From 8a3846672ec8f923395b57afcfa708956af35f7a Mon Sep 17 00:00:00 2001
From: Tomas Tormo <tomas.tormo@gmail.com>
Date: Tue, 13 Oct 2026 22:02:43 +0000
Subject: [PATCH 1/7] controlplane, console: stop listing expired nodes on
 every refresh

GET /admin/status and GET /user/status returned every node row kept for
the retention period, so each console refresh grew with history. At 25k
rows, mostly expired probe identities, one refresh moved 54.6 MB and took
about 650 ms of control-plane time. Both lists now hold admitted and
banned nodes only: 94 KB in 33 ms. A user's list is filtered by owner in
SQL instead of in Go after loading the whole mesh.

storage.Store lists nodes through one ListNodes(ctx, NodeFilter), which
selects by state (admitted, expired, banned), owner and role, with keyset
paging. GET /user/nodes pages NodeListResponse, newest enrollment first,
narrowed by state, role and, for an administrator, owner_id. An expired
OIDC enrollment can renew in place, so the console pages state=expired
in its Expired Nodes section, only when the section is opened.

/metrics counts nodes with one GROUP BY instead of loading every row.
Migration 19 indexes owner_id and (enrolled_at, peer_id).
controlplane.Options.Default() sets NodeRetention to 30 days, so
agentmesh-one deletes lapsed rows too. A negative retention keeps them,
and --node-retention 0 still means keep forever.
---
 api/agentmesh.pb.go                           | 408 ++++++++++--------
 api/agentmesh.proto                           |  18 +-
 cmd/agentmesh-control-plane/main.go           |   6 +
 internal/console/public/app.js                |   1 +
 internal/console/public/expired-nodes.js      | 142 ++++++
 internal/console/public/index.html            |  23 +
 internal/console/public/style.css             |  18 +
 internal/console/server_test.go               |   7 +-
 internal/controlplane/catalog_test.go         |  20 +-
 internal/controlplane/config.go               |  10 +-
 internal/controlplane/metrics.go              |  29 +-
 internal/controlplane/node_gc.go              |   2 +-
 internal/controlplane/node_gc_test.go         |  46 +-
 internal/controlplane/server.go               |  23 +-
 internal/controlplane/sts_test.go             |   4 +-
 internal/controlplane/ui.go                   | 146 ++++++-
 internal/controlplane/ui_test.go              | 209 +++++++++
 internal/storage/migration_test.go            |   7 +-
 internal/storage/round_trip_test.go           | 131 +++++-
 internal/storage/sql_store.go                 | 121 +++++-
 internal/storage/storage.go                   |  46 +-
 sdk/js/src/gen/agentmesh_pb.ts                |  65 ++-
 .../src/agent_mesh/_proto/agentmesh_pb2.py    |  72 ++--
 .../src/agent_mesh/_proto/agentmesh_pb2.pyi   |   8 +
 site/content/docs/reference/control-plane.md  |   5 +-
 tests/ui/console.spec.js                      |  67 +++
 26 files changed, 1329 insertions(+), 305 deletions(-)
 create mode 100644 internal/console/public/expired-nodes.js
 create mode 100644 internal/controlplane/ui_test.go

diff --git a/api/agentmesh.pb.go b/api/agentmesh.pb.go
index f75184d7..d06b591a 100644
--- a/api/agentmesh.pb.go
+++ b/api/agentmesh.pb.go
@@ -4791,7 +4791,7 @@ func (x *NodeServices) GetReportTime() *timestamppb.Timestamp {
 }
 
 // AdminStatusResponse answers GET /admin/status: everything the console
-// shows an administrator.
+// shows an administrator, except expired nodes (see GET /user/nodes).
 type AdminStatusResponse struct {
 	state              protoimpl.MessageState `protogen:"open.v1"`
 	Users              []*User                `protobuf:"bytes,1,rep,name=users,proto3" json:"users,omitempty"`
@@ -4885,9 +4885,9 @@ func (x *AdminStatusResponse) GetNodeCatalog() map[string]*NodeServices {
 	return nil
 }
 
-// UserStatusResponse answers GET /user/status: the caller and what it owns.
-// The router fleet and the mesh policy describe the whole mesh and are set
-// for an administrator only.
+// UserStatusResponse answers GET /user/status: the caller and what it owns,
+// except expired nodes (see GET /user/nodes). The router fleet and the mesh
+// policy describe the whole mesh and are set for an administrator only.
 type UserStatusResponse struct {
 	state           protoimpl.MessageState `protogen:"open.v1"`
 	User            *User                  `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
@@ -4964,6 +4964,63 @@ func (x *UserStatusResponse) GetPolicy() *PolicyConfig {
 	return nil
 }
 
+// NodeListResponse answers GET /user/nodes: enrolled nodes, newest enrollment
+// first, page_size (default 50, at most 200) at a time. state (admitted,
+// expired or banned, repeatable) and role narrow the list. An administrator
+// sees every owner's nodes and may pick one with owner_id; a user sees its own.
+type NodeListResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	Nodes []*EnrolledNode        `protobuf:"bytes,1,rep,name=nodes,proto3" json:"nodes,omitempty"`
+	// Pass as page_token for the next page; empty on the last page.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *NodeListResponse) Reset() {
+	*x = NodeListResponse{}
+	mi := &file_api_agentmesh_proto_msgTypes[61]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *NodeListResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NodeListResponse) ProtoMessage() {}
+
+func (x *NodeListResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_agentmesh_proto_msgTypes[61]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NodeListResponse.ProtoReflect.Descriptor instead.
+func (*NodeListResponse) Descriptor() ([]byte, []int) {
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{61}
+}
+
+func (x *NodeListResponse) GetNodes() []*EnrolledNode {
+	if x != nil {
+		return x.Nodes
+	}
+	return nil
+}
+
+func (x *NodeListResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
 type IdentityEvidenceResponse struct {
 	state                   protoimpl.MessageState `protogen:"open.v1"`
 	PeerId                  string                 `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
@@ -4978,7 +5035,7 @@ type IdentityEvidenceResponse struct {
 
 func (x *IdentityEvidenceResponse) Reset() {
 	*x = IdentityEvidenceResponse{}
-	mi := &file_api_agentmesh_proto_msgTypes[61]
+	mi := &file_api_agentmesh_proto_msgTypes[62]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4990,7 +5047,7 @@ func (x *IdentityEvidenceResponse) String() string {
 func (*IdentityEvidenceResponse) ProtoMessage() {}
 
 func (x *IdentityEvidenceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[61]
+	mi := &file_api_agentmesh_proto_msgTypes[62]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5003,7 +5060,7 @@ func (x *IdentityEvidenceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IdentityEvidenceResponse.ProtoReflect.Descriptor instead.
 func (*IdentityEvidenceResponse) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{61}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{62}
 }
 
 func (x *IdentityEvidenceResponse) GetPeerId() string {
@@ -5064,7 +5121,7 @@ type PeerEvidenceResponse struct {
 
 func (x *PeerEvidenceResponse) Reset() {
 	*x = PeerEvidenceResponse{}
-	mi := &file_api_agentmesh_proto_msgTypes[62]
+	mi := &file_api_agentmesh_proto_msgTypes[63]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5076,7 +5133,7 @@ func (x *PeerEvidenceResponse) String() string {
 func (*PeerEvidenceResponse) ProtoMessage() {}
 
 func (x *PeerEvidenceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[62]
+	mi := &file_api_agentmesh_proto_msgTypes[63]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5089,7 +5146,7 @@ func (x *PeerEvidenceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PeerEvidenceResponse.ProtoReflect.Descriptor instead.
 func (*PeerEvidenceResponse) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{62}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{63}
 }
 
 func (x *PeerEvidenceResponse) GetPeerId() string {
@@ -5174,7 +5231,7 @@ type MemberCredential struct {
 
 func (x *MemberCredential) Reset() {
 	*x = MemberCredential{}
-	mi := &file_api_agentmesh_proto_msgTypes[63]
+	mi := &file_api_agentmesh_proto_msgTypes[64]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5186,7 +5243,7 @@ func (x *MemberCredential) String() string {
 func (*MemberCredential) ProtoMessage() {}
 
 func (x *MemberCredential) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[63]
+	mi := &file_api_agentmesh_proto_msgTypes[64]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5199,7 +5256,7 @@ func (x *MemberCredential) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MemberCredential.ProtoReflect.Descriptor instead.
 func (*MemberCredential) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{63}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{64}
 }
 
 func (x *MemberCredential) GetControlPlaneUrl() string {
@@ -5264,7 +5321,7 @@ type TrustedSigningKey struct {
 
 func (x *TrustedSigningKey) Reset() {
 	*x = TrustedSigningKey{}
-	mi := &file_api_agentmesh_proto_msgTypes[64]
+	mi := &file_api_agentmesh_proto_msgTypes[65]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5276,7 +5333,7 @@ func (x *TrustedSigningKey) String() string {
 func (*TrustedSigningKey) ProtoMessage() {}
 
 func (x *TrustedSigningKey) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[64]
+	mi := &file_api_agentmesh_proto_msgTypes[65]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5289,7 +5346,7 @@ func (x *TrustedSigningKey) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TrustedSigningKey.ProtoReflect.Descriptor instead.
 func (*TrustedSigningKey) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{64}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{65}
 }
 
 func (x *TrustedSigningKey) GetPublicKey() []byte {
@@ -5318,7 +5375,7 @@ type OIDCSession struct {
 
 func (x *OIDCSession) Reset() {
 	*x = OIDCSession{}
-	mi := &file_api_agentmesh_proto_msgTypes[65]
+	mi := &file_api_agentmesh_proto_msgTypes[66]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5330,7 +5387,7 @@ func (x *OIDCSession) String() string {
 func (*OIDCSession) ProtoMessage() {}
 
 func (x *OIDCSession) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[65]
+	mi := &file_api_agentmesh_proto_msgTypes[66]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5343,7 +5400,7 @@ func (x *OIDCSession) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OIDCSession.ProtoReflect.Descriptor instead.
 func (*OIDCSession) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{65}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{66}
 }
 
 func (x *OIDCSession) GetIssuer() string {
@@ -5395,7 +5452,7 @@ type TaskAuthorizationRule struct {
 
 func (x *TaskAuthorizationRule) Reset() {
 	*x = TaskAuthorizationRule{}
-	mi := &file_api_agentmesh_proto_msgTypes[66]
+	mi := &file_api_agentmesh_proto_msgTypes[67]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5407,7 +5464,7 @@ func (x *TaskAuthorizationRule) String() string {
 func (*TaskAuthorizationRule) ProtoMessage() {}
 
 func (x *TaskAuthorizationRule) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[66]
+	mi := &file_api_agentmesh_proto_msgTypes[67]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5420,7 +5477,7 @@ func (x *TaskAuthorizationRule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TaskAuthorizationRule.ProtoReflect.Descriptor instead.
 func (*TaskAuthorizationRule) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{66}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{67}
 }
 
 func (x *TaskAuthorizationRule) GetName() string {
@@ -5472,7 +5529,7 @@ type TaskRule struct {
 
 func (x *TaskRule) Reset() {
 	*x = TaskRule{}
-	mi := &file_api_agentmesh_proto_msgTypes[67]
+	mi := &file_api_agentmesh_proto_msgTypes[68]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5484,7 +5541,7 @@ func (x *TaskRule) String() string {
 func (*TaskRule) ProtoMessage() {}
 
 func (x *TaskRule) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[67]
+	mi := &file_api_agentmesh_proto_msgTypes[68]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5497,7 +5554,7 @@ func (x *TaskRule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TaskRule.ProtoReflect.Descriptor instead.
 func (*TaskRule) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{67}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{68}
 }
 
 func (x *TaskRule) GetDescription() string {
@@ -5546,7 +5603,7 @@ type TaskOperation struct {
 
 func (x *TaskOperation) Reset() {
 	*x = TaskOperation{}
-	mi := &file_api_agentmesh_proto_msgTypes[68]
+	mi := &file_api_agentmesh_proto_msgTypes[69]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5558,7 +5615,7 @@ func (x *TaskOperation) String() string {
 func (*TaskOperation) ProtoMessage() {}
 
 func (x *TaskOperation) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[68]
+	mi := &file_api_agentmesh_proto_msgTypes[69]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5571,7 +5628,7 @@ func (x *TaskOperation) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TaskOperation.ProtoReflect.Descriptor instead.
 func (*TaskOperation) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{68}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{69}
 }
 
 func (x *TaskOperation) GetAllowedTools() []string {
@@ -5631,7 +5688,7 @@ type TokenExchangeRequest struct {
 
 func (x *TokenExchangeRequest) Reset() {
 	*x = TokenExchangeRequest{}
-	mi := &file_api_agentmesh_proto_msgTypes[69]
+	mi := &file_api_agentmesh_proto_msgTypes[70]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5643,7 +5700,7 @@ func (x *TokenExchangeRequest) String() string {
 func (*TokenExchangeRequest) ProtoMessage() {}
 
 func (x *TokenExchangeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[69]
+	mi := &file_api_agentmesh_proto_msgTypes[70]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5656,7 +5713,7 @@ func (x *TokenExchangeRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenExchangeRequest.ProtoReflect.Descriptor instead.
 func (*TokenExchangeRequest) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{69}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{70}
 }
 
 func (x *TokenExchangeRequest) GetSubjectToken() string {
@@ -5706,7 +5763,7 @@ type TokenExchangeResponse struct {
 
 func (x *TokenExchangeResponse) Reset() {
 	*x = TokenExchangeResponse{}
-	mi := &file_api_agentmesh_proto_msgTypes[70]
+	mi := &file_api_agentmesh_proto_msgTypes[71]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5718,7 +5775,7 @@ func (x *TokenExchangeResponse) String() string {
 func (*TokenExchangeResponse) ProtoMessage() {}
 
 func (x *TokenExchangeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[70]
+	mi := &file_api_agentmesh_proto_msgTypes[71]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5731,7 +5788,7 @@ func (x *TokenExchangeResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenExchangeResponse.ProtoReflect.Descriptor instead.
 func (*TokenExchangeResponse) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{70}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{71}
 }
 
 func (x *TokenExchangeResponse) GetBiscuitToken() []byte {
@@ -5787,7 +5844,7 @@ type STSTokenRequest struct {
 
 func (x *STSTokenRequest) Reset() {
 	*x = STSTokenRequest{}
-	mi := &file_api_agentmesh_proto_msgTypes[71]
+	mi := &file_api_agentmesh_proto_msgTypes[72]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5799,7 +5856,7 @@ func (x *STSTokenRequest) String() string {
 func (*STSTokenRequest) ProtoMessage() {}
 
 func (x *STSTokenRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[71]
+	mi := &file_api_agentmesh_proto_msgTypes[72]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5812,7 +5869,7 @@ func (x *STSTokenRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use STSTokenRequest.ProtoReflect.Descriptor instead.
 func (*STSTokenRequest) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{71}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{72}
 }
 
 func (x *STSTokenRequest) GetBiscuit() []byte {
@@ -5863,7 +5920,7 @@ type STSTokenResponse struct {
 
 func (x *STSTokenResponse) Reset() {
 	*x = STSTokenResponse{}
-	mi := &file_api_agentmesh_proto_msgTypes[72]
+	mi := &file_api_agentmesh_proto_msgTypes[73]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5875,7 +5932,7 @@ func (x *STSTokenResponse) String() string {
 func (*STSTokenResponse) ProtoMessage() {}
 
 func (x *STSTokenResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[72]
+	mi := &file_api_agentmesh_proto_msgTypes[73]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5888,7 +5945,7 @@ func (x *STSTokenResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use STSTokenResponse.ProtoReflect.Descriptor instead.
 func (*STSTokenResponse) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{72}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{73}
 }
 
 func (x *STSTokenResponse) GetJwt() string {
@@ -5939,7 +5996,7 @@ type RevocationsResponse struct {
 
 func (x *RevocationsResponse) Reset() {
 	*x = RevocationsResponse{}
-	mi := &file_api_agentmesh_proto_msgTypes[73]
+	mi := &file_api_agentmesh_proto_msgTypes[74]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5951,7 +6008,7 @@ func (x *RevocationsResponse) String() string {
 func (*RevocationsResponse) ProtoMessage() {}
 
 func (x *RevocationsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_agentmesh_proto_msgTypes[73]
+	mi := &file_api_agentmesh_proto_msgTypes[74]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5964,7 +6021,7 @@ func (x *RevocationsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RevocationsResponse.ProtoReflect.Descriptor instead.
 func (*RevocationsResponse) Descriptor() ([]byte, []int) {
-	return file_api_agentmesh_proto_rawDescGZIP(), []int{73}
+	return file_api_agentmesh_proto_rawDescGZIP(), []int{74}
 }
 
 func (x *RevocationsResponse) GetRevocationIds() []string {
@@ -6374,7 +6431,10 @@ const file_api_agentmesh_proto_rawDesc = "" +
 	"\x0eenrolled_nodes\x18\x02 \x03(\v2\x1a.agentmesh.v1.EnrolledNodeR\renrolledNodes\x12G\n" +
 	"\x10bootstrap_tokens\x18\x03 \x03(\v2\x1c.agentmesh.v1.BootstrapTokenR\x0fbootstrapTokens\x12@\n" +
 	"\x0eactive_routers\x18\x04 \x03(\v2\x19.agentmesh.v1.RouterLeaseR\ractiveRouters\x122\n" +
-	"\x06policy\x18\x05 \x01(\v2\x1a.agentmesh.v1.PolicyConfigR\x06policy\"\xbd\x02\n" +
+	"\x06policy\x18\x05 \x01(\v2\x1a.agentmesh.v1.PolicyConfigR\x06policy\"l\n" +
+	"\x10NodeListResponse\x120\n" +
+	"\x05nodes\x18\x01 \x03(\v2\x1a.agentmesh.v1.EnrolledNodeR\x05nodes\x12&\n" +
+	"\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"\xbd\x02\n" +
 	"\x18IdentityEvidenceResponse\x12\x17\n" +
 	"\apeer_id\x18\x01 \x01(\tR\x06peerId\x12\x18\n" +
 	"\abiscuit\x18\x02 \x01(\fR\abiscuit\x12J\n" +
@@ -6491,7 +6551,7 @@ func file_api_agentmesh_proto_rawDescGZIP() []byte {
 }
 
 var file_api_agentmesh_proto_enumTypes = make([]protoimpl.EnumInfo, 8)
-var file_api_agentmesh_proto_msgTypes = make([]protoimpl.MessageInfo, 82)
+var file_api_agentmesh_proto_msgTypes = make([]protoimpl.MessageInfo, 83)
 var file_api_agentmesh_proto_goTypes = []any{
 	(EnrollmentStatus)(0),                 // 0: agentmesh.v1.EnrollmentStatus
 	(ServiceType)(0),                      // 1: agentmesh.v1.ServiceType
@@ -6562,135 +6622,137 @@ var file_api_agentmesh_proto_goTypes = []any{
 	(*NodeServices)(nil),                  // 66: agentmesh.v1.NodeServices
 	(*AdminStatusResponse)(nil),           // 67: agentmesh.v1.AdminStatusResponse
 	(*UserStatusResponse)(nil),            // 68: agentmesh.v1.UserStatusResponse
-	(*IdentityEvidenceResponse)(nil),      // 69: agentmesh.v1.IdentityEvidenceResponse
-	(*PeerEvidenceResponse)(nil),          // 70: agentmesh.v1.PeerEvidenceResponse
-	(*MemberCredential)(nil),              // 71: agentmesh.v1.MemberCredential
-	(*TrustedSigningKey)(nil),             // 72: agentmesh.v1.TrustedSigningKey
-	(*OIDCSession)(nil),                   // 73: agentmesh.v1.OIDCSession
-	(*TaskAuthorizationRule)(nil),         // 74: agentmesh.v1.TaskAuthorizationRule
-	(*TaskRule)(nil),                      // 75: agentmesh.v1.TaskRule
-	(*TaskOperation)(nil),                 // 76: agentmesh.v1.TaskOperation
-	(*TokenExchangeRequest)(nil),          // 77: agentmesh.v1.TokenExchangeRequest
-	(*TokenExchangeResponse)(nil),         // 78: agentmesh.v1.TokenExchangeResponse
-	(*STSTokenRequest)(nil),               // 79: agentmesh.v1.STSTokenRequest
-	(*STSTokenResponse)(nil),              // 80: agentmesh.v1.STSTokenResponse
-	(*RevocationsResponse)(nil),           // 81: agentmesh.v1.RevocationsResponse
-	nil,                                   // 82: agentmesh.v1.EnrollRequest.LabelsEntry
-	nil,                                   // 83: agentmesh.v1.BootstrapEnrollRequest.LabelsEntry
-	nil,                                   // 84: agentmesh.v1.CommandBackend.EnvEntry
-	nil,                                   // 85: agentmesh.v1.RouterInfo.LabelsEntry
-	nil,                                   // 86: agentmesh.v1.EnrollmentRequest.LabelsEntry
-	nil,                                   // 87: agentmesh.v1.EnrolledNode.LabelsEntry
-	nil,                                   // 88: agentmesh.v1.AdminStatusResponse.NodeCatalogEntry
-	nil,                                   // 89: agentmesh.v1.PeerEvidenceResponse.LabelsEntry
-	(*durationpb.Duration)(nil),           // 90: google.protobuf.Duration
-	(*timestamppb.Timestamp)(nil),         // 91: google.protobuf.Timestamp
+	(*NodeListResponse)(nil),              // 69: agentmesh.v1.NodeListResponse
+	(*IdentityEvidenceResponse)(nil),      // 70: agentmesh.v1.IdentityEvidenceResponse
+	(*PeerEvidenceResponse)(nil),          // 71: agentmesh.v1.PeerEvidenceResponse
+	(*MemberCredential)(nil),              // 72: agentmesh.v1.MemberCredential
+	(*TrustedSigningKey)(nil),             // 73: agentmesh.v1.TrustedSigningKey
+	(*OIDCSession)(nil),                   // 74: agentmesh.v1.OIDCSession
+	(*TaskAuthorizationRule)(nil),         // 75: agentmesh.v1.TaskAuthorizationRule
+	(*TaskRule)(nil),                      // 76: agentmesh.v1.TaskRule
+	(*TaskOperation)(nil),                 // 77: agentmesh.v1.TaskOperation
+	(*TokenExchangeRequest)(nil),          // 78: agentmesh.v1.TokenExchangeRequest
+	(*TokenExchangeResponse)(nil),         // 79: agentmesh.v1.TokenExchangeResponse
+	(*STSTokenRequest)(nil),               // 80: agentmesh.v1.STSTokenRequest
+	(*STSTokenResponse)(nil),              // 81: agentmesh.v1.STSTokenResponse
+	(*RevocationsResponse)(nil),           // 82: agentmesh.v1.RevocationsResponse
+	nil,                                   // 83: agentmesh.v1.EnrollRequest.LabelsEntry
+	nil,                                   // 84: agentmesh.v1.BootstrapEnrollRequest.LabelsEntry
+	nil,                                   // 85: agentmesh.v1.CommandBackend.EnvEntry
+	nil,                                   // 86: agentmesh.v1.RouterInfo.LabelsEntry
+	nil,                                   // 87: agentmesh.v1.EnrollmentRequest.LabelsEntry
+	nil,                                   // 88: agentmesh.v1.EnrolledNode.LabelsEntry
+	nil,                                   // 89: agentmesh.v1.AdminStatusResponse.NodeCatalogEntry
+	nil,                                   // 90: agentmesh.v1.PeerEvidenceResponse.LabelsEntry
+	(*durationpb.Duration)(nil),           // 91: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),         // 92: google.protobuf.Timestamp
 }
 var file_api_agentmesh_proto_depIdxs = []int32{
-	4,  // 0: agentmesh.v1.RouterGoAway.reason:type_name -> agentmesh.v1.RouterGoAway.Reason
-	90, // 1: agentmesh.v1.RouterGoAway.retry_after:type_name -> google.protobuf.Duration
-	5,  // 2: agentmesh.v1.MeshEvent.type:type_name -> agentmesh.v1.MeshEvent.Type
-	91, // 3: agentmesh.v1.MeshEvent.event_time:type_name -> google.protobuf.Timestamp
-	82, // 4: agentmesh.v1.EnrollRequest.labels:type_name -> agentmesh.v1.EnrollRequest.LabelsEntry
-	91, // 5: agentmesh.v1.EnrollResponse.expire_time:type_name -> google.protobuf.Timestamp
-	83, // 6: agentmesh.v1.BootstrapEnrollRequest.labels:type_name -> agentmesh.v1.BootstrapEnrollRequest.LabelsEntry
-	0,  // 7: agentmesh.v1.BootstrapEnrollResponse.status:type_name -> agentmesh.v1.EnrollmentStatus
-	91, // 8: agentmesh.v1.BootstrapEnrollResponse.expire_time:type_name -> google.protobuf.Timestamp
-	1,  // 9: agentmesh.v1.ServiceInfo.type:type_name -> agentmesh.v1.ServiceType
-	84, // 10: agentmesh.v1.CommandBackend.env:type_name -> agentmesh.v1.CommandBackend.EnvEntry
-	16, // 11: agentmesh.v1.RegisterServiceRequest.service:type_name -> agentmesh.v1.ServiceInfo
-	17, // 12: agentmesh.v1.RegisterServiceRequest.command:type_name -> agentmesh.v1.CommandBackend
-	29, // 13: agentmesh.v1.ControlPlaneInfoResponse.routers:type_name -> agentmesh.v1.RouterInfo
-	21, // 14: agentmesh.v1.ControlPlaneInfoResponse.directory:type_name -> agentmesh.v1.DirectoryParameters
-	90, // 15: agentmesh.v1.DirectoryParameters.reprovide_interval:type_name -> google.protobuf.Duration
-	90, // 16: agentmesh.v1.DirectoryParameters.record_ttl:type_name -> google.protobuf.Duration
-	23, // 17: agentmesh.v1.DirectoryRequest.provide:type_name -> agentmesh.v1.DirectoryProvide
-	25, // 18: agentmesh.v1.DirectoryRequest.find_providers:type_name -> agentmesh.v1.DirectoryFindProviders
-	26, // 19: agentmesh.v1.DirectoryRequest.find_peer:type_name -> agentmesh.v1.DirectoryFindPeer
-	24, // 20: agentmesh.v1.DirectoryRequest.withdraw:type_name -> agentmesh.v1.DirectoryWithdraw
-	28, // 21: agentmesh.v1.DirectoryResponse.providers:type_name -> agentmesh.v1.PeerRecord
-	28, // 22: agentmesh.v1.DirectoryResponse.peer:type_name -> agentmesh.v1.PeerRecord
-	85, // 23: agentmesh.v1.RouterInfo.labels:type_name -> agentmesh.v1.RouterInfo.LabelsEntry
-	90, // 24: agentmesh.v1.RouterLeaseRequest.ttl:type_name -> google.protobuf.Duration
-	91, // 25: agentmesh.v1.RouterLeaseResponse.expire_time:type_name -> google.protobuf.Timestamp
-	33, // 26: agentmesh.v1.PolicyRole.http:type_name -> agentmesh.v1.HTTPGrant
-	40, // 27: agentmesh.v1.EgressDestination.broker:type_name -> agentmesh.v1.CredentialBroker
-	35, // 28: agentmesh.v1.EgressDestination.inspection:type_name -> agentmesh.v1.Inspection
-	2,  // 29: agentmesh.v1.EgressDestination.mode:type_name -> agentmesh.v1.EgressMode
-	36, // 30: agentmesh.v1.Inspection.inspectors:type_name -> agentmesh.v1.Inspector
-	37, // 31: agentmesh.v1.Inspector.model_armor:type_name -> agentmesh.v1.ModelArmor
-	38, // 32: agentmesh.v1.Inspector.ext_proc:type_name -> agentmesh.v1.ExtProc
-	3,  // 33: agentmesh.v1.ModelArmor.response:type_name -> agentmesh.v1.ResponseInspection
-	90, // 34: agentmesh.v1.ModelArmor.timeout:type_name -> google.protobuf.Duration
-	39, // 35: agentmesh.v1.ExtProc.processing_mode:type_name -> agentmesh.v1.ExtProcProcessingMode
-	90, // 36: agentmesh.v1.ExtProc.message_timeout:type_name -> google.protobuf.Duration
-	6,  // 37: agentmesh.v1.ExtProcProcessingMode.request_header_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.HeaderMode
-	6,  // 38: agentmesh.v1.ExtProcProcessingMode.response_header_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.HeaderMode
-	7,  // 39: agentmesh.v1.ExtProcProcessingMode.request_body_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.BodyMode
-	7,  // 40: agentmesh.v1.ExtProcProcessingMode.response_body_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.BodyMode
-	6,  // 41: agentmesh.v1.ExtProcProcessingMode.request_trailer_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.HeaderMode
-	6,  // 42: agentmesh.v1.ExtProcProcessingMode.response_trailer_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.HeaderMode
-	41, // 43: agentmesh.v1.CredentialBroker.oidc_federation:type_name -> agentmesh.v1.OIDCFederation
-	42, // 44: agentmesh.v1.CredentialBroker.aws_assume_role:type_name -> agentmesh.v1.AWSAssumeRole
-	43, // 45: agentmesh.v1.CredentialBroker.platform_identity:type_name -> agentmesh.v1.PlatformIdentity
-	32, // 46: agentmesh.v1.PolicyConfig.roles:type_name -> agentmesh.v1.PolicyRole
-	44, // 47: agentmesh.v1.PolicyConfig.bindings:type_name -> agentmesh.v1.PolicyBinding
-	34, // 48: agentmesh.v1.PolicyConfig.egress:type_name -> agentmesh.v1.EgressDestination
-	34, // 49: agentmesh.v1.EgressAssignmentsResponse.egress:type_name -> agentmesh.v1.EgressDestination
-	91, // 50: agentmesh.v1.KeysResponse.sign_time:type_name -> google.protobuf.Timestamp
-	91, // 51: agentmesh.v1.TokenRefreshResponse.expire_time:type_name -> google.protobuf.Timestamp
-	16, // 52: agentmesh.v1.NodeCatalogReport.services:type_name -> agentmesh.v1.ServiceInfo
-	91, // 53: agentmesh.v1.BootstrapTokenCreateResponse.expire_time:type_name -> google.protobuf.Timestamp
-	91, // 54: agentmesh.v1.BootstrapToken.create_time:type_name -> google.protobuf.Timestamp
-	91, // 55: agentmesh.v1.BootstrapToken.expire_time:type_name -> google.protobuf.Timestamp
-	91, // 56: agentmesh.v1.BootstrapToken.revoke_time:type_name -> google.protobuf.Timestamp
-	59, // 57: agentmesh.v1.BootstrapTokenListResponse.tokens:type_name -> agentmesh.v1.BootstrapToken
-	0,  // 58: agentmesh.v1.EnrollmentRequest.status:type_name -> agentmesh.v1.EnrollmentStatus
-	86, // 59: agentmesh.v1.EnrollmentRequest.labels:type_name -> agentmesh.v1.EnrollmentRequest.LabelsEntry
-	91, // 60: agentmesh.v1.EnrollmentRequest.create_time:type_name -> google.protobuf.Timestamp
-	91, // 61: agentmesh.v1.EnrollmentRequest.resolve_time:type_name -> google.protobuf.Timestamp
-	61, // 62: agentmesh.v1.EnrollmentRequestListResponse.requests:type_name -> agentmesh.v1.EnrollmentRequest
-	91, // 63: agentmesh.v1.User.create_time:type_name -> google.protobuf.Timestamp
-	87, // 64: agentmesh.v1.EnrolledNode.labels:type_name -> agentmesh.v1.EnrolledNode.LabelsEntry
-	91, // 65: agentmesh.v1.EnrolledNode.enroll_time:type_name -> google.protobuf.Timestamp
-	91, // 66: agentmesh.v1.EnrolledNode.expire_time:type_name -> google.protobuf.Timestamp
-	91, // 67: agentmesh.v1.RouterLease.last_renewal_time:type_name -> google.protobuf.Timestamp
-	91, // 68: agentmesh.v1.RouterLease.expire_time:type_name -> google.protobuf.Timestamp
-	16, // 69: agentmesh.v1.NodeServices.services:type_name -> agentmesh.v1.ServiceInfo
-	91, // 70: agentmesh.v1.NodeServices.report_time:type_name -> google.protobuf.Timestamp
-	63, // 71: agentmesh.v1.AdminStatusResponse.users:type_name -> agentmesh.v1.User
-	65, // 72: agentmesh.v1.AdminStatusResponse.active_routers:type_name -> agentmesh.v1.RouterLease
-	64, // 73: agentmesh.v1.AdminStatusResponse.enrolled_nodes:type_name -> agentmesh.v1.EnrolledNode
-	61, // 74: agentmesh.v1.AdminStatusResponse.enrollment_requests:type_name -> agentmesh.v1.EnrollmentRequest
-	59, // 75: agentmesh.v1.AdminStatusResponse.bootstrap_tokens:type_name -> agentmesh.v1.BootstrapToken
-	45, // 76: agentmesh.v1.AdminStatusResponse.policy:type_name -> agentmesh.v1.PolicyConfig
-	88, // 77: agentmesh.v1.AdminStatusResponse.node_catalog:type_name -> agentmesh.v1.AdminStatusResponse.NodeCatalogEntry
-	63, // 78: agentmesh.v1.UserStatusResponse.user:type_name -> agentmesh.v1.User
-	64, // 79: agentmesh.v1.UserStatusResponse.enrolled_nodes:type_name -> agentmesh.v1.EnrolledNode
-	59, // 80: agentmesh.v1.UserStatusResponse.bootstrap_tokens:type_name -> agentmesh.v1.BootstrapToken
-	65, // 81: agentmesh.v1.UserStatusResponse.active_routers:type_name -> agentmesh.v1.RouterLease
-	45, // 82: agentmesh.v1.UserStatusResponse.policy:type_name -> agentmesh.v1.PolicyConfig
-	91, // 83: agentmesh.v1.IdentityEvidenceResponse.biscuit_expire_time:type_name -> google.protobuf.Timestamp
-	91, // 84: agentmesh.v1.IdentityEvidenceResponse.check_time:type_name -> google.protobuf.Timestamp
-	89, // 85: agentmesh.v1.PeerEvidenceResponse.labels:type_name -> agentmesh.v1.PeerEvidenceResponse.LabelsEntry
-	91, // 86: agentmesh.v1.PeerEvidenceResponse.expire_time:type_name -> google.protobuf.Timestamp
-	91, // 87: agentmesh.v1.PeerEvidenceResponse.check_time:type_name -> google.protobuf.Timestamp
-	91, // 88: agentmesh.v1.MemberCredential.expire_time:type_name -> google.protobuf.Timestamp
-	72, // 89: agentmesh.v1.MemberCredential.trusted_keys:type_name -> agentmesh.v1.TrustedSigningKey
-	73, // 90: agentmesh.v1.MemberCredential.oidc_session:type_name -> agentmesh.v1.OIDCSession
-	91, // 91: agentmesh.v1.TrustedSigningKey.receive_time:type_name -> google.protobuf.Timestamp
-	75, // 92: agentmesh.v1.TaskAuthorizationRule.rules:type_name -> agentmesh.v1.TaskRule
-	91, // 93: agentmesh.v1.TaskAuthorizationRule.expire_time:type_name -> google.protobuf.Timestamp
-	76, // 94: agentmesh.v1.TaskRule.operation:type_name -> agentmesh.v1.TaskOperation
-	74, // 95: agentmesh.v1.TokenExchangeRequest.task_rule:type_name -> agentmesh.v1.TaskAuthorizationRule
-	91, // 96: agentmesh.v1.TokenExchangeResponse.expire_time:type_name -> google.protobuf.Timestamp
-	91, // 97: agentmesh.v1.STSTokenResponse.expire_time:type_name -> google.protobuf.Timestamp
-	66, // 98: agentmesh.v1.AdminStatusResponse.NodeCatalogEntry.value:type_name -> agentmesh.v1.NodeServices
-	99, // [99:99] is the sub-list for method output_type
-	99, // [99:99] is the sub-list for method input_type
-	99, // [99:99] is the sub-list for extension type_name
-	99, // [99:99] is the sub-list for extension extendee
-	0,  // [0:99] is the sub-list for field type_name
+	4,   // 0: agentmesh.v1.RouterGoAway.reason:type_name -> agentmesh.v1.RouterGoAway.Reason
+	91,  // 1: agentmesh.v1.RouterGoAway.retry_after:type_name -> google.protobuf.Duration
+	5,   // 2: agentmesh.v1.MeshEvent.type:type_name -> agentmesh.v1.MeshEvent.Type
+	92,  // 3: agentmesh.v1.MeshEvent.event_time:type_name -> google.protobuf.Timestamp
+	83,  // 4: agentmesh.v1.EnrollRequest.labels:type_name -> agentmesh.v1.EnrollRequest.LabelsEntry
+	92,  // 5: agentmesh.v1.EnrollResponse.expire_time:type_name -> google.protobuf.Timestamp
+	84,  // 6: agentmesh.v1.BootstrapEnrollRequest.labels:type_name -> agentmesh.v1.BootstrapEnrollRequest.LabelsEntry
+	0,   // 7: agentmesh.v1.BootstrapEnrollResponse.status:type_name -> agentmesh.v1.EnrollmentStatus
+	92,  // 8: agentmesh.v1.BootstrapEnrollResponse.expire_time:type_name -> google.protobuf.Timestamp
+	1,   // 9: agentmesh.v1.ServiceInfo.type:type_name -> agentmesh.v1.ServiceType
+	85,  // 10: agentmesh.v1.CommandBackend.env:type_name -> agentmesh.v1.CommandBackend.EnvEntry
+	16,  // 11: agentmesh.v1.RegisterServiceRequest.service:type_name -> agentmesh.v1.ServiceInfo
+	17,  // 12: agentmesh.v1.RegisterServiceRequest.command:type_name -> agentmesh.v1.CommandBackend
+	29,  // 13: agentmesh.v1.ControlPlaneInfoResponse.routers:type_name -> agentmesh.v1.RouterInfo
+	21,  // 14: agentmesh.v1.ControlPlaneInfoResponse.directory:type_name -> agentmesh.v1.DirectoryParameters
+	91,  // 15: agentmesh.v1.DirectoryParameters.reprovide_interval:type_name -> google.protobuf.Duration
+	91,  // 16: agentmesh.v1.DirectoryParameters.record_ttl:type_name -> google.protobuf.Duration
+	23,  // 17: agentmesh.v1.DirectoryRequest.provide:type_name -> agentmesh.v1.DirectoryProvide
+	25,  // 18: agentmesh.v1.DirectoryRequest.find_providers:type_name -> agentmesh.v1.DirectoryFindProviders
+	26,  // 19: agentmesh.v1.DirectoryRequest.find_peer:type_name -> agentmesh.v1.DirectoryFindPeer
+	24,  // 20: agentmesh.v1.DirectoryRequest.withdraw:type_name -> agentmesh.v1.DirectoryWithdraw
+	28,  // 21: agentmesh.v1.DirectoryResponse.providers:type_name -> agentmesh.v1.PeerRecord
+	28,  // 22: agentmesh.v1.DirectoryResponse.peer:type_name -> agentmesh.v1.PeerRecord
+	86,  // 23: agentmesh.v1.RouterInfo.labels:type_name -> agentmesh.v1.RouterInfo.LabelsEntry
+	91,  // 24: agentmesh.v1.RouterLeaseRequest.ttl:type_name -> google.protobuf.Duration
+	92,  // 25: agentmesh.v1.RouterLeaseResponse.expire_time:type_name -> google.protobuf.Timestamp
+	33,  // 26: agentmesh.v1.PolicyRole.http:type_name -> agentmesh.v1.HTTPGrant
+	40,  // 27: agentmesh.v1.EgressDestination.broker:type_name -> agentmesh.v1.CredentialBroker
+	35,  // 28: agentmesh.v1.EgressDestination.inspection:type_name -> agentmesh.v1.Inspection
+	2,   // 29: agentmesh.v1.EgressDestination.mode:type_name -> agentmesh.v1.EgressMode
+	36,  // 30: agentmesh.v1.Inspection.inspectors:type_name -> agentmesh.v1.Inspector
+	37,  // 31: agentmesh.v1.Inspector.model_armor:type_name -> agentmesh.v1.ModelArmor
+	38,  // 32: agentmesh.v1.Inspector.ext_proc:type_name -> agentmesh.v1.ExtProc
+	3,   // 33: agentmesh.v1.ModelArmor.response:type_name -> agentmesh.v1.ResponseInspection
+	91,  // 34: agentmesh.v1.ModelArmor.timeout:type_name -> google.protobuf.Duration
+	39,  // 35: agentmesh.v1.ExtProc.processing_mode:type_name -> agentmesh.v1.ExtProcProcessingMode
+	91,  // 36: agentmesh.v1.ExtProc.message_timeout:type_name -> google.protobuf.Duration
+	6,   // 37: agentmesh.v1.ExtProcProcessingMode.request_header_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.HeaderMode
+	6,   // 38: agentmesh.v1.ExtProcProcessingMode.response_header_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.HeaderMode
+	7,   // 39: agentmesh.v1.ExtProcProcessingMode.request_body_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.BodyMode
+	7,   // 40: agentmesh.v1.ExtProcProcessingMode.response_body_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.BodyMode
+	6,   // 41: agentmesh.v1.ExtProcProcessingMode.request_trailer_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.HeaderMode
+	6,   // 42: agentmesh.v1.ExtProcProcessingMode.response_trailer_mode:type_name -> agentmesh.v1.ExtProcProcessingMode.HeaderMode
+	41,  // 43: agentmesh.v1.CredentialBroker.oidc_federation:type_name -> agentmesh.v1.OIDCFederation
+	42,  // 44: agentmesh.v1.CredentialBroker.aws_assume_role:type_name -> agentmesh.v1.AWSAssumeRole
+	43,  // 45: agentmesh.v1.CredentialBroker.platform_identity:type_name -> agentmesh.v1.PlatformIdentity
+	32,  // 46: agentmesh.v1.PolicyConfig.roles:type_name -> agentmesh.v1.PolicyRole
+	44,  // 47: agentmesh.v1.PolicyConfig.bindings:type_name -> agentmesh.v1.PolicyBinding
+	34,  // 48: agentmesh.v1.PolicyConfig.egress:type_name -> agentmesh.v1.EgressDestination
+	34,  // 49: agentmesh.v1.EgressAssignmentsResponse.egress:type_name -> agentmesh.v1.EgressDestination
+	92,  // 50: agentmesh.v1.KeysResponse.sign_time:type_name -> google.protobuf.Timestamp
+	92,  // 51: agentmesh.v1.TokenRefreshResponse.expire_time:type_name -> google.protobuf.Timestamp
+	16,  // 52: agentmesh.v1.NodeCatalogReport.services:type_name -> agentmesh.v1.ServiceInfo
+	92,  // 53: agentmesh.v1.BootstrapTokenCreateResponse.expire_time:type_name -> google.protobuf.Timestamp
+	92,  // 54: agentmesh.v1.BootstrapToken.create_time:type_name -> google.protobuf.Timestamp
+	92,  // 55: agentmesh.v1.BootstrapToken.expire_time:type_name -> google.protobuf.Timestamp
+	92,  // 56: agentmesh.v1.BootstrapToken.revoke_time:type_name -> google.protobuf.Timestamp
+	59,  // 57: agentmesh.v1.BootstrapTokenListResponse.tokens:type_name -> agentmesh.v1.BootstrapToken
+	0,   // 58: agentmesh.v1.EnrollmentRequest.status:type_name -> agentmesh.v1.EnrollmentStatus
+	87,  // 59: agentmesh.v1.EnrollmentRequest.labels:type_name -> agentmesh.v1.EnrollmentRequest.LabelsEntry
+	92,  // 60: agentmesh.v1.EnrollmentRequest.create_time:type_name -> google.protobuf.Timestamp
+	92,  // 61: agentmesh.v1.EnrollmentRequest.resolve_time:type_name -> google.protobuf.Timestamp
+	61,  // 62: agentmesh.v1.EnrollmentRequestListResponse.requests:type_name -> agentmesh.v1.EnrollmentRequest
+	92,  // 63: agentmesh.v1.User.create_time:type_name -> google.protobuf.Timestamp
+	88,  // 64: agentmesh.v1.EnrolledNode.labels:type_name -> agentmesh.v1.EnrolledNode.LabelsEntry
+	92,  // 65: agentmesh.v1.EnrolledNode.enroll_time:type_name -> google.protobuf.Timestamp
+	92,  // 66: agentmesh.v1.EnrolledNode.expire_time:type_name -> google.protobuf.Timestamp
+	92,  // 67: agentmesh.v1.RouterLease.last_renewal_time:type_name -> google.protobuf.Timestamp
+	92,  // 68: agentmesh.v1.RouterLease.expire_time:type_name -> google.protobuf.Timestamp
+	16,  // 69: agentmesh.v1.NodeServices.services:type_name -> agentmesh.v1.ServiceInfo
+	92,  // 70: agentmesh.v1.NodeServices.report_time:type_name -> google.protobuf.Timestamp
+	63,  // 71: agentmesh.v1.AdminStatusResponse.users:type_name -> agentmesh.v1.User
+	65,  // 72: agentmesh.v1.AdminStatusResponse.active_routers:type_name -> agentmesh.v1.RouterLease
+	64,  // 73: agentmesh.v1.AdminStatusResponse.enrolled_nodes:type_name -> agentmesh.v1.EnrolledNode
+	61,  // 74: agentmesh.v1.AdminStatusResponse.enrollment_requests:type_name -> agentmesh.v1.EnrollmentRequest
+	59,  // 75: agentmesh.v1.AdminStatusResponse.bootstrap_tokens:type_name -> agentmesh.v1.BootstrapToken
+	45,  // 76: agentmesh.v1.AdminStatusResponse.policy:type_name -> agentmesh.v1.PolicyConfig
+	89,  // 77: agentmesh.v1.AdminStatusResponse.node_catalog:type_name -> agentmesh.v1.AdminStatusResponse.NodeCatalogEntry
+	63,  // 78: agentmesh.v1.UserStatusResponse.user:type_name -> agentmesh.v1.User
+	64,  // 79: agentmesh.v1.UserStatusResponse.enrolled_nodes:type_name -> agentmesh.v1.EnrolledNode
+	59,  // 80: agentmesh.v1.UserStatusResponse.bootstrap_tokens:type_name -> agentmesh.v1.BootstrapToken
+	65,  // 81: agentmesh.v1.UserStatusResponse.active_routers:type_name -> agentmesh.v1.RouterLease
+	45,  // 82: agentmesh.v1.UserStatusResponse.policy:type_name -> agentmesh.v1.PolicyConfig
+	64,  // 83: agentmesh.v1.NodeListResponse.nodes:type_name -> agentmesh.v1.EnrolledNode
+	92,  // 84: agentmesh.v1.IdentityEvidenceResponse.biscuit_expire_time:type_name -> google.protobuf.Timestamp
+	92,  // 85: agentmesh.v1.IdentityEvidenceResponse.check_time:type_name -> google.protobuf.Timestamp
+	90,  // 86: agentmesh.v1.PeerEvidenceResponse.labels:type_name -> agentmesh.v1.PeerEvidenceResponse.LabelsEntry
+	92,  // 87: agentmesh.v1.PeerEvidenceResponse.expire_time:type_name -> google.protobuf.Timestamp
+	92,  // 88: agentmesh.v1.PeerEvidenceResponse.check_time:type_name -> google.protobuf.Timestamp
+	92,  // 89: agentmesh.v1.MemberCredential.expire_time:type_name -> google.protobuf.Timestamp
+	73,  // 90: agentmesh.v1.MemberCredential.trusted_keys:type_name -> agentmesh.v1.TrustedSigningKey
+	74,  // 91: agentmesh.v1.MemberCredential.oidc_session:type_name -> agentmesh.v1.OIDCSession
+	92,  // 92: agentmesh.v1.TrustedSigningKey.receive_time:type_name -> google.protobuf.Timestamp
+	76,  // 93: agentmesh.v1.TaskAuthorizationRule.rules:type_name -> agentmesh.v1.TaskRule
+	92,  // 94: agentmesh.v1.TaskAuthorizationRule.expire_time:type_name -> google.protobuf.Timestamp
+	77,  // 95: agentmesh.v1.TaskRule.operation:type_name -> agentmesh.v1.TaskOperation
+	75,  // 96: agentmesh.v1.TokenExchangeRequest.task_rule:type_name -> agentmesh.v1.TaskAuthorizationRule
+	92,  // 97: agentmesh.v1.TokenExchangeResponse.expire_time:type_name -> google.protobuf.Timestamp
+	92,  // 98: agentmesh.v1.STSTokenResponse.expire_time:type_name -> google.protobuf.Timestamp
+	66,  // 99: agentmesh.v1.AdminStatusResponse.NodeCatalogEntry.value:type_name -> agentmesh.v1.NodeServices
+	100, // [100:100] is the sub-list for method output_type
+	100, // [100:100] is the sub-list for method input_type
+	100, // [100:100] is the sub-list for extension type_name
+	100, // [100:100] is the sub-list for extension extendee
+	0,   // [0:100] is the sub-list for field type_name
 }
 
