_api_agentmesh_proto_msgTypes[69]
+	mi := &file_api_agentmesh_proto_msgTypes[70]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5643,7 +5700,7 @@ func (x *TokenExchangeRequest) String() string {
 func (*TokenExchangeRequest) ProtoMessage() {}
 
 func (x *TokenExchangeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[69]
+	mi := &file_api_agentmesh_proto_msgTypes[70]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5656,7 +5713,7 @@ func (x *TokenExchangeRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenExchangeRequest.ProtoReflect.Descriptor instead.
 func (*TokenExchangeRequest) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{69}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{70}
 }
 
 func (x *TokenExchangeRequest) GetSubjectToken() string {
@@ -5706,7 +5763,7 @@ type TokenExchangeResponse struct {
 
 func (x *TokenExchangeResponse) Reset() {
 	*x = TokenExchangeResponse{}
-	mi := &file_api_agentmesh_proto_msgTypes[70]
+	mi := &file_api_agentmesh_proto_msgTypes[71]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5718,7 +5775,7 @@ func (x *TokenExchangeResponse) String() string {
 func (*TokenExchangeResponse) ProtoMessage() {}
 
 func (x *TokenExchangeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[70]
+	mi := &file_api_agentmesh_proto_msgTypes[71]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5731,7 +5788,7 @@ func (x *TokenExchangeResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenExchangeResponse.ProtoReflect.Descriptor instead.
 func (*TokenExchangeResponse) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{70}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{71}
 }
 
 func (x *TokenExchangeResponse) GetBiscuitToken() []byte {
@@ -5787,7 +5844,7 @@ type STSTokenRequest struct {
 
 func (x *STSTokenRequest) Reset() {
 	*x = STSTokenRequest{}
-	mi := &file_api_agentmesh_proto_msgTypes[71]
+	mi := &file_api_agentmesh_proto_msgTypes[72]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5799,7 +5856,7 @@ func (x *STSTokenRequest) String() string {
 func (*STSTokenRequest) ProtoMessage() {}
 
 func (x *STSTokenRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[71]
+	mi := &file_api_agentmesh_proto_msgTypes[72]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5812,7 +5869,7 @@ func (x *STSTokenRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use STSTokenRequest.ProtoReflect.Descriptor instead.
 func (*STSTokenRequest) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{71}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{72}
 }
 
 func (x *STSTokenRequest) GetBiscuit() []byte {
@@ -5863,7 +5920,7 @@ type STSTokenResponse struct {
 
 func (x *STSTokenResponse) Reset() {
 	*x = STSTokenResponse{}
-	mi := &file_api_agentmesh_proto_msgTypes[72]
+	mi := &file_api_agentmesh_proto_msgTypes[73]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5875,7 +5932,7 @@ func (x *STSTokenResponse) String() string {
 func (*STSTokenResponse) ProtoMessage() {}
 
 func (x *STSTokenResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[72]
+	mi := &file_api_agentmesh_proto_msgTypes[73]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5888,7 +5945,7 @@ func (x *STSTokenResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use STSTokenResponse.ProtoReflect.Descriptor instead.
 func (*STSTokenResponse) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{72}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{73}
 }
 
 func (x *STSTokenResponse) GetJwt() string {
@@ -5939,7 +5996,7 @@ type RevocationsResponse struct {
 
 func (x *RevocationsResponse) Reset() {
 	*x = RevocationsResponse{}
-	mi := &file_api_agentmesh_proto_msgTypes[73]
+	mi := &file_api_agentmesh_proto_msgTypes[74]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5951,7 +6008,7 @@ func (x *RevocationsResponse) String() string {
 func (*RevocationsResponse) ProtoMessage() {}
 
 func (x *RevocationsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[73]
+	mi := &file_api_agentmesh_proto_msgTypes[74]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5964,7 +6021,7 @@ func (x *RevocationsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RevocationsResponse.ProtoReflect.Descriptor instead.
 func (*RevocationsResponse) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{73}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{74}
 }
 
 func (x *RevocationsResponse) GetRevocationIds() []string {
@@ -6374,7 +6431,10 @@ const file_api_agentmesh_proto_rawDesc = "" +
 	"\x0eenrolled_nodes\x18\x02 \x03(\v2\x1a.agentmesh.v1.EnrolledNodeR\renrolledNodes\x12G\n" +
 	"\x10bootstrap_tokens\x18\x03 \x03(\v2\x1c.agentmesh.v1.BootstrapTokenR\x0fbootstrapTokens\x12@\n" +
 	"\x0eactive_routers\x18\x04 \x03(\v2\x19.agentmesh.v1.RouterLeaseR\ractiveRouters\x122\n" +
-	"\x06policy\x18\x05 \x01(\v2\x1a.agentmesh.v1.PolicyConfigR\x06policy\"\xbd\x02\n" +
+	"\x06policy\x18\x05 \x01(\v2\x1a.agentmesh.v1.PolicyConfigR\x06policy\"l\n" +
+	"\x10NodeListResponse\x120\n" +
+	"\x05nodes\x18\x01 \x03(\v2\x1a.agentmesh.v1.EnrolledNodeR\x05nodes\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"\xbd\x02\n" +
 	"\x18IdentityEvidenceResponse\x12\x17\n" +
 	"\apeer_id\x18\x01 \x01(\tR\x06peerId\x12\x18\n" +
 	"\abiscuit\x18\x02 \x01(\fR\abiscuit\x12J\n" +
@@ -6491,7 +6551,7 @@ func file_api_agentmesh_proto_rawDescGZIP() []byte {
 }
 
 var file_api_agentmesh_proto_enumTypes = make([]protoimpl.EnumInfo, 8)
-var file_api_agentmesh_proto_msgTypes = make([]protoimpl.MessageInfo, 82)
+var file_api_agentmesh_proto_msgTypes = make([]protoimpl.MessageInfo, 83)
 var file_api_agentmesh_proto_goTypes = []any{
 	(EnrollmentStatus)(0),                 // 0: agentmesh.v1.EnrollmentStatus
 	(ServiceType)(0),                      // 1: agentmesh.v1.ServiceType
@@ -6562,135 +6622,137 @@ var file_api_agentmesh_proto_goTypes = []any{
 	(*NodeServices)(nil),                  // 66: agentmesh.v1.NodeServices
 	(*AdminStatusResponse)(nil),           // 67: agentmesh.v1.AdminStatusResponse
 	(*UserStatusResponse)(nil),            // 68: agentmesh.v1.UserStatusResponse
-	(*IdentityEvidenceResponse)(nil),      // 69: agentmesh.v1.IdentityEvidenceResponse
-	(*PeerEvidenceResponse)(nil),          // 70: agentmesh.v1.PeerEvidenceResponse
-	(*MemberCredential)(nil),              // 71: agentmesh.v1.MemberCredential
-	(*TrustedSigningKey)(nil),             // 72: agentmesh.v1.TrustedSigningKey
-	(*OIDCSession)(nil),                   // 73: agentmesh.v1.OIDCSession
-	(*TaskAuthorizationRule)(nil),         // 74: agentmesh.v1.TaskAuthorizationRule
-	(*TaskRule)(nil),                      // 75: agentmesh.v1.TaskRule
-	(*TaskOperation)(nil),                 // 76: agentmesh.v1.TaskOperation
-	(*TokenExchangeRequest)(nil),          // 77: agentmesh.v1.TokenExchangeRequest
-	(*TokenExchangeResponse)(nil),         // 78: agentmesh.v1.TokenExchangeResponse
-	(*STSTokenRequest)(nil),               // 79: agentmesh.v1.STSTokenRequest
-	(*STSTokenResponse)(nil),              // 80: agentmesh.v1.STSTokenResponse
-	(*RevocationsResponse)(nil),           // 81: agentmesh.v1.RevocationsResponse
-	nil,                                   // 82: agentmesh.v1.EnrollRequest.LabelsEntry
-	nil,                                   // 83: agentmesh.v1.BootstrapEnrollRequest.LabelsEntry
-	nil,                                   // 84: agentmesh.v1.CommandBackend.EnvEntry
-	nil,                                   // 85: agentmesh.v1.RouterInfo.LabelsEntry
-	nil,                                   // 86: agentmesh.v1.EnrollmentRequest.LabelsEntry
-	nil,                                   // 87: agentmesh.v1.EnrolledNode.LabelsEntry
-	nil,                                   // 88: agentmesh.v1.AdminStatusResponse.NodeCatalogEntry
-	nil,                                   // 89: agentmesh.v1.PeerEvidenceResponse.LabelsEntry
-	(*durationpb.Duration)(nil),           // 90: google.protobuf.Duration
-	(*timestamppb.Timestamp)(nil),         // 91: google.protobuf.Timestamp
+	(*NodeListResponse)(nil),              // 69: agentmesh.v1.NodeListResponse
+	(*IdentityEvidenceResponse)(nil),      // 70: agentmesh.v1.IdentityEvidenceResponse
+	(*PeerEvidenceResponse)(nil),          // 71: agentmesh.v1.PeerEvidenceResponse
+	(*MemberCredential)(nil),              // 72: agentmesh.v1.MemberCredential
+	(*TrustedSigningKey)(nil),             // 73: agentmesh.v1.TrustedSigningKey
+	(*OIDCSession)(nil),                   // 74: agentmesh.v1.OIDCSession
+	(*TaskAuthorizationRule)(nil),         // 75: agentmesh.v1.TaskAuthorizationRule
+	(*TaskRule)(nil),                      // 76: agentmesh.v1.TaskRule
+	(*TaskOperation)(nil),                 // 77: agentmesh.v1.TaskOperation
+	(*TokenExchangeRequest)(nil),          // 78: agentmesh.v1.TokenExchangeRequest
+	(*TokenExchangeResponse)(nil),         // 79: agentmesh.v1.TokenExchangeResponse
+	(*STSTokenRequest)(nil),               // 80: agentmesh.v1.STSTokenRequest
+	(*STSTokenResponse)(nil),              // 81: agentmesh.v1.STSTokenResponse
+	(*RevocationsResponse)(nil),           // 82: agentmesh.v1.RevocationsResponse
+	nil,                                   // 83: agentmesh.v1.EnrollRequest.LabelsEntry
+	nil,                                   // 84: agentmesh.v1.BootstrapEnrollRequest.LabelsEntry
+	nil,                                   // 85: agentmesh.v1.CommandBackend.EnvEntry
+	nil,                                   // 86: agentmesh.v1.RouterInfo.LabelsEntry
+	nil,                                   // 87: agentmesh.v1.EnrollmentRequest.LabelsEntry
+	nil,                                   // 88: agentmesh.v1.EnrolledNode.LabelsEntry
+	nil,                                   // 89: agentmesh.v1.AdminStatusResponse.NodeCatalogEntry
+	nil,                                   // 90: agentmesh.v1.PeerEvidenceResponse.LabelsEntry
+	(*durationpb.Duration)(nil),           // 91: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),         // 92: google.protobuf.Timestamp
 }
 var file_api_agentmesh_proto_depIdxs = []int32{
-	4,  // 0: agentmesh.v1.RouterGoAway.reason:type_name -> agentmesh.v1.RouterGoAway.Reason
-	90, // 1: agentmesh.v1.RouterGoAway.retry_after:type_name -> google.protobuf.Duration
-	5,  // 2: agentmesh.v1.MeshEvent.type:type_name -> agentmesh.v1.MeshEvent.Type
-	91, // 3: agentmesh.v1.MeshEvent.event_time:type_name -> google.protobuf.Timestamp
-	82, // 4: agentmesh.v1.EnrollRequest.labels:type_name -> agentmesh.v1.EnrollRequest.LabelsEntry
-	91, // 5: agentmesh.v1.EnrollResponse.expire_time:type_name -> google.protobuf.Timestamp
-	83, // 6: agentmesh.v1.BootstrapEnrollRequest.labels:type_name -> agentmesh.v1.BootstrapEnrollRequest.LabelsEntry
-	0,  // 7: agentmesh.v1.BootstrapEnrollResponse.status:type_name -> agentmesh.v1.EnrollmentStatus
-	91, // 8: agentmesh.v1.BootstrapEnrollResponse.expire_time:type_name -> google.protobuf.Timestamp
-	1,  // 9: agentmesh.v1.ServiceInfo.type:type_name -> agentmesh.v1.ServiceType
-	84, // 10: agentmesh.v1.CommandBackend.env:type_name -> agentmesh.v1.CommandBackend.EnvEntry
-	16, // 11: agentmesh.v1.RegisterServiceRequest.service:type_name -> agentmesh.v1.ServiceInfo
-	17, // 12: agentmesh.v1.RegisterServiceRequest.command:type_name -> agentmesh.v1.CommandBackend
-	29, // 13: agentmesh.v1.ControlPlaneInfoResponse.routers:type_name -> agentmesh.v1.RouterInfo
-	21, // 14: agentmesh.v1.ControlPlaneInfoResponse.directory:type_name -> agentmesh.v1.DirectoryParameters
-	90, // 15: agentmesh.v1.DirectoryParameters.reprovide_interval:type_name -> google.protobuf.Duration
-	90, // 16: agentmesh.v1.DirectoryParameters.record_ttl:type_name -> google.protobuf.Duration
-	23, // 17: agentmesh.v1.DirectoryRequest.provide:type_name -> agentmesh.v1.DirectoryProvide
-	25, // 18: agentmesh.v1.DirectoryRequest.find_providers:type_name -> agentmesh.v1.DirectoryFindProviders
-	26, // 19: agentmesh.v1.DirectoryRequest.find_peer:type_name -> agentmesh.v1.DirectoryFindPeer
-	24, // 20: agentmesh.v1.DirectoryRequest.withdraw:type_name -> agentmesh.v1.DirectoryWithdraw
-	28, // 21: agentmesh.v1.DirectoryResponse.providers:type_name -> agentmesh.v1.PeerRecord
-	28, // 22: agentmesh.v1.DirectoryResponse.peer:type_name -> agentmesh.v1.PeerRecord
-	85, // 23: agentmesh.v1.RouterInfo.labels:type_name -> agentmesh.v1.RouterInfo.LabelsEntry
-	90, // 24: agentmesh.v1.RouterLeaseRequest.ttl:type_name -> google.protobuf.Duration
-	91, // 25: agentmesh.v1.RouterLeaseResponse.expire_time:type_name -> google.protobuf.Timestamp
-	33, // 26: agentmesh.v1.PolicyRole.http:type_name -> agentmesh.v1.HTTPGrant
-	40, // 27: agentmesh.v1.EgressDestination.broker:type_name -> agentmesh.v1.CredentialBroker
-	35, // 28: agentmesh.v1.EgressDestination.inspection:type_name -> agentmesh.v1.Inspection
-	2,  // 29: agentmesh.v1.EgressDestination.mode:type_name -> agentmesh.v1.EgressMode
-	36, // 30: agentmesh.v1.Inspection.inspectors:type_name -> agentmesh.v1.Inspector
-	37, // 31: agentmesh.v1.Inspector.model_armor:type_name -> agentmesh.v1.ModelArmor
-	38, // 32: agentmesh.v1.Inspector.ext_proc:type_name -> agentmesh.v1.ExtProc
-	3,  // 33: agentmesh.v1.ModelArmor.response:type_name -> agentmesh.v1.ResponseInspection
-	90, // 34: agentmesh.v1.ModelArmor.timeout:type_name -> google.protobuf.Duration
-	39, // 35: agentmesh.v1.ExtProc.processing_mode:type_name -> agentmesh.v1.ExtProcProcessingMode
-	90, // 36: agentmesh.v1.ExtProc.message_timeout:type_name -> google.protobuf.Duration
-	6,  // 37: agentmesh.v1.ExtProcProcessingMode.request_header_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.HeaderMode
-	6,  // 38: agentmesh.v1.ExtProcProcessingMode.response_header_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.HeaderMode
-	7,  // 39: agentmesh.v1.ExtProcProcessingMode.request_body_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.BodyMode
-	7,  // 40: agentmesh.v1.ExtProcProcessingMode.response_body_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.BodyMode
-	6,  // 41: agentmesh.v1.ExtProcProcessingMode.request_trailer_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.HeaderMode
-	6,  // 42: agentmesh.v1.ExtProcProcessingMode.response_trailer_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.HeaderMode
-	41, // 43: agentmesh.v1.CredentialBroker.oidc_federation:type_name -> agentmesh.v1.OIDCFederation
-	42, // 44: agentmesh.v1.CredentialBroker.aws_assume_role:type_name -> agentmesh.v1.AWSAssumeRole
-	43, // 45: agentmesh.v1.CredentialBroker.platform_identity:type_name -> agentmesh.v1.PlatformIdentity
-	32, // 46: agentmesh.v1.PolicyConfig.roles:type_name -> agentmesh.v1.PolicyRole
-	44, // 47: agentmesh.v1.PolicyConfig.bindings:type_name -> agentmesh.v1.PolicyBinding
-	34, // 48: agentmesh.v1.PolicyConfig.egress:type_name -> agentmesh.v1.EgressDestination
-	34, // 49: agentmesh.v1.EgressAssignmentsResponse.egress:type_name -> agentmesh.v1.EgressDestination
-	91, // 50: agentmesh.v1.KeysResponse.sign_time:type_name -> google.protobuf.Timestamp
-	91, // 51: agentmesh.v1.TokenRefreshResponse.expire_time:type_name -> google.protobuf.Timestamp
-	16, // 52: agentmesh.v1.NodeCatalogReport.services:type_name -> agentmesh.v1.ServiceInfo
-	91, // 53: agentmesh.v1.BootstrapTokenCreateResponse.expire_time:type_name -> google.protobuf.Timestamp
-	91, // 54: agentmesh.v1.BootstrapToken.create_time:type_name -> google.protobuf.Timestamp
-	91, // 55: agentmesh.v1.BootstrapToken.expire_time:type_name -> google.protobuf.Timestamp
-	91, // 56: agentmesh.v1.BootstrapToken.revoke_time:type_name -> google.protobuf.Timestamp
-	59, // 57: agentmesh.v1.BootstrapTokenListResponse.tokens:type_name -> agentmesh.v1.BootstrapToken
-	0,  // 58: agentmesh.v1.EnrollmentRequest.status:type_name -> agentmesh.v1.EnrollmentStatus
-	86, // 59: agentmesh.v1.EnrollmentRequest.labels:type_name -> agentmesh.v1.EnrollmentRequest.LabelsEntry
-	91, // 60: agentmesh.v1.EnrollmentRequest.create_time:type_name -> google.protobuf.Timestamp
-	91, // 61: agentmesh.v1.EnrollmentRequest.resolve_time:type_name -> google.protobuf.Timestamp
-	61, // 62: agentmesh.v1.EnrollmentRequestListResponse.requests:type_name -> agentmesh.v1.EnrollmentRequest
-	91, // 63: agentmesh.v1.User.create_time:type_name -> google.protobuf.Timestamp
-	87, // 64: agentmesh.v1.EnrolledNode.labels:type_name -> agentmesh.v1.EnrolledNode.LabelsEntry
-	91, // 65: agentmesh.v1.EnrolledNode.enroll_time:type_name -> google.protobuf.Timestamp
-	91, // 66: agentmesh.v1.EnrolledNode.expire_time:type_name -> google.protobuf.Timestamp
-	91, // 67: agentmesh.v1.RouterLease.last_renewal_time:type_name -> google.protobuf.Timestamp
-	91, // 68: agentmesh.v1.RouterLease.expire_time:type_name -> google.protobuf.Timestamp
-	16, // 69: agentmesh.v1.NodeServices.services:type_name -> agentmesh.v1.ServiceInfo
-	91, // 70: agentmesh.v1.NodeServices.report_time:type_name -> google.protobuf.Timestamp
-	63, // 71: agentmesh.v1.AdminStatusResponse.users:type_name -> agentmesh.v1.User
-	65, // 72: agentmesh.v1.AdminStatusResponse.active_routers:type_name -> agentmesh.v1.RouterLease
-	64, // 73: agentmesh.v1.AdminStatusResponse.enrolled_nodes:type_name -> agentmesh.v1.EnrolledNode
-	61, // 74: agentmesh.v1.AdminStatusResponse.enrollment_requests:type_name -> agentmesh.v1.EnrollmentRequest
-	59, // 75: agentmesh.v1.AdminStatusResponse.bootstrap_tokens:type_name -> agentmesh.v1.BootstrapToken
-	45, // 76: agentmesh.v1.AdminStatusResponse.policy:type_name -> agentmesh.v1.PolicyConfig
-	88, // 77: agentmesh.v1.AdminStatusResponse.node_catalog:type_name -> agentmesh.v1.AdminStatusResponse.NodeCatalogEntry
-	63, // 78: agentmesh.v1.UserStatusResponse.user:type_name -> agentmesh.v1.User
-	64, // 79: agentmesh.v1.UserStatusResponse.enrolled_nodes:type_name -> agentmesh.v1.EnrolledNode
-	59, // 80: agentmesh.v1.UserStatusResponse.bootstrap_tokens:type_name -> agentmesh.v1.BootstrapToken
-	65, // 81: agentmesh.v1.UserStatusResponse.active_routers:type_name -> agentmesh.v1.RouterLease
-	45, // 82: agentmesh.v1.UserStatusResponse.policy:type_name -> agentmesh.v1.PolicyConfig
-	91, // 83: agentmesh.v1.IdentityEvidenceResponse.biscuit_expire_time:type_name -> google.protobuf.Timestamp
-	91, // 84: agentmesh.v1.IdentityEvidenceResponse.check_time:type_name -> google.protobuf.Timestamp
-	89, // 85: agentmesh.v1.PeerEvidenceResponse.labels:type_name -> agentmesh.v1.PeerEvidenceResponse.LabelsEntry
-	91, // 86: agentmesh.v1.PeerEvidenceResponse.expire_time:type_name -> google.protobuf.Timestamp
-	91, // 87: agentmesh.v1.PeerEvidenceResponse.check_time:type_name -> google.protobuf.Timestamp
-	91, // 88: agentmesh.v1.MemberCredential.expire_time:type_name -> google.protobuf.Timestamp
-	72, // 89: agentmesh.v1.MemberCredential.trusted_keys:type_name -> agentmesh.v1.TrustedSigningKey
-	73, // 90: agentmesh.v1.MemberCredential.oidc_session:type_name -> agentmesh.v1.OIDCSession
-	91, // 91: agentmesh.v1.TrustedSigningKey.receive_time:type_name -> google.protobuf.Timestamp
-	75, // 92: agentmesh.v1.TaskAuthorizationRule.rules:type_name -> agentmesh.v1.TaskRule
-	91, // 93: agentmesh.v1.TaskAuthorizationRule.expire_time:type_name -> google.protobuf.Timestamp
-	76, // 94: agentmesh.v1.TaskRule.operation:type_name -> agentmesh.v1.TaskOperation
-	74, // 95: agentmesh.v1.TokenExchangeRequest.task_rule:type_name -> agentmesh.v1.TaskAuthorizationRule
-	91, // 96: agentmesh.v1.TokenExchangeResponse.expire_time:type_name -> google.protobuf.Timestamp
-	91, // 97: agentmesh.v1.STSTokenResponse.expire_time:type_name -> google.protobuf.Timestamp
-	66, // 98: agentmesh.v1.AdminStatusResponse.NodeCatalogEntry.value:type_name -> agentmesh.v1.NodeServices
-	99, // [99:99] is the sub-list for method output_type
-	99, // [99:99] is the sub-list for method input_type
-	99, // [99:99] is the sub-list for extension type_name
-	99, // [99:99] is the sub-list for extension extendee
-	0,  // [0:99] is the sub-list for field type_name
+	4,   // 0: agentmesh.v1.RouterGoAway.reason:type_name -> agentmesh.v1.RouterGoAway.Reason
+	91,  // 1: agentmesh.v1.RouterGoAway.retry_after:type_name -> google.protobuf.Duration
+	5,   // 2: agentmesh.v1.MeshEvent.type:type_name -> agentmesh.v1.MeshEvent.Type
+	92,  // 3: agentmesh.v1.MeshEvent.event_time:type_name -> google.protobuf.Timestamp
+	83,  // 4: agentmesh.v1.EnrollRequest.labels:type_name -> agentmesh.v1.EnrollRequest.LabelsEntry
+	92,  // 5: agentmesh.v1.EnrollResponse.expire_time:type_name -> google.protobuf.Timestamp
+	84,  // 6: agentmesh.v1.BootstrapEnrollRequest.labels:type_name -> agentmesh.v1.BootstrapEnrollRequest.LabelsEntry
+	0,   // 7: agentmesh.v1.BootstrapEnrollResponse.status:type_name -> agentmesh.v1.EnrollmentStatus
+	92,  // 8: agentmesh.v1.BootstrapEnrollResponse.expire_time:type_name -> google.protobuf.Timestamp
+	1,   // 9: agentmesh.v1.ServiceInfo.type:type_name -> agentmesh.v1.ServiceType
+	85,  // 10: agentmesh.v1.CommandBackend.env:type_name -> agentmesh.v1.CommandBackend.EnvEntry
+	16,  // 11: agentmesh.v1.RegisterServiceRequest.service:type_name -> agentmesh.v1.ServiceInfo
+	17,  // 12: agentmesh.v1.RegisterServiceRequest.command:type_name -> agentmesh.v1.CommandBackend
+	29,  // 13: agentmesh.v1.ControlPlaneInfoResponse.routers:type_name -> agentmesh.v1.RouterInfo
+	21,  // 14: agentmesh.v1.ControlPlaneInfoResponse.directory:type_name -> agentmesh.v1.DirectoryParameters
+	91,  // 15: agentmesh.v1.DirectoryParameters.reprovide_interval:type_name -> google.protobuf.Duration
+	91,  // 16: agentmesh.v1.DirectoryParameters.record_ttl:type_name -> google.protobuf.Duration
+	23,  // 17: agentmesh.v1.DirectoryRequest.provide:type_name -> agentmesh.v1.DirectoryProvide
+	25,  // 18: agentmesh.v1.DirectoryRequest.find_providers:type_name -> agentmesh.v1.DirectoryFindProviders
+	26,  // 19: agentmesh.v1.DirectoryRequest.find_peer:type_name -> agentmesh.v1.DirectoryFindPeer
+	24,  // 20: agentmesh.v1.DirectoryRequest.withdraw:type_name -> agentmesh.v1.DirectoryWithdraw
+	28,  // 21: agentmesh.v1.DirectoryResponse.providers:type_name -> agentmesh.v1.PeerRecord
+	28,  // 22: agentmesh.v1.DirectoryResponse.peer:type_name -> agentmesh.v1.PeerRecord
+	86,  // 23: agentmesh.v1.RouterInfo.labels:type_name -> agentmesh.v1.RouterInfo.LabelsEntry
+	91,  // 24: agentmesh.v1.RouterLeaseRequest.ttl:type_name -> google.protobuf.Duration
+	92,  // 25: agentmesh.v1.RouterLeaseResponse.expire_time:type_name -> google.protobuf.Timestamp
+	33,  // 26: agentmesh.v1.PolicyRole.http:type_name -> agentmesh.v1.HTTPGrant
+	40,  // 27: agentmesh.v1.EgressDestination.broker:type_name -> agentmesh.v1.CredentialBroker
+	35,  // 28: agentmesh.v1.EgressDestination.inspection:type_name -> agentmesh.v1.Inspection
+	2,   // 29: agentmesh.v1.EgressDestination.mode:type_name -> agentmesh.v1.EgressMode
+	36,  // 30: agentmesh.v1.Inspection.inspectors:type_name -> agentmesh.v1.Inspector
+	37,  // 31: agentmesh.v1.Inspector.model_armor:type_name -> agentmesh.v1.ModelArmor
+	38,  // 32: agentmesh.v1.Inspector.ext_proc:type_name -> agentmesh.v1.ExtProc
+	3,   // 33: agentmesh.v1.ModelArmor.response:type_name -> agentmesh.v1.ResponseInspection
+	91,  // 34: agentmesh.v1.ModelArmor.timeout:type_name -> google.protobuf.Duration
+	39,  // 35: agentmesh.v1.ExtProc.processing_mode:type_name -> agentmesh.v1.ExtProcProcessingMode
+	91,  // 36: agentmesh.v1.ExtProc.message_timeout:type_name -> google.protobuf.Duration
+	6,   // 37: agentmesh.v1.ExtProcProcessingMode.request_header_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.HeaderMode
+	6,   // 38: agentmesh.v1.ExtProcProcessingMode.response_header_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.HeaderMode
+	7,   // 39: agentmesh.v1.ExtProcProcessingMode.request_body_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.BodyMode
+	7,   // 40: agentmesh.v1.ExtProcProcessingMode.response_body_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.BodyMode
+	6,   // 41: agentmesh.v1.ExtProcProcessingMode.request_trailer_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.HeaderMode
+	6,   // 42: agentmesh.v1.ExtProcProcessingMode.response_trailer_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.HeaderMode
+	41,  // 43: agentmesh.v1.CredentialBroker.oidc_federation:type_name -> agentmesh.v1.OIDCFederation
+	42,  // 44: agentmesh.v1.CredentialBroker.aws_assume_role:type_name -> agentmesh.v1.AWSAssumeRole
+	43,  // 45: agentmesh.v1.CredentialBroker.platform_identity:type_name -> agentmesh.v1.PlatformIdentity
+	32,  // 46: agentmesh.v1.PolicyConfig.roles:type_name -> agentmesh.v1.PolicyRole
+	44,  // 47: agentmesh.v1.PolicyConfig.bindings:type_name -> agentmesh.v1.PolicyBinding
+	34,  // 48: agentmesh.v1.PolicyConfig.egress:type_name -> agentmesh.v1.EgressDestination
+	34,  // 49: agentmesh.v1.EgressAssignmentsResponse.egress:type_name -> agentmesh.v1.EgressDestination
+	92,  // 50: agentmesh.v1.KeysResponse.sign_time:type_name -> google.protobuf.Timestamp
+	92,  // 51: agentmesh.v1.TokenRefreshResponse.expire_time:type_name -> google.protobuf.Timestamp
+	16,  // 52: agentmesh.v1.NodeCatalogReport.services:type_name -> agentmesh.v1.ServiceInfo
+	92,  // 53: agentmesh.v1.BootstrapTokenCreateResponse.expire_time:type_name -> google.protobuf.Timestamp
+	92,  // 54: agentmesh.v1.BootstrapToken.create_time:type_name -> google.protobuf.Timestamp
+	92,  // 55: agentmesh.v1.BootstrapToken.expire_time:type_name -> google.protobuf.Timestamp
+	92,  // 56: agentmesh.v1.BootstrapToken.revoke_time:type_name -> google.protobuf.Timestamp
+	59,  // 57: agentmesh.v1.BootstrapTokenListResponse.tokens:type_name -> agentmesh.v1.BootstrapToken
+	0,   // 58: agentmesh.v1.EnrollmentRequest.status:type_name -> agentmesh.v1.EnrollmentStatus
+	87,  // 59: agentmesh.v1.EnrollmentRequest.labels:type_name -> agentmesh.v1.EnrollmentRequest.LabelsEntry
+	92,  // 60: agentmesh.v1.EnrollmentRequest.create_time:type_name -> google.protobuf.Timestamp
+	92,  // 61: agentmesh.v1.EnrollmentRequest.resolve_time:type_name -> google.protobuf.Timestamp
+	61,  // 62: agentmesh.v1.EnrollmentRequestListResponse.requests:type_name -> agentmesh.v1.EnrollmentRequest
+	92,  // 63: agentmesh.v1.User.create_time:type_name -> google.protobuf.Timestamp
+	88,  // 64: agentmesh.v1.EnrolledNode.labels:type_name -> agentmesh.v1.EnrolledNode.LabelsEntry
+	92,  // 65: agentmesh.v1.EnrolledNode.enroll_time:type_name -> google.protobuf.Timestamp
+	92,  // 66: agentmesh.v1.EnrolledNode.expire_time:type_name -> google.protobuf.Timestamp
+	92,  // 67: agentmesh.v1.RouterLease.last_renewal_time:type_name -> google.protobuf.Timestamp
+	92,  // 68: agentmesh.v1.RouterLease.expire_time:type_name -> google.protobuf.Timestamp
+	16,  // 69: agentmesh.v1.NodeServices.services:type_name -> agentmesh.v1.ServiceInfo
+	92,  // 70: agentmesh.v1.NodeServices.report_time:type_name -> google.protobuf.Timestamp
+	63,  // 71: agentmesh.v1.AdminStatusResponse.users:type_name -> agentmesh.v1.User
+	65,  // 72: agentmesh.v1.AdminStatusResponse.active_routers:type_name -> agentmesh.v1.RouterLease
+	64,  // 73: agentmesh.v1.AdminStatusResponse.enrolled_nodes:type_name -> agentmesh.v1.EnrolledNode
+	61,  // 74: agentmesh.v1.AdminStatusResponse.enrollment_requests:type_name -> agentmesh.v1.EnrollmentRequest
+	59,  // 75: agentmesh.v1.AdminStatusResponse.bootstrap_tokens:type_name -> agentmesh.v1.BootstrapToken
+	45,  // 76: agentmesh.v1.AdminStatusResponse.policy:type_name -> agentmesh.v1.PolicyConfig
+	89,  // 77: agentmesh.v1.AdminStatusResponse.node_catalog:type_name -> agentmesh.v1.AdminStatusResponse.NodeCatalogEntry
+	63,  // 78: agentmesh.v1.UserStatusResponse.user:type_name -> agentmesh.v1.User
+	64,  // 79: agentmesh.v1.UserStatusResponse.enrolled_nodes:type_name -> agentmesh.v1.EnrolledNode
+	59,  // 80: agentmesh.v1.UserStatusResponse.bootstrap_tokens:type_name -> agentmesh.v1.BootstrapToken
+	65,  // 81: agentmesh.v1.UserStatusResponse.active_routers:type_name -> agentmesh.v1.RouterLease
+	45,  // 82: agentmesh.v1.UserStatusResponse.policy:type_name -> agentmesh.v1.PolicyConfig
+	64,  // 83: agentmesh.v1.NodeListResponse.nodes:type_name -> agentmesh.v1.EnrolledNode
+	92,  // 84: agentmesh.v1.IdentityEvidenceResponse.biscuit_expire_time:type_name -> google.protobuf.Timestamp
+	92,  // 85: agentmesh.v1.IdentityEvidenceResponse.check_time:type_name -> google.protobuf.Timestamp
+	90,  // 86: agentmesh.v1.PeerEvidenceResponse.labels:type_name -> agentmesh.v1.PeerEvidenceResponse.LabelsEntry
+	92,  // 87: agentmesh.v1.PeerEvidenceResponse.expire_time:type_name -> google.protobuf.Timestamp
+	92,  // 88: agentmesh.v1.PeerEvidenceResponse.check_time:type_name -> google.protobuf.Timestamp
+	92,  // 89: agentmesh.v1.MemberCredential.expire_time:type_name -> google.protobuf.Timestamp
+	73,  // 90: agentmesh.v1.MemberCredential.trusted_keys:type_name -> agentmesh.v1.TrustedSigningKey
+	74,  // 91: agentmesh.v1.MemberCredential.oidc_session:type_name -> agentmesh.v1.OIDCSession
+	92,  // 92: agentmesh.v1.TrustedSigningKey.receive_time:type_name -> google.protobuf.Timestamp
+	76,  // 93: agentmesh.v1.TaskAuthorizationRule.rules:type_name -> agentmesh.v1.TaskRule
+	92,  // 94: agentmesh.v1.TaskAuthorizationRule.expire_time:type_name -> google.protobuf.Timestamp
+	77,  // 95: agentmesh.v1.TaskRule.operation:type_name -> agentmesh.v1.TaskOperation
+	75,  // 96: agentmesh.v1.TokenExchangeRequest.task_rule:type_name -> agentmesh.v1.TaskAuthorizationRule
+	92,  // 97: agentmesh.v1.TokenExchangeResponse.expire_time:type_name -> google.protobuf.Timestamp
+	92,  // 98: agentmesh.v1.STSTokenResponse.expire_time:type_name -> google.protobuf.Timestamp
+	66,  // 99: agentmesh.v1.AdminStatusResponse.NodeCatalogEntry.value:type_name -> agentmesh.v1.NodeServices
+	100, // [100:100] is the sub-list for method output_type
+	100, // [100:100] is the sub-list for method input_type
+	100, // [100:100] is the sub-list for extension type_name
+	100, // [100:100] is the sub-list for extension extendee
+	0,   // [0:100] is the sub-list for field type_name
 }
 
 func init() { file_api_agentmesh_proto_init() }
@@ -6724,7 +6786,7 @@ func file_api_agentmesh_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_agentmesh_proto_rawDesc), len(file_api_agentmesh_proto_rawDesc)),
 			NumEnums:      8,
-			NumMessages:   82,
+			NumMessages:   83,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/api/agentmesh.proto b/api/agentmesh.proto
index 7396648f..0d76de6a 100644
--- a/api/agentmesh.proto
+++ b/api/agentmesh.proto
@@ -767,7 +767,7 @@ message NodeServices {
 }
 
