diff --git a/api/agentmesh.pb.go b/api/agentmesh.pb.go
index d06b591a..7f86a0b1 100644
--- a/api/agentmesh.pb.go
+++ b/api/agentmesh.pb.go
@@ -3984,8 +3984,14 @@ type BootstrapTokenCreateRequest struct {
 	// because a node that can always recover holds a credential that never
 	// expires.
 	AutonomousRecovery bool `protobuf:"varint,6,opt,name=autonomous_recovery,json=autonomousRecovery,proto3" json:"autonomous_recovery,omitempty"`
-	unknownFields      protoimpl.UnknownFields
-	sizeCache          protoimpl.SizeCache
+	// Copied onto every node the token enrolls: such a node is forgotten
+	// soon after it falls silent (the control plane's
+	// --ephemeral-node-retention, an hour by default) instead of being kept
+	// for --node-retention. For members that come and go: a fleet in a scale
+	// test, a probe, a CI job.
+	Ephemeral     bool `protobuf:"varint,7,opt,name=ephemeral,proto3" json:"ephemeral,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *BootstrapTokenCreateRequest) Reset() {
@@ -4060,6 +4066,13 @@ func (x *BootstrapTokenCreateRequest) GetAutonomousRecovery() bool {
 	return false
 }
 
+func (x *BootstrapTokenCreateRequest) GetEphemeral() bool {
+	if x != nil {
+		return x.Ephemeral
+	}
+	return false
+}
+
 // BootstrapTokenCreateResponse is returned (201) when a token is minted.
 // token is the plaintext and is shown exactly once; the control plane keeps
 // only its hash, which is also the id.
@@ -4154,6 +4167,7 @@ type BootstrapToken struct {
 	// or exhausted usages. Unset means never revoked.
 	RevokeTime         *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=revoke_time,json=revokeTime,proto3" json:"revoke_time,omitempty"`
 	AutonomousRecovery bool                   `protobuf:"varint,10,opt,name=autonomous_recovery,json=autonomousRecovery,proto3" json:"autonomous_recovery,omitempty"`
+	Ephemeral          bool                   `protobuf:"varint,11,opt,name=ephemeral,proto3" json:"ephemeral,omitempty"`
 	unknownFields      protoimpl.UnknownFields
 	sizeCache          protoimpl.SizeCache
 }
@@ -4258,6 +4272,13 @@ func (x *BootstrapToken) GetAutonomousRecovery() bool {
 	return false
 }
 
+func (x *BootstrapToken) GetEphemeral() bool {
+	if x != nil {
+		return x.Ephemeral
+	}
+	return false
+}
+
 type BootstrapTokenListResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Tokens        []*BootstrapToken      `protobuf:"bytes,1,rep,name=tokens,proto3" json:"tokens,omitempty"`
@@ -4546,8 +4567,11 @@ type EnrolledNode struct {
 	ExpireTime         *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
 	Banned             bool                   `protobuf:"varint,9,opt,name=banned,proto3" json:"banned,omitempty"`
 	AutonomousRecovery bool                   `protobuf:"varint,10,opt,name=autonomous_recovery,json=autonomousRecovery,proto3" json:"autonomous_recovery,omitempty"`
-	unknownFields      protoimpl.UnknownFields
-	sizeCache          protoimpl.SizeCache
+	// The node was enrolled by an ephemeral token and is forgotten soon after
+	// it falls silent.
+	Ephemeral     bool `protobuf:"varint,11,opt,name=ephemeral,proto3" json:"ephemeral,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *EnrolledNode) Reset() {
@@ -4650,6 +4674,13 @@ func (x *EnrolledNode) GetAutonomousRecovery() bool {
 	return false
 }
 
+func (x *EnrolledNode) GetEphemeral() bool {
+	if x != nil {
+		return x.Ephemeral
+	}
+	return false
+}
+
 // RouterLease is a router's current registration with the control plane.
 type RouterLease struct {
 	state  protoimpl.MessageState `protogen:"open.v1"`
@@ -6328,7 +6359,7 @@ const file_api_agentmesh_proto_rawDesc = "" +
 	"\apeer_id\x18\x01 \x01(\tR\x06peerId\"E\n" +
 	"\x13TokenRevokeResponse\x12\x18\n" +
 	"\asuccess\x18\x01 \x01(\bR\asuccess\x12\x14\n" +
-	"\x05error\x18\x02 \x01(\tR\x05error\"\xdb\x01\n" +
+	"\x05error\x18\x02 \x01(\tR\x05error\"\xf9\x01\n" +
 	"\x1bBootstrapTokenCreateRequest\x12\x12\n" +
 	"\x04role\x18\x01 \x01(\tR\x04role\x12\x19\n" +
 	"\bowner_id\x18\x02 \x01(\tR\aownerId\x12\x1b\n" +
@@ -6336,14 +6367,15 @@ const file_api_agentmesh_proto_rawDesc = "" +
 	"\n" +
 	"max_usages\x18\x04 \x01(\x05R\tmaxUsages\x12 \n" +
 	"\vdescription\x18\x05 \x01(\tR\vdescription\x12/\n" +
-	"\x13autonomous_recovery\x18\x06 \x01(\bR\x12autonomousRecovery\"\xb0\x01\n" +
+	"\x13autonomous_recovery\x18\x06 \x01(\bR\x12autonomousRecovery\x12\x1c\n" +
+	"\tephemeral\x18\a \x01(\bR\tephemeral\"\xb0\x01\n" +
 	"\x1cBootstrapTokenCreateResponse\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12\x14\n" +
 	"\x05token\x18\x02 \x01(\tR\x05token\x12\x12\n" +
 	"\x04role\x18\x03 \x01(\tR\x04role\x12\x19\n" +
 	"\bowner_id\x18\x04 \x01(\tR\aownerId\x12;\n" +
 	"\vexpire_time\x18\x05 \x01(\v2\x1a.google.protobuf.TimestampR\n" +
-	"expireTime\"\x9b\x03\n" +
+	"expireTime\"\xb9\x03\n" +
 	"\x0eBootstrapToken\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12\x12\n" +
 	"\x04role\x18\x02 \x01(\tR\x04role\x12\x19\n" +
@@ -6359,7 +6391,8 @@ const file_api_agentmesh_proto_rawDesc = "" +
 	"\vrevoke_time\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\n" +
 	"revokeTime\x12/\n" +
 	"\x13autonomous_recovery\x18\n" +
-	" \x01(\bR\x12autonomousRecovery\"R\n" +
+	" \x01(\bR\x12autonomousRecovery\x12\x1c\n" +
+	"\tephemeral\x18\v \x01(\bR\tephemeral\"R\n" +
 	"\x1aBootstrapTokenListResponse\x124\n" +
 	"\x06tokens\x18\x01 \x03(\v2\x1c.agentmesh.v1.BootstrapTokenR\x06tokens\"\xac\x03\n" +
 	"\x11EnrollmentRequest\x12\x0e\n" +
@@ -6384,7 +6417,7 @@ const file_api_agentmesh_proto_rawDesc = "" +
 	"\x05email\x18\x03 \x01(\tR\x05email\x12\x12\n" +
 	"\x04role\x18\x04 \x01(\tR\x04role\x12;\n" +
 	"\vcreate_time\x18\x05 \x01(\v2\x1a.google.protobuf.TimestampR\n" +
-	"createTime\"\xde\x03\n" +
+	"createTime\"\xfc\x03\n" +
 	"\fEnrolledNode\x12\x17\n" +
 	"\apeer_id\x18\x01 \x01(\tR\x06peerId\x12\x12\n" +
 	"\x04role\x18\x02 \x01(\tR\x04role\x12'\n" +
@@ -6399,7 +6432,8 @@ const file_api_agentmesh_proto_rawDesc = "" +
 	"expireTime\x12\x16\n" +
 	"\x06banned\x18\t \x01(\bR\x06banned\x12/\n" +
 	"\x13autonomous_recovery\x18\n" +
-	" \x01(\bR\x12autonomousRecovery\x1a9\n" +
+	" \x01(\bR\x12autonomousRecovery\x12\x1c\n" +
+	"\tephemeral\x18\v \x01(\bR\tephemeral\x1a9\n" +
 	"\vLabelsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
 	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x8d\x02\n" +
diff --git a/api/agentmesh.proto b/api/agentmesh.proto
index 0d76de6a..ac0e8d05 100644
--- a/api/agentmesh.proto
+++ b/api/agentmesh.proto
@@ -667,6 +667,12 @@ message BootstrapTokenCreateRequest {
   // because a node that can always recover holds a credential that never
   // expires.
   bool autonomous_recovery = 6;
+  // Copied onto every node the token enrolls: such a node is forgotten
+  // soon after it falls silent (the control plane's
+  // --ephemeral-node-retention, an hour by default) instead of being kept
+  // for --node-retention. For members that come and go: a fleet in a scale
+  // test, a probe, a CI job.
+  bool ephemeral = 7;
 }
 