 func init() { file_api_agentmesh_proto_init() }
@@ -6724,7 +6786,7 @@ func file_api_agentmesh_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_api_agentmesh_proto_rawDesc), len(file_api_agentmesh_proto_rawDesc)),
 			NumEnums:      8,
-			NumMessages:   82,
+			NumMessages:   83,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/api/agentmesh.proto b/api/agentmesh.proto
index 7396648f..0d76de6a 100644
--- a/api/agentmesh.proto
+++ b/api/agentmesh.proto
@@ -767,7 +767,7 @@ message NodeServices {
 }
 
 // AdminStatusResponse answers GET /admin/status: everything the console
-// shows an administrator.
+// shows an administrator, except expired nodes (see GET /user/nodes).
 message AdminStatusResponse {
   repeated User users = 1;
   repeated RouterLease active_routers = 2;
@@ -779,9 +779,9 @@ message AdminStatusResponse {
   map<string, NodeServices> node_catalog = 7;
 }
 
-// UserStatusResponse answers GET /user/status: the caller and what it owns.
-// The router fleet and the mesh policy describe the whole mesh and are set
-// for an administrator only.
+// UserStatusResponse answers GET /user/status: the caller and what it owns,
+// except expired nodes (see GET /user/nodes). The router fleet and the mesh
+// policy describe the whole mesh and are set for an administrator only.
 message UserStatusResponse {
   User user = 1;
   repeated EnrolledNode enrolled_nodes = 2;
@@ -790,6 +790,16 @@ message UserStatusResponse {
   PolicyConfig policy = 5;
 }
 
+// NodeListResponse answers GET /user/nodes: enrolled nodes, newest enrollment
+// first, page_size (default 50, at most 200) at a time. state (admitted,
+// expired or banned, repeatable) and role narrow the list. An administrator
+// sees every owner's nodes and may pick one with owner_id; a user sees its own.
+message NodeListResponse {
+  repeated EnrolledNode nodes = 1;
+  // Pass as page_token for the next page; empty on the last page.
+  string next_page_token = 2;
+}
+
 // ============================================================================
 // Identity Evidence API
 // ============================================================================
diff --git a/cmd/agentmesh-control-plane/main.go b/cmd/agentmesh-control-plane/main.go
index a529f420..405cd496 100644
--- a/cmd/agentmesh-control-plane/main.go
+++ b/cmd/agentmesh-control-plane/main.go
@@ -121,6 +121,12 @@ func main() {
 				}
 			}()
 
+			// Options reads 0 as the default, so the flag's 0 (keep forever)
+			// travels as a negative retention.
+			if nodeRetention == 0 {
+				nodeRetention = -1
+			}
+
 			opts := controlplane.Options{
 				ListenAddr:            bindAddress,
 				DriverName:            dbDriver,
diff --git a/internal/console/public/app.js b/internal/console/public/app.js
index 05cbea51..a2b47257 100644
--- a/internal/console/public/app.js
+++ b/internal/console/public/app.js
@@ -146,6 +146,7 @@ function showApp() {
 
 function showLandingPage() {
     stopAutoRefresh();
+    resetExpiredNodes();
     document.getElementById('landing-page').classList.add('active');
     document.getElementById('app-container').style.display = 'none';
 }
diff --git a/internal/console/public/expired-nodes.js b/internal/console/public/expired-nodes.js
new file mode 100644
index 00000000..2cfce488
--- /dev/null
+++ b/internal/console/public/expired-nodes.js
@@ -0,0 +1,142 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+const EXPIRED_NODES_PAGE_SIZE = 50;
+
+// Where the expired-nodes list resumes, and which opening of the section a
+// fetch belongs to, so a slow page never lands in a list reset since.
+let expiredNodesPageToken = '';
+let expiredNodesGeneration = 0;
+
+document.addEventListener('DOMContentLoaded', () => {
+    const expiredNodes = document.getElementById('expired-nodes');
+    expiredNodes.addEventListener('toggle', () => {
+        if (expiredNodes.open) {
+            loadExpiredNodes(true);
+        }
+    });
+    document.getElementById('expired-nodes-more').addEventListener('click', () => loadExpiredNodes(false));
+    document.getElementById('table-expired-nodes').addEventListener('click', (e) => {
+        const button = e.target.closest('button[data-peer-id]');
+        if (button) {
+            revokeExpiredNode(button);
+        }
+    });
+});
+
+// Fetched on demand, never by the background refresh: expired rows stay for
+// the retention period, and listing them all would slow every refresh.
+async function loadExpiredNodes(reset) {
+    const more = document.getElementById('expired-nodes-more');
+    if (reset) {
+        expiredNodesGeneration++;
+        expiredNodesPageToken = '';
+        more.hidden = true;
+        setTableMessage('table-expired-nodes', 5, 'Loading...');
+    }
+    const generation = expiredNodesGeneration;
+    let url = `api/user/nodes?state=expired&page_size=${EXPIRED_NODES_PAGE_SIZE}`;
+    if (expiredNodesPageToken) {
+        url += `&page_token=${encodeURIComponent(expiredNodesPageToken)}`;
+    }
+
+    more.disabled = true;
+    try {
+        const response = await fetch(url);
+        if (response.status === 401 || response.status === 403) {
+            showLandingPage();
+            throw new Error('Unauthorized. Please login again.');
+        }
+        if (!response.ok) {
+            throw new Error(`HTTP error! status: ${response.status}`);
+        }
+        const data = await response.json();
+        if (generation !== expiredNodesGeneration) {
+            return;
+        }
+
+        const tbody = document.getElementById('table-expired-nodes');
+        const rows = (data.nodes || []).map(expiredNodeRow).join('');
+        if (reset) {
+            tbody.innerHTML = rows;
+        } else {
+            tbody.insertAdjacentHTML('beforeend', rows);
+        }
+        if (!tbody.querySelector('tr')) {
+            setTableMessage('table-expired-nodes', 5, 'No expired nodes');
+        }
+        expiredNodesPageToken = data.next_page_token || '';
+        more.hidden = !expiredNodesPageToken;
+        applySearchFilter();
+    } catch (error) {
+        if (generation !== expiredNodesGeneration) {
+            return;
+        }
+        console.error('Failed to load expired nodes:', error);
+        // A failed "Load more" keeps the rows already shown and the button to retry.
+        if (reset) {
+            setTableMessage('table-expired-nodes', 5, `Error loading expired nodes: ${error.message}`, true);
+        } else {
+            showToast(`Failed to load more expired nodes: ${error.message}`, 'error');
+        }
+    } finally {
+        more.disabled = false;
+    }
+}
+
+// The Revoke button carries the peer ID as data, not inside an inline handler,
+// where an HTML-escaped quote would be decoded back into the script.
+function expiredNodeRow(node) {
+    const expired = node.expire_time ? new Date(node.expire_time).toLocaleString() : '';
+    return `
+        <tr>
+            <td>${peerCell(node.peer_id, node.labels)}</td>
+            <td>${escapeHTML(node.role)}</td>
+            <td>${escapeHTML(node.owner_id || '')}</td>
+            <td>${escapeHTML(expired)}</td>
+            <td><button class="btn btn-sm btn-danger" type="button" data-peer-id="${escapeHTML(node.peer_id)}">Revoke</button></td>
+        </tr>
+    `;
+}
+
+// Paging resumes after the last row served, so dropping a revoked row never
+// shifts the next page.
+async function revokeExpiredNode(button) {
+    if (!confirm('Revoke this node? It can no longer renew its expired session or rejoin the mesh.')) {
+        return;
+    }
+    button.disabled = true;
+    try {
+        await actionRequest(`api/user/revoke?id=${encodeURIComponent(button.dataset.peerId)}`);
+    } catch (error) {
+        // actionRequest already reported the failure.
+        button.disabled = false;
+        return;
+    }
+    const tbody = document.getElementById('table-expired-nodes');
+    button.closest('tr').remove();
+    if (!tbody.querySelector('tr:not([data-filter-empty])')) {
+        loadExpiredNodes(true);
+    }
+}
+
+// The landing page hides the app without a reload, so the next identity to log
+// in must not inherit rows, or an in-flight page, fetched for this one.
+function resetExpiredNodes() {
+    expiredNodesGeneration++;
+    expiredNodesPageToken = '';
+    document.getElementById('expired-nodes').open = false;
+    document.getElementById('table-expired-nodes').innerHTML = '';
+    document.getElementById('expired-nodes-more').hidden = true;
+}
diff --git a/internal/console/public/index.html b/internal/console/public/index.html
index 0853e629..90683cee 100644
--- a/internal/console/public/index.html
+++ b/internal/console/public/index.html
@@ -226,6 +226,28 @@ <h2>Revoked Nodes</h2>
                             </div>
                         </div>
                     </div>
+                    <!-- Loaded on open, never by the refresh: expired rows pile up for the
+                         retention period, yet an expired OIDC node can renew until revoked. -->
+                    <details id="expired-nodes" class="section-header-spaced">
+                        <summary class="section-header"><h2>Expired Nodes</h2></summary>
+                        <div class="card">
+                            <div class="table-responsive">
+                            <table class="data-table">
+                                <thead>
+                                    <tr>
+                                        <th>Node ID</th>
+                                        <th>Type</th>
+                                        <th>Owner</th>
+                                        <th>Expired</th>
+                                        <th>Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="table-expired-nodes"></tbody>
+                            </table>
+                            </div>
+                            <button id="expired-nodes-more" class="btn btn-sm load-more" type="button" hidden>Load more</button>
+                        </div>
+                    </details>
                 </section>
 
                 <!-- Services View: self-reported by each node (see /nodes/catalog);
@@ -405,5 +427,6 @@ <h2>Mesh Security Policies</h2>
     <div id="toast-container" class="toast-container" role="status" aria-live="polite"></div>
     <script src="vendor/js-yaml.min.js"></script>
     <script src="app.js"></script>
+    <script src="expired-nodes.js"></script>
 </body>
 </html>
diff --git a/internal/console/public/style.css b/internal/console/public/style.css
index 0326f0fc..65a03ee2 100644
--- a/internal/console/public/style.css
+++ b/internal/console/public/style.css
@@ -523,6 +523,24 @@ body {
     font-weight: 600;
 }
 
+/* A collapsible section: the disclosure marker sits beside its title. */
+summary.section-header {
+    cursor: pointer;
+}
+
+summary.section-header h2 {
+    display: inline;
+}
+
+.load-more {
+    margin-top: 16px;
+}
+
+/* .btn sets display, which would otherwise beat the hidden attribute. */
+.load-more[hidden] {
+    display: none;
+}
+
 /* Buttons */
 .btn {
     display: inline-flex;
diff --git a/internal/console/server_test.go b/internal/console/server_test.go
index 23b6e35c..3a7cd53c 100644
--- a/internal/console/server_test.go
+++ b/internal/console/server_test.go
@@ -95,8 +95,11 @@ func TestNewServerEmbeddedAssets(t *testing.T) {
 	if code, body := get("/"); code != http.StatusOK || !strings.Contains(body, "<html") {
 		t.Errorf("GET / = %d, want 200 with the embedded index.html", code)
 	}
-	if code, _ := get("/app.js"); code != http.StatusOK {
-		t.Errorf("GET /app.js = %d, want 200", code)
+	// A missing file would get the SPA fallback, so a script must not be index.html.
+	for _, asset := range []string{"/app.js", "/expired-nodes.js"} {
+		if code, body := get(asset); code != http.StatusOK || strings.Contains(body, "<html") {
+			t.Errorf("GET %s = %d, want 200 with the embedded script", asset, code)
+		}
 	}
 	// SPA fallback: unknown paths serve index.html.
 	if code, body := get("/some/client/route"); code != http.StatusOK || !strings.Contains(body, "<html") {
diff --git a/internal/controlplane/catalog_test.go b/internal/controlplane/catalog_test.go
index 8f2e732b..3b34b94c 100644
--- a/internal/controlplane/catalog_test.go
+++ b/internal/controlplane/catalog_test.go
@@ -82,8 +82,8 @@ func catalogBody(t *testing.T, services ...*api.ServiceInfo) []byte {
 	return body
 }
 
-// adminNodeCatalog fetches /admin/status and returns its node_catalog value.
-func adminNodeCatalog(t *testing.T, cpURL, adminToken string) map[string]*api.NodeServices {
+// adminStatus fetches /admin/status with the admin token.
+func adminStatus(t *testing.T, cpURL, adminToken string) *api.AdminStatusResponse {
 	t.Helper()
 
 	req, err := http.NewRequest(http.MethodGet, cpURL+"/admin/status", nil)
@@ -107,7 +107,7 @@ func adminNodeCatalog(t *testing.T, cpURL, adminToken string) map[string]*api.No
 	if err := protojson.Unmarshal(body, status); err != nil {
 		t.Fatalf("decode /admin/status: %v", err)
 	}
-	return status.GetNodeCatalog()
+	return status
 }
 
 func TestHandleNodeCatalog(t *testing.T) {
@@ -155,7 +155,7 @@ func TestHandleNodeCatalog(t *testing.T) {
 	}
 
 	// The console sees the reported services with the report time.
-	view := adminNodeCatalog(t, cpURL, srv.config.AdminToken)
+	view := adminStatus(t, cpURL, srv.config.AdminToken).GetNodeCatalog()
 	got, ok := view[nodePeer.String()]
 	if !ok || len(view) != 1 {
 		t.Fatalf("expected the reporting peer in node_catalog, got %v", view)
@@ -169,7 +169,7 @@ func TestHandleNodeCatalog(t *testing.T) {
 	if got := postCatalog(t, cpURL, bearer(biscuitBytes), priv, catalogBody(t)); got != http.StatusNoContent {
 		t.Fatalf("empty report: got status %d, want %d", got, http.StatusNoContent)
 	}
-	if view := adminNodeCatalog(t, cpURL, srv.config.AdminToken); len(view[nodePeer.String()].GetServices()) != 0 {
+	if view := adminStatus(t, cpURL, srv.config.AdminToken).GetNodeCatalog(); len(view[nodePeer.String()].GetServices()) != 0 {
 		t.Fatalf("empty report must clear services, got %+v", view)
 	}
 }
@@ -280,7 +280,7 @@ func TestHandleNodeCatalog_Admission(t *testing.T) {
 	if got := postCatalog(t, cpURL, bearer(biscuitBytes), priv, body); got != http.StatusNoContent {
 		t.Fatalf("admitted node: got status %d, want %d", got, http.StatusNoContent)
 	}
-	if _, ok := adminNodeCatalog(t, cpURL, srv.config.AdminToken)[nodePeer.String()]; !ok {
+	if _, ok := adminStatus(t, cpURL, srv.config.AdminToken).GetNodeCatalog()[nodePeer.String()]; !ok {
 		t.Fatal("admitted node's report missing from node_catalog")
 	}
 
@@ -296,9 +296,13 @@ func TestHandleNodeCatalog_Admission(t *testing.T) {
 	if got := postCatalog(t, cpURL, bearer(biscuitBytes), priv, body); got != http.StatusUnauthorized {
 		t.Fatalf("expired session: got status %d, want %d", got, http.StatusUnauthorized)
 	}
-	if view := adminNodeCatalog(t, cpURL, srv.config.AdminToken); len(view) != 0 {
+	expired := adminStatus(t, cpURL, srv.config.AdminToken)
+	if view := expired.GetNodeCatalog(); len(view) != 0 {
 		t.Fatalf("expired node must not appear in node_catalog, got %v", view)
 	}
+	if nodes := expired.GetEnrolledNodes(); len(nodes) != 0 {
+		t.Fatalf("expired node must not appear in enrolled_nodes, got %v", nodes)
+	}
 
 	// Banned through the server path: the entry is evicted outright.
 	record.ExpiresAt = time.Now().Add(time.Hour)
@@ -359,7 +363,7 @@ func TestCatalogPeerIDCanonicalization(t *testing.T) {
 
 	// The view must join the CIDv1 record with the canonically-keyed entry,
 	// displayed under the record's own spelling.
-	view := adminNodeCatalog(t, cpURL, srv.config.AdminToken)
+	view := adminStatus(t, cpURL, srv.config.AdminToken).GetNodeCatalog()
 	if _, ok := view[cidForm]; !ok || len(view[cidForm].GetServices()) != 1 {
 		t.Fatalf("CIDv1-enrolled node's report missing from node_catalog, got %v", view)
 	}
diff --git a/internal/controlplane/config.go b/internal/controlplane/config.go
index 8e1924d0..a71618d8 100644
--- a/internal/controlplane/config.go
+++ b/internal/controlplane/config.go
@@ -49,9 +49,10 @@ type Options struct {
 	OIDCSessionTTL        time.Duration // How long an OIDC enrollment stays refreshable before the identity must re-authenticate interactively; defaults to api.OIDCSessionTTL
 	WorkloadSessionTTL    time.Duration // Session TTL for enrollments from a WorkloadIssuer; defaults to DefaultWorkloadSessionTTL (48h)
 	// NodeRetention is how long an enrolled node's row is kept after its
-	// session expired before being deleted; 0 keeps rows forever. Every
-	// pod restart without a persistent data dir enrolls a fresh identity,
-	// so without this the nodes table only ever grows.
+	// session expired before being deleted; 0 is DefaultNodeRetention and a
+	// negative value keeps rows forever. Every pod restart without a
+	// persistent data dir enrolls a fresh identity, so without this the
+	// nodes table only ever grows.
 	NodeRetention         time.Duration
 	AdminToken            string // Optional: administrative bearer token for protecting policy and enrollment queue REST APIs
 	AutoApproveEnrollment bool   // If true, valid bootstrap token enrollment requests are immediately approved without administrative manual gate
@@ -124,6 +125,9 @@ func (o *Options) Default() {
 	if o.WorkloadSessionTTL <= 0 {
 		o.WorkloadSessionTTL = DefaultWorkloadSessionTTL
 	}
+	if o.NodeRetention == 0 {
+		o.NodeRetention = DefaultNodeRetention
+	}
 	if o.DelegatedBiscuitTTL <= 0 {
 		o.DelegatedBiscuitTTL = 1 * time.Hour
 	}
diff --git a/internal/controlplane/metrics.go b/internal/controlplane/metrics.go
index a4f1ab0d..fb1f2a84 100644
--- a/internal/controlplane/metrics.go
+++ b/internal/controlplane/metrics.go
@@ -91,16 +91,6 @@ const (
 	meshStateTimeout = 5 * time.Second
 )
 
-// Node admission states as reported by meshStateCollector. "admitted" is
-// what CheckAdmission says, not liveness: a node that enrolled once and went
-// away stays admitted until its session expires. Liveness is
-// agentmesh_control_plane_mesh_connected_peers.
-const (
-	nodeStateAdmitted = "admitted"
-	nodeStateExpired  = "expired"
-	nodeStateBanned   = "banned"
-)
-
 // Bootstrap token states as reported by meshStateCollector.
 const (
 	tokenStateActive    = "active"
@@ -294,12 +284,14 @@ func readMeshSnapshot(ctx context.Context, store storage.Store, now time.Time) (
 		tokensByState:      map[string]int{},
 	}
 
-	nodes, err := store.ListNodes(ctx)
+	// Liveness is agentmesh_control_plane_mesh_connected_peers, not the
+	// "admitted" state (see storage.NodeState).
+	counts, err := store.CountNodes(ctx, now)
 	if err != nil {
 		return snap, err
 	}
-	for i := range nodes {
-		snap.nodesByRoleState[[2]string{nodes[i].Role, nodeState(&nodes[i], now)}]++
+	for _, c := range counts {
+		snap.nodesByRoleState[[2]string{c.Role, string(c.State)}] = c.Count
 	}
 
 	users, err := store.ListUsers(ctx)
@@ -351,17 +343,6 @@ func enrollmentStatusLabel(s api.EnrollmentStatus) string {
 	return strings.ToLower(strings.TrimPrefix(s.String(), "ENROLLMENT_STATUS_"))
 }
 
-func nodeState(n *storage.EnrolledNode, now time.Time) string {
-	switch n.CheckAdmission(now) {
-	case nil:
-		return nodeStateAdmitted
-	case storage.ErrNodeBanned:
-		return nodeStateBanned
-	default:
-		return nodeStateExpired
-	}
-}
-
 func tokenState(t *storage.BootstrapToken, now time.Time) string {
 	switch {
 	case t.IsRevoked():
diff --git a/internal/controlplane/node_gc.go b/internal/controlplane/node_gc.go
index 1d1b3394..972d7cd4 100644
--- a/internal/controlplane/node_gc.go
+++ b/internal/controlplane/node_gc.go
@@ -62,7 +62,7 @@ func (s *Server) runNodeGCLoop() {
 }
 
 // gcExpiredNodes deletes every unbanned node whose session expired more than
-// NodeRetention before now. A retention of zero means keep forever, and that
+// NodeRetention before now. A negative retention means keep forever, and that
 // holds here too, not only in the loop that decides whether to tick.
 func (s *Server) gcExpiredNodes(now time.Time) {
 	if s.config.NodeRetention <= 0 {
diff --git a/internal/controlplane/node_gc_test.go b/internal/controlplane/node_gc_test.go
index a7874ec7..c4ae136b 100644
--- a/internal/controlplane/node_gc_test.go
+++ b/internal/controlplane/node_gc_test.go
@@ -57,7 +57,7 @@ func TestGCExpiredNodesAppliesRetention(t *testing.T) {
 
 	srv.gcExpiredNodes(now)
 
-	nodes, err := store.ListNodes(ctx)
+	nodes, err := store.ListNodes(ctx, storage.NodeFilter{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -88,22 +88,56 @@ func TestNodeGCLoopIsOffWithoutRetention(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	srv, err := NewServer(Options{DriverName: "sqlite", DataSourceName: "unused", OIDCIssuer: "https://issuer"}, store)
+	srv, err := NewServer(Options{DriverName: "sqlite", DataSourceName: "unused", OIDCIssuer: "https://issuer", NodeRetention: -1}, store)
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer func() { _ = srv.Close() }()
 
-	// The loop returns immediately with retention 0, and a direct sweep is a
-	// no-op too: zero means keep forever, not "expired as of now".
+	// The loop returns immediately with a negative retention, and a direct
+	// sweep is a no-op too: it means keep forever, not "expired as of now".
 	srv.wg.Add(1)
 	srv.runNodeGCLoop()
 	srv.gcExpiredNodes(now)
-	nodes, err := store.ListNodes(ctx)
+	nodes, err := store.ListNodes(ctx, storage.NodeFilter{})
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(nodes) != 1 {
-		t.Fatalf("retention 0 deleted rows: %d left", len(nodes))
+		t.Fatalf("negative retention deleted rows: %d left", len(nodes))
+	}
+}
+
+// A caller that leaves NodeRetention unset, such as agentmesh-one, still
+// reclaims rows whose session lapsed more than DefaultNodeRetention ago.
+func TestGCExpiredNodesDefaultsRetention(t *testing.T) {
+	store := newMetricsTestStore(t)
+	ctx := context.Background()
+	now := time.Now()
+	for id, expiresAt := range map[string]time.Time{
+		"stale":  now.Add(-DefaultNodeRetention - time.Hour),
+		"recent": now.Add(-DefaultNodeRetention + time.Hour),
+	} {
+		if err := store.EnrollNode(ctx, &storage.EnrolledNode{
+			PeerID: id, PublicKey: []byte("pub"), Biscuit: []byte("b"), Role: api.RoleNode,
+			EnrollmentType: "OIDC", EnrolledAt: now.Add(-90 * 24 * time.Hour), ExpiresAt: expiresAt,
+		}); err != nil {
+			t.Fatalf("enroll %s: %v", id, err)
+		}
+	}
+
+	srv, err := NewServer(Options{DriverName: "sqlite", DataSourceName: "unused", OIDCIssuer: "https://issuer"}, store)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = srv.Close() }()
+
+	srv.gcExpiredNodes(now)
+	nodes, err := store.ListNodes(ctx, storage.NodeFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(nodes) != 1 || nodes[0].PeerID != "recent" {
+		t.Fatalf("after a sweep with the default retention got %+v, want only recent", nodes)
 	}
 }
diff --git a/internal/controlplane/server.go b/internal/controlplane/server.go
index 9ed6d6a2..0e1df95b 100644
--- a/internal/controlplane/server.go
+++ b/internal/controlplane/server.go
@@ -355,6 +355,7 @@ func (s *Server) RegisterRoutes(mux *http.ServeMux) {
 	handle("/admin/status", noStore(s.HandleAdminStatus))
 	handle("/admin/policy", noStore(s.HandleAdminPolicy))
 	handle("/user/status", noStore(s.HandleUserStatus))
+	handle("/user/nodes", noStore(s.HandleListNodes))
 	handle("/user/bootstrap-tokens", noStore(s.HandleUserBootstrapTokens))
 	handle("/user/revoke", noStore(s.HandleUserRevoke))
 }
@@ -1620,24 +1621,20 @@ func (s *Server) unservedEgress(ctx context.Context, policy *api.PolicyConfig) (
 	if len(policy.GetEgress()) == 0 {
 		return nil, nil, nil
 	}
-	nodes, err := s.store.ListNodes(ctx)
+	nodes, err := s.store.ListNodes(ctx, storage.NodeFilter{States: []storage.NodeState{storage.NodeAdmitted}})
 	if err != nil {
 		return nil, nil, err
 	}
-	// Admission and roles belong to the node, not to the destination, so each
-	// node is settled once and an unresolved one is reported once.
+	// Roles belong to the node, not to the destination, so each node is
+	// settled once and an unresolved one is reported once.
 	type candidate struct {
 		roles  []string
 		labels map[string]string
 	}
-	now := time.Now()
 	var candidates []candidate
 	var unresolved []unresolvedNode
 	for i := range nodes {
 		node := &nodes[i]
-		if node.CheckAdmission(now) != nil {
-			continue
-		}
 		roles, err := nodeRoles(node, policy.GetBindings())
 		if err != nil {
 			unresolved = append(unresolved, unresolvedNode{peerID: node.PeerID, err: err})
@@ -3108,17 +3105,19 @@ func (s *Server) HandleUserStatus(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	isAdmin := user.Role == "admin"
 