 // AdminStatusResponse answers GET /admin/status: everything the console
-// shows an administrator.
+// shows an administrator, except expired nodes (see GET /user/nodes).
 message AdminStatusResponse {
   repeated User users = 1;
   repeated RouterLease active_routers = 2;
@@ -779,9 +779,9 @@ message AdminStatusResponse {
   map<string, NodeServices> node_catalog = 7;
 }
 
-// UserStatusResponse answers GET /user/status: the caller and what it owns.
-// The router fleet and the mesh policy describe the whole mesh and are set
-// for an administrator only.
+// UserStatusResponse answers GET /user/status: the caller and what it owns,
+// except expired nodes (see GET /user/nodes). The router fleet and the mesh
+// policy describe the whole mesh and are set for an administrator only.
 message UserStatusResponse {
   User user = 1;
   repeated EnrolledNode enrolled_nodes = 2;
@@ -790,6 +790,16 @@ message UserStatusResponse {
   PolicyConfig policy = 5;
 }
 
+// NodeListResponse answers GET /user/nodes: enrolled nodes, newest enrollment
+// first, page_size (default 50, at most 200) at a time. state (admitted,
+// expired or banned, repeatable) and role narrow the list. An administrator
+// sees every owner's nodes and may pick one with owner_id; a user sees its own.
+message NodeListResponse {
+  repeated EnrolledNode nodes = 1;
+  // Pass as page_token for the next page; empty on the last page.
+  string next_page_token = 2;
+}
+
 // ============================================================================
 // Identity Evidence API
 // ============================================================================
diff --git a/cmd/agentmesh-control-plane/main.go b/cmd/agentmesh-control-plane/main.go
index a529f420..ebf3f158 100644
--- a/cmd/agentmesh-control-plane/main.go
+++ b/cmd/agentmesh-control-plane/main.go
@@ -98,6 +98,10 @@ func main() {
 			if stsIssuerURL == "" {
 				stsIssuerURL = strings.TrimSpace(os.Getenv("AGENTMESH_STS_ISSUER_URL"))
 			}
+			// Options reads 0 as unset; the flag's 0 is a value the operator typed.
+			if nodeRetention <= 0 {
+				logger.Fatalf("--node-retention must be positive, got %s: node records are never kept forever", nodeRetention)
+			}
 
 			var auds []string
 			for _, aud := range strings.Split(allowedAudiencesFlag, ",") {
@@ -202,7 +206,7 @@ func main() {
 	rootCmd.Flags().DurationVar(&biscuitTTL, "biscuit-ttl", api.BiscuitTokenTTL, "Lifespan minted into every issued Biscuit's expiration fact. Capped to the OIDC token's own expiry when shorter.")
 	rootCmd.Flags().DurationVar(&oidcSessionTTL, "oidc-session-ttl", api.OIDCSessionTTL, "How long an OIDC enrollment stays refreshable before the identity must re-authenticate with the OIDC provider. Shorter values keep the provider authoritative for offboarding at the cost of more frequent interactive re-enrollment.")
 	rootCmd.Flags().DurationVar(&workloadSessionTTL, "workload-session-ttl", controlplane.DefaultWorkloadSessionTTL, "How long a workload-issuer enrollment stays refreshable without presenting a fresh platform JWT on /refresh.")
-	rootCmd.Flags().DurationVar(&nodeRetention, "node-retention", controlplane.DefaultNodeRetention, "How long an enrolled node's record is kept after its session expired before it is deleted. Banned nodes are always kept. 0 keeps every record forever.")
+	rootCmd.Flags().DurationVar(&nodeRetention, "node-retention", controlplane.DefaultNodeRetention, "How long an enrolled node's record is kept after its session expired before it is deleted. Banned nodes are always kept. Must be positive: records are never kept forever.")
 	rootCmd.Flags().DurationVar(&meshReconnectInterval, "mesh-reconnect-interval", controlplane.DefaultMeshReconnectInterval, "How often the event publisher re-reads the router leases and dials any router it is not connected to.")
 	rootCmd.Flags().StringVar(&adminTokenPath, "admin-token-path", "", "Path to file containing the token for authenticating policy REST API requests (or env AGENTMESH_ADMIN_TOKEN)")
 	rootCmd.Flags().StringVar(&stsIssuerURL, "sts-issuer-url", "", "Canonical external URL of this control plane for OIDC/STS issuer and discovery metadata (or env AGENTMESH_STS_ISSUER_URL)")
diff --git a/cmd/agentmesh-one/main.go b/cmd/agentmesh-one/main.go
index 0e93a76e..9fade107 100644
--- a/cmd/agentmesh-one/main.go
+++ b/cmd/agentmesh-one/main.go
@@ -231,6 +231,7 @@ func main() {
 	rootCmd.Flags().DurationVar(&cpTunables.KeyGracePeriod, "control-plane-key-grace-period", 0, "How long rotated-out keys stay valid for verification (0 keeps the component default)")
 	rootCmd.Flags().DurationVar(&cpTunables.BiscuitTTL, "control-plane-biscuit-ttl", 0, "Lifespan minted into issued biscuits (0 keeps the component default)")
 	rootCmd.Flags().DurationVar(&cpTunables.WorkloadSessionTTL, "control-plane-workload-session-ttl", 0, "How long a workload-issuer enrollment stays refreshable without presenting a fresh platform JWT on /refresh (0 keeps the component default)")
+	rootCmd.Flags().DurationVar(&cpTunables.NodeRetention, "control-plane-node-retention", 0, "How long a node record is kept after its session expired before it is deleted (0 keeps the component default)")
 	rootCmd.Flags().BoolVar(&cpTunables.ManualEnrollment, "control-plane-manual-enrollment", false, "Queue bootstrap enrollments for admin approval instead of auto-approving")
 
 	// Embedded router tunables.
diff --git a/internal/console/public/app.js b/internal/console/public/app.js
index 05cbea51..b1bd4178 100644
--- a/internal/console/public/app.js
+++ b/internal/console/public/app.js
@@ -4,6 +4,10 @@ const TOAST_TIMEOUT_MS = 5000;
 
 let refreshTimer = null;
 let refreshInFlight = false;
+// The session's role and user ID, learned from the first /user/status of a
+// session. An admin's later refreshes read /admin/status alone: /user/status
+// would list the same mesh a second time only to be overwritten.
+let session = null;
 // Last policy the server confirmed, so an edit is never silently overwritten by
 // a background refresh or thrown away by a stray click.
 let policyBaseline = '';
@@ -146,6 +150,8 @@ function showApp() {
 
 function showLandingPage() {
     stopAutoRefresh();
+    resetExpiredNodes();
+    session = null;
     document.getElementById('landing-page').classList.add('active');
     document.getElementById('app-container').style.display = 'none';
 }
@@ -194,8 +200,10 @@ window.saveAdminToken = function() {
 
 async function loadData() {
     try {
-        // 1. Fetch user-scoped status
-        const response = await fetch('api/user/status');
+        // One status call per refresh: the user's own until the role is known,
+        // then the one that matches the role.
+        const endpoint = session !== null && session.role === 'admin' ? 'api/admin/status' : 'api/user/status';
+        const response = await fetch(endpoint);
         if (response.status === 401 || response.status === 403) {
             showLandingPage();
             throw new Error('Unauthorized. Please login again.');
@@ -204,15 +212,19 @@ async function loadData() {
             throw new Error(`HTTP error! status: ${response.status}`);
         }
         let data = await response.json();
-        
-        const role = data.user ? data.user.role : 'user';
-        const userId = data.user ? data.user.id : '';
+
+        if (data.user) {
+            session = { role: data.user.role || 'user', id: data.user.id || '' };
+        }
+        const role = session !== null ? session.role : 'user';
+        const userId = session !== null ? session.id : '';
         
         // Update UI components depending on Role
         updateUIForRole(role, userId);
 
-        // 2. If user is admin, fetch full unfiltered admin status
-        if (role === 'admin') {
+        // The first call of an admin's session answered with the user's view;
+        // the mesh-wide one is what the admin console renders.
+        if (role === 'admin' && endpoint !== 'api/admin/status') {
             const adminResp = await fetch('api/admin/status');
             if (adminResp.ok) {
                 data = await adminResp.json();
diff --git a/internal/console/public/expired-nodes.js b/internal/console/public/expired-nodes.js
new file mode 100644
index 00000000..2cfce488
--- /dev/null
+++ b/internal/console/public/expired-nodes.js
@@ -0,0 +1,142 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+const EXPIRED_NODES_PAGE_SIZE = 50;
+
+// Where the expired-nodes list resumes, and which opening of the section a
+// fetch belongs to, so a slow page never lands in a list reset since.
+let expiredNodesPageToken = '';
+let expiredNodesGeneration = 0;
+
+document.addEventListener('DOMContentLoaded', () => {
+    const expiredNodes = document.getElementById('expired-nodes');
+    expiredNodes.addEventListener('toggle', () => {
+        if (expiredNodes.open) {
+            loadExpiredNodes(true);
+        }
+    });
+    document.getElementById('expired-nodes-more').addEventListener('click', () => loadExpiredNodes(false));
+    document.getElementById('table-expired-nodes').addEventListener('click', (e) => {
+        const button = e.target.closest('button[data-peer-id]');
+        if (button) {
+            revokeExpiredNode(button);
+        }
+    });
+});
+
+// Fetched on demand, never by the background refresh: expired rows stay for
+// the retention period, and listing them all would slow every refresh.
+async function loadExpiredNodes(reset) {
+    const more = document.getElementById('expired-nodes-more');
+    if (reset) {
+        expiredNodesGeneration++;
+        expiredNodesPageToken = '';
+        more.hidden = true;
+        setTableMessage('table-expired-nodes', 5, 'Loading...');
+    }
+    const generation = expiredNodesGeneration;
+    let url = `api/user/nodes?state=expired&page_size=${EXPIRED_NODES_PAGE_SIZE}`;
+    if (expiredNodesPageToken) {
+        url += `&page_token=${encodeURIComponent(expiredNodesPageToken)}`;
+    }
+
+    more.disabled = true;
+    try {
+        const response = await fetch(url);
+        if (response.status === 401 || response.status === 403) {
+            showLandingPage();
+            throw new Error('Unauthorized. Please login again.');
+        }
+        if (!response.ok) {
+            throw new Error(`HTTP error! status: ${response.status}`);
+        }
+        const data = await response.json();
+        if (generation !== expiredNodesGeneration) {
+            return;
+        }
+
+        const tbody = document.getElementById('table-expired-nodes');
+        const rows = (data.nodes || []).map(expiredNodeRow).join('');
+        if (reset) {
+            tbody.innerHTML = rows;
+        } else {
+            tbody.insertAdjacentHTML('beforeend', rows);
+        }
+        if (!tbody.querySelector('tr')) {
+            setTableMessage('table-expired-nodes', 5, 'No expired nodes');
+        }
+        expiredNodesPageToken = data.next_page_token || '';
+        more.hidden = !expiredNodesPageToken;
+        applySearchFilter();
+    } catch (error) {
+        if (generation !== expiredNodesGeneration) {
+            return;
+        }
+        console.error('Failed to load expired nodes:', error);
+        // A failed "Load more" keeps the rows already shown and the button to retry.
+        if (reset) {
+            setTableMessage('table-expired-nodes', 5, `Error loading expired nodes: ${error.message}`, true);
+        } else {
+            showToast(`Failed to load more expired nodes: ${error.message}`, 'error');
+        }
+    } finally {
+        more.disabled = false;
+    }
+}
+
+// The Revoke button carries the peer ID as data, not inside an inline handler,
+// where an HTML-escaped quote would be decoded back into the script.
+function expiredNodeRow(node) {
+    const expired = node.expire_time ? new Date(node.expire_time).toLocaleString() : '';
+    return `
+        <tr>
+            <td>${peerCell(node.peer_id, node.labels)}</td>
+            <td>${escapeHTML(node.role)}</td>
+            <td>${escapeHTML(node.owner_id || '')}</td>
+            <td>${escapeHTML(expired)}</td>
+            <td><button class="btn btn-sm btn-danger" type="button" data-peer-id="${escapeHTML(node.peer_id)}">Revoke</button></td>
+        </tr>
+    `;
+}
+
+// Paging resumes after the last row served, so dropping a revoked row never
+// shifts the next page.
+async function revokeExpiredNode(button) {
+    if (!confirm('Revoke this node? It can no longer renew its expired session or rejoin the mesh.')) {
+        return;
+    }
+    button.disabled = true;
+    try {
+        await actionRequest(`api/user/revoke?id=${encodeURIComponent(button.dataset.peerId)}`);
+    } catch (error) {
+        // actionRequest already reported the failure.
+        button.disabled = false;
+        return;
+    }
+    const tbody = document.getElementById('table-expired-nodes');
+    button.closest('tr').remove();
+    if (!tbody.querySelector('tr:not([data-filter-empty])')) {
+        loadExpiredNodes(true);
+    }
+}
+
+// The landing page hides the app without a reload, so the next identity to log
+// in must not inherit rows, or an in-flight page, fetched for this one.
+function resetExpiredNodes() {
+    expiredNodesGeneration++;
+    expiredNodesPageToken = '';
+    document.getElementById('expired-nodes').open = false;
+    document.getElementById('table-expired-nodes').innerHTML = '';
+    document.getElementById('expired-nodes-more').hidden = true;
+}
diff --git a/internal/console/public/index.html b/internal/console/public/index.html
index 0853e629..90683cee 100644
--- a/internal/console/public/index.html
+++ b/internal/console/public/index.html
@@ -226,6 +226,28 @@ <h2>Revoked Nodes</h2>
                             </div>
                         </div>
                     </div>
+                    <!-- Loaded on open, never by the refresh: expired rows pile up for the
+                         retention period, yet an expired OIDC node can renew until revoked. -->
+                    <details id="expired-nodes" class="section-header-spaced">
+                        <summary class="section-header"><h2>Expired Nodes</h2></summary>
+                        <div class="card">
+                            <div class="table-responsive">
+                            <table class="data-table">
+                                <thead>
+                                    <tr>
+                                        <th>Node ID</th>
+                                        <th>Type</th>
+                                        <th>Owner</th>
+                                        <th>Expired</th>
+                                        <th>Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="table-expired-nodes"></tbody>
+                            </table>
+                            </div>
+                            <button id="expired-nodes-more" class="btn btn-sm load-more" type="button" hidden>Load more</button>
+                        </div>
+                    </details>
                 </section>
 
                 <!-- Services View: self-reported by each node (see /nodes/catalog);
@@ -405,5 +427,6 @@ <h2>Mesh Security Policies</h2>
     <div id="toast-container" class="toast-container" role="status" aria-live="polite"></div>
     <script src="vendor/js-yaml.min.js"></script>
     <script src="app.js"></script>
+    <script src="expired-nodes.js"></script>
 </body>
 </html>
diff --git a/internal/console/public/style.css b/internal/console/public/style.css
index 0326f0fc..65a03ee2 100644
--- a/internal/console/public/style.css
+++ b/internal/console/public/style.css
@@ -523,6 +523,24 @@ body {
     font-weight: 600;
 }
 
+/* A collapsible section: the disclosure marker sits beside its title. */
+summary.section-header {
+    cursor: pointer;
+}
+
+summary.section-header h2 {
+    display: inline;
+}
+
+.load-more {
+    margin-top: 16px;
+}
+
+/* .btn sets display, which would otherwise beat the hidden attribute. */
+.load-more[hidden] {
+    display: none;
+}
+
 /* Buttons */
 .btn {
     display: inline-flex;
diff --git a/internal/console/server_test.go b/internal/console/server_test.go
index 23b6e35c..3a7cd53c 100644
--- a/internal/console/server_test.go
+++ b/internal/console/server_test.go
@@ -95,8 +95,11 @@ func TestNewServerEmbeddedAssets(t *testing.T) {
 	if code, body := get("/"); code != http.StatusOK || !strings.Contains(body, "<html") {
 		t.Errorf("GET / = %d, want 200 with the embedded index.html", code)
 	}
-	if code, _ := get("/app.js"); code != http.StatusOK {
-		t.Errorf("GET /app.js = %d, want 200", code)
+	// A missing file would get the SPA fallback, so a script must not be index.html.
+	for _, asset := range []string{"/app.js", "/expired-nodes.js"} {
+		if code, body := get(asset); code != http.StatusOK || strings.Contains(body, "<html") {
+			t.Errorf("GET %s = %d, want 200 with the embedded script", asset, code)
+		}
 	}
 	// SPA fallback: unknown paths serve index.html.
 	if code, body := get("/some/client/route"); code != http.StatusOK || !strings.Contains(body, "<html") {
diff --git a/internal/controlplane/catalog_test.go b/internal/controlplane/catalog_test.go
index 8f2e732b..c390a726 100644
--- a/internal/controlplane/catalog_test.go
+++ b/internal/controlplane/catalog_test.go
@@ -19,14 +19,18 @@ import (
 	"context"
 	"crypto/ed25519"
 	"encoding/base64"
+	"errors"
 	"io"
 	"net/http"
+	"path/filepath"
 	"strconv"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/google/agentmesh/api"
 	"github.com/google/agentmesh/internal/identity"
+	"github.com/google/agentmesh/internal/storage"
 	"github.com/libp2p/go-libp2p/core/crypto"
 	"github.com/libp2p/go-libp2p/core/peer"
 	"google.golang.org/protobuf/encoding/protojson"
@@ -82,8 +86,8 @@ func catalogBody(t *testing.T, services ...*api.ServiceInfo) []byte {
 	return body
 }
 
-// adminNodeCatalog fetches /admin/status and returns its node_catalog value.
-func adminNodeCatalog(t *testing.T, cpURL, adminToken string) map[string]*api.NodeServices {
+// adminStatus fetches /admin/status with the admin token.
+func adminStatus(t *testing.T, cpURL, adminToken string) *api.AdminStatusResponse {
 	t.Helper()
 
 	req, err := http.NewRequest(http.MethodGet, cpURL+"/admin/status", nil)
@@ -107,7 +111,7 @@ func adminNodeCatalog(t *testing.T, cpURL, adminToken string) map[string]*api.No
 	if err := protojson.Unmarshal(body, status); err != nil {
 		t.Fatalf("decode /admin/status: %v", err)
 	}
-	return status.GetNodeCatalog()
+	return status
 }
 
 func TestHandleNodeCatalog(t *testing.T) {
@@ -155,7 +159,7 @@ func TestHandleNodeCatalog(t *testing.T) {
 	}
 
 	// The console sees the reported services with the report time.
-	view := adminNodeCatalog(t, cpURL, srv.config.AdminToken)
+	view := adminStatus(t, cpURL, srv.config.AdminToken).GetNodeCatalog()
 	got, ok := view[nodePeer.String()]
 	if !ok || len(view) != 1 {
 		t.Fatalf("expected the reporting peer in node_catalog, got %v", view)
@@ -169,7 +173,7 @@ func TestHandleNodeCatalog(t *testing.T) {
 	if got := postCatalog(t, cpURL, bearer(biscuitBytes), priv, catalogBody(t)); got != http.StatusNoContent {
 		t.Fatalf("empty report: got status %d, want %d", got, http.StatusNoContent)
 	}
-	if view := adminNodeCatalog(t, cpURL, srv.config.AdminToken); len(view[nodePeer.String()].GetServices()) != 0 {
+	if view := adminStatus(t, cpURL, srv.config.AdminToken).GetNodeCatalog(); len(view[nodePeer.String()].GetServices()) != 0 {
 		t.Fatalf("empty report must clear services, got %+v", view)
 	}
 }
@@ -280,7 +284,7 @@ func TestHandleNodeCatalog_Admission(t *testing.T) {
 	if got := postCatalog(t, cpURL, bearer(biscuitBytes), priv, body); got != http.StatusNoContent {
 		t.Fatalf("admitted node: got status %d, want %d", got, http.StatusNoContent)
 	}
-	if _, ok := adminNodeCatalog(t, cpURL, srv.config.AdminToken)[nodePeer.String()]; !ok {
+	if _, ok := adminStatus(t, cpURL, srv.config.AdminToken).GetNodeCatalog()[nodePeer.String()]; !ok {
 		t.Fatal("admitted node's report missing from node_catalog")
 	}
 
@@ -296,9 +300,13 @@ func TestHandleNodeCatalog_Admission(t *testing.T) {
 	if got := postCatalog(t, cpURL, bearer(biscuitBytes), priv, body); got != http.StatusUnauthorized {
 		t.Fatalf("expired session: got status %d, want %d", got, http.StatusUnauthorized)
 	}
-	if view := adminNodeCatalog(t, cpURL, srv.config.AdminToken); len(view) != 0 {
+	expired := adminStatus(t, cpURL, srv.config.AdminToken)
+	if view := expired.GetNodeCatalog(); len(view) != 0 {
 		t.Fatalf("expired node must not appear in node_catalog, got %v", view)
 	}
+	if nodes := expired.GetEnrolledNodes(); len(nodes) != 0 {
+		t.Fatalf("expired node must not appear in enrolled_nodes, got %v", nodes)
+	}
 
 	// Banned through the server path: the entry is evicted outright.
 	record.ExpiresAt = time.Now().Add(time.Hour)
@@ -316,6 +324,74 @@ func TestHandleNodeCatalog_Admission(t *testing.T) {
 	}
 }
 
+// failingStore is a store whose reads fail on demand, the way a database
+// that stopped answering looks to the control plane.
+type failingStore struct {
+	storage.Store
+	fail atomic.Bool
+}
+
+func (f *failingStore) GetAllValidPublicKeys(ctx context.Context) ([]ed25519.PublicKey, error) {
+	if f.fail.Load() {
+		return nil, errors.New("store: connection refused")
+	}
+	return f.Store.GetAllValidPublicKeys(ctx)
+}
+
+func (f *failingStore) GetNode(ctx context.Context, peerID string) (*storage.EnrolledNode, error) {
+	if f.fail.Load() {
+		return nil, errors.New("store: connection refused")
+	}
+	return f.Store.GetNode(ctx, peerID)
+}
+
+// A store that does not answer is an outage, not a refusal: the member is
+// told 503 and the control plane logs it, where before it was told 401, the
+// answer a revoked credential gets, and nothing was logged. On the testnet
+// a database stall produced hundreds of such 401s per step of the ladder.
+func TestMemberAuthAnswersStoreFailureAs503(t *testing.T) {
+	t.Parallel()
+
+	dbPath := filepath.Join(t.TempDir(), "control-plane.db")
+	real, err := storage.NewSQLStore("sqlite", dbPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	store := &failingStore{Store: real}
+	srv, err := NewServer(Options{
+		ListenAddr: "127.0.0.1:0", DriverName: "sqlite", DataSourceName: dbPath,
+		AllowedAudiences: []string{"agentmesh-audience"}, BiscuitTimeout: 10 * time.Second,
+	}, store)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := srv.Start(); err != nil {
+		t.Fatal(err)
+	}
+	defer func() {
+		_ = srv.Close()
+		_ = real.Close()
+	}()
+	cpURL := "http://" + srv.listener.Addr().String()
+
+	ctx := context.Background()
+	priv, biscuitBytes := enrollRefreshTestNode(t, ctx, real)
+	body := catalogBody(t, &api.ServiceInfo{Type: api.ServiceType_SERVICE_TYPE_MCP, Name: "calc"})
+	if got := postCatalog(t, cpURL, bearer(biscuitBytes), priv, body); got != http.StatusNoContent {
+		t.Fatalf("admitted node with a healthy store: got status %d, want %d", got, http.StatusNoContent)
+	}
+
+	store.fail.Store(true)
+	if got := postCatalog(t, cpURL, bearer(biscuitBytes), priv, body); got != http.StatusServiceUnavailable {
+		t.Fatalf("admitted node with a failing store: got status %d, want %d, not a refusal", got, http.StatusServiceUnavailable)
+	}
+
+	store.fail.Store(false)
+	if got := postCatalog(t, cpURL, bearer(biscuitBytes), priv, body); got != http.StatusNoContent {
+		t.Fatalf("admitted node once the store answers again: got status %d, want %d", got, http.StatusNoContent)
+	}
+}
+
 // The cache is keyed by the canonical base58 form from the verified biscuit,
 // but the enrollment record's PeerID comes off the wire and may be any valid
 // encoding of the same peer (e.g. CIDv1 base32). The view lookup and the
@@ -359,7 +435,7 @@ func TestCatalogPeerIDCanonicalization(t *testing.T) {
 
 	// The view must join the CIDv1 record with the canonically-keyed entry,
 	// displayed under the record's own spelling.
-	view := adminNodeCatalog(t, cpURL, srv.config.AdminToken)
+	view := adminStatus(t, cpURL, srv.config.AdminToken).GetNodeCatalog()
 	if _, ok := view[cidForm]; !ok || len(view[cidForm].GetServices()) != 1 {
 		t.Fatalf("CIDv1-enrolled node's report missing from node_catalog, got %v", view)
 	}
diff --git a/internal/controlplane/config.go b/internal/controlplane/config.go
index 8e1924d0..2f403ab9 100644
--- a/internal/controlplane/config.go
+++ b/internal/controlplane/config.go
@@ -49,9 +49,10 @@ type Options struct {
 	OIDCSessionTTL        time.Duration // How long an OIDC enrollment stays refreshable before the identity must re-authenticate interactively; defaults to api.OIDCSessionTTL
 	WorkloadSessionTTL    time.Duration // Session TTL for enrollments from a WorkloadIssuer; defaults to DefaultWorkloadSessionTTL (48h)
 	// NodeRetention is how long an enrolled node's row is kept after its
-	// session expired before being deleted; 0 keeps rows forever. Every
-	// pod restart without a persistent data dir enrolls a fresh identity,
-	// so without this the nodes table only ever grows.
+	// session expired before being deleted; unset is DefaultNodeRetention,
+	// and Validate refuses a negative value. Every pod restart without a
+	// persistent data dir enrolls a fresh identity, so without a bound the
+	// nodes table only ever grows.
 	NodeRetention         time.Duration
 	AdminToken            string // Optional: administrative bearer token for protecting policy and enrollment queue REST APIs
 	AutoApproveEnrollment bool   // If true, valid bootstrap token enrollment requests are immediately approved without administrative manual gate
@@ -124,6 +125,9 @@ func (o *Options) Default() {
 	if o.WorkloadSessionTTL <= 0 {
 		o.WorkloadSessionTTL = DefaultWorkloadSessionTTL
 	}
+	if o.NodeRetention == 0 {
+		o.NodeRetention = DefaultNodeRetention
+	}
 	if o.DelegatedBiscuitTTL <= 0 {
 		o.DelegatedBiscuitTTL = 1 * time.Hour
 	}
@@ -149,5 +153,8 @@ func (o *Options) Validate() error {
 	if err := api.ValidateDirectoryParameters(o.DHTReplication, o.DHTReprovideInterval); err != nil {
 		return err
 	}
+	if o.NodeRetention <= 0 {
+		return fmt.Errorf("NodeRetention must be positive, got %s: node records are never kept forever", o.NodeRetention)
+	}
 	return nil
 }
diff --git a/internal/controlplane/metrics.go b/internal/controlplane/metrics.go
index a4f1ab0d..fb1f2a84 100644
--- a/internal/controlplane/metrics.go
+++ b/internal/controlplane/metrics.go
@@ -91,16 +91,6 @@ const (
 	meshStateTimeout = 5 * time.Second
 )
 
-// Node admission states as reported by meshStateCollector. "admitted" is
-// what CheckAdmission says, not liveness: a node that enrolled once and went
-// away stays admitted until its session expires. Liveness is
-// agentmesh_control_plane_mesh_connected_peers.
-const (
-	nodeStateAdmitted = "admitted"
-	nodeStateExpired  = "expired"
-	nodeStateBanned   = "banned"
-)
-
 // Bootstrap token states as reported by meshStateCollector.
 const (
 	tokenStateActive    = "active"
@@ -294,12 +284,14 @@ func readMeshSnapshot(ctx context.Context, store storage.Store, now time.Time) (
 		tokensByState:      map[string]int{},
 	}
 
-	nodes, err := store.ListNodes(ctx)
+	// Liveness is agentmesh_control_plane_mesh_connected_peers, not the
+	// "admitted" state (see storage.NodeState).
+	counts, err := store.CountNodes(ctx, now)
 	if err != nil {
 		return snap, err
 	}
-	for i := range nodes {
-		snap.nodesByRoleState[[2]string{nodes[i].Role, nodeState(&nodes[i], now)}]++
+	for _, c := range counts {
+		snap.nodesByRoleState[[2]string{c.Role, string(c.State)}] = c.Count
 	}
 
 	users, err := store.ListUsers(ctx)
@@ -351,17 +343,6 @@ func enrollmentStatusLabel(s api.EnrollmentStatus) string {
 	return strings.ToLower(strings.TrimPrefix(s.String(), "ENROLLMENT_STATUS_"))
 }
 
-func nodeState(n *storage.EnrolledNode, now time.Time) string {
-	switch n.CheckAdmission(now) {
-	case nil:
-		return nodeStateAdmitted
-	case storage.ErrNodeBanned:
-		return nodeStateBanned
-	default:
-		return nodeStateExpired
-	}
-}
-
 func tokenState(t *storage.BootstrapToken, now time.Time) string {
 	switch {
 	case t.IsRevoked():
diff --git a/internal/controlplane/node_gc.go b/internal/controlplane/node_gc.go
index 1d1b3394..91529108 100644
--- a/internal/controlplane/node_gc.go
+++ b/internal/controlplane/node_gc.go
@@ -28,11 +28,20 @@ const (
 	// and is what --node-retention defaults to.
 	DefaultNodeRetention = 30 * 24 * time.Hour
 
-	// nodeGCInterval is how often the sweep runs. Rows lapse on a scale of
-	// days, so nothing is gained by sweeping more often than hourly.
-	nodeGCInterval = time.Hour
+	// maxNodeGCInterval bounds how often the sweep runs. Rows lapse on a
+	// scale of days, so nothing is gained by sweeping more often than hourly;
+	// a retention far shorter than that, as a test sets, sweeps at a tenth
+	// of it so a lapsed row does not outlive the retention by much.
+	maxNodeGCInterval = time.Hour
+	minNodeGCInterval = time.Second
 )
 
+// nodeGCInterval is the sweep period for a retention: a tenth of it, within
+// [minNodeGCInterval, maxNodeGCInterval].
+func nodeGCInterval(retention time.Duration) time.Duration {
+	return min(maxNodeGCInterval, max(minNodeGCInterval, retention/10))
+}
+
 var nodesDeletedTotal = promauto.NewCounter(prometheus.CounterOpts{
 	Name: "agentmesh_control_plane_nodes_deleted_total",
 	Help: "Enrolled node records removed after outliving their session by the retention period",
@@ -43,13 +52,9 @@ var nodesDeletedTotal = promauto.NewCounter(prometheus.CounterOpts{
 // harmless and not worth a claim.
 func (s *Server) runNodeGCLoop() {
 	defer s.wg.Done()
-	if s.config.NodeRetention <= 0 {
-		return
-	}
-
 	s.gcExpiredNodes(time.Now())
 