 // BootstrapTokenCreateResponse is returned (201) when a token is minted.
@@ -694,6 +700,7 @@ message BootstrapToken {
   // or exhausted usages. Unset means never revoked.
   google.protobuf.Timestamp revoke_time = 9;
   bool autonomous_recovery = 10;
+  bool ephemeral = 11;
 }
 
 message BootstrapTokenListResponse {
@@ -746,6 +753,9 @@ message EnrolledNode {
   google.protobuf.Timestamp expire_time = 8;
   bool banned = 9;
   bool autonomous_recovery = 10;
+  // The node was enrolled by an ephemeral token and is forgotten soon after
+  // it falls silent.
+  bool ephemeral = 11;
 }
 
 // RouterLease is a router's current registration with the control plane.
diff --git a/cmd/agentmesh-control-plane/main.go b/cmd/agentmesh-control-plane/main.go
index ebf3f158..fcec9af8 100644
--- a/cmd/agentmesh-control-plane/main.go
+++ b/cmd/agentmesh-control-plane/main.go
@@ -36,31 +36,32 @@ import (
 )
 
 var (
-	bindAddress           string
-	pprofAddr             string
-	dbDriver              string
-	dbDSN                 string
-	dbDSNPath             string
-	oidcIssuer            string
-	workloadIssuer        string
-	oidcClientID          string
-	allowedAudiencesFlag  string
-	keyRotationInterval   time.Duration
-	keyGracePeriod        time.Duration
-	leaseDuration         time.Duration
-	dhtReplication        int
-	dhtReprovideInterval  time.Duration
-	biscuitTTL            time.Duration
-	oidcSessionTTL        time.Duration
-	workloadSessionTTL    time.Duration
-	nodeRetention         time.Duration
-	meshReconnectInterval time.Duration
-	adminTokenPath        string
-	stsIssuerURL          string
-	insecureSkipTLSVerify bool
-	logLevel              string
-	logFormat             string
-	autoApproveEnrollment bool
+	bindAddress            string
+	pprofAddr              string
+	dbDriver               string
+	dbDSN                  string
+	dbDSNPath              string
+	oidcIssuer             string
+	workloadIssuer         string
+	oidcClientID           string
+	allowedAudiencesFlag   string
+	keyRotationInterval    time.Duration
+	keyGracePeriod         time.Duration
+	leaseDuration          time.Duration
+	dhtReplication         int
+	dhtReprovideInterval   time.Duration
+	biscuitTTL             time.Duration
+	oidcSessionTTL         time.Duration
+	workloadSessionTTL     time.Duration
+	nodeRetention          time.Duration
+	ephemeralNodeRetention time.Duration
+	meshReconnectInterval  time.Duration
+	adminTokenPath         string
+	stsIssuerURL           string
+	insecureSkipTLSVerify  bool
+	logLevel               string
+	logFormat              string
+	autoApproveEnrollment  bool
 )
 
 var logger = golog.Logger("agentmesh-control-plane-cli")
@@ -102,6 +103,9 @@ func main() {
 			if nodeRetention <= 0 {
 				logger.Fatalf("--node-retention must be positive, got %s: node records are never kept forever", nodeRetention)
 			}
+			if ephemeralNodeRetention <= 0 {
+				logger.Fatalf("--ephemeral-node-retention must be positive, got %s", ephemeralNodeRetention)
+			}
 
 			var auds []string
 			for _, aud := range strings.Split(allowedAudiencesFlag, ",") {
@@ -126,27 +130,28 @@ func main() {
 			}()
 
 			opts := controlplane.Options{
-				ListenAddr:            bindAddress,
-				DriverName:            dbDriver,
-				DataSourceName:        dbDSN,
-				OIDCIssuer:            oidcIssuer,
-				WorkloadIssuer:        workloadIssuer,
-				OIDCClientID:          oidcClientID,
-				AllowedAudiences:      auds,
-				LeaseDuration:         leaseDuration,
-				KeyRotationInterval:   keyRotationInterval,
-				KeyGracePeriod:        keyGracePeriod,
-				DHTReplication:        dhtReplication,
-				DHTReprovideInterval:  dhtReprovideInterval,
-				InsecureSkipTLSVerify: insecureSkipTLSVerify,
-				BiscuitTimeout:        10 * time.Second,
-				BiscuitTTL:            biscuitTTL,
-				OIDCSessionTTL:        oidcSessionTTL,
-				WorkloadSessionTTL:    workloadSessionTTL,
-				NodeRetention:         nodeRetention,
-				AdminToken:            adminToken,
-				AutoApproveEnrollment: autoApproveEnrollment,
-				STSIssuerURL:          stsIssuerURL,
+				ListenAddr:             bindAddress,
+				DriverName:             dbDriver,
+				DataSourceName:         dbDSN,
+				OIDCIssuer:             oidcIssuer,
+				WorkloadIssuer:         workloadIssuer,
+				OIDCClientID:           oidcClientID,
+				AllowedAudiences:       auds,
+				LeaseDuration:          leaseDuration,
+				KeyRotationInterval:    keyRotationInterval,
+				KeyGracePeriod:         keyGracePeriod,
+				DHTReplication:         dhtReplication,
+				DHTReprovideInterval:   dhtReprovideInterval,
+				InsecureSkipTLSVerify:  insecureSkipTLSVerify,
+				BiscuitTimeout:         10 * time.Second,
+				BiscuitTTL:             biscuitTTL,
+				OIDCSessionTTL:         oidcSessionTTL,
+				WorkloadSessionTTL:     workloadSessionTTL,
+				NodeRetention:          nodeRetention,
+				EphemeralNodeRetention: ephemeralNodeRetention,
+				AdminToken:             adminToken,
+				AutoApproveEnrollment:  autoApproveEnrollment,
+				STSIssuerURL:           stsIssuerURL,
 			}
 