-	allNodes, err := s.store.ListNodes(ctx)
+	filter := storage.NodeFilter{States: statusNodeStates, Now: time.Now()}
+	if !isAdmin {
+		filter.OwnerID = &user.ID
+	}
+	allNodes, err := s.store.ListNodes(ctx, filter)
 	if err != nil {
 		logger.Errorf("Failed to list nodes: %v", err)
 		http.Error(w, "Internal server error", http.StatusInternalServerError)
 		return
 	}
-	nodes := []*api.EnrolledNode{}
+	nodes := make([]*api.EnrolledNode, 0, len(allNodes))
 	for i := range allNodes {
-		if isAdmin || allNodes[i].OwnerID == user.ID {
-			nodes = append(nodes, enrolledNodeView(&allNodes[i], isAdmin))
-		}
+		nodes = append(nodes, enrolledNodeView(&allNodes[i], isAdmin))
 	}
 
 	allTokens, err := s.store.ListBootstrapTokens(ctx)
diff --git a/internal/controlplane/sts_test.go b/internal/controlplane/sts_test.go
index ca594281..3ff020de 100644
--- a/internal/controlplane/sts_test.go
+++ b/internal/controlplane/sts_test.go
@@ -126,7 +126,7 @@ func TestTokenExchangeStatelessAndRoleIsolation(t *testing.T) {
 		t.Fatalf("SavePolicyDocument: %v", err)
 	}
 
-	nodesBefore, err := store.ListNodes(ctx)
+	nodesBefore, err := store.ListNodes(ctx, storage.NodeFilter{})
 	if err != nil {
 		t.Fatalf("ListNodes: %v", err)
 	}
@@ -186,7 +186,7 @@ func TestTokenExchangeStatelessAndRoleIsolation(t *testing.T) {
 	}
 
 	// Verify zero DB writes occurred during /token/exchange.
-	nodesAfter, err := store.ListNodes(ctx)
+	nodesAfter, err := store.ListNodes(ctx, storage.NodeFilter{})
 	if err != nil {
 		t.Fatalf("ListNodes after exchange: %v", err)
 	}
diff --git a/internal/controlplane/ui.go b/internal/controlplane/ui.go
index 25336889..ebecbcb9 100644
--- a/internal/controlplane/ui.go
+++ b/internal/controlplane/ui.go
@@ -15,12 +15,29 @@
 package controlplane
 
 import (
+	"encoding/base64"
+	"errors"
+	"fmt"
 	"net/http"
+	"strconv"
+	"strings"
 	"time"
 
 	"github.com/google/agentmesh/api"
+	"github.com/google/agentmesh/internal/storage"
 )
 
+// Page bounds for GET /user/nodes, so one request is one bounded query.
+const (
+	defaultNodesPageSize = 50
+	maxNodesPageSize     = 200
+)
+
+// statusNodeStates are the nodes GET /admin/status and GET /user/status list on
+// every console refresh. Expired rows stay for the retention period, so
+// GET /user/nodes pages them instead and the lists stay the size of the live mesh.
+var statusNodeStates = []storage.NodeState{storage.NodeAdmitted, storage.NodeBanned}
+
 // HandleAdminStatus HTTP GET `/admin/status`: the whole mesh as the console
 // shows it, protojson of AdminStatusResponse.
 func (s *Server) HandleAdminStatus(w http.ResponseWriter, r *http.Request) {
@@ -34,6 +51,7 @@ func (s *Server) HandleAdminStatus(w http.ResponseWriter, r *http.Request) {
 	}
 
 	ctx := r.Context()
+	now := time.Now()
 
 	routers, err := s.store.GetActiveRouters(ctx)
 	if err != nil {
@@ -42,7 +60,7 @@ func (s *Server) HandleAdminStatus(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	nodes, err := s.store.ListNodes(ctx)
+	nodes, err := s.store.ListNodes(ctx, storage.NodeFilter{States: statusNodeStates, Now: now})
 	if err != nil {
 		logger.Errorf("Failed to list nodes: %v", err)
 		http.Error(w, "Internal server error", http.StatusInternalServerError)
@@ -89,6 +107,130 @@ func (s *Server) HandleAdminStatus(w http.ResponseWriter, r *http.Request) {
 		EnrollmentRequests: enrollmentRequestViews(reqs),
 		BootstrapTokens:    bootstrapTokenViews(tokens),
 		Policy:             policy,
-		NodeCatalog:        s.catalogViewFor(nodes, time.Now()),
+		NodeCatalog:        s.catalogViewFor(nodes, now),
+	})
+}
+
+// HandleListNodes HTTP GET `/user/nodes`: one page of the nodes the caller
+// may see, protojson of NodeListResponse. An administrator sees every owner's
+// nodes and may pick one with owner_id; a user sees only its own.
+func (s *Server) HandleListNodes(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	user, ok := s.requireUser(w, r)
+	if !ok {
+		return
+	}
+
+	query := r.URL.Query()
+	pageSize, err := parseNodesPageSize(query.Get("page_size"))
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	after, err := decodeNodesPageToken(query.Get("page_token"))
+	if err != nil {
+		http.Error(w, "Invalid page_token", http.StatusBadRequest)
+		return
+	}
+	states, err := parseNodeStates(query["state"])
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	isAdmin := user.Role == "admin"
+	owner := &user.ID
+	if isAdmin {
+		owner = nil
+	}
+	if query.Has("owner_id") {
+		id := query.Get("owner_id")
+		if !isAdmin && id != user.ID {
+			http.Error(w, "Only an administrator may list another owner's nodes", http.StatusForbidden)
+			return
+		}
+		owner = &id
+	}
+
+	// One row past the page tells whether a next page exists.
+	nodes, err := s.store.ListNodes(r.Context(), storage.NodeFilter{
+		States:  states,
+		Now:     time.Now(),
+		OwnerID: owner,
+		Role:    query.Get("role"),
+		After:   after,
+		Limit:   pageSize + 1,
 	})
+	if err != nil {
+		logger.Errorf("Failed to list nodes: %v", err)
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+		return
+	}
+
+	resp := &api.NodeListResponse{}
+	if len(nodes) > pageSize {
+		nodes = nodes[:pageSize]
+		last := nodes[pageSize-1]
+		resp.NextPageToken = encodeNodesPageToken(storage.NodeCursor{EnrolledAt: last.EnrolledAt, PeerID: last.PeerID})
+	}
+	for i := range nodes {
+		resp.Nodes = append(resp.Nodes, enrolledNodeView(&nodes[i], isAdmin))
+	}
+	writeProtoJSON(w, resp)
+}
+
+func parseNodesPageSize(raw string) (int, error) {
+	if raw == "" {
+		return defaultNodesPageSize, nil
+	}
+	n, err := strconv.Atoi(raw)
+	if err != nil || n < 1 {
+		return 0, errors.New("page_size must be a positive integer")
+	}
+	return min(n, maxNodesPageSize), nil
+}
+
+// parseNodeStates reads the repeatable state parameter; none means every state.
+func parseNodeStates(raw []string) ([]storage.NodeState, error) {
+	states := make([]storage.NodeState, 0, len(raw))
+	for _, value := range raw {
+		state := storage.NodeState(value)
+		switch state {
+		case storage.NodeAdmitted, storage.NodeExpired, storage.NodeBanned:
+			states = append(states, state)
+		default:
+			return nil, fmt.Errorf("state must be admitted, expired or banned, not %q", value)
+		}
+	}
+	return states, nil
+}
+
+// The token is opaque to clients: base64url of "<enrollment unix ms>:<peer ID>",
+// the sort key of the last row served.
+func encodeNodesPageToken(c storage.NodeCursor) string {
+	key := strconv.FormatInt(c.EnrolledAt.UnixMilli(), 10) + ":" + c.PeerID
+	return base64.RawURLEncoding.EncodeToString([]byte(key))
+}
+
+// decodeNodesPageToken returns nil for an empty token, the first page.
+func decodeNodesPageToken(token string) (*storage.NodeCursor, error) {
+	if token == "" {
+		return nil, nil
+	}
+	raw, err := base64.RawURLEncoding.DecodeString(token)
+	if err != nil {
+		return nil, err
+	}
+	ms, peerID, ok := strings.Cut(string(raw), ":")
+	if !ok || peerID == "" {
+		return nil, errors.New("page token lacks a peer ID")
+	}
+	at, err := strconv.ParseInt(ms, 10, 64)
+	if err != nil {
+		return nil, err
+	}
+	return &storage.NodeCursor{EnrolledAt: time.UnixMilli(at), PeerID: peerID}, nil
 }
diff --git a/internal/controlplane/ui_test.go b/internal/controlplane/ui_test.go
new file mode 100644
index 00000000..485523b1
--- /dev/null
+++ b/internal/controlplane/ui_test.go
@@ -0,0 +1,209 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package controlplane
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"net/http"
+	"net/url"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/google/agentmesh/api"
+	"github.com/google/agentmesh/internal/storage"
+	"google.golang.org/protobuf/encoding/protojson"
+)
+
+// An expired OIDC node can renew in place, so its owner and every admin must
+// be able to page through it to revoke it, and nobody else may see it.
+func TestHandleListNodes(t *testing.T) {
+	h := newLifecycleHarness(t)
+	ctx := context.Background()
+	now := time.Now()
+	const adminToken = "super-secret-admin-token"
+	aliceToken := h.mintToken(map[string]interface{}{"sub": "alice"})
+
+	for _, id := range []string{"alice", "bob"} {
+		if err := h.store.SaveUser(ctx, &storage.User{ID: id, Role: "user", CreatedAt: now}); err != nil {
+			t.Fatalf("save user %s: %v", id, err)
+		}
+	}
+	enrolled := now.Add(-48 * time.Hour)
+	for _, n := range []struct {
+		id, owner             string
+		enrolledAt, expiresAt time.Time
+	}{
+		{"alice-1", "alice", enrolled, now.Add(-time.Hour)},
+		{"bob-1", "bob", enrolled, now.Add(-time.Hour)},
+		{"alice-2", "alice", enrolled.Add(-time.Hour), now.Add(-2 * time.Hour)},
+		{"bob-2", "bob", enrolled.Add(-time.Hour), now.Add(-2 * time.Hour)},
+		{"alice-live", "alice", enrolled, now.Add(time.Hour)},
+		{"alice-banned", "alice", enrolled, now.Add(-3 * time.Hour)},
+	} {
+		if err := h.store.EnrollNode(ctx, &storage.EnrolledNode{
+			PeerID: n.id, PublicKey: []byte("pub"), Biscuit: []byte("b"), Role: api.RoleNode,
+			EnrollmentType: "OIDC", ClaimsJSON: `{"sub":"` + n.owner + `"}`, OwnerID: n.owner,
+			EnrolledAt: n.enrolledAt, ExpiresAt: n.expiresAt,
+		}); err != nil {
+			t.Fatalf("enroll %s: %v", n.id, err)
+		}
+	}
+	if err := h.store.SetNodeBanned(ctx, "alice-banned", true); err != nil {
+		t.Fatal(err)
+	}
+
+	get := func(t *testing.T, path, bearer string) []byte {
+		t.Helper()
+		status, body := h.do(http.MethodGet, path, bearer, nil, "")
+		if status != http.StatusOK {
+			t.Fatalf("GET %s: status %d, body %s", path, status, body)
+		}
+		return body
+	}
+	page := func(t *testing.T, query, bearer string) *api.NodeListResponse {
+		t.Helper()
+		resp := &api.NodeListResponse{}
+		if err := protojson.Unmarshal(get(t, "/user/nodes?"+query, bearer), resp); err != nil {
+			t.Fatalf("decode /user/nodes: %v", err)
+		}
+		return resp
+	}
+	ids := func(nodes []*api.EnrolledNode) []string {
+		var out []string
+		for _, n := range nodes {
+			out = append(out, n.GetPeerId())
+		}
+		return out
+	}
+	// pageAll follows next_page_token from the first page to the last.
+	pageAll := func(t *testing.T, bearer string) []string {
+		t.Helper()
+		var got []string
+		token := ""
+		for range 10 {
+			resp := page(t, "state=expired&page_size=1&page_token="+url.QueryEscape(token), bearer)
+			got = append(got, ids(resp.GetNodes())...)
+			if token = resp.GetNextPageToken(); token == "" {
+				return got
+			}
+		}
+		t.Fatalf("next_page_token never ran out, visited %v", got)
+		return nil
+	}
+
+	t.Run("admin sees every expired node", func(t *testing.T) {
+		want := []string{"bob-1", "alice-1", "bob-2", "alice-2"}
+		if got := pageAll(t, adminToken); !slices.Equal(got, want) {
+			t.Errorf("admin paged through %v, want %v", got, want)
+		}
+	})
+
+	t.Run("user sees only its own expired nodes", func(t *testing.T) {
+		want := []string{"alice-1", "alice-2"}
+		if got := pageAll(t, aliceToken); !slices.Equal(got, want) {
+			t.Errorf("alice paged through %v, want %v", got, want)
+		}
+	})
+
+	t.Run("a cursor from another owner's row does not widen the scope", func(t *testing.T) {
+		token := encodeNodesPageToken(storage.NodeCursor{EnrolledAt: enrolled, PeerID: "bob-1"})
+		want := []string{"alice-1", "alice-2"}
+		if got := ids(page(t, "state=expired&page_token="+token, aliceToken).GetNodes()); !slices.Equal(got, want) {
+			t.Errorf("alice after bob-1's cursor got %v, want %v", got, want)
+		}
+	})
+
+	t.Run("admin narrows by owner and state", func(t *testing.T) {
+		want := []string{"alice-live", "alice-banned"}
+		if got := ids(page(t, "owner_id=alice&state=admitted&state=banned", adminToken).GetNodes()); !slices.Equal(got, want) {
+			t.Errorf("admin listing alice's admitted and banned nodes got %v, want %v", got, want)
+		}
+	})
+
+	t.Run("a user may name only itself as owner", func(t *testing.T) {
+		want := []string{"alice-live", "alice-banned", "alice-1", "alice-2"}
+		if got := ids(page(t, "owner_id=alice", aliceToken).GetNodes()); !slices.Equal(got, want) {
+			t.Errorf("alice listing her own nodes got %v, want %v", got, want)
+		}
+		if status, body := h.do(http.MethodGet, "/user/nodes?owner_id=bob", aliceToken, nil, ""); status != http.StatusForbidden {
+			t.Errorf("alice listing bob's nodes: status %d (%s), want %d", status, body, http.StatusForbidden)
+		}
+	})
+
+	t.Run("claims stay admin-only", func(t *testing.T) {
+		body := get(t, "/user/nodes", aliceToken)
+		for _, field := range []string{`"claims_json"`, `"biscuit"`, `"public_key"`} {
+			if bytes.Contains(body, []byte(field)) {
+				t.Errorf("non-admin body carries %s: %s", field, body)
+			}
+		}
+		if body := get(t, "/user/nodes", adminToken); !bytes.Contains(body, []byte(`"claims_json"`)) {
+			t.Errorf("admin body lacks \"claims_json\": %s", body)
+		}
+	})
+
+	t.Run("GET /user/status leaves expired nodes out", func(t *testing.T) {
+		status := &api.UserStatusResponse{}
+		if err := protojson.Unmarshal(get(t, "/user/status", aliceToken), status); err != nil {
+			t.Fatalf("decode /user/status: %v", err)
+		}
+		got := ids(status.GetEnrolledNodes())
+		if !slices.Contains(got, "alice-live") || slices.Contains(got, "alice-1") {
+			t.Errorf("enrolled_nodes = %v, want alice-live listed and alice-1 left out", got)
+		}
+	})
+
+	for _, tc := range []struct {
+		name, bearer, query string
+		want                int
+	}{
+		{"malformed page_token", adminToken, "page_token=%21%21", http.StatusBadRequest},
+		{"page_token without a peer ID", adminToken, "page_token=" + base64.RawURLEncoding.EncodeToString([]byte("1700000000000")), http.StatusBadRequest},
+		{"page_size zero", adminToken, "page_size=0", http.StatusBadRequest},
+		{"page_size not a number", adminToken, "page_size=ten", http.StatusBadRequest},
+		{"unknown state", adminToken, "state=lapsed", http.StatusBadRequest},
+		{"unauthenticated", "", "", http.StatusUnauthorized},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if status, body := h.do(http.MethodGet, "/user/nodes?"+tc.query, tc.bearer, nil, ""); status != tc.want {
+				t.Errorf("status %d (%s), want %d", status, body, tc.want)
+			}
+		})
+	}
+}
+
+// The default and the ceiling are what keep one console request one bounded query.
+func TestParseNodesPageSize(t *testing.T) {
+	for _, tc := range []struct {
+		raw     string
+		want    int
+		wantErr bool
+	}{
+		{"", defaultNodesPageSize, false},
+		{"7", 7, false},
+		{"5000", maxNodesPageSize, false},
+		{"0", 0, true},
+		{"-3", 0, true},
+		{"ten", 0, true},
+	} {
+		got, err := parseNodesPageSize(tc.raw)
+		if (err != nil) != tc.wantErr || got != tc.want {
+			t.Errorf("parseNodesPageSize(%q) = %d, %v; want %d, error %t", tc.raw, got, err, tc.want, tc.wantErr)
+		}
+	}
+}
diff --git a/internal/storage/migration_test.go b/internal/storage/migration_test.go
index ea4c43d9..51d2d907 100644
--- a/internal/storage/migration_test.go
+++ b/internal/storage/migration_test.go
@@ -149,8 +149,9 @@ func TestMigrationConvertsSecondsToMillis(t *testing.T) {
 	}
 }
 
-// Migration 16 indexes the scans that run on every bootstrap and every GC
-// pass; the index list is the contract the planner relies on.
+// Migrations 16 and 19 index the scans that run on every bootstrap, every GC
+// pass and every console refresh; the index list is the contract the planner
+// relies on.
 func TestMigrationCreatesIndexes(t *testing.T) {
 	store, err := NewSQLStore("sqlite", filepath.Join(t.TempDir(), "cp.db"))
 	if err != nil {
@@ -174,6 +175,8 @@ func TestMigrationCreatesIndexes(t *testing.T) {
 	want := []string{
 		"idx_enrollment_requests_created_at",
 		"idx_nodes_banned_expires_at",
+		"idx_nodes_enrolled_at",
+		"idx_nodes_owner_id",
 		"idx_revoked_biscuits_expires_at",
 		"idx_routers_expires_at",
 	}
diff --git a/internal/storage/round_trip_test.go b/internal/storage/round_trip_test.go
index 1d9eee6c..8fab2052 100644
--- a/internal/storage/round_trip_test.go
+++ b/internal/storage/round_trip_test.go
@@ -18,6 +18,8 @@ import (
 	"context"
 	"errors"
 	"reflect"
+	"slices"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -138,7 +140,7 @@ func TestEnrolledNodeRoundTripsEveryField(t *testing.T) {
 	requireFieldsRoundTrip(t, want, got, "Banned")
 
 	// ListNodes selects its own column list, so it can drift from GetNode.
-	listed, err := store.ListNodes(ctx)
+	listed, err := store.ListNodes(ctx, NodeFilter{})
 	if err != nil {
 		t.Fatalf("ListNodes: %v", err)
 	}
@@ -277,7 +279,7 @@ func TestDeleteExpiredNodesSparesBannedAndUnbounded(t *testing.T) {
 		t.Errorf("deleted %d rows, want 1", deleted)
 	}
 
-	remaining, err := store.ListNodes(ctx)
+	remaining, err := store.ListNodes(ctx, NodeFilter{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -298,6 +300,131 @@ func TestDeleteExpiredNodesSparesBannedAndUnbounded(t *testing.T) {
 	}
 }
 
+// The console lists, pages and revokes from what ListNodes selects, so each
+// state must hold exactly what CheckAdmission says, an owner filter must never
+// widen, and paging must not lose a row that shares its enrollment time with
+// the end of the previous page.
+func TestListNodes(t *testing.T) {
+	store := newTestStore(t)
+	ctx := context.Background()
+	now := time.Now()
+
+	for _, id := range []string{"alice", "bob"} {
+		if err := store.SaveUser(ctx, &User{ID: id, Role: "user", CreatedAt: now}); err != nil {
+			t.Fatalf("save user %s: %v", id, err)
+		}
+	}
+	enrolled := now.Add(-48 * time.Hour)
+	for _, n := range []struct {
+		id, owner, role       string
+		enrolledAt, expiresAt time.Time
+	}{
+		{"live-a", "alice", api.RoleNode, enrolled, now.Add(time.Hour)},
+		{"live-b", "bob", api.RoleNode, enrolled, now.Add(time.Hour)},
+		{"never", "alice", api.RoleRouter, enrolled.Add(-time.Hour), time.Time{}},
+		{"exp-a", "alice", api.RoleNode, enrolled.Add(-2 * time.Hour), now.Add(-time.Minute)},
+		{"exp-unowned", "", api.RoleNode, enrolled.Add(-3 * time.Hour), now.Add(-time.Hour)},
+		{"banned", "alice", api.RoleNode, enrolled.Add(-4 * time.Hour), now.Add(-24 * time.Hour)},
+	} {
+		if err := store.EnrollNode(ctx, &EnrolledNode{
+			PeerID: n.id, PublicKey: []byte("pub"), Biscuit: []byte("b"), Role: n.role,
+			EnrollmentType: "OIDC", OwnerID: n.owner, EnrolledAt: n.enrolledAt, ExpiresAt: n.expiresAt,
+		}); err != nil {
+			t.Fatalf("enroll %s: %v", n.id, err)
+		}
+	}
+	if err := store.SetNodeBanned(ctx, "banned", true); err != nil {
+		t.Fatal(err)
+	}
+
+	list := func(t *testing.T, filter NodeFilter) []string {
+		t.Helper()
+		nodes, err := store.ListNodes(ctx, filter)
+		if err != nil {
+			t.Fatalf("ListNodes(%+v): %v", filter, err)
+		}
+		var ids []string
+		for _, n := range nodes {
+			ids = append(ids, n.PeerID)
+		}
+		return ids
+	}
+
+	all := []string{"live-b", "live-a", "never", "exp-a", "exp-unowned", "banned"}
+	for _, tc := range []struct {
+		name   string
+		filter NodeFilter
+		want   []string
+	}{
+		{"zero filter", NodeFilter{}, all},
+		{"admitted", NodeFilter{States: []NodeState{NodeAdmitted}, Now: now}, []string{"live-b", "live-a", "never"}},
+		{"expired", NodeFilter{States: []NodeState{NodeExpired}, Now: now}, []string{"exp-a", "exp-unowned"}},
+		{"banned", NodeFilter{States: []NodeState{NodeBanned}, Now: now}, []string{"banned"}},
+		{"admitted or banned", NodeFilter{States: []NodeState{NodeAdmitted, NodeBanned}, Now: now}, []string{"live-b", "live-a", "never", "banned"}},
+		{"one owner", NodeFilter{OwnerID: new("alice")}, []string{"live-a", "never", "exp-a", "banned"}},
+		{"owner without nodes", NodeFilter{OwnerID: new("carol")}, nil},
+		// An empty ID must never widen to every owner, unowned rows included.
+		{"empty owner", NodeFilter{OwnerID: new("")}, nil},
+		{"role", NodeFilter{Role: api.RoleRouter}, []string{"never"}},
+		{"owner and state", NodeFilter{States: []NodeState{NodeExpired}, Now: now, OwnerID: new("alice")}, []string{"exp-a"}},
+		{"cursor from another owner's row", NodeFilter{OwnerID: new("alice"), After: &NodeCursor{EnrolledAt: enrolled, PeerID: "live-b"}}, []string{"live-a", "never", "exp-a", "banned"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := list(t, tc.filter); !slices.Equal(got, tc.want) {
+				t.Errorf("got %v, want %v", got, tc.want)
+			}
+		})
+	}
+
+	for _, pageSize := range []int{1, 4} {
+		t.Run("pages of "+strconv.Itoa(pageSize), func(t *testing.T) {
+			var got []string
+			var after *NodeCursor
+			for range len(all) + 1 {
+				page, err := store.ListNodes(ctx, NodeFilter{After: after, Limit: pageSize})
+				if err != nil {
+					t.Fatal(err)
+				}
+				if len(page) == 0 {
+					break
+				}
+				for _, n := range page {
+					got = append(got, n.PeerID)
+				}
+				last := page[len(page)-1]
+				after = &NodeCursor{EnrolledAt: last.EnrolledAt, PeerID: last.PeerID}
+			}
+			if !slices.Equal(got, all) {
+				t.Errorf("paging visited %v, want %v", got, all)
+			}
+		})
+	}
+
+	t.Run("CountNodes buckets as ListNodes filters", func(t *testing.T) {
+		counts, err := store.CountNodes(ctx, now)
+		if err != nil {
+			t.Fatalf("CountNodes: %v", err)
+		}
+		got := map[NodeCount]bool{}
+		for _, c := range counts {
+			got[c] = true
+		}
+		want := map[NodeCount]bool{
+			{Role: api.RoleNode, State: NodeAdmitted, Count: 2}:   true,
+			{Role: api.RoleRouter, State: NodeAdmitted, Count: 1}: true,
+			{Role: api.RoleNode, State: NodeExpired, Count: 2}:    true,
+			{Role: api.RoleNode, State: NodeBanned, Count: 1}:     true,
+		}
+		if !reflect.DeepEqual(got, want) {
+			t.Errorf("CountNodes = %v, want %v", counts, want)
+		}
+	})
+
+	if _, err := store.ListNodes(ctx, NodeFilter{States: []NodeState{"lapsed"}}); err == nil {
+		t.Error("ListNodes accepted an unknown state")
+	}
+}
+
 func TestBootstrapTokenRoundTripsEveryField(t *testing.T) {
 	store := newTestStore(t)
 	ctx := context.Background()
diff --git a/internal/storage/sql_store.go b/internal/storage/sql_store.go
index f8fe901a..4394e090 100644
--- a/internal/storage/sql_store.go
+++ b/internal/storage/sql_store.go
@@ -555,6 +555,19 @@ var migrations = []migration{
 			`ALTER TABLE routers ADD COLUMN connection_limit INTEGER`,
 		},
 	},
+	{
+		// A user's node list searches owner_id, and a GET /user/nodes page
+		// walks enrolled_at instead of sorting every matching row.
+		version: 19,
+		postgres: []string{
+			`CREATE INDEX IF NOT EXISTS idx_nodes_owner_id ON nodes (owner_id)`,
+			`CREATE INDEX IF NOT EXISTS idx_nodes_enrolled_at ON nodes (enrolled_at, peer_id)`,
+		},
+		sqlite: []string{
+			`CREATE INDEX IF NOT EXISTS idx_nodes_owner_id ON nodes (owner_id)`,
+			`CREATE INDEX IF NOT EXISTS idx_nodes_enrolled_at ON nodes (enrolled_at, peer_id)`,
+		},
+	},
 }
 
 var meshPrefixMigration = []string{
@@ -1062,9 +1075,11 @@ func (s *SQLStore) IsIdentityBanned(ctx context.Context, identity string) (bool,
 
 // DeleteExpiredNodes implements Store.
 func (s *SQLStore) DeleteExpiredNodes(ctx context.Context, before time.Time) (int64, error) {
-	// A zero ExpiresAt round-trips as a negative UnixMilli, hence > 0.
-	query := s.rebind(`DELETE FROM nodes WHERE banned = ? AND expires_at > 0 AND expires_at < ?`)
-	res, err := s.db.ExecContext(ctx, query, false, before.UnixMilli())
+	expired, args, err := nodeStateWhere(NodeExpired, before)
+	if err != nil {
+		return 0, err
+	}
+	res, err := s.db.ExecContext(ctx, s.rebind(`DELETE FROM nodes WHERE `+expired), args...)
 	if err != nil {
 		return 0, err
 	}
@@ -1684,10 +1699,18 @@ func (s *SQLStore) ResolveEnrollmentRequest(ctx context.Context, id string, stat
 	return nil
 }
 
-// ListNodes retrieves all enrolled nodes.
-func (s *SQLStore) ListNodes(ctx context.Context) ([]EnrolledNode, error) {
-	query := s.rebind(`SELECT peer_id, public_key, biscuit_token, role, enrollment_type, claims_json, owner_id, labels_json, enrolled_at, expires_at, banned, autonomous_recovery FROM nodes ORDER BY enrolled_at DESC`)
-	rows, err := s.db.QueryContext(ctx, query)
+// ListNodes implements Store.
+func (s *SQLStore) ListNodes(ctx context.Context, filter NodeFilter) ([]EnrolledNode, error) {
+	where, args, err := nodeFilterWhere(filter)
+	if err != nil {
+		return nil, err
+	}
+	query := `SELECT peer_id, public_key, biscuit_token, role, enrollment_type, claims_json, owner_id, labels_json, enrolled_at, expires_at, banned, autonomous_recovery FROM nodes` + where + ` ORDER BY enrolled_at DESC, peer_id DESC`
+	if filter.Limit > 0 {
+		query += ` LIMIT ?`
+		args = append(args, filter.Limit)
+	}
+	rows, err := s.db.QueryContext(ctx, s.rebind(query), args...)
 	if err != nil {
 		return nil, fmt.Errorf("failed to query nodes: %w", err)
 	}
@@ -1745,6 +1768,90 @@ func (s *SQLStore) ListNodes(ctx context.Context) ([]EnrolledNode, error) {
 	return nodes, nil
 }
 
+// nodeFilterWhere renders filter as a WHERE clause, empty for the zero filter.
+func nodeFilterWhere(filter NodeFilter) (string, []any, error) {
+	var conds []string
+	var args []any
+	if len(filter.States) > 0 {
+		now := filter.Now
+		if now.IsZero() {
+			now = time.Now()
+		}
+		arms := make([]string, 0, len(filter.States))
+		for _, state := range filter.States {
+			arm, armArgs, err := nodeStateWhere(state, now)
+			if err != nil {
+				return "", nil, err
+			}
+			arms = append(arms, arm)
+			args = append(args, armArgs...)
+		}
+		conds = append(conds, "("+strings.Join(arms, " OR ")+")")
+	}
+	if filter.OwnerID != nil {
+		conds = append(conds, "owner_id = ?")
+		args = append(args, *filter.OwnerID)
+	}
+	if filter.Role != "" {
+		conds = append(conds, "role = ?")
+		args = append(args, filter.Role)
+	}
+	if filter.After != nil {
+		at := filter.After.EnrolledAt.UnixMilli()
+		conds = append(conds, "enrolled_at <= ? AND (enrolled_at < ? OR peer_id < ?)")
+		args = append(args, at, at, filter.After.PeerID)
+	}
+	if len(conds) == 0 {
+		return "", nil, nil
+	}
+	return " WHERE " + strings.Join(conds, " AND "), args, nil
+}
+
+// nodeStateWhere is CheckAdmission in SQL. A zero ExpiresAt round-trips as a
+// negative UnixMilli, so it never expires. Each arm leads with banned so it
+// can search the (banned, expires_at) index.
+func nodeStateWhere(state NodeState, now time.Time) (string, []any, error) {
+	ms := now.UnixMilli()
+	switch state {
+	case NodeBanned:
+		return "banned = ?", []any{true}, nil
+	case NodeExpired:
+		return "(banned = ? AND expires_at > 0 AND expires_at < ?)", []any{false, ms}, nil
+	case NodeAdmitted:
+		return "(banned = ? AND expires_at <= 0) OR (banned = ? AND expires_at >= ?)", []any{false, false, ms}, nil
+	}
+	return "", nil, fmt.Errorf("unknown node state %q", state)
+}
+
+// CountNodes implements Store. The CASE tests a ban first, as CheckAdmission does.
+func (s *SQLStore) CountNodes(ctx context.Context, now time.Time) ([]NodeCount, error) {
+	banned, args, err := nodeStateWhere(NodeBanned, now)
+	if err != nil {
+		return nil, err
+	}
+	expired, expiredArgs, err := nodeStateWhere(NodeExpired, now)
+	if err != nil {
+		return nil, err
+	}
+	query := fmt.Sprintf(`SELECT role, CASE WHEN %s THEN '%s' WHEN %s THEN '%s' ELSE '%s' END, COUNT(*) FROM nodes GROUP BY 1, 2`,
+		banned, NodeBanned, expired, NodeExpired, NodeAdmitted)
+	rows, err := s.db.QueryContext(ctx, s.rebind(query), append(args, expiredArgs...)...)
+	if err != nil {
+		return nil, fmt.Errorf("failed to count nodes: %w", err)
+	}
+	defer func() { _ = rows.Close() }()
+
+	var counts []NodeCount
+	for rows.Next() {
+		var c NodeCount
+		if err := rows.Scan(&c.Role, &c.State, &c.Count); err != nil {
+			return nil, fmt.Errorf("failed to scan node count: %w", err)
+		}
+		counts = append(counts, c)
+	}
+	return counts, rows.Err()
+}
+
 // ListBootstrapTokens retrieves all bootstrap tokens.
 func (s *SQLStore) ListBootstrapTokens(ctx context.Context) ([]BootstrapToken, error) {
 	query := s.rebind(`SELECT id, token_hash, role, owner_id, max_usages, usages_count, description, created_at, expires_at, revoked_at, autonomous_recovery FROM bootstrap_tokens ORDER BY created_at DESC`)
diff --git a/internal/storage/storage.go b/internal/storage/storage.go
index d77bbd31..37338dd8 100644
--- a/internal/storage/storage.go
+++ b/internal/storage/storage.go
@@ -112,6 +112,44 @@ type EnrolledNode struct {
 	AutonomousRecovery bool
 }
 
+// NodeState is what CheckAdmission says of a node at some instant. "admitted"
+// is not liveness: a node that enrolled once and went away stays admitted
+// until its session expires.
+type NodeState string
+
+const (
+	NodeAdmitted NodeState = "admitted"
+	NodeExpired  NodeState = "expired"
+	NodeBanned   NodeState = "banned"
+)
+
+// NodeFilter selects what ListNodes returns; the zero value is every node.
+type NodeFilter struct {
+	// States keeps the nodes in any of these states at Now, time.Now() if zero.
+	States []NodeState
+	Now    time.Time
+	// OwnerID nil means every owner; any other value, even "", keeps only
+	// that owner's nodes.
+	OwnerID *string
+	Role    string
+	// After resumes from the last row of the previous page. Limit 0 is no limit.
+	After *NodeCursor
+	Limit int
+}
+
+// NodeCursor is the sort key of the last row of a ListNodes page.
+type NodeCursor struct {
+	EnrolledAt time.Time
+	PeerID     string
+}
+
+// NodeCount is how many nodes of one role are in one state.
+type NodeCount struct {
+	Role  string
+	State NodeState
+	Count int
+}
+
 // CheckAdmission reports whether the control plane may still serve this node.
 // Enrollment is bounded by two independent conditions, an explicit ban and the
 // end of the OIDC session, and every path that acts on an enrolled node has to
@@ -313,8 +351,12 @@ type Store interface {
 	// both succeed. ErrEnrollmentAlreadyResolved if it was not pending.
 	ResolveEnrollmentRequest(ctx context.Context, id string, status api.EnrollmentStatus, biscuit []byte, resolvedBy string) error
 
-	// ListNodes retrieves all enrolled nodes.
-	ListNodes(ctx context.Context) ([]EnrolledNode, error)
+	// ListNodes retrieves the enrolled nodes the filter selects, newest
+	// enrollment first. Peer ID breaks ties, so pages neither skip nor repeat a row.
+	ListNodes(ctx context.Context, filter NodeFilter) ([]EnrolledNode, error)
+
+	// CountNodes counts every enrolled node by role and by its state at now.
+	CountNodes(ctx context.Context, now time.Time) ([]NodeCount, error)
 