-	ticker := time.NewTicker(nodeGCInterval)
+	ticker := time.NewTicker(nodeGCInterval(s.config.NodeRetention))
 	defer ticker.Stop()
 	for {
 		select {
@@ -62,12 +67,10 @@ func (s *Server) runNodeGCLoop() {
 }
 
 // gcExpiredNodes deletes every unbanned node whose session expired more than
-// NodeRetention before now. A retention of zero means keep forever, and that
-// holds here too, not only in the loop that decides whether to tick.
+// NodeRetention before now. Options.Validate has refused a retention that is
+// not positive, so there is no "keep forever": an unbounded nodes table is
+// what slowed every console refresh and metrics scrape.
 func (s *Server) gcExpiredNodes(now time.Time) {
-	if s.config.NodeRetention <= 0 {
-		return
-	}
 	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
 	defer cancel()
 
diff --git a/internal/controlplane/node_gc_test.go b/internal/controlplane/node_gc_test.go
index a7874ec7..58b62e7b 100644
--- a/internal/controlplane/node_gc_test.go
+++ b/internal/controlplane/node_gc_test.go
@@ -16,6 +16,7 @@ package controlplane
 
 import (
 	"context"
+	"strings"
 	"testing"
 	"time"
 
@@ -57,7 +58,7 @@ func TestGCExpiredNodesAppliesRetention(t *testing.T) {
 
 	srv.gcExpiredNodes(now)
 
-	nodes, err := store.ListNodes(ctx)
+	nodes, err := store.ListNodes(ctx, storage.NodeFilter{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -77,15 +78,52 @@ func TestGCExpiredNodesAppliesRetention(t *testing.T) {
 	}
 }
 
-func TestNodeGCLoopIsOffWithoutRetention(t *testing.T) {
+// A retention that is not positive is refused, not read as "keep forever":
+// an unbounded nodes table is what this GC exists to prevent. Unset is the
+// default (TestGCExpiredNodesDefaultsRetention).
+func TestNodeRetentionMustBePositive(t *testing.T) {
+	store := newMetricsTestStore(t)
+	for _, retention := range []time.Duration{-1, -time.Hour} {
+		_, err := NewServer(Options{DriverName: "sqlite", DataSourceName: "unused", OIDCIssuer: "https://issuer", NodeRetention: retention}, store)
+		if err == nil || !strings.Contains(err.Error(), "NodeRetention must be positive") {
+			t.Fatalf("NewServer with NodeRetention %s: err = %v, want a refusal naming NodeRetention", retention, err)
+		}
+	}
+}
+
+// The sweep runs at a tenth of the retention, no more often than every
+// second and no less often than hourly: the default retention sweeps hourly,
+// a test's retention of seconds sweeps every second.
+func TestNodeGCIntervalFollowsRetention(t *testing.T) {
+	for retention, want := range map[time.Duration]time.Duration{
+		DefaultNodeRetention: time.Hour,
+		24 * time.Hour:       time.Hour,
+		5 * time.Hour:        30 * time.Minute,
+		time.Second:          time.Second,
+		3 * time.Second:      time.Second,
+	} {
+		if got := nodeGCInterval(retention); got != want {
+			t.Errorf("nodeGCInterval(%s) = %s, want %s", retention, got, want)
+		}
+	}
+}
+
+// A caller that leaves NodeRetention unset, such as agentmesh-one, still
+// reclaims rows whose session lapsed more than DefaultNodeRetention ago.
+func TestGCExpiredNodesDefaultsRetention(t *testing.T) {
 	store := newMetricsTestStore(t)
 	ctx := context.Background()
 	now := time.Now()
-	if err := store.EnrollNode(ctx, &storage.EnrolledNode{
-		PeerID: "lapsed", PublicKey: []byte("pub"), Biscuit: []byte("b"), Role: api.RoleNode,
-		EnrollmentType: "OIDC", EnrolledAt: now.Add(-2 * time.Hour), ExpiresAt: now.Add(-time.Hour),
-	}); err != nil {
-		t.Fatal(err)
+	for id, expiresAt := range map[string]time.Time{
+		"stale":  now.Add(-DefaultNodeRetention - time.Hour),
+		"recent": now.Add(-DefaultNodeRetention + time.Hour),
+	} {
+		if err := store.EnrollNode(ctx, &storage.EnrolledNode{
+			PeerID: id, PublicKey: []byte("pub"), Biscuit: []byte("b"), Role: api.RoleNode,
+			EnrollmentType: "OIDC", EnrolledAt: now.Add(-90 * 24 * time.Hour), ExpiresAt: expiresAt,
+		}); err != nil {
+			t.Fatalf("enroll %s: %v", id, err)
+		}
 	}
 
 	srv, err := NewServer(Options{DriverName: "sqlite", DataSourceName: "unused", OIDCIssuer: "https://issuer"}, store)
@@ -94,16 +132,12 @@ func TestNodeGCLoopIsOffWithoutRetention(t *testing.T) {
 	}
 	defer func() { _ = srv.Close() }()
 
-	// The loop returns immediately with retention 0, and a direct sweep is a
-	// no-op too: zero means keep forever, not "expired as of now".
-	srv.wg.Add(1)
-	srv.runNodeGCLoop()
 	srv.gcExpiredNodes(now)
-	nodes, err := store.ListNodes(ctx)
+	nodes, err := store.ListNodes(ctx, storage.NodeFilter{})
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(nodes) != 1 {
-		t.Fatalf("retention 0 deleted rows: %d left", len(nodes))
+	if len(nodes) != 1 || nodes[0].PeerID != "recent" {
+		t.Fatalf("after a sweep with the default retention got %+v, want only recent", nodes)
 	}
 }
diff --git a/internal/controlplane/server.go b/internal/controlplane/server.go
index 9ed6d6a2..e7e617bb 100644
--- a/internal/controlplane/server.go
+++ b/internal/controlplane/server.go
@@ -355,6 +355,7 @@ func (s *Server) RegisterRoutes(mux *http.ServeMux) {
 	handle("/admin/status", noStore(s.HandleAdminStatus))
 	handle("/admin/policy", noStore(s.HandleAdminPolicy))
 	handle("/user/status", noStore(s.HandleUserStatus))
+	handle("/user/nodes", noStore(s.HandleListNodes))
 	handle("/user/bootstrap-tokens", noStore(s.HandleUserBootstrapTokens))
 	handle("/user/revoke", noStore(s.HandleUserRevoke))
 }
@@ -1620,24 +1621,20 @@ func (s *Server) unservedEgress(ctx context.Context, policy *api.PolicyConfig) (
 	if len(policy.GetEgress()) == 0 {
 		return nil, nil, nil
 	}
-	nodes, err := s.store.ListNodes(ctx)
+	nodes, err := s.store.ListNodes(ctx, storage.NodeFilter{States: []storage.NodeState{storage.NodeAdmitted}})
 	if err != nil {
 		return nil, nil, err
 	}
-	// Admission and roles belong to the node, not to the destination, so each
-	// node is settled once and an unresolved one is reported once.
+	// Roles belong to the node, not to the destination, so each node is
+	// settled once and an unresolved one is reported once.
 	type candidate struct {
 		roles  []string
 		labels map[string]string
 	}
-	now := time.Now()
 	var candidates []candidate
 	var unresolved []unresolvedNode
 	for i := range nodes {
 		node := &nodes[i]
-		if node.CheckAdmission(now) != nil {
-			continue
-		}
 		roles, err := nodeRoles(node, policy.GetBindings())
 		if err != nil {
 			unresolved = append(unresolved, unresolvedNode{peerID: node.PeerID, err: err})
@@ -1664,9 +1661,15 @@ func (s *Server) unservedEgress(ctx context.Context, policy *api.PolicyConfig) (
 // admittedNodeWithChallenge returns the enrolled, admitted node whose biscuit
 // the request bears after verifying the signed freshness challenge in
 // HeaderChallengeTimestamp and HeaderChallengeSignature against the node's
-// stored public key. Every failure writes a uniform 401 Unauthorized.
+// stored public key. A credential that does not verify writes a uniform 401
+// Unauthorized; a store that could not be read writes 503, so that a member
+// retries instead of taking a database outage for a revocation.
 func (s *Server) admittedNodeWithChallenge(w http.ResponseWriter, r *http.Request, challengeFn func(peerID string, ts int64) []byte) *storage.EnrolledNode {
-	nodeRecord := s.admittedNode(r)
+	nodeRecord, err := s.admittedNode(r)
+	if err != nil {
+		writeStoreUnavailable(w, r, err)
+		return nil
+	}
 	if nodeRecord == nil {
 		writeChallengeError(w, "Unauthorized: node credential required")
 		return nil
@@ -1692,29 +1695,43 @@ func (s *Server) admittedNodeWithChallenge(w http.ResponseWriter, r *http.Reques
 }
 
 // admittedNode returns the enrolled, admitted node whose biscuit the request
-// bears, or nil.
-func (s *Server) admittedNode(r *http.Request) *storage.EnrolledNode {
+// bears, or nil when the request carries no such credential. The error is a
+// store that could not be read, which says nothing about the credential;
+// the caller answers it as an outage, not as a refusal.
+func (s *Server) admittedNode(r *http.Request) (*storage.EnrolledNode, error) {
 	authHeader := r.Header.Get("Authorization")
 	if !strings.HasPrefix(authHeader, "Bearer ") {
-		return nil
+		return nil, nil
 	}
 	biscuitBytes, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(authHeader, "Bearer "))
 	if err != nil {
-		return nil
+		return nil, nil
 	}
 	trustedKeys, err := s.store.GetAllValidPublicKeys(r.Context())
 	if err != nil {
-		return nil
+		return nil, fmt.Errorf("signing keys: %w", err)
 	}
 	peerID, err := identity.VerifyAndExtractPeerID(trustedKeys, biscuitBytes, s.config.BiscuitTimeout)
 	if err != nil {
-		return nil
+		return nil, nil
 	}
 	nodeRecord, err := s.store.GetNode(r.Context(), peerID.String())
-	if err != nil || nodeRecord == nil || nodeRecord.CheckAdmission(time.Now()) != nil {
-		return nil
+	if err != nil && !errors.Is(err, storage.ErrNotFound) {
+		return nil, fmt.Errorf("node %s: %w", peerID, err)
 	}
-	return nodeRecord
+	if nodeRecord == nil || nodeRecord.CheckAdmission(time.Now()) != nil {
+		return nil, nil
+	}
+	return nodeRecord, nil
+}
+
+// writeStoreUnavailable answers a mesh request the control plane could not
+// authenticate because its own store did not answer: 503, so the member
+// retries at its next sync, and a log line, so the outage is read from the
+// control plane and not inferred from members reporting 401.
+func writeStoreUnavailable(w http.ResponseWriter, r *http.Request, err error) {
+	logger.Errorw("Store unavailable while authenticating a member", "path", r.URL.Path, "error", err)
+	http.Error(w, "Service unavailable: control plane store did not answer", http.StatusServiceUnavailable)
 }
 
 // HandleEgress HTTP GET `/egress`: the egress destinations the requesting
@@ -3108,17 +3125,23 @@ func (s *Server) HandleUserStatus(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	isAdmin := user.Role == "admin"
 
-	allNodes, err := s.store.ListNodes(ctx)
+	// A banned node is out of the mesh and only an administrator can restore
+	// it, so only the administrators' list carries banned rows: a user's
+	// list would otherwise keep every node they ever revoked, forever.
+	filter := storage.NodeFilter{States: statusNodeStates, Now: time.Now()}
+	if !isAdmin {
+		filter.States = []storage.NodeState{storage.NodeAdmitted}
+		filter.OwnerID = &user.ID
+	}
+	allNodes, err := s.store.ListNodes(ctx, filter)
 	if err != nil {
 		logger.Errorf("Failed to list nodes: %v", err)
 		http.Error(w, "Internal server error", http.StatusInternalServerError)
 		return
 	}
-	nodes := []*api.EnrolledNode{}
+	nodes := make([]*api.EnrolledNode, 0, len(allNodes))
 	for i := range allNodes {
-		if isAdmin || allNodes[i].OwnerID == user.ID {
-			nodes = append(nodes, enrolledNodeView(&allNodes[i], isAdmin))
-		}
+		nodes = append(nodes, enrolledNodeView(&allNodes[i], isAdmin))
 	}
 
 	allTokens, err := s.store.ListBootstrapTokens(ctx)
diff --git a/internal/controlplane/server_test.go b/internal/controlplane/server_test.go
index 22d18c1b..d6461645 100644
--- a/internal/controlplane/server_test.go
+++ b/internal/controlplane/server_test.go
@@ -2620,6 +2620,24 @@ func TestUserStatusAndTenancy(t *testing.T) {
 	if !nodeAUpdated.Banned {
 		t.Error("expected node A to be banned/revoked in DB")
 	}
+
+	// A revoked node is out of the user's list from then on: banned rows are
+	// never garbage-collected, and only an administrator can restore one.
+	req, _ = http.NewRequest("GET", baseURL+"/user/status", nil)
+	req.Header.Set("Authorization", "Bearer "+tokenA)
+	resp, err = client.Do(req)
+	if err != nil {
+		t.Fatalf("GET /user/status after revoke failed: %v", err)
+	}
+	statusBody, _ = io.ReadAll(resp.Body)
+	_ = resp.Body.Close()
+	data = &api.UserStatusResponse{}
+	if err := protojson.Unmarshal(statusBody, data); err != nil {
+		t.Fatalf("decode /user/status after revoke: %v", err)
+	}
+	if nodes := data.GetEnrolledNodes(); len(nodes) != 0 {
+		t.Errorf("after revoking its only node the user's status lists %d node(s), want none: %v", len(nodes), nodes)
+	}
 }
 
 func TestResolveRolesAndRoleImpersonationProtection(t *testing.T) {
diff --git a/internal/controlplane/sts.go b/internal/controlplane/sts.go
index 2b8414c8..37ccaeb3 100644
--- a/internal/controlplane/sts.go
+++ b/internal/controlplane/sts.go
@@ -743,7 +743,11 @@ func (s *Server) HandleTokenExchange(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
 		return
 	}
-	nodeRecord := s.admittedNode(r)
+	nodeRecord, err := s.admittedNode(r)
+	if err != nil {
+		writeStoreUnavailable(w, r, err)
+		return
+	}
 	if nodeRecord == nil {
 		writeChallengeError(w, "Unauthorized: node credential required")
 		return
@@ -944,7 +948,11 @@ func (s *Server) HandleSTSToken(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
 		return
 	}
-	nodeRecord := s.admittedNode(r)
+	nodeRecord, err := s.admittedNode(r)
+	if err != nil {
+		writeStoreUnavailable(w, r, err)
+		return
+	}
 	if nodeRecord == nil {
 		writeChallengeError(w, "Unauthorized: node credential required")
 		return
@@ -1553,7 +1561,11 @@ func decodeBase64Biscuit(encoded string) ([]byte, error) {
 }
 
 func (s *Server) resolveDefaultActorPeer(ctx context.Context, r *http.Request) (peer.ID, error) {
-	if nodeRecord := s.admittedNode(r); nodeRecord != nil {
+	nodeRecord, err := s.admittedNode(r)
+	if err != nil {
+		return "", err
+	}
+	if nodeRecord != nil {
 		return peer.Decode(nodeRecord.PeerID)
 	}
 	_, pub, err := s.store.GetCurrentKey(ctx)
@@ -1708,7 +1720,12 @@ func (s *Server) handleOAuthTokenExchangeGrant(w http.ResponseWriter, r *http.Re
 			}
 		}
 	} else {
-		admitted := s.admittedNode(r)
+		admitted, storeErr := s.admittedNode(r)
+		if storeErr != nil {
+			logger.Errorw("Store unavailable while authenticating a member", "path", r.URL.Path, "error", storeErr)
+			writeOAuthError(w, http.StatusServiceUnavailable, "temporarily_unavailable", "control plane store did not answer")
+			return
+		}
 		actorPeerID, err := s.resolveDefaultActorPeer(r.Context(), r)
 		if err != nil {
 			writeOAuthError(w, http.StatusBadRequest, "invalid_request", "Could not resolve actor peer_id: "+err.Error())
diff --git a/internal/controlplane/sts_test.go b/internal/controlplane/sts_test.go
index ca594281..3ff020de 100644
--- a/internal/controlplane/sts_test.go
+++ b/internal/controlplane/sts_test.go
@@ -126,7 +126,7 @@ func TestTokenExchangeStatelessAndRoleIsolation(t *testing.T) {
 		t.Fatalf("SavePolicyDocument: %v", err)
 	}
 
-	nodesBefore, err := store.ListNodes(ctx)
+	nodesBefore, err := store.ListNodes(ctx, storage.NodeFilter{})
 	if err != nil {
 		t.Fatalf("ListNodes: %v", err)
 	}
@@ -186,7 +186,7 @@ func TestTokenExchangeStatelessAndRoleIsolation(t *testing.T) {
 	}
 
 	// Verify zero DB writes occurred during /token/exchange.
-	nodesAfter, err := store.ListNodes(ctx)
+	nodesAfter, err := store.ListNodes(ctx, storage.NodeFilter{})
 	if err != nil {
 		t.Fatalf("ListNodes after exchange: %v", err)
 	}
diff --git a/internal/controlplane/ui.go b/internal/controlplane/ui.go
index 25336889..cd94d018 100644
--- a/internal/controlplane/ui.go
+++ b/internal/controlplane/ui.go
@@ -15,12 +15,30 @@
 package controlplane
 
 import (
+	"encoding/base64"
+	"errors"
+	"fmt"
 	"net/http"
+	"slices"
+	"strconv"
+	"strings"
 	"time"
 
 	"github.com/google/agentmesh/api"
+	"github.com/google/agentmesh/internal/storage"
 )
 
+// Page bounds for GET /user/nodes, so one request is one bounded query.
+const (
+	defaultNodesPageSize = 50
+	maxNodesPageSize     = 200
+)
+
+// statusNodeStates are the nodes GET /admin/status and GET /user/status list on
+// every console refresh. Expired rows stay for the retention period, so
+// GET /user/nodes pages them instead and the lists stay the size of the live mesh.
+var statusNodeStates = []storage.NodeState{storage.NodeAdmitted, storage.NodeBanned}
+
 // HandleAdminStatus HTTP GET `/admin/status`: the whole mesh as the console
 // shows it, protojson of AdminStatusResponse.
 func (s *Server) HandleAdminStatus(w http.ResponseWriter, r *http.Request) {
@@ -34,6 +52,7 @@ func (s *Server) HandleAdminStatus(w http.ResponseWriter, r *http.Request) {
 	}
 
 	ctx := r.Context()
+	now := time.Now()
 
 	routers, err := s.store.GetActiveRouters(ctx)
 	if err != nil {
@@ -42,7 +61,7 @@ func (s *Server) HandleAdminStatus(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	nodes, err := s.store.ListNodes(ctx)
+	nodes, err := s.store.ListNodes(ctx, storage.NodeFilter{States: statusNodeStates, Now: now})
 	if err != nil {
 		logger.Errorf("Failed to list nodes: %v", err)
 		http.Error(w, "Internal server error", http.StatusInternalServerError)
@@ -89,6 +108,132 @@ func (s *Server) HandleAdminStatus(w http.ResponseWriter, r *http.Request) {
 		EnrollmentRequests: enrollmentRequestViews(reqs),
 		BootstrapTokens:    bootstrapTokenViews(tokens),
 		Policy:             policy,
-		NodeCatalog:        s.catalogViewFor(nodes, time.Now()),
+		NodeCatalog:        s.catalogViewFor(nodes, now),
+	})
+}
+
+// HandleListNodes HTTP GET `/user/nodes`: one page of the nodes the caller
+// may see, protojson of NodeListResponse. An administrator sees every owner's
+// nodes and may pick one with owner_id; a user sees only its own.
+func (s *Server) HandleListNodes(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	user, ok := s.requireUser(w, r)
+	if !ok {
+		return
+	}
+
+	query := r.URL.Query()
+	pageSize, err := parseNodesPageSize(query.Get("page_size"))
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	after, err := decodeNodesPageToken(query.Get("page_token"))
+	if err != nil {
+		http.Error(w, "Invalid page_token", http.StatusBadRequest)
+		return
+	}
+	states, err := parseNodeStates(query["state"])
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	isAdmin := user.Role == "admin"
+	owner := &user.ID
+	if isAdmin {
+		owner = nil
+	}
+	if query.Has("owner_id") {
+		id := query.Get("owner_id")
+		if !isAdmin && id != user.ID {
+			http.Error(w, "Only an administrator may list another owner's nodes", http.StatusForbidden)
+			return
+		}
+		owner = &id
+	}
+
+	// One row past the page tells whether a next page exists.
+	nodes, err := s.store.ListNodes(r.Context(), storage.NodeFilter{
+		States:  states,
+		Now:     time.Now(),
+		OwnerID: owner,
+		Role:    query.Get("role"),
+		After:   after,
+		Limit:   pageSize + 1,
 	})
+	if err != nil {
+		logger.Errorf("Failed to list nodes: %v", err)
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+		return
+	}
+
+	resp := &api.NodeListResponse{}
+	if len(nodes) > pageSize {
+		nodes = nodes[:pageSize]
+		last := nodes[pageSize-1]
+		resp.NextPageToken = encodeNodesPageToken(storage.NodeCursor{EnrolledAt: last.EnrolledAt, PeerID: last.PeerID})
+	}
+	for i := range nodes {
+		resp.Nodes = append(resp.Nodes, enrolledNodeView(&nodes[i], isAdmin))
+	}
+	writeProtoJSON(w, resp)
+}
+
+func parseNodesPageSize(raw string) (int, error) {
+	if raw == "" {
+		return defaultNodesPageSize, nil
+	}
+	n, err := strconv.Atoi(raw)
+	if err != nil || n < 1 {
+		return 0, errors.New("page_size must be a positive integer")
+	}
+	return min(n, maxNodesPageSize), nil
+}
+
+// parseNodeStates reads the repeatable state parameter; none means every state.
+func parseNodeStates(raw []string) ([]storage.NodeState, error) {
+	states := make([]storage.NodeState, 0, len(raw))
+	for _, value := range raw {
+		state := storage.NodeState(value)
+		switch state {
+		case storage.NodeAdmitted, storage.NodeExpired, storage.NodeBanned:
+			if !slices.Contains(states, state) {
+				states = append(states, state)
+			}
+		default:
+			return nil, fmt.Errorf("state must be admitted, expired or banned, not %q", value)
+		}
+	}
+	return states, nil
+}
+
+// The token is opaque to clients: base64url of "<enrollment unix ms>:<peer ID>",
+// the sort key of the last row served.
+func encodeNodesPageToken(c storage.NodeCursor) string {
+	key := strconv.FormatInt(c.EnrolledAt.UnixMilli(), 10) + ":" + c.PeerID
+	return base64.RawURLEncoding.EncodeToString([]byte(key))
+}
+
+// decodeNodesPageToken returns nil for an empty token, the first page.
+func decodeNodesPageToken(token string) (*storage.NodeCursor, error) {
+	if token == "" {
+		return nil, nil
+	}
+	raw, err := base64.RawURLEncoding.DecodeString(token)
+	if err != nil {
+		return nil, err
+	}
+	ms, peerID, ok := strings.Cut(string(raw), ":")
+	if !ok || peerID == "" {
+		return nil, errors.New("page token lacks a peer ID")
+	}
+	at, err := strconv.ParseInt(ms, 10, 64)
+	if err != nil {
+		return nil, err
+	}
+	return &storage.NodeCursor{EnrolledAt: time.UnixMilli(at), PeerID: peerID}, nil
 }
diff --git a/internal/controlplane/ui_test.go b/internal/controlplane/ui_test.go
new file mode 100644
index 00000000..485523b1
--- /dev/null
+++ b/internal/controlplane/ui_test.go
@@ -0,0 +1,209 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package controlplane
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"net/http"
+	"net/url"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/google/agentmesh/api"
+	"github.com/google/agentmesh/internal/storage"
+	"google.golang.org/protobuf/encoding/protojson"
+)
+
+// An expired OIDC node can renew in place, so its owner and every admin must
+// be able to page through it to revoke it, and nobody else may see it.
+func TestHandleListNodes(t *testing.T) {
+	h := newLifecycleHarness(t)
+	ctx := context.Background()
+	now := time.Now()
+	const adminToken = "super-secret-admin-token"
+	aliceToken := h.mintToken(map[string]interface{}{"sub": "alice"})
+
+	for _, id := range []string{"alice", "bob"} {
+		if err := h.store.SaveUser(ctx, &storage.User{ID: id, Role: "user", CreatedAt: now}); err != nil {
+			t.Fatalf("save user %s: %v", id, err)
+		}
+	}
+	enrolled := now.Add(-48 * time.Hour)
+	for _, n := range []struct {
+		id, owner             string
+		enrolledAt, expiresAt time.Time
+	}{
+		{"alice-1", "alice", enrolled, now.Add(-time.Hour)},
+		{"bob-1", "bob", enrolled, now.Add(-time.Hour)},
+		{"alice-2", "alice", enrolled.Add(-time.Hour), now.Add(-2 * time.Hour)},
+		{"bob-2", "bob", enrolled.Add(-time.Hour), now.Add(-2 * time.Hour)},
+		{"alice-live", "alice", enrolled, now.Add(time.Hour)},
+		{"alice-banned", "alice", enrolled, now.Add(-3 * time.Hour)},
+	} {
+		if err := h.store.EnrollNode(ctx, &storage.EnrolledNode{
+			PeerID: n.id, PublicKey: []byte("pub"), Biscuit: []byte("b"), Role: api.RoleNode,
+			EnrollmentType: "OIDC", ClaimsJSON: `{"sub":"` + n.owner + `"}`, OwnerID: n.owner,
+			EnrolledAt: n.enrolledAt, ExpiresAt: n.expiresAt,
+		}); err != nil {
+			t.Fatalf("enroll %s: %v", n.id, err)
+		}
+	}
+	if err := h.store.SetNodeBanned(ctx, "alice-banned", true); err != nil {
+		t.Fatal(err)
+	}
+
+	get := func(t *testing.T, path, bearer string) []byte {
+		t.Helper()
+		status, body := h.do(http.MethodGet, path, bearer, nil, "")
+		if status != http.StatusOK {
+			t.Fatalf("GET %s: status %d, body %s", path, status, body)
+		}
+		return body
+	}
+	page := func(t *testing.T, query, bearer string) *api.NodeListResponse {
+		t.Helper()
+		resp := &api.NodeListResponse{}
+		if err := protojson.Unmarshal(get(t, "/user/nodes?"+query, bearer), resp); err != nil {
+			t.Fatalf("decode /user/nodes: %v", err)
+		}
+		return resp
+	}
+	ids := func(nodes []*api.EnrolledNode) []string {
+		var out []string
+		for _, n := range nodes {
+			out = append(out, n.GetPeerId())
+		}
+		return out
+	}
+	// pageAll follows next_page_token from the first page to the last.
+	pageAll := func(t *testing.T, bearer string) []string {
+		t.Helper()
+		var got []string
+		token := ""
+		for range 10 {
+			resp := page(t, "state=expired&page_size=1&page_token="+url.QueryEscape(token), bearer)
+			got = append(got, ids(resp.GetNodes())...)
+			if token = resp.GetNextPageToken(); token == "" {
+				return got
+			}
+		}
+		t.Fatalf("next_page_token never ran out, visited %v", got)
+		return nil
+	}
+
+	t.Run("admin sees every expired node", func(t *testing.T) {
+		want := []string{"bob-1", "alice-1", "bob-2", "alice-2"}
+		if got := pageAll(t, adminToken); !slices.Equal(got, want) {
+			t.Errorf("admin paged through %v, want %v", got, want)
+		}
+	})
+
+	t.Run("user sees only its own expired nodes", func(t *testing.T) {
+		want := []string{"alice-1", "alice-2"}
+		if got := pageAll(t, aliceToken); !slices.Equal(got, want) {
+			t.Errorf("alice paged through %v, want %v", got, want)
+		}
+	})
+
+	t.Run("a cursor from another owner's row does not widen the scope", func(t *testing.T) {
+		token := encodeNodesPageToken(storage.NodeCursor{EnrolledAt: enrolled, PeerID: "bob-1"})
+		want := []string{"alice-1", "alice-2"}
+		if got := ids(page(t, "state=expired&page_token="+token, aliceToken).GetNodes()); !slices.Equal(got, want) {
+			t.Errorf("alice after bob-1's cursor got %v, want %v", got, want)
+		}
+	})
+
+	t.Run("admin narrows by owner and state", func(t *testing.T) {
+		want := []string{"alice-live", "alice-banned"}
+		if got := ids(page(t, "owner_id=alice&state=admitted&state=banned", adminToken).GetNodes()); !slices.Equal(got, want) {
+			t.Errorf("admin listing alice's admitted and banned nodes got %v, want %v", got, want)
+		}
+	})
+
+	t.Run("a user may name only itself as owner", func(t *testing.T) {
+		want := []string{"alice-live", "alice-banned", "alice-1", "alice-2"}
+		if got := ids(page(t, "owner_id=alice", aliceToken).GetNodes()); !slices.Equal(got, want) {
+			t.Errorf("alice listing her own nodes got %v, want %v", got, want)
+		}
+		if status, body := h.do(http.MethodGet, "/user/nodes?owner_id=bob", aliceToken, nil, ""); status != http.StatusForbidden {
+			t.Errorf("alice listing bob's nodes: status %d (%s), want %d", status, body, http.StatusForbidden)
+		}
+	})
+
+	t.Run("claims stay admin-only", func(t *testing.T) {
+		body := get(t, "/user/nodes", aliceToken)
+		for _, field := range []string{`"claims_json"`, `"biscuit"`, `"public_key"`} {
+			if bytes.Contains(body, []byte(field)) {
+				t.Errorf("non-admin body carries %s: %s", field, body)
+			}
+		}
+		if body := get(t, "/user/nodes", adminToken); !bytes.Contains(body, []byte(`"claims_json"`)) {
+			t.Errorf("admin body lacks \"claims_json\": %s", body)
+		}
+	})
+
+	t.Run("GET /user/status leaves expired nodes out", func(t *testing.T) {
+		status := &api.UserStatusResponse{}
+		if err := protojson.Unmarshal(get(t, "/user/status", aliceToken), status); err != nil {
+			t.Fatalf("decode /user/status: %v", err)
+		}
+		got := ids(status.GetEnrolledNodes())
+		if !slices.Contains(got, "alice-live") || slices.Contains(got, "alice-1") {
+			t.Errorf("enrolled_nodes = %v, want alice-live listed and alice-1 left out", got)
+		}
+	})
+
+	for _, tc := range []struct {
+		name, bearer, query string
+		want                int
+	}{
+		{"malformed page_token", adminToken, "page_token=%21%21", http.StatusBadRequest},
+		{"page_token without a peer ID", adminToken, "page_token=" + base64.RawURLEncoding.EncodeToString([]byte("1700000000000")), http.StatusBadRequest},
+		{"page_size zero", adminToken, "page_size=0", http.StatusBadRequest},
+		{"page_size not a number", adminToken, "page_size=ten", http.StatusBadRequest},
+		{"unknown state", adminToken, "state=lapsed", http.StatusBadRequest},
+		{"unauthenticated", "", "", http.StatusUnauthorized},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if status, body := h.do(http.MethodGet, "/user/nodes?"+tc.query, tc.bearer, nil, ""); status != tc.want {
+				t.Errorf("status %d (%s), want %d", status, body, tc.want)
+			}
+		})
+	}
+}
+
+// The default and the ceiling are what keep one console request one bounded query.
+func TestParseNodesPageSize(t *testing.T) {
+	for _, tc := range []struct {
+		raw     string
+		want    int
+		wantErr bool
+	}{
+		{"", defaultNodesPageSize, false},
+		{"7", 7, false},
+		{"5000", maxNodesPageSize, false},
+		{"0", 0, true},
+		{"-3", 0, true},
+		{"ten", 0, true},
+	} {
+		got, err := parseNodesPageSize(tc.raw)
+		if (err != nil) != tc.wantErr || got != tc.want {
+			t.Errorf("parseNodesPageSize(%q) = %d, %v; want %d, error %t", tc.raw, got, err, tc.want, tc.wantErr)
+		}
+	}
+}
diff --git a/internal/standalone/standalone.go b/internal/standalone/standalone.go
index e5e5d105..f859edec 100644
--- a/internal/standalone/standalone.go
+++ b/internal/standalone/standalone.go
@@ -137,6 +137,9 @@ type ControlPlaneTunables struct {
 	// WorkloadSessionTTL is how long a workload-issuer enrollment stays
 	// refreshable without presenting a fresh platform JWT on /refresh.
 	WorkloadSessionTTL time.Duration
+	// NodeRetention is how long a node record is kept after its session
+	// expired before the control plane deletes it.
+	NodeRetention time.Duration
 	// ManualEnrollment queues bootstrap enrollments for admin approval
 	// instead of auto-approving them.
 	ManualEnrollment bool
@@ -290,6 +293,7 @@ func (s *Server) Start(ctx context.Context) (retErr error) {
 		KeyGracePeriod:        s.opts.ControlPlane.KeyGracePeriod,
 		BiscuitTTL:            s.opts.ControlPlane.BiscuitTTL,
 		WorkloadSessionTTL:    s.opts.ControlPlane.WorkloadSessionTTL,
+		NodeRetention:         s.opts.ControlPlane.NodeRetention,
 		BiscuitTimeout:        10 * time.Second,
 		AdminToken:            s.adminToken,
 		AutoApproveEnrollment: !s.opts.ControlPlane.ManualEnrollment,
diff --git a/internal/storage/migration_test.go b/internal/storage/migration_test.go
index ea4c43d9..51d2d907 100644
--- a/internal/storage/migration_test.go
+++ b/internal/storage/migration_test.go
@@ -149,8 +149,9 @@ func TestMigrationConvertsSecondsToMillis(t *testing.T) {
 	}
 }
 