 			srv, err := controlplane.NewServer(opts, store)
@@ -206,7 +211,8 @@ func main() {
 	rootCmd.Flags().DurationVar(&biscuitTTL, "biscuit-ttl", api.BiscuitTokenTTL, "Lifespan minted into every issued Biscuit's expiration fact. Capped to the OIDC token's own expiry when shorter.")
 	rootCmd.Flags().DurationVar(&oidcSessionTTL, "oidc-session-ttl", api.OIDCSessionTTL, "How long an OIDC enrollment stays refreshable before the identity must re-authenticate with the OIDC provider. Shorter values keep the provider authoritative for offboarding at the cost of more frequent interactive re-enrollment.")
 	rootCmd.Flags().DurationVar(&workloadSessionTTL, "workload-session-ttl", controlplane.DefaultWorkloadSessionTTL, "How long a workload-issuer enrollment stays refreshable without presenting a fresh platform JWT on /refresh.")
-	rootCmd.Flags().DurationVar(&nodeRetention, "node-retention", controlplane.DefaultNodeRetention, "How long an enrolled node's record is kept after its session expired before it is deleted. Banned nodes are always kept. Must be positive: records are never kept forever.")
+	rootCmd.Flags().DurationVar(&nodeRetention, "node-retention", controlplane.DefaultNodeRetention, "How long an enrolled node's record is kept after its session expired, or after its last refresh for a node enrolled with a bootstrap token, before it is deleted. Banned nodes are always kept. Must be positive: records are never kept forever.")
+	rootCmd.Flags().DurationVar(&ephemeralNodeRetention, "ephemeral-node-retention", controlplane.DefaultEphemeralNodeRetention, "--node-retention for a node enrolled with an ephemeral bootstrap token: how long after its last refresh its record is kept. For members that come and go: a fleet in a scale test, a probe, a CI job.")
 	rootCmd.Flags().DurationVar(&meshReconnectInterval, "mesh-reconnect-interval", controlplane.DefaultMeshReconnectInterval, "How often the event publisher re-reads the router leases and dials any router it is not connected to.")
 	rootCmd.Flags().StringVar(&adminTokenPath, "admin-token-path", "", "Path to file containing the token for authenticating policy REST API requests (or env AGENTMESH_ADMIN_TOKEN)")
 	rootCmd.Flags().StringVar(&stsIssuerURL, "sts-issuer-url", "", "Canonical external URL of this control plane for OIDC/STS issuer and discovery metadata (or env AGENTMESH_STS_ISSUER_URL)")
diff --git a/cmd/agentmesh-one/main.go b/cmd/agentmesh-one/main.go
index 9fade107..a48728f6 100644
--- a/cmd/agentmesh-one/main.go
+++ b/cmd/agentmesh-one/main.go
@@ -231,7 +231,8 @@ func main() {
 	rootCmd.Flags().DurationVar(&cpTunables.KeyGracePeriod, "control-plane-key-grace-period", 0, "How long rotated-out keys stay valid for verification (0 keeps the component default)")
 	rootCmd.Flags().DurationVar(&cpTunables.BiscuitTTL, "control-plane-biscuit-ttl", 0, "Lifespan minted into issued biscuits (0 keeps the component default)")
 	rootCmd.Flags().DurationVar(&cpTunables.WorkloadSessionTTL, "control-plane-workload-session-ttl", 0, "How long a workload-issuer enrollment stays refreshable without presenting a fresh platform JWT on /refresh (0 keeps the component default)")
-	rootCmd.Flags().DurationVar(&cpTunables.NodeRetention, "control-plane-node-retention", 0, "How long a node record is kept after its session expired before it is deleted (0 keeps the component default)")
+	rootCmd.Flags().DurationVar(&cpTunables.NodeRetention, "control-plane-node-retention", 0, "How long a node record is kept after its session expired, or after its last refresh for a bootstrap enrollment, before it is deleted (0 keeps the component default)")
+	rootCmd.Flags().DurationVar(&cpTunables.EphemeralNodeRetention, "control-plane-ephemeral-node-retention", 0, "How long a node enrolled with an ephemeral bootstrap token is kept after its last refresh (0 keeps the component default)")
 	rootCmd.Flags().BoolVar(&cpTunables.ManualEnrollment, "control-plane-manual-enrollment", false, "Queue bootstrap enrollments for admin approval instead of auto-approving")
 
 	// Embedded router tunables.
diff --git a/internal/console/public/app.js b/internal/console/public/app.js
index b1bd4178..2216d3e7 100644
--- a/internal/console/public/app.js
+++ b/internal/console/public/app.js
@@ -779,6 +779,7 @@ function renderBootstrapTokensTable(tokens) {
             ? `<span class="badge badge-rejected">Revoked</span>`
             : `<span class="badge badge-approved">Active</span>`;
         const recovery = token.autonomous_recovery ? 'Autonomous' : 'Manual';
+        const members = token.ephemeral ? 'Ephemeral' : 'Regular';
         const action = revoked
             ? '-'
             : `<button class="btn btn-sm btn-danger" onclick="revokeBootstrapToken('${escapeHTML(token.id)}')">Revoke</button>`;
@@ -789,6 +790,7 @@ function renderBootstrapTokensTable(tokens) {
                 <td><code>${escapeHTML(token.owner_id || '-')}</code></td>
                 <td>${escapeHTML(String(token.usages_count || 0))} / ${escapeHTML(String(token.max_usages || 0))}</td>
                 <td>${escapeHTML(expiresAt)}</td>
+                <td>${members}</td>
                 <td>${recovery}</td>
                 <td>${status}</td>
                 <td>${action}</td>
@@ -810,6 +812,7 @@ window.generateBootstrapToken = async function() {
     const ttl_hours = parseInt(document.getElementById('token-ttl').value, 10) || 24;
     const description = document.getElementById('token-desc').value;
     const autonomous_recovery = document.getElementById('token-recovery').checked;
+    const ephemeral = document.getElementById('token-ephemeral').checked;
 
     const payload = {
         role,
@@ -824,6 +827,9 @@ window.generateBootstrapToken = async function() {
     if (autonomous_recovery) {
         payload.autonomous_recovery = true;
     }
+    if (ephemeral) {
+        payload.ephemeral = true;
+    }
 
     try {
         const res = await actionRequest('api/user/bootstrap-tokens', 'POST', payload);
diff --git a/internal/console/public/index.html b/internal/console/public/index.html
index 90683cee..0dc61628 100644
--- a/internal/console/public/index.html
+++ b/internal/console/public/index.html
@@ -355,6 +355,12 @@ <h3>Generate Bootstrap Token</h3>
                                 <label for="token-desc" class="field-label">Description</label>
                                 <input type="text" id="token-desc" class="field-input" placeholder="Token purpose">
                             </div>
+                            <div class="input-group field">
+                                <label for="token-ephemeral" class="field-label">
+                                    <input type="checkbox" id="token-ephemeral"> Ephemeral members
+                                </label>
+                                <small class="field-hint">Nodes enrolled with this token are forgotten an hour after they stop refreshing, instead of being kept for the node retention. For members that come and go: a fleet in a scale test, a probe, a CI job.</small>
+                            </div>
                             <div class="input-group field" id="token-recovery-group">
                                 <label for="token-recovery" class="field-label">
                                     <input type="checkbox" id="token-recovery"> Autonomous recovery
@@ -387,6 +393,7 @@ <h3>Active Tokens</h3>
                                     <th>Owner</th>
                                     <th>Usages</th>
                                     <th>Expires</th>
+                                    <th>Members</th>
                                     <th>Recovery</th>
                                     <th>Status</th>
                                     <th>Actions</th>
diff --git a/internal/controlplane/catalog.go b/internal/controlplane/catalog.go
index 820b703e..ab79b0ac 100644
--- a/internal/controlplane/catalog.go
+++ b/internal/controlplane/catalog.go
@@ -93,6 +93,7 @@ func (s *Server) dropCatalogEntry(peerID string) {
 	}
 	s.catalogMu.Lock()
 	delete(s.catalog, pID.String())
+	catalogEntries.Set(float64(len(s.catalog)))
 	s.catalogMu.Unlock()
 }
 