 	// DeleteExpiredNodes removes enrolled nodes whose session expired before
 	// the given time and that are not banned, returning how many went. A
diff --git a/sdk/js/src/gen/agentmesh_pb.ts b/sdk/js/src/gen/agentmesh_pb.ts
index 24eddf51..4a4df4d4 100644
--- a/sdk/js/src/gen/agentmesh_pb.ts
+++ b/sdk/js/src/gen/agentmesh_pb.ts
@@ -26,7 +26,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file agentmesh.proto.
  */
 export const file_agentmesh: GenFile = /*@__PURE__*/
-  fileDesc("Cg9hZ2VudG1lc2gucHJvdG8SDGFnZW50bWVzaC52MSI0CglBdXRoRnJhbWUSDwoHYmlzY3VpdBgBIAEoDBIWCg50YXJnZXRfc2VydmljZRgCIAEoCSI/CgxBdXRoUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCBINCgVlcnJvchgCIAEoCRIPCgdiaXNjdWl0GAMgASgMIrEBCgxSb3V0ZXJHb0F3YXkSMQoGcmVhc29uGAEgASgOMiEuYWdlbnRtZXNoLnYxLlJvdXRlckdvQXdheS5SZWFzb24SLgoLcmV0cnlfYWZ0ZXIYAiABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb24iPgoGUmVhc29uEhYKElJFQVNPTl9VTlNQRUNJRklFRBAAEgwKCERSQUlOSU5HEAESDgoKT1ZFUkxPQURFRBACItwBCglNZXNoRXZlbnQSKgoEdHlwZRgBIAEoDjIcLmFnZW50bWVzaC52MS5NZXNoRXZlbnQuVHlwZRIPCgdwZWVyX2lkGAIgASgJEi4KCmV2ZW50X3RpbWUYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhYKDm5ld19wdWJsaWNfa2V5GAQgASgMEhEKCXNpZ25hdHVyZRgFIAEoDCI3CgRUeXBlEgoKBkJBTk5FRBAAEhAKDEtFWV9ST1RBVElPThABEhEKDVBPTElDWV9VUERBVEUQAiL5AQoNRW5yb2xsUmVxdWVzdBILCgNqd3QYASABKAkSDwoHcGVlcl9pZBgCIAEoCRISCgpwdWJsaWNfa2V5GAMgASgMEhYKDnJlcXVlc3RlZF9yb2xlGAQgASgJEjcKBmxhYmVscxgFIAMoCzInLmFnZW50bWVzaC52MS5FbnJvbGxSZXF1ZXN0LkxhYmVsc0VudHJ5EhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKrAQoORW5yb2xsUmVzcG9uc2USFQoNYmlzY3VpdF90b2tlbhgBIAEoDBIVCg1lcnJvcl9tZXNzYWdlGAIgASgJEiAKGGNvbnRyb2xfcGxhbmVfcHVibGljX2tleRgDIAEoDBIYChByb3V0ZXJfYWRkcmVzc2VzGAQgAygJEi8KC2V4cGlyZV90aW1lGAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCKXAgoWQm9vdHN0cmFwRW5yb2xsUmVxdWVzdBIXCg9ib290c3RyYXBfdG9rZW4YASABKAkSDwoHcGVlcl9pZBgCIAEoCRISCgpwdWJsaWNfa2V5GAMgASgMEhYKDnJlcXVlc3RlZF9yb2xlGAQgASgJEkAKBmxhYmVscxgFIAMoCzIwLmFnZW50bWVzaC52MS5Cb290c3RyYXBFbnJvbGxSZXF1ZXN0LkxhYmVsc0VudHJ5EhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKDAgoXQm9vdHN0cmFwRW5yb2xsUmVzcG9uc2USLgoGc3RhdHVzGAEgASgOMh4uYWdlbnRtZXNoLnYxLkVucm9sbG1lbnRTdGF0dXMSFQoNYmlzY3VpdF90b2tlbhgCIAEoDBIdChVwb2xsX2ludGVydmFsX3NlY29uZHMYAyABKAUSFQoNZXJyb3JfbWVzc2FnZRgEIAEoCRIgChhjb250cm9sX3BsYW5lX3B1YmxpY19rZXkYBSABKAwSGAoQcm91dGVyX2FkZHJlc3NlcxgGIAMoCRIvCgtleHBpcmVfdGltZRgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiWQoLU2VydmljZUluZm8SJwoEdHlwZRgBIAEoDjIZLmFnZW50bWVzaC52MS5TZXJ2aWNlVHlwZRIMCgRuYW1lGAIgASgJEhMKC2Rlc2NyaXB0aW9uGAMgASgJIoEBCg5Db21tYW5kQmFja2VuZBIPCgdjb21tYW5kGAEgAygJEjIKA2VudhgCIAMoCzIlLmFnZW50bWVzaC52MS5Db21tYW5kQmFja2VuZC5FbnZFbnRyeRoqCghFbnZFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIpYBChZSZWdpc3RlclNlcnZpY2VSZXF1ZXN0EioKB3NlcnZpY2UYASABKAsyGS5hZ2VudG1lc2gudjEuU2VydmljZUluZm8SFAoKdGFyZ2V0X3VybBgCIAEoCUgAEi8KB2NvbW1hbmQYAyABKAsyHC5hZ2VudG1lc2gudjEuQ29tbWFuZEJhY2tlbmRIAEIJCgdiYWNrZW5kImkKEkRpc2NvdmVyZWRQcm92aWRlchIPCgdwZWVyX2lkGAEgASgJEhcKD2xvY2FsX3Byb3h5X3VybBgCIAEoCRIQCghzcnZfbmFtZRgDIAEoCRIXCg9zcnZfZGVzY3JpcHRpb24YBCABKAki6AEKGENvbnRyb2xQbGFuZUluZm9SZXNwb25zZRITCgtvaWRjX2lzc3VlchgBIAEoCRIRCgljbGllbnRfaWQYAiABKAkSEAoIYXVkaWVuY2UYAyABKAkSGAoQcm91dGVyX2FkZHJlc3NlcxgEIAMoCRIXCg9iYW5uZWRfcGVlcl9pZHMYBSADKAkSKQoHcm91dGVycxgGIAMoCzIYLmFnZW50bWVzaC52MS5Sb3V0ZXJJbmZvEjQKCWRpcmVjdG9yeRgHIAEoCzIhLmFnZW50bWVzaC52MS5EaXJlY3RvcnlQYXJhbWV0ZXJzIpABChNEaXJlY3RvcnlQYXJhbWV0ZXJzEhMKC3JlcGxpY2F0aW9uGAEgASgFEjUKEnJlcHJvdmlkZV9pbnRlcnZhbBgCIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbhItCgpyZWNvcmRfdHRsGAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uIvsBChBEaXJlY3RvcnlSZXF1ZXN0EjEKB3Byb3ZpZGUYASABKAsyHi5hZ2VudG1lc2gudjEuRGlyZWN0b3J5UHJvdmlkZUgAEj4KDmZpbmRfcHJvdmlkZXJzGAIgASgLMiQuYWdlbnRtZXNoLnYxLkRpcmVjdG9yeUZpbmRQcm92aWRlcnNIABI0CglmaW5kX3BlZXIYAyABKAsyHy5hZ2VudG1lc2gudjEuRGlyZWN0b3J5RmluZFBlZXJIABIzCgh3aXRoZHJhdxgEIAEoCzIfLmFnZW50bWVzaC52MS5EaXJlY3RvcnlXaXRoZHJhd0gAQgkKB3JlcXVlc3QiUQoQRGlyZWN0b3J5UHJvdmlkZRILCgNrZXkYASABKAwSDQoFYWRkcnMYAiADKAkSEAoIcHJvdmlkZXIYAyABKAkSDwoHc2VydmljZRgEIAEoCSIyChFEaXJlY3RvcnlXaXRoZHJhdxILCgNrZXkYASABKAwSEAoIcHJvdmlkZXIYAiABKAkiNAoWRGlyZWN0b3J5RmluZFByb3ZpZGVycxILCgNrZXkYASABKAwSDQoFbGltaXQYAiABKA0iJAoRRGlyZWN0b3J5RmluZFBlZXISDwoHcGVlcl9pZBgBIAEoCSJ3ChFEaXJlY3RvcnlSZXNwb25zZRIrCglwcm92aWRlcnMYASADKAsyGC5hZ2VudG1lc2gudjEuUGVlclJlY29yZBImCgRwZWVyGAIgASgLMhguYWdlbnRtZXNoLnYxLlBlZXJSZWNvcmQSDQoFZXJyb3IYAyABKAkiLAoKUGVlclJlY29yZBIPCgdwZWVyX2lkGAEgASgJEg0KBWFkZHJzGAIgAygJIsQBCgpSb3V0ZXJJbmZvEg8KB3BlZXJfaWQYASABKAkSEQoJYWRkcmVzc2VzGAIgAygJEjQKBmxhYmVscxgDIAMoCzIkLmFnZW50bWVzaC52MS5Sb3V0ZXJJbmZvLkxhYmVsc0VudHJ5EhMKC2Nvbm5lY3Rpb25zGAQgASgFEhgKEGNvbm5lY3Rpb25fbGltaXQYBSABKAUaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKDAgoSUm91dGVyTGVhc2VSZXF1ZXN0Eg8KB3BlZXJfaWQYASABKAkSEQoJYWRkcmVzc2VzGAIgAygJEg8KB2Jpc2N1aXQYAyABKAwSFwoPY29ubmVjdGVkX3BlZXJzGAQgAygJEhAKCGRodF9zaXplGAUgASgFEhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwSJgoDdHRsGAggASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uEhMKC2Nvbm5lY3Rpb25zGAkgASgFEhgKEGNvbm5lY3Rpb25fbGltaXQYCiABKAUiZgoTUm91dGVyTGVhc2VSZXNwb25zZRIPCgdzdWNjZXNzGAEgASgIEg0KBWVycm9yGAIgASgJEi8KC2V4cGlyZV90aW1lGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCK9AQoKUG9saWN5Um9sZRIMCgRuYW1lGAEgASgJEhcKD2FsbG93ZWRfdGFyZ2V0cxgCIAMoCRIYChBhbGxvd2VkX3NlcnZpY2VzGAMgAygJEhYKDmN1c3RvbV9kYXRhbG9nGAQgAygJEhYKDmFsbG93ZWRfbGFiZWxzGAUgAygJEiUKBGh0dHAYBiADKAsyFy5hZ2VudG1lc2gudjEuSFRUUEdyYW50EhcKD2FsbG93ZWRfcHVibGlzaBgHIAMoCSI8CglIVFRQR3JhbnQSDwoHc2VydmljZRgBIAEoCRIPCgdtZXRob2RzGAIgAygJEg0KBXBhdGhzGAMgAygJIqECChFFZ3Jlc3NEZXN0aW5hdGlvbhIMCgRuYW1lGAEgASgJEhIKCnRhcmdldF91cmwYAiABKAkSEgoKY3JlZGVudGlhbBgDIAEoCRIRCglzZXJ2ZWRfYnkYBCADKAkSLgoGYnJva2VyGAUgASgLMh4uYWdlbnRtZXNoLnYxLkNyZWRlbnRpYWxCcm9rZXISLAoKaW5zcGVjdGlvbhgGIAEoCzIYLmFnZW50bWVzaC52MS5JbnNwZWN0aW9uEiYKBG1vZGUYByABKA4yGC5hZ2VudG1lc2gudjEuRWdyZXNzTW9kZRINCgVwb3J0cxgIIAMoDRIVCg1wcmVzZXJ2ZV9ob3N0GAkgASgIEhcKD2ZvcndhcmRfY29udGV4dBgKIAEoCCI5CgpJbnNwZWN0aW9uEisKCmluc3BlY3RvcnMYASADKAsyFy5hZ2VudG1lc2gudjEuSW5zcGVjdG9yIm8KCUluc3BlY3RvchIvCgttb2RlbF9hcm1vchgBIAEoCzIYLmFnZW50bWVzaC52MS5Nb2RlbEFybW9ySAASKQoIZXh0X3Byb2MYAiABKAsyFS5hZ2VudG1lc2gudjEuRXh0UHJvY0gAQgYKBGtpbmQikQEKCk1vZGVsQXJtb3ISEAoIdGVtcGxhdGUYASABKAkSMgoIcmVzcG9uc2UYAiABKA4yIC5hZ2VudG1lc2gudjEuUmVzcG9uc2VJbnNwZWN0aW9uEhEKCWZhaWxfb3BlbhgDIAEoCBIqCgd0aW1lb3V0GAQgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uIogCCgdFeHRQcm9jEg4KBnRhcmdldBgBIAEoCRIKCgJjYRgCIAEoCRIaChJjbGllbnRfY2VydGlmaWNhdGUYAyABKAkSPAoPcHJvY2Vzc2luZ19tb2RlGAQgASgLMiMuYWdlbnRtZXNoLnYxLkV4dFByb2NQcm9jZXNzaW5nTW9kZRIbChNhbGxvd19tb2RlX292ZXJyaWRlGAUgASgIEjIKD21lc3NhZ2VfdGltZW91dBgGIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbhIaChJmYWlsdXJlX21vZGVfYWxsb3cYByABKAgSGgoSbWF4X2J1ZmZlcmVkX2J5dGVzGAggASgNIv8EChVFeHRQcm9jUHJvY2Vzc2luZ01vZGUSSwoTcmVxdWVzdF9oZWFkZXJfbW9kZRgBIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJMChRyZXNwb25zZV9oZWFkZXJfbW9kZRgCIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJHChFyZXF1ZXN0X2JvZHlfbW9kZRgDIAEoDjIsLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuQm9keU1vZGUSSAoScmVzcG9uc2VfYm9keV9tb2RlGAQgASgOMiwuYWdlbnRtZXNoLnYxLkV4dFByb2NQcm9jZXNzaW5nTW9kZS5Cb2R5TW9kZRJMChRyZXF1ZXN0X3RyYWlsZXJfbW9kZRgFIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJNChVyZXNwb25zZV90cmFpbGVyX21vZGUYBiABKA4yLi5hZ2VudG1lc2gudjEuRXh0UHJvY1Byb2Nlc3NpbmdNb2RlLkhlYWRlck1vZGUiOQoKSGVhZGVyTW9kZRIXChNIRUFERVJfTU9ERV9ERUZBVUxUEAASCAoEU0VORBABEggKBFNLSVAQAiJgCghCb2R5TW9kZRIICgROT05FEAASDAoIU1RSRUFNRUQQARIMCghCVUZGRVJFRBACEhQKEEJVRkZFUkVEX1BBUlRJQUwQAxIYChRGVUxMX0RVUExFWF9TVFJFQU1FRBAEIuEBChBDcmVkZW50aWFsQnJva2VyEhcKDXN0YXRpY19zZWNyZXQYASABKAlIABI3Cg9vaWRjX2ZlZGVyYXRpb24YAiABKAsyHC5hZ2VudG1lc2gudjEuT0lEQ0ZlZGVyYXRpb25IABI2Cg9hd3NfYXNzdW1lX3JvbGUYAyABKAsyGy5hZ2VudG1lc2gudjEuQVdTQXNzdW1lUm9sZUgAEjsKEXBsYXRmb3JtX2lkZW50aXR5GAQgASgLMh4uYWdlbnRtZXNoLnYxLlBsYXRmb3JtSWRlbnRpdHlIAEIGCgRraW5kIl8KDk9JRENGZWRlcmF0aW9uEhYKDnRva2VuX2VuZHBvaW50GAEgASgJEhAKCGF1ZGllbmNlGAIgASgJEhMKC2ltcGVyc29uYXRlGAMgASgJEg4KBnNjb3BlcxgEIAMoCSI5Cg1BV1NBc3N1bWVSb2xlEhAKCHJvbGVfYXJuGAEgASgJEhYKDnNlc3Npb25fcG9saWN5GAIgASgJIiIKEFBsYXRmb3JtSWRlbnRpdHkSDgoGc2NvcGVzGAEgAygJIi4KDVBvbGljeUJpbmRpbmcSDAoEcm9sZRgBIAEoCRIPCgdtZW1iZXJzGAIgAygJIpcBCgxQb2xpY3lDb25maWcSJwoFcm9sZXMYASADKAsyGC5hZ2VudG1lc2gudjEuUG9saWN5Um9sZRItCghiaW5kaW5ncxgCIAMoCzIbLmFnZW50bWVzaC52MS5Qb2xpY3lCaW5kaW5nEi8KBmVncmVzcxgDIAMoCzIfLmFnZW50bWVzaC52MS5FZ3Jlc3NEZXN0aW5hdGlvbiIYChZQb2xpY3lDb25maWdHZXRSZXF1ZXN0IjAKF1BvbGljeUNvbmZpZ0dldFJlc3BvbnNlEhUKDWRhdGFsb2dfcnVsZXMYASADKAkiPAoaUG9saWN5Q29uZmlnVXBkYXRlUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCBINCgVlcnJvchgCIAEoCSIaChhFZ3Jlc3NBc3NpZ25tZW50c1JlcXVlc3QiTAoZRWdyZXNzQXNzaWdubWVudHNSZXNwb25zZRIvCgZlZ3Jlc3MYASADKAsyHy5hZ2VudG1lc2gudjEuRWdyZXNzRGVzdGluYXRpb24iZgoMS2V5c1Jlc3BvbnNlEhMKC3B1YmxpY19rZXlzGAEgAygMEi0KCXNpZ25fdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASEgoKc2lnbmF0dXJlcxgDIAMoDCJrChNUb2tlblJlZnJlc2hSZXF1ZXN0EhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYASABKAwSGQoRY2hhbGxlbmdlX3VuaXhfbXMYAiABKAMSDwoHcGVlcl9pZBgDIAEoCRILCgNqd3QYBCABKAkidQoUVG9rZW5SZWZyZXNoUmVzcG9uc2USFQoNYmlzY3VpdF90b2tlbhgBIAEoDBIvCgtleHBpcmVfdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASFQoNZXJyb3JfbWVzc2FnZRgDIAEoCSJAChFOb2RlQ2F0YWxvZ1JlcG9ydBIrCghzZXJ2aWNlcxgBIAMoCzIZLmFnZW50bWVzaC52MS5TZXJ2aWNlSW5mbyIlChJUb2tlblJldm9rZVJlcXVlc3QSDwoHcGVlcl9pZBgBIAEoCSI1ChNUb2tlblJldm9rZVJlc3BvbnNlEg8KB3N1Y2Nlc3MYASABKAgSDQoFZXJyb3IYAiABKAkilgEKG0Jvb3RzdHJhcFRva2VuQ3JlYXRlUmVxdWVzdBIMCgRyb2xlGAEgASgJEhAKCG93bmVyX2lkGAIgASgJEhEKCXR0bF9ob3VycxgDIAEoBRISCgptYXhfdXNhZ2VzGAQgASgFEhMKC2Rlc2NyaXB0aW9uGAUgASgJEhsKE2F1dG9ub21vdXNfcmVjb3ZlcnkYBiABKAgiigEKHEJvb3RzdHJhcFRva2VuQ3JlYXRlUmVzcG9uc2USCgoCaWQYASABKAkSDQoFdG9rZW4YAiABKAkSDAoEcm9sZRgDIAEoCRIQCghvd25lcl9pZBgEIAEoCRIvCgtleHBpcmVfdGltZRgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiqwIKDkJvb3RzdHJhcFRva2VuEgoKAmlkGAEgASgJEgwKBHJvbGUYAiABKAkSEAoIb3duZXJfaWQYAyABKAkSEgoKbWF4X3VzYWdlcxgEIAEoBRIUCgx1c2FnZXNfY291bnQYBSABKAUSEwoLZGVzY3JpcHRpb24YBiABKAkSLwoLY3JlYXRlX3RpbWUYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi8KC2V4cGlyZV90aW1lGAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIvCgtyZXZva2VfdGltZRgJIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGwoTYXV0b25vbW91c19yZWNvdmVyeRgKIAEoCCJKChpCb290c3RyYXBUb2tlbkxpc3RSZXNwb25zZRIsCgZ0b2tlbnMYASADKAsyHC5hZ2VudG1lc2gudjEuQm9vdHN0cmFwVG9rZW4i1gIKEUVucm9sbG1lbnRSZXF1ZXN0EgoKAmlkGAEgASgJEg8KB3BlZXJfaWQYAiABKAkSEAoIdG9rZW5faWQYAyABKAkSLgoGc3RhdHVzGAQgASgOMh4uYWdlbnRtZXNoLnYxLkVucm9sbG1lbnRTdGF0dXMSOwoGbGFiZWxzGAUgAygLMisuYWdlbnRtZXNoLnYxLkVucm9sbG1lbnRSZXF1ZXN0LkxhYmVsc0VudHJ5Ei8KC2NyZWF0ZV90aW1lGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIwCgxyZXNvbHZlX3RpbWUYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhMKC3Jlc29sdmVkX2J5GAggASgJGi0KC0xhYmVsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiUgodRW5yb2xsbWVudFJlcXVlc3RMaXN0UmVzcG9uc2USMQoIcmVxdWVzdHMYASADKAsyHy5hZ2VudG1lc2gudjEuRW5yb2xsbWVudFJlcXVlc3QicAoEVXNlchIKCgJpZBgBIAEoCRIOCgZpc3N1ZXIYAiABKAkSDQoFZW1haWwYAyABKAkSDAoEcm9sZRgEIAEoCRIvCgtjcmVhdGVfdGltZRgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAi4wIKDEVucm9sbGVkTm9kZRIPCgdwZWVyX2lkGAEgASgJEgwKBHJvbGUYAiABKAkSFwoPZW5yb2xsbWVudF90eXBlGAMgASgJEhMKC2NsYWltc19qc29uGAQgASgJEhAKCG93bmVyX2lkGAUgASgJEjYKBmxhYmVscxgGIAMoCzImLmFnZW50bWVzaC52MS5FbnJvbGxlZE5vZGUuTGFiZWxzRW50cnkSLwoLZW5yb2xsX3RpbWUYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi8KC2V4cGlyZV90aW1lGAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIOCgZiYW5uZWQYCSABKAgSGwoTYXV0b25vbW91c19yZWNvdmVyeRgKIAEoCBotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIsQBCgtSb3V0ZXJMZWFzZRIPCgdwZWVyX2lkGAEgASgJEhEKCWFkZHJlc3NlcxgCIAMoCRI1ChFsYXN0X3JlbmV3YWxfdGltZRgDIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLwoLZXhwaXJlX3RpbWUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhcKD2Nvbm5lY3RlZF9wZWVycxgFIAMoCRIQCghkaHRfc2l6ZRgGIAEoBSJsCgxOb2RlU2VydmljZXMSKwoIc2VydmljZXMYASADKAsyGS5hZ2VudG1lc2gudjEuU2VydmljZUluZm8SLwoLcmVwb3J0X3RpbWUYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wItsDChNBZG1pblN0YXR1c1Jlc3BvbnNlEiEKBXVzZXJzGAEgAygLMhIuYWdlbnRtZXNoLnYxLlVzZXISMQoOYWN0aXZlX3JvdXRlcnMYAiADKAsyGS5hZ2VudG1lc2gudjEuUm91dGVyTGVhc2USMgoOZW5yb2xsZWRfbm9kZXMYAyADKAsyGi5hZ2VudG1lc2gudjEuRW5yb2xsZWROb2RlEjwKE2Vucm9sbG1lbnRfcmVxdWVzdHMYBCADKAsyHy5hZ2VudG1lc2gudjEuRW5yb2xsbWVudFJlcXVlc3QSNgoQYm9vdHN0cmFwX3Rva2VucxgFIAMoCzIcLmFnZW50bWVzaC52MS5Cb290c3RyYXBUb2tlbhIqCgZwb2xpY3kYBiABKAsyGi5hZ2VudG1lc2gudjEuUG9saWN5Q29uZmlnEkgKDG5vZGVfY2F0YWxvZxgHIAMoCzIyLmFnZW50bWVzaC52MS5BZG1pblN0YXR1c1Jlc3BvbnNlLk5vZGVDYXRhbG9nRW50cnkaTgoQTm9kZUNhdGFsb2dFbnRyeRILCgNrZXkYASABKAkSKQoFdmFsdWUYAiABKAsyGi5hZ2VudG1lc2gudjEuTm9kZVNlcnZpY2VzOgI4ASKBAgoSVXNlclN0YXR1c1Jlc3BvbnNlEiAKBHVzZXIYASABKAsyEi5hZ2VudG1lc2gudjEuVXNlchIyCg5lbnJvbGxlZF9ub2RlcxgCIAMoCzIaLmFnZW50bWVzaC52MS5FbnJvbGxlZE5vZGUSNgoQYm9vdHN0cmFwX3Rva2VucxgDIAMoCzIcLmFnZW50bWVzaC52MS5Cb290c3RyYXBUb2tlbhIxCg5hY3RpdmVfcm91dGVycxgEIAMoCzIZLmFnZW50bWVzaC52MS5Sb3V0ZXJMZWFzZRIqCgZwb2xpY3kYBSABKAsyGi5hZ2VudG1lc2gudjEuUG9saWN5Q29uZmlnIuQBChhJZGVudGl0eUV2aWRlbmNlUmVzcG9uc2USDwoHcGVlcl9pZBgBIAEoCRIPCgdiaXNjdWl0GAIgASgMEjcKE2Jpc2N1aXRfZXhwaXJlX3RpbWUYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhkKEWNvbnRyb2xfcGxhbmVfdXJsGAQgASgJEiIKGnRydXN0ZWRfY29udHJvbF9wbGFuZV9rZXlzGAUgAygMEi4KCmNoZWNrX3RpbWUYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIsYCChRQZWVyRXZpZGVuY2VSZXNwb25zZRIPCgdwZWVyX2lkGAEgASgJEg8KB2Jpc2N1aXQYAiABKAwSFQoNdmVyaWZ5aW5nX2tleRgDIAEoDBINCgVyb2xlcxgEIAMoCRI+CgZsYWJlbHMYBSADKAsyLi5hZ2VudG1lc2gudjEuUGVlckV2aWRlbmNlUmVzcG9uc2UuTGFiZWxzRW50cnkSLwoLZXhwaXJlX3RpbWUYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhYKDnJldm9jYXRpb25faWRzGAcgAygJEi4KCmNoZWNrX3RpbWUYCCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wGi0KC0xhYmVsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEijAIKEE1lbWJlckNyZWRlbnRpYWwSGQoRY29udHJvbF9wbGFuZV91cmwYASABKAkSDwoHYmlzY3VpdBgCIAEoDBIvCgtleHBpcmVfdGltZRgDIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASNQoMdHJ1c3RlZF9rZXlzGAQgAygLMh8uYWdlbnRtZXNoLnYxLlRydXN0ZWRTaWduaW5nS2V5EhkKEWlzc3VlZF91bmRlcl9rZXlzGAUgAygMEhgKEHJvdXRlcl9hZGRyZXNzZXMYBiADKAkSLwoMb2lkY19zZXNzaW9uGAcgASgLMhkuYWdlbnRtZXNoLnYxLk9JRENTZXNzaW9uIlkKEVRydXN0ZWRTaWduaW5nS2V5EhIKCnB1YmxpY19rZXkYASABKAwSMAoMcmVjZWl2ZV90aW1lGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCJZCgtPSURDU2Vzc2lvbhIOCgZpc3N1ZXIYASABKAkSEQoJY2xpZW50X2lkGAIgASgJEhAKCGF1ZGllbmNlGAMgASgJEhUKDXJlZnJlc2hfdG9rZW4YBCABKAkikwEKFVRhc2tBdXRob3JpemF0aW9uUnVsZRIMCgRuYW1lGAEgASgJEhQKDGRpc3BsYXlfbmFtZRgCIAEoCRIlCgVydWxlcxgDIAMoCzIWLmFnZW50bWVzaC52MS5UYXNrUnVsZRIvCgtleHBpcmVfdGltZRgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAihAEKCFRhc2tSdWxlEhMKC2Rlc2NyaXB0aW9uGAEgASgJEhgKEGFsbG93ZWRfc2VydmljZXMYAiADKAkSLgoJb3BlcmF0aW9uGAMgASgLMhsuYWdlbnRtZXNoLnYxLlRhc2tPcGVyYXRpb24SGQoRYWxsb3dlZF9yZXNvdXJjZXMYBCADKAkicwoNVGFza09wZXJhdGlvbhIVCg1hbGxvd2VkX3Rvb2xzGAEgAygJEhcKD2FsbG93ZWRfbWV0aG9kcxgCIAMoCRIVCg1hbGxvd2VkX3BhdGhzGAMgAygJEhsKE2FsbG93ZWRfcGVybWlzc2lvbnMYBCADKAkiqwEKFFRva2VuRXhjaGFuZ2VSZXF1ZXN0EhUKDXN1YmplY3RfdG9rZW4YASABKAkSNgoJdGFza19ydWxlGAIgASgLMiMuYWdlbnRtZXNoLnYxLlRhc2tBdXRob3JpemF0aW9uUnVsZRIMCgRzZWFsGAMgASgIEhkKEWNoYWxsZW5nZV91bml4X21zGAQgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYBSABKAwifwoVVG9rZW5FeGNoYW5nZVJlc3BvbnNlEhUKDWJpc2N1aXRfdG9rZW4YASABKAwSLwoLZXhwaXJlX3RpbWUYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEg0KBXJvbGVzGAMgAygJEg8KB3N1YmplY3QYBCABKAkigQEKD1NUU1Rva2VuUmVxdWVzdBIPCgdiaXNjdWl0GAEgASgMEhMKC2Rlc3RpbmF0aW9uGAIgASgJEhAKCGF1ZGllbmNlGAMgASgJEhkKEWNoYWxsZW5nZV91bml4X21zGAQgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYBSABKAwigwEKEFNUU1Rva2VuUmVzcG9uc2USCwoDand0GAEgASgJEi8KC2V4cGlyZV90aW1lGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIPCgdzdWJqZWN0GAMgASgJEg0KBXJvbGVzGAQgAygJEhEKCXRhc2tfbmFtZRgFIAEoCSJGChNSZXZvY2F0aW9uc1Jlc3BvbnNlEhYKDnJldm9jYXRpb25faWRzGAEgAygJEhcKD2Jhbm5lZF9wZWVyX2lkcxgCIAMoCSqUAQoQRW5yb2xsbWVudFN0YXR1cxIhCh1FTlJPTExNRU5UX1NUQVRVU19VTlNQRUNJRklFRBAAEh0KGUVOUk9MTE1FTlRfU1RBVFVTX1BFTkRJTkcQARIeChpFTlJPTExNRU5UX1NUQVRVU19BUFBST1ZFRBACEh4KGkVOUk9MTE1FTlRfU1RBVFVTX1JFSkVDVEVEEAMqjAEKC1NlcnZpY2VUeXBlEhwKGFNFUlZJQ0VfVFlQRV9VTlNQRUNJRklFRBAAEhQKEFNFUlZJQ0VfVFlQRV9NQ1AQARIaChZTRVJWSUNFX1RZUEVfSU5GRVJFTkNFEAISFAoQU0VSVklDRV9UWVBFX0EyQRADEhcKE1NFUlZJQ0VfVFlQRV9FR1JFU1MQBCo3CgpFZ3Jlc3NNb2RlEhQKEEVHUkVTU19NT0RFX0hUVFAQABITCg9FR1JFU1NfTU9ERV9UQ1AQASpcChJSZXNwb25zZUluc3BlY3Rpb24SIAocUkVTUE9OU0VfSU5TUEVDVElPTl9CVUZGRVJFRBAAEiQKIFJFU1BPTlNFX0lOU1BFQ1RJT05fUkVRVUVTVF9PTkxZEAFCIVofZ2l0aHViLmNvbS9nb29nbGUvYWdlbnRtZXNoL2FwaWIGcHJvdG8z", [file_google_protobuf_duration, file_google_protobuf_timestamp]);
+  fileDesc("Cg9hZ2VudG1lc2gucHJvdG8SDGFnZW50bWVzaC52MSI0CglBdXRoRnJhbWUSDwoHYmlzY3VpdBgBIAEoDBIWCg50YXJnZXRfc2VydmljZRgCIAEoCSI/CgxBdXRoUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCBINCgVlcnJvchgCIAEoCRIPCgdiaXNjdWl0GAMgASgMIrEBCgxSb3V0ZXJHb0F3YXkSMQoGcmVhc29uGAEgASgOMiEuYWdlbnRtZXNoLnYxLlJvdXRlckdvQXdheS5SZWFzb24SLgoLcmV0cnlfYWZ0ZXIYAiABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb24iPgoGUmVhc29uEhYKElJFQVNPTl9VTlNQRUNJRklFRBAAEgwKCERSQUlOSU5HEAESDgoKT1ZFUkxPQURFRBACItwBCglNZXNoRXZlbnQSKgoEdHlwZRgBIAEoDjIcLmFnZW50bWVzaC52MS5NZXNoRXZlbnQuVHlwZRIPCgdwZWVyX2lkGAIgASgJEi4KCmV2ZW50X3RpbWUYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhYKDm5ld19wdWJsaWNfa2V5GAQgASgMEhEKCXNpZ25hdHVyZRgFIAEoDCI3CgRUeXBlEgoKBkJBTk5FRBAAEhAKDEtFWV9ST1RBVElPThABEhEKDVBPTElDWV9VUERBVEUQAiL5AQoNRW5yb2xsUmVxdWVzdBILCgNqd3QYASABKAkSDwoHcGVlcl9pZBgCIAEoCRISCgpwdWJsaWNfa2V5GAMgASgMEhYKDnJlcXVlc3RlZF9yb2xlGAQgASgJEjcKBmxhYmVscxgFIAMoCzInLmFnZW50bWVzaC52MS5FbnJvbGxSZXF1ZXN0LkxhYmVsc0VudHJ5EhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKrAQoORW5yb2xsUmVzcG9uc2USFQoNYmlzY3VpdF90b2tlbhgBIAEoDBIVCg1lcnJvcl9tZXNzYWdlGAIgASgJEiAKGGNvbnRyb2xfcGxhbmVfcHVibGljX2tleRgDIAEoDBIYChByb3V0ZXJfYWRkcmVzc2VzGAQgAygJEi8KC2V4cGlyZV90aW1lGAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCKXAgoWQm9vdHN0cmFwRW5yb2xsUmVxdWVzdBIXCg9ib290c3RyYXBfdG9rZW4YASABKAkSDwoHcGVlcl9pZBgCIAEoCRISCgpwdWJsaWNfa2V5GAMgASgMEhYKDnJlcXVlc3RlZF9yb2xlGAQgASgJEkAKBmxhYmVscxgFIAMoCzIwLmFnZW50bWVzaC52MS5Cb290c3RyYXBFbnJvbGxSZXF1ZXN0LkxhYmVsc0VudHJ5EhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKDAgoXQm9vdHN0cmFwRW5yb2xsUmVzcG9uc2USLgoGc3RhdHVzGAEgASgOMh4uYWdlbnRtZXNoLnYxLkVucm9sbG1lbnRTdGF0dXMSFQoNYmlzY3VpdF90b2tlbhgCIAEoDBIdChVwb2xsX2ludGVydmFsX3NlY29uZHMYAyABKAUSFQoNZXJyb3JfbWVzc2FnZRgEIAEoCRIgChhjb250cm9sX3BsYW5lX3B1YmxpY19rZXkYBSABKAwSGAoQcm91dGVyX2FkZHJlc3NlcxgGIAMoCRIvCgtleHBpcmVfdGltZRgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiWQoLU2VydmljZUluZm8SJwoEdHlwZRgBIAEoDjIZLmFnZW50bWVzaC52MS5TZXJ2aWNlVHlwZRIMCgRuYW1lGAIgASgJEhMKC2Rlc2NyaXB0aW9uGAMgASgJIoEBCg5Db21tYW5kQmFja2VuZBIPCgdjb21tYW5kGAEgAygJEjIKA2VudhgCIAMoCzIlLmFnZW50bWVzaC52MS5Db21tYW5kQmFja2VuZC5FbnZFbnRyeRoqCghFbnZFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIpYBChZSZWdpc3RlclNlcnZpY2VSZXF1ZXN0EioKB3NlcnZpY2UYASABKAsyGS5hZ2VudG1lc2gudjEuU2VydmljZUluZm8SFAoKdGFyZ2V0X3VybBgCIAEoCUgAEi8KB2NvbW1hbmQYAyABKAsyHC5hZ2VudG1lc2gudjEuQ29tbWFuZEJhY2tlbmRIAEIJCgdiYWNrZW5kImkKEkRpc2NvdmVyZWRQcm92aWRlchIPCgdwZWVyX2lkGAEgASgJEhcKD2xvY2FsX3Byb3h5X3VybBgCIAEoCRIQCghzcnZfbmFtZRgDIAEoCRIXCg9zcnZfZGVzY3JpcHRpb24YBCABKAki6AEKGENvbnRyb2xQbGFuZUluZm9SZXNwb25zZRITCgtvaWRjX2lzc3VlchgBIAEoCRIRCgljbGllbnRfaWQYAiABKAkSEAoIYXVkaWVuY2UYAyABKAkSGAoQcm91dGVyX2FkZHJlc3NlcxgEIAMoCRIXCg9iYW5uZWRfcGVlcl9pZHMYBSADKAkSKQoHcm91dGVycxgGIAMoCzIYLmFnZW50bWVzaC52MS5Sb3V0ZXJJbmZvEjQKCWRpcmVjdG9yeRgHIAEoCzIhLmFnZW50bWVzaC52MS5EaXJlY3RvcnlQYXJhbWV0ZXJzIpABChNEaXJlY3RvcnlQYXJhbWV0ZXJzEhMKC3JlcGxpY2F0aW9uGAEgASgFEjUKEnJlcHJvdmlkZV9pbnRlcnZhbBgCIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbhItCgpyZWNvcmRfdHRsGAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uIvsBChBEaXJlY3RvcnlSZXF1ZXN0EjEKB3Byb3ZpZGUYASABKAsyHi5hZ2VudG1lc2gudjEuRGlyZWN0b3J5UHJvdmlkZUgAEj4KDmZpbmRfcHJvdmlkZXJzGAIgASgLMiQuYWdlbnRtZXNoLnYxLkRpcmVjdG9yeUZpbmRQcm92aWRlcnNIABI0CglmaW5kX3BlZXIYAyABKAsyHy5hZ2VudG1lc2gudjEuRGlyZWN0b3J5RmluZFBlZXJIABIzCgh3aXRoZHJhdxgEIAEoCzIfLmFnZW50bWVzaC52MS5EaXJlY3RvcnlXaXRoZHJhd0gAQgkKB3JlcXVlc3QiUQoQRGlyZWN0b3J5UHJvdmlkZRILCgNrZXkYASABKAwSDQoFYWRkcnMYAiADKAkSEAoIcHJvdmlkZXIYAyABKAkSDwoHc2VydmljZRgEIAEoCSIyChFEaXJlY3RvcnlXaXRoZHJhdxILCgNrZXkYASABKAwSEAoIcHJvdmlkZXIYAiABKAkiNAoWRGlyZWN0b3J5RmluZFByb3ZpZGVycxILCgNrZXkYASABKAwSDQoFbGltaXQYAiABKA0iJAoRRGlyZWN0b3J5RmluZFBlZXISDwoHcGVlcl9pZBgBIAEoCSJ3ChFEaXJlY3RvcnlSZXNwb25zZRIrCglwcm92aWRlcnMYASADKAsyGC5hZ2VudG1lc2gudjEuUGVlclJlY29yZBImCgRwZWVyGAIgASgLMhguYWdlbnRtZXNoLnYxLlBlZXJSZWNvcmQSDQoFZXJyb3IYAyABKAkiLAoKUGVlclJlY29yZBIPCgdwZWVyX2lkGAEgASgJEg0KBWFkZHJzGAIgAygJIsQBCgpSb3V0ZXJJbmZvEg8KB3BlZXJfaWQYASABKAkSEQoJYWRkcmVzc2VzGAIgAygJEjQKBmxhYmVscxgDIAMoCzIkLmFnZW50bWVzaC52MS5Sb3V0ZXJJbmZvLkxhYmVsc0VudHJ5EhMKC2Nvbm5lY3Rpb25zGAQgASgFEhgKEGNvbm5lY3Rpb25fbGltaXQYBSABKAUaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKDAgoSUm91dGVyTGVhc2VSZXF1ZXN0Eg8KB3BlZXJfaWQYASABKAkSEQoJYWRkcmVzc2VzGAIgAygJEg8KB2Jpc2N1aXQYAyABKAwSFwoPY29ubmVjdGVkX3BlZXJzGAQgAygJEhAKCGRodF9zaXplGAUgASgFEhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwSJgoDdHRsGAggASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uEhMKC2Nvbm5lY3Rpb25zGAkgASgFEhgKEGNvbm5lY3Rpb25fbGltaXQYCiABKAUiZgoTUm91dGVyTGVhc2VSZXNwb25zZRIPCgdzdWNjZXNzGAEgASgIEg0KBWVycm9yGAIgASgJEi8KC2V4cGlyZV90aW1lGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCK9AQoKUG9saWN5Um9sZRIMCgRuYW1lGAEgASgJEhcKD2FsbG93ZWRfdGFyZ2V0cxgCIAMoCRIYChBhbGxvd2VkX3NlcnZpY2VzGAMgAygJEhYKDmN1c3RvbV9kYXRhbG9nGAQgAygJEhYKDmFsbG93ZWRfbGFiZWxzGAUgAygJEiUKBGh0dHAYBiADKAsyFy5hZ2VudG1lc2gudjEuSFRUUEdyYW50EhcKD2FsbG93ZWRfcHVibGlzaBgHIAMoCSI8CglIVFRQR3JhbnQSDwoHc2VydmljZRgBIAEoCRIPCgdtZXRob2RzGAIgAygJEg0KBXBhdGhzGAMgAygJIqECChFFZ3Jlc3NEZXN0aW5hdGlvbhIMCgRuYW1lGAEgASgJEhIKCnRhcmdldF91cmwYAiABKAkSEgoKY3JlZGVudGlhbBgDIAEoCRIRCglzZXJ2ZWRfYnkYBCADKAkSLgoGYnJva2VyGAUgASgLMh4uYWdlbnRtZXNoLnYxLkNyZWRlbnRpYWxCcm9rZXISLAoKaW5zcGVjdGlvbhgGIAEoCzIYLmFnZW50bWVzaC52MS5JbnNwZWN0aW9uEiYKBG1vZGUYByABKA4yGC5hZ2VudG1lc2gudjEuRWdyZXNzTW9kZRINCgVwb3J0cxgIIAMoDRIVCg1wcmVzZXJ2ZV9ob3N0GAkgASgIEhcKD2ZvcndhcmRfY29udGV4dBgKIAEoCCI5CgpJbnNwZWN0aW9uEisKCmluc3BlY3RvcnMYASADKAsyFy5hZ2VudG1lc2gudjEuSW5zcGVjdG9yIm8KCUluc3BlY3RvchIvCgttb2RlbF9hcm1vchgBIAEoCzIYLmFnZW50bWVzaC52MS5Nb2RlbEFybW9ySAASKQoIZXh0X3Byb2MYAiABKAsyFS5hZ2VudG1lc2gudjEuRXh0UHJvY0gAQgYKBGtpbmQikQEKCk1vZGVsQXJtb3ISEAoIdGVtcGxhdGUYASABKAkSMgoIcmVzcG9uc2UYAiABKA4yIC5hZ2VudG1lc2gudjEuUmVzcG9uc2VJbnNwZWN0aW9uEhEKCWZhaWxfb3BlbhgDIAEoCBIqCgd0aW1lb3V0GAQgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uIogCCgdFeHRQcm9jEg4KBnRhcmdldBgBIAEoCRIKCgJjYRgCIAEoCRIaChJjbGllbnRfY2VydGlmaWNhdGUYAyABKAkSPAoPcHJvY2Vzc2luZ19tb2RlGAQgASgLMiMuYWdlbnRtZXNoLnYxLkV4dFByb2NQcm9jZXNzaW5nTW9kZRIbChNhbGxvd19tb2RlX292ZXJyaWRlGAUgASgIEjIKD21lc3NhZ2VfdGltZW91dBgGIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbhIaChJmYWlsdXJlX21vZGVfYWxsb3cYByABKAgSGgoSbWF4X2J1ZmZlcmVkX2J5dGVzGAggASgNIv8EChVFeHRQcm9jUHJvY2Vzc2luZ01vZGUSSwoTcmVxdWVzdF9oZWFkZXJfbW9kZRgBIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJMChRyZXNwb25zZV9oZWFkZXJfbW9kZRgCIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJHChFyZXF1ZXN0X2JvZHlfbW9kZRgDIAEoDjIsLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuQm9keU1vZGUSSAoScmVzcG9uc2VfYm9keV9tb2RlGAQgASgOMiwuYWdlbnRtZXNoLnYxLkV4dFByb2NQcm9jZXNzaW5nTW9kZS5Cb2R5TW9kZRJMChRyZXF1ZXN0X3RyYWlsZXJfbW9kZRgFIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJNChVyZXNwb25zZV90cmFpbGVyX21vZGUYBiABKA4yLi5hZ2VudG1lc2gudjEuRXh0UHJvY1Byb2Nlc3NpbmdNb2RlLkhlYWRlck1vZGUiOQoKSGVhZGVyTW9kZRIXChNIRUFERVJfTU9ERV9ERUZBVUxUEAASCAoEU0VORBABEggKBFNLSVAQAiJgCghCb2R5TW9kZRIICgROT05FEAASDAoIU1RSRUFNRUQQARIMCghCVUZGRVJFRBACEhQKEEJVRkZFUkVEX1BBUlRJQUwQAxIYChRGVUxMX0RVUExFWF9TVFJFQU1FRBAEIuEBChBDcmVkZW50aWFsQnJva2VyEhcKDXN0YXRpY19zZWNyZXQYASABKAlIABI3Cg9vaWRjX2ZlZGVyYXRpb24YAiABKAsyHC5hZ2VudG1lc2gudjEuT0lEQ0ZlZGVyYXRpb25IABI2Cg9hd3NfYXNzdW1lX3JvbGUYAyABKAsyGy5hZ2VudG1lc2gudjEuQVdTQXNzdW1lUm9sZUgAEjsKEXBsYXRmb3JtX2lkZW50aXR5GAQgASgLMh4uYWdlbnRtZXNoLnYxLlBsYXRmb3JtSWRlbnRpdHlIAEIGCgRraW5kIl8KDk9JRENGZWRlcmF0aW9uEhYKDnRva2VuX2VuZHBvaW50GAEgASgJEhAKCGF1ZGllbmNlGAIgASgJEhMKC2ltcGVyc29uYXRlGAMgASgJEg4KBnNjb3BlcxgEIAMoCSI5Cg1BV1NBc3N1bWVSb2xlEhAKCHJvbGVfYXJuGAEgASgJEhYKDnNlc3Npb25fcG9saWN5GAIgASgJIiIKEFBsYXRmb3JtSWRlbnRpdHkSDgoGc2NvcGVzGAEgAygJIi4KDVBvbGljeUJpbmRpbmcSDAoEcm9sZRgBIAEoCRIPCgdtZW1iZXJzGAIgAygJIpcBCgxQb2xpY3lDb25maWcSJwoFcm9sZXMYASADKAsyGC5hZ2VudG1lc2gudjEuUG9saWN5Um9sZRItCghiaW5kaW5ncxgCIAMoCzIbLmFnZW50bWVzaC52MS5Qb2xpY3lCaW5kaW5nEi8KBmVncmVzcxgDIAMoCzIfLmFnZW50bWVzaC52MS5FZ3Jlc3NEZXN0aW5hdGlvbiIYChZQb2xpY3lDb25maWdHZXRSZXF1ZXN0IjAKF1BvbGljeUNvbmZpZ0dldFJlc3BvbnNlEhUKDWRhdGFsb2dfcnVsZXMYASADKAkiPAoaUG9saWN5Q29uZmlnVXBkYXRlUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCBINCgVlcnJvchgCIAEoCSIaChhFZ3Jlc3NBc3NpZ25tZW50c1JlcXVlc3QiTAoZRWdyZXNzQXNzaWdubWVudHNSZXNwb25zZRIvCgZlZ3Jlc3MYASADKAsyHy5hZ2VudG1lc2gudjEuRWdyZXNzRGVzdGluYXRpb24iZgoMS2V5c1Jlc3BvbnNlEhMKC3B1YmxpY19rZXlzGAEgAygMEi0KCXNpZ25fdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASEgoKc2lnbmF0dXJlcxgDIAMoDCJrChNUb2tlblJlZnJlc2hSZXF1ZXN0EhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYASABKAwSGQoRY2hhbGxlbmdlX3VuaXhfbXMYAiABKAMSDwoHcGVlcl9pZBgDIAEoCRILCgNqd3QYBCABKAkidQoUVG9rZW5SZWZyZXNoUmVzcG9uc2USFQoNYmlzY3VpdF90b2tlbhgBIAEoDBIvCgtleHBpcmVfdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASFQoNZXJyb3JfbWVzc2FnZRgDIAEoCSJAChFOb2RlQ2F0YWxvZ1JlcG9ydBIrCghzZXJ2aWNlcxgBIAMoCzIZLmFnZW50bWVzaC52MS5TZXJ2aWNlSW5mbyIlChJUb2tlblJldm9rZVJlcXVlc3QSDwoHcGVlcl9pZBgBIAEoCSI1ChNUb2tlblJldm9rZVJlc3BvbnNlEg8KB3N1Y2Nlc3MYASABKAgSDQoFZXJyb3IYAiABKAkilgEKG0Jvb3RzdHJhcFRva2VuQ3JlYXRlUmVxdWVzdBIMCgRyb2xlGAEgASgJEhAKCG93bmVyX2lkGAIgASgJEhEKCXR0bF9ob3VycxgDIAEoBRISCgptYXhfdXNhZ2VzGAQgASgFEhMKC2Rlc2NyaXB0aW9uGAUgASgJEhsKE2F1dG9ub21vdXNfcmVjb3ZlcnkYBiABKAgiigEKHEJvb3RzdHJhcFRva2VuQ3JlYXRlUmVzcG9uc2USCgoCaWQYASABKAkSDQoFdG9rZW4YAiABKAkSDAoEcm9sZRgDIAEoCRIQCghvd25lcl9pZBgEIAEoCRIvCgtleHBpcmVfdGltZRgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiqwIKDkJvb3RzdHJhcFRva2VuEgoKAmlkGAEgASgJEgwKBHJvbGUYAiABKAkSEAoIb3duZXJfaWQYAyABKAkSEgoKbWF4X3VzYWdlcxgEIAEoBRIUCgx1c2FnZXNfY291bnQYBSABKAUSEwoLZGVzY3JpcHRpb24YBiABKAkSLwoLY3JlYXRlX3RpbWUYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi8KC2V4cGlyZV90aW1lGAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIvCgtyZXZva2VfdGltZRgJIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGwoTYXV0b25vbW91c19yZWNvdmVyeRgKIAEoCCJKChpCb290c3RyYXBUb2tlbkxpc3RSZXNwb25zZRIsCgZ0b2tlbnMYASADKAsyHC5hZ2VudG1lc2gudjEuQm9vdHN0cmFwVG9rZW4i1gIKEUVucm9sbG1lbnRSZXF1ZXN0EgoKAmlkGAEgASgJEg8KB3BlZXJfaWQYAiABKAkSEAoIdG9rZW5faWQYAyABKAkSLgoGc3RhdHVzGAQgASgOMh4uYWdlbnRtZXNoLnYxLkVucm9sbG1lbnRTdGF0dXMSOwoGbGFiZWxzGAUgAygLMisuYWdlbnRtZXNoLnYxLkVucm9sbG1lbnRSZXF1ZXN0LkxhYmVsc0VudHJ5Ei8KC2NyZWF0ZV90aW1lGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIwCgxyZXNvbHZlX3RpbWUYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhMKC3Jlc29sdmVkX2J5GAggASgJGi0KC0xhYmVsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiUgodRW5yb2xsbWVudFJlcXVlc3RMaXN0UmVzcG9uc2USMQoIcmVxdWVzdHMYASADKAsyHy5hZ2VudG1lc2gudjEuRW5yb2xsbWVudFJlcXVlc3QicAoEVXNlchIKCgJpZBgBIAEoCRIOCgZpc3N1ZXIYAiABKAkSDQoFZW1haWwYAyABKAkSDAoEcm9sZRgEIAEoCRIvCgtjcmVhdGVfdGltZRgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAi4wIKDEVucm9sbGVkTm9kZRIPCgdwZWVyX2lkGAEgASgJEgwKBHJvbGUYAiABKAkSFwoPZW5yb2xsbWVudF90eXBlGAMgASgJEhMKC2NsYWltc19qc29uGAQgASgJEhAKCG93bmVyX2lkGAUgASgJEjYKBmxhYmVscxgGIAMoCzImLmFnZW50bWVzaC52MS5FbnJvbGxlZE5vZGUuTGFiZWxzRW50cnkSLwoLZW5yb2xsX3RpbWUYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi8KC2V4cGlyZV90aW1lGAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIOCgZiYW5uZWQYCSABKAgSGwoTYXV0b25vbW91c19yZWNvdmVyeRgKIAEoCBotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIsQBCgtSb3V0ZXJMZWFzZRIPCgdwZWVyX2lkGAEgASgJEhEKCWFkZHJlc3NlcxgCIAMoCRI1ChFsYXN0X3JlbmV3YWxfdGltZRgDIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLwoLZXhwaXJlX3RpbWUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhcKD2Nvbm5lY3RlZF9wZWVycxgFIAMoCRIQCghkaHRfc2l6ZRgGIAEoBSJsCgxOb2RlU2VydmljZXMSKwoIc2VydmljZXMYASADKAsyGS5hZ2VudG1lc2gudjEuU2VydmljZUluZm8SLwoLcmVwb3J0X3RpbWUYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wItsDChNBZG1pblN0YXR1c1Jlc3BvbnNlEiEKBXVzZXJzGAEgAygLMhIuYWdlbnRtZXNoLnYxLlVzZXISMQoOYWN0aXZlX3JvdXRlcnMYAiADKAsyGS5hZ2VudG1lc2gudjEuUm91dGVyTGVhc2USMgoOZW5yb2xsZWRfbm9kZXMYAyADKAsyGi5hZ2VudG1lc2gudjEuRW5yb2xsZWROb2RlEjwKE2Vucm9sbG1lbnRfcmVxdWVzdHMYBCADKAsyHy5hZ2VudG1lc2gudjEuRW5yb2xsbWVudFJlcXVlc3QSNgoQYm9vdHN0cmFwX3Rva2VucxgFIAMoCzIcLmFnZW50bWVzaC52MS5Cb290c3RyYXBUb2tlbhIqCgZwb2xpY3kYBiABKAsyGi5hZ2VudG1lc2gudjEuUG9saWN5Q29uZmlnEkgKDG5vZGVfY2F0YWxvZxgHIAMoCzIyLmFnZW50bWVzaC52MS5BZG1pblN0YXR1c1Jlc3BvbnNlLk5vZGVDYXRhbG9nRW50cnkaTgoQTm9kZUNhdGFsb2dFbnRyeRILCgNrZXkYASABKAkSKQoFdmFsdWUYAiABKAsyGi5hZ2VudG1lc2gudjEuTm9kZVNlcnZpY2VzOgI4ASKBAgoSVXNlclN0YXR1c1Jlc3BvbnNlEiAKBHVzZXIYASABKAsyEi5hZ2VudG1lc2gudjEuVXNlchIyCg5lbnJvbGxlZF9ub2RlcxgCIAMoCzIaLmFnZW50bWVzaC52MS5FbnJvbGxlZE5vZGUSNgoQYm9vdHN0cmFwX3Rva2VucxgDIAMoCzIcLmFnZW50bWVzaC52MS5Cb290c3RyYXBUb2tlbhIxCg5hY3RpdmVfcm91dGVycxgEIAMoCzIZLmFnZW50bWVzaC52MS5Sb3V0ZXJMZWFzZRIqCgZwb2xpY3kYBSABKAsyGi5hZ2VudG1lc2gudjEuUG9saWN5Q29uZmlnIlYKEE5vZGVMaXN0UmVzcG9uc2USKQoFbm9kZXMYASADKAsyGi5hZ2VudG1lc2gudjEuRW5yb2xsZWROb2RlEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCSLkAQoYSWRlbnRpdHlFdmlkZW5jZVJlc3BvbnNlEg8KB3BlZXJfaWQYASABKAkSDwoHYmlzY3VpdBgCIAEoDBI3ChNiaXNjdWl0X2V4cGlyZV90aW1lGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIZChFjb250cm9sX3BsYW5lX3VybBgEIAEoCRIiChp0cnVzdGVkX2NvbnRyb2xfcGxhbmVfa2V5cxgFIAMoDBIuCgpjaGVja190aW1lGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCLGAgoUUGVlckV2aWRlbmNlUmVzcG9uc2USDwoHcGVlcl9pZBgBIAEoCRIPCgdiaXNjdWl0GAIgASgMEhUKDXZlcmlmeWluZ19rZXkYAyABKAwSDQoFcm9sZXMYBCADKAkSPgoGbGFiZWxzGAUgAygLMi4uYWdlbnRtZXNoLnYxLlBlZXJFdmlkZW5jZVJlc3BvbnNlLkxhYmVsc0VudHJ5Ei8KC2V4cGlyZV90aW1lGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIWCg5yZXZvY2F0aW9uX2lkcxgHIAMoCRIuCgpjaGVja190aW1lGAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIowCChBNZW1iZXJDcmVkZW50aWFsEhkKEWNvbnRyb2xfcGxhbmVfdXJsGAEgASgJEg8KB2Jpc2N1aXQYAiABKAwSLwoLZXhwaXJlX3RpbWUYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjUKDHRydXN0ZWRfa2V5cxgEIAMoCzIfLmFnZW50bWVzaC52MS5UcnVzdGVkU2lnbmluZ0tleRIZChFpc3N1ZWRfdW5kZXJfa2V5cxgFIAMoDBIYChByb3V0ZXJfYWRkcmVzc2VzGAYgAygJEi8KDG9pZGNfc2Vzc2lvbhgHIAEoCzIZLmFnZW50bWVzaC52MS5PSURDU2Vzc2lvbiJZChFUcnVzdGVkU2lnbmluZ0tleRISCgpwdWJsaWNfa2V5GAEgASgMEjAKDHJlY2VpdmVfdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiWQoLT0lEQ1Nlc3Npb24SDgoGaXNzdWVyGAEgASgJEhEKCWNsaWVudF9pZBgCIAEoCRIQCghhdWRpZW5jZRgDIAEoCRIVCg1yZWZyZXNoX3Rva2VuGAQgASgJIpMBChVUYXNrQXV0aG9yaXphdGlvblJ1bGUSDAoEbmFtZRgBIAEoCRIUCgxkaXNwbGF5X25hbWUYAiABKAkSJQoFcnVsZXMYAyADKAsyFi5hZ2VudG1lc2gudjEuVGFza1J1bGUSLwoLZXhwaXJlX3RpbWUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIoQBCghUYXNrUnVsZRITCgtkZXNjcmlwdGlvbhgBIAEoCRIYChBhbGxvd2VkX3NlcnZpY2VzGAIgAygJEi4KCW9wZXJhdGlvbhgDIAEoCzIbLmFnZW50bWVzaC52MS5UYXNrT3BlcmF0aW9uEhkKEWFsbG93ZWRfcmVzb3VyY2VzGAQgAygJInMKDVRhc2tPcGVyYXRpb24SFQoNYWxsb3dlZF90b29scxgBIAMoCRIXCg9hbGxvd2VkX21ldGhvZHMYAiADKAkSFQoNYWxsb3dlZF9wYXRocxgDIAMoCRIbChNhbGxvd2VkX3Blcm1pc3Npb25zGAQgAygJIqsBChRUb2tlbkV4Y2hhbmdlUmVxdWVzdBIVCg1zdWJqZWN0X3Rva2VuGAEgASgJEjYKCXRhc2tfcnVsZRgCIAEoCzIjLmFnZW50bWVzaC52MS5UYXNrQXV0aG9yaXphdGlvblJ1bGUSDAoEc2VhbBgDIAEoCBIZChFjaGFsbGVuZ2VfdW5peF9tcxgEIAEoAxIbChNjaGFsbGVuZ2Vfc2lnbmF0dXJlGAUgASgMIn8KFVRva2VuRXhjaGFuZ2VSZXNwb25zZRIVCg1iaXNjdWl0X3Rva2VuGAEgASgMEi8KC2V4cGlyZV90aW1lGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBINCgVyb2xlcxgDIAMoCRIPCgdzdWJqZWN0GAQgASgJIoEBCg9TVFNUb2tlblJlcXVlc3QSDwoHYmlzY3VpdBgBIAEoDBITCgtkZXN0aW5hdGlvbhgCIAEoCRIQCghhdWRpZW5jZRgDIAEoCRIZChFjaGFsbGVuZ2VfdW5peF9tcxgEIAEoAxIbChNjaGFsbGVuZ2Vfc2lnbmF0dXJlGAUgASgMIoMBChBTVFNUb2tlblJlc3BvbnNlEgsKA2p3dBgBIAEoCRIvCgtleHBpcmVfdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASDwoHc3ViamVjdBgDIAEoCRINCgVyb2xlcxgEIAMoCRIRCgl0YXNrX25hbWUYBSABKAkiRgoTUmV2b2NhdGlvbnNSZXNwb25zZRIWCg5yZXZvY2F0aW9uX2lkcxgBIAMoCRIXCg9iYW5uZWRfcGVlcl9pZHMYAiADKAkqlAEKEEVucm9sbG1lbnRTdGF0dXMSIQodRU5ST0xMTUVOVF9TVEFUVVNfVU5TUEVDSUZJRUQQABIdChlFTlJPTExNRU5UX1NUQVRVU19QRU5ESU5HEAESHgoaRU5ST0xMTUVOVF9TVEFUVVNfQVBQUk9WRUQQAhIeChpFTlJPTExNRU5UX1NUQVRVU19SRUpFQ1RFRBADKowBCgtTZXJ2aWNlVHlwZRIcChhTRVJWSUNFX1RZUEVfVU5TUEVDSUZJRUQQABIUChBTRVJWSUNFX1RZUEVfTUNQEAESGgoWU0VSVklDRV9UWVBFX0lORkVSRU5DRRACEhQKEFNFUlZJQ0VfVFlQRV9BMkEQAxIXChNTRVJWSUNFX1RZUEVfRUdSRVNTEAQqNwoKRWdyZXNzTW9kZRIUChBFR1JFU1NfTU9ERV9IVFRQEAASEwoPRUdSRVNTX01PREVfVENQEAEqXAoSUmVzcG9uc2VJbnNwZWN0aW9uEiAKHFJFU1BPTlNFX0lOU1BFQ1RJT05fQlVGRkVSRUQQABIkCiBSRVNQT05TRV9JTlNQRUNUSU9OX1JFUVVFU1RfT05MWRABQiFaH2dpdGh1Yi5jb20vZ29vZ2xlL2FnZW50bWVzaC9hcGliBnByb3RvMw", [file_google_protobuf_duration, file_google_protobuf_timestamp]);
 