-// Migration 16 indexes the scans that run on every bootstrap and every GC
-// pass; the index list is the contract the planner relies on.
+// Migrations 16 and 19 index the scans that run on every bootstrap, every GC
+// pass and every console refresh; the index list is the contract the planner
+// relies on.
 func TestMigrationCreatesIndexes(t *testing.T) {
 	store, err := NewSQLStore("sqlite", filepath.Join(t.TempDir(), "cp.db"))
 	if err != nil {
@@ -174,6 +175,8 @@ func TestMigrationCreatesIndexes(t *testing.T) {
 	want := []string{
 		"idx_enrollment_requests_created_at",
 		"idx_nodes_banned_expires_at",
+		"idx_nodes_enrolled_at",
+		"idx_nodes_owner_id",
 		"idx_revoked_biscuits_expires_at",
 		"idx_routers_expires_at",
 	}
diff --git a/internal/storage/round_trip_test.go b/internal/storage/round_trip_test.go
index 1d9eee6c..d6cc8d9d 100644
--- a/internal/storage/round_trip_test.go
+++ b/internal/storage/round_trip_test.go
@@ -18,6 +18,8 @@ import (
 	"context"
 	"errors"
 	"reflect"
+	"slices"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -138,14 +140,18 @@ func TestEnrolledNodeRoundTripsEveryField(t *testing.T) {
 	requireFieldsRoundTrip(t, want, got, "Banned")
 
 	// ListNodes selects its own column list, so it can drift from GetNode.
-	listed, err := store.ListNodes(ctx)
+	// It leaves the two blobs out on purpose: a list is a view of the rows.
+	listed, err := store.ListNodes(ctx, NodeFilter{})
 	if err != nil {
 		t.Fatalf("ListNodes: %v", err)
 	}
 	if len(listed) != 1 {
 		t.Fatalf("ListNodes returned %d nodes, want 1", len(listed))
 	}
-	requireFieldsRoundTrip(t, want, &listed[0], "Banned")
+	requireFieldsRoundTrip(t, want, &listed[0], "Banned", "PublicKey", "Biscuit")
+	if len(listed[0].PublicKey) != 0 || len(listed[0].Biscuit) != 0 {
+		t.Errorf("ListNodes read the blobs: public key %d bytes, biscuit %d bytes; GetNode is what reads them", len(listed[0].PublicKey), len(listed[0].Biscuit))
+	}
 }
 
 // Autonomous recovery is a per-node, server-side opt-in: it must default
@@ -277,7 +283,7 @@ func TestDeleteExpiredNodesSparesBannedAndUnbounded(t *testing.T) {
 		t.Errorf("deleted %d rows, want 1", deleted)
 	}
 
-	remaining, err := store.ListNodes(ctx)
+	remaining, err := store.ListNodes(ctx, NodeFilter{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -298,6 +304,131 @@ func TestDeleteExpiredNodesSparesBannedAndUnbounded(t *testing.T) {
 	}
 }
 
+// The console lists, pages and revokes from what ListNodes selects, so each
+// state must hold exactly what CheckAdmission says, an owner filter must never
+// widen, and paging must not lose a row that shares its enrollment time with
+// the end of the previous page.
+func TestListNodes(t *testing.T) {
+	store := newTestStore(t)
+	ctx := context.Background()
+	now := time.Now()
+
+	for _, id := range []string{"alice", "bob"} {
+		if err := store.SaveUser(ctx, &User{ID: id, Role: "user", CreatedAt: now}); err != nil {
+			t.Fatalf("save user %s: %v", id, err)
+		}
+	}
+	enrolled := now.Add(-48 * time.Hour)
+	for _, n := range []struct {
+		id, owner, role       string
+		enrolledAt, expiresAt time.Time
+	}{
+		{"live-a", "alice", api.RoleNode, enrolled, now.Add(time.Hour)},
+		{"live-b", "bob", api.RoleNode, enrolled, now.Add(time.Hour)},
+		{"never", "alice", api.RoleRouter, enrolled.Add(-time.Hour), time.Time{}},
+		{"exp-a", "alice", api.RoleNode, enrolled.Add(-2 * time.Hour), now.Add(-time.Minute)},
+		{"exp-unowned", "", api.RoleNode, enrolled.Add(-3 * time.Hour), now.Add(-time.Hour)},
+		{"banned", "alice", api.RoleNode, enrolled.Add(-4 * time.Hour), now.Add(-24 * time.Hour)},
+	} {
+		if err := store.EnrollNode(ctx, &EnrolledNode{
+			PeerID: n.id, PublicKey: []byte("pub"), Biscuit: []byte("b"), Role: n.role,
+			EnrollmentType: "OIDC", OwnerID: n.owner, EnrolledAt: n.enrolledAt, ExpiresAt: n.expiresAt,
+		}); err != nil {
+			t.Fatalf("enroll %s: %v", n.id, err)
+		}
+	}
+	if err := store.SetNodeBanned(ctx, "banned", true); err != nil {
+		t.Fatal(err)
+	}
+
+	list := func(t *testing.T, filter NodeFilter) []string {
+		t.Helper()
+		nodes, err := store.ListNodes(ctx, filter)
+		if err != nil {
+			t.Fatalf("ListNodes(%+v): %v", filter, err)
+		}
+		var ids []string
+		for _, n := range nodes {
+			ids = append(ids, n.PeerID)
+		}
+		return ids
+	}
+
+	all := []string{"live-b", "live-a", "never", "exp-a", "exp-unowned", "banned"}
+	for _, tc := range []struct {
+		name   string
+		filter NodeFilter
+		want   []string
+	}{
+		{"zero filter", NodeFilter{}, all},
+		{"admitted", NodeFilter{States: []NodeState{NodeAdmitted}, Now: now}, []string{"live-b", "live-a", "never"}},
+		{"expired", NodeFilter{States: []NodeState{NodeExpired}, Now: now}, []string{"exp-a", "exp-unowned"}},
+		{"banned", NodeFilter{States: []NodeState{NodeBanned}, Now: now}, []string{"banned"}},
+		{"admitted or banned", NodeFilter{States: []NodeState{NodeAdmitted, NodeBanned}, Now: now}, []string{"live-b", "live-a", "never", "banned"}},
+		{"one owner", NodeFilter{OwnerID: new("alice")}, []string{"live-a", "never", "exp-a", "banned"}},
+		{"owner without nodes", NodeFilter{OwnerID: new("carol")}, nil},
+		// An empty ID must never widen to every owner, unowned rows included.
+		{"empty owner", NodeFilter{OwnerID: new("")}, nil},
+		{"role", NodeFilter{Role: api.RoleRouter}, []string{"never"}},
+		{"owner and state", NodeFilter{States: []NodeState{NodeExpired}, Now: now, OwnerID: new("alice")}, []string{"exp-a"}},
+		{"cursor from another owner's row", NodeFilter{OwnerID: new("alice"), After: &NodeCursor{EnrolledAt: enrolled, PeerID: "live-b"}}, []string{"live-a", "never", "exp-a", "banned"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := list(t, tc.filter); !slices.Equal(got, tc.want) {
+				t.Errorf("got %v, want %v", got, tc.want)
+			}
+		})
+	}
+
+	for _, pageSize := range []int{1, 4} {
+		t.Run("pages of "+strconv.Itoa(pageSize), func(t *testing.T) {
+			var got []string
+			var after *NodeCursor
+			for range len(all) + 1 {
+				page, err := store.ListNodes(ctx, NodeFilter{After: after, Limit: pageSize})
+				if err != nil {
+					t.Fatal(err)
+				}
+				if len(page) == 0 {
+					break
+				}
+				for _, n := range page {
+					got = append(got, n.PeerID)
+				}
+				last := page[len(page)-1]
+				after = &NodeCursor{EnrolledAt: last.EnrolledAt, PeerID: last.PeerID}
+			}
+			if !slices.Equal(got, all) {
+				t.Errorf("paging visited %v, want %v", got, all)
+			}
+		})
+	}
+
+	t.Run("CountNodes buckets as ListNodes filters", func(t *testing.T) {
+		counts, err := store.CountNodes(ctx, now)
+		if err != nil {
+			t.Fatalf("CountNodes: %v", err)
+		}
+		got := map[NodeCount]bool{}
+		for _, c := range counts {
+			got[c] = true
+		}
+		want := map[NodeCount]bool{
+			{Role: api.RoleNode, State: NodeAdmitted, Count: 2}:   true,
+			{Role: api.RoleRouter, State: NodeAdmitted, Count: 1}: true,
+			{Role: api.RoleNode, State: NodeExpired, Count: 2}:    true,
+			{Role: api.RoleNode, State: NodeBanned, Count: 1}:     true,
+		}
+		if !reflect.DeepEqual(got, want) {
+			t.Errorf("CountNodes = %v, want %v", counts, want)
+		}
+	})
+
+	if _, err := store.ListNodes(ctx, NodeFilter{States: []NodeState{"lapsed"}}); err == nil {
+		t.Error("ListNodes accepted an unknown state")
+	}
+}
+
 func TestBootstrapTokenRoundTripsEveryField(t *testing.T) {
 	store := newTestStore(t)
 	ctx := context.Background()
diff --git a/internal/storage/sql_store.go b/internal/storage/sql_store.go
index f8fe901a..b0587033 100644
--- a/internal/storage/sql_store.go
+++ b/internal/storage/sql_store.go
@@ -555,6 +555,19 @@ var migrations = []migration{
 			`ALTER TABLE routers ADD COLUMN connection_limit INTEGER`,
 		},
 	},
+	{
+		// A user's node list searches owner_id, and a GET /user/nodes page
+		// walks enrolled_at instead of sorting every matching row.
+		version: 19,
+		postgres: []string{
+			`CREATE INDEX IF NOT EXISTS idx_nodes_owner_id ON nodes (owner_id)`,
+			`CREATE INDEX IF NOT EXISTS idx_nodes_enrolled_at ON nodes (enrolled_at, peer_id)`,
+		},
+		sqlite: []string{
+			`CREATE INDEX IF NOT EXISTS idx_nodes_owner_id ON nodes (owner_id)`,
+			`CREATE INDEX IF NOT EXISTS idx_nodes_enrolled_at ON nodes (enrolled_at, peer_id)`,
+		},
+	},
 }
 
 var meshPrefixMigration = []string{
@@ -1062,9 +1075,11 @@ func (s *SQLStore) IsIdentityBanned(ctx context.Context, identity string) (bool,
 
 // DeleteExpiredNodes implements Store.
 func (s *SQLStore) DeleteExpiredNodes(ctx context.Context, before time.Time) (int64, error) {
-	// A zero ExpiresAt round-trips as a negative UnixMilli, hence > 0.
-	query := s.rebind(`DELETE FROM nodes WHERE banned = ? AND expires_at > 0 AND expires_at < ?`)
-	res, err := s.db.ExecContext(ctx, query, false, before.UnixMilli())
+	expired, args, err := nodeStateWhere(NodeExpired, before)
+	if err != nil {
+		return 0, err
+	}
+	res, err := s.db.ExecContext(ctx, s.rebind(`DELETE FROM nodes WHERE `+expired), args...)
 	if err != nil {
 		return 0, err
 	}
@@ -1684,10 +1699,20 @@ func (s *SQLStore) ResolveEnrollmentRequest(ctx context.Context, id string, stat
 	return nil
 }
 
-// ListNodes retrieves all enrolled nodes.
-func (s *SQLStore) ListNodes(ctx context.Context) ([]EnrolledNode, error) {
-	query := s.rebind(`SELECT peer_id, public_key, biscuit_token, role, enrollment_type, claims_json, owner_id, labels_json, enrolled_at, expires_at, banned, autonomous_recovery FROM nodes ORDER BY enrolled_at DESC`)
-	rows, err := s.db.QueryContext(ctx, query)
+// ListNodes implements Store.
+func (s *SQLStore) ListNodes(ctx context.Context, filter NodeFilter) ([]EnrolledNode, error) {
+	where, args, err := nodeFilterWhere(filter)
+	if err != nil {
+		return nil, err
+	}
+	// Neither blob is read: a list is a view of the rows, and the biscuit is
+	// a 2 KB column per row that only GetNode's single-row callers need.
+	query := `SELECT peer_id, role, enrollment_type, claims_json, owner_id, labels_json, enrolled_at, expires_at, banned, autonomous_recovery FROM nodes` + where + ` ORDER BY enrolled_at DESC, peer_id DESC`
+	if filter.Limit > 0 {
+		query += ` LIMIT ?`
+		args = append(args, filter.Limit)
+	}
+	rows, err := s.db.QueryContext(ctx, s.rebind(query), args...)
 	if err != nil {
 		return nil, fmt.Errorf("failed to query nodes: %w", err)
 	}
@@ -1700,8 +1725,6 @@ func (s *SQLStore) ListNodes(ctx context.Context) ([]EnrolledNode, error) {
 		var enrolledAtUnix, expiresAtUnix int64
 		err := rows.Scan(
 			&node.PeerID,
-			&node.PublicKey,
-			&node.Biscuit,
 			&node.Role,
 			&node.EnrollmentType,
 			&claimsJSON,
@@ -1728,15 +1751,6 @@ func (s *SQLStore) ListNodes(ctx context.Context) ([]EnrolledNode, error) {
 		}
 		node.EnrolledAt = time.UnixMilli(enrolledAtUnix)
 		node.ExpiresAt = time.UnixMilli(expiresAtUnix)
-
-		pubCopy := make([]byte, len(node.PublicKey))
-		copy(pubCopy, node.PublicKey)
-		node.PublicKey = pubCopy
-
-		biscuitCopy := make([]byte, len(node.Biscuit))
-		copy(biscuitCopy, node.Biscuit)
-		node.Biscuit = biscuitCopy
-
 		nodes = append(nodes, node)
 	}
 	if err := rows.Err(); err != nil {
@@ -1745,6 +1759,91 @@ func (s *SQLStore) ListNodes(ctx context.Context) ([]EnrolledNode, error) {
 	return nodes, nil
 }
 
+// nodeFilterWhere renders filter as a WHERE clause, empty for the zero filter.
+func nodeFilterWhere(filter NodeFilter) (string, []any, error) {
+	var conds []string
+	var args []any
+	if len(filter.States) > 0 {
+		now := filter.Now
+		if now.IsZero() {
+			now = time.Now()
+		}
+		arms := make([]string, 0, len(filter.States))
+		for _, state := range filter.States {
+			arm, armArgs, err := nodeStateWhere(state, now)
+			if err != nil {
+				return "", nil, err
+			}
+			arms = append(arms, arm)
+			args = append(args, armArgs...)
+		}
+		conds = append(conds, "("+strings.Join(arms, " OR ")+")")
+	}
+	if filter.OwnerID != nil {
+		conds = append(conds, "owner_id = ?")
+		args = append(args, *filter.OwnerID)
+	}
+	if filter.Role != "" {
+		conds = append(conds, "role = ?")
+		args = append(args, filter.Role)
+	}
+	if filter.After != nil {
+		at := filter.After.EnrolledAt.UnixMilli()
+		conds = append(conds, "enrolled_at <= ? AND (enrolled_at < ? OR peer_id < ?)")
+		args = append(args, at, at, filter.After.PeerID)
+	}
+	if len(conds) == 0 {
+		return "", nil, nil
+	}
+	return " WHERE " + strings.Join(conds, " AND "), args, nil
+}
+
+// nodeStateWhere is CheckAdmission in SQL. A zero ExpiresAt round-trips as a
+// negative UnixMilli, so it never expires. Each arm leads with banned so it
+// can search the (banned, expires_at) index.
+func nodeStateWhere(state NodeState, now time.Time) (string, []any, error) {
+	ms := now.UnixMilli()
+	switch state {
+	case NodeBanned:
+		return "banned = ?", []any{true}, nil
+	case NodeExpired:
+		return "(banned = ? AND expires_at > 0 AND expires_at < ?)", []any{false, ms}, nil
+	case NodeAdmitted:
+		// Parenthesised like the other arms, so a caller may AND it with more.
+		return "((banned = ? AND expires_at <= 0) OR (banned = ? AND expires_at >= ?))", []any{false, false, ms}, nil
+	}
+	return "", nil, fmt.Errorf("unknown node state %q", state)
+}
+
+// CountNodes implements Store. The CASE tests a ban first, as CheckAdmission does.
+func (s *SQLStore) CountNodes(ctx context.Context, now time.Time) ([]NodeCount, error) {
+	banned, args, err := nodeStateWhere(NodeBanned, now)
+	if err != nil {
+		return nil, err
+	}
+	expired, expiredArgs, err := nodeStateWhere(NodeExpired, now)
+	if err != nil {
+		return nil, err
+	}
+	query := fmt.Sprintf(`SELECT role, CASE WHEN %s THEN '%s' WHEN %s THEN '%s' ELSE '%s' END, COUNT(*) FROM nodes GROUP BY 1, 2`,
+		banned, NodeBanned, expired, NodeExpired, NodeAdmitted)
+	rows, err := s.db.QueryContext(ctx, s.rebind(query), append(args, expiredArgs...)...)
+	if err != nil {
+		return nil, fmt.Errorf("failed to count nodes: %w", err)
+	}
+	defer func() { _ = rows.Close() }()
+
+	var counts []NodeCount
+	for rows.Next() {
+		var c NodeCount
+		if err := rows.Scan(&c.Role, &c.State, &c.Count); err != nil {
+			return nil, fmt.Errorf("failed to scan node count: %w", err)
+		}
+		counts = append(counts, c)
+	}
+	return counts, rows.Err()
+}
+
 // ListBootstrapTokens retrieves all bootstrap tokens.
 func (s *SQLStore) ListBootstrapTokens(ctx context.Context) ([]BootstrapToken, error) {
 	query := s.rebind(`SELECT id, token_hash, role, owner_id, max_usages, usages_count, description, created_at, expires_at, revoked_at, autonomous_recovery FROM bootstrap_tokens ORDER BY created_at DESC`)
diff --git a/internal/storage/storage.go b/internal/storage/storage.go
index d77bbd31..251b399c 100644
--- a/internal/storage/storage.go
+++ b/internal/storage/storage.go
@@ -112,6 +112,44 @@ type EnrolledNode struct {
 	AutonomousRecovery bool
 }
 
+// NodeState is what CheckAdmission says of a node at some instant. "admitted"
+// is not liveness: a node that enrolled once and went away stays admitted
+// until its session expires.
+type NodeState string
+
+const (
+	NodeAdmitted NodeState = "admitted"
+	NodeExpired  NodeState = "expired"
+	NodeBanned   NodeState = "banned"
+)
+
+// NodeFilter selects what ListNodes returns; the zero value is every node.
+type NodeFilter struct {
+	// States keeps the nodes in any of these states at Now, time.Now() if zero.
+	States []NodeState
+	Now    time.Time
+	// OwnerID nil means every owner; any other value, even "", keeps only
+	// that owner's nodes.
+	OwnerID *string
+	Role    string
+	// After resumes from the last row of the previous page. Limit 0 is no limit.
+	After *NodeCursor
+	Limit int
+}
+
+// NodeCursor is the sort key of the last row of a ListNodes page.
+type NodeCursor struct {
+	EnrolledAt time.Time
+	PeerID     string
+}
+
+// NodeCount is how many nodes of one role are in one state.
+type NodeCount struct {
+	Role  string
+	State NodeState
+	Count int
+}
+
 // CheckAdmission reports whether the control plane may still serve this node.
 // Enrollment is bounded by two independent conditions, an explicit ban and the
 // end of the OIDC session, and every path that acts on an enrolled node has to
@@ -313,8 +351,13 @@ type Store interface {
 	// both succeed. ErrEnrollmentAlreadyResolved if it was not pending.
 	ResolveEnrollmentRequest(ctx context.Context, id string, status api.EnrollmentStatus, biscuit []byte, resolvedBy string) error
 
-	// ListNodes retrieves all enrolled nodes.
-	ListNodes(ctx context.Context) ([]EnrolledNode, error)
+	// ListNodes retrieves the enrolled nodes the filter selects, newest
+	// enrollment first. Peer ID breaks ties, so pages neither skip nor repeat a row.
+	// A listed node carries no PublicKey and no Biscuit: GetNode reads those.
+	ListNodes(ctx context.Context, filter NodeFilter) ([]EnrolledNode, error)
+
+	// CountNodes counts every enrolled node by role and by its state at now.
+	CountNodes(ctx context.Context, now time.Time) ([]NodeCount, error)
 