@@ -144,6 +145,7 @@ func (s *Server) HandleNodeCatalog(w http.ResponseWriter, r *http.Request) {
 		Services:   req.Services,
 		ReportedAt: time.Now(),
 	}
+	catalogEntries.Set(float64(len(s.catalog)))
 	s.catalogMu.Unlock()
 
 	w.WriteHeader(http.StatusNoContent)
diff --git a/internal/controlplane/config.go b/internal/controlplane/config.go
index 2f403ab9..269ff62f 100644
--- a/internal/controlplane/config.go
+++ b/internal/controlplane/config.go
@@ -49,13 +49,17 @@ type Options struct {
 	OIDCSessionTTL        time.Duration // How long an OIDC enrollment stays refreshable before the identity must re-authenticate interactively; defaults to api.OIDCSessionTTL
 	WorkloadSessionTTL    time.Duration // Session TTL for enrollments from a WorkloadIssuer; defaults to DefaultWorkloadSessionTTL (48h)
 	// NodeRetention is how long an enrolled node's row is kept after its
-	// session expired before being deleted; unset is DefaultNodeRetention,
-	// and Validate refuses a negative value. Every pod restart without a
+	// session expired, or, for a bootstrap enrollment, after its last
+	// refresh, before being deleted; unset is DefaultNodeRetention, and
+	// Validate refuses a negative value. Every pod restart without a
 	// persistent data dir enrolls a fresh identity, so without a bound the
 	// nodes table only ever grows.
-	NodeRetention         time.Duration
-	AdminToken            string // Optional: administrative bearer token for protecting policy and enrollment queue REST APIs
-	AutoApproveEnrollment bool   // If true, valid bootstrap token enrollment requests are immediately approved without administrative manual gate
+	NodeRetention time.Duration
+	// EphemeralNodeRetention is NodeRetention for a member an ephemeral
+	// bootstrap token enrolled; unset is DefaultEphemeralNodeRetention.
+	EphemeralNodeRetention time.Duration
+	AdminToken             string // Optional: administrative bearer token for protecting policy and enrollment queue REST APIs
+	AutoApproveEnrollment  bool   // If true, valid bootstrap token enrollment requests are immediately approved without administrative manual gate
 	// STSIssuerURL is the public issuer URL advertised in
 	// /.well-known/openid-configuration and minted as the "iss" claim in
 	// outbound /sts/token JWTs. If empty, derived from the incoming HTTP request.
@@ -128,6 +132,9 @@ func (o *Options) Default() {
 	if o.NodeRetention == 0 {
 		o.NodeRetention = DefaultNodeRetention
 	}
+	if o.EphemeralNodeRetention == 0 {
+		o.EphemeralNodeRetention = DefaultEphemeralNodeRetention
+	}
 	if o.DelegatedBiscuitTTL <= 0 {
 		o.DelegatedBiscuitTTL = 1 * time.Hour
 	}
@@ -156,5 +163,8 @@ func (o *Options) Validate() error {
 	if o.NodeRetention <= 0 {
 		return fmt.Errorf("NodeRetention must be positive, got %s: node records are never kept forever", o.NodeRetention)
 	}
+	if o.EphemeralNodeRetention <= 0 {
+		return fmt.Errorf("EphemeralNodeRetention must be positive, got %s", o.EphemeralNodeRetention)
+	}
 	return nil
 }
diff --git a/internal/controlplane/metrics.go b/internal/controlplane/metrics.go
index fb1f2a84..29adf675 100644
--- a/internal/controlplane/metrics.go
+++ b/internal/controlplane/metrics.go
@@ -113,6 +113,10 @@ type meshSnapshot struct {
 	// the retiring one stops verifying; zero when there is none.
 	signingKeys       int
 	retiringKeyExpiry time.Time
+	// storageRows is the row count of every table the control plane keeps
+	// bounded; a table that grows past its retention is a reaper that
+	// stopped working.
+	storageRows map[string]int64
 }
 
 // meshStateCollector exports the control plane's view of the mesh: who is
@@ -141,6 +145,7 @@ type meshStateCollector struct {
 	meshPeersDesc    *prometheus.Desc
 	signingKeysDesc  *prometheus.Desc
 	retiringKeyDesc  *prometheus.Desc
+	storageRowsDesc  *prometheus.Desc
 	scrapeOKDesc     *prometheus.Desc
 	scrapeSampleDesc *prometheus.Desc
 }
@@ -195,6 +200,10 @@ func newMeshStateCollector(store storage.Store) *meshStateCollector {
 			"agentmesh_control_plane_retiring_key_expiry_timestamp_seconds",
 			"Unix time the retiring signing key stops verifying; absent when no rotation is in its grace period",
 			nil, nil),
+		storageRowsDesc: prometheus.NewDesc(
+			"agentmesh_control_plane_storage_rows",
+			"Rows in a control plane store table",
+			[]string{"table"}, nil),
 		scrapeOKDesc: prometheus.NewDesc(
 			"agentmesh_control_plane_mesh_state_scrape_success",
 			"1 if the mesh state was read from the store, 0 if the last read failed",
@@ -210,7 +219,7 @@ func (c *meshStateCollector) Describe(ch chan<- *prometheus.Desc) {
 	for _, d := range []*prometheus.Desc{
 		c.nodesDesc, c.usersDesc, c.requestsDesc, c.tokensDesc, c.routersDesc,
 		c.routerPeersDesc, c.routerDHTDesc, c.routerLeaseDesc, c.meshPeersDesc,
-		c.signingKeysDesc, c.retiringKeyDesc, c.scrapeOKDesc, c.scrapeSampleDesc,
+		c.signingKeysDesc, c.retiringKeyDesc, c.storageRowsDesc, c.scrapeOKDesc, c.scrapeSampleDesc,
 	} {
 		ch <- d
 	}
@@ -257,6 +266,9 @@ func (c *meshStateCollector) Collect(ch chan<- prometheus.Metric) {
 	if !s.retiringKeyExpiry.IsZero() {
 		ch <- prometheus.MustNewConstMetric(c.retiringKeyDesc, prometheus.GaugeValue, float64(s.retiringKeyExpiry.Unix()))
 	}
+	for table, n := range s.storageRows {
+		ch <- prometheus.MustNewConstMetric(c.storageRowsDesc, prometheus.GaugeValue, float64(n), table)
+	}
 }
 
 // refresh replaces the snapshot from the store. A failed read keeps the last
@@ -335,6 +347,11 @@ func readMeshSnapshot(ctx context.Context, store storage.Store, now time.Time) (
 		}
 	}
 
+	snap.storageRows, err = store.CountRows(ctx)
+	if err != nil {
+		return snap, err
+	}
+
 	return snap, nil
 }
 
diff --git a/internal/controlplane/metrics_test.go b/internal/controlplane/metrics_test.go
index a7b0044c..099d97d7 100644
--- a/internal/controlplane/metrics_test.go
+++ b/internal/controlplane/metrics_test.go
@@ -343,6 +343,10 @@ func TestMetricsEndpointServesMeshStateAndRuntime(t *testing.T) {
 		"agentmesh_control_plane_mesh_state_scrape_success 1",
 		"agentmesh_control_plane_routers_active 0",
 		"agentmesh_control_plane_mesh_connected_peers 0",
+		`agentmesh_control_plane_storage_rows{table="nodes"} 0`,
+		`agentmesh_control_plane_storage_rows{table="enrollment_requests"} 0`,
+		"agentmesh_control_plane_catalog_entries ",
+		`agentmesh_control_plane_storage_rows_deleted_total{table="routers"} `,
 		"go_goroutines",
 	} {
 		if !strings.Contains(string(body), want) {
diff --git a/internal/controlplane/node_gc.go b/internal/controlplane/node_gc.go
index 91529108..22ffd902 100644
--- a/internal/controlplane/node_gc.go
+++ b/internal/controlplane/node_gc.go
@@ -20,14 +20,23 @@ import (
 
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promauto"
+
+	"github.com/google/agentmesh/internal/storage"
 )
 
 const (
 	// DefaultNodeRetention keeps a lapsed enrollment for a month past its
-	// session, long enough to be looked up when investigating an incident,
-	// and is what --node-retention defaults to.
+	// session, and a bootstrap enrollment for a month past its last refresh,
+	// long enough to be looked up when investigating an incident, and is
+	// what --node-retention defaults to.
 	DefaultNodeRetention = 30 * 24 * time.Hour
 