 /**
  * @generated from message agentmesh.v1.AuthFrame
@@ -2405,7 +2405,7 @@ export const NodeServicesSchema: GenMessage<NodeServices> = /*@__PURE__*/
 
 /**
  * AdminStatusResponse answers GET /admin/status: everything the console
- * shows an administrator.
+ * shows an administrator, except expired nodes (see GET /user/nodes).
  *
  * @generated from message agentmesh.v1.AdminStatusResponse
  */
@@ -2456,9 +2456,9 @@ export const AdminStatusResponseSchema: GenMessage<AdminStatusResponse> = /*@__P
   messageDesc(file_agentmesh, 59);
 
 /**
- * UserStatusResponse answers GET /user/status: the caller and what it owns.
- * The router fleet and the mesh policy describe the whole mesh and are set
- * for an administrator only.
+ * UserStatusResponse answers GET /user/status: the caller and what it owns,
+ * except expired nodes (see GET /user/nodes). The router fleet and the mesh
+ * policy describe the whole mesh and are set for an administrator only.
  *
  * @generated from message agentmesh.v1.UserStatusResponse
  */
@@ -2496,6 +2496,35 @@ export type UserStatusResponse = Message<"agentmesh.v1.UserStatusResponse"> & {
 export const UserStatusResponseSchema: GenMessage<UserStatusResponse> = /*@__PURE__*/
   messageDesc(file_agentmesh, 60);
 
+/**
+ * NodeListResponse answers GET /user/nodes: enrolled nodes, newest enrollment
+ * first, page_size (default 50, at most 200) at a time. state (admitted,
+ * expired or banned, repeatable) and role narrow the list. An administrator
+ * sees every owner's nodes and may pick one with owner_id; a user sees its own.
+ *
+ * @generated from message agentmesh.v1.NodeListResponse
+ */
+export type NodeListResponse = Message<"agentmesh.v1.NodeListResponse"> & {
+  /**
+   * @generated from field: repeated agentmesh.v1.EnrolledNode nodes = 1;
+   */
+  nodes: EnrolledNode[];
+
+  /**
+   * Pass as page_token for the next page; empty on the last page.
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+};
+
+/**
+ * Describes the message agentmesh.v1.NodeListResponse.
+ * Use `create(NodeListResponseSchema)` to create a new message.
+ */
+export const NodeListResponseSchema: GenMessage<NodeListResponse> = /*@__PURE__*/
+  messageDesc(file_agentmesh, 61);
+
 /**
  * @generated from message agentmesh.v1.IdentityEvidenceResponse
  */
@@ -2538,7 +2567,7 @@ export type IdentityEvidenceResponse = Message<"agentmesh.v1.IdentityEvidenceRes
  * Use `create(IdentityEvidenceResponseSchema)` to create a new message.
  */
 export const IdentityEvidenceResponseSchema: GenMessage<IdentityEvidenceResponse> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 61);
+  messageDesc(file_agentmesh, 62);
 
 /**
  * @generated from message agentmesh.v1.PeerEvidenceResponse
@@ -2594,7 +2623,7 @@ export type PeerEvidenceResponse = Message<"agentmesh.v1.PeerEvidenceResponse">
  * Use `create(PeerEvidenceResponseSchema)` to create a new message.
  */
 export const PeerEvidenceResponseSchema: GenMessage<PeerEvidenceResponse> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 62);
+  messageDesc(file_agentmesh, 63);
 
 /**
  * @generated from message agentmesh.v1.MemberCredential
@@ -2659,7 +2688,7 @@ export type MemberCredential = Message<"agentmesh.v1.MemberCredential"> & {
  * Use `create(MemberCredentialSchema)` to create a new message.
  */
 export const MemberCredentialSchema: GenMessage<MemberCredential> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 63);
+  messageDesc(file_agentmesh, 64);
 
 /**
  * @generated from message agentmesh.v1.TrustedSigningKey
@@ -2686,7 +2715,7 @@ export type TrustedSigningKey = Message<"agentmesh.v1.TrustedSigningKey"> & {
  * Use `create(TrustedSigningKeySchema)` to create a new message.
  */
 export const TrustedSigningKeySchema: GenMessage<TrustedSigningKey> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 64);
+  messageDesc(file_agentmesh, 65);
 
 /**
  * @generated from message agentmesh.v1.OIDCSession
@@ -2718,7 +2747,7 @@ export type OIDCSession = Message<"agentmesh.v1.OIDCSession"> & {
  * Use `create(OIDCSessionSchema)` to create a new message.
  */
 export const OIDCSessionSchema: GenMessage<OIDCSession> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 65);
+  messageDesc(file_agentmesh, 66);
 
 /**
  * TaskAuthorizationRule narrows a credential's authority for a specific task or
@@ -2762,7 +2791,7 @@ export type TaskAuthorizationRule = Message<"agentmesh.v1.TaskAuthorizationRule"
  * Use `create(TaskAuthorizationRuleSchema)` to create a new message.
  */
 export const TaskAuthorizationRuleSchema: GenMessage<TaskAuthorizationRule> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 66);
+  messageDesc(file_agentmesh, 67);
 
 /**
  * @generated from message agentmesh.v1.TaskRule
@@ -2806,7 +2835,7 @@ export type TaskRule = Message<"agentmesh.v1.TaskRule"> & {
  * Use `create(TaskRuleSchema)` to create a new message.
  */
 export const TaskRuleSchema: GenMessage<TaskRule> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 67);
+  messageDesc(file_agentmesh, 68);
 
 /**
  * @generated from message agentmesh.v1.TaskOperation
@@ -2848,7 +2877,7 @@ export type TaskOperation = Message<"agentmesh.v1.TaskOperation"> & {
  * Use `create(TaskOperationSchema)` to create a new message.
  */
 export const TaskOperationSchema: GenMessage<TaskOperation> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 68);
+  messageDesc(file_agentmesh, 69);
 
 /**
  * TokenExchangeRequest is the body of POST /token/exchange on the control
@@ -2906,7 +2935,7 @@ export type TokenExchangeRequest = Message<"agentmesh.v1.TokenExchangeRequest">
  * Use `create(TokenExchangeRequestSchema)` to create a new message.
  */
 export const TokenExchangeRequestSchema: GenMessage<TokenExchangeRequest> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 69);
+  messageDesc(file_agentmesh, 70);
 
 /**
  * @generated from message agentmesh.v1.TokenExchangeResponse
@@ -2938,7 +2967,7 @@ export type TokenExchangeResponse = Message<"agentmesh.v1.TokenExchangeResponse"
  * Use `create(TokenExchangeResponseSchema)` to create a new message.
  */
 export const TokenExchangeResponseSchema: GenMessage<TokenExchangeResponse> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 70);
+  messageDesc(file_agentmesh, 71);
 
 /**
  * STSTokenRequest is the body of POST /sts/token on the control plane: an
@@ -2992,7 +3021,7 @@ export type STSTokenRequest = Message<"agentmesh.v1.STSTokenRequest"> & {
  * Use `create(STSTokenRequestSchema)` to create a new message.
  */
 export const STSTokenRequestSchema: GenMessage<STSTokenRequest> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 71);
+  messageDesc(file_agentmesh, 72);
 
 /**
  * @generated from message agentmesh.v1.STSTokenResponse
@@ -3029,7 +3058,7 @@ export type STSTokenResponse = Message<"agentmesh.v1.STSTokenResponse"> & {
  * Use `create(STSTokenResponseSchema)` to create a new message.
  */
 export const STSTokenResponseSchema: GenMessage<STSTokenResponse> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 72);
+  messageDesc(file_agentmesh, 73);
 
 /**
  * RevocationsResponse answers GET /revocations on the control plane: the set of
@@ -3055,7 +3084,7 @@ export type RevocationsResponse = Message<"agentmesh.v1.RevocationsResponse"> &
  * Use `create(RevocationsResponseSchema)` to create a new message.
  */
 export const RevocationsResponseSchema: GenMessage<RevocationsResponse> = /*@__PURE__*/
-  messageDesc(file_agentmesh, 73);
+  messageDesc(file_agentmesh, 74);
 