 	// DeleteExpiredNodes removes enrolled nodes whose session expired before
 	// the given time and that are not banned, returning how many went. A
diff --git a/sdk/js/src/gen/agentmesh_pb.ts b/sdk/js/src/gen/agentmesh_pb.ts
index 24eddf51..4a4df4d4 100644
--- a/sdk/js/src/gen/agentmesh_pb.ts
+++ b/sdk/js/src/gen/agentmesh_pb.ts
@@ -26,7 +26,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file agentmesh.proto.
  */
 export const file_agentmesh: GenFile = /*@__PURE__*/
-  fileDesc("Cg9hZ2VudG1lc2gucHJvdG8SDGFnZW50bWVzaC52MSI0CglBdXRoRnJhbWUSDwoHYmlzY3VpdBgBIAEoDBIWCg50YXJnZXRfc2VydmljZRgCIAEoCSI/CgxBdXRoUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCBINCgVlcnJvchgCIAEoCRIPCgdiaXNjdWl0GAMgASgMIrEBCgxSb3V0ZXJHb0F3YXkSMQoGcmVhc29uGAEgASgOMiEuYWdlbnRtZXNoLnYxLlJvdXRlckdvQXdheS5SZWFzb24SLgoLcmV0cnlfYWZ0ZXIYAiABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb24iPgoGUmVhc29uEhYKElJFQVNPTl9VTlNQRUNJRklFRBAAEgwKCERSQUlOSU5HEAESDgoKT1ZFUkxPQURFRBACItwBCglNZXNoRXZlbnQSKgoEdHlwZRgBIAEoDjIcLmFnZW50bWVzaC52MS5NZXNoRXZlbnQuVHlwZRIPCgdwZWVyX2lkGAIgASgJEi4KCmV2ZW50X3RpbWUYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhYKDm5ld19wdWJsaWNfa2V5GAQgASgMEhEKCXNpZ25hdHVyZRgFIAEoDCI3CgRUeXBlEgoKBkJBTk5FRBAAEhAKDEtFWV9ST1RBVElPThABEhEKDVBPTElDWV9VUERBVEUQAiL5AQoNRW5yb2xsUmVxdWVzdBILCgNqd3QYASABKAkSDwoHcGVlcl9pZBgCIAEoCRISCgpwdWJsaWNfa2V5GAMgASgMEhYKDnJlcXVlc3RlZF9yb2xlGAQgASgJEjcKBmxhYmVscxgFIAMoCzInLmFnZW50bWVzaC52MS5FbnJvbGxSZXF1ZXN0LkxhYmVsc0VudHJ5EhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKrAQoORW5yb2xsUmVzcG9uc2USFQoNYmlzY3VpdF90b2tlbhgBIAEoDBIVCg1lcnJvcl9tZXNzYWdlGAIgASgJEiAKGGNvbnRyb2xfcGxhbmVfcHVibGljX2tleRgDIAEoDBIYChByb3V0ZXJfYWRkcmVzc2VzGAQgAygJEi8KC2V4cGlyZV90aW1lGAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCKXAgoWQm9vdHN0cmFwRW5yb2xsUmVxdWVzdBIXCg9ib290c3RyYXBfdG9rZW4YASABKAkSDwoHcGVlcl9pZBgCIAEoCRISCgpwdWJsaWNfa2V5GAMgASgMEhYKDnJlcXVlc3RlZF9yb2xlGAQgASgJEkAKBmxhYmVscxgFIAMoCzIwLmFnZW50bWVzaC52MS5Cb290c3RyYXBFbnJvbGxSZXF1ZXN0LkxhYmVsc0VudHJ5EhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKDAgoXQm9vdHN0cmFwRW5yb2xsUmVzcG9uc2USLgoGc3RhdHVzGAEgASgOMh4uYWdlbnRtZXNoLnYxLkVucm9sbG1lbnRTdGF0dXMSFQoNYmlzY3VpdF90b2tlbhgCIAEoDBIdChVwb2xsX2ludGVydmFsX3NlY29uZHMYAyABKAUSFQoNZXJyb3JfbWVzc2FnZRgEIAEoCRIgChhjb250cm9sX3BsYW5lX3B1YmxpY19rZXkYBSABKAwSGAoQcm91dGVyX2FkZHJlc3NlcxgGIAMoCRIvCgtleHBpcmVfdGltZRgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiWQoLU2VydmljZUluZm8SJwoEdHlwZRgBIAEoDjIZLmFnZW50bWVzaC52MS5TZXJ2aWNlVHlwZRIMCgRuYW1lGAIgASgJEhMKC2Rlc2NyaXB0aW9uGAMgASgJIoEBCg5Db21tYW5kQmFja2VuZBIPCgdjb21tYW5kGAEgAygJEjIKA2VudhgCIAMoCzIlLmFnZW50bWVzaC52MS5Db21tYW5kQmFja2VuZC5FbnZFbnRyeRoqCghFbnZFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIpYBChZSZWdpc3RlclNlcnZpY2VSZXF1ZXN0EioKB3NlcnZpY2UYASABKAsyGS5hZ2VudG1lc2gudjEuU2VydmljZUluZm8SFAoKdGFyZ2V0X3VybBgCIAEoCUgAEi8KB2NvbW1hbmQYAyABKAsyHC5hZ2VudG1lc2gudjEuQ29tbWFuZEJhY2tlbmRIAEIJCgdiYWNrZW5kImkKEkRpc2NvdmVyZWRQcm92aWRlchIPCgdwZWVyX2lkGAEgASgJEhcKD2xvY2FsX3Byb3h5X3VybBgCIAEoCRIQCghzcnZfbmFtZRgDIAEoCRIXCg9zcnZfZGVzY3JpcHRpb24YBCABKAki6AEKGENvbnRyb2xQbGFuZUluZm9SZXNwb25zZRITCgtvaWRjX2lzc3VlchgBIAEoCRIRCgljbGllbnRfaWQYAiABKAkSEAoIYXVkaWVuY2UYAyABKAkSGAoQcm91dGVyX2FkZHJlc3NlcxgEIAMoCRIXCg9iYW5uZWRfcGVlcl9pZHMYBSADKAkSKQoHcm91dGVycxgGIAMoCzIYLmFnZW50bWVzaC52MS5Sb3V0ZXJJbmZvEjQKCWRpcmVjdG9yeRgHIAEoCzIhLmFnZW50bWVzaC52MS5EaXJlY3RvcnlQYXJhbWV0ZXJzIpABChNEaXJlY3RvcnlQYXJhbWV0ZXJzEhMKC3JlcGxpY2F0aW9uGAEgASgFEjUKEnJlcHJvdmlkZV9pbnRlcnZhbBgCIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbhItCgpyZWNvcmRfdHRsGAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uIvsBChBEaXJlY3RvcnlSZXF1ZXN0EjEKB3Byb3ZpZGUYASABKAsyHi5hZ2VudG1lc2gudjEuRGlyZWN0b3J5UHJvdmlkZUgAEj4KDmZpbmRfcHJvdmlkZXJzGAIgASgLMiQuYWdlbnRtZXNoLnYxLkRpcmVjdG9yeUZpbmRQcm92aWRlcnNIABI0CglmaW5kX3BlZXIYAyABKAsyHy5hZ2VudG1lc2gudjEuRGlyZWN0b3J5RmluZFBlZXJIABIzCgh3aXRoZHJhdxgEIAEoCzIfLmFnZW50bWVzaC52MS5EaXJlY3RvcnlXaXRoZHJhd0gAQgkKB3JlcXVlc3QiUQoQRGlyZWN0b3J5UHJvdmlkZRILCgNrZXkYASABKAwSDQoFYWRkcnMYAiADKAkSEAoIcHJvdmlkZXIYAyABKAkSDwoHc2VydmljZRgEIAEoCSIyChFEaXJlY3RvcnlXaXRoZHJhdxILCgNrZXkYASABKAwSEAoIcHJvdmlkZXIYAiABKAkiNAoWRGlyZWN0b3J5RmluZFByb3ZpZGVycxILCgNrZXkYASABKAwSDQoFbGltaXQYAiABKA0iJAoRRGlyZWN0b3J5RmluZFBlZXISDwoHcGVlcl9pZBgBIAEoCSJ3ChFEaXJlY3RvcnlSZXNwb25zZRIrCglwcm92aWRlcnMYASADKAsyGC5hZ2VudG1lc2gudjEuUGVlclJlY29yZBImCgRwZWVyGAIgASgLMhguYWdlbnRtZXNoLnYxLlBlZXJSZWNvcmQSDQoFZXJyb3IYAyABKAkiLAoKUGVlclJlY29yZBIPCgdwZWVyX2lkGAEgASgJEg0KBWFkZHJzGAIgAygJIsQBCgpSb3V0ZXJJbmZvEg8KB3BlZXJfaWQYASABKAkSEQoJYWRkcmVzc2VzGAIgAygJEjQKBmxhYmVscxgDIAMoCzIkLmFnZW50bWVzaC52MS5Sb3V0ZXJJbmZvLkxhYmVsc0VudHJ5EhMKC2Nvbm5lY3Rpb25zGAQgASgFEhgKEGNvbm5lY3Rpb25fbGltaXQYBSABKAUaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKDAgoSUm91dGVyTGVhc2VSZXF1ZXN0Eg8KB3BlZXJfaWQYASABKAkSEQoJYWRkcmVzc2VzGAIgAygJEg8KB2Jpc2N1aXQYAyABKAwSFwoPY29ubmVjdGVkX3BlZXJzGAQgAygJEhAKCGRodF9zaXplGAUgASgFEhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwSJgoDdHRsGAggASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uEhMKC2Nvbm5lY3Rpb25zGAkgASgFEhgKEGNvbm5lY3Rpb25fbGltaXQYCiABKAUiZgoTUm91dGVyTGVhc2VSZXNwb25zZRIPCgdzdWNjZXNzGAEgASgIEg0KBWVycm9yGAIgASgJEi8KC2V4cGlyZV90aW1lGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCK9AQoKUG9saWN5Um9sZRIMCgRuYW1lGAEgASgJEhcKD2FsbG93ZWRfdGFyZ2V0cxgCIAMoCRIYChBhbGxvd2VkX3NlcnZpY2VzGAMgAygJEhYKDmN1c3RvbV9kYXRhbG9nGAQgAygJEhYKDmFsbG93ZWRfbGFiZWxzGAUgAygJEiUKBGh0dHAYBiADKAsyFy5hZ2VudG1lc2gudjEuSFRUUEdyYW50EhcKD2FsbG93ZWRfcHVibGlzaBgHIAMoCSI8CglIVFRQR3JhbnQSDwoHc2VydmljZRgBIAEoCRIPCgdtZXRob2RzGAIgAygJEg0KBXBhdGhzGAMgAygJIqECChFFZ3Jlc3NEZXN0aW5hdGlvbhIMCgRuYW1lGAEgASgJEhIKCnRhcmdldF91cmwYAiABKAkSEgoKY3JlZGVudGlhbBgDIAEoCRIRCglzZXJ2ZWRfYnkYBCADKAkSLgoGYnJva2VyGAUgASgLMh4uYWdlbnRtZXNoLnYxLkNyZWRlbnRpYWxCcm9rZXISLAoKaW5zcGVjdGlvbhgGIAEoCzIYLmFnZW50bWVzaC52MS5JbnNwZWN0aW9uEiYKBG1vZGUYByABKA4yGC5hZ2VudG1lc2gudjEuRWdyZXNzTW9kZRINCgVwb3J0cxgIIAMoDRIVCg1wcmVzZXJ2ZV9ob3N0GAkgASgIEhcKD2ZvcndhcmRfY29udGV4dBgKIAEoCCI5CgpJbnNwZWN0aW9uEisKCmluc3BlY3RvcnMYASADKAsyFy5hZ2VudG1lc2gudjEuSW5zcGVjdG9yIm8KCUluc3BlY3RvchIvCgttb2RlbF9hcm1vchgBIAEoCzIYLmFnZW50bWVzaC52MS5Nb2RlbEFybW9ySAASKQoIZXh0X3Byb2MYAiABKAsyFS5hZ2VudG1lc2gudjEuRXh0UHJvY0gAQgYKBGtpbmQikQEKCk1vZGVsQXJtb3ISEAoIdGVtcGxhdGUYASABKAkSMgoIcmVzcG9uc2UYAiABKA4yIC5hZ2VudG1lc2gudjEuUmVzcG9uc2VJbnNwZWN0aW9uEhEKCWZhaWxfb3BlbhgDIAEoCBIqCgd0aW1lb3V0GAQgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uIogCCgdFeHRQcm9jEg4KBnRhcmdldBgBIAEoCRIKCgJjYRgCIAEoCRIaChJjbGllbnRfY2VydGlmaWNhdGUYAyABKAkSPAoPcHJvY2Vzc2luZ19tb2RlGAQgASgLMiMuYWdlbnRtZXNoLnYxLkV4dFByb2NQcm9jZXNzaW5nTW9kZRIbChNhbGxvd19tb2RlX292ZXJyaWRlGAUgASgIEjIKD21lc3NhZ2VfdGltZW91dBgGIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbhIaChJmYWlsdXJlX21vZGVfYWxsb3cYByABKAgSGgoSbWF4X2J1ZmZlcmVkX2J5dGVzGAggASgNIv8EChVFeHRQcm9jUHJvY2Vzc2luZ01vZGUSSwoTcmVxdWVzdF9oZWFkZXJfbW9kZRgBIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJMChRyZXNwb25zZV9oZWFkZXJfbW9kZRgCIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJHChFyZXF1ZXN0X2JvZHlfbW9kZRgDIAEoDjIsLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuQm9keU1vZGUSSAoScmVzcG9uc2VfYm9keV9tb2RlGAQgASgOMiwuYWdlbnRtZXNoLnYxLkV4dFByb2NQcm9jZXNzaW5nTW9kZS5Cb2R5TW9kZRJMChRyZXF1ZXN0X3RyYWlsZXJfbW9kZRgFIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJNChVyZXNwb25zZV90cmFpbGVyX21vZGUYBiABKA4yLi5hZ2VudG1lc2gudjEuRXh0UHJvY1Byb2Nlc3NpbmdNb2RlLkhlYWRlck1vZGUiOQoKSGVhZGVyTW9kZRIXChNIRUFERVJfTU9ERV9ERUZBVUxUEAASCAoEU0VORBABEggKBFNLSVAQAiJgCghCb2R5TW9kZRIICgROT05FEAASDAoIU1RSRUFNRUQQARIMCghCVUZGRVJFRBACEhQKEEJVRkZFUkVEX1BBUlRJQUwQAxIYChRGVUxMX0RVUExFWF9TVFJFQU1FRBAEIuEBChBDcmVkZW50aWFsQnJva2VyEhcKDXN0YXRpY19zZWNyZXQYASABKAlIABI3Cg9vaWRjX2ZlZGVyYXRpb24YAiABKAsyHC5hZ2VudG1lc2gudjEuT0lEQ0ZlZGVyYXRpb25IABI2Cg9hd3NfYXNzdW1lX3JvbGUYAyABKAsyGy5hZ2VudG1lc2gudjEuQVdTQXNzdW1lUm9sZUgAEjsKEXBsYXRmb3JtX2lkZW50aXR5GAQgASgLMh4uYWdlbnRtZXNoLnYxLlBsYXRmb3JtSWRlbnRpdHlIAEIGCgRraW5kIl8KDk9JRENGZWRlcmF0aW9uEhYKDnRva2VuX2VuZHBvaW50GAEgASgJEhAKCGF1ZGllbmNlGAIgASgJEhMKC2ltcGVyc29uYXRlGAMgASgJEg4KBnNjb3BlcxgEIAMoCSI5Cg1BV1NBc3N1bWVSb2xlEhAKCHJvbGVfYXJuGAEgASgJEhYKDnNlc3Npb25fcG9saWN5GAIgASgJIiIKEFBsYXRmb3JtSWRlbnRpdHkSDgoGc2NvcGVzGAEgAygJIi4KDVBvbGljeUJpbmRpbmcSDAoEcm9sZRgBIAEoCRIPCgdtZW1iZXJzGAIgAygJIpcBCgxQb2xpY3lDb25maWcSJwoFcm9sZXMYASADKAsyGC5hZ2VudG1lc2gudjEuUG9saWN5Um9sZRItCghiaW5kaW5ncxgCIAMoCzIbLmFnZW50bWVzaC52MS5Qb2xpY3lCaW5kaW5nEi8KBmVncmVzcxgDIAMoCzIfLmFnZW50bWVzaC52MS5FZ3Jlc3NEZXN0aW5hdGlvbiIYChZQb2xpY3lDb25maWdHZXRSZXF1ZXN0IjAKF1BvbGljeUNvbmZpZ0dldFJlc3BvbnNlEhUKDWRhdGFsb2dfcnVsZXMYASADKAkiPAoaUG9saWN5Q29uZmlnVXBkYXRlUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCBINCgVlcnJvchgCIAEoCSIaChhFZ3Jlc3NBc3NpZ25tZW50c1JlcXVlc3QiTAoZRWdyZXNzQXNzaWdubWVudHNSZXNwb25zZRIvCgZlZ3Jlc3MYASADKAsyHy5hZ2VudG1lc2gudjEuRWdyZXNzRGVzdGluYXRpb24iZgoMS2V5c1Jlc3BvbnNlEhMKC3B1YmxpY19rZXlzGAEgAygMEi0KCXNpZ25fdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASEgoKc2lnbmF0dXJlcxgDIAMoDCJrChNUb2tlblJlZnJlc2hSZXF1ZXN0EhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYASABKAwSGQoRY2hhbGxlbmdlX3VuaXhfbXMYAiABKAMSDwoHcGVlcl9pZBgDIAEoCRILCgNqd3QYBCABKAkidQoUVG9rZW5SZWZyZXNoUmVzcG9uc2USFQoNYmlzY3VpdF90b2tlbhgBIAEoDBIvCgtleHBpcmVfdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASFQoNZXJyb3JfbWVzc2FnZRgDIAEoCSJAChFOb2RlQ2F0YWxvZ1JlcG9ydBIrCghzZXJ2aWNlcxgBIAMoCzIZLmFnZW50bWVzaC52MS5TZXJ2aWNlSW5mbyIlChJUb2tlblJldm9rZVJlcXVlc3QSDwoHcGVlcl9pZBgBIAEoCSI1ChNUb2tlblJldm9rZVJlc3BvbnNlEg8KB3N1Y2Nlc3MYASABKAgSDQoFZXJyb3IYAiABKAkilgEKG0Jvb3RzdHJhcFRva2VuQ3JlYXRlUmVxdWVzdBIMCgRyb2xlGAEgASgJEhAKCG93bmVyX2lkGAIgASgJEhEKCXR0bF9ob3VycxgDIAEoBRISCgptYXhfdXNhZ2VzGAQgASgFEhMKC2Rlc2NyaXB0aW9uGAUgASgJEhsKE2F1dG9ub21vdXNfcmVjb3ZlcnkYBiABKAgiigEKHEJvb3RzdHJhcFRva2VuQ3JlYXRlUmVzcG9uc2USCgoCaWQYASABKAkSDQoFdG9rZW4YAiABKAkSDAoEcm9sZRgDIAEoCRIQCghvd25lcl9pZBgEIAEoCRIvCgtleHBpcmVfdGltZRgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiqwIKDkJvb3RzdHJhcFRva2VuEgoKAmlkGAEgASgJEgwKBHJvbGUYAiABKAkSEAoIb3duZXJfaWQYAyABKAkSEgoKbWF4X3VzYWdlcxgEIAEoBRIUCgx1c2FnZXNfY291bnQYBSABKAUSEwoLZGVzY3JpcHRpb24YBiABKAkSLwoLY3JlYXRlX3RpbWUYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi8KC2V4cGlyZV90aW1lGAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIvCgtyZXZva2VfdGltZRgJIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGwoTYXV0b25vbW91c19yZWNvdmVyeRgKIAEoCCJKChpCb290c3RyYXBUb2tlbkxpc3RSZXNwb25zZRIsCgZ0b2tlbnMYASADKAsyHC5hZ2VudG1lc2gudjEuQm9vdHN0cmFwVG9rZW4i1gIKEUVucm9sbG1lbnRSZXF1ZXN0EgoKAmlkGAEgASgJEg8KB3BlZXJfaWQYAiABKAkSEAoIdG9rZW5faWQYAyABKAkSLgoGc3RhdHVzGAQgASgOMh4uYWdlbnRtZXNoLnYxLkVucm9sbG1lbnRTdGF0dXMSOwoGbGFiZWxzGAUgAygLMisuYWdlbnRtZXNoLnYxLkVucm9sbG1lbnRSZXF1ZXN0LkxhYmVsc0VudHJ5Ei8KC2NyZWF0ZV90aW1lGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIwCgxyZXNvbHZlX3RpbWUYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhMKC3Jlc29sdmVkX2J5GAggASgJGi0KC0xhYmVsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiUgodRW5yb2xsbWVudFJlcXVlc3RMaXN0UmVzcG9uc2USMQoIcmVxdWVzdHMYASADKAsyHy5hZ2VudG1lc2gudjEuRW5yb2xsbWVudFJlcXVlc3QicAoEVXNlchIKCgJpZBgBIAEoCRIOCgZpc3N1ZXIYAiABKAkSDQoFZW1haWwYAyABKAkSDAoEcm9sZRgEIAEoCRIvCgtjcmVhdGVfdGltZRgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAi4wIKDEVucm9sbGVkTm9kZRIPCgdwZWVyX2lkGAEgASgJEgwKBHJvbGUYAiABKAkSFwoPZW5yb2xsbWVudF90eXBlGAMgASgJEhMKC2NsYWltc19qc29uGAQgASgJEhAKCG93bmVyX2lkGAUgASgJEjYKBmxhYmVscxgGIAMoCzImLmFnZW50bWVzaC52MS5FbnJvbGxlZE5vZGUuTGFiZWxzRW50cnkSLwoLZW5yb2xsX3RpbWUYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi8KC2V4cGlyZV90aW1lGAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIOCgZiYW5uZWQYCSABKAgSGwoTYXV0b25vbW91c19yZWNvdmVyeRgKIAEoCBotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIsQBCgtSb3V0ZXJMZWFzZRIPCgdwZWVyX2lkGAEgASgJEhEKCWFkZHJlc3NlcxgCIAMoCRI1ChFsYXN0X3JlbmV3YWxfdGltZRgDIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLwoLZXhwaXJlX3RpbWUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhcKD2Nvbm5lY3RlZF9wZWVycxgFIAMoCRIQCghkaHRfc2l6ZRgGIAEoBSJsCgxOb2RlU2VydmljZXMSKwoIc2VydmljZXMYASADKAsyGS5hZ2VudG1lc2gudjEuU2VydmljZUluZm8SLwoLcmVwb3J0X3RpbWUYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wItsDChNBZG1pblN0YXR1c1Jlc3BvbnNlEiEKBXVzZXJzGAEgAygLMhIuYWdlbnRtZXNoLnYxLlVzZXISMQoOYWN0aXZlX3JvdXRlcnMYAiADKAsyGS5hZ2VudG1lc2gudjEuUm91dGVyTGVhc2USMgoOZW5yb2xsZWRfbm9kZXMYAyADKAsyGi5hZ2VudG1lc2gudjEuRW5yb2xsZWROb2RlEjwKE2Vucm9sbG1lbnRfcmVxdWVzdHMYBCADKAsyHy5hZ2VudG1lc2gudjEuRW5yb2xsbWVudFJlcXVlc3QSNgoQYm9vdHN0cmFwX3Rva2VucxgFIAMoCzIcLmFnZW50bWVzaC52MS5Cb290c3RyYXBUb2tlbhIqCgZwb2xpY3kYBiABKAsyGi5hZ2VudG1lc2gudjEuUG9saWN5Q29uZmlnEkgKDG5vZGVfY2F0YWxvZxgHIAMoCzIyLmFnZW50bWVzaC52MS5BZG1pblN0YXR1c1Jlc3BvbnNlLk5vZGVDYXRhbG9nRW50cnkaTgoQTm9kZUNhdGFsb2dFbnRyeRILCgNrZXkYASABKAkSKQoFdmFsdWUYAiABKAsyGi5hZ2VudG1lc2gudjEuTm9kZVNlcnZpY2VzOgI4ASKBAgoSVXNlclN0YXR1c1Jlc3BvbnNlEiAKBHVzZXIYASABKAsyEi5hZ2VudG1lc2gudjEuVXNlchIyCg5lbnJvbGxlZF9ub2RlcxgCIAMoCzIaLmFnZW50bWVzaC52MS5FbnJvbGxlZE5vZGUSNgoQYm9vdHN0cmFwX3Rva2VucxgDIAMoCzIcLmFnZW50bWVzaC52MS5Cb290c3RyYXBUb2tlbhIxCg5hY3RpdmVfcm91dGVycxgEIAMoCzIZLmFnZW50bWVzaC52MS5Sb3V0ZXJMZWFzZRIqCgZwb2xpY3kYBSABKAsyGi5hZ2VudG1lc2gudjEuUG9saWN5Q29uZmlnIuQBChhJZGVudGl0eUV2aWRlbmNlUmVzcG9uc2USDwoHcGVlcl9pZBgBIAEoCRIPCgdiaXNjdWl0GAIgASgMEjcKE2Jpc2N1aXRfZXhwaXJlX3RpbWUYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhkKEWNvbnRyb2xfcGxhbmVfdXJsGAQgASgJEiIKGnRydXN0ZWRfY29udHJvbF9wbGFuZV9rZXlzGAUgAygMEi4KCmNoZWNrX3RpbWUYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIsYCChRQZWVyRXZpZGVuY2VSZXNwb25zZRIPCgdwZWVyX2lkGAEgASgJEg8KB2Jpc2N1aXQYAiABKAwSFQoNdmVyaWZ5aW5nX2tleRgDIAEoDBINCgVyb2xlcxgEIAMoCRI+CgZsYWJlbHMYBSADKAsyLi5hZ2VudG1lc2gudjEuUGVlckV2aWRlbmNlUmVzcG9uc2UuTGFiZWxzRW50cnkSLwoLZXhwaXJlX3RpbWUYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhYKDnJldm9jYXRpb25faWRzGAcgAygJEi4KCmNoZWNrX3RpbWUYCCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wGi0KC0xhYmVsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEijAIKEE1lbWJlckNyZWRlbnRpYWwSGQoRY29udHJvbF9wbGFuZV91cmwYASABKAkSDwoHYmlzY3VpdBgCIAEoDBIvCgtleHBpcmVfdGltZRgDIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASNQoMdHJ1c3RlZF9rZXlzGAQgAygLMh8uYWdlbnRtZXNoLnYxLlRydXN0ZWRTaWduaW5nS2V5EhkKEWlzc3VlZF91bmRlcl9rZXlzGAUgAygMEhgKEHJvdXRlcl9hZGRyZXNzZXMYBiADKAkSLwoMb2lkY19zZXNzaW9uGAcgASgLMhkuYWdlbnRtZXNoLnYxLk9JRENTZXNzaW9uIlkKEVRydXN0ZWRTaWduaW5nS2V5EhIKCnB1YmxpY19rZXkYASABKAwSMAoMcmVjZWl2ZV90aW1lGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCJZCgtPSURDU2Vzc2lvbhIOCgZpc3N1ZXIYASABKAkSEQoJY2xpZW50X2lkGAIgASgJEhAKCGF1ZGllbmNlGAMgASgJEhUKDXJlZnJlc2hfdG9rZW4YBCABKAkikwEKFVRhc2tBdXRob3JpemF0aW9uUnVsZRIMCgRuYW1lGAEgASgJEhQKDGRpc3BsYXlfbmFtZRgCIAEoCRIlCgVydWxlcxgDIAMoCzIWLmFnZW50bWVzaC52MS5UYXNrUnVsZRIvCgtleHBpcmVfdGltZRgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAihAEKCFRhc2tSdWxlEhMKC2Rlc2NyaXB0aW9uGAEgASgJEhgKEGFsbG93ZWRfc2VydmljZXMYAiADKAkSLgoJb3BlcmF0aW9uGAMgASgLMhsuYWdlbnRtZXNoLnYxLlRhc2tPcGVyYXRpb24SGQoRYWxsb3dlZF9yZXNvdXJjZXMYBCADKAkicwoNVGFza09wZXJhdGlvbhIVCg1hbGxvd2VkX3Rvb2xzGAEgAygJEhcKD2FsbG93ZWRfbWV0aG9kcxgCIAMoCRIVCg1hbGxvd2VkX3BhdGhzGAMgAygJEhsKE2FsbG93ZWRfcGVybWlzc2lvbnMYBCADKAkiqwEKFFRva2VuRXhjaGFuZ2VSZXF1ZXN0EhUKDXN1YmplY3RfdG9rZW4YASABKAkSNgoJdGFza19ydWxlGAIgASgLMiMuYWdlbnRtZXNoLnYxLlRhc2tBdXRob3JpemF0aW9uUnVsZRIMCgRzZWFsGAMgASgIEhkKEWNoYWxsZW5nZV91bml4X21zGAQgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYBSABKAwifwoVVG9rZW5FeGNoYW5nZVJlc3BvbnNlEhUKDWJpc2N1aXRfdG9rZW4YASABKAwSLwoLZXhwaXJlX3RpbWUYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEg0KBXJvbGVzGAMgAygJEg8KB3N1YmplY3QYBCABKAkigQEKD1NUU1Rva2VuUmVxdWVzdBIPCgdiaXNjdWl0GAEgASgMEhMKC2Rlc3RpbmF0aW9uGAIgASgJEhAKCGF1ZGllbmNlGAMgASgJEhkKEWNoYWxsZW5nZV91bml4X21zGAQgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYBSABKAwigwEKEFNUU1Rva2VuUmVzcG9uc2USCwoDand0GAEgASgJEi8KC2V4cGlyZV90aW1lGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIPCgdzdWJqZWN0GAMgASgJEg0KBXJvbGVzGAQgAygJEhEKCXRhc2tfbmFtZRgFIAEoCSJGChNSZXZvY2F0aW9uc1Jlc3BvbnNlEhYKDnJldm9jYXRpb25faWRzGAEgAygJEhcKD2Jhbm5lZF9wZWVyX2lkcxgCIAMoCSqUAQoQRW5yb2xsbWVudFN0YXR1cxIhCh1FTlJPTExNRU5UX1NUQVRVU19VTlNQRUNJRklFRBAAEh0KGUVOUk9MTE1FTlRfU1RBVFVTX1BFTkRJTkcQARIeChpFTlJPTExNRU5UX1NUQVRVU19BUFBST1ZFRBACEh4KGkVOUk9MTE1FTlRfU1RBVFVTX1JFSkVDVEVEEAMqjAEKC1NlcnZpY2VUeXBlEhwKGFNFUlZJQ0VfVFlQRV9VTlNQRUNJRklFRBAAEhQKEFNFUlZJQ0VfVFlQRV9NQ1AQARIaChZTRVJWSUNFX1RZUEVfSU5GRVJFTkNFEAISFAoQU0VSVklDRV9UWVBFX0EyQRADEhcKE1NFUlZJQ0VfVFlQRV9FR1JFU1MQBCo3CgpFZ3Jlc3NNb2RlEhQKEEVHUkVTU19NT0RFX0hUVFAQABITCg9FR1JFU1NfTU9ERV9UQ1AQASpcChJSZXNwb25zZUluc3BlY3Rpb24SIAocUkVTUE9OU0VfSU5TUEVDVElPTl9CVUZGRVJFRBAAEiQKIFJFU1BPTlNFX0lOU1BFQ1RJT05fUkVRVUVTVF9PTkxZEAFCIVofZ2l0aHViLmNvbS9nb29nbGUvYWdlbnRtZXNoL2FwaWIGcHJvdG8z", [file_google_protobuf_duration, file_google_protobuf_timestamp]);
+  fileDesc("Cg9hZ2VudG1lc2gucHJvdG8SDGFnZW50bWVzaC52MSI0CglBdXRoRnJhbWUSDwoHYmlzY3VpdBgBIAEoDBIWCg50YXJnZXRfc2VydmljZRgCIAEoCSI/CgxBdXRoUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCBINCgVlcnJvchgCIAEoCRIPCgdiaXNjdWl0GAMgASgMIrEBCgxSb3V0ZXJHb0F3YXkSMQoGcmVhc29uGAEgASgOMiEuYWdlbnRtZXNoLnYxLlJvdXRlckdvQXdheS5SZWFzb24SLgoLcmV0cnlfYWZ0ZXIYAiABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb24iPgoGUmVhc29uEhYKElJFQVNPTl9VTlNQRUNJRklFRBAAEgwKCERSQUlOSU5HEAESDgoKT1ZFUkxPQURFRBACItwBCglNZXNoRXZlbnQSKgoEdHlwZRgBIAEoDjIcLmFnZW50bWVzaC52MS5NZXNoRXZlbnQuVHlwZRIPCgdwZWVyX2lkGAIgASgJEi4KCmV2ZW50X3RpbWUYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhYKDm5ld19wdWJsaWNfa2V5GAQgASgMEhEKCXNpZ25hdHVyZRgFIAEoDCI3CgRUeXBlEgoKBkJBTk5FRBAAEhAKDEtFWV9ST1RBVElPThABEhEKDVBPTElDWV9VUERBVEUQAiL5AQoNRW5yb2xsUmVxdWVzdBILCgNqd3QYASABKAkSDwoHcGVlcl9pZBgCIAEoCRISCgpwdWJsaWNfa2V5GAMgASgMEhYKDnJlcXVlc3RlZF9yb2xlGAQgASgJEjcKBmxhYmVscxgFIAMoCzInLmFnZW50bWVzaC52MS5FbnJvbGxSZXF1ZXN0LkxhYmVsc0VudHJ5EhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKrAQoORW5yb2xsUmVzcG9uc2USFQoNYmlzY3VpdF90b2tlbhgBIAEoDBIVCg1lcnJvcl9tZXNzYWdlGAIgASgJEiAKGGNvbnRyb2xfcGxhbmVfcHVibGljX2tleRgDIAEoDBIYChByb3V0ZXJfYWRkcmVzc2VzGAQgAygJEi8KC2V4cGlyZV90aW1lGAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCKXAgoWQm9vdHN0cmFwRW5yb2xsUmVxdWVzdBIXCg9ib290c3RyYXBfdG9rZW4YASABKAkSDwoHcGVlcl9pZBgCIAEoCRISCgpwdWJsaWNfa2V5GAMgASgMEhYKDnJlcXVlc3RlZF9yb2xlGAQgASgJEkAKBmxhYmVscxgFIAMoCzIwLmFnZW50bWVzaC52MS5Cb290c3RyYXBFbnJvbGxSZXF1ZXN0LkxhYmVsc0VudHJ5EhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKDAgoXQm9vdHN0cmFwRW5yb2xsUmVzcG9uc2USLgoGc3RhdHVzGAEgASgOMh4uYWdlbnRtZXNoLnYxLkVucm9sbG1lbnRTdGF0dXMSFQoNYmlzY3VpdF90b2tlbhgCIAEoDBIdChVwb2xsX2ludGVydmFsX3NlY29uZHMYAyABKAUSFQoNZXJyb3JfbWVzc2FnZRgEIAEoCRIgChhjb250cm9sX3BsYW5lX3B1YmxpY19rZXkYBSABKAwSGAoQcm91dGVyX2FkZHJlc3NlcxgGIAMoCRIvCgtleHBpcmVfdGltZRgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiWQoLU2VydmljZUluZm8SJwoEdHlwZRgBIAEoDjIZLmFnZW50bWVzaC52MS5TZXJ2aWNlVHlwZRIMCgRuYW1lGAIgASgJEhMKC2Rlc2NyaXB0aW9uGAMgASgJIoEBCg5Db21tYW5kQmFja2VuZBIPCgdjb21tYW5kGAEgAygJEjIKA2VudhgCIAMoCzIlLmFnZW50bWVzaC52MS5Db21tYW5kQmFja2VuZC5FbnZFbnRyeRoqCghFbnZFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIpYBChZSZWdpc3RlclNlcnZpY2VSZXF1ZXN0EioKB3NlcnZpY2UYASABKAsyGS5hZ2VudG1lc2gudjEuU2VydmljZUluZm8SFAoKdGFyZ2V0X3VybBgCIAEoCUgAEi8KB2NvbW1hbmQYAyABKAsyHC5hZ2VudG1lc2gudjEuQ29tbWFuZEJhY2tlbmRIAEIJCgdiYWNrZW5kImkKEkRpc2NvdmVyZWRQcm92aWRlchIPCgdwZWVyX2lkGAEgASgJEhcKD2xvY2FsX3Byb3h5X3VybBgCIAEoCRIQCghzcnZfbmFtZRgDIAEoCRIXCg9zcnZfZGVzY3JpcHRpb24YBCABKAki6AEKGENvbnRyb2xQbGFuZUluZm9SZXNwb25zZRITCgtvaWRjX2lzc3VlchgBIAEoCRIRCgljbGllbnRfaWQYAiABKAkSEAoIYXVkaWVuY2UYAyABKAkSGAoQcm91dGVyX2FkZHJlc3NlcxgEIAMoCRIXCg9iYW5uZWRfcGVlcl9pZHMYBSADKAkSKQoHcm91dGVycxgGIAMoCzIYLmFnZW50bWVzaC52MS5Sb3V0ZXJJbmZvEjQKCWRpcmVjdG9yeRgHIAEoCzIhLmFnZW50bWVzaC52MS5EaXJlY3RvcnlQYXJhbWV0ZXJzIpABChNEaXJlY3RvcnlQYXJhbWV0ZXJzEhMKC3JlcGxpY2F0aW9uGAEgASgFEjUKEnJlcHJvdmlkZV9pbnRlcnZhbBgCIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbhItCgpyZWNvcmRfdHRsGAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uIvsBChBEaXJlY3RvcnlSZXF1ZXN0EjEKB3Byb3ZpZGUYASABKAsyHi5hZ2VudG1lc2gudjEuRGlyZWN0b3J5UHJvdmlkZUgAEj4KDmZpbmRfcHJvdmlkZXJzGAIgASgLMiQuYWdlbnRtZXNoLnYxLkRpcmVjdG9yeUZpbmRQcm92aWRlcnNIABI0CglmaW5kX3BlZXIYAyABKAsyHy5hZ2VudG1lc2gudjEuRGlyZWN0b3J5RmluZFBlZXJIABIzCgh3aXRoZHJhdxgEIAEoCzIfLmFnZW50bWVzaC52MS5EaXJlY3RvcnlXaXRoZHJhd0gAQgkKB3JlcXVlc3QiUQoQRGlyZWN0b3J5UHJvdmlkZRILCgNrZXkYASABKAwSDQoFYWRkcnMYAiADKAkSEAoIcHJvdmlkZXIYAyABKAkSDwoHc2VydmljZRgEIAEoCSIyChFEaXJlY3RvcnlXaXRoZHJhdxILCgNrZXkYASABKAwSEAoIcHJvdmlkZXIYAiABKAkiNAoWRGlyZWN0b3J5RmluZFByb3ZpZGVycxILCgNrZXkYASABKAwSDQoFbGltaXQYAiABKA0iJAoRRGlyZWN0b3J5RmluZFBlZXISDwoHcGVlcl9pZBgBIAEoCSJ3ChFEaXJlY3RvcnlSZXNwb25zZRIrCglwcm92aWRlcnMYASADKAsyGC5hZ2VudG1lc2gudjEuUGVlclJlY29yZBImCgRwZWVyGAIgASgLMhguYWdlbnRtZXNoLnYxLlBlZXJSZWNvcmQSDQoFZXJyb3IYAyABKAkiLAoKUGVlclJlY29yZBIPCgdwZWVyX2lkGAEgASgJEg0KBWFkZHJzGAIgAygJIsQBCgpSb3V0ZXJJbmZvEg8KB3BlZXJfaWQYASABKAkSEQoJYWRkcmVzc2VzGAIgAygJEjQKBmxhYmVscxgDIAMoCzIkLmFnZW50bWVzaC52MS5Sb3V0ZXJJbmZvLkxhYmVsc0VudHJ5EhMKC2Nvbm5lY3Rpb25zGAQgASgFEhgKEGNvbm5lY3Rpb25fbGltaXQYBSABKAUaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKDAgoSUm91dGVyTGVhc2VSZXF1ZXN0Eg8KB3BlZXJfaWQYASABKAkSEQoJYWRkcmVzc2VzGAIgAygJEg8KB2Jpc2N1aXQYAyABKAwSFwoPY29ubmVjdGVkX3BlZXJzGAQgAygJEhAKCGRodF9zaXplGAUgASgFEhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwSJgoDdHRsGAggASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uEhMKC2Nvbm5lY3Rpb25zGAkgASgFEhgKEGNvbm5lY3Rpb25fbGltaXQYCiABKAUiZgoTUm91dGVyTGVhc2VSZXNwb25zZRIPCgdzdWNjZXNzGAEgASgIEg0KBWVycm9yGAIgASgJEi8KC2V4cGlyZV90aW1lGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCK9AQoKUG9saWN5Um9sZRIMCgRuYW1lGAEgASgJEhcKD2FsbG93ZWRfdGFyZ2V0cxgCIAMoCRIYChBhbGxvd2VkX3NlcnZpY2VzGAMgAygJEhYKDmN1c3RvbV9kYXRhbG9nGAQgAygJEhYKDmFsbG93ZWRfbGFiZWxzGAUgAygJEiUKBGh0dHAYBiADKAsyFy5hZ2VudG1lc2gudjEuSFRUUEdyYW50EhcKD2FsbG93ZWRfcHVibGlzaBgHIAMoCSI8CglIVFRQR3JhbnQSDwoHc2VydmljZRgBIAEoCRIPCgdtZXRob2RzGAIgAygJEg0KBXBhdGhzGAMgAygJIqECChFFZ3Jlc3NEZXN0aW5hdGlvbhIMCgRuYW1lGAEgASgJEhIKCnRhcmdldF91cmwYAiABKAkSEgoKY3JlZGVudGlhbBgDIAEoCRIRCglzZXJ2ZWRfYnkYBCADKAkSLgoGYnJva2VyGAUgASgLMh4uYWdlbnRtZXNoLnYxLkNyZWRlbnRpYWxCcm9rZXISLAoKaW5zcGVjdGlvbhgGIAEoCzIYLmFnZW50bWVzaC52MS5JbnNwZWN0aW9uEiYKBG1vZGUYByABKA4yGC5hZ2VudG1lc2gudjEuRWdyZXNzTW9kZRINCgVwb3J0cxgIIAMoDRIVCg1wcmVzZXJ2ZV9ob3N0GAkgASgIEhcKD2ZvcndhcmRfY29udGV4dBgKIAEoCCI5CgpJbnNwZWN0aW9uEisKCmluc3BlY3RvcnMYASADKAsyFy5hZ2VudG1lc2gudjEuSW5zcGVjdG9yIm8KCUluc3BlY3RvchIvCgttb2RlbF9hcm1vchgBIAEoCzIYLmFnZW50bWVzaC52MS5Nb2RlbEFybW9ySAASKQoIZXh0X3Byb2MYAiABKAsyFS5hZ2VudG1lc2gudjEuRXh0UHJvY0gAQgYKBGtpbmQikQEKCk1vZGVsQXJtb3ISEAoIdGVtcGxhdGUYASABKAkSMgoIcmVzcG9uc2UYAiABKA4yIC5hZ2VudG1lc2gudjEuUmVzcG9uc2VJbnNwZWN0aW9uEhEKCWZhaWxfb3BlbhgDIAEoCBIqCgd0aW1lb3V0GAQgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uIogCCgdFeHRQcm9jEg4KBnRhcmdldBgBIAEoCRIKCgJjYRgCIAEoCRIaChJjbGllbnRfY2VydGlmaWNhdGUYAyABKAkSPAoPcHJvY2Vzc2luZ19tb2RlGAQgASgLMiMuYWdlbnRtZXNoLnYxLkV4dFByb2NQcm9jZXNzaW5nTW9kZRIbChNhbGxvd19tb2RlX292ZXJyaWRlGAUgASgIEjIKD21lc3NhZ2VfdGltZW91dBgGIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbhIaChJmYWlsdXJlX21vZGVfYWxsb3cYByABKAgSGgoSbWF4X2J1ZmZlcmVkX2J5dGVzGAggASgNIv8EChVFeHRQcm9jUHJvY2Vzc2luZ01vZGUSSwoTcmVxdWVzdF9oZWFkZXJfbW9kZRgBIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJMChRyZXNwb25zZV9oZWFkZXJfbW9kZRgCIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJHChFyZXF1ZXN0X2JvZHlfbW9kZRgDIAEoDjIsLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuQm9keU1vZGUSSAoScmVzcG9uc2VfYm9keV9tb2RlGAQgASgOMiwuYWdlbnRtZXNoLnYxLkV4dFByb2NQcm9jZXNzaW5nTW9kZS5Cb2R5TW9kZRJMChRyZXF1ZXN0X3RyYWlsZXJfbW9kZRgFIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJNChVyZXNwb25zZV90cmFpbGVyX21vZGUYBiABKA4yLi5hZ2VudG1lc2gudjEuRXh0UHJvY1Byb2Nlc3NpbmdNb2RlLkhlYWRlck1vZGUiOQoKSGVhZGVyTW9kZRIXChNIRUFERVJfTU9ERV9ERUZBVUxUEAASCAoEU0VORBABEggKBFNLSVAQAiJgCghCb2R5TW9kZRIICgROT05FEAASDAoIU1RSRUFNRUQQARIMCghCVUZGRVJFRBACEhQKEEJVRkZFUkVEX1BBUlRJQUwQAxIYChRGVUxMX0RVUExFWF9TVFJFQU1FRBAEIuEBChBDcmVkZW50aWFsQnJva2VyEhcKDXN0YXRpY19zZWNyZXQYASABKAlIABI3Cg9vaWRjX2ZlZGVyYXRpb24YAiABKAsyHC5hZ2VudG1lc2gudjEuT0lEQ0ZlZGVyYXRpb25IABI2Cg9hd3NfYXNzdW1lX3JvbGUYAyABKAsyGy5hZ2VudG1lc2gudjEuQVdTQXNzdW1lUm9sZUgAEjsKEXBsYXRmb3JtX2lkZW50aXR5GAQgASgLMh4uYWdlbnRtZXNoLnYxLlBsYXRmb3JtSWRlbnRpdHlIAEIGCgRraW5kIl8KDk9JRENGZWRlcmF0aW9uEhYKDnRva2VuX2VuZHBvaW50GAEgASgJEhAKCGF1ZGllbmNlGAIgASgJEhMKC2ltcGVyc29uYXRlGAMgASgJEg4KBnNjb3BlcxgEIAMoCSI5Cg1BV1NBc3N1bWVSb2xlEhAKCHJvbGVfYXJuGAEgASgJEhYKDnNlc3Npb25fcG9saWN5GAIgASgJIiIKEFBsYXRmb3JtSWRlbnRpdHkSDgoGc2NvcGVzGAEgAygJIi4KDVBvbGljeUJpbmRpbmcSDAoEcm9sZRgBIAEoCRIPCgdtZW1iZXJzGAIgAygJIpcBCgxQb2xpY3lDb25maWcSJwoFcm9sZXMYASADKAsyGC5hZ2VudG1lc2gudjEuUG9saWN5Um9sZRItCghiaW5kaW5ncxgCIAMoCzIbLmFnZW50bWVzaC52MS5Qb2xpY3lCaW5kaW5nEi8KBmVncmVzcxgDIAMoCzIfLmFnZW50bWVzaC52MS5FZ3Jlc3NEZXN0aW5hdGlvbiIYChZQb2xpY3lDb25maWdHZXRSZXF1ZXN0IjAKF1BvbGljeUNvbmZpZ0dldFJlc3BvbnNlEhUKDWRhdGFsb2dfcnVsZXMYASADKAkiPAoaUG9saWN5Q29uZmlnVXBkYXRlUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCBINCgVlcnJvchgCIAEoCSIaChhFZ3Jlc3NBc3NpZ25tZW50c1JlcXVlc3QiTAoZRWdyZXNzQXNzaWdubWVudHNSZXNwb25zZRIvCgZlZ3Jlc3MYASADKAsyHy5hZ2VudG1lc2gudjEuRWdyZXNzRGVzdGluYXRpb24iZgoMS2V5c1Jlc3BvbnNlEhMKC3B1YmxpY19rZXlzGAEgAygMEi0KCXNpZ25fdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASEgoKc2lnbmF0dXJlcxgDIAMoDCJrChNUb2tlblJlZnJlc2hSZXF1ZXN0EhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYASABKAwSGQoRY2hhbGxlbmdlX3VuaXhfbXMYAiABKAMSDwoHcGVlcl9pZBgDIAEoCRILCgNqd3QYBCABKAkidQoUVG9rZW5SZWZyZXNoUmVzcG9uc2USFQoNYmlzY3VpdF90b2tlbhgBIAEoDBIvCgtleHBpcmVfdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASFQoNZXJyb3JfbWVzc2FnZRgDIAEoCSJAChFOb2RlQ2F0YWxvZ1JlcG9ydBIrCghzZXJ2aWNlcxgBIAMoCzIZLmFnZW50bWVzaC52MS5TZXJ2aWNlSW5mbyIlChJUb2tlblJldm9rZVJlcXVlc3QSDwoHcGVlcl9pZBgBIAEoCSI1ChNUb2tlblJldm9rZVJlc3BvbnNlEg8KB3N1Y2Nlc3MYASABKAgSDQoFZXJyb3IYAiABKAkilgEKG0Jvb3RzdHJhcFRva2VuQ3JlYXRlUmVxdWVzdBIMCgRyb2xlGAEgASgJEhAKCG93bmVyX2lkGAIgASgJEhEKCXR0bF9ob3VycxgDIAEoBRISCgptYXhfdXNhZ2VzGAQgASgFEhMKC2Rlc2NyaXB0aW9uGAUgASgJEhsKE2F1dG9ub21vdXNfcmVjb3ZlcnkYBiABKAgiigEKHEJvb3RzdHJhcFRva2VuQ3JlYXRlUmVzcG9uc2USCgoCaWQYASABKAkSDQoFdG9rZW4YAiABKAkSDAoEcm9sZRgDIAEoCRIQCghvd25lcl9pZBgEIAEoCRIvCgtleHBpcmVfdGltZRgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiqwIKDkJvb3RzdHJhcFRva2VuEgoKAmlkGAEgASgJEgwKBHJvbGUYAiABKAkSEAoIb3duZXJfaWQYAyABKAkSEgoKbWF4X3VzYWdlcxgEIAEoBRIUCgx1c2FnZXNfY291bnQYBSABKAUSEwoLZGVzY3JpcHRpb24YBiABKAkSLwoLY3JlYXRlX3RpbWUYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi8KC2V4cGlyZV90aW1lGAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIvCgtyZXZva2VfdGltZRgJIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGwoTYXV0b25vbW91c19yZWNvdmVyeRgKIAEoCCJKChpCb290c3RyYXBUb2tlbkxpc3RSZXNwb25zZRIsCgZ0b2tlbnMYASADKAsyHC5hZ2VudG1lc2gudjEuQm9vdHN0cmFwVG9rZW4i1gIKEUVucm9sbG1lbnRSZXF1ZXN0EgoKAmlkGAEgASgJEg8KB3BlZXJfaWQYAiABKAkSEAoIdG9rZW5faWQYAyABKAkSLgoGc3RhdHVzGAQgASgOMh4uYWdlbnRtZXNoLnYxLkVucm9sbG1lbnRTdGF0dXMSOwoGbGFiZWxzGAUgAygLMisuYWdlbnRtZXNoLnYxLkVucm9sbG1lbnRSZXF1ZXN0LkxhYmVsc0VudHJ5Ei8KC2NyZWF0ZV90aW1lGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIwCgxyZXNvbHZlX3RpbWUYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhMKC3Jlc29sdmVkX2J5GAggASgJGi0KC0xhYmVsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiUgodRW5yb2xsbWVudFJlcXVlc3RMaXN0UmVzcG9uc2USMQoIcmVxdWVzdHMYASADKAsyHy5hZ2VudG1lc2gudjEuRW5yb2xsbWVudFJlcXVlc3QicAoEVXNlchIKCgJpZBgBIAEoCRIOCgZpc3N1ZXIYAiABKAkSDQoFZW1haWwYAyABKAkSDAoEcm9sZRgEIAEoCRIvCgtjcmVhdGVfdGltZRgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAi4wIKDEVucm9sbGVkTm9kZRIPCgdwZWVyX2lkGAEgASgJEgwKBHJvbGUYAiABKAkSFwoPZW5yb2xsbWVudF90eXBlGAMgASgJEhMKC2NsYWltc19qc29uGAQgASgJEhAKCG93bmVyX2lkGAUgASgJEjYKBmxhYmVscxgGIAMoCzImLmFnZW50bWVzaC52MS5FbnJvbGxlZE5vZGUuTGFiZWxzRW50cnkSLwoLZW5yb2xsX3RpbWUYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi8KC2V4cGlyZV90aW1lGAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIOCgZiYW5uZWQYCSABKAgSGwoTYXV0b25vbW91c19yZWNvdmVyeRgKIAEoCBotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIsQBCgtSb3V0ZXJMZWFzZRIPCgdwZWVyX2lkGAEgASgJEhEKCWFkZHJlc3NlcxgCIAMoCRI1ChFsYXN0X3JlbmV3YWxfdGltZRgDIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLwoLZXhwaXJlX3RpbWUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhcKD2Nvbm5lY3RlZF9wZWVycxgFIAMoCRIQCghkaHRfc2l6ZRgGIAEoBSJsCgxOb2RlU2VydmljZXMSKwoIc2VydmljZXMYASADKAsyGS5hZ2VudG1lc2gudjEuU2VydmljZUluZm8SLwoLcmVwb3J0X3RpbWUYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wItsDChNBZG1pblN0YXR1c1Jlc3BvbnNlEiEKBXVzZXJzGAEgAygLMhIuYWdlbnRtZXNoLnYxLlVzZXISMQoOYWN0aXZlX3JvdXRlcnMYAiADKAsyGS5hZ2VudG1lc2gudjEuUm91dGVyTGVhc2USMgoOZW5yb2xsZWRfbm9kZXMYAyADKAsyGi5hZ2VudG1lc2gudjEuRW5yb2xsZWROb2RlEjwKE2Vucm9sbG1lbnRfcmVxdWVzdHMYBCADKAsyHy5hZ2VudG1lc2gudjEuRW5yb2xsbWVudFJlcXVlc3QSNgoQYm9vdHN0cmFwX3Rva2VucxgFIAMoCzIcLmFnZW50bWVzaC52MS5Cb290c3RyYXBUb2tlbhIqCgZwb2xpY3kYBiABKAsyGi5hZ2VudG1lc2gudjEuUG9saWN5Q29uZmlnEkgKDG5vZGVfY2F0YWxvZxgHIAMoCzIyLmFnZW50bWVzaC52MS5BZG1pblN0YXR1c1Jlc3BvbnNlLk5vZGVDYXRhbG9nRW50cnkaTgoQTm9kZUNhdGFsb2dFbnRyeRILCgNrZXkYASABKAkSKQoFdmFsdWUYAiABKAsyGi5hZ2VudG1lc2gudjEuTm9kZVNlcnZpY2VzOgI4ASKBAgoSVXNlclN0YXR1c1Jlc3BvbnNlEiAKBHVzZXIYASABKAsyEi5hZ2VudG1lc2gudjEuVXNlchIyCg5lbnJvbGxlZF9ub2RlcxgCIAMoCzIaLmFnZW50bWVzaC52MS5FbnJvbGxlZE5vZGUSNgoQYm9vdHN0cmFwX3Rva2VucxgDIAMoCzIcLmFnZW50bWVzaC52MS5Cb290c3RyYXBUb2tlbhIxCg5hY3RpdmVfcm91dGVycxgEIAMoCzIZLmFnZW50bWVzaC52MS5Sb3V0ZXJMZWFzZRIqCgZwb2xpY3kYBSABKAsyGi5hZ2VudG1lc2gudjEuUG9saWN5Q29uZmlnIlYKEE5vZGVMaXN0UmVzcG9uc2USKQoFbm9kZXMYASADKAsyGi5hZ2VudG1lc2gudjEuRW5yb2xsZWROb2RlEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCSLkAQoYSWRlbnRpdHlFdmlkZW5jZVJlc3BvbnNlEg8KB3BlZXJfaWQYASABKAkSDwoHYmlzY3VpdBgCIAEoDBI3ChNiaXNjdWl0X2V4cGlyZV90aW1lGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIZChFjb250cm9sX3BsYW5lX3VybBgEIAEoCRIiChp0cnVzdGVkX2NvbnRyb2xfcGxhbmVfa2V5cxgFIAMoDBIuCgpjaGVja190aW1lGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCLGAgoUUGVlckV2aWRlbmNlUmVzcG9uc2USDwoHcGVlcl9pZBgBIAEoCRIPCgdiaXNjdWl0GAIgASgMEhUKDXZlcmlmeWluZ19rZXkYAyABKAwSDQoFcm9sZXMYBCADKAkSPgoGbGFiZWxzGAUgAygLMi4uYWdlbnRtZXNoLnYxLlBlZXJFdmlkZW5jZVJlc3BvbnNlLkxhYmVsc0VudHJ5Ei8KC2V4cGlyZV90aW1lGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIWCg5yZXZvY2F0aW9uX2lkcxgHIAMoCRIuCgpjaGVja190aW1lGAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIowCChBNZW1iZXJDcmVkZW50aWFsEhkKEWNvbnRyb2xfcGxhbmVfdXJsGAEgASgJEg8KB2Jpc2N1aXQYAiABKAwSLwoLZXhwaXJlX3RpbWUYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjUKDHRydXN0ZWRfa2V5cxgEIAMoCzIfLmFnZW50bWVzaC52MS5UcnVzdGVkU2lnbmluZ0tleRIZChFpc3N1ZWRfdW5kZXJfa2V5cxgFIAMoDBIYChByb3V0ZXJfYWRkcmVzc2VzGAYgAygJEi8KDG9pZGNfc2Vzc2lvbhgHIAEoCzIZLmFnZW50bWVzaC52MS5PSURDU2Vzc2lvbiJZChFUcnVzdGVkU2lnbmluZ0tleRISCgpwdWJsaWNfa2V5GAEgASgMEjAKDHJlY2VpdmVfdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiWQoLT0lEQ1Nlc3Npb24SDgoGaXNzdWVyGAEgASgJEhEKCWNsaWVudF9pZBgCIAEoCRIQCghhdWRpZW5jZRgDIAEoCRIVCg1yZWZyZXNoX3Rva2VuGAQgASgJIpMBChVUYXNrQXV0aG9yaXphdGlvblJ1bGUSDAoEbmFtZRgBIAEoCRIUCgxkaXNwbGF5X25hbWUYAiABKAkSJQoFcnVsZXMYAyADKAsyFi5hZ2VudG1lc2gudjEuVGFza1J1bGUSLwoLZXhwaXJlX3RpbWUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIoQBCghUYXNrUnVsZRITCgtkZXNjcmlwdGlvbhgBIAEoCRIYChBhbGxvd2VkX3NlcnZpY2VzGAIgAygJEi4KCW9wZXJhdGlvbhgDIAEoCzIbLmFnZW50bWVzaC52MS5UYXNrT3BlcmF0aW9uEhkKEWFsbG93ZWRfcmVzb3VyY2VzGAQgAygJInMKDVRhc2tPcGVyYXRpb24SFQoNYWxsb3dlZF90b29scxgBIAMoCRIXCg9hbGxvd2VkX21ldGhvZHMYAiADKAkSFQoNYWxsb3dlZF9wYXRocxgDIAMoCRIbChNhbGxvd2VkX3Blcm1pc3Npb25zGAQgAygJIqsBChRUb2tlbkV4Y2hhbmdlUmVxdWVzdBIVCg1zdWJqZWN0X3Rva2VuGAEgASgJEjYKCXRhc2tfcnVsZRgCIAEoCzIjLmFnZW50bWVzaC52MS5UYXNrQXV0aG9yaXphdGlvblJ1bGUSDAoEc2VhbBgDIAEoCBIZChFjaGFsbGVuZ2VfdW5peF9tcxgEIAEoAxIbChNjaGFsbGVuZ2Vfc2lnbmF0dXJlGAUgASgMIn8KFVRva2VuRXhjaGFuZ2VSZXNwb25zZRIVCg1iaXNjdWl0X3Rva2VuGAEgASgMEi8KC2V4cGlyZV90aW1lGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBINCgVyb2xlcxgDIAMoCRIPCgdzdWJqZWN0GAQgASgJIoEBCg9TVFNUb2tlblJlcXVlc3QSDwoHYmlzY3VpdBgBIAEoDBITCgtkZXN0aW5hdGlvbhgCIAEoCRIQCghhdWRpZW5jZRgDIAEoCRIZChFjaGFsbGVuZ2VfdW5peF9tcxgEIAEoAxIbChNjaGFsbGVuZ2Vfc2lnbmF0dXJlGAUgASgMIoMBChBTVFNUb2tlblJlc3BvbnNlEgsKA2p3dBgBIAEoCRIvCgtleHBpcmVfdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASDwoHc3ViamVjdBgDIAEoCRINCgVyb2xlcxgEIAMoCRIRCgl0YXNrX25hbWUYBSABKAkiRgoTUmV2b2NhdGlvbnNSZXNwb25zZRIWCg5yZXZvY2F0aW9uX2lkcxgBIAMoCRIXCg9iYW5uZWRfcGVlcl9pZHMYAiADKAkqlAEKEEVucm9sbG1lbnRTdGF0dXMSIQodRU5ST0xMTUVOVF9TVEFUVVNfVU5TUEVDSUZJRUQQABIdChlFTlJPTExNRU5UX1NUQVRVU19QRU5ESU5HEAESHgoaRU5ST0xMTUVOVF9TVEFUVVNfQVBQUk9WRUQQAhIeChpFTlJPTExNRU5UX1NUQVRVU19SRUpFQ1RFRBADKowBCgtTZXJ2aWNlVHlwZRIcChhTRVJWSUNFX1RZUEVfVU5TUEVDSUZJRUQQABIUChBTRVJWSUNFX1RZUEVfTUNQEAESGgoWU0VSVklDRV9UWVBFX0lORkVSRU5DRRACEhQKEFNFUlZJQ0VfVFlQRV9BMkEQAxIXChNTRVJWSUNFX1RZUEVfRUdSRVNTEAQqNwoKRWdyZXNzTW9kZRIUChBFR1JFU1NfTU9ERV9IVFRQEAASEwoPRUdSRVNTX01PREVfVENQEAEqXAoSUmVzcG9uc2VJbnNwZWN0aW9uEiAKHFJFU1BPTlNFX0lOU1BFQ1RJT05fQlVGRkVSRUQQABIkCiBSRVNQT05TRV9JTlNQRUNUSU9OX1JFUVVFU1RfT05MWRABQiFaH2dpdGh1Yi5jb20vZ29vZ2xlL2FnZW50bWVzaC9hcGliBnByb3RvMw", [file_google_protobuf_duration, file_google_protobuf_timestamp]);
 