+	// DefaultEphemeralNodeRetention is how long a member an ephemeral token
+	// enrolled is kept after its last refresh: an hour, long past the few
+	// minutes a member of a fleet, a probe or a CI job stays, and what
+	// --ephemeral-node-retention defaults to.
+	DefaultEphemeralNodeRetention = time.Hour
+
 	// maxNodeGCInterval bounds how often the sweep runs. Rows lapse on a
 	// scale of days, so nothing is gained by sweeping more often than hourly;
 	// a retention far shorter than that, as a test sets, sweeps at a tenth
@@ -42,34 +51,155 @@ func nodeGCInterval(retention time.Duration) time.Duration {
 	return min(maxNodeGCInterval, max(minNodeGCInterval, retention/10))
 }
 
-var nodesDeletedTotal = promauto.NewCounter(prometheus.CounterOpts{
+var nodesDeletedTotal = promauto.NewCounterVec(prometheus.CounterOpts{
 	Name: "agentmesh_control_plane_nodes_deleted_total",
-	Help: "Enrolled node records removed after outliving their session by the retention period",
+	Help: "Enrolled node records removed by the node GC, by reason: session for a session that lapsed more than the retention ago, silent for a bootstrap member that did not refresh for the retention, ephemeral for one an ephemeral token enrolled that did not refresh for the ephemeral retention",
+}, []string{"reason"})
+
+const (
+	deletedReasonSession   = "session"
+	deletedReasonSilent    = "silent"
+	deletedReasonEphemeral = "ephemeral"
+)
+
+var storageRowsDeletedTotal = promauto.NewCounterVec(prometheus.CounterOpts{
+	Name: "agentmesh_control_plane_storage_rows_deleted_total",
+	Help: "Rows the storage GC removed from a table other than nodes: enrollment requests older than the retention, bootstrap tokens expired for the retention that no request refers to, router leases expired for the retention",
+}, []string{"table"})
+
+var catalogEntries = promauto.NewGauge(prometheus.GaugeOpts{
+	Name: "agentmesh_control_plane_catalog_entries",
+	Help: "Service reports the control plane holds in memory, one per node that reported since it was admitted",
 })
 
+const (
+	tableEnrollmentRequests = "enrollment_requests"
+	tableBootstrapTokens    = "bootstrap_tokens"
+	tableRouters            = "routers"
+)
+
+func init() {
+	for _, reason := range []string{deletedReasonSession, deletedReasonSilent, deletedReasonEphemeral} {
+		nodesDeletedTotal.WithLabelValues(reason)
+	}
+	for _, table := range []string{tableEnrollmentRequests, tableBootstrapTokens, tableRouters} {
+		storageRowsDeletedTotal.WithLabelValues(table)
+	}
+}
+
 // runNodeGCLoop sweeps once at start and then hourly. Replicas each sweep
-// against the shared database; the delete is idempotent, so the race is
+// against the shared database; the deletes are idempotent, so the race is
 // harmless and not worth a claim.
 func (s *Server) runNodeGCLoop() {
 	defer s.wg.Done()
-	s.gcExpiredNodes(time.Now())
+	s.gcStorage(time.Now())
 
 	ticker := time.NewTicker(nodeGCInterval(s.config.NodeRetention))
 	defer ticker.Stop()
 	for {
 		select {
 		case <-ticker.C:
-			s.gcExpiredNodes(time.Now())
+			s.gcStorage(time.Now())
 		case <-s.ctx.Done():
 			return
 		}
 	}
 }
 
+// gcStorage is one sweep over everything that grows with mesh activity: the
+// node records, the enrollment requests, the bootstrap tokens, the router
+// leases, and the in-memory service catalog. Each step logs its own failure
+// and the next one still runs, so one table's trouble does not let another
+// grow.
+func (s *Server) gcStorage(now time.Time) {
+	s.gcExpiredNodes(now)
+	s.gcEnrollmentRecords(now)
+	s.pruneCatalog(now)
+}
+
+// gcEnrollmentRecords deletes the enrollment requests resolved, or left
+// pending, more than NodeRetention ago (EphemeralNodeRetention when an
+// ephemeral token made them), then the bootstrap tokens that expired more
+// than NodeRetention ago and that no remaining request refers to, then the
+// router leases expired for as long. Requests go before tokens because a
+// request refers to its token.
+func (s *Server) gcEnrollmentRecords(now time.Time) {
+	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancel()
+
+	before := now.Add(-s.config.NodeRetention)
+	requests, err := s.store.DeleteStaleEnrollmentRequests(ctx, before, now.Add(-s.config.EphemeralNodeRetention))
+	if err != nil {
+		logger.Errorf("Failed to delete stale enrollment requests: %v", err)
+	} else if requests > 0 {
+		storageRowsDeletedTotal.WithLabelValues(tableEnrollmentRequests).Add(float64(requests))
+		logger.Infof("Deleted %d enrollment requests older than the retention", requests)
+	}
+
+	tokens, err := s.store.DeleteExpiredBootstrapTokens(ctx, before)
+	if err != nil {
+		logger.Errorf("Failed to delete expired bootstrap tokens: %v", err)
+	} else if tokens > 0 {
+		storageRowsDeletedTotal.WithLabelValues(tableBootstrapTokens).Add(float64(tokens))
+		logger.Infof("Deleted %d bootstrap tokens expired more than %s ago", tokens, s.config.NodeRetention)
+	}
+
+	leases, err := s.store.DeleteExpiredRouterLeases(ctx, before)
+	if err != nil {
+		logger.Errorf("Failed to delete expired router leases: %v", err)
+	} else if leases > 0 {
+		storageRowsDeletedTotal.WithLabelValues(tableRouters).Add(float64(leases))
+		logger.Infof("Deleted %d router leases expired more than %s ago", leases, s.config.NodeRetention)
+	}
+}
+
+// pruneCatalog forgets the service report of every peer that is no longer
+// an admitted node: its enrollment lapsed, was collected or was banned on
+// another replica. The console already hides such reports; this keeps the
+// cache from holding one entry per member that ever joined until the next
+// restart.
+func (s *Server) pruneCatalog(now time.Time) {
+	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
+	defer cancel()
+
+	snap := s.catalogSnapshot()
+	if len(snap) == 0 {
+		catalogEntries.Set(0)
+		return
+	}
+	admitted, err := s.store.ListNodes(ctx, storage.NodeFilter{States: []storage.NodeState{storage.NodeAdmitted}, Now: now})
+	if err != nil {
+		logger.Errorf("Failed to list admitted nodes to prune the service catalog: %v", err)
+		return
+	}
+	keep := make(map[string]struct{}, len(admitted))
+	for i := range admitted {
+		keep[admitted[i].PeerID] = struct{}{}
+	}
+	dropped := 0
+	s.catalogMu.Lock()
+	for peerID := range snap {
+		if _, ok := keep[peerID]; !ok {
+			delete(s.catalog, peerID)
+			logger.Debugw("Dropped service report of a node no longer admitted", "peer_id", peerID)
+			dropped++
+		}
+	}
+	remaining := len(s.catalog)
+	s.catalogMu.Unlock()
+	catalogEntries.Set(float64(remaining))
+	if dropped > 0 {
+		logger.Infof("Dropped %d service reports of nodes no longer admitted, %d remain", dropped, remaining)
+	}
+}
+
 // gcExpiredNodes deletes every unbanned node whose session expired more than
-// NodeRetention before now. Options.Validate has refused a retention that is
-// not positive, so there is no "keep forever": an unbounded nodes table is
-// what slowed every console refresh and metrics scrape.
+// NodeRetention before now, and every unbanned bootstrap member, which has
+// no session, that did not refresh for NodeRetention, or for
+// EphemeralNodeRetention when an ephemeral token enrolled it. Options.Validate
+// has refused a retention that is not positive, so there is no "keep
+// forever": an unbounded nodes table is what slowed every console refresh
+// and metrics scrape.
 func (s *Server) gcExpiredNodes(now time.Time) {
 	ctx, cancel := context.WithTimeout(s.ctx, 30*time.Second)
 	defer cancel()
@@ -80,7 +210,21 @@ func (s *Server) gcExpiredNodes(now time.Time) {
 		return
 	}
 	if deleted > 0 {
-		nodesDeletedTotal.Add(float64(deleted))
+		nodesDeletedTotal.WithLabelValues(deletedReasonSession).Add(float64(deleted))
 		logger.Infof("Deleted %d node records whose session expired more than %s ago", deleted, s.config.NodeRetention)
 	}
+
+	silent, ephemeral, err := s.store.DeleteSilentBootstrapNodes(ctx, now.Add(-s.config.NodeRetention), now.Add(-s.config.EphemeralNodeRetention))
+	if err != nil {
+		logger.Errorf("Failed to delete silent bootstrap node records: %v", err)
+		return
+	}
+	if silent > 0 {
+		nodesDeletedTotal.WithLabelValues(deletedReasonSilent).Add(float64(silent))
+		logger.Infof("Deleted %d bootstrap node records that did not refresh for %s", silent, s.config.NodeRetention)
+	}
+	if ephemeral > 0 {
+		nodesDeletedTotal.WithLabelValues(deletedReasonEphemeral).Add(float64(ephemeral))
+		logger.Infof("Deleted %d ephemeral node records that did not refresh for %s", ephemeral, s.config.EphemeralNodeRetention)
+	}
 }
diff --git a/internal/controlplane/node_gc_test.go b/internal/controlplane/node_gc_test.go
index 58b62e7b..b8573556 100644
--- a/internal/controlplane/node_gc_test.go
+++ b/internal/controlplane/node_gc_test.go
@@ -16,13 +16,15 @@ package controlplane
 