 /**
  * @generated from enum agentmesh.v1.EnrollmentStatus
diff --git a/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.py b/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.py
index be4059d3..d1597202 100644
--- a/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.py
+++ b/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.py
@@ -15,7 +15,7 @@
 from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x0f\x61gentmesh.proto\x12\x0c\x61gentmesh.v1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"4\n\tAuthFrame\x12\x0f\n\x07\x62iscuit\x18\x01 \x01(\x0c\x12\x16\n\x0etarget_service\x18\x02 \x01(\t\"?\n\x0c\x41uthResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x03 \x01(\x0c\"\xb1\x01\n\x0cRouterGoAway\x12\x31\n\x06reason\x18\x01 \x01(\x0e\x32!.agentmesh.v1.RouterGoAway.Reason\x12.\n\x0bretry_after\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\">\n\x06Reason\x12\x16\n\x12REASON_UNSPECIFIED\x10\x00\x12\x0c\n\x08\x44RAINING\x10\x01\x12\x0e\n\nOVERLOADED\x10\x02\"\xdc\x01\n\tMeshEvent\x12*\n\x04type\x18\x01 \x01(\x0e\x32\x1c.agentmesh.v1.MeshEvent.Type\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12.\n\nevent_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x16\n\x0enew_public_key\x18\x04 \x01(\x0c\x12\x11\n\tsignature\x18\x05 \x01(\x0c\"7\n\x04Type\x12\n\n\x06\x42\x41NNED\x10\x00\x12\x10\n\x0cKEY_ROTATION\x10\x01\x12\x11\n\rPOLICY_UPDATE\x10\x02\"\xf9\x01\n\rEnrollRequest\x12\x0b\n\x03jwt\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x12\n\npublic_key\x18\x03 \x01(\x0c\x12\x16\n\x0erequested_role\x18\x04 \x01(\t\x12\x37\n\x06labels\x18\x05 \x03(\x0b\x32\'.agentmesh.v1.EnrollRequest.LabelsEntry\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xab\x01\n\x0e\x45nrollResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12 \n\x18\x63ontrol_plane_public_key\x18\x03 \x01(\x0c\x12\x18\n\x10router_addresses\x18\x04 \x03(\t\x12/\n\x0b\x65xpire_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x97\x02\n\x16\x42ootstrapEnrollRequest\x12\x17\n\x0f\x62ootstrap_token\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x12\n\npublic_key\x18\x03 \x01(\x0c\x12\x16\n\x0erequested_role\x18\x04 \x01(\t\x12@\n\x06labels\x18\x05 \x03(\x0b\x32\x30.agentmesh.v1.BootstrapEnrollRequest.LabelsEntry\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x83\x02\n\x17\x42ootstrapEnrollResponse\x12.\n\x06status\x18\x01 \x01(\x0e\x32\x1e.agentmesh.v1.EnrollmentStatus\x12\x15\n\rbiscuit_token\x18\x02 \x01(\x0c\x12\x1d\n\x15poll_interval_seconds\x18\x03 \x01(\x05\x12\x15\n\rerror_message\x18\x04 \x01(\t\x12 \n\x18\x63ontrol_plane_public_key\x18\x05 \x01(\x0c\x12\x18\n\x10router_addresses\x18\x06 \x03(\t\x12/\n\x0b\x65xpire_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"Y\n\x0bServiceInfo\x12\'\n\x04type\x18\x01 \x01(\x0e\x32\x19.agentmesh.v1.ServiceType\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x03 \x01(\t\"\x81\x01\n\x0e\x43ommandBackend\x12\x0f\n\x07\x63ommand\x18\x01 \x03(\t\x12\x32\n\x03\x65nv\x18\x02 \x03(\x0b\x32%.agentmesh.v1.CommandBackend.EnvEntry\x1a*\n\x08\x45nvEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x96\x01\n\x16RegisterServiceRequest\x12*\n\x07service\x18\x01 \x01(\x0b\x32\x19.agentmesh.v1.ServiceInfo\x12\x14\n\ntarget_url\x18\x02 \x01(\tH\x00\x12/\n\x07\x63ommand\x18\x03 \x01(\x0b\x32\x1c.agentmesh.v1.CommandBackendH\x00\x42\t\n\x07\x62\x61\x63kend\"i\n\x12\x44iscoveredProvider\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x17\n\x0flocal_proxy_url\x18\x02 \x01(\t\x12\x10\n\x08srv_name\x18\x03 \x01(\t\x12\x17\n\x0fsrv_description\x18\x04 \x01(\t\"\xe8\x01\n\x18\x43ontrolPlaneInfoResponse\x12\x13\n\x0boidc_issuer\x18\x01 \x01(\t\x12\x11\n\tclient_id\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x18\n\x10router_addresses\x18\x04 \x03(\t\x12\x17\n\x0f\x62\x61nned_peer_ids\x18\x05 \x03(\t\x12)\n\x07routers\x18\x06 \x03(\x0b\x32\x18.agentmesh.v1.RouterInfo\x12\x34\n\tdirectory\x18\x07 \x01(\x0b\x32!.agentmesh.v1.DirectoryParameters\"\x90\x01\n\x13\x44irectoryParameters\x12\x13\n\x0breplication\x18\x01 \x01(\x05\x12\x35\n\x12reprovide_interval\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12-\n\nrecord_ttl\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\"\xfb\x01\n\x10\x44irectoryRequest\x12\x31\n\x07provide\x18\x01 \x01(\x0b\x32\x1e.agentmesh.v1.DirectoryProvideH\x00\x12>\n\x0e\x66ind_providers\x18\x02 \x01(\x0b\x32$.agentmesh.v1.DirectoryFindProvidersH\x00\x12\x34\n\tfind_peer\x18\x03 \x01(\x0b\x32\x1f.agentmesh.v1.DirectoryFindPeerH\x00\x12\x33\n\x08withdraw\x18\x04 \x01(\x0b\x32\x1f.agentmesh.v1.DirectoryWithdrawH\x00\x42\t\n\x07request\"Q\n\x10\x44irectoryProvide\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\r\n\x05\x61\x64\x64rs\x18\x02 \x03(\t\x12\x10\n\x08provider\x18\x03 \x01(\t\x12\x0f\n\x07service\x18\x04 \x01(\t\"2\n\x11\x44irectoryWithdraw\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\x10\n\x08provider\x18\x02 \x01(\t\"4\n\x16\x44irectoryFindProviders\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\r\n\x05limit\x18\x02 \x01(\r\"$\n\x11\x44irectoryFindPeer\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\"w\n\x11\x44irectoryResponse\x12+\n\tproviders\x18\x01 \x03(\x0b\x32\x18.agentmesh.v1.PeerRecord\x12&\n\x04peer\x18\x02 \x01(\x0b\x32\x18.agentmesh.v1.PeerRecord\x12\r\n\x05\x65rror\x18\x03 \x01(\t\",\n\nPeerRecord\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\r\n\x05\x61\x64\x64rs\x18\x02 \x03(\t\"\xc4\x01\n\nRouterInfo\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x34\n\x06labels\x18\x03 \x03(\x0b\x32$.agentmesh.v1.RouterInfo.LabelsEntry\x12\x13\n\x0b\x63onnections\x18\x04 \x01(\x05\x12\x18\n\x10\x63onnection_limit\x18\x05 \x01(\x05\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x83\x02\n\x12RouterLeaseRequest\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x0f\n\x07\x62iscuit\x18\x03 \x01(\x0c\x12\x17\n\x0f\x63onnected_peers\x18\x04 \x03(\t\x12\x10\n\x08\x64ht_size\x18\x05 \x01(\x05\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x12&\n\x03ttl\x18\x08 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x13\n\x0b\x63onnections\x18\t \x01(\x05\x12\x18\n\x10\x63onnection_limit\x18\n \x01(\x05\"f\n\x13RouterLeaseResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xbd\x01\n\nPolicyRole\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x17\n\x0f\x61llowed_targets\x18\x02 \x03(\t\x12\x18\n\x10\x61llowed_services\x18\x03 \x03(\t\x12\x16\n\x0e\x63ustom_datalog\x18\x04 \x03(\t\x12\x16\n\x0e\x61llowed_labels\x18\x05 \x03(\t\x12%\n\x04http\x18\x06 \x03(\x0b\x32\x17.agentmesh.v1.HTTPGrant\x12\x17\n\x0f\x61llowed_publish\x18\x07 \x03(\t\"<\n\tHTTPGrant\x12\x0f\n\x07service\x18\x01 \x01(\t\x12\x0f\n\x07methods\x18\x02 \x03(\t\x12\r\n\x05paths\x18\x03 \x03(\t\"\xa1\x02\n\x11\x45gressDestination\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x12\n\ntarget_url\x18\x02 \x01(\t\x12\x12\n\ncredential\x18\x03 \x01(\t\x12\x11\n\tserved_by\x18\x04 \x03(\t\x12.\n\x06\x62roker\x18\x05 \x01(\x0b\x32\x1e.agentmesh.v1.CredentialBroker\x12,\n\ninspection\x18\x06 \x01(\x0b\x32\x18.agentmesh.v1.Inspection\x12&\n\x04mode\x18\x07 \x01(\x0e\x32\x18.agentmesh.v1.EgressMode\x12\r\n\x05ports\x18\x08 \x03(\r\x12\x15\n\rpreserve_host\x18\t \x01(\x08\x12\x17\n\x0f\x66orward_context\x18\n \x01(\x08\"9\n\nInspection\x12+\n\ninspectors\x18\x01 \x03(\x0b\x32\x17.agentmesh.v1.Inspector\"o\n\tInspector\x12/\n\x0bmodel_armor\x18\x01 \x01(\x0b\x32\x18.agentmesh.v1.ModelArmorH\x00\x12)\n\x08\x65xt_proc\x18\x02 \x01(\x0b\x32\x15.agentmesh.v1.ExtProcH\x00\x42\x06\n\x04kind\"\x91\x01\n\nModelArmor\x12\x10\n\x08template\x18\x01 \x01(\t\x12\x32\n\x08response\x18\x02 \x01(\x0e\x32 .agentmesh.v1.ResponseInspection\x12\x11\n\tfail_open\x18\x03 \x01(\x08\x12*\n\x07timeout\x18\x04 \x01(\x0b\x32\x19.google.protobuf.Duration\"\x88\x02\n\x07\x45xtProc\x12\x0e\n\x06target\x18\x01 \x01(\t\x12\n\n\x02\x63\x61\x18\x02 \x01(\t\x12\x1a\n\x12\x63lient_certificate\x18\x03 \x01(\t\x12<\n\x0fprocessing_mode\x18\x04 \x01(\x0b\x32#.agentmesh.v1.ExtProcProcessingMode\x12\x1b\n\x13\x61llow_mode_override\x18\x05 \x01(\x08\x12\x32\n\x0fmessage_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x1a\n\x12\x66\x61ilure_mode_allow\x18\x07 \x01(\x08\x12\x1a\n\x12max_buffered_bytes\x18\x08 \x01(\r\"\xff\x04\n\x15\x45xtProcProcessingMode\x12K\n\x13request_header_mode\x18\x01 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12L\n\x14response_header_mode\x18\x02 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12G\n\x11request_body_mode\x18\x03 \x01(\x0e\x32,.agentmesh.v1.ExtProcProcessingMode.BodyMode\x12H\n\x12response_body_mode\x18\x04 \x01(\x0e\x32,.agentmesh.v1.ExtProcProcessingMode.BodyMode\x12L\n\x14request_trailer_mode\x18\x05 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12M\n\x15response_trailer_mode\x18\x06 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\"9\n\nHeaderMode\x12\x17\n\x13HEADER_MODE_DEFAULT\x10\x00\x12\x08\n\x04SEND\x10\x01\x12\x08\n\x04SKIP\x10\x02\"`\n\x08\x42odyMode\x12\x08\n\x04NONE\x10\x00\x12\x0c\n\x08STREAMED\x10\x01\x12\x0c\n\x08\x42UFFERED\x10\x02\x12\x14\n\x10\x42UFFERED_PARTIAL\x10\x03\x12\x18\n\x14\x46ULL_DUPLEX_STREAMED\x10\x04\"\xe1\x01\n\x10\x43redentialBroker\x12\x17\n\rstatic_secret\x18\x01 \x01(\tH\x00\x12\x37\n\x0foidc_federation\x18\x02 \x01(\x0b\x32\x1c.agentmesh.v1.OIDCFederationH\x00\x12\x36\n\x0f\x61ws_assume_role\x18\x03 \x01(\x0b\x32\x1b.agentmesh.v1.AWSAssumeRoleH\x00\x12;\n\x11platform_identity\x18\x04 \x01(\x0b\x32\x1e.agentmesh.v1.PlatformIdentityH\x00\x42\x06\n\x04kind\"_\n\x0eOIDCFederation\x12\x16\n\x0etoken_endpoint\x18\x01 \x01(\t\x12\x10\n\x08\x61udience\x18\x02 \x01(\t\x12\x13\n\x0bimpersonate\x18\x03 \x01(\t\x12\x0e\n\x06scopes\x18\x04 \x03(\t\"9\n\rAWSAssumeRole\x12\x10\n\x08role_arn\x18\x01 \x01(\t\x12\x16\n\x0esession_policy\x18\x02 \x01(\t\"\"\n\x10PlatformIdentity\x12\x0e\n\x06scopes\x18\x01 \x03(\t\".\n\rPolicyBinding\x12\x0c\n\x04role\x18\x01 \x01(\t\x12\x0f\n\x07members\x18\x02 \x03(\t\"\x97\x01\n\x0cPolicyConfig\x12\'\n\x05roles\x18\x01 \x03(\x0b\x32\x18.agentmesh.v1.PolicyRole\x12-\n\x08\x62indings\x18\x02 \x03(\x0b\x32\x1b.agentmesh.v1.PolicyBinding\x12/\n\x06\x65gress\x18\x03 \x03(\x0b\x32\x1f.agentmesh.v1.EgressDestination\"\x18\n\x16PolicyConfigGetRequest\"0\n\x17PolicyConfigGetResponse\x12\x15\n\rdatalog_rules\x18\x01 \x03(\t\"<\n\x1aPolicyConfigUpdateResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\"\x1a\n\x18\x45gressAssignmentsRequest\"L\n\x19\x45gressAssignmentsResponse\x12/\n\x06\x65gress\x18\x01 \x03(\x0b\x32\x1f.agentmesh.v1.EgressDestination\"f\n\x0cKeysResponse\x12\x13\n\x0bpublic_keys\x18\x01 \x03(\x0c\x12-\n\tsign_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x12\n\nsignatures\x18\x03 \x03(\x0c\"k\n\x13TokenRefreshRequest\x12\x1b\n\x13\x63hallenge_signature\x18\x01 \x01(\x0c\x12\x19\n\x11\x63hallenge_unix_ms\x18\x02 \x01(\x03\x12\x0f\n\x07peer_id\x18\x03 \x01(\t\x12\x0b\n\x03jwt\x18\x04 \x01(\t\"u\n\x14TokenRefreshResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x15\n\rerror_message\x18\x03 \x01(\t\"@\n\x11NodeCatalogReport\x12+\n\x08services\x18\x01 \x03(\x0b\x32\x19.agentmesh.v1.ServiceInfo\"%\n\x12TokenRevokeRequest\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\"5\n\x13TokenRevokeResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\"\x96\x01\n\x1b\x42ootstrapTokenCreateRequest\x12\x0c\n\x04role\x18\x01 \x01(\t\x12\x10\n\x08owner_id\x18\x02 \x01(\t\x12\x11\n\tttl_hours\x18\x03 \x01(\x05\x12\x12\n\nmax_usages\x18\x04 \x01(\x05\x12\x13\n\x0b\x64\x65scription\x18\x05 \x01(\t\x12\x1b\n\x13\x61utonomous_recovery\x18\x06 \x01(\x08\"\x8a\x01\n\x1c\x42ootstrapTokenCreateResponse\x12\n\n\x02id\x18\x01 \x01(\t\x12\r\n\x05token\x18\x02 \x01(\t\x12\x0c\n\x04role\x18\x03 \x01(\t\x12\x10\n\x08owner_id\x18\x04 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xab\x02\n\x0e\x42ootstrapToken\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0c\n\x04role\x18\x02 \x01(\t\x12\x10\n\x08owner_id\x18\x03 \x01(\t\x12\x12\n\nmax_usages\x18\x04 \x01(\x05\x12\x14\n\x0cusages_count\x18\x05 \x01(\x05\x12\x13\n\x0b\x64\x65scription\x18\x06 \x01(\t\x12/\n\x0b\x63reate_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0brevoke_time\x18\t \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x1b\n\x13\x61utonomous_recovery\x18\n \x01(\x08\"J\n\x1a\x42ootstrapTokenListResponse\x12,\n\x06tokens\x18\x01 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\"\xd6\x02\n\x11\x45nrollmentRequest\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x10\n\x08token_id\x18\x03 \x01(\t\x12.\n\x06status\x18\x04 \x01(\x0e\x32\x1e.agentmesh.v1.EnrollmentStatus\x12;\n\x06labels\x18\x05 \x03(\x0b\x32+.agentmesh.v1.EnrollmentRequest.LabelsEntry\x12/\n\x0b\x63reate_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x30\n\x0cresolve_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x13\n\x0bresolved_by\x18\x08 \x01(\t\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"R\n\x1d\x45nrollmentRequestListResponse\x12\x31\n\x08requests\x18\x01 \x03(\x0b\x32\x1f.agentmesh.v1.EnrollmentRequest\"p\n\x04User\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0e\n\x06issuer\x18\x02 \x01(\t\x12\r\n\x05\x65mail\x18\x03 \x01(\t\x12\x0c\n\x04role\x18\x04 \x01(\t\x12/\n\x0b\x63reate_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xe3\x02\n\x0c\x45nrolledNode\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0c\n\x04role\x18\x02 \x01(\t\x12\x17\n\x0f\x65nrollment_type\x18\x03 \x01(\t\x12\x13\n\x0b\x63laims_json\x18\x04 \x01(\t\x12\x10\n\x08owner_id\x18\x05 \x01(\t\x12\x36\n\x06labels\x18\x06 \x03(\x0b\x32&.agentmesh.v1.EnrolledNode.LabelsEntry\x12/\n\x0b\x65nroll_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0e\n\x06\x62\x61nned\x18\t \x01(\x08\x12\x1b\n\x13\x61utonomous_recovery\x18\n \x01(\x08\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xc4\x01\n\x0bRouterLease\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x35\n\x11last_renewal_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x17\n\x0f\x63onnected_peers\x18\x05 \x03(\t\x12\x10\n\x08\x64ht_size\x18\x06 \x01(\x05\"l\n\x0cNodeServices\x12+\n\x08services\x18\x01 \x03(\x0b\x32\x19.agentmesh.v1.ServiceInfo\x12/\n\x0breport_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xdb\x03\n\x13\x41\x64minStatusResponse\x12!\n\x05users\x18\x01 \x03(\x0b\x32\x12.agentmesh.v1.User\x12\x31\n\x0e\x61\x63tive_routers\x18\x02 \x03(\x0b\x32\x19.agentmesh.v1.RouterLease\x12\x32\n\x0e\x65nrolled_nodes\x18\x03 \x03(\x0b\x32\x1a.agentmesh.v1.EnrolledNode\x12<\n\x13\x65nrollment_requests\x18\x04 \x03(\x0b\x32\x1f.agentmesh.v1.EnrollmentRequest\x12\x36\n\x10\x62ootstrap_tokens\x18\x05 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\x12*\n\x06policy\x18\x06 \x01(\x0b\x32\x1a.agentmesh.v1.PolicyConfig\x12H\n\x0cnode_catalog\x18\x07 \x03(\x0b\x32\x32.agentmesh.v1.AdminStatusResponse.NodeCatalogEntry\x1aN\n\x10NodeCatalogEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12)\n\x05value\x18\x02 \x01(\x0b\x32\x1a.agentmesh.v1.NodeServices:\x02\x38\x01\"\x81\x02\n\x12UserStatusResponse\x12 \n\x04user\x18\x01 \x01(\x0b\x32\x12.agentmesh.v1.User\x12\x32\n\x0e\x65nrolled_nodes\x18\x02 \x03(\x0b\x32\x1a.agentmesh.v1.EnrolledNode\x12\x36\n\x10\x62ootstrap_tokens\x18\x03 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\x12\x31\n\x0e\x61\x63tive_routers\x18\x04 \x03(\x0b\x32\x19.agentmesh.v1.RouterLease\x12*\n\x06policy\x18\x05 \x01(\x0b\x32\x1a.agentmesh.v1.PolicyConfig\"\xe4\x01\n\x18IdentityEvidenceResponse\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12\x37\n\x13\x62iscuit_expire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x19\n\x11\x63ontrol_plane_url\x18\x04 \x01(\t\x12\"\n\x1atrusted_control_plane_keys\x18\x05 \x03(\x0c\x12.\n\ncheck_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xc6\x02\n\x14PeerEvidenceResponse\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12\x15\n\rverifying_key\x18\x03 \x01(\x0c\x12\r\n\x05roles\x18\x04 \x03(\t\x12>\n\x06labels\x18\x05 \x03(\x0b\x32..agentmesh.v1.PeerEvidenceResponse.LabelsEntry\x12/\n\x0b\x65xpire_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x16\n\x0erevocation_ids\x18\x07 \x03(\t\x12.\n\ncheck_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x8c\x02\n\x10MemberCredential\x12\x19\n\x11\x63ontrol_plane_url\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x0ctrusted_keys\x18\x04 \x03(\x0b\x32\x1f.agentmesh.v1.TrustedSigningKey\x12\x19\n\x11issued_under_keys\x18\x05 \x03(\x0c\x12\x18\n\x10router_addresses\x18\x06 \x03(\t\x12/\n\x0coidc_session\x18\x07 \x01(\x0b\x32\x19.agentmesh.v1.OIDCSession\"Y\n\x11TrustedSigningKey\x12\x12\n\npublic_key\x18\x01 \x01(\x0c\x12\x30\n\x0creceive_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"Y\n\x0bOIDCSession\x12\x0e\n\x06issuer\x18\x01 \x01(\t\x12\x11\n\tclient_id\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x15\n\rrefresh_token\x18\x04 \x01(\t\"\x93\x01\n\x15TaskAuthorizationRule\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x14\n\x0c\x64isplay_name\x18\x02 \x01(\t\x12%\n\x05rules\x18\x03 \x03(\x0b\x32\x16.agentmesh.v1.TaskRule\x12/\n\x0b\x65xpire_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x84\x01\n\x08TaskRule\x12\x13\n\x0b\x64\x65scription\x18\x01 \x01(\t\x12\x18\n\x10\x61llowed_services\x18\x02 \x03(\t\x12.\n\toperation\x18\x03 \x01(\x0b\x32\x1b.agentmesh.v1.TaskOperation\x12\x19\n\x11\x61llowed_resources\x18\x04 \x03(\t\"s\n\rTaskOperation\x12\x15\n\rallowed_tools\x18\x01 \x03(\t\x12\x17\n\x0f\x61llowed_methods\x18\x02 \x03(\t\x12\x15\n\rallowed_paths\x18\x03 \x03(\t\x12\x1b\n\x13\x61llowed_permissions\x18\x04 \x03(\t\"\xab\x01\n\x14TokenExchangeRequest\x12\x15\n\rsubject_token\x18\x01 \x01(\t\x12\x36\n\ttask_rule\x18\x02 \x01(\x0b\x32#.agentmesh.v1.TaskAuthorizationRule\x12\x0c\n\x04seal\x18\x03 \x01(\x08\x12\x19\n\x11\x63hallenge_unix_ms\x18\x04 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x05 \x01(\x0c\"\x7f\n\x15TokenExchangeResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\r\n\x05roles\x18\x03 \x03(\t\x12\x0f\n\x07subject\x18\x04 \x01(\t\"\x81\x01\n\x0fSTSTokenRequest\x12\x0f\n\x07\x62iscuit\x18\x01 \x01(\x0c\x12\x13\n\x0b\x64\x65stination\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x19\n\x11\x63hallenge_unix_ms\x18\x04 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x05 \x01(\x0c\"\x83\x01\n\x10STSTokenResponse\x12\x0b\n\x03jwt\x18\x01 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0f\n\x07subject\x18\x03 \x01(\t\x12\r\n\x05roles\x18\x04 \x03(\t\x12\x11\n\ttask_name\x18\x05 \x01(\t\"F\n\x13RevocationsResponse\x12\x16\n\x0erevocation_ids\x18\x01 \x03(\t\x12\x17\n\x0f\x62\x61nned_peer_ids\x18\x02 \x03(\t*\x94\x01\n\x10\x45nrollmentStatus\x12!\n\x1d\x45NROLLMENT_STATUS_UNSPECIFIED\x10\x00\x12\x1d\n\x19\x45NROLLMENT_STATUS_PENDING\x10\x01\x12\x1e\n\x1a\x45NROLLMENT_STATUS_APPROVED\x10\x02\x12\x1e\n\x1a\x45NROLLMENT_STATUS_REJECTED\x10\x03*\x8c\x01\n\x0bServiceType\x12\x1c\n\x18SERVICE_TYPE_UNSPECIFIED\x10\x00\x12\x14\n\x10SERVICE_TYPE_MCP\x10\x01\x12\x1a\n\x16SERVICE_TYPE_INFERENCE\x10\x02\x12\x14\n\x10SERVICE_TYPE_A2A\x10\x03\x12\x17\n\x13SERVICE_TYPE_EGRESS\x10\x04*7\n\nEgressMode\x12\x14\n\x10\x45GRESS_MODE_HTTP\x10\x00\x12\x13\n\x0f\x45GRESS_MODE_TCP\x10\x01*\\\n\x12ResponseInspection\x12 \n\x1cRESPONSE_INSPECTION_BUFFERED\x10\x00\x12$\n RESPONSE_INSPECTION_REQUEST_ONLY\x10\x01\x42!Z\x1fgithub.com/google/agentmesh/apib\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x0f\x61gentmesh.proto\x12\x0c\x61gentmesh.v1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"4\n\tAuthFrame\x12\x0f\n\x07\x62iscuit\x18\x01 \x01(\x0c\x12\x16\n\x0etarget_service\x18\x02 \x01(\t\"?\n\x0c\x41uthResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x03 \x01(\x0c\"\xb1\x01\n\x0cRouterGoAway\x12\x31\n\x06reason\x18\x01 \x01(\x0e\x32!.agentmesh.v1.RouterGoAway.Reason\x12.\n\x0bretry_after\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\">\n\x06Reason\x12\x16\n\x12REASON_UNSPECIFIED\x10\x00\x12\x0c\n\x08\x44RAINING\x10\x01\x12\x0e\n\nOVERLOADED\x10\x02\"\xdc\x01\n\tMeshEvent\x12*\n\x04type\x18\x01 \x01(\x0e\x32\x1c.agentmesh.v1.MeshEvent.Type\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12.\n\nevent_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x16\n\x0enew_public_key\x18\x04 \x01(\x0c\x12\x11\n\tsignature\x18\x05 \x01(\x0c\"7\n\x04Type\x12\n\n\x06\x42\x41NNED\x10\x00\x12\x10\n\x0cKEY_ROTATION\x10\x01\x12\x11\n\rPOLICY_UPDATE\x10\x02\"\xf9\x01\n\rEnrollRequest\x12\x0b\n\x03jwt\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x12\n\npublic_key\x18\x03 \x01(\x0c\x12\x16\n\x0erequested_role\x18\x04 \x01(\t\x12\x37\n\x06labels\x18\x05 \x03(\x0b\x32\'.agentmesh.v1.EnrollRequest.LabelsEntry\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xab\x01\n\x0e\x45nrollResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12 \n\x18\x63ontrol_plane_public_key\x18\x03 \x01(\x0c\x12\x18\n\x10router_addresses\x18\x04 \x03(\t\x12/\n\x0b\x65xpire_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x97\x02\n\x16\x42ootstrapEnrollRequest\x12\x17\n\x0f\x62ootstrap_token\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x12\n\npublic_key\x18\x03 \x01(\x0c\x12\x16\n\x0erequested_role\x18\x04 \x01(\t\x12@\n\x06labels\x18\x05 \x03(\x0b\x32\x30.agentmesh.v1.BootstrapEnrollRequest.LabelsEntry\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x83\x02\n\x17\x42ootstrapEnrollResponse\x12.\n\x06status\x18\x01 \x01(\x0e\x32\x1e.agentmesh.v1.EnrollmentStatus\x12\x15\n\rbiscuit_token\x18\x02 \x01(\x0c\x12\x1d\n\x15poll_interval_seconds\x18\x03 \x01(\x05\x12\x15\n\rerror_message\x18\x04 \x01(\t\x12 \n\x18\x63ontrol_plane_public_key\x18\x05 \x01(\x0c\x12\x18\n\x10router_addresses\x18\x06 \x03(\t\x12/\n\x0b\x65xpire_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"Y\n\x0bServiceInfo\x12\'\n\x04type\x18\x01 \x01(\x0e\x32\x19.agentmesh.v1.ServiceType\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x03 \x01(\t\"\x81\x01\n\x0e\x43ommandBackend\x12\x0f\n\x07\x63ommand\x18\x01 \x03(\t\x12\x32\n\x03\x65nv\x18\x02 \x03(\x0b\x32%.agentmesh.v1.CommandBackend.EnvEntry\x1a*\n\x08\x45nvEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x96\x01\n\x16RegisterServiceRequest\x12*\n\x07service\x18\x01 \x01(\x0b\x32\x19.agentmesh.v1.ServiceInfo\x12\x14\n\ntarget_url\x18\x02 \x01(\tH\x00\x12/\n\x07\x63ommand\x18\x03 \x01(\x0b\x32\x1c.agentmesh.v1.CommandBackendH\x00\x42\t\n\x07\x62\x61\x63kend\"i\n\x12\x44iscoveredProvider\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x17\n\x0flocal_proxy_url\x18\x02 \x01(\t\x12\x10\n\x08srv_name\x18\x03 \x01(\t\x12\x17\n\x0fsrv_description\x18\x04 \x01(\t\"\xe8\x01\n\x18\x43ontrolPlaneInfoResponse\x12\x13\n\x0boidc_issuer\x18\x01 \x01(\t\x12\x11\n\tclient_id\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x18\n\x10router_addresses\x18\x04 \x03(\t\x12\x17\n\x0f\x62\x61nned_peer_ids\x18\x05 \x03(\t\x12)\n\x07routers\x18\x06 \x03(\x0b\x32\x18.agentmesh.v1.RouterInfo\x12\x34\n\tdirectory\x18\x07 \x01(\x0b\x32!.agentmesh.v1.DirectoryParameters\"\x90\x01\n\x13\x44irectoryParameters\x12\x13\n\x0breplication\x18\x01 \x01(\x05\x12\x35\n\x12reprovide_interval\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12-\n\nrecord_ttl\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\"\xfb\x01\n\x10\x44irectoryRequest\x12\x31\n\x07provide\x18\x01 \x01(\x0b\x32\x1e.agentmesh.v1.DirectoryProvideH\x00\x12>\n\x0e\x66ind_providers\x18\x02 \x01(\x0b\x32$.agentmesh.v1.DirectoryFindProvidersH\x00\x12\x34\n\tfind_peer\x18\x03 \x01(\x0b\x32\x1f.agentmesh.v1.DirectoryFindPeerH\x00\x12\x33\n\x08withdraw\x18\x04 \x01(\x0b\x32\x1f.agentmesh.v1.DirectoryWithdrawH\x00\x42\t\n\x07request\"Q\n\x10\x44irectoryProvide\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\r\n\x05\x61\x64\x64rs\x18\x02 \x03(\t\x12\x10\n\x08provider\x18\x03 \x01(\t\x12\x0f\n\x07service\x18\x04 \x01(\t\"2\n\x11\x44irectoryWithdraw\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\x10\n\x08provider\x18\x02 \x01(\t\"4\n\x16\x44irectoryFindProviders\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\r\n\x05limit\x18\x02 \x01(\r\"$\n\x11\x44irectoryFindPeer\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\"w\n\x11\x44irectoryResponse\x12+\n\tproviders\x18\x01 \x03(\x0b\x32\x18.agentmesh.v1.PeerRecord\x12&\n\x04peer\x18\x02 \x01(\x0b\x32\x18.agentmesh.v1.PeerRecord\x12\r\n\x05\x65rror\x18\x03 \x01(\t\",\n\nPeerRecord\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\r\n\x05\x61\x64\x64rs\x18\x02 \x03(\t\"\xc4\x01\n\nRouterInfo\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x34\n\x06labels\x18\x03 \x03(\x0b\x32$.agentmesh.v1.RouterInfo.LabelsEntry\x12\x13\n\x0b\x63onnections\x18\x04 \x01(\x05\x12\x18\n\x10\x63onnection_limit\x18\x05 \x01(\x05\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x83\x02\n\x12RouterLeaseRequest\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x0f\n\x07\x62iscuit\x18\x03 \x01(\x0c\x12\x17\n\x0f\x63onnected_peers\x18\x04 \x03(\t\x12\x10\n\x08\x64ht_size\x18\x05 \x01(\x05\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x12&\n\x03ttl\x18\x08 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x13\n\x0b\x63onnections\x18\t \x01(\x05\x12\x18\n\x10\x63onnection_limit\x18\n \x01(\x05\"f\n\x13RouterLeaseResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xbd\x01\n\nPolicyRole\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x17\n\x0f\x61llowed_targets\x18\x02 \x03(\t\x12\x18\n\x10\x61llowed_services\x18\x03 \x03(\t\x12\x16\n\x0e\x63ustom_datalog\x18\x04 \x03(\t\x12\x16\n\x0e\x61llowed_labels\x18\x05 \x03(\t\x12%\n\x04http\x18\x06 \x03(\x0b\x32\x17.agentmesh.v1.HTTPGrant\x12\x17\n\x0f\x61llowed_publish\x18\x07 \x03(\t\"<\n\tHTTPGrant\x12\x0f\n\x07service\x18\x01 \x01(\t\x12\x0f\n\x07methods\x18\x02 \x03(\t\x12\r\n\x05paths\x18\x03 \x03(\t\"\xa1\x02\n\x11\x45gressDestination\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x12\n\ntarget_url\x18\x02 \x01(\t\x12\x12\n\ncredential\x18\x03 \x01(\t\x12\x11\n\tserved_by\x18\x04 \x03(\t\x12.\n\x06\x62roker\x18\x05 \x01(\x0b\x32\x1e.agentmesh.v1.CredentialBroker\x12,\n\ninspection\x18\x06 \x01(\x0b\x32\x18.agentmesh.v1.Inspection\x12&\n\x04mode\x18\x07 \x01(\x0e\x32\x18.agentmesh.v1.EgressMode\x12\r\n\x05ports\x18\x08 \x03(\r\x12\x15\n\rpreserve_host\x18\t \x01(\x08\x12\x17\n\x0f\x66orward_context\x18\n \x01(\x08\"9\n\nInspection\x12+\n\ninspectors\x18\x01 \x03(\x0b\x32\x17.agentmesh.v1.Inspector\"o\n\tInspector\x12/\n\x0bmodel_armor\x18\x01 \x01(\x0b\x32\x18.agentmesh.v1.ModelArmorH\x00\x12)\n\x08\x65xt_proc\x18\x02 \x01(\x0b\x32\x15.agentmesh.v1.ExtProcH\x00\x42\x06\n\x04kind\"\x91\x01\n\nModelArmor\x12\x10\n\x08template\x18\x01 \x01(\t\x12\x32\n\x08response\x18\x02 \x01(\x0e\x32 .agentmesh.v1.ResponseInspection\x12\x11\n\tfail_open\x18\x03 \x01(\x08\x12*\n\x07timeout\x18\x04 \x01(\x0b\x32\x19.google.protobuf.Duration\"\x88\x02\n\x07\x45xtProc\x12\x0e\n\x06target\x18\x01 \x01(\t\x12\n\n\x02\x63\x61\x18\x02 \x01(\t\x12\x1a\n\x12\x63lient_certificate\x18\x03 \x01(\t\x12<\n\x0fprocessing_mode\x18\x04 \x01(\x0b\x32#.agentmesh.v1.ExtProcProcessingMode\x12\x1b\n\x13\x61llow_mode_override\x18\x05 \x01(\x08\x12\x32\n\x0fmessage_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x1a\n\x12\x66\x61ilure_mode_allow\x18\x07 \x01(\x08\x12\x1a\n\x12max_buffered_bytes\x18\x08 \x01(\r\"\xff\x04\n\x15\x45xtProcProcessingMode\x12K\n\x13request_header_mode\x18\x01 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12L\n\x14response_header_mode\x18\x02 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12G\n\x11request_body_mode\x18\x03 \x01(\x0e\x32,.agentmesh.v1.ExtProcProcessingMode.BodyMode\x12H\n\x12response_body_mode\x18\x04 \x01(\x0e\x32,.agentmesh.v1.ExtProcProcessingMode.BodyMode\x12L\n\x14request_trailer_mode\x18\x05 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12M\n\x15response_trailer_mode\x18\x06 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\"9\n\nHeaderMode\x12\x17\n\x13HEADER_MODE_DEFAULT\x10\x00\x12\x08\n\x04SEND\x10\x01\x12\x08\n\x04SKIP\x10\x02\"`\n\x08\x42odyMode\x12\x08\n\x04NONE\x10\x00\x12\x0c\n\x08STREAMED\x10\x01\x12\x0c\n\x08\x42UFFERED\x10\x02\x12\x14\n\x10\x42UFFERED_PARTIAL\x10\x03\x12\x18\n\x14\x46ULL_DUPLEX_STREAMED\x10\x04\"\xe1\x01\n\x10\x43redentialBroker\x12\x17\n\rstatic_secret\x18\x01 \x01(\tH\x00\x12\x37\n\x0foidc_federation\x18\x02 \x01(\x0b\x32\x1c.agentmesh.v1.OIDCFederationH\x00\x12\x36\n\x0f\x61ws_assume_role\x18\x03 \x01(\x0b\x32\x1b.agentmesh.v1.AWSAssumeRoleH\x00\x12;\n\x11platform_identity\x18\x04 \x01(\x0b\x32\x1e.agentmesh.v1.PlatformIdentityH\x00\x42\x06\n\x04kind\"_\n\x0eOIDCFederation\x12\x16\n\x0etoken_endpoint\x18\x01 \x01(\t\x12\x10\n\x08\x61udience\x18\x02 \x01(\t\x12\x13\n\x0bimpersonate\x18\x03 \x01(\t\x12\x0e\n\x06scopes\x18\x04 \x03(\t\"9\n\rAWSAssumeRole\x12\x10\n\x08role_arn\x18\x01 \x01(\t\x12\x16\n\x0esession_policy\x18\x02 \x01(\t\"\"\n\x10PlatformIdentity\x12\x0e\n\x06scopes\x18\x01 \x03(\t\".\n\rPolicyBinding\x12\x0c\n\x04role\x18\x01 \x01(\t\x12\x0f\n\x07members\x18\x02 \x03(\t\"\x97\x01\n\x0cPolicyConfig\x12\'\n\x05roles\x18\x01 \x03(\x0b\x32\x18.agentmesh.v1.PolicyRole\x12-\n\x08\x62indings\x18\x02 \x03(\x0b\x32\x1b.agentmesh.v1.PolicyBinding\x12/\n\x06\x65gress\x18\x03 \x03(\x0b\x32\x1f.agentmesh.v1.EgressDestination\"\x18\n\x16PolicyConfigGetRequest\"0\n\x17PolicyConfigGetResponse\x12\x15\n\rdatalog_rules\x18\x01 \x03(\t\"<\n\x1aPolicyConfigUpdateResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\"\x1a\n\x18\x45gressAssignmentsRequest\"L\n\x19\x45gressAssignmentsResponse\x12/\n\x06\x65gress\x18\x01 \x03(\x0b\x32\x1f.agentmesh.v1.EgressDestination\"f\n\x0cKeysResponse\x12\x13\n\x0bpublic_keys\x18\x01 \x03(\x0c\x12-\n\tsign_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x12\n\nsignatures\x18\x03 \x03(\x0c\"k\n\x13TokenRefreshRequest\x12\x1b\n\x13\x63hallenge_signature\x18\x01 \x01(\x0c\x12\x19\n\x11\x63hallenge_unix_ms\x18\x02 \x01(\x03\x12\x0f\n\x07peer_id\x18\x03 \x01(\t\x12\x0b\n\x03jwt\x18\x04 \x01(\t\"u\n\x14TokenRefreshResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x15\n\rerror_message\x18\x03 \x01(\t\"@\n\x11NodeCatalogReport\x12+\n\x08services\x18\x01 \x03(\x0b\x32\x19.agentmesh.v1.ServiceInfo\"%\n\x12TokenRevokeRequest\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\"5\n\x13TokenRevokeResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\"\x96\x01\n\x1b\x42ootstrapTokenCreateRequest\x12\x0c\n\x04role\x18\x01 \x01(\t\x12\x10\n\x08owner_id\x18\x02 \x01(\t\x12\x11\n\tttl_hours\x18\x03 \x01(\x05\x12\x12\n\nmax_usages\x18\x04 \x01(\x05\x12\x13\n\x0b\x64\x65scription\x18\x05 \x01(\t\x12\x1b\n\x13\x61utonomous_recovery\x18\x06 \x01(\x08\"\x8a\x01\n\x1c\x42ootstrapTokenCreateResponse\x12\n\n\x02id\x18\x01 \x01(\t\x12\r\n\x05token\x18\x02 \x01(\t\x12\x0c\n\x04role\x18\x03 \x01(\t\x12\x10\n\x08owner_id\x18\x04 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xab\x02\n\x0e\x42ootstrapToken\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0c\n\x04role\x18\x02 \x01(\t\x12\x10\n\x08owner_id\x18\x03 \x01(\t\x12\x12\n\nmax_usages\x18\x04 \x01(\x05\x12\x14\n\x0cusages_count\x18\x05 \x01(\x05\x12\x13\n\x0b\x64\x65scription\x18\x06 \x01(\t\x12/\n\x0b\x63reate_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0brevoke_time\x18\t \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x1b\n\x13\x61utonomous_recovery\x18\n \x01(\x08\"J\n\x1a\x42ootstrapTokenListResponse\x12,\n\x06tokens\x18\x01 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\"\xd6\x02\n\x11\x45nrollmentRequest\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x10\n\x08token_id\x18\x03 \x01(\t\x12.\n\x06status\x18\x04 \x01(\x0e\x32\x1e.agentmesh.v1.EnrollmentStatus\x12;\n\x06labels\x18\x05 \x03(\x0b\x32+.agentmesh.v1.EnrollmentRequest.LabelsEntry\x12/\n\x0b\x63reate_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x30\n\x0cresolve_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x13\n\x0bresolved_by\x18\x08 \x01(\t\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"R\n\x1d\x45nrollmentRequestListResponse\x12\x31\n\x08requests\x18\x01 \x03(\x0b\x32\x1f.agentmesh.v1.EnrollmentRequest\"p\n\x04User\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0e\n\x06issuer\x18\x02 \x01(\t\x12\r\n\x05\x65mail\x18\x03 \x01(\t\x12\x0c\n\x04role\x18\x04 \x01(\t\x12/\n\x0b\x63reate_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xe3\x02\n\x0c\x45nrolledNode\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0c\n\x04role\x18\x02 \x01(\t\x12\x17\n\x0f\x65nrollment_type\x18\x03 \x01(\t\x12\x13\n\x0b\x63laims_json\x18\x04 \x01(\t\x12\x10\n\x08owner_id\x18\x05 \x01(\t\x12\x36\n\x06labels\x18\x06 \x03(\x0b\x32&.agentmesh.v1.EnrolledNode.LabelsEntry\x12/\n\x0b\x65nroll_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0e\n\x06\x62\x61nned\x18\t \x01(\x08\x12\x1b\n\x13\x61utonomous_recovery\x18\n \x01(\x08\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xc4\x01\n\x0bRouterLease\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x35\n\x11last_renewal_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x17\n\x0f\x63onnected_peers\x18\x05 \x03(\t\x12\x10\n\x08\x64ht_size\x18\x06 \x01(\x05\"l\n\x0cNodeServices\x12+\n\x08services\x18\x01 \x03(\x0b\x32\x19.agentmesh.v1.ServiceInfo\x12/\n\x0breport_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xdb\x03\n\x13\x41\x64minStatusResponse\x12!\n\x05users\x18\x01 \x03(\x0b\x32\x12.agentmesh.v1.User\x12\x31\n\x0e\x61\x63tive_routers\x18\x02 \x03(\x0b\x32\x19.agentmesh.v1.RouterLease\x12\x32\n\x0e\x65nrolled_nodes\x18\x03 \x03(\x0b\x32\x1a.agentmesh.v1.EnrolledNode\x12<\n\x13\x65nrollment_requests\x18\x04 \x03(\x0b\x32\x1f.agentmesh.v1.EnrollmentRequest\x12\x36\n\x10\x62ootstrap_tokens\x18\x05 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\x12*\n\x06policy\x18\x06 \x01(\x0b\x32\x1a.agentmesh.v1.PolicyConfig\x12H\n\x0cnode_catalog\x18\x07 \x03(\x0b\x32\x32.agentmesh.v1.AdminStatusResponse.NodeCatalogEntry\x1aN\n\x10NodeCatalogEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12)\n\x05value\x18\x02 \x01(\x0b\x32\x1a.agentmesh.v1.NodeServices:\x02\x38\x01\"\x81\x02\n\x12UserStatusResponse\x12 \n\x04user\x18\x01 \x01(\x0b\x32\x12.agentmesh.v1.User\x12\x32\n\x0e\x65nrolled_nodes\x18\x02 \x03(\x0b\x32\x1a.agentmesh.v1.EnrolledNode\x12\x36\n\x10\x62ootstrap_tokens\x18\x03 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\x12\x31\n\x0e\x61\x63tive_routers\x18\x04 \x03(\x0b\x32\x19.agentmesh.v1.RouterLease\x12*\n\x06policy\x18\x05 \x01(\x0b\x32\x1a.agentmesh.v1.PolicyConfig\"V\n\x10NodeListResponse\x12)\n\x05nodes\x18\x01 \x03(\x0b\x32\x1a.agentmesh.v1.EnrolledNode\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\"\xe4\x01\n\x18IdentityEvidenceResponse\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12\x37\n\x13\x62iscuit_expire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x19\n\x11\x63ontrol_plane_url\x18\x04 \x01(\t\x12\"\n\x1atrusted_control_plane_keys\x18\x05 \x03(\x0c\x12.\n\ncheck_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xc6\x02\n\x14PeerEvidenceResponse\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12\x15\n\rverifying_key\x18\x03 \x01(\x0c\x12\r\n\x05roles\x18\x04 \x03(\t\x12>\n\x06labels\x18\x05 \x03(\x0b\x32..agentmesh.v1.PeerEvidenceResponse.LabelsEntry\x12/\n\x0b\x65xpire_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x16\n\x0erevocation_ids\x18\x07 \x03(\t\x12.\n\ncheck_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x8c\x02\n\x10MemberCredential\x12\x19\n\x11\x63ontrol_plane_url\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x0ctrusted_keys\x18\x04 \x03(\x0b\x32\x1f.agentmesh.v1.TrustedSigningKey\x12\x19\n\x11issued_under_keys\x18\x05 \x03(\x0c\x12\x18\n\x10router_addresses\x18\x06 \x03(\t\x12/\n\x0coidc_session\x18\x07 \x01(\x0b\x32\x19.agentmesh.v1.OIDCSession\"Y\n\x11TrustedSigningKey\x12\x12\n\npublic_key\x18\x01 \x01(\x0c\x12\x30\n\x0creceive_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"Y\n\x0bOIDCSession\x12\x0e\n\x06issuer\x18\x01 \x01(\t\x12\x11\n\tclient_id\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x15\n\rrefresh_token\x18\x04 \x01(\t\"\x93\x01\n\x15TaskAuthorizationRule\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x14\n\x0c\x64isplay_name\x18\x02 \x01(\t\x12%\n\x05rules\x18\x03 \x03(\x0b\x32\x16.agentmesh.v1.TaskRule\x12/\n\x0b\x65xpire_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x84\x01\n\x08TaskRule\x12\x13\n\x0b\x64\x65scription\x18\x01 \x01(\t\x12\x18\n\x10\x61llowed_services\x18\x02 \x03(\t\x12.\n\toperation\x18\x03 \x01(\x0b\x32\x1b.agentmesh.v1.TaskOperation\x12\x19\n\x11\x61llowed_resources\x18\x04 \x03(\t\"s\n\rTaskOperation\x12\x15\n\rallowed_tools\x18\x01 \x03(\t\x12\x17\n\x0f\x61llowed_methods\x18\x02 \x03(\t\x12\x15\n\rallowed_paths\x18\x03 \x03(\t\x12\x1b\n\x13\x61llowed_permissions\x18\x04 \x03(\t\"\xab\x01\n\x14TokenExchangeRequest\x12\x15\n\rsubject_token\x18\x01 \x01(\t\x12\x36\n\ttask_rule\x18\x02 \x01(\x0b\x32#.agentmesh.v1.TaskAuthorizationRule\x12\x0c\n\x04seal\x18\x03 \x01(\x08\x12\x19\n\x11\x63hallenge_unix_ms\x18\x04 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x05 \x01(\x0c\"\x7f\n\x15TokenExchangeResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\r\n\x05roles\x18\x03 \x03(\t\x12\x0f\n\x07subject\x18\x04 \x01(\t\"\x81\x01\n\x0fSTSTokenRequest\x12\x0f\n\x07\x62iscuit\x18\x01 \x01(\x0c\x12\x13\n\x0b\x64\x65stination\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x19\n\x11\x63hallenge_unix_ms\x18\x04 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x05 \x01(\x0c\"\x83\x01\n\x10STSTokenResponse\x12\x0b\n\x03jwt\x18\x01 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0f\n\x07subject\x18\x03 \x01(\t\x12\r\n\x05roles\x18\x04 \x03(\t\x12\x11\n\ttask_name\x18\x05 \x01(\t\"F\n\x13RevocationsResponse\x12\x16\n\x0erevocation_ids\x18\x01 \x03(\t\x12\x17\n\x0f\x62\x61nned_peer_ids\x18\x02 \x03(\t*\x94\x01\n\x10\x45nrollmentStatus\x12!\n\x1d\x45NROLLMENT_STATUS_UNSPECIFIED\x10\x00\x12\x1d\n\x19\x45NROLLMENT_STATUS_PENDING\x10\x01\x12\x1e\n\x1a\x45NROLLMENT_STATUS_APPROVED\x10\x02\x12\x1e\n\x1a\x45NROLLMENT_STATUS_REJECTED\x10\x03*\x8c\x01\n\x0bServiceType\x12\x1c\n\x18SERVICE_TYPE_UNSPECIFIED\x10\x00\x12\x14\n\x10SERVICE_TYPE_MCP\x10\x01\x12\x1a\n\x16SERVICE_TYPE_INFERENCE\x10\x02\x12\x14\n\x10SERVICE_TYPE_A2A\x10\x03\x12\x17\n\x13SERVICE_TYPE_EGRESS\x10\x04*7\n\nEgressMode\x12\x14\n\x10\x45GRESS_MODE_HTTP\x10\x00\x12\x13\n\x0f\x45GRESS_MODE_TCP\x10\x01*\\\n\x12ResponseInspection\x12 \n\x1cRESPONSE_INSPECTION_BUFFERED\x10\x00\x12$\n RESPONSE_INSPECTION_REQUEST_ONLY\x10\x01\x42!Z\x1fgithub.com/google/agentmesh/apib\x06proto3')
 