 /**
  * @generated from message agentmesh.v1.AuthFrame
@@ -2405,7 +2405,7 @@ export const NodeServicesSchema: GenMessage<NodeServices> = /*@__PURE__*/
 
 /**
  * AdminStatusResponse answers GET /admin/status: everything the console
- * shows an administrator.
+ * shows an administrator, except expired nodes (see GET /user/nodes).
  *
  * @generated from message agentmesh.v1.AdminStatusResponse
  */
@@ -2456,9 +2456,9 @@ export const AdminStatusResponseSchema: GenMessage<AdminStatusResponse> = /*@__P
   messageDesc(file_agentmesh, 59);
 
 /**
- * UserStatusResponse answers GET /user/status: the caller and what it owns.
- * The router fleet and the mesh policy describe the whole mesh and are set
- * for an administrator only.
+ * UserStatusResponse answers GET /user/status: the caller and what it owns,
+ * except expired nodes (see GET /user/nodes). The router fleet and the mesh
+ * policy describe the whole mesh and are set for an administrator only.
  *
  * @generated from message agentmesh.v1.UserStatusResponse
  */
@@ -2496,6 +2496,35 @@ export type UserStatusResponse = Message<"agentmesh.v1.UserStatusResponse"> & {
 export const UserStatusResponseSchema: GenMessage<UserStatusResponse> = /*@__PURE__*/
   messageDesc(file_agentmesh, 60);
 
+/**
+ * NodeListResponse answers GET /user/nodes: enrolled nodes, newest enrollment
+ * first, page_size (default 50, at most 200) at a time. state (admitted,
+ * expired or banned, repeatable) and role narrow the list. An administrator
+ * sees every owner's nodes and may pick one with owner_id; a user sees its own.
+ *
+ * @generated from message agentmesh.v1.NodeListResponse
+ */
+export type NodeListResponse = Message<"agentmesh.v1.NodeListResponse"> & {
+  /**
+   * @generated from field: repeated agentmesh.v1.EnrolledNode nodes = 1;
+   */
+  nodes: EnrolledNode[];
+
+  /**
+   * Pass as page_token for the next page; empty on the last page.
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+};
+
+/**
+ * Describes the message agentmesh.v1.NodeListResponse.
+ * Use `create(NodeListResponseSchema)` to create a new message.
+ */
+export const NodeListResponseSchema: GenMessage<NodeListResponse> = /*@__PURE__*/
+  messageDesc(file_agentmesh, 61);
+
 /**
  * @generated from message agentmesh.v1.IdentityEvidenceResponse
  */
@@ -2538,7 +2567,7 @@ export type IdentityEvidenceResponse = Message<"agentmesh.v1.IdentityEvidenceRes
  * Use `create(IdentityEvidenceResponseSchema)` to create a new message.
  */
 export const IdentityEvidenceResponseSchema: GenMessage<IdentityEvidenceResponse> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 61);
+  messageDesc(file_agentmesh, 62);
 
 /**
  * @generated from message agentmesh.v1.PeerEvidenceResponse
@@ -2594,7 +2623,7 @@ export type PeerEvidenceResponse = Message<"agentmesh.v1.PeerEvidenceResponse">
  * Use `create(PeerEvidenceResponseSchema)` to create a new message.
  */
 export const PeerEvidenceResponseSchema: GenMessage<PeerEvidenceResponse> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 62);
+  messageDesc(file_agentmesh, 63);
 
 /**
  * @generated from message agentmesh.v1.MemberCredential
@@ -2659,7 +2688,7 @@ export type MemberCredential = Message<"agentmesh.v1.MemberCredential"> & {
  * Use `create(MemberCredentialSchema)` to create a new message.
  */
 export const MemberCredentialSchema: GenMessage<MemberCredential> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 63);
+  messageDesc(file_agentmesh, 64);
 
 /**
  * @generated from message agentmesh.v1.TrustedSigningKey
@@ -2686,7 +2715,7 @@ export type TrustedSigningKey = Message<"agentmesh.v1.TrustedSigningKey"> & {
  * Use `create(TrustedSigningKeySchema)` to create a new message.
  */
 export const TrustedSigningKeySchema: GenMessage<TrustedSigningKey> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 64);
+  messageDesc(file_agentmesh, 65);
 
 /**
  * @generated from message agentmesh.v1.OIDCSession
@@ -2718,7 +2747,7 @@ export type OIDCSession = Message<"agentmesh.v1.OIDCSession"> & {
  * Use `create(OIDCSessionSchema)` to create a new message.
  */
 export const OIDCSessionSchema: GenMessage<OIDCSession> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 65);
+  messageDesc(file_agentmesh, 66);
 
 /**
  * TaskAuthorizationRule narrows a credential's authority for a specific task or
@@ -2762,7 +2791,7 @@ export type TaskAuthorizationRule = Message<"agentmesh.v1.TaskAuthorizationRule"
  * Use `create(TaskAuthorizationRuleSchema)` to create a new message.
  */
 export const TaskAuthorizationRuleSchema: GenMessage<TaskAuthorizationRule> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 66);
+  messageDesc(file_agentmesh, 67);
 
 /**
  * @generated from message agentmesh.v1.TaskRule
@@ -2806,7 +2835,7 @@ export type TaskRule = Message<"agentmesh.v1.TaskRule"> & {
  * Use `create(TaskRuleSchema)` to create a new message.
  */
 export const TaskRuleSchema: GenMessage<TaskRule> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 67);
+  messageDesc(file_agentmesh, 68);
 
 /**
  * @generated from message agentmesh.v1.TaskOperation
@@ -2848,7 +2877,7 @@ export type TaskOperation = Message<"agentmesh.v1.TaskOperation"> & {
  * Use `create(TaskOperationSchema)` to create a new message.
  */
 export const TaskOperationSchema: GenMessage<TaskOperation> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 68);
+  messageDesc(file_agentmesh, 69);
 
 /**
  * TokenExchangeRequest is the body of POST /token/exchange on the control
@@ -2906,7 +2935,7 @@ export type TokenExchangeRequest = Message<"agentmesh.v1.TokenExchangeRequest">
  * Use `create(TokenExchangeRequestSchema)` to create a new message.
  */
 export const TokenExchangeRequestSchema: GenMessage<TokenExchangeRequest> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 69);
+  messageDesc(file_agentmesh, 70);
 
 /**
  * @generated from message agentmesh.v1.TokenExchangeResponse
@@ -2938,7 +2967,7 @@ export type TokenExchangeResponse = Message<"agentmesh.v1.TokenExchangeResponse"
  * Use `create(TokenExchangeResponseSchema)` to create a new message.
  */
 export const TokenExchangeResponseSchema: GenMessage<TokenExchangeResponse> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 70);
+  messageDesc(file_agentmesh, 71);
 
 /**
  * STSTokenRequest is the body of POST /sts/token on the control plane: an
@@ -2992,7 +3021,7 @@ export type STSTokenRequest = Message<"agentmesh.v1.STSTokenRequest"> & {
  * Use `create(STSTokenRequestSchema)` to create a new message.
  */
 export const STSTokenRequestSchema: GenMessage<STSTokenRequest> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 71);
+  messageDesc(file_agentmesh, 72);
 
 /**
  * @generated from message agentmesh.v1.STSTokenResponse
@@ -3029,7 +3058,7 @@ export type STSTokenResponse = Message<"agentmesh.v1.STSTokenResponse"> & {
  * Use `create(STSTokenResponseSchema)` to create a new message.
  */
 export const STSTokenResponseSchema: GenMessage<STSTokenResponse> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 72);
+  messageDesc(file_agentmesh, 73);
 
 /**
  * RevocationsResponse answers GET /revocations on the control plane: the set of
@@ -3055,7 +3084,7 @@ export type RevocationsResponse = Message<"agentmesh.v1.RevocationsResponse"> &
  * Use `create(RevocationsResponseSchema)` to create a new message.
  */
 export const RevocationsResponseSchema: GenMessage<RevocationsResponse> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 73);
+  messageDesc(file_agentmesh, 74);
 