 import (
 	"context"
+	"slices"
 	"strings"
 	"testing"
 	"time"
 
+	dto "github.com/prometheus/client_model/go"
+
 	"github.com/google/agentmesh/api"
 	"github.com/google/agentmesh/internal/storage"
-	dto "github.com/prometheus/client_model/go"
 )
 
 func TestGCExpiredNodesAppliesRetention(t *testing.T) {
@@ -53,8 +55,7 @@ func TestGCExpiredNodesAppliesRetention(t *testing.T) {
 	}
 	defer func() { _ = srv.Close() }()
 
-	var before dto.Metric
-	_ = nodesDeletedTotal.Write(&before)
+	before := counterValue(t, nodesDeletedTotal, deletedReasonSession)
 
 	srv.gcExpiredNodes(now)
 
@@ -70,11 +71,169 @@ func TestGCExpiredNodesAppliesRetention(t *testing.T) {
 			t.Error("lapsed-8d survived a 7d retention")
 		}
 	}
+	if got := counterValue(t, nodesDeletedTotal, deletedReasonSession) - before; got != 1 {
+		t.Errorf("nodes_deleted_total{reason=session} advanced by %v, want 1", got)
+	}
+}
+
+// A bootstrap enrollment has no session, so the sweep judges it by its last
+// refresh: a member that did not refresh for the retention is forgotten, a
+// member an ephemeral token enrolled after the ephemeral retention, and one
+// that refreshed recently stays whichever token enrolled it. The ladder's
+// ten thousand members per run left exactly these rows on the testnet.
+func TestGCForgetsSilentBootstrapMembers(t *testing.T) {
+	store := newMetricsTestStore(t)
+	ctx := context.Background()
+	now := time.Now()
+
+	enroll := func(id string, lastRefresh time.Time, ephemeral bool) {
+		t.Helper()
+		if err := store.EnrollNode(ctx, &storage.EnrolledNode{
+			PeerID: id, PublicKey: []byte("pub"), Biscuit: []byte("b"), Role: api.RoleNode,
+			EnrollmentType: "BOOTSTRAP", EnrolledAt: lastRefresh, Ephemeral: ephemeral,
+		}); err != nil {
+			t.Fatalf("enroll %s: %v", id, err)
+		}
+	}
+	// Retention 7d, ephemeral retention 1h.
+	enroll("regular-fresh", now.Add(-time.Hour), false)
+	enroll("regular-6d", now.Add(-6*24*time.Hour), false)
+	enroll("regular-8d", now.Add(-8*24*time.Hour), false)
+	enroll("ephemeral-fresh", now.Add(-10*time.Minute), true)
+	enroll("ephemeral-2h", now.Add(-2*time.Hour), true)
+	enroll("banned-8d", now.Add(-8*24*time.Hour), false)
+	if err := store.SetNodeBanned(ctx, "banned-8d", true); err != nil {
+		t.Fatal(err)
+	}
+
+	srv, err := NewServer(Options{
+		DriverName: "sqlite", DataSourceName: "unused", OIDCIssuer: "https://issuer",
+		NodeRetention: 7 * 24 * time.Hour, EphemeralNodeRetention: time.Hour,
+	}, store)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = srv.Close() }()
+
+	silentBefore := counterValue(t, nodesDeletedTotal, deletedReasonSilent)
+	ephemeralBefore := counterValue(t, nodesDeletedTotal, deletedReasonEphemeral)
+
+	srv.gcExpiredNodes(now)
+
+	nodes, err := store.ListNodes(ctx, storage.NodeFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var left []string
+	for _, n := range nodes {
+		left = append(left, n.PeerID)
+	}
+	slices.Sort(left)
+	want := []string{"banned-8d", "ephemeral-fresh", "regular-6d", "regular-fresh"}
+	if !slices.Equal(left, want) {
+		t.Fatalf("after the sweep %v remain, want %v", left, want)
+	}
+	if got := counterValue(t, nodesDeletedTotal, deletedReasonSilent) - silentBefore; got != 1 {
+		t.Errorf("nodes_deleted_total{reason=silent} advanced by %v, want 1", got)
+	}
+	if got := counterValue(t, nodesDeletedTotal, deletedReasonEphemeral) - ephemeralBefore; got != 1 {
+		t.Errorf("nodes_deleted_total{reason=ephemeral} advanced by %v, want 1", got)
+	}
+}
+
+// One sweep also bounds the records enrollment leaves behind: the requests,
+// the tokens that made them, the router leases, and the in-memory service
+// catalog. Every table the testnet audit found growing is covered here.
+func TestGCStorageBoundsEnrollmentRecordsAndCatalog(t *testing.T) {
+	store := newMetricsTestStore(t)
+	ctx := context.Background()
+	now := time.Now()
+	day := 24 * time.Hour
+
+	if err := store.SaveBootstrapToken(ctx, &storage.BootstrapToken{
+		ID: "old", TokenHash: "hash-old", Role: api.RoleNode, MaxUsages: 10, CreatedAt: now.Add(-41 * day), ExpiresAt: now.Add(-40 * day),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := store.SaveBootstrapToken(ctx, &storage.BootstrapToken{
+		ID: "live", TokenHash: "hash-live", Role: api.RoleNode, MaxUsages: 10, CreatedAt: now, ExpiresAt: now.Add(day),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	resolved := now.Add(-40 * day)
+	if err := store.CreateEnrollmentRequest(ctx, &storage.EnrollmentRequest{
+		ID: "old-request", PeerID: "old-peer", PublicKey: []byte("pub"), TokenID: "old",
+		Status: api.EnrollmentStatus_ENROLLMENT_STATUS_APPROVED, CreatedAt: now.Add(-41 * day), ResolvedAt: &resolved,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := store.CreateEnrollmentRequest(ctx, &storage.EnrollmentRequest{
+		ID: "live-request", PeerID: "live-peer", PublicKey: []byte("pub"), TokenID: "live",
+		Status: api.EnrollmentStatus_ENROLLMENT_STATUS_PENDING, CreatedAt: now,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	for _, lease := range []struct {
+		id        string
+		expiresAt time.Time
+	}{{"router-live", now.Add(time.Minute)}, {"router-gone", now.Add(-40 * day)}} {
+		if err := store.UpsertRouterLease(ctx, &storage.RouterLease{PeerID: lease.id, Addresses: []string{"/ip4/127.0.0.1/tcp/1"}, LastRenewal: now, ExpiresAt: lease.expiresAt}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// An admitted node that reported services, and a report left by a node
+	// whose row the sweep already collected.
+	admitted, gone := "admitted-peer", "gone-peer"
+	if err := store.EnrollNode(ctx, &storage.EnrolledNode{
+		PeerID: admitted, PublicKey: []byte("pub"), Biscuit: []byte("b"), Role: api.RoleNode, EnrollmentType: "BOOTSTRAP", EnrolledAt: now,
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	srv, err := NewServer(Options{
+		DriverName: "sqlite", DataSourceName: "unused", OIDCIssuer: "https://issuer",
+		NodeRetention: 30 * day, EphemeralNodeRetention: time.Hour,
+	}, store)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = srv.Close() }()
+	srv.catalog[admitted] = nodeCatalogEntry{ReportedAt: now}
+	srv.catalog[gone] = nodeCatalogEntry{ReportedAt: now}
+
+	before := map[string]float64{}
+	for _, table := range []string{tableEnrollmentRequests, tableBootstrapTokens, tableRouters} {
+		before[table] = counterValue(t, storageRowsDeletedTotal, table)
+	}
 