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, globals())
 _builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'agentmesh_pb2', globals())
@@ -39,14 +39,14 @@
   _ADMINSTATUSRESPONSE_NODECATALOGENTRY._serialized_options = b'8\001'
   _PEEREVIDENCERESPONSE_LABELSENTRY._options = None
   _PEEREVIDENCERESPONSE_LABELSENTRY._serialized_options = b'8\001'
-  _ENROLLMENTSTATUS._serialized_start=11478
-  _ENROLLMENTSTATUS._serialized_end=11626
-  _SERVICETYPE._serialized_start=11629
-  _SERVICETYPE._serialized_end=11769
-  _EGRESSMODE._serialized_start=11771
-  _EGRESSMODE._serialized_end=11826
-  _RESPONSEINSPECTION._serialized_start=11828
-  _RESPONSEINSPECTION._serialized_end=11920
+  _ENROLLMENTSTATUS._serialized_start=11566
+  _ENROLLMENTSTATUS._serialized_end=11714
+  _SERVICETYPE._serialized_start=11717
+  _SERVICETYPE._serialized_end=11857
+  _EGRESSMODE._serialized_start=11859
+  _EGRESSMODE._serialized_end=11914
+  _RESPONSEINSPECTION._serialized_start=11916
+  _RESPONSEINSPECTION._serialized_end=12008
   _AUTHFRAME._serialized_start=98
   _AUTHFRAME._serialized_end=150
   _AUTHRESPONSE._serialized_start=152
@@ -191,32 +191,34 @@
   _ADMINSTATUSRESPONSE_NODECATALOGENTRY._serialized_end=9159
   _USERSTATUSRESPONSE._serialized_start=9162
   _USERSTATUSRESPONSE._serialized_end=9419
-  _IDENTITYEVIDENCERESPONSE._serialized_start=9422
-  _IDENTITYEVIDENCERESPONSE._serialized_end=9650
-  _PEEREVIDENCERESPONSE._serialized_start=9653
-  _PEEREVIDENCERESPONSE._serialized_end=9979
+  _NODELISTRESPONSE._serialized_start=9421
+  _NODELISTRESPONSE._serialized_end=9507
+  _IDENTITYEVIDENCERESPONSE._serialized_start=9510
+  _IDENTITYEVIDENCERESPONSE._serialized_end=9738
+  _PEEREVIDENCERESPONSE._serialized_start=9741
+  _PEEREVIDENCERESPONSE._serialized_end=10067
   _PEEREVIDENCERESPONSE_LABELSENTRY._serialized_start=825
   _PEEREVIDENCERESPONSE_LABELSENTRY._serialized_end=870
-  _MEMBERCREDENTIAL._serialized_start=9982
-  _MEMBERCREDENTIAL._serialized_end=10250
-  _TRUSTEDSIGNINGKEY._serialized_start=10252
-  _TRUSTEDSIGNINGKEY._serialized_end=10341
-  _OIDCSESSION._serialized_start=10343
-  _OIDCSESSION._serialized_end=10432
-  _TASKAUTHORIZATIONRULE._serialized_start=10435
-  _TASKAUTHORIZATIONRULE._serialized_end=10582
-  _TASKRULE._serialized_start=10585
-  _TASKRULE._serialized_end=10717
-  _TASKOPERATION._serialized_start=10719
-  _TASKOPERATION._serialized_end=10834
-  _TOKENEXCHANGEREQUEST._serialized_start=10837
-  _TOKENEXCHANGEREQUEST._serialized_end=11008
-  _TOKENEXCHANGERESPONSE._serialized_start=11010
-  _TOKENEXCHANGERESPONSE._serialized_end=11137
-  _STSTOKENREQUEST._serialized_start=11140
-  _STSTOKENREQUEST._serialized_end=11269
-  _STSTOKENRESPONSE._serialized_start=11272
-  _STSTOKENRESPONSE._serialized_end=11403
-  _REVOCATIONSRESPONSE._serialized_start=11405
-  _REVOCATIONSRESPONSE._serialized_end=11475
+  _MEMBERCREDENTIAL._serialized_start=10070
+  _MEMBERCREDENTIAL._serialized_end=10338
+  _TRUSTEDSIGNINGKEY._serialized_start=10340
+  _TRUSTEDSIGNINGKEY._serialized_end=10429
+  _OIDCSESSION._serialized_start=10431
+  _OIDCSESSION._serialized_end=10520
+  _TASKAUTHORIZATIONRULE._serialized_start=10523
+  _TASKAUTHORIZATIONRULE._serialized_end=10670
+  _TASKRULE._serialized_start=10673
+  _TASKRULE._serialized_end=10805
+  _TASKOPERATION._serialized_start=10807
+  _TASKOPERATION._serialized_end=10922
+  _TOKENEXCHANGEREQUEST._serialized_start=10925
+  _TOKENEXCHANGEREQUEST._serialized_end=11096
+  _TOKENEXCHANGERESPONSE._serialized_start=11098
+  _TOKENEXCHANGERESPONSE._serialized_end=11225
+  _STSTOKENREQUEST._serialized_start=11228
+  _STSTOKENREQUEST._serialized_end=11357
+  _STSTOKENRESPONSE._serialized_start=11360
+  _STSTOKENRESPONSE._serialized_end=11491
+  _REVOCATIONSRESPONSE._serialized_start=11493
+  _REVOCATIONSRESPONSE._serialized_end=11563
 # @@protoc_insertion_point(module_scope)
diff --git a/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.pyi b/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.pyi
index 8ddc53b0..f814b46b 100644
--- a/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.pyi
+++ b/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.pyi
@@ -588,6 +588,14 @@ class NodeCatalogReport(_message.Message):
     services: _containers.RepeatedCompositeFieldContainer[ServiceInfo]
     def __init__(self, services: _Optional[_Iterable[_Union[ServiceInfo, _Mapping]]] = ...) -> None: ...
 
+class NodeListResponse(_message.Message):
+    __slots__ = ["next_page_token", "nodes"]
+    NEXT_PAGE_TOKEN_FIELD_NUMBER: _ClassVar[int]
+    NODES_FIELD_NUMBER: _ClassVar[int]
+    next_page_token: str
+    nodes: _containers.RepeatedCompositeFieldContainer[EnrolledNode]
+    def __init__(self, nodes: _Optional[_Iterable[_Union[EnrolledNode, _Mapping]]] = ..., next_page_token: _Optional[str] = ...) -> None: ...
+
 class NodeServices(_message.Message):
     __slots__ = ["report_time", "services"]
     REPORT_TIME_FIELD_NUMBER: _ClassVar[int]
diff --git a/site/content/docs/reference/control-plane.md b/site/content/docs/reference/control-plane.md
index ffef9dd3..f78d1099 100644
--- a/site/content/docs/reference/control-plane.md
+++ b/site/content/docs/reference/control-plane.md
@@ -108,7 +108,7 @@ names; unknown fields are rejected.
 
 | Route | Purpose |
 |---|---|
-| `GET /admin/status` | `AdminStatusResponse`: everything the console shows: routers, nodes, enrollment requests, tokens, users, the policy and the node service catalog. |
+| `GET /admin/status` | `AdminStatusResponse`: everything the console shows: routers, nodes, enrollment requests, tokens, users, the policy and the node service catalog. Nodes whose session expired are left out; `GET /user/nodes?state=expired` lists them. |
 | `GET /admin/policy` | The mesh policy as `PolicyConfig`, the same document `POST /policies` takes. |
 | `POST /policies`, `PUT /policies` | Replace the mesh policy. The body is `PolicyConfig`, so a misspelt grant fails instead of being dropped. |
 | `GET /admin/bootstrap-tokens` | `BootstrapTokenListResponse`: every token, including revoked and expired ones. |
@@ -129,7 +129,8 @@ with `403`). The console uses these routes.
 
 | Route | Purpose |
 |---|---|
-| `GET /user/status` | `UserStatusResponse`: the caller, their enrolled nodes and tokens. For an administrator it also carries the routers and the policy. |
+| `GET /user/status` | `UserStatusResponse`: the caller, their enrolled nodes and tokens. For an administrator it also carries the routers and the policy. Nodes whose session expired are left out. |
+| `GET /user/nodes` | `NodeListResponse`: one page of enrolled nodes, most recent enrollment first. `state` (`admitted`, `expired` or `banned`, repeatable) and `role` narrow the list. An expired OIDC enrollment can renew in place, so the console pages `state=expired` to keep those nodes revocable. An administrator sees every owner's nodes and may pick one with `owner_id`; a user sees only their own. Query `page_size` (default 50, at most 200) and `page_token`, the `next_page_token` of the previous page. |
 | `POST /user/bootstrap-tokens` | Mint a token owned by the caller; body and response as on the admin route. `role` defaults to `mesh:role:node`. Banning the owner disables the tokens they minted. |
 | `POST /user/revoke` | Ban one of the caller's own nodes. |
 
diff --git a/tests/ui/console.spec.js b/tests/ui/console.spec.js
index 7911d889..a4db74a1 100644
--- a/tests/ui/console.spec.js
+++ b/tests/ui/console.spec.js
@@ -443,3 +443,70 @@ test('an admin restores a revoked node from the Nodes view', async ({ page }) =>
   await page.locator('#table-revoked-nodes tr', { hasText: REVOKED }).locator('button:has-text("Restore")').click();
   await expect.poll(() => unban).toBe(`POST /api/admin/nodes/${REVOKED}/unban`);
 });
+
+// Expired nodes are not in /admin/status: the section fetches them only when
+// opened, a page at a time, and a revoke there drops the row in place.
+test('expired nodes load on open, page on demand and revoke in place', async ({ page }) => {
+  const FIRST = '12D3KooWExpiredFirstFixturePeer';
+  const SECOND = '12D3KooWExpiredSecondFixturePeer';
+  const requested = [];
+  await page.route((url) => url.pathname.endsWith('/api/user/nodes'), async (route) => {
+    const params = new URL(route.request().url()).searchParams;
+    requested.push(`${params.getAll('state')}:${params.get('page_token') || ''}`);
+    const expired = { role: 'mesh:role:node', expire_time: '2026-09-15T08:00:00Z' };
+    const json = params.get('page_token') === 'next'
+      // The owner is server data on an admin page; markup in it must render inert.
+      ? { nodes: [{ ...expired, peer_id: SECOND, owner_id: '<img src=x onerror="window.expiredXSS=1">' }] }
+      : { nodes: [{ ...expired, peer_id: FIRST, owner_id: 'alice' }], next_page_token: 'next' };
+    await route.fulfill({ json });
+  });
+  let revoked = '';
+  await page.route((url) => url.pathname.endsWith('/api/user/revoke'), async (route) => {
+    revoked = `${route.request().method()} ${new URL(route.request().url()).searchParams.get('id')}`;
+    await route.fulfill({ status: 200, contentType: 'text/plain', body: 'Node revoked successfully' });
+  });
+
+  await login(page);
+  await page.click('.nav-item[data-target="nodes"]');
+  expect(requested, 'the list is fetched only when opened').toEqual([]);
+
+  await page.click('#expired-nodes summary');
+  const rows = page.locator('#table-expired-nodes tr');
+  await expect(rows).toHaveCount(1);
+  await expect(rows.nth(0)).toContainText(FIRST);
+  await expect(rows.nth(0).locator('td').nth(3)).not.toHaveText(/2026-09-15T08:00:00Z|-/);
+
+  await page.click('#expired-nodes-more');
+  await expect(rows).toHaveCount(2);
+  await expect(rows.nth(1)).toContainText(SECOND);
+  await expect(page.locator('#expired-nodes-more')).toBeHidden();
+  expect(await page.locator('#table-expired-nodes img').count()).toBe(0);
+  expect(await page.evaluate(() => window.expiredXSS)).toBeUndefined();
+  expect(requested).toEqual(['expired:', 'expired:next']);
+
+  page.once('dialog', (d) => d.accept());
+  await rows.filter({ hasText: FIRST }).locator('button:has-text("Revoke")').click();
+  await expect.poll(() => revoked).toBe(`POST ${FIRST}`);
+  await expect(rows).toHaveCount(1);
+  await expect(page.locator('#table-expired-nodes')).not.toContainText(FIRST);
+});
+
+// The landing page hides the app without a reload, so the next identity to log
+// in must not see the expired rows fetched for the previous one.
+test('returning to the landing page clears the expired nodes list', async ({ page }) => {
+  await page.route((url) => url.pathname.endsWith('/api/user/nodes'), async (route) => {
+    await route.fulfill({ json: { nodes: [{
+      peer_id: '12D3KooWExpiredResetFixturePeer', role: 'mesh:role:node', owner_id: 'bob', expire_time: '2026-09-15T08:00:00Z',
+    }] } });
+  });
+
+  await login(page);
+  await page.click('.nav-item[data-target="nodes"]');
+  await page.click('#expired-nodes summary');
+  const rows = page.locator('#table-expired-nodes tr');
+  await expect(rows).toHaveCount(1);
+
+  await page.evaluate(() => showLandingPage());
+  await expect(page.locator('#expired-nodes')).toHaveJSProperty('open', false);
+  await expect(rows).toHaveCount(0);
+});

From c554225d3f8882b1f884cfc07ad3ef7cb6b47f8c Mon Sep 17 00:00:00 2001
From: Antonio Ojea <aojea@google.com>
Date: Thu, 15 Oct 2026 04:47:13 +0000
Subject: [PATCH 2/7] controlplane: --node-retention must be positive; no
 record is kept forever

A retention of 0 travelled as -1 and meant keep forever, the one duration
in Options with such a sentinel and the setting whose absence let the
nodes table grow to 119k rows on the testnet. Options.Default fills an
unset retention with DefaultNodeRetention as it does every other
duration, Options.Validate refuses one that is not positive, and the
flag refuses 0 on its own, since there it is a value the operator typed
and not an unset field. agentmesh-one exposes it as
--control-plane-node-retention like the other control plane tunables.
---
 cmd/agentmesh-control-plane/main.go          | 12 +++----
 cmd/agentmesh-one/main.go                    |  1 +
 internal/controlplane/config.go              |  9 +++--
 internal/controlplane/node_gc.go             | 12 ++-----
 internal/controlplane/node_gc_test.go        | 37 ++++++--------------
 internal/standalone/standalone.go            |  4 +++
 site/content/docs/reference/agentmesh-one.md |  1 +
 site/content/docs/reference/control-plane.md |  2 +-
 8 files changed, 31 insertions(+), 47 deletions(-)

diff --git a/cmd/agentmesh-control-plane/main.go b/cmd/agentmesh-control-plane/main.go
index 405cd496..ebf3f158 100644
--- a/cmd/agentmesh-control-plane/main.go
+++ b/cmd/agentmesh-control-plane/main.go
@@ -98,6 +98,10 @@ func main() {
 			if stsIssuerURL == "" {
 				stsIssuerURL = strings.TrimSpace(os.Getenv("AGENTMESH_STS_ISSUER_URL"))
 			}
+			// Options reads 0 as unset; the flag's 0 is a value the operator typed.
+			if nodeRetention <= 0 {
+				logger.Fatalf("--node-retention must be positive, got %s: node records are never kept forever", nodeRetention)
+			}
 
 			var auds []string
 			for _, aud := range strings.Split(allowedAudiencesFlag, ",") {
@@ -121,12 +125,6 @@ func main() {
 				}
 			}()
 
-			// Options reads 0 as the default, so the flag's 0 (keep forever)
-			// travels as a negative retention.
-			if nodeRetention == 0 {
-				nodeRetention = -1
-			}
-
 			opts := controlplane.Options{
 				ListenAddr:            bindAddress,
 				DriverName:            dbDriver,
@@ -208,7 +206,7 @@ func main() {
 	rootCmd.Flags().DurationVar(&biscuitTTL, "biscuit-ttl", api.BiscuitTokenTTL, "Lifespan minted into every issued Biscuit's expiration fact. Capped to the OIDC token's own expiry when shorter.")
 	rootCmd.Flags().DurationVar(&oidcSessionTTL, "oidc-session-ttl", api.OIDCSessionTTL, "How long an OIDC enrollment stays refreshable before the identity must re-authenticate with the OIDC provider. Shorter values keep the provider authoritative for offboarding at the cost of more frequent interactive re-enrollment.")
 	rootCmd.Flags().DurationVar(&workloadSessionTTL, "workload-session-ttl", controlplane.DefaultWorkloadSessionTTL, "How long a workload-issuer enrollment stays refreshable without presenting a fresh platform JWT on /refresh.")
-	rootCmd.Flags().DurationVar(&nodeRetention, "node-retention", controlplane.DefaultNodeRetention, "How long an enrolled node's record is kept after its session expired before it is deleted. Banned nodes are always kept. 0 keeps every record forever.")
+	rootCmd.Flags().DurationVar(&nodeRetention, "node-retention", controlplane.DefaultNodeRetention, "How long an enrolled node's record is kept after its session expired before it is deleted. Banned nodes are always kept. Must be positive: records are never kept forever.")
 	rootCmd.Flags().DurationVar(&meshReconnectInterval, "mesh-reconnect-interval", controlplane.DefaultMeshReconnectInterval, "How often the event publisher re-reads the router leases and dials any router it is not connected to.")
 	rootCmd.Flags().StringVar(&adminTokenPath, "admin-token-path", "", "Path to file containing the token for authenticating policy REST API requests (or env AGENTMESH_ADMIN_TOKEN)")
 	rootCmd.Flags().StringVar(&stsIssuerURL, "sts-issuer-url", "", "Canonical external URL of this control plane for OIDC/STS issuer and discovery metadata (or env AGENTMESH_STS_ISSUER_URL)")
diff --git a/cmd/agentmesh-one/main.go b/cmd/agentmesh-one/main.go
index 0e93a76e..9fade107 100644
--- a/cmd/agentmesh-one/main.go
+++ b/cmd/agentmesh-one/main.go
@@ -231,6 +231,7 @@ func main() {
 	rootCmd.Flags().DurationVar(&cpTunables.KeyGracePeriod, "control-plane-key-grace-period", 0, "How long rotated-out keys stay valid for verification (0 keeps the component default)")
 	rootCmd.Flags().DurationVar(&cpTunables.BiscuitTTL, "control-plane-biscuit-ttl", 0, "Lifespan minted into issued biscuits (0 keeps the component default)")
 	rootCmd.Flags().DurationVar(&cpTunables.WorkloadSessionTTL, "control-plane-workload-session-ttl", 0, "How long a workload-issuer enrollment stays refreshable without presenting a fresh platform JWT on /refresh (0 keeps the component default)")
+	rootCmd.Flags().DurationVar(&cpTunables.NodeRetention, "control-plane-node-retention", 0, "How long a node record is kept after its session expired before it is deleted (0 keeps the component default)")
 	rootCmd.Flags().BoolVar(&cpTunables.ManualEnrollment, "control-plane-manual-enrollment", false, "Queue bootstrap enrollments for admin approval instead of auto-approving")
 
 	// Embedded router tunables.
diff --git a/internal/controlplane/config.go b/internal/controlplane/config.go
index a71618d8..2f403ab9 100644
--- a/internal/controlplane/config.go
+++ b/internal/controlplane/config.go
@@ -49,9 +49,9 @@ type Options struct {
 	OIDCSessionTTL        time.Duration // How long an OIDC enrollment stays refreshable before the identity must re-authenticate interactively; defaults to api.OIDCSessionTTL
 	WorkloadSessionTTL    time.Duration // Session TTL for enrollments from a WorkloadIssuer; defaults to DefaultWorkloadSessionTTL (48h)
 	// NodeRetention is how long an enrolled node's row is kept after its
-	// session expired before being deleted; 0 is DefaultNodeRetention and a
-	// negative value keeps rows forever. Every pod restart without a
-	// persistent data dir enrolls a fresh identity, so without this the
+	// session expired before being deleted; unset is DefaultNodeRetention,
+	// and Validate refuses a negative value. Every pod restart without a
+	// persistent data dir enrolls a fresh identity, so without a bound the
 	// nodes table only ever grows.
 	NodeRetention         time.Duration
 	AdminToken            string // Optional: administrative bearer token for protecting policy and enrollment queue REST APIs
@@ -153,5 +153,8 @@ func (o *Options) Validate() error {
 	if err := api.ValidateDirectoryParameters(o.DHTReplication, o.DHTReprovideInterval); err != nil {
 		return err
 	}
+	if o.NodeRetention <= 0 {
+		return fmt.Errorf("NodeRetention must be positive, got %s: node records are never kept forever", o.NodeRetention)
+	}
 	return nil
 }
diff --git a/internal/controlplane/node_gc.go b/internal/controlplane/node_gc.go
index 972d7cd4..c7a5237a 100644
--- a/internal/controlplane/node_gc.go
+++ b/internal/controlplane/node_gc.go
@@ -43,10 +43,6 @@ var nodesDeletedTotal = promauto.NewCounter(prometheus.CounterOpts{
 // harmless and not worth a claim.
 func (s *Server) runNodeGCLoop() {
 	defer s.wg.Done()
-	if s.config.NodeRetention <= 0 {
-		return
-	}
-
 	s.gcExpiredNodes(time.Now())
 
 	ticker := time.NewTicker(nodeGCInterval)
@@ -62,12 +58,10 @@ func (s *Server) runNodeGCLoop() {
 }
 
 // gcExpiredNodes deletes every unbanned node whose session expired more than
-// NodeRetention before now. A negative retention means keep forever, and that
-// holds here too, not only in the loop that decides whether to tick.
+// NodeRetention before now. Options.Validate has refused a retention that is
+// not positive, so there is no "keep forever": an unbounded nodes table is
+// what slowed every console refresh and metrics scrape.
 func (s *Server) gcExpiredNodes(now time.Time) {
-	if s.config.NodeRetention <= 0 {
-		return
-	}
 	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
 	defer cancel()
 
diff --git a/internal/controlplane/node_gc_test.go b/internal/controlplane/node_gc_test.go
index c4ae136b..f15ca172 100644
--- a/internal/controlplane/node_gc_test.go
+++ b/internal/controlplane/node_gc_test.go
@@ -16,6 +16,7 @@ package controlplane
 
 import (
 	"context"
+	"strings"
 	"testing"
 	"time"
 
@@ -77,34 +78,16 @@ func TestGCExpiredNodesAppliesRetention(t *testing.T) {
 	}
 }
 
-func TestNodeGCLoopIsOffWithoutRetention(t *testing.T) {
+// A retention that is not positive is refused, not read as "keep forever":
+// an unbounded nodes table is what this GC exists to prevent. Unset is the
+// default (TestGCExpiredNodesDefaultsRetention).
+func TestNodeRetentionMustBePositive(t *testing.T) {
 	store := newMetricsTestStore(t)
-	ctx := context.Background()
-	now := time.Now()
-	if err := store.EnrollNode(ctx, &storage.EnrolledNode{
-		PeerID: "lapsed", PublicKey: []byte("pub"), Biscuit: []byte("b"), Role: api.RoleNode,
-		EnrollmentType: "OIDC", EnrolledAt: now.Add(-2 * time.Hour), ExpiresAt: now.Add(-time.Hour),
-	}); err != nil {
-		t.Fatal(err)
-	}
-
-	srv, err := NewServer(Options{DriverName: "sqlite", DataSourceName: "unused", OIDCIssuer: "https://issuer", NodeRetention: -1}, store)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = srv.Close() }()
-
-	// The loop returns immediately with a negative retention, and a direct
-	// sweep is a no-op too: it means keep forever, not "expired as of now".
-	srv.wg.Add(1)
-	srv.runNodeGCLoop()
-	srv.gcExpiredNodes(now)
-	nodes, err := store.ListNodes(ctx, storage.NodeFilter{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(nodes) != 1 {
-		t.Fatalf("negative retention deleted rows: %d left", len(nodes))
+	for _, retention := range []time.Duration{-1, -time.Hour} {
+		_, err := NewServer(Options{DriverName: "sqlite", DataSourceName: "unused", OIDCIssuer: "https://issuer", NodeRetention: retention}, store)
+		if err == nil || !strings.Contains(err.Error(), "NodeRetention must be positive") {
+			t.Fatalf("NewServer with NodeRetention %s: err = %v, want a refusal naming NodeRetention", retention, err)
+		}
 	}
 }
 
diff --git a/internal/standalone/standalone.go b/internal/standalone/standalone.go
index e5e5d105..f859edec 100644
--- a/internal/standalone/standalone.go
+++ b/internal/standalone/standalone.go
@@ -137,6 +137,9 @@ type ControlPlaneTunables struct {
 	// WorkloadSessionTTL is how long a workload-issuer enrollment stays
 	// refreshable without presenting a fresh platform JWT on /refresh.
 	WorkloadSessionTTL time.Duration
+	// NodeRetention is how long a node record is kept after its session
+	// expired before the control plane deletes it.
+	NodeRetention time.Duration
 	// ManualEnrollment queues bootstrap enrollments for admin approval
 	// instead of auto-approving them.
 	ManualEnrollment bool
@@ -290,6 +293,7 @@ func (s *Server) Start(ctx context.Context) (retErr error) {
 		KeyGracePeriod:        s.opts.ControlPlane.KeyGracePeriod,
 		BiscuitTTL:            s.opts.ControlPlane.BiscuitTTL,
 		WorkloadSessionTTL:    s.opts.ControlPlane.WorkloadSessionTTL,
+		NodeRetention:         s.opts.ControlPlane.NodeRetention,
 		BiscuitTimeout:        10 * time.Second,
 		AdminToken:            s.adminToken,
 		AutoApproveEnrollment: !s.opts.ControlPlane.ManualEnrollment,
diff --git a/site/content/docs/reference/agentmesh-one.md b/site/content/docs/reference/agentmesh-one.md
index 0e3f572f..2755bb36 100644
--- a/site/content/docs/reference/agentmesh-one.md
+++ b/site/content/docs/reference/agentmesh-one.md
@@ -64,6 +64,7 @@ of zero leaves the default of that component unchanged.
 | `--control-plane-key-grace-period` | `--key-grace-period` |
 | `--control-plane-biscuit-ttl` | `--biscuit-ttl` |
 | `--control-plane-workload-session-ttl` | `--workload-session-ttl` |
+| `--control-plane-node-retention` | `--node-retention` |
 | `--control-plane-manual-enrollment` | The opposite of `--auto-approve-enrollment`: queue bootstrap enrollments for approval. |
 | `--router-control-plane-sync-interval` | `agentmesh-router --control-plane-sync-interval` |
 | `--router-low-watermark`, `--router-high-watermark` | `--low-watermark`, `--high-watermark` |
diff --git a/site/content/docs/reference/control-plane.md b/site/content/docs/reference/control-plane.md
index f78d1099..15f73a6c 100644
--- a/site/content/docs/reference/control-plane.md
+++ b/site/content/docs/reference/control-plane.md
@@ -39,7 +39,7 @@ agentmesh-control-plane admin unban --peer <id>     lift a ban
 | `--lease-duration` | `15m` | How long a router lease lasts without renewal. |
 | `--dht-replication` | `3` | How many routers each record a member announces is placed on: the router it announced to keeps it, and places a copy on this many routers closest to the key. A record on three routers survives two of them down at once; each replica more is a copy more of every record. Members are not concerned: they ask the routers they hold. Published on `/info`; every router of the mesh runs on it. |
 | `--dht-reprovide-interval` | `5m` | How often a member re-announces each service it publishes. A provider that stopped without unpublishing stays listed for three intervals, which is how long routers keep a record after its last announcement; the mesh pays its providers divided by the interval in announcements a minute. Published on `/info`. |
-| `--node-retention` | `720h` (30 days) | How long the record of an enrolled node is kept after its session expires. Banned nodes are kept forever. `0` keeps every record. |
+| `--node-retention` | `720h` (30 days) | How long the record of an enrolled node is kept after its session expires. Banned nodes are kept forever. Must be positive; records are never kept forever. |
 | `--mesh-reconnect-interval` | `30s` | How often the event publisher re-reads the router leases and dials any router it is not connected to. On each router it runs the mesh handshake with a credential it mints for its own peer under the signing key, with the role `mesh:role:control-plane`, so the router holds its connection as a member's. |
 | `--log-level` | `info` | `debug`, `info`, `warn`, `error`. |
 | `--log-format` | `text` | `text` or `json`. |

From fcc6ae75ffdba17d670e49d1a6ea08b4882bd76e Mon Sep 17 00:00:00 2001
From: Antonio Ojea <aojea@google.com>
Date: Thu, 15 Oct 2026 05:07:11 +0000
Subject: [PATCH 3/7] storage: a node list carries no blobs, and the SQL arms
 compose

ListNodes read public_key and biscuit_token for every row, about 2 KB a
row, and every caller discarded them: the status pages, the node list,
the egress check. The columns stay out of the list; GetNode reads them
for the one node a caller acts on, and the round-trip test pins that a
listed node carries neither.

nodeStateWhere's admitted arm was a bare OR where the other arms were
parenthesised, so a caller that appended AND would have bound it wrong;
it is parenthesised like the rest. parseNodeStates drops a state named
twice, so a query string cannot grow the OR beyond three arms.
---
 internal/controlplane/ui.go         |  5 ++++-
 internal/storage/round_trip_test.go |  6 +++++-
 internal/storage/sql_store.go       | 18 +++++-------------
 internal/storage/storage.go         |  1 +
 4 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/internal/controlplane/ui.go b/internal/controlplane/ui.go
index ebecbcb9..cd94d018 100644
--- a/internal/controlplane/ui.go
+++ b/internal/controlplane/ui.go
@@ -19,6 +19,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -200,7 +201,9 @@ func parseNodeStates(raw []string) ([]storage.NodeState, error) {
 		state := storage.NodeState(value)
 		switch state {
 		case storage.NodeAdmitted, storage.NodeExpired, storage.NodeBanned:
-			states = append(states, state)
+			if !slices.Contains(states, state) {
+				states = append(states, state)
+			}
 		default:
 			return nil, fmt.Errorf("state must be admitted, expired or banned, not %q", value)
 		}
diff --git a/internal/storage/round_trip_test.go b/internal/storage/round_trip_test.go
index 8fab2052..d6cc8d9d 100644
--- a/internal/storage/round_trip_test.go
+++ b/internal/storage/round_trip_test.go
@@ -140,6 +140,7 @@ func TestEnrolledNodeRoundTripsEveryField(t *testing.T) {
 	requireFieldsRoundTrip(t, want, got, "Banned")
 
 	// ListNodes selects its own column list, so it can drift from GetNode.
+	// It leaves the two blobs out on purpose: a list is a view of the rows.
 	listed, err := store.ListNodes(ctx, NodeFilter{})
 	if err != nil {
 		t.Fatalf("ListNodes: %v", err)
@@ -147,7 +148,10 @@ func TestEnrolledNodeRoundTripsEveryField(t *testing.T) {
 	if len(listed) != 1 {
 		t.Fatalf("ListNodes returned %d nodes, want 1", len(listed))
 	}
-	requireFieldsRoundTrip(t, want, &listed[0], "Banned")
+	requireFieldsRoundTrip(t, want, &listed[0], "Banned", "PublicKey", "Biscuit")
+	if len(listed[0].PublicKey) != 0 || len(listed[0].Biscuit) != 0 {
+		t.Errorf("ListNodes read the blobs: public key %d bytes, biscuit %d bytes; GetNode is what reads them", len(listed[0].PublicKey), len(listed[0].Biscuit))
+	}
 }
 
 // Autonomous recovery is a per-node, server-side opt-in: it must default
diff --git a/internal/storage/sql_store.go b/internal/storage/sql_store.go
index 4394e090..b0587033 100644
--- a/internal/storage/sql_store.go
+++ b/internal/storage/sql_store.go
@@ -1705,7 +1705,9 @@ func (s *SQLStore) ListNodes(ctx context.Context, filter NodeFilter) ([]Enrolled
 	if err != nil {
 		return nil, err
 	}
-	query := `SELECT peer_id, public_key, biscuit_token, role, enrollment_type, claims_json, owner_id, labels_json, enrolled_at, expires_at, banned, autonomous_recovery FROM nodes` + where + ` ORDER BY enrolled_at DESC, peer_id DESC`
+	// Neither blob is read: a list is a view of the rows, and the biscuit is
+	// a 2 KB column per row that only GetNode's single-row callers need.
+	query := `SELECT peer_id, role, enrollment_type, claims_json, owner_id, labels_json, enrolled_at, expires_at, banned, autonomous_recovery FROM nodes` + where + ` ORDER BY enrolled_at DESC, peer_id DESC`
 	if filter.Limit > 0 {
 		query += ` LIMIT ?`
 		args = append(args, filter.Limit)
@@ -1723,8 +1725,6 @@ func (s *SQLStore) ListNodes(ctx context.Context, filter NodeFilter) ([]Enrolled
 		var enrolledAtUnix, expiresAtUnix int64
 		err := rows.Scan(
 			&node.PeerID,
-			&node.PublicKey,
-			&node.Biscuit,
 			&node.Role,
 			&node.EnrollmentType,
 			&claimsJSON,
@@ -1751,15 +1751,6 @@ func (s *SQLStore) ListNodes(ctx context.Context, filter NodeFilter) ([]Enrolled
 		}
 		node.EnrolledAt = time.UnixMilli(enrolledAtUnix)
 		node.ExpiresAt = time.UnixMilli(expiresAtUnix)
-
-		pubCopy := make([]byte, len(node.PublicKey))
-		copy(pubCopy, node.PublicKey)
-		node.PublicKey = pubCopy
-
-		biscuitCopy := make([]byte, len(node.Biscuit))
-		copy(biscuitCopy, node.Biscuit)
-		node.Biscuit = biscuitCopy
-
 		nodes = append(nodes, node)
 	}
 	if err := rows.Err(); err != nil {
@@ -1818,7 +1809,8 @@ func nodeStateWhere(state NodeState, now time.Time) (string, []any, error) {
 	case NodeExpired:
 		return "(banned = ? AND expires_at > 0 AND expires_at < ?)", []any{false, ms}, nil
 	case NodeAdmitted:
-		return "(banned = ? AND expires_at <= 0) OR (banned = ? AND expires_at >= ?)", []any{false, false, ms}, nil
+		// Parenthesised like the other arms, so a caller may AND it with more.
+		return "((banned = ? AND expires_at <= 0) OR (banned = ? AND expires_at >= ?))", []any{false, false, ms}, nil
 	}
 	return "", nil, fmt.Errorf("unknown node state %q", state)
 }
diff --git a/internal/storage/storage.go b/internal/storage/storage.go
index 37338dd8..251b399c 100644
--- a/internal/storage/storage.go
+++ b/internal/storage/storage.go
@@ -353,6 +353,7 @@ type Store interface {
 
 	// ListNodes retrieves the enrolled nodes the filter selects, newest
 	// enrollment first. Peer ID breaks ties, so pages neither skip nor repeat a row.
+	// A listed node carries no PublicKey and no Biscuit: GetNode reads those.
 	ListNodes(ctx context.Context, filter NodeFilter) ([]EnrolledNode, error)
 
 	// CountNodes counts every enrolled node by role and by its state at now.