 /**
  * @generated from enum agentmesh.v1.EnrollmentStatus
diff --git a/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.py b/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.py
index be4059d3..d1597202 100644
--- a/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.py
+++ b/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.py
@@ -15,7 +15,7 @@
 from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x0f\x61gentmesh.proto\x12\x0c\x61gentmesh.v1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"4\n\tAuthFrame\x12\x0f\n\x07\x62iscuit\x18\x01 \x01(\x0c\x12\x16\n\x0etarget_service\x18\x02 \x01(\t\"?\n\x0c\x41uthResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x03 \x01(\x0c\"\xb1\x01\n\x0cRouterGoAway\x12\x31\n\x06reason\x18\x01 \x01(\x0e\x32!.agentmesh.v1.RouterGoAway.Reason\x12.\n\x0bretry_after\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\">\n\x06Reason\x12\x16\n\x12REASON_UNSPECIFIED\x10\x00\x12\x0c\n\x08\x44RAINING\x10\x01\x12\x0e\n\nOVERLOADED\x10\x02\"\xdc\x01\n\tMeshEvent\x12*\n\x04type\x18\x01 \x01(\x0e\x32\x1c.agentmesh.v1.MeshEvent.Type\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12.\n\nevent_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x16\n\x0enew_public_key\x18\x04 \x01(\x0c\x12\x11\n\tsignature\x18\x05 \x01(\x0c\"7\n\x04Type\x12\n\n\x06\x42\x41NNED\x10\x00\x12\x10\n\x0cKEY_ROTATION\x10\x01\x12\x11\n\rPOLICY_UPDATE\x10\x02\"\xf9\x01\n\rEnrollRequest\x12\x0b\n\x03jwt\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x12\n\npublic_key\x18\x03 \x01(\x0c\x12\x16\n\x0erequested_role\x18\x04 \x01(\t\x12\x37\n\x06labels\x18\x05 \x03(\x0b\x32\'.agentmesh.v1.EnrollRequest.LabelsEntry\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xab\x01\n\x0e\x45nrollResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12 \n\x18\x63ontrol_plane_public_key\x18\x03 \x01(\x0c\x12\x18\n\x10router_addresses\x18\x04 \x03(\t\x12/\n\x0b\x65xpire_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x97\x02\n\x16\x42ootstrapEnrollRequest\x12\x17\n\x0f\x62ootstrap_token\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x12\n\npublic_key\x18\x03 \x01(\x0c\x12\x16\n\x0erequested_role\x18\x04 \x01(\t\x12@\n\x06labels\x18\x05 \x03(\x0b\x32\x30.agentmesh.v1.BootstrapEnrollRequest.LabelsEntry\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x83\x02\n\x17\x42ootstrapEnrollResponse\x12.\n\x06status\x18\x01 \x01(\x0e\x32\x1e.agentmesh.v1.EnrollmentStatus\x12\x15\n\rbiscuit_token\x18\x02 \x01(\x0c\x12\x1d\n\x15poll_interval_seconds\x18\x03 \x01(\x05\x12\x15\n\rerror_message\x18\x04 \x01(\t\x12 \n\x18\x63ontrol_plane_public_key\x18\x05 \x01(\x0c\x12\x18\n\x10router_addresses\x18\x06 \x03(\t\x12/\n\x0b\x65xpire_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"Y\n\x0bServiceInfo\x12\'\n\x04type\x18\x01 \x01(\x0e\x32\x19.agentmesh.v1.ServiceType\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x03 \x01(\t\"\x81\x01\n\x0e\x43ommandBackend\x12\x0f\n\x07\x63ommand\x18\x01 \x03(\t\x12\x32\n\x03\x65nv\x18\x02 \x03(\x0b\x32%.agentmesh.v1.CommandBackend.EnvEntry\x1a*\n\x08\x45nvEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x96\x01\n\x16RegisterServiceRequest\x12*\n\x07service\x18\x01 \x01(\x0b\x32\x19.agentmesh.v1.ServiceInfo\x12\x14\n\ntarget_url\x18\x02 \x01(\tH\x00\x12/\n\x07\x63ommand\x18\x03 \x01(\x0b\x32\x1c.agentmesh.v1.CommandBackendH\x00\x42\t\n\x07\x62\x61\x63kend\"i\n\x12\x44iscoveredProvider\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x17\n\x0flocal_proxy_url\x18\x02 \x01(\t\x12\x10\n\x08srv_name\x18\x03 \x01(\t\x12\x17\n\x0fsrv_description\x18\x04 \x01(\t\"\xe8\x01\n\x18\x43ontrolPlaneInfoResponse\x12\x13\n\x0boidc_issuer\x18\x01 \x01(\t\x12\x11\n\tclient_id\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x18\n\x10router_addresses\x18\x04 \x03(\t\x12\x17\n\x0f\x62\x61nned_peer_ids\x18\x05 \x03(\t\x12)\n\x07routers\x18\x06 \x03(\x0b\x32\x18.agentmesh.v1.RouterInfo\x12\x34\n\tdirectory\x18\x07 \x01(\x0b\x32!.agentmesh.v1.DirectoryParameters\"\x90\x01\n\x13\x44irectoryParameters\x12\x13\n\x0breplication\x18\x01 \x01(\x05\x12\x35\n\x12reprovide_interval\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12-\n\nrecord_ttl\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\"\xfb\x01\n\x10\x44irectoryRequest\x12\x31\n\x07provide\x18\x01 \x01(\x0b\x32\x1e.agentmesh.v1.DirectoryProvideH\x00\x12>\n\x0e\x66ind_providers\x18\x02 \x01(\x0b\x32$.agentmesh.v1.DirectoryFindProvidersH\x00\x12\x34\n\tfind_peer\x18\x03 \x01(\x0b\x32\x1f.agentmesh.v1.DirectoryFindPeerH\x00\x12\x33\n\x08withdraw\x18\x04 \x01(\x0b\x32\x1f.agentmesh.v1.DirectoryWithdrawH\x00\x42\t\n\x07request\"Q\n\x10\x44irectoryProvide\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\r\n\x05\x61\x64\x64rs\x18\x02 \x03(\t\x12\x10\n\x08provider\x18\x03 \x01(\t\x12\x0f\n\x07service\x18\x04 \x01(\t\"2\n\x11\x44irectoryWithdraw\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\x10\n\x08provider\x18\x02 \x01(\t\"4\n\x16\x44irectoryFindProviders\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\r\n\x05limit\x18\x02 \x01(\r\"$\n\x11\x44irectoryFindPeer\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\"w\n\x11\x44irectoryResponse\x12+\n\tproviders\x18\x01 \x03(\x0b\x32\x18.agentmesh.v1.PeerRecord\x12&\n\x04peer\x18\x02 \x01(\x0b\x32\x18.agentmesh.v1.PeerRecord\x12\r\n\x05\x65rror\x18\x03 \x01(\t\",\n\nPeerRecord\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\r\n\x05\x61\x64\x64rs\x18\x02 \x03(\t\"\xc4\x01\n\nRouterInfo\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x34\n\x06labels\x18\x03 \x03(\x0b\x32$.agentmesh.v1.RouterInfo.LabelsEntry\x12\x13\n\x0b\x63onnections\x18\x04 \x01(\x05\x12\x18\n\x10\x63onnection_limit\x18\x05 \x01(\x05\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x83\x02\n\x12RouterLeaseRequest\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x0f\n\x07\x62iscuit\x18\x03 \x01(\x0c\x12\x17\n\x0f\x63onnected_peers\x18\x04 \x03(\t\x12\x10\n\x08\x64ht_size\x18\x05 \x01(\x05\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x12&\n\x03ttl\x18\x08 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x13\n\x0b\x63onnections\x18\t \x01(\x05\x12\x18\n\x10\x63onnection_limit\x18\n \x01(\x05\"f\n\x13RouterLeaseResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xbd\x01\n\nPolicyRole\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x17\n\x0f\x61llowed_targets\x18\x02 \x03(\t\x12\x18\n\x10\x61llowed_services\x18\x03 \x03(\t\x12\x16\n\x0e\x63ustom_datalog\x18\x04 \x03(\t\x12\x16\n\x0e\x61llowed_labels\x18\x05 \x03(\t\x12%\n\x04http\x18\x06 \x03(\x0b\x32\x17.agentmesh.v1.HTTPGrant\x12\x17\n\x0f\x61llowed_publish\x18\x07 \x03(\t\"<\n\tHTTPGrant\x12\x0f\n\x07service\x18\x01 \x01(\t\x12\x0f\n\x07methods\x18\x02 \x03(\t\x12\r\n\x05paths\x18\x03 \x03(\t\"\xa1\x02\n\x11\x45gressDestination\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x12\n\ntarget_url\x18\x02 \x01(\t\x12\x12\n\ncredential\x18\x03 \x01(\t\x12\x11\n\tserved_by\x18\x04 \x03(\t\x12.\n\x06\x62roker\x18\x05 \x01(\x0b\x32\x1e.agentmesh.v1.CredentialBroker\x12,\n\ninspection\x18\x06 \x01(\x0b\x32\x18.agentmesh.v1.Inspection\x12&\n\x04mode\x18\x07 \x01(\x0e\x32\x18.agentmesh.v1.EgressMode\x12\r\n\x05ports\x18\x08 \x03(\r\x12\x15\n\rpreserve_host\x18\t \x01(\x08\x12\x17\n\x0f\x66orward_context\x18\n \x01(\x08\"9\n\nInspection\x12+\n\ninspectors\x18\x01 \x03(\x0b\x32\x17.agentmesh.v1.Inspector\"o\n\tInspector\x12/\n\x0bmodel_armor\x18\x01 \x01(\x0b\x32\x18.agentmesh.v1.ModelArmorH\x00\x12)\n\x08\x65xt_proc\x18\x02 \x01(\x0b\x32\x15.agentmesh.v1.ExtProcH\x00\x42\x06\n\x04kind\"\x91\x01\n\nModelArmor\x12\x10\n\x08template\x18\x01 \x01(\t\x12\x32\n\x08response\x18\x02 \x01(\x0e\x32 .agentmesh.v1.ResponseInspection\x12\x11\n\tfail_open\x18\x03 \x01(\x08\x12*\n\x07timeout\x18\x04 \x01(\x0b\x32\x19.google.protobuf.Duration\"\x88\x02\n\x07\x45xtProc\x12\x0e\n\x06target\x18\x01 \x01(\t\x12\n\n\x02\x63\x61\x18\x02 \x01(\t\x12\x1a\n\x12\x63lient_certificate\x18\x03 \x01(\t\x12<\n\x0fprocessing_mode\x18\x04 \x01(\x0b\x32#.agentmesh.v1.ExtProcProcessingMode\x12\x1b\n\x13\x61llow_mode_override\x18\x05 \x01(\x08\x12\x32\n\x0fmessage_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x1a\n\x12\x66\x61ilure_mode_allow\x18\x07 \x01(\x08\x12\x1a\n\x12max_buffered_bytes\x18\x08 \x01(\r\"\xff\x04\n\x15\x45xtProcProcessingMode\x12K\n\x13request_header_mode\x18\x01 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12L\n\x14response_header_mode\x18\x02 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12G\n\x11request_body_mode\x18\x03 \x01(\x0e\x32,.agentmesh.v1.ExtProcProcessingMode.BodyMode\x12H\n\x12response_body_mode\x18\x04 \x01(\x0e\x32,.agentmesh.v1.ExtProcProcessingMode.BodyMode\x12L\n\x14request_trailer_mode\x18\x05 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12M\n\x15response_trailer_mode\x18\x06 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\"9\n\nHeaderMode\x12\x17\n\x13HEADER_MODE_DEFAULT\x10\x00\x12\x08\n\x04SEND\x10\x01\x12\x08\n\x04SKIP\x10\x02\"`\n\x08\x42odyMode\x12\x08\n\x04NONE\x10\x00\x12\x0c\n\x08STREAMED\x10\x01\x12\x0c\n\x08\x42UFFERED\x10\x02\x12\x14\n\x10\x42UFFERED_PARTIAL\x10\x03\x12\x18\n\x14\x46ULL_DUPLEX_STREAMED\x10\x04\"\xe1\x01\n\x10\x43redentialBroker\x12\x17\n\rstatic_secret\x18\x01 \x01(\tH\x00\x12\x37\n\x0foidc_federation\x18\x02 \x01(\x0b\x32\x1c.agentmesh.v1.OIDCFederationH\x00\x12\x36\n\x0f\x61ws_assume_role\x18\x03 \x01(\x0b\x32\x1b.agentmesh.v1.AWSAssumeRoleH\x00\x12;\n\x11platform_identity\x18\x04 \x01(\x0b\x32\x1e.agentmesh.v1.PlatformIdentityH\x00\x42\x06\n\x04kind\"_\n\x0eOIDCFederation\x12\x16\n\x0etoken_endpoint\x18\x01 \x01(\t\x12\x10\n\x08\x61udience\x18\x02 \x01(\t\x12\x13\n\x0bimpersonate\x18\x03 \x01(\t\x12\x0e\n\x06scopes\x18\x04 \x03(\t\"9\n\rAWSAssumeRole\x12\x10\n\x08role_arn\x18\x01 \x01(\t\x12\x16\n\x0esession_policy\x18\x02 \x01(\t\"\"\n\x10PlatformIdentity\x12\x0e\n\x06scopes\x18\x01 \x03(\t\".\n\rPolicyBinding\x12\x0c\n\x04role\x18\x01 \x01(\t\x12\x0f\n\x07members\x18\x02 \x03(\t\"\x97\x01\n\x0cPolicyConfig\x12\'\n\x05roles\x18\x01 \x03(\x0b\x32\x18.agentmesh.v1.PolicyRole\x12-\n\x08\x62indings\x18\x02 \x03(\x0b\x32\x1b.agentmesh.v1.PolicyBinding\x12/\n\x06\x65gress\x18\x03 \x03(\x0b\x32\x1f.agentmesh.v1.EgressDestination\"\x18\n\x16PolicyConfigGetRequest\"0\n\x17PolicyConfigGetResponse\x12\x15\n\rdatalog_rules\x18\x01 \x03(\t\"<\n\x1aPolicyConfigUpdateResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\"\x1a\n\x18\x45gressAssignmentsRequest\"L\n\x19\x45gressAssignmentsResponse\x12/\n\x06\x65gress\x18\x01 \x03(\x0b\x32\x1f.agentmesh.v1.EgressDestination\"f\n\x0cKeysResponse\x12\x13\n\x0bpublic_keys\x18\x01 \x03(\x0c\x12-\n\tsign_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x12\n\nsignatures\x18\x03 \x03(\x0c\"k\n\x13TokenRefreshRequest\x12\x1b\n\x13\x63hallenge_signature\x18\x01 \x01(\x0c\x12\x19\n\x11\x63hallenge_unix_ms\x18\x02 \x01(\x03\x12\x0f\n\x07peer_id\x18\x03 \x01(\t\x12\x0b\n\x03jwt\x18\x04 \x01(\t\"u\n\x14TokenRefreshResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x15\n\rerror_message\x18\x03 \x01(\t\"@\n\x11NodeCatalogReport\x12+\n\x08services\x18\x01 \x03(\x0b\x32\x19.agentmesh.v1.ServiceInfo\"%\n\x12TokenRevokeRequest\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\"5\n\x13TokenRevokeResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\"\x96\x01\n\x1b\x42ootstrapTokenCreateRequest\x12\x0c\n\x04role\x18\x01 \x01(\t\x12\x10\n\x08owner_id\x18\x02 \x01(\t\x12\x11\n\tttl_hours\x18\x03 \x01(\x05\x12\x12\n\nmax_usages\x18\x04 \x01(\x05\x12\x13\n\x0b\x64\x65scription\x18\x05 \x01(\t\x12\x1b\n\x13\x61utonomous_recovery\x18\x06 \x01(\x08\"\x8a\x01\n\x1c\x42ootstrapTokenCreateResponse\x12\n\n\x02id\x18\x01 \x01(\t\x12\r\n\x05token\x18\x02 \x01(\t\x12\x0c\n\x04role\x18\x03 \x01(\t\x12\x10\n\x08owner_id\x18\x04 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xab\x02\n\x0e\x42ootstrapToken\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0c\n\x04role\x18\x02 \x01(\t\x12\x10\n\x08owner_id\x18\x03 \x01(\t\x12\x12\n\nmax_usages\x18\x04 \x01(\x05\x12\x14\n\x0cusages_count\x18\x05 \x01(\x05\x12\x13\n\x0b\x64\x65scription\x18\x06 \x01(\t\x12/\n\x0b\x63reate_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0brevoke_time\x18\t \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x1b\n\x13\x61utonomous_recovery\x18\n \x01(\x08\"J\n\x1a\x42ootstrapTokenListResponse\x12,\n\x06tokens\x18\x01 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\"\xd6\x02\n\x11\x45nrollmentRequest\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x10\n\x08token_id\x18\x03 \x01(\t\x12.\n\x06status\x18\x04 \x01(\x0e\x32\x1e.agentmesh.v1.EnrollmentStatus\x12;\n\x06labels\x18\x05 \x03(\x0b\x32+.agentmesh.v1.EnrollmentRequest.LabelsEntry\x12/\n\x0b\x63reate_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x30\n\x0cresolve_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x13\n\x0bresolved_by\x18\x08 \x01(\t\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"R\n\x1d\x45nrollmentRequestListResponse\x12\x31\n\x08requests\x18\x01 \x03(\x0b\x32\x1f.agentmesh.v1.EnrollmentRequest\"p\n\x04User\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0e\n\x06issuer\x18\x02 \x01(\t\x12\r\n\x05\x65mail\x18\x03 \x01(\t\x12\x0c\n\x04role\x18\x04 \x01(\t\x12/\n\x0b\x63reate_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xe3\x02\n\x0c\x45nrolledNode\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0c\n\x04role\x18\x02 \x01(\t\x12\x17\n\x0f\x65nrollment_type\x18\x03 \x01(\t\x12\x13\n\x0b\x63laims_json\x18\x04 \x01(\t\x12\x10\n\x08owner_id\x18\x05 \x01(\t\x12\x36\n\x06labels\x18\x06 \x03(\x0b\x32&.agentmesh.v1.EnrolledNode.LabelsEntry\x12/\n\x0b\x65nroll_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0e\n\x06\x62\x61nned\x18\t \x01(\x08\x12\x1b\n\x13\x61utonomous_recovery\x18\n \x01(\x08\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xc4\x01\n\x0bRouterLease\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x35\n\x11last_renewal_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x17\n\x0f\x63onnected_peers\x18\x05 \x03(\t\x12\x10\n\x08\x64ht_size\x18\x06 \x01(\x05\"l\n\x0cNodeServices\x12+\n\x08services\x18\x01 \x03(\x0b\x32\x19.agentmesh.v1.ServiceInfo\x12/\n\x0breport_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xdb\x03\n\x13\x41\x64minStatusResponse\x12!\n\x05users\x18\x01 \x03(\x0b\x32\x12.agentmesh.v1.User\x12\x31\n\x0e\x61\x63tive_routers\x18\x02 \x03(\x0b\x32\x19.agentmesh.v1.RouterLease\x12\x32\n\x0e\x65nrolled_nodes\x18\x03 \x03(\x0b\x32\x1a.agentmesh.v1.EnrolledNode\x12<\n\x13\x65nrollment_requests\x18\x04 \x03(\x0b\x32\x1f.agentmesh.v1.EnrollmentRequest\x12\x36\n\x10\x62ootstrap_tokens\x18\x05 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\x12*\n\x06policy\x18\x06 \x01(\x0b\x32\x1a.agentmesh.v1.PolicyConfig\x12H\n\x0cnode_catalog\x18\x07 \x03(\x0b\x32\x32.agentmesh.v1.AdminStatusResponse.NodeCatalogEntry\x1aN\n\x10NodeCatalogEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12)\n\x05value\x18\x02 \x01(\x0b\x32\x1a.agentmesh.v1.NodeServices:\x02\x38\x01\"\x81\x02\n\x12UserStatusResponse\x12 \n\x04user\x18\x01 \x01(\x0b\x32\x12.agentmesh.v1.User\x12\x32\n\x0e\x65nrolled_nodes\x18\x02 \x03(\x0b\x32\x1a.agentmesh.v1.EnrolledNode\x12\x36\n\x10\x62ootstrap_tokens\x18\x03 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\x12\x31\n\x0e\x61\x63tive_routers\x18\x04 \x03(\x0b\x32\x19.agentmesh.v1.RouterLease\x12*\n\x06policy\x18\x05 \x01(\x0b\x32\x1a.agentmesh.v1.PolicyConfig\"\xe4\x01\n\x18IdentityEvidenceResponse\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12\x37\n\x13\x62iscuit_expire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x19\n\x11\x63ontrol_plane_url\x18\x04 \x01(\t\x12\"\n\x1atrusted_control_plane_keys\x18\x05 \x03(\x0c\x12.\n\ncheck_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xc6\x02\n\x14PeerEvidenceResponse\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12\x15\n\rverifying_key\x18\x03 \x01(\x0c\x12\r\n\x05roles\x18\x04 \x03(\t\x12>\n\x06labels\x18\x05 \x03(\x0b\x32..agentmesh.v1.PeerEvidenceResponse.LabelsEntry\x12/\n\x0b\x65xpire_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x16\n\x0erevocation_ids\x18\x07 \x03(\t\x12.\n\ncheck_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x8c\x02\n\x10MemberCredential\x12\x19\n\x11\x63ontrol_plane_url\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x0ctrusted_keys\x18\x04 \x03(\x0b\x32\x1f.agentmesh.v1.TrustedSigningKey\x12\x19\n\x11issued_under_keys\x18\x05 \x03(\x0c\x12\x18\n\x10router_addresses\x18\x06 \x03(\t\x12/\n\x0coidc_session\x18\x07 \x01(\x0b\x32\x19.agentmesh.v1.OIDCSession\"Y\n\x11TrustedSigningKey\x12\x12\n\npublic_key\x18\x01 \x01(\x0c\x12\x30\n\x0creceive_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"Y\n\x0bOIDCSession\x12\x0e\n\x06issuer\x18\x01 \x01(\t\x12\x11\n\tclient_id\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x15\n\rrefresh_token\x18\x04 \x01(\t\"\x93\x01\n\x15TaskAuthorizationRule\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x14\n\x0c\x64isplay_name\x18\x02 \x01(\t\x12%\n\x05rules\x18\x03 \x03(\x0b\x32\x16.agentmesh.v1.TaskRule\x12/\n\x0b\x65xpire_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x84\x01\n\x08TaskRule\x12\x13\n\x0b\x64\x65scription\x18\x01 \x01(\t\x12\x18\n\x10\x61llowed_services\x18\x02 \x03(\t\x12.\n\toperation\x18\x03 \x01(\x0b\x32\x1b.agentmesh.v1.TaskOperation\x12\x19\n\x11\x61llowed_resources\x18\x04 \x03(\t\"s\n\rTaskOperation\x12\x15\n\rallowed_tools\x18\x01 \x03(\t\x12\x17\n\x0f\x61llowed_methods\x18\x02 \x03(\t\x12\x15\n\rallowed_paths\x18\x03 \x03(\t\x12\x1b\n\x13\x61llowed_permissions\x18\x04 \x03(\t\"\xab\x01\n\x14TokenExchangeRequest\x12\x15\n\rsubject_token\x18\x01 \x01(\t\x12\x36\n\ttask_rule\x18\x02 \x01(\x0b\x32#.agentmesh.v1.TaskAuthorizationRule\x12\x0c\n\x04seal\x18\x03 \x01(\x08\x12\x19\n\x11\x63hallenge_unix_ms\x18\x04 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x05 \x01(\x0c\"\x7f\n\x15TokenExchangeResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\r\n\x05roles\x18\x03 \x03(\t\x12\x0f\n\x07subject\x18\x04 \x01(\t\"\x81\x01\n\x0fSTSTokenRequest\x12\x0f\n\x07\x62iscuit\x18\x01 \x01(\x0c\x12\x13\n\x0b\x64\x65stination\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x19\n\x11\x63hallenge_unix_ms\x18\x04 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x05 \x01(\x0c\"\x83\x01\n\x10STSTokenResponse\x12\x0b\n\x03jwt\x18\x01 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0f\n\x07subject\x18\x03 \x01(\t\x12\r\n\x05roles\x18\x04 \x03(\t\x12\x11\n\ttask_name\x18\x05 \x01(\t\"F\n\x13RevocationsResponse\x12\x16\n\x0erevocation_ids\x18\x01 \x03(\t\x12\x17\n\x0f\x62\x61nned_peer_ids\x18\x02 \x03(\t*\x94\x01\n\x10\x45nrollmentStatus\x12!\n\x1d\x45NROLLMENT_STATUS_UNSPECIFIED\x10\x00\x12\x1d\n\x19\x45NROLLMENT_STATUS_PENDING\x10\x01\x12\x1e\n\x1a\x45NROLLMENT_STATUS_APPROVED\x10\x02\x12\x1e\n\x1a\x45NROLLMENT_STATUS_REJECTED\x10\x03*\x8c\x01\n\x0bServiceType\x12\x1c\n\x18SERVICE_TYPE_UNSPECIFIED\x10\x00\x12\x14\n\x10SERVICE_TYPE_MCP\x10\x01\x12\x1a\n\x16SERVICE_TYPE_INFERENCE\x10\x02\x12\x14\n\x10SERVICE_TYPE_A2A\x10\x03\x12\x17\n\x13SERVICE_TYPE_EGRESS\x10\x04*7\n\nEgressMode\x12\x14\n\x10\x45GRESS_MODE_HTTP\x10\x00\x12\x13\n\x0f\x45GRESS_MODE_TCP\x10\x01*\\\n\x12ResponseInspection\x12 \n\x1cRESPONSE_INSPECTION_BUFFERED\x10\x00\x12$\n RESPONSE_INSPECTION_REQUEST_ONLY\x10\x01\x42!Z\x1fgithub.com/google/agentmesh/apib\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x0f\x61gentmesh.proto\x12\x0c\x61gentmesh.v1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"4\n\tAuthFrame\x12\x0f\n\x07\x62iscuit\x18\x01 \x01(\x0c\x12\x16\n\x0etarget_service\x18\x02 \x01(\t\"?\n\x0c\x41uthResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x03 \x01(\x0c\"\xb1\x01\n\x0cRouterGoAway\x12\x31\n\x06reason\x18\x01 \x01(\x0e\x32!.agentmesh.v1.RouterGoAway.Reason\x12.\n\x0bretry_after\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\">\n\x06Reason\x12\x16\n\x12REASON_UNSPECIFIED\x10\x00\x12\x0c\n\x08\x44RAINING\x10\x01\x12\x0e\n\nOVERLOADED\x10\x02\"\xdc\x01\n\tMeshEvent\x12*\n\x04type\x18\x01 \x01(\x0e\x32\x1c.agentmesh.v1.MeshEvent.Type\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12.\n\nevent_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x16\n\x0enew_public_key\x18\x04 \x01(\x0c\x12\x11\n\tsignature\x18\x05 \x01(\x0c\"7\n\x04Type\x12\n\n\x06\x42\x41NNED\x10\x00\x12\x10\n\x0cKEY_ROTATION\x10\x01\x12\x11\n\rPOLICY_UPDATE\x10\x02\"\xf9\x01\n\rEnrollRequest\x12\x0b\n\x03jwt\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x12\n\npublic_key\x18\x03 \x01(\x0c\x12\x16\n\x0erequested_role\x18\x04 \x01(\t\x12\x37\n\x06labels\x18\x05 \x03(\x0b\x32\'.agentmesh.v1.EnrollRequest.LabelsEntry\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xab\x01\n\x0e\x45nrollResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12 \n\x18\x63ontrol_plane_public_key\x18\x03 \x01(\x0c\x12\x18\n\x10router_addresses\x18\x04 \x03(\t\x12/\n\x0b\x65xpire_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x97\x02\n\x16\x42ootstrapEnrollRequest\x12\x17\n\x0f\x62ootstrap_token\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x12\n\npublic_key\x18\x03 \x01(\x0c\x12\x16\n\x0erequested_role\x18\x04 \x01(\t\x12@\n\x06labels\x18\x05 \x03(\x0b\x32\x30.agentmesh.v1.BootstrapEnrollRequest.LabelsEntry\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x83\x02\n\x17\x42ootstrapEnrollResponse\x12.\n\x06status\x18\x01 \x01(\x0e\x32\x1e.agentmesh.v1.EnrollmentStatus\x12\x15\n\rbiscuit_token\x18\x02 \x01(\x0c\x12\x1d\n\x15poll_interval_seconds\x18\x03 \x01(\x05\x12\x15\n\rerror_message\x18\x04 \x01(\t\x12 \n\x18\x63ontrol_plane_public_key\x18\x05 \x01(\x0c\x12\x18\n\x10router_addresses\x18\x06 \x03(\t\x12/\n\x0b\x65xpire_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"Y\n\x0bServiceInfo\x12\'\n\x04type\x18\x01 \x01(\x0e\x32\x19.agentmesh.v1.ServiceType\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x03 \x01(\t\"\x81\x01\n\x0e\x43ommandBackend\x12\x0f\n\x07\x63ommand\x18\x01 \x03(\t\x12\x32\n\x03\x65nv\x18\x02 \x03(\x0b\x32%.agentmesh.v1.CommandBackend.EnvEntry\x1a*\n\x08\x45nvEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x96\x01\n\x16RegisterServiceRequest\x12*\n\x07service\x18\x01 \x01(\x0b\x32\x19.agentmesh.v1.ServiceInfo\x12\x14\n\ntarget_url\x18\x02 \x01(\tH\x00\x12/\n\x07\x63ommand\x18\x03 \x01(\x0b\x32\x1c.agentmesh.v1.CommandBackendH\x00\x42\t\n\x07\x62\x61\x63kend\"i\n\x12\x44iscoveredProvider\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x17\n\x0flocal_proxy_url\x18\x02 \x01(\t\x12\x10\n\x08srv_name\x18\x03 \x01(\t\x12\x17\n\x0fsrv_description\x18\x04 \x01(\t\"\xe8\x01\n\x18\x43ontrolPlaneInfoResponse\x12\x13\n\x0boidc_issuer\x18\x01 \x01(\t\x12\x11\n\tclient_id\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x18\n\x10router_addresses\x18\x04 \x03(\t\x12\x17\n\x0f\x62\x61nned_peer_ids\x18\x05 \x03(\t\x12)\n\x07routers\x18\x06 \x03(\x0b\x32\x18.agentmesh.v1.RouterInfo\x12\x34\n\tdirectory\x18\x07 \x01(\x0b\x32!.agentmesh.v1.DirectoryParameters\"\x90\x01\n\x13\x44irectoryParameters\x12\x13\n\x0breplication\x18\x01 \x01(\x05\x12\x35\n\x12reprovide_interval\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12-\n\nrecord_ttl\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\"\xfb\x01\n\x10\x44irectoryRequest\x12\x31\n\x07provide\x18\x01 \x01(\x0b\x32\x1e.agentmesh.v1.DirectoryProvideH\x00\x12>\n\x0e\x66ind_providers\x18\x02 \x01(\x0b\x32$.agentmesh.v1.DirectoryFindProvidersH\x00\x12\x34\n\tfind_peer\x18\x03 \x01(\x0b\x32\x1f.agentmesh.v1.DirectoryFindPeerH\x00\x12\x33\n\x08withdraw\x18\x04 \x01(\x0b\x32\x1f.agentmesh.v1.DirectoryWithdrawH\x00\x42\t\n\x07request\"Q\n\x10\x44irectoryProvide\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\r\n\x05\x61\x64\x64rs\x18\x02 \x03(\t\x12\x10\n\x08provider\x18\x03 \x01(\t\x12\x0f\n\x07service\x18\x04 \x01(\t\"2\n\x11\x44irectoryWithdraw\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\x10\n\x08provider\x18\x02 \x01(\t\"4\n\x16\x44irectoryFindProviders\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\r\n\x05limit\x18\x02 \x01(\r\"$\n\x11\x44irectoryFindPeer\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\"w\n\x11\x44irectoryResponse\x12+\n\tproviders\x18\x01 \x03(\x0b\x32\x18.agentmesh.v1.PeerRecord\x12&\n\x04peer\x18\x02 \x01(\x0b\x32\x18.agentmesh.v1.PeerRecord\x12\r\n\x05\x65rror\x18\x03 \x01(\t\",\n\nPeerRecord\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\r\n\x05\x61\x64\x64rs\x18\x02 \x03(\t\"\xc4\x01\n\nRouterInfo\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x34\n\x06labels\x18\x03 \x03(\x0b\x32$.agentmesh.v1.RouterInfo.LabelsEntry\x12\x13\n\x0b\x63onnections\x18\x04 \x01(\x05\x12\x18\n\x10\x63onnection_limit\x18\x05 \x01(\x05\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x83\x02\n\x12RouterLeaseRequest\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x0f\n\x07\x62iscuit\x18\x03 \x01(\x0c\x12\x17\n\x0f\x63onnected_peers\x18\x04 \x03(\t\x12\x10\n\x08\x64ht_size\x18\x05 \x01(\x05\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x12&\n\x03ttl\x18\x08 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x13\n\x0b\x63onnections\x18\t \x01(\x05\x12\x18\n\x10\x63onnection_limit\x18\n \x01(\x05\"f\n\x13RouterLeaseResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xbd\x01\n\nPolicyRole\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x17\n\x0f\x61llowed_targets\x18\x02 \x03(\t\x12\x18\n\x10\x61llowed_services\x18\x03 \x03(\t\x12\x16\n\x0e\x63ustom_datalog\x18\x04 \x03(\t\x12\x16\n\x0e\x61llowed_labels\x18\x05 \x03(\t\x12%\n\x04http\x18\x06 \x03(\x0b\x32\x17.agentmesh.v1.HTTPGrant\x12\x17\n\x0f\x61llowed_publish\x18\x07 \x03(\t\"<\n\tHTTPGrant\x12\x0f\n\x07service\x18\x01 \x01(\t\x12\x0f\n\x07methods\x18\x02 \x03(\t\x12\r\n\x05paths\x18\x03 \x03(\t\"\xa1\x02\n\x11\x45gressDestination\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x12\n\ntarget_url\x18\x02 \x01(\t\x12\x12\n\ncredential\x18\x03 \x01(\t\x12\x11\n\tserved_by\x18\x04 \x03(\t\x12.\n\x06\x62roker\x18\x05 \x01(\x0b\x32\x1e.agentmesh.v1.CredentialBroker\x12,\n\ninspection\x18\x06 \x01(\x0b\x32\x18.agentmesh.v1.Inspection\x12&\n\x04mode\x18\x07 \x01(\x0e\x32\x18.agentmesh.v1.EgressMode\x12\r\n\x05ports\x18\x08 \x03(\r\x12\x15\n\rpreserve_host\x18\t \x01(\x08\x12\x17\n\x0f\x66orward_context\x18\n \x01(\x08\"9\n\nInspection\x12+\n\ninspectors\x18\x01 \x03(\x0b\x32\x17.agentmesh.v1.Inspector\"o\n\tInspector\x12/\n\x0bmodel_armor\x18\x01 \x01(\x0b\x32\x18.agentmesh.v1.ModelArmorH\x00\x12)\n\x08\x65xt_proc\x18\x02 \x01(\x0b\x32\x15.agentmesh.v1.ExtProcH\x00\x42\x06\n\x04kind\"\x91\x01\n\nModelArmor\x12\x10\n\x08template\x18\x01 \x01(\t\x12\x32\n\x08response\x18\x02 \x01(\x0e\x32 .agentmesh.v1.ResponseInspection\x12\x11\n\tfail_open\x18\x03 \x01(\x08\x12*\n\x07timeout\x18\x04 \x01(\x0b\x32\x19.google.protobuf.Duration\"\x88\x02\n\x07\x45xtProc\x12\x0e\n\x06target\x18\x01 \x01(\t\x12\n\n\x02\x63\x61\x18\x02 \x01(\t\x12\x1a\n\x12\x63lient_certificate\x18\x03 \x01(\t\x12<\n\x0fprocessing_mode\x18\x04 \x01(\x0b\x32#.agentmesh.v1.ExtProcProcessingMode\x12\x1b\n\x13\x61llow_mode_override\x18\x05 \x01(\x08\x12\x32\n\x0fmessage_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x1a\n\x12\x66\x61ilure_mode_allow\x18\x07 \x01(\x08\x12\x1a\n\x12max_buffered_bytes\x18\x08 \x01(\r\"\xff\x04\n\x15\x45xtProcProcessingMode\x12K\n\x13request_header_mode\x18\x01 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12L\n\x14response_header_mode\x18\x02 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12G\n\x11request_body_mode\x18\x03 \x01(\x0e\x32,.agentmesh.v1.ExtProcProcessingMode.BodyMode\x12H\n\x12response_body_mode\x18\x04 \x01(\x0e\x32,.agentmesh.v1.ExtProcProcessingMode.BodyMode\x12L\n\x14request_trailer_mode\x18\x05 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12M\n\x15response_trailer_mode\x18\x06 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\"9\n\nHeaderMode\x12\x17\n\x13HEADER_MODE_DEFAULT\x10\x00\x12\x08\n\x04SEND\x10\x01\x12\x08\n\x04SKIP\x10\x02\"`\n\x08\x42odyMode\x12\x08\n\x04NONE\x10\x00\x12\x0c\n\x08STREAMED\x10\x01\x12\x0c\n\x08\x42UFFERED\x10\x02\x12\x14\n\x10\x42UFFERED_PARTIAL\x10\x03\x12\x18\n\x14\x46ULL_DUPLEX_STREAMED\x10\x04\"\xe1\x01\n\x10\x43redentialBroker\x12\x17\n\rstatic_secret\x18\x01 \x01(\tH\x00\x12\x37\n\x0foidc_federation\x18\x02 \x01(\x0b\x32\x1c.agentmesh.v1.OIDCFederationH\x00\x12\x36\n\x0f\x61ws_assume_role\x18\x03 \x01(\x0b\x32\x1b.agentmesh.v1.AWSAssumeRoleH\x00\x12;\n\x11platform_identity\x18\x04 \x01(\x0b\x32\x1e.agentmesh.v1.PlatformIdentityH\x00\x42\x06\n\x04kind\"_\n\x0eOIDCFederation\x12\x16\n\x0etoken_endpoint\x18\x01 \x01(\t\x12\x10\n\x08\x61udience\x18\x02 \x01(\t\x12\x13\n\x0bimpersonate\x18\x03 \x01(\t\x12\x0e\n\x06scopes\x18\x04 \x03(\t\"9\n\rAWSAssumeRole\x12\x10\n\x08role_arn\x18\x01 \x01(\t\x12\x16\n\x0esession_policy\x18\x02 \x01(\t\"\"\n\x10PlatformIdentity\x12\x0e\n\x06scopes\x18\x01 \x03(\t\".\n\rPolicyBinding\x12\x0c\n\x04role\x18\x01 \x01(\t\x12\x0f\n\x07members\x18\x02 \x03(\t\"\x97\x01\n\x0cPolicyConfig\x12\'\n\x05roles\x18\x01 \x03(\x0b\x32\x18.agentmesh.v1.PolicyRole\x12-\n\x08\x62indings\x18\x02 \x03(\x0b\x32\x1b.agentmesh.v1.PolicyBinding\x12/\n\x06\x65gress\x18\x03 \x03(\x0b\x32\x1f.agentmesh.v1.EgressDestination\"\x18\n\x16PolicyConfigGetRequest\"0\n\x17PolicyConfigGetResponse\x12\x15\n\rdatalog_rules\x18\x01 \x03(\t\"<\n\x1aPolicyConfigUpdateResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\"\x1a\n\x18\x45gressAssignmentsRequest\"L\n\x19\x45gressAssignmentsResponse\x12/\n\x06\x65gress\x18\x01 \x03(\x0b\x32\x1f.agentmesh.v1.EgressDestination\"f\n\x0cKeysResponse\x12\x13\n\x0bpublic_keys\x18\x01 \x03(\x0c\x12-\n\tsign_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x12\n\nsignatures\x18\x03 \x03(\x0c\"k\n\x13TokenRefreshRequest\x12\x1b\n\x13\x63hallenge_signature\x18\x01 \x01(\x0c\x12\x19\n\x11\x63hallenge_unix_ms\x18\x02 \x01(\x03\x12\x0f\n\x07peer_id\x18\x03 \x01(\t\x12\x0b\n\x03jwt\x18\x04 \x01(\t\"u\n\x14TokenRefreshResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x15\n\rerror_message\x18\x03 \x01(\t\"@\n\x11NodeCatalogReport\x12+\n\x08services\x18\x01 \x03(\x0b\x32\x19.agentmesh.v1.ServiceInfo\"%\n\x12TokenRevokeRequest\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\"5\n\x13TokenRevokeResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\"\x96\x01\n\x1b\x42ootstrapTokenCreateRequest\x12\x0c\n\x04role\x18\x01 \x01(\t\x12\x10\n\x08owner_id\x18\x02 \x01(\t\x12\x11\n\tttl_hours\x18\x03 \x01(\x05\x12\x12\n\nmax_usages\x18\x04 \x01(\x05\x12\x13\n\x0b\x64\x65scription\x18\x05 \x01(\t\x12\x1b\n\x13\x61utonomous_recovery\x18\x06 \x01(\x08\"\x8a\x01\n\x1c\x42ootstrapTokenCreateResponse\x12\n\n\x02id\x18\x01 \x01(\t\x12\r\n\x05token\x18\x02 \x01(\t\x12\x0c\n\x04role\x18\x03 \x01(\t\x12\x10\n\x08owner_id\x18\x04 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xab\x02\n\x0e\x42ootstrapToken\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0c\n\x04role\x18\x02 \x01(\t\x12\x10\n\x08owner_id\x18\x03 \x01(\t\x12\x12\n\nmax_usages\x18\x04 \x01(\x05\x12\x14\n\x0cusages_count\x18\x05 \x01(\x05\x12\x13\n\x0b\x64\x65scription\x18\x06 \x01(\t\x12/\n\x0b\x63reate_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0brevoke_time\x18\t \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x1b\n\x13\x61utonomous_recovery\x18\n \x01(\x08\"J\n\x1a\x42ootstrapTokenListResponse\x12,\n\x06tokens\x18\x01 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\"\xd6\x02\n\x11\x45nrollmentRequest\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x10\n\x08token_id\x18\x03 \x01(\t\x12.\n\x06status\x18\x04 \x01(\x0e\x32\x1e.agentmesh.v1.EnrollmentStatus\x12;\n\x06labels\x18\x05 \x03(\x0b\x32+.agentmesh.v1.EnrollmentRequest.LabelsEntry\x12/\n\x0b\x63reate_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x30\n\x0cresolve_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x13\n\x0bresolved_by\x18\x08 \x01(\t\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"R\n\x1d\x45nrollmentRequestListResponse\x12\x31\n\x08requests\x18\x01 \x03(\x0b\x32\x1f.agentmesh.v1.EnrollmentRequest\"p\n\x04User\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0e\n\x06issuer\x18\x02 \x01(\t\x12\r\n\x05\x65mail\x18\x03 \x01(\t\x12\x0c\n\x04role\x18\x04 \x01(\t\x12/\n\x0b\x63reate_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xe3\x02\n\x0c\x45nrolledNode\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0c\n\x04role\x18\x02 \x01(\t\x12\x17\n\x0f\x65nrollment_type\x18\x03 \x01(\t\x12\x13\n\x0b\x63laims_json\x18\x04 \x01(\t\x12\x10\n\x08owner_id\x18\x05 \x01(\t\x12\x36\n\x06labels\x18\x06 \x03(\x0b\x32&.agentmesh.v1.EnrolledNode.LabelsEntry\x12/\n\x0b\x65nroll_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0e\n\x06\x62\x61nned\x18\t \x01(\x08\x12\x1b\n\x13\x61utonomous_recovery\x18\n \x01(\x08\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xc4\x01\n\x0bRouterLease\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x35\n\x11last_renewal_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x17\n\x0f\x63onnected_peers\x18\x05 \x03(\t\x12\x10\n\x08\x64ht_size\x18\x06 \x01(\x05\"l\n\x0cNodeServices\x12+\n\x08services\x18\x01 \x03(\x0b\x32\x19.agentmesh.v1.ServiceInfo\x12/\n\x0breport_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xdb\x03\n\x13\x41\x64minStatusResponse\x12!\n\x05users\x18\x01 \x03(\x0b\x32\x12.agentmesh.v1.User\x12\x31\n\x0e\x61\x63tive_routers\x18\x02 \x03(\x0b\x32\x19.agentmesh.v1.RouterLease\x12\x32\n\x0e\x65nrolled_nodes\x18\x03 \x03(\x0b\x32\x1a.agentmesh.v1.EnrolledNode\x12<\n\x13\x65nrollment_requests\x18\x04 \x03(\x0b\x32\x1f.agentmesh.v1.EnrollmentRequest\x12\x36\n\x10\x62ootstrap_tokens\x18\x05 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\x12*\n\x06policy\x18\x06 \x01(\x0b\x32\x1a.agentmesh.v1.PolicyConfig\x12H\n\x0cnode_catalog\x18\x07 \x03(\x0b\x32\x32.agentmesh.v1.AdminStatusResponse.NodeCatalogEntry\x1aN\n\x10NodeCatalogEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12)\n\x05value\x18\x02 \x01(\x0b\x32\x1a.agentmesh.v1.NodeServices:\x02\x38\x01\"\x81\x02\n\x12UserStatusResponse\x12 \n\x04user\x18\x01 \x01(\x0b\x32\x12.agentmesh.v1.User\x12\x32\n\x0e\x65nrolled_nodes\x18\x02 \x03(\x0b\x32\x1a.agentmesh.v1.EnrolledNode\x12\x36\n\x10\x62ootstrap_tokens\x18\x03 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\x12\x31\n\x0e\x61\x63tive_routers\x18\x04 \x03(\x0b\x32\x19.agentmesh.v1.RouterLease\x12*\n\x06policy\x18\x05 \x01(\x0b\x32\x1a.agentmesh.v1.PolicyConfig\"V\n\x10NodeListResponse\x12)\n\x05nodes\x18\x01 \x03(\x0b\x32\x1a.agentmesh.v1.EnrolledNode\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\"\xe4\x01\n\x18IdentityEvidenceResponse\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12\x37\n\x13\x62iscuit_expire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x19\n\x11\x63ontrol_plane_url\x18\x04 \x01(\t\x12\"\n\x1atrusted_control_plane_keys\x18\x05 \x03(\x0c\x12.\n\ncheck_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xc6\x02\n\x14PeerEvidenceResponse\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12\x15\n\rverifying_key\x18\x03 \x01(\x0c\x12\r\n\x05roles\x18\x04 \x03(\t\x12>\n\x06labels\x18\x05 \x03(\x0b\x32..agentmesh.v1.PeerEvidenceResponse.LabelsEntry\x12/\n\x0b\x65xpire_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x16\n\x0erevocation_ids\x18\x07 \x03(\t\x12.\n\ncheck_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x8c\x02\n\x10MemberCredential\x12\x19\n\x11\x63ontrol_plane_url\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x0ctrusted_keys\x18\x04 \x03(\x0b\x32\x1f.agentmesh.v1.TrustedSigningKey\x12\x19\n\x11issued_under_keys\x18\x05 \x03(\x0c\x12\x18\n\x10router_addresses\x18\x06 \x03(\t\x12/\n\x0coidc_session\x18\x07 \x01(\x0b\x32\x19.agentmesh.v1.OIDCSession\"Y\n\x11TrustedSigningKey\x12\x12\n\npublic_key\x18\x01 \x01(\x0c\x12\x30\n\x0creceive_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"Y\n\x0bOIDCSession\x12\x0e\n\x06issuer\x18\x01 \x01(\t\x12\x11\n\tclient_id\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x15\n\rrefresh_token\x18\x04 \x01(\t\"\x93\x01\n\x15TaskAuthorizationRule\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x14\n\x0c\x64isplay_name\x18\x02 \x01(\t\x12%\n\x05rules\x18\x03 \x03(\x0b\x32\x16.agentmesh.v1.TaskRule\x12/\n\x0b\x65xpire_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x84\x01\n\x08TaskRule\x12\x13\n\x0b\x64\x65scription\x18\x01 \x01(\t\x12\x18\n\x10\x61llowed_services\x18\x02 \x03(\t\x12.\n\toperation\x18\x03 \x01(\x0b\x32\x1b.agentmesh.v1.TaskOperation\x12\x19\n\x11\x61llowed_resources\x18\x04 \x03(\t\"s\n\rTaskOperation\x12\x15\n\rallowed_tools\x18\x01 \x03(\t\x12\x17\n\x0f\x61llowed_methods\x18\x02 \x03(\t\x12\x15\n\rallowed_paths\x18\x03 \x03(\t\x12\x1b\n\x13\x61llowed_permissions\x18\x04 \x03(\t\"\xab\x01\n\x14TokenExchangeRequest\x12\x15\n\rsubject_token\x18\x01 \x01(\t\x12\x36\n\ttask_rule\x18\x02 \x01(\x0b\x32#.agentmesh.v1.TaskAuthorizationRule\x12\x0c\n\x04seal\x18\x03 \x01(\x08\x12\x19\n\x11\x63hallenge_unix_ms\x18\x04 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x05 \x01(\x0c\"\x7f\n\x15TokenExchangeResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\r\n\x05roles\x18\x03 \x03(\t\x12\x0f\n\x07subject\x18\x04 \x01(\t\"\x81\x01\n\x0fSTSTokenRequest\x12\x0f\n\x07\x62iscuit\x18\x01 \x01(\x0c\x12\x13\n\x0b\x64\x65stination\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x19\n\x11\x63hallenge_unix_ms\x18\x04 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x05 \x01(\x0c\"\x83\x01\n\x10STSTokenResponse\x12\x0b\n\x03jwt\x18\x01 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0f\n\x07subject\x18\x03 \x01(\t\x12\r\n\x05roles\x18\x04 \x03(\t\x12\x11\n\ttask_name\x18\x05 \x01(\t\"F\n\x13RevocationsResponse\x12\x16\n\x0erevocation_ids\x18\x01 \x03(\t\x12\x17\n\x0f\x62\x61nned_peer_ids\x18\x02 \x03(\t*\x94\x01\n\x10\x45nrollmentStatus\x12!\n\x1d\x45NROLLMENT_STATUS_UNSPECIFIED\x10\x00\x12\x1d\n\x19\x45NROLLMENT_STATUS_PENDING\x10\x01\x12\x1e\n\x1a\x45NROLLMENT_STATUS_APPROVED\x10\x02\x12\x1e\n\x1a\x45NROLLMENT_STATUS_REJECTED\x10\x03*\x8c\x01\n\x0bServiceType\x12\x1c\n\x18SERVICE_TYPE_UNSPECIFIED\x10\x00\x12\x14\n\x10SERVICE_TYPE_MCP\x10\x01\x12\x1a\n\x16SERVICE_TYPE_INFERENCE\x10\x02\x12\x14\n\x10SERVICE_TYPE_A2A\x10\x03\x12\x17\n\x13SERVICE_TYPE_EGRESS\x10\x04*7\n\nEgressMode\x12\x14\n\x10\x45GRESS_MODE_HTTP\x10\x00\x12\x13\n\x0f\x45GRESS_MODE_TCP\x10\x01*\\\n\x12ResponseInspection\x12 \n\x1cRESPONSE_INSPECTION_BUFFERED\x10\x00\x12$\n RESPONSE_INSPECTION_REQUEST_ONLY\x10\x01\x42!Z\x1fgithub.com/google/agentmesh/apib\x06proto3')
 