-	var after dto.Metric
-	_ = nodesDeletedTotal.Write(&after)
-	if got := after.GetCounter().GetValue() - before.GetCounter().GetValue(); got != 1 {
-		t.Errorf("agentmesh_control_plane_nodes_deleted_total advanced by %v, want 1", got)
+	srv.gcStorage(now)
+
+	for table, want := range map[string]float64{tableEnrollmentRequests: 1, tableBootstrapTokens: 1, tableRouters: 1} {
+		if got := counterValue(t, storageRowsDeletedTotal, table) - before[table]; got != want {
+			t.Errorf("storage_rows_deleted_total{table=%s} advanced by %v, want %v", table, got, want)
+		}
+	}
+	counts, err := store.CountRows(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for table, want := range map[string]int64{"enrollment_requests": 1, "bootstrap_tokens": 1, "routers": 1, "nodes": 1} {
+		if counts[table] != want {
+			t.Errorf("%s has %d rows after the sweep, want %d", table, counts[table], want)
+		}
+	}
+	if _, ok := srv.catalogSnapshot()[gone]; ok {
+		t.Errorf("catalog still holds the report of a node that is no longer enrolled")
+	}
+	if _, ok := srv.catalogSnapshot()[admitted]; !ok {
+		t.Errorf("catalog dropped the report of an admitted node")
+	}
+	var m dto.Metric
+	if err := catalogEntries.Write(&m); err != nil {
+		t.Fatal(err)
+	}
+	if got := m.GetGauge().GetValue(); got != 1 {
+		t.Errorf("catalog_entries = %v, want 1", got)
 	}
 }
 
diff --git a/internal/controlplane/server.go b/internal/controlplane/server.go
index e7e617bb..a535d4ea 100644
--- a/internal/controlplane/server.go
+++ b/internal/controlplane/server.go
@@ -2184,6 +2184,7 @@ func (s *Server) HandleEnroll(w http.ResponseWriter, r *http.Request) {
 			EnrolledAt:         time.Now(),
 			ExpiresAt:          time.Time{},
 			AutonomousRecovery: tokenRecord.AutonomousRecovery,
+			Ephemeral:          tokenRecord.Ephemeral,
 		}
 		if err := s.store.EnrollNode(ctx, nodeRecord); err != nil {
 			logger.Errorf("Failed to enroll active bootstrap node: %v", err)
@@ -2570,6 +2571,7 @@ func (s *Server) HandleAdminBootstrapTokens(w http.ResponseWriter, r *http.Reque
 		CreatedAt:          time.Now(),
 		ExpiresAt:          time.Now().Add(time.Duration(req.GetTtlHours()) * time.Hour),
 		AutonomousRecovery: req.GetAutonomousRecovery(),
+		Ephemeral:          req.GetEphemeral(),
 	}
 
 	if err := s.store.SaveBootstrapToken(r.Context(), tokenRecord); err != nil {
@@ -2793,6 +2795,7 @@ func (s *Server) HandleAdminEnrollmentAction(w http.ResponseWriter, r *http.Requ
 			EnrolledAt:         time.Now(),
 			ExpiresAt:          time.Time{},
 			AutonomousRecovery: tokenRecord.AutonomousRecovery,
+			Ephemeral:          tokenRecord.Ephemeral,
 		}
 		if err := s.store.EnrollNode(ctx, nodeRecord); err != nil {
 			logger.Errorf("Failed to enroll active bootstrap node: %v", err)
@@ -3281,6 +3284,7 @@ func (s *Server) HandleUserBootstrapTokens(w http.ResponseWriter, r *http.Reques
 		CreatedAt:          time.Now(),
 		ExpiresAt:          time.Now().Add(time.Duration(req.GetTtlHours()) * time.Hour),
 		AutonomousRecovery: req.GetAutonomousRecovery(),
+		Ephemeral:          req.GetEphemeral(),
 	}
 
 	if err := s.store.SaveBootstrapToken(r.Context(), tokenRecord); err != nil {
diff --git a/internal/controlplane/server_test.go b/internal/controlplane/server_test.go
index d6461645..abc830fd 100644
--- a/internal/controlplane/server_test.go
+++ b/internal/controlplane/server_test.go
@@ -3212,8 +3212,10 @@ func TestBootstrapTokenOwnerPropagatesToNode(t *testing.T) {
 	const ownerSub = "owner-sub-id"
 	userJWT := mintToken(map[string]interface{}{"sub": ownerSub, "email": "owner@example.com"})
 
+	// Ephemeral is a restriction on the members, not a privilege, so a user
+	// may set it on the tokens they mint.
 	req, _ := http.NewRequest(http.MethodPost, baseURL+"/user/bootstrap-tokens",
-		bytes.NewBufferString(`{"role":"`+api.RoleNode+`","max_usages":1}`))
+		bytes.NewBufferString(`{"role":"`+api.RoleNode+`","max_usages":1,"ephemeral":true}`))
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("Authorization", "Bearer "+userJWT)
 	resp, err := client.Do(req)
@@ -3270,6 +3272,16 @@ func TestBootstrapTokenOwnerPropagatesToNode(t *testing.T) {
 	if enrolled.OwnerID != ownerSub {
 		t.Errorf("enrolled node owner = %q, want %q", enrolled.OwnerID, ownerSub)
 	}
+	if !enrolled.Ephemeral {
+		t.Error("enrolled node is not ephemeral; the token's flag must be copied onto the node")
+	}
+	tokens, err := store.ListBootstrapTokens(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(tokens) != 1 || !tokens[0].Ephemeral {
+		t.Errorf("stored tokens = %+v, want one ephemeral token", tokens)
+	}
 }
 