From 3aebe3dc1acd32bb5d9c1f85e5bfe2535b0ffedf Mon Sep 17 00:00:00 2001
From: Antonio Ojea <aojea@google.com>
Date: Thu, 15 Oct 2026 06:00:38 +0000
Subject: [PATCH 4/7] controlplane, console: a user's status lists admitted
 nodes; one status call per refresh

GET /user/status listed a user's banned nodes with the admitted ones.
A banned row is never garbage-collected and only an administrator can
restore it, and the console never showed a user their banned nodes, so
every node a user ever revoked travelled in their 15 s poll forever. A
user's status now lists admitted nodes; an administrator's lists banned
ones too, for the revoked table.

The console fetched /user/status on every refresh to learn the role and
then, for an administrator, /admin/status, which ran the same mesh-wide
queries again and replaced the first answer. It learns the role once per
session and then calls the one status that matches it.
---
 internal/console/public/app.js       | 25 ++++++++++++++++++-------
 internal/controlplane/server.go      |  4 ++++
 internal/controlplane/server_test.go | 18 ++++++++++++++++++
 3 files changed, 40 insertions(+), 7 deletions(-)

diff --git a/internal/console/public/app.js b/internal/console/public/app.js
index a2b47257..b1bd4178 100644
--- a/internal/console/public/app.js
+++ b/internal/console/public/app.js
@@ -4,6 +4,10 @@ const TOAST_TIMEOUT_MS = 5000;
 
 let refreshTimer = null;
 let refreshInFlight = false;
+// The session's role and user ID, learned from the first /user/status of a
+// session. An admin's later refreshes read /admin/status alone: /user/status
+// would list the same mesh a second time only to be overwritten.
+let session = null;
 // Last policy the server confirmed, so an edit is never silently overwritten by
 // a background refresh or thrown away by a stray click.
 let policyBaseline = '';
@@ -147,6 +151,7 @@ function showApp() {
 function showLandingPage() {
     stopAutoRefresh();
     resetExpiredNodes();
+    session = null;
     document.getElementById('landing-page').classList.add('active');
     document.getElementById('app-container').style.display = 'none';
 }
@@ -195,8 +200,10 @@ window.saveAdminToken = function() {
 
 async function loadData() {
     try {
-        // 1. Fetch user-scoped status
-        const response = await fetch('api/user/status');
+        // One status call per refresh: the user's own until the role is known,
+        // then the one that matches the role.
+        const endpoint = session !== null && session.role === 'admin' ? 'api/admin/status' : 'api/user/status';
+        const response = await fetch(endpoint);
         if (response.status === 401 || response.status === 403) {
             showLandingPage();
             throw new Error('Unauthorized. Please login again.');
@@ -205,15 +212,19 @@ async function loadData() {
             throw new Error(`HTTP error! status: ${response.status}`);
         }
         let data = await response.json();
-        
-        const role = data.user ? data.user.role : 'user';
-        const userId = data.user ? data.user.id : '';
+
+        if (data.user) {
+            session = { role: data.user.role || 'user', id: data.user.id || '' };
+        }
+        const role = session !== null ? session.role : 'user';
+        const userId = session !== null ? session.id : '';
         
         // Update UI components depending on Role
         updateUIForRole(role, userId);
 
-        // 2. If user is admin, fetch full unfiltered admin status
-        if (role === 'admin') {
+        // The first call of an admin's session answered with the user's view;
+        // the mesh-wide one is what the admin console renders.
+        if (role === 'admin' && endpoint !== 'api/admin/status') {
             const adminResp = await fetch('api/admin/status');
             if (adminResp.ok) {
                 data = await adminResp.json();
diff --git a/internal/controlplane/server.go b/internal/controlplane/server.go
index 0e1df95b..e04a2895 100644
--- a/internal/controlplane/server.go
+++ b/internal/controlplane/server.go
@@ -3105,8 +3105,12 @@ func (s *Server) HandleUserStatus(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	isAdmin := user.Role == "admin"
 
+	// A banned node is out of the mesh and only an administrator can restore
+	// it, so only the administrators' list carries banned rows: a user's
+	// list would otherwise keep every node they ever revoked, forever.
 	filter := storage.NodeFilter{States: statusNodeStates, Now: time.Now()}
 	if !isAdmin {
+		filter.States = []storage.NodeState{storage.NodeAdmitted}
 		filter.OwnerID = &user.ID
 	}
 	allNodes, err := s.store.ListNodes(ctx, filter)
diff --git a/internal/controlplane/server_test.go b/internal/controlplane/server_test.go
index 22d18c1b..d6461645 100644
--- a/internal/controlplane/server_test.go
+++ b/internal/controlplane/server_test.go
@@ -2620,6 +2620,24 @@ func TestUserStatusAndTenancy(t *testing.T) {
 	if !nodeAUpdated.Banned {
 		t.Error("expected node A to be banned/revoked in DB")
 	}
+
+	// A revoked node is out of the user's list from then on: banned rows are
+	// never garbage-collected, and only an administrator can restore one.
+	req, _ = http.NewRequest("GET", baseURL+"/user/status", nil)
+	req.Header.Set("Authorization", "Bearer "+tokenA)
+	resp, err = client.Do(req)
+	if err != nil {
+		t.Fatalf("GET /user/status after revoke failed: %v", err)
+	}
+	statusBody, _ = io.ReadAll(resp.Body)
+	_ = resp.Body.Close()
+	data = &api.UserStatusResponse{}
+	if err := protojson.Unmarshal(statusBody, data); err != nil {
+		t.Fatalf("decode /user/status after revoke: %v", err)
+	}
+	if nodes := data.GetEnrolledNodes(); len(nodes) != 0 {
+		t.Errorf("after revoking its only node the user's status lists %d node(s), want none: %v", len(nodes), nodes)
+	}
 }
 
 func TestResolveRolesAndRoleImpersonationProtection(t *testing.T) {

From c13ac6ae2e7fcbff61fd0109bac980fe2dfe7ccd Mon Sep 17 00:00:00 2001
From: Antonio Ojea <aojea@google.com>
Date: Thu, 15 Oct 2026 07:53:55 +0000
Subject: [PATCH 5/7] controlplane: a store that does not answer is 503 to a
 member, not 401

admittedNode returned nil for a store read that failed as it did for a
credential that did not verify, so a database stall answered every
member request with 401 Unauthorized and no log line. On the testnet one
such stall produced 484 of them in a step of the ladder: members were
told their credential was refused when nothing about it had changed, and
the cause was read from the database's own log.

admittedNode now tells a store failure from a missing credential; the
mesh endpoints answer it with 503 Service Unavailable and one error log
line naming the path and the store error, and the OAuth paths answer
temporarily_unavailable. A member retries at its next sync, which is
what it does for a 503 and not for a 401.
---
 internal/controlplane/catalog_test.go | 72 +++++++++++++++++++++++++++
 internal/controlplane/server.go       | 42 ++++++++++++----
 internal/controlplane/sts.go          | 25 ++++++++--
 3 files changed, 124 insertions(+), 15 deletions(-)

diff --git a/internal/controlplane/catalog_test.go b/internal/controlplane/catalog_test.go
index 3b34b94c..c390a726 100644
--- a/internal/controlplane/catalog_test.go
+++ b/internal/controlplane/catalog_test.go
@@ -19,14 +19,18 @@ import (
 	"context"
 	"crypto/ed25519"
 	"encoding/base64"
+	"errors"
 	"io"
 	"net/http"
+	"path/filepath"
 	"strconv"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/google/agentmesh/api"
 	"github.com/google/agentmesh/internal/identity"
+	"github.com/google/agentmesh/internal/storage"
 	"github.com/libp2p/go-libp2p/core/crypto"
 	"github.com/libp2p/go-libp2p/core/peer"
 	"google.golang.org/protobuf/encoding/protojson"
@@ -320,6 +324,74 @@ func TestHandleNodeCatalog_Admission(t *testing.T) {
 	}
 }
 
+// failingStore is a store whose reads fail on demand, the way a database
+// that stopped answering looks to the control plane.
+type failingStore struct {
+	storage.Store
+	fail atomic.Bool
+}
+
+func (f *failingStore) GetAllValidPublicKeys(ctx context.Context) ([]ed25519.PublicKey, error) {
+	if f.fail.Load() {
+		return nil, errors.New("store: connection refused")
+	}
+	return f.Store.GetAllValidPublicKeys(ctx)
+}
+
+func (f *failingStore) GetNode(ctx context.Context, peerID string) (*storage.EnrolledNode, error) {
+	if f.fail.Load() {
+		return nil, errors.New("store: connection refused")
+	}
+	return f.Store.GetNode(ctx, peerID)
+}
+
+// A store that does not answer is an outage, not a refusal: the member is
+// told 503 and the control plane logs it, where before it was told 401, the
+// answer a revoked credential gets, and nothing was logged. On the testnet
+// a database stall produced hundreds of such 401s per step of the ladder.
+func TestMemberAuthAnswersStoreFailureAs503(t *testing.T) {
+	t.Parallel()
+
+	dbPath := filepath.Join(t.TempDir(), "control-plane.db")
+	real, err := storage.NewSQLStore("sqlite", dbPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	store := &failingStore{Store: real}
+	srv, err := NewServer(Options{
+		ListenAddr: "127.0.0.1:0", DriverName: "sqlite", DataSourceName: dbPath,
+		AllowedAudiences: []string{"agentmesh-audience"}, BiscuitTimeout: 10 * time.Second,
+	}, store)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := srv.Start(); err != nil {
+		t.Fatal(err)
+	}
+	defer func() {
+		_ = srv.Close()
+		_ = real.Close()
+	}()
+	cpURL := "http://" + srv.listener.Addr().String()
+
+	ctx := context.Background()
+	priv, biscuitBytes := enrollRefreshTestNode(t, ctx, real)
+	body := catalogBody(t, &api.ServiceInfo{Type: api.ServiceType_SERVICE_TYPE_MCP, Name: "calc"})
+	if got := postCatalog(t, cpURL, bearer(biscuitBytes), priv, body); got != http.StatusNoContent {
+		t.Fatalf("admitted node with a healthy store: got status %d, want %d", got, http.StatusNoContent)
+	}
+
+	store.fail.Store(true)
+	if got := postCatalog(t, cpURL, bearer(biscuitBytes), priv, body); got != http.StatusServiceUnavailable {
+		t.Fatalf("admitted node with a failing store: got status %d, want %d, not a refusal", got, http.StatusServiceUnavailable)
+	}
+
+	store.fail.Store(false)
+	if got := postCatalog(t, cpURL, bearer(biscuitBytes), priv, body); got != http.StatusNoContent {
+		t.Fatalf("admitted node once the store answers again: got status %d, want %d", got, http.StatusNoContent)
+	}
+}
+
 // The cache is keyed by the canonical base58 form from the verified biscuit,
 // but the enrollment record's PeerID comes off the wire and may be any valid
 // encoding of the same peer (e.g. CIDv1 base32). The view lookup and the
diff --git a/internal/controlplane/server.go b/internal/controlplane/server.go
index e04a2895..e7e617bb 100644
--- a/internal/controlplane/server.go
+++ b/internal/controlplane/server.go
@@ -1661,9 +1661,15 @@ func (s *Server) unservedEgress(ctx context.Context, policy *api.PolicyConfig) (
 // admittedNodeWithChallenge returns the enrolled, admitted node whose biscuit
 // the request bears after verifying the signed freshness challenge in
 // HeaderChallengeTimestamp and HeaderChallengeSignature against the node's
-// stored public key. Every failure writes a uniform 401 Unauthorized.
+// stored public key. A credential that does not verify writes a uniform 401
+// Unauthorized; a store that could not be read writes 503, so that a member
+// retries instead of taking a database outage for a revocation.
 func (s *Server) admittedNodeWithChallenge(w http.ResponseWriter, r *http.Request, challengeFn func(peerID string, ts int64) []byte) *storage.EnrolledNode {
-	nodeRecord := s.admittedNode(r)
+	nodeRecord, err := s.admittedNode(r)
+	if err != nil {
+		writeStoreUnavailable(w, r, err)
+		return nil
+	}
 	if nodeRecord == nil {
 		writeChallengeError(w, "Unauthorized: node credential required")
 		return nil
@@ -1689,29 +1695,43 @@ func (s *Server) admittedNodeWithChallenge(w http.ResponseWriter, r *http.Reques
 }
 
 // admittedNode returns the enrolled, admitted node whose biscuit the request
-// bears, or nil.
-func (s *Server) admittedNode(r *http.Request) *storage.EnrolledNode {
+// bears, or nil when the request carries no such credential. The error is a
+// store that could not be read, which says nothing about the credential;
+// the caller answers it as an outage, not as a refusal.
+func (s *Server) admittedNode(r *http.Request) (*storage.EnrolledNode, error) {
 	authHeader := r.Header.Get("Authorization")
 	if !strings.HasPrefix(authHeader, "Bearer ") {
-		return nil
+		return nil, nil
 	}
 	biscuitBytes, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(authHeader, "Bearer "))
 	if err != nil {
-		return nil
+		return nil, nil
 	}
 	trustedKeys, err := s.store.GetAllValidPublicKeys(r.Context())
 	if err != nil {
-		return nil
+		return nil, fmt.Errorf("signing keys: %w", err)
 	}
 	peerID, err := identity.VerifyAndExtractPeerID(trustedKeys, biscuitBytes, s.config.BiscuitTimeout)
 	if err != nil {
-		return nil
+		return nil, nil
 	}
 	nodeRecord, err := s.store.GetNode(r.Context(), peerID.String())
-	if err != nil || nodeRecord == nil || nodeRecord.CheckAdmission(time.Now()) != nil {
-		return nil
+	if err != nil && !errors.Is(err, storage.ErrNotFound) {
+		return nil, fmt.Errorf("node %s: %w", peerID, err)
 	}
-	return nodeRecord
+	if nodeRecord == nil || nodeRecord.CheckAdmission(time.Now()) != nil {
+		return nil, nil
+	}
+	return nodeRecord, nil
+}
+
+// writeStoreUnavailable answers a mesh request the control plane could not
+// authenticate because its own store did not answer: 503, so the member
+// retries at its next sync, and a log line, so the outage is read from the
+// control plane and not inferred from members reporting 401.
+func writeStoreUnavailable(w http.ResponseWriter, r *http.Request, err error) {
+	logger.Errorw("Store unavailable while authenticating a member", "path", r.URL.Path, "error", err)
+	http.Error(w, "Service unavailable: control plane store did not answer", http.StatusServiceUnavailable)
 }
 
 // HandleEgress HTTP GET `/egress`: the egress destinations the requesting
diff --git a/internal/controlplane/sts.go b/internal/controlplane/sts.go
index 2b8414c8..37ccaeb3 100644
--- a/internal/controlplane/sts.go
+++ b/internal/controlplane/sts.go
@@ -743,7 +743,11 @@ func (s *Server) HandleTokenExchange(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
 		return
 	}
-	nodeRecord := s.admittedNode(r)
+	nodeRecord, err := s.admittedNode(r)
+	if err != nil {
+		writeStoreUnavailable(w, r, err)
+		return
+	}
 	if nodeRecord == nil {
 		writeChallengeError(w, "Unauthorized: node credential required")
 		return
@@ -944,7 +948,11 @@ func (s *Server) HandleSTSToken(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
 		return
 	}
-	nodeRecord := s.admittedNode(r)
+	nodeRecord, err := s.admittedNode(r)
+	if err != nil {
+		writeStoreUnavailable(w, r, err)
+		return
+	}
 	if nodeRecord == nil {
 		writeChallengeError(w, "Unauthorized: node credential required")
 		return
@@ -1553,7 +1561,11 @@ func decodeBase64Biscuit(encoded string) ([]byte, error) {
 }
 
 func (s *Server) resolveDefaultActorPeer(ctx context.Context, r *http.Request) (peer.ID, error) {
-	if nodeRecord := s.admittedNode(r); nodeRecord != nil {
+	nodeRecord, err := s.admittedNode(r)
+	if err != nil {
+		return "", err
+	}
+	if nodeRecord != nil {
 		return peer.Decode(nodeRecord.PeerID)
 	}
 	_, pub, err := s.store.GetCurrentKey(ctx)
@@ -1708,7 +1720,12 @@ func (s *Server) handleOAuthTokenExchangeGrant(w http.ResponseWriter, r *http.Re
 			}
 		}
 	} else {
-		admitted := s.admittedNode(r)
+		admitted, storeErr := s.admittedNode(r)
+		if storeErr != nil {
+			logger.Errorw("Store unavailable while authenticating a member", "path", r.URL.Path, "error", storeErr)
+			writeOAuthError(w, http.StatusServiceUnavailable, "temporarily_unavailable", "control plane store did not answer")
+			return
+		}
 		actorPeerID, err := s.resolveDefaultActorPeer(r.Context(), r)
 		if err != nil {
 			writeOAuthError(w, http.StatusBadRequest, "invalid_request", "Could not resolve actor peer_id: "+err.Error())

From 92bf43543da1ec72872eee80d53d214e5b8f113f Mon Sep 17 00:00:00 2001
From: Antonio Ojea <aojea@google.com>
Date: Thu, 15 Oct 2026 08:55:22 +0000
Subject: [PATCH 6/7] controlplane: the node GC sweeps at a tenth of the
 retention

The sweep ran hourly whatever the retention, so a retention shorter than
an hour was honoured only at the next restart. It now runs at a tenth of
the retention, no more often than every second and no less often than
hourly: the default 30 days still sweeps hourly, and a retention of
seconds, which an integration test sets to watch the table shrink, is
honoured within seconds.
---
 internal/controlplane/node_gc.go      | 17 +++++++++++++----
 internal/controlplane/node_gc_test.go | 17 +++++++++++++++++
 2 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/internal/controlplane/node_gc.go b/internal/controlplane/node_gc.go
index c7a5237a..91529108 100644
--- a/internal/controlplane/node_gc.go
+++ b/internal/controlplane/node_gc.go
@@ -28,11 +28,20 @@ const (
 	// and is what --node-retention defaults to.
 	DefaultNodeRetention = 30 * 24 * time.Hour
 
-	// nodeGCInterval is how often the sweep runs. Rows lapse on a scale of
-	// days, so nothing is gained by sweeping more often than hourly.
-	nodeGCInterval = time.Hour
+	// maxNodeGCInterval bounds how often the sweep runs. Rows lapse on a
+	// scale of days, so nothing is gained by sweeping more often than hourly;
+	// a retention far shorter than that, as a test sets, sweeps at a tenth
+	// of it so a lapsed row does not outlive the retention by much.
+	maxNodeGCInterval = time.Hour
+	minNodeGCInterval = time.Second
 )
 
+// nodeGCInterval is the sweep period for a retention: a tenth of it, within
+// [minNodeGCInterval, maxNodeGCInterval].
+func nodeGCInterval(retention time.Duration) time.Duration {
+	return min(maxNodeGCInterval, max(minNodeGCInterval, retention/10))
+}
+
 var nodesDeletedTotal = promauto.NewCounter(prometheus.CounterOpts{
 	Name: "agentmesh_control_plane_nodes_deleted_total",
 	Help: "Enrolled node records removed after outliving their session by the retention period",
@@ -45,7 +54,7 @@ func (s *Server) runNodeGCLoop() {
 	defer s.wg.Done()
 	s.gcExpiredNodes(time.Now())
 
-	ticker := time.NewTicker(nodeGCInterval)
+	ticker := time.NewTicker(nodeGCInterval(s.config.NodeRetention))
 	defer ticker.Stop()
 	for {
 		select {
diff --git a/internal/controlplane/node_gc_test.go b/internal/controlplane/node_gc_test.go
index f15ca172..58b62e7b 100644
--- a/internal/controlplane/node_gc_test.go
+++ b/internal/controlplane/node_gc_test.go
@@ -91,6 +91,23 @@ func TestNodeRetentionMustBePositive(t *testing.T) {
 	}
 }
 
+// The sweep runs at a tenth of the retention, no more often than every
+// second and no less often than hourly: the default retention sweeps hourly,
+// a test's retention of seconds sweeps every second.
+func TestNodeGCIntervalFollowsRetention(t *testing.T) {
+	for retention, want := range map[time.Duration]time.Duration{
+		DefaultNodeRetention: time.Hour,
+		24 * time.Hour:       time.Hour,
+		5 * time.Hour:        30 * time.Minute,
+		time.Second:          time.Second,
+		3 * time.Second:      time.Second,
+	} {
+		if got := nodeGCInterval(retention); got != want {
+			t.Errorf("nodeGCInterval(%s) = %s, want %s", retention, got, want)
+		}
+	}
+}
+
 // A caller that leaves NodeRetention unset, such as agentmesh-one, still
 // reclaims rows whose session lapsed more than DefaultNodeRetention ago.
 func TestGCExpiredNodesDefaultsRetention(t *testing.T) {

From c49a98904662fcb1a0e83d197f7ace75633ff727 Mon Sep 17 00:00:00 2001
From: Antonio Ojea <aojea@google.com>
Date: Thu, 15 Oct 2026 09:06:59 +0000
Subject: [PATCH 7/7] tests: the nodes table is bounded, in seconds

An integration test for what the scale runs found on the testnet: a
probe CronJob enrolls a fresh identity every run and never comes back
for it, such rows stayed forever, the metrics scrape read every one of
them every 30 seconds, and the control plane stalled on it.

TestLapsedMembersAreCollected is that in seconds: one member keeps its
session alive by refreshing with a fresh token, sixteen enroll and
leave. Their sessions lapse; a lapsed member is refused at /refresh; the
admin status lists only the member that refreshes; GET
/user/nodes?state=expired pages the lapsed rows; /metrics counts them by
state without listing them. The retention passes, the GC deletes them,
nodes_deleted_total says so, and the member that refreshed throughout is
untouched.
---
 tests/integration/node_lifecycle_test.go | 286 +++++++++++++++++++++++
 1 file changed, 286 insertions(+)
 create mode 100644 tests/integration/node_lifecycle_test.go

diff --git a/tests/integration/node_lifecycle_test.go b/tests/integration/node_lifecycle_test.go
new file mode 100644
index 00000000..b7f9afd7
--- /dev/null
+++ b/tests/integration/node_lifecycle_test.go
@@ -0,0 +1,286 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package integration_test
+
+import (
+	"bytes"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/google/agentmesh/api"
+	"github.com/libp2p/go-libp2p/core/crypto"
+	"github.com/libp2p/go-libp2p/core/peer"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
+)
+
+// oidcMember is a member enrolled with an OIDC token, driven over the
+// control plane API alone: the test decides when it refreshes and with what.
+type oidcMember struct {
+	priv    crypto.PrivKey
+	peerID  peer.ID
+	sub     string
+	biscuit []byte
+}
+
+// enrollOIDCMember enrolls a fresh key at POST /register with a token for sub.
+func enrollOIDCMember(t *testing.T, cpPort int, mintToken func(map[string]interface{}) string, sub string) *oidcMember {
+	t.Helper()
+	priv, _, err := crypto.GenerateKeyPair(crypto.Ed25519, -1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pID, err := peer.IDFromPrivateKey(priv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	enrolled := registerOnControlPlane(t, cpPort, pID, priv, mintToken(map[string]interface{}{"sub": sub, "roles": []string{api.RoleNode}}))
+	return &oidcMember{priv: priv, peerID: pID, sub: sub, biscuit: enrolled.BiscuitToken}
+}
+
+// refresh is one POST /refresh with the member's current credential and,
+// when jwt is set, a fresh platform token that renews the session; on
+// success the member holds the new credential. It returns status and body.
+func (m *oidcMember) refresh(t *testing.T, cpURL, jwt string) (int, string) {
+	t.Helper()
+	ts := time.Now().UnixMilli()
+	sig, err := m.priv.Sign(api.RefreshChallenge(m.peerID.String(), ts))
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, err := proto.Marshal(&api.TokenRefreshRequest{ChallengeUnixMs: ts, ChallengeSignature: sig, Jwt: jwt})
+	if err != nil {
+		t.Fatal(err)
+	}
+	req, _ := http.NewRequest(http.MethodPost, cpURL+"/refresh", bytes.NewReader(body))
+	req.Header.Set("Authorization", "Bearer "+base64.StdEncoding.EncodeToString(m.biscuit))
+	req.Header.Set("Content-Type", "application/x-protobuf")
+	resp, err := (&http.Client{Timeout: 5 * time.Second}).Do(req)
+	if err != nil {
+		t.Fatalf("POST /refresh: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	data, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode == http.StatusOK {
+		var refreshed api.TokenRefreshResponse
+		if err := proto.Unmarshal(data, &refreshed); err != nil {
+			t.Fatal(err)
+		}
+		m.biscuit = refreshed.BiscuitToken
+	}
+	return resp.StatusCode, string(data)
+}
+
+// listNodes is GET /user/nodes as the administrator, one page.
+func listNodes(t *testing.T, cpURL, adminToken, query string) *api.NodeListResponse {
+	t.Helper()
+	req, _ := http.NewRequest(http.MethodGet, cpURL+"/user/nodes?"+query, nil)
+	req.Header.Set("Authorization", "Bearer "+adminToken)
+	resp, err := (&http.Client{Timeout: 5 * time.Second}).Do(req)
+	if err != nil {
+		t.Fatalf("GET /user/nodes?%s: %v", query, err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	data, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("GET /user/nodes?%s: %d %s", query, resp.StatusCode, data)
+	}
+	var page api.NodeListResponse
+	if err := protojson.Unmarshal(data, &page); err != nil {
+		t.Fatalf("GET /user/nodes?%s: %v", query, err)
+	}
+	return &page
+}
+
+// controlPlaneMetric reads one series from the control plane's /metrics.
+func controlPlaneMetric(t *testing.T, cpURL, series string) (float64, bool) {
+	t.Helper()
+	resp, err := http.Get(cpURL + "/metrics")
+	if err != nil {
+		t.Fatalf("GET /metrics: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	data, _ := io.ReadAll(resp.Body)
+	for _, line := range strings.Split(string(data), "\n") {
+		if strings.HasPrefix(line, series+" ") {
+			var v float64
+			if _, err := fmt.Sscanf(strings.TrimPrefix(line, series+" "), "%g", &v); err != nil {
+				t.Fatalf("parse %q: %v", line, err)
+			}
+			return v, true
+		}
+	}
+	return 0, false
+}
+
+// TestLapsedMembersAreCollected is the testnet's nodes table in seconds. A
+// probe CronJob enrolls a fresh identity every run and never comes back for
+// it; such rows stayed forever, the table grew without bound, the metrics
+// scrape read every row every 30 seconds and the control plane stalled on
+// it. One member keeps its session alive by refreshing with a fresh token;
+// sixteen enroll and leave.
+func TestLapsedMembersAreCollected(t *testing.T) {
+	tmpDir := t.TempDir()
+	oidcURL, mintToken := startCustomMockOIDC(t)
+	policyFile := filepath.Join(tmpDir, "policies.yaml")
+	policy := fmt.Sprintf("roles: []\nbindings:\n  - role: %s\n    members: [%q]\n", api.RoleNode, api.SystemAuthenticated)
+	if err := os.WriteFile(policyFile, []byte(policy), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	// Sessions of two seconds, kept for one more after they lapse; the GC
+	// sweeps at a tenth of the retention, no less often than every second.
+	cpPort, _ := startControlPlane(t, tmpDir, oidcURL, policyFile,
+		"--oidc-session-ttl", "2s",
+		"--node-retention", "1s",
+	)
+	cpURL := fmt.Sprintf("http://127.0.0.1:%d", cpPort)
+
+	// Under the enrollment limiter's burst (controlplane.EnrollBurst), which
+	// is a guard this test leaves in force.
+	const leaving = 16
+	stayer := enrollOIDCMember(t, cpPort, mintToken, "stayer")
+	leavers := make([]*oidcMember, leaving)
+	for i := range leavers {
+		leavers[i] = enrollOIDCMember(t, cpPort, mintToken, fmt.Sprintf("leaver-%02d", i))
+	}
+	enrolledAt := time.Now()
+
+	// The one that stays refreshes with a fresh token well within its
+	// session; each such refresh renews the session.
+	stop := make(chan struct{})
+	stopRefreshing := sync.OnceFunc(func() { close(stop) })
+	t.Cleanup(stopRefreshing)
+	refreshed := make(chan error, 1)
+	go func() {
+		defer close(refreshed)
+		ticker := time.NewTicker(500 * time.Millisecond)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-stop:
+				return
+			case <-ticker.C:
+				ts := time.Now().UnixMilli()
+				sig, err := stayer.priv.Sign(api.RefreshChallenge(stayer.peerID.String(), ts))
+				if err != nil {
+					refreshed <- err
+					return
+				}
+				jwt := mintToken(map[string]interface{}{"sub": stayer.sub, "roles": []string{api.RoleNode}})
+				body, _ := proto.Marshal(&api.TokenRefreshRequest{ChallengeUnixMs: ts, ChallengeSignature: sig, Jwt: jwt})
+				req, _ := http.NewRequest(http.MethodPost, cpURL+"/refresh", bytes.NewReader(body))
+				req.Header.Set("Authorization", "Bearer "+base64.StdEncoding.EncodeToString(stayer.biscuit))
+				req.Header.Set("Content-Type", "application/x-protobuf")
+				resp, err := (&http.Client{Timeout: 5 * time.Second}).Do(req)
+				if err != nil {
+					refreshed <- err
+					return
+				}
+				data, _ := io.ReadAll(resp.Body)
+				_ = resp.Body.Close()
+				if resp.StatusCode != http.StatusOK {
+					refreshed <- fmt.Errorf("refresh of the member that stays: %d %s", resp.StatusCode, data)
+					return
+				}
+				var out api.TokenRefreshResponse
+				if err := proto.Unmarshal(data, &out); err != nil {
+					refreshed <- err
+					return
+				}
+				stayer.biscuit = out.BiscuitToken
+			}
+		}
+	}()
+
+	// Every member is admitted; the status lists them all.
+	if got := len(fetchAdminStatus(t, cpPort, testAdminToken).GetEnrolledNodes()); got != leaving+1 {
+		t.Fatalf("admin status lists %d nodes right after enrollment, want %d", got, leaving+1)
+	}
+
+	// The leavers' sessions lapse. A lapsed member is refused at /refresh
+	// and told what to do; it is out of the status and in the expired list,
+	// which pages; and the metrics count it by state without listing it.
+	time.Sleep(time.Until(enrolledAt.Add(2500 * time.Millisecond)))
+	if status, body := leavers[0].refresh(t, cpURL, ""); status != http.StatusUnauthorized || !strings.Contains(body, "Session expired") {
+		t.Fatalf("refresh of a lapsed member: %d %s, want 401 naming the lapsed session", status, strings.TrimSpace(body))
+	}
+	if nodes := fetchAdminStatus(t, cpPort, testAdminToken).GetEnrolledNodes(); len(nodes) != 1 || nodes[0].GetPeerId() != stayer.peerID.String() {
+		t.Fatalf("admin status after the sessions lapsed lists %d nodes, want only the one that refreshes", len(nodes))
+	}
+	var expired []string
+	pageToken := ""
+	for pages := 0; ; pages++ {
+		page := listNodes(t, cpURL, testAdminToken, "state=expired&page_size=5&page_token="+pageToken)
+		for _, n := range page.GetNodes() {
+			expired = append(expired, n.GetPeerId())
+		}
+		if page.GetNextPageToken() == "" {
+			if pages != 3 {
+				t.Errorf("%d expired nodes came in %d pages of 5, want 4", len(expired), pages+1)
+			}
+			break
+		}
+		pageToken = page.GetNextPageToken()
+	}
+	if len(expired) != leaving {
+		t.Fatalf("expired list holds %d nodes, want the %d that left: %v", len(expired), leaving, expired)
+	}
+	for _, id := range expired {
+		if id == stayer.peerID.String() {
+			t.Fatalf("the member that refreshes is in the expired list")
+		}
+	}
+	if v, ok := controlPlaneMetric(t, cpURL, `agentmesh_control_plane_enrolled_nodes{role="mesh:role:node",state="expired"}`); !ok || v != leaving {
+		t.Errorf("enrolled_nodes{state=expired} = %v (present %v), want %d", v, ok, leaving)
+	}
+	if v, ok := controlPlaneMetric(t, cpURL, `agentmesh_control_plane_enrolled_nodes{role="mesh:role:node",state="admitted"}`); !ok || v != 1 {
+		t.Errorf("enrolled_nodes{state=admitted} = %v (present %v), want 1", v, ok)
+	}
+
+	// The retention passes and the GC deletes the lapsed rows; the member
+	// that refreshes is untouched.
+	deadline := time.Now().Add(6 * time.Second)
+	for {
+		left := listNodes(t, cpURL, testAdminToken, "state=expired&page_size=200").GetNodes()
+		if len(left) == 0 {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("%d lapsed rows still in the table %s after they lapsed; want them deleted after the retention", len(left), time.Since(enrolledAt))
+		}
+		time.Sleep(200 * time.Millisecond)
+	}
+	if v, ok := controlPlaneMetric(t, cpURL, "agentmesh_control_plane_nodes_deleted_total"); !ok || v != leaving {
+		t.Errorf("nodes_deleted_total = %v (present %v), want %d", v, ok, leaving)
+	}
+	stopRefreshing()
+	if err := <-refreshed; err != nil {
+		t.Fatalf("the member that kept refreshing was refused: %v", err)
+	}
+	if status, body := stayer.refresh(t, cpURL, ""); status != http.StatusOK {
+		t.Fatalf("the member that kept refreshing is refused after the sweep: %d %s", status, body)
+	}
+	if nodes := fetchAdminStatus(t, cpPort, testAdminToken).GetEnrolledNodes(); len(nodes) != 1 {
+		t.Fatalf("admin status after the sweep lists %d nodes, want 1", len(nodes))
+	}
+}