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, globals())
 _builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'agentmesh_pb2', globals())
@@ -39,14 +39,14 @@
   _ADMINSTATUSRESPONSE_NODECATALOGENTRY._serialized_options = b'8\001'
   _PEEREVIDENCERESPONSE_LABELSENTRY._options = None
   _PEEREVIDENCERESPONSE_LABELSENTRY._serialized_options = b'8\001'
-  _ENROLLMENTSTATUS._serialized_start=11478
-  _ENROLLMENTSTATUS._serialized_end=11626
-  _SERVICETYPE._serialized_start=11629
-  _SERVICETYPE._serialized_end=11769
-  _EGRESSMODE._serialized_start=11771
-  _EGRESSMODE._serialized_end=11826
-  _RESPONSEINSPECTION._serialized_start=11828
-  _RESPONSEINSPECTION._serialized_end=11920
+  _ENROLLMENTSTATUS._serialized_start=11566
+  _ENROLLMENTSTATUS._serialized_end=11714
+  _SERVICETYPE._serialized_start=11717
+  _SERVICETYPE._serialized_end=11857
+  _EGRESSMODE._serialized_start=11859
+  _EGRESSMODE._serialized_end=11914
+  _RESPONSEINSPECTION._serialized_start=11916
+  _RESPONSEINSPECTION._serialized_end=12008
   _AUTHFRAME._serialized_start=98
   _AUTHFRAME._serialized_end=150
   _AUTHRESPONSE._serialized_start=152
@@ -191,32 +191,34 @@
   _ADMINSTATUSRESPONSE_NODECATALOGENTRY._serialized_end=9159
   _USERSTATUSRESPONSE._serialized_start=9162
   _USERSTATUSRESPONSE._serialized_end=9419
-  _IDENTITYEVIDENCERESPONSE._serialized_start=9422
-  _IDENTITYEVIDENCERESPONSE._serialized_end=9650
-  _PEEREVIDENCERESPONSE._serialized_start=9653
-  _PEEREVIDENCERESPONSE._serialized_end=9979
+  _NODELISTRESPONSE._serialized_start=9421
+  _NODELISTRESPONSE._serialized_end=9507
+  _IDENTITYEVIDENCERESPONSE._serialized_start=9510
+  _IDENTITYEVIDENCERESPONSE._serialized_end=9738
+  _PEEREVIDENCERESPONSE._serialized_start=9741
+  _PEEREVIDENCERESPONSE._serialized_end=10067
   _PEEREVIDENCERESPONSE_LABELSENTRY._serialized_start=825
   _PEEREVIDENCERESPONSE_LABELSENTRY._serialized_end=870
-  _MEMBERCREDENTIAL._serialized_start=9982
-  _MEMBERCREDENTIAL._serialized_end=10250
-  _TRUSTEDSIGNINGKEY._serialized_start=10252
-  _TRUSTEDSIGNINGKEY._serialized_end=10341
-  _OIDCSESSION._serialized_start=10343
-  _OIDCSESSION._serialized_end=10432
-  _TASKAUTHORIZATIONRULE._serialized_start=10435
-  _TASKAUTHORIZATIONRULE._serialized_end=10582
-  _TASKRULE._serialized_start=10585
-  _TASKRULE._serialized_end=10717
-  _TASKOPERATION._serialized_start=10719
-  _TASKOPERATION._serialized_end=10834
-  _TOKENEXCHANGEREQUEST._serialized_start=10837
-  _TOKENEXCHANGEREQUEST._serialized_end=11008
-  _TOKENEXCHANGERESPONSE._serialized_start=11010
-  _TOKENEXCHANGERESPONSE._serialized_end=11137
-  _STSTOKENREQUEST._serialized_start=11140
-  _STSTOKENREQUEST._serialized_end=11269
-  _STSTOKENRESPONSE._serialized_start=11272
-  _STSTOKENRESPONSE._serialized_end=11403
-  _REVOCATIONSRESPONSE._serialized_start=11405
-  _REVOCATIONSRESPONSE._serialized_end=11475
+  _MEMBERCREDENTIAL._serialized_start=10070
+  _MEMBERCREDENTIAL._serialized_end=10338
+  _TRUSTEDSIGNINGKEY._serialized_start=10340
+  _TRUSTEDSIGNINGKEY._serialized_end=10429
+  _OIDCSESSION._serialized_start=10431
+  _OIDCSESSION._serialized_end=10520
+  _TASKAUTHORIZATIONRULE._serialized_start=10523
+  _TASKAUTHORIZATIONRULE._serialized_end=10670
+  _TASKRULE._serialized_start=10673
+  _TASKRULE._serialized_end=10805
+  _TASKOPERATION._serialized_start=10807
+  _TASKOPERATION._serialized_end=10922
+  _TOKENEXCHANGEREQUEST._serialized_start=10925
+  _TOKENEXCHANGEREQUEST._serialized_end=11096
+  _TOKENEXCHANGERESPONSE._serialized_start=11098
+  _TOKENEXCHANGERESPONSE._serialized_end=11225
+  _STSTOKENREQUEST._serialized_start=11228
+  _STSTOKENREQUEST._serialized_end=11357
+  _STSTOKENRESPONSE._serialized_start=11360
+  _STSTOKENRESPONSE._serialized_end=11491
+  _REVOCATIONSRESPONSE._serialized_start=11493
+  _REVOCATIONSRESPONSE._serialized_end=11563
 # @@protoc_insertion_point(module_scope)
diff --git a/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.pyi b/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.pyi
index 8ddc53b0..f814b46b 100644
--- a/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.pyi
+++ b/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.pyi
@@ -588,6 +588,14 @@ class NodeCatalogReport(_message.Message):
     services: _containers.RepeatedCompositeFieldContainer[ServiceInfo]
     def __init__(self, services: _Optional[_Iterable[_Union[ServiceInfo, _Mapping]]] = ...) -> None: ...
 
+class NodeListResponse(_message.Message):
+    __slots__ = ["next_page_token", "nodes"]
+    NEXT_PAGE_TOKEN_FIELD_NUMBER: _ClassVar[int]
+    NODES_FIELD_NUMBER: _ClassVar[int]
+    next_page_token: str
+    nodes: _containers.RepeatedCompositeFieldContainer[EnrolledNode]
+    def __init__(self, nodes: _Optional[_Iterable[_Union[EnrolledNode, _Mapping]]] = ..., next_page_token: _Optional[str] = ...) -> None: ...
+
 class NodeServices(_message.Message):
     __slots__ = ["report_time", "services"]
     REPORT_TIME_FIELD_NUMBER: _ClassVar[int]
diff --git a/site/content/docs/reference/agentmesh-one.md b/site/content/docs/reference/agentmesh-one.md
index 0e3f572f..2755bb36 100644
--- a/site/content/docs/reference/agentmesh-one.md
+++ b/site/content/docs/reference/agentmesh-one.md
@@ -64,6 +64,7 @@ of zero leaves the default of that component unchanged.
 | `--control-plane-key-grace-period` | `--key-grace-period` |
 | `--control-plane-biscuit-ttl` | `--biscuit-ttl` |
 | `--control-plane-workload-session-ttl` | `--workload-session-ttl` |
+| `--control-plane-node-retention` | `--node-retention` |
 | `--control-plane-manual-enrollment` | The opposite of `--auto-approve-enrollment`: queue bootstrap enrollments for approval. |
 | `--router-control-plane-sync-interval` | `agentmesh-router --control-plane-sync-interval` |
 | `--router-low-watermark`, `--router-high-watermark` | `--low-watermark`, `--high-watermark` |
diff --git a/site/content/docs/reference/control-plane.md b/site/content/docs/reference/control-plane.md
index ffef9dd3..15f73a6c 100644
--- a/site/content/docs/reference/control-plane.md
+++ b/site/content/docs/reference/control-plane.md
@@ -39,7 +39,7 @@ agentmesh-control-plane admin unban --peer <id>     lift a ban
 | `--lease-duration` | `15m` | How long a router lease lasts without renewal. |
 | `--dht-replication` | `3` | How many routers each record a member announces is placed on: the router it announced to keeps it, and places a copy on this many routers closest to the key. A record on three routers survives two of them down at once; each replica more is a copy more of every record. Members are not concerned: they ask the routers they hold. Published on `/info`; every router of the mesh runs on it. |
 | `--dht-reprovide-interval` | `5m` | How often a member re-announces each service it publishes. A provider that stopped without unpublishing stays listed for three intervals, which is how long routers keep a record after its last announcement; the mesh pays its providers divided by the interval in announcements a minute. Published on `/info`. |
-| `--node-retention` | `720h` (30 days) | How long the record of an enrolled node is kept after its session expires. Banned nodes are kept forever. `0` keeps every record. |
+| `--node-retention` | `720h` (30 days) | How long the record of an enrolled node is kept after its session expires. Banned nodes are kept forever. Must be positive; records are never kept forever. |
 | `--mesh-reconnect-interval` | `30s` | How often the event publisher re-reads the router leases and dials any router it is not connected to. On each router it runs the mesh handshake with a credential it mints for its own peer under the signing key, with the role `mesh:role:control-plane`, so the router holds its connection as a member's. |
 | `--log-level` | `info` | `debug`, `info`, `warn`, `error`. |
 | `--log-format` | `text` | `text` or `json`. |
@@ -108,7 +108,7 @@ names; unknown fields are rejected.
 
 | Route | Purpose |
 |---|---|
-| `GET /admin/status` | `AdminStatusResponse`: everything the console shows: routers, nodes, enrollment requests, tokens, users, the policy and the node service catalog. |
+| `GET /admin/status` | `AdminStatusResponse`: everything the console shows: routers, nodes, enrollment requests, tokens, users, the policy and the node service catalog. Nodes whose session expired are left out; `GET /user/nodes?state=expired` lists them. |
 | `GET /admin/policy` | The mesh policy as `PolicyConfig`, the same document `POST /policies` takes. |
 | `POST /policies`, `PUT /policies` | Replace the mesh policy. The body is `PolicyConfig`, so a misspelt grant fails instead of being dropped. |
 | `GET /admin/bootstrap-tokens` | `BootstrapTokenListResponse`: every token, including revoked and expired ones. |
@@ -129,7 +129,8 @@ with `403`). The console uses these routes.
 
 | Route | Purpose |
 |---|---|
-| `GET /user/status` | `UserStatusResponse`: the caller, their enrolled nodes and tokens. For an administrator it also carries the routers and the policy. |
+| `GET /user/status` | `UserStatusResponse`: the caller, their enrolled nodes and tokens. For an administrator it also carries the routers and the policy. Nodes whose session expired are left out. |
+| `GET /user/nodes` | `NodeListResponse`: one page of enrolled nodes, most recent enrollment first. `state` (`admitted`, `expired` or `banned`, repeatable) and `role` narrow the list. An expired OIDC enrollment can renew in place, so the console pages `state=expired` to keep those nodes revocable. An administrator sees every owner's nodes and may pick one with `owner_id`; a user sees only their own. Query `page_size` (default 50, at most 200) and `page_token`, the `next_page_token` of the previous page. |
 | `POST /user/bootstrap-tokens` | Mint a token owned by the caller; body and response as on the admin route. `role` defaults to `mesh:role:node`. Banning the owner disables the tokens they minted. |
 | `POST /user/revoke` | Ban one of the caller's own nodes. |
 
diff --git a/tests/integration/node_lifecycle_test.go b/tests/integration/node_lifecycle_test.go
new file mode 100644
index 00000000..b7f9afd7
--- /dev/null
+++ b/tests/integration/node_lifecycle_test.go
@@ -0,0 +1,286 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package integration_test
+
+import (
+	"bytes"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/google/agentmesh/api"
+	"github.com/libp2p/go-libp2p/core/crypto"
+	"github.com/libp2p/go-libp2p/core/peer"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
+)
+
+// oidcMember is a member enrolled with an OIDC token, driven over the
+// control plane API alone: the test decides when it refreshes and with what.
+type oidcMember struct {
+	priv    crypto.PrivKey
+	peerID  peer.ID
+	sub     string
+	biscuit []byte
+}
+
+// enrollOIDCMember enrolls a fresh key at POST /register with a token for sub.
+func enrollOIDCMember(t *testing.T, cpPort int, mintToken func(map[string]interface{}) string, sub string) *oidcMember {
+	t.Helper()
+	priv, _, err := crypto.GenerateKeyPair(crypto.Ed25519, -1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pID, err := peer.IDFromPrivateKey(priv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	enrolled := registerOnControlPlane(t, cpPort, pID, priv, mintToken(map[string]interface{}{"sub": sub, "roles": []string{api.RoleNode}}))
+	return &oidcMember{priv: priv, peerID: pID, sub: sub, biscuit: enrolled.BiscuitToken}
+}
+
+// refresh is one POST /refresh with the member's current credential and,
+// when jwt is set, a fresh platform token that renews the session; on
+// success the member holds the new credential. It returns status and body.
+func (m *oidcMember) refresh(t *testing.T, cpURL, jwt string) (int, string) {
+	t.Helper()
+	ts := time.Now().UnixMilli()
+	sig, err := m.priv.Sign(api.RefreshChallenge(m.peerID.String(), ts))
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, err := proto.Marshal(&api.TokenRefreshRequest{ChallengeUnixMs: ts, ChallengeSignature: sig, Jwt: jwt})
+	if err != nil {
+		t.Fatal(err)
+	}
+	req, _ := http.NewRequest(http.MethodPost, cpURL+"/refresh", bytes.NewReader(body))
+	req.Header.Set("Authorization", "Bearer "+base64.StdEncoding.EncodeToString(m.biscuit))
+	req.Header.Set("Content-Type", "application/x-protobuf")
+	resp, err := (&http.Client{Timeout: 5 * time.Second}).Do(req)
+	if err != nil {
+		t.Fatalf("POST /refresh: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	data, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode == http.StatusOK {
+		var refreshed api.TokenRefreshResponse
+		if err := proto.Unmarshal(data, &refreshed); err != nil {
+			t.Fatal(err)
+		}
+		m.biscuit = refreshed.BiscuitToken
+	}
+	return resp.StatusCode, string(data)
+}
+
+// listNodes is GET /user/nodes as the administrator, one page.
+func listNodes(t *testing.T, cpURL, adminToken, query string) *api.NodeListResponse {
+	t.Helper()
+	req, _ := http.NewRequest(http.MethodGet, cpURL+"/user/nodes?"+query, nil)
+	req.Header.Set("Authorization", "Bearer "+adminToken)
+	resp, err := (&http.Client{Timeout: 5 * time.Second}).Do(req)
+	if err != nil {
+		t.Fatalf("GET /user/nodes?%s: %v", query, err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	data, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("GET /user/nodes?%s: %d %s", query, resp.StatusCode, data)
+	}
+	var page api.NodeListResponse
+	if err := protojson.Unmarshal(data, &page); err != nil {
+		t.Fatalf("GET /user/nodes?%s: %v", query, err)
+	}
+	return &page
+}
+
+// controlPlaneMetric reads one series from the control plane's /metrics.
+func controlPlaneMetric(t *testing.T, cpURL, series string) (float64, bool) {
+	t.Helper()
+	resp, err := http.Get(cpURL + "/metrics")
+	if err != nil {
+		t.Fatalf("GET /metrics: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	data, _ := io.ReadAll(resp.Body)
+	for _, line := range strings.Split(string(data), "\n") {
+		if strings.HasPrefix(line, series+" ") {
+			var v float64
+			if _, err := fmt.Sscanf(strings.TrimPrefix(line, series+" "), "%g", &v); err != nil {
+				t.Fatalf("parse %q: %v", line, err)
+			}
+			return v, true
+		}
+	}
+	return 0, false
+}
+
+// TestLapsedMembersAreCollected is the testnet's nodes table in seconds. A
+// probe CronJob enrolls a fresh identity every run and never comes back for
+// it; such rows stayed forever, the table grew without bound, the metrics
+// scrape read every row every 30 seconds and the control plane stalled on
+// it. One member keeps its session alive by refreshing with a fresh token;
+// sixteen enroll and leave.
+func TestLapsedMembersAreCollected(t *testing.T) {
+	tmpDir := t.TempDir()
+	oidcURL, mintToken := startCustomMockOIDC(t)
+	policyFile := filepath.Join(tmpDir, "policies.yaml")
+	policy := fmt.Sprintf("roles: []\nbindings:\n  - role: %s\n    members: [%q]\n", api.RoleNode, api.SystemAuthenticated)
+	if err := os.WriteFile(policyFile, []byte(policy), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	// Sessions of two seconds, kept for one more after they lapse; the GC
+	// sweeps at a tenth of the retention, no less often than every second.
+	cpPort, _ := startControlPlane(t, tmpDir, oidcURL, policyFile,
+		"--oidc-session-ttl", "2s",
+		"--node-retention", "1s",
+	)
+	cpURL := fmt.Sprintf("http://127.0.0.1:%d", cpPort)
+
+	// Under the enrollment limiter's burst (controlplane.EnrollBurst), which
+	// is a guard this test leaves in force.
+	const leaving = 16
+	stayer := enrollOIDCMember(t, cpPort, mintToken, "stayer")
+	leavers := make([]*oidcMember, leaving)
+	for i := range leavers {
+		leavers[i] = enrollOIDCMember(t, cpPort, mintToken, fmt.Sprintf("leaver-%02d", i))
+	}
+	enrolledAt := time.Now()
+
+	// The one that stays refreshes with a fresh token well within its
+	// session; each such refresh renews the session.
+	stop := make(chan struct{})
+	stopRefreshing := sync.OnceFunc(func() { close(stop) })
+	t.Cleanup(stopRefreshing)
+	refreshed := make(chan error, 1)
+	go func() {
+		defer close(refreshed)
+		ticker := time.NewTicker(500 * time.Millisecond)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-stop:
+				return
+			case <-ticker.C:
+				ts := time.Now().UnixMilli()
+				sig, err := stayer.priv.Sign(api.RefreshChallenge(stayer.peerID.String(), ts))
+				if err != nil {
+					refreshed <- err
+					return
+				}
+				jwt := mintToken(map[string]interface{}{"sub": stayer.sub, "roles": []string{api.RoleNode}})
+				body, _ := proto.Marshal(&api.TokenRefreshRequest{ChallengeUnixMs: ts, ChallengeSignature: sig, Jwt: jwt})
+				req, _ := http.NewRequest(http.MethodPost, cpURL+"/refresh", bytes.NewReader(body))
+				req.Header.Set("Authorization", "Bearer "+base64.StdEncoding.EncodeToString(stayer.biscuit))
+				req.Header.Set("Content-Type", "application/x-protobuf")
+				resp, err := (&http.Client{Timeout: 5 * time.Second}).Do(req)
+				if err != nil {
+					refreshed <- err
+					return
+				}
+				data, _ := io.ReadAll(resp.Body)
+				_ = resp.Body.Close()
+				if resp.StatusCode != http.StatusOK {
+					refreshed <- fmt.Errorf("refresh of the member that stays: %d %s", resp.StatusCode, data)
+					return
+				}
+				var out api.TokenRefreshResponse
+				if err := proto.Unmarshal(data, &out); err != nil {
+					refreshed <- err
+					return
+				}
+				stayer.biscuit = out.BiscuitToken
+			}
+		}
+	}()
+
+	// Every member is admitted; the status lists them all.
+	if got := len(fetchAdminStatus(t, cpPort, testAdminToken).GetEnrolledNodes()); got != leaving+1 {
+		t.Fatalf("admin status lists %d nodes right after enrollment, want %d", got, leaving+1)
+	}
+
+	// The leavers' sessions lapse. A lapsed member is refused at /refresh
+	// and told what to do; it is out of the status and in the expired list,
+	// which pages; and the metrics count it by state without listing it.
+	time.Sleep(time.Until(enrolledAt.Add(2500 * time.Millisecond)))
+	if status, body := leavers[0].refresh(t, cpURL, ""); status != http.StatusUnauthorized || !strings.Contains(body, "Session expired") {
+		t.Fatalf("refresh of a lapsed member: %d %s, want 401 naming the lapsed session", status, strings.TrimSpace(body))
+	}
+	if nodes := fetchAdminStatus(t, cpPort, testAdminToken).GetEnrolledNodes(); len(nodes) != 1 || nodes[0].GetPeerId() != stayer.peerID.String() {
+		t.Fatalf("admin status after the sessions lapsed lists %d nodes, want only the one that refreshes", len(nodes))
+	}
+	var expired []string
+	pageToken := ""
+	for pages := 0; ; pages++ {
+		page := listNodes(t, cpURL, testAdminToken, "state=expired&page_size=5&page_token="+pageToken)
+		for _, n := range page.GetNodes() {
+			expired = append(expired, n.GetPeerId())
+		}
+		if page.GetNextPageToken() == "" {
+			if pages != 3 {
+				t.Errorf("%d expired nodes came in %d pages of 5, want 4", len(expired), pages+1)
+			}
+			break
+		}
+		pageToken = page.GetNextPageToken()
+	}
+	if len(expired) != leaving {
+		t.Fatalf("expired list holds %d nodes, want the %d that left: %v", len(expired), leaving, expired)
+	}
+	for _, id := range expired {
+		if id == stayer.peerID.String() {
+			t.Fatalf("the member that refreshes is in the expired list")
+		}
+	}
+	if v, ok := controlPlaneMetric(t, cpURL, `agentmesh_control_plane_enrolled_nodes{role="mesh:role:node",state="expired"}`); !ok || v != leaving {
+		t.Errorf("enrolled_nodes{state=expired} = %v (present %v), want %d", v, ok, leaving)
+	}
+	if v, ok := controlPlaneMetric(t, cpURL, `agentmesh_control_plane_enrolled_nodes{role="mesh:role:node",state="admitted"}`); !ok || v != 1 {
+		t.Errorf("enrolled_nodes{state=admitted} = %v (present %v), want 1", v, ok)
+	}
+
+	// The retention passes and the GC deletes the lapsed rows; the member
+	// that refreshes is untouched.
+	deadline := time.Now().Add(6 * time.Second)
+	for {
+		left := listNodes(t, cpURL, testAdminToken, "state=expired&page_size=200").GetNodes()
+		if len(left) == 0 {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("%d lapsed rows still in the table %s after they lapsed; want them deleted after the retention", len(left), time.Since(enrolledAt))
+		}
+		time.Sleep(200 * time.Millisecond)
+	}
+	if v, ok := controlPlaneMetric(t, cpURL, "agentmesh_control_plane_nodes_deleted_total"); !ok || v != leaving {
+		t.Errorf("nodes_deleted_total = %v (present %v), want %d", v, ok, leaving)
+	}
+	stopRefreshing()
+	if err := <-refreshed; err != nil {
+		t.Fatalf("the member that kept refreshing was refused: %v", err)
+	}
+	if status, body := stayer.refresh(t, cpURL, ""); status != http.StatusOK {
+		t.Fatalf("the member that kept refreshing is refused after the sweep: %d %s", status, body)
+	}
+	if nodes := fetchAdminStatus(t, cpPort, testAdminToken).GetEnrolledNodes(); len(nodes) != 1 {
+		t.Fatalf("admin status after the sweep lists %d nodes, want 1", len(nodes))
+	}
+}
diff --git a/tests/ui/console.spec.js b/tests/ui/console.spec.js
index 7911d889..a4db74a1 100644
--- a/tests/ui/console.spec.js
+++ b/tests/ui/console.spec.js
@@ -443,3 +443,70 @@ test('an admin restores a revoked node from the Nodes view', async ({ page }) =>
   await page.locator('#table-revoked-nodes tr', { hasText: REVOKED }).locator('button:has-text("Restore")').click();
   await expect.poll(() => unban).toBe(`POST /api/admin/nodes/${REVOKED}/unban`);
 });
+
+// Expired nodes are not in /admin/status: the section fetches them only when
+// opened, a page at a time, and a revoke there drops the row in place.
+test('expired nodes load on open, page on demand and revoke in place', async ({ page }) => {
+  const FIRST = '12D3KooWExpiredFirstFixturePeer';
+  const SECOND = '12D3KooWExpiredSecondFixturePeer';
+  const requested = [];
+  await page.route((url) => url.pathname.endsWith('/api/user/nodes'), async (route) => {
+    const params = new URL(route.request().url()).searchParams;
+    requested.push(`${params.getAll('state')}:${params.get('page_token') || ''}`);
+    const expired = { role: 'mesh:role:node', expire_time: '2026-09-15T08:00:00Z' };
+    const json = params.get('page_token') === 'next'
+      // The owner is server data on an admin page; markup in it must render inert.
+      ? { nodes: [{ ...expired, peer_id: SECOND, owner_id: '<img src=x onerror="window.expiredXSS=1">' }] }
+      : { nodes: [{ ...expired, peer_id: FIRST, owner_id: 'alice' }], next_page_token: 'next' };
+    await route.fulfill({ json });
+  });
+  let revoked = '';
+  await page.route((url) => url.pathname.endsWith('/api/user/revoke'), async (route) => {
+    revoked = `${route.request().method()} ${new URL(route.request().url()).searchParams.get('id')}`;
+    await route.fulfill({ status: 200, contentType: 'text/plain', body: 'Node revoked successfully' });
+  });
+
+  await login(page);
+  await page.click('.nav-item[data-target="nodes"]');
+  expect(requested, 'the list is fetched only when opened').toEqual([]);
+
+  await page.click('#expired-nodes summary');
+  const rows = page.locator('#table-expired-nodes tr');
+  await expect(rows).toHaveCount(1);
+  await expect(rows.nth(0)).toContainText(FIRST);
+  await expect(rows.nth(0).locator('td').nth(3)).not.toHaveText(/2026-09-15T08:00:00Z|-/);
+
+  await page.click('#expired-nodes-more');
+  await expect(rows).toHaveCount(2);
+  await expect(rows.nth(1)).toContainText(SECOND);
+  await expect(page.locator('#expired-nodes-more')).toBeHidden();
+  expect(await page.locator('#table-expired-nodes img').count()).toBe(0);
+  expect(await page.evaluate(() => window.expiredXSS)).toBeUndefined();
+  expect(requested).toEqual(['expired:', 'expired:next']);
+
+  page.once('dialog', (d) => d.accept());
+  await rows.filter({ hasText: FIRST }).locator('button:has-text("Revoke")').click();
+  await expect.poll(() => revoked).toBe(`POST ${FIRST}`);
+  await expect(rows).toHaveCount(1);
+  await expect(page.locator('#table-expired-nodes')).not.toContainText(FIRST);
+});
+
+// The landing page hides the app without a reload, so the next identity to log
+// in must not see the expired rows fetched for the previous one.
+test('returning to the landing page clears the expired nodes list', async ({ page }) => {
+  await page.route((url) => url.pathname.endsWith('/api/user/nodes'), async (route) => {
+    await route.fulfill({ json: { nodes: [{
+      peer_id: '12D3KooWExpiredResetFixturePeer', role: 'mesh:role:node', owner_id: 'bob', expire_time: '2026-09-15T08:00:00Z',
+    }] } });
+  });
+
+  await login(page);
+  await page.click('.nav-item[data-target="nodes"]');
+  await page.click('#expired-nodes summary');
+  const rows = page.locator('#table-expired-nodes tr');
+  await expect(rows).toHaveCount(1);
+
+  await page.evaluate(() => showLandingPage());
+  await expect(page.locator('#expired-nodes')).toHaveJSProperty('open', false);
+  await expect(rows).toHaveCount(0);
+});