 // TestInitRegisterRoutesEmbedded pins the embedder seam used by single-binary
diff --git a/internal/controlplane/views.go b/internal/controlplane/views.go
index ebcb6214..6c0420d2 100644
--- a/internal/controlplane/views.go
+++ b/internal/controlplane/views.go
@@ -46,6 +46,7 @@ func bootstrapTokenView(t *storage.BootstrapToken) *api.BootstrapToken {
 		CreateTime:         timestampOrNil(t.CreatedAt),
 		ExpireTime:         timestampOrNil(t.ExpiresAt),
 		AutonomousRecovery: t.AutonomousRecovery,
+		Ephemeral:          t.Ephemeral,
 	}
 	if t.RevokedAt != nil {
 		v.RevokeTime = timestamppb.New(*t.RevokedAt)
@@ -116,6 +117,7 @@ func enrolledNodeView(n *storage.EnrolledNode, withClaims bool) *api.EnrolledNod
 		ExpireTime:         timestampOrNil(n.ExpiresAt),
 		Banned:             n.Banned,
 		AutonomousRecovery: n.AutonomousRecovery,
+		Ephemeral:          n.Ephemeral,
 	}
 	if withClaims {
 		v.ClaimsJson = n.ClaimsJSON
diff --git a/internal/standalone/standalone.go b/internal/standalone/standalone.go
index f859edec..5b7611ef 100644
--- a/internal/standalone/standalone.go
+++ b/internal/standalone/standalone.go
@@ -138,8 +138,12 @@ type ControlPlaneTunables struct {
 	// refreshable without presenting a fresh platform JWT on /refresh.
 	WorkloadSessionTTL time.Duration
 	// NodeRetention is how long a node record is kept after its session
-	// expired before the control plane deletes it.
+	// expired, or after its last refresh for a bootstrap enrollment, before
+	// the control plane deletes it.
 	NodeRetention time.Duration
+	// EphemeralNodeRetention is NodeRetention for a node an ephemeral
+	// bootstrap token enrolled.
+	EphemeralNodeRetention time.Duration
 	// ManualEnrollment queues bootstrap enrollments for admin approval
 	// instead of auto-approving them.
 	ManualEnrollment bool
@@ -279,25 +283,26 @@ func (s *Server) Start(ctx context.Context) (retErr error) {
 	// exists. Public traffic reaches the same handlers via the router's
 	// HTTP fallback mux.
 	cp, err := controlplane.NewServer(controlplane.Options{
-		ListenAddr:            "127.0.0.1:0",
-		DriverName:            s.opts.DBDriver,
-		DataSourceName:        s.opts.DBDSN,
-		OIDCIssuer:            s.opts.OIDCIssuer,
-		WorkloadIssuer:        s.opts.WorkloadIssuer,
-		OIDCClientID:          s.opts.OIDCClientID,
-		AllowedAudiences:      s.opts.AllowedAudiences,
-		LeaseDuration:         s.opts.ControlPlane.LeaseDuration,
-		KeyRotationInterval:   s.opts.ControlPlane.KeyRotationInterval,
-		DHTReplication:        s.opts.ControlPlane.DHTReplication,
-		DHTReprovideInterval:  s.opts.ControlPlane.DHTReprovideInterval,
-		KeyGracePeriod:        s.opts.ControlPlane.KeyGracePeriod,
-		BiscuitTTL:            s.opts.ControlPlane.BiscuitTTL,
-		WorkloadSessionTTL:    s.opts.ControlPlane.WorkloadSessionTTL,
-		NodeRetention:         s.opts.ControlPlane.NodeRetention,
-		BiscuitTimeout:        10 * time.Second,
-		AdminToken:            s.adminToken,
-		AutoApproveEnrollment: !s.opts.ControlPlane.ManualEnrollment,
-		STSIssuerURL:          s.opts.ExternalURL,
+		ListenAddr:             "127.0.0.1:0",
+		DriverName:             s.opts.DBDriver,
+		DataSourceName:         s.opts.DBDSN,
+		OIDCIssuer:             s.opts.OIDCIssuer,
+		WorkloadIssuer:         s.opts.WorkloadIssuer,
+		OIDCClientID:           s.opts.OIDCClientID,
+		AllowedAudiences:       s.opts.AllowedAudiences,
+		LeaseDuration:          s.opts.ControlPlane.LeaseDuration,
+		KeyRotationInterval:    s.opts.ControlPlane.KeyRotationInterval,
+		DHTReplication:         s.opts.ControlPlane.DHTReplication,
+		DHTReprovideInterval:   s.opts.ControlPlane.DHTReprovideInterval,
+		KeyGracePeriod:         s.opts.ControlPlane.KeyGracePeriod,
+		BiscuitTTL:             s.opts.ControlPlane.BiscuitTTL,
+		WorkloadSessionTTL:     s.opts.ControlPlane.WorkloadSessionTTL,
+		NodeRetention:          s.opts.ControlPlane.NodeRetention,
+		EphemeralNodeRetention: s.opts.ControlPlane.EphemeralNodeRetention,
+		BiscuitTimeout:         10 * time.Second,
+		AdminToken:             s.adminToken,
+		AutoApproveEnrollment:  !s.opts.ControlPlane.ManualEnrollment,
+		STSIssuerURL:           s.opts.ExternalURL,
 	}, store)
 	if err != nil {
 		return fmt.Errorf("failed to create control plane: %w", err)
diff --git a/internal/storage/round_trip_test.go b/internal/storage/round_trip_test.go
index d6cc8d9d..721fd46f 100644
--- a/internal/storage/round_trip_test.go
+++ b/internal/storage/round_trip_test.go
@@ -124,6 +124,7 @@ func TestEnrolledNodeRoundTripsEveryField(t *testing.T) {
 		ExpiresAt:      time.Now().Add(time.Hour),
 		// Non-default so the round trip proves the column is read back.
 		AutonomousRecovery: true,
+		Ephemeral:          true,
 	}
 	// Banned is never set by enrollment; a node cannot un-ban itself by
 	// re-enrolling. TestReEnrollmentKeepsAnExistingBan covers that.
@@ -252,6 +253,193 @@ func TestReEnrollmentKeepsAnExistingBan(t *testing.T) {
 // Expiry-based deletion must never take a ban with it, nor touch a node that
 // never had a session bound: the first is how a node is kept out, the second
 // has no expiry to have lapsed.
+// A bootstrap row has no session, so what decides its deletion is how long
+// ago it last refreshed, with a shorter retention for a member an ephemeral
+// token enrolled. Rows with a session, and banned rows, are left to
+// DeleteExpiredNodes and to nobody.
+func TestDeleteSilentBootstrapNodes(t *testing.T) {
+	store := newTestStore(t)
+	ctx := context.Background()
+	now := time.Now()
+	enroll := func(id, kind string, lastRefresh, expiresAt time.Time, ephemeral bool) {
+		t.Helper()
+		if err := store.EnrollNode(ctx, &EnrolledNode{
+			PeerID: id, PublicKey: []byte("pub"), Biscuit: []byte("b"), Role: api.RoleNode,
+			EnrollmentType: kind, EnrolledAt: lastRefresh, ExpiresAt: expiresAt, Ephemeral: ephemeral,
+		}); err != nil {
+			t.Fatalf("enroll %s: %v", id, err)
+		}
+	}
+	var never time.Time
+	enroll("regular-fresh", "BOOTSTRAP", now.Add(-time.Hour), never, false)
+	enroll("regular-stale", "BOOTSTRAP", now.Add(-40*24*time.Hour), never, false)
+	enroll("ephemeral-fresh", "BOOTSTRAP", now.Add(-10*time.Minute), never, true)
+	enroll("ephemeral-stale", "BOOTSTRAP", now.Add(-2*time.Hour), never, true)
+	enroll("oidc-stale", "OIDC", now.Add(-40*24*time.Hour), now.Add(50*24*time.Hour), false)
+	enroll("banned-stale", "BOOTSTRAP", now.Add(-40*24*time.Hour), never, false)
+	if err := store.SetNodeBanned(ctx, "banned-stale", true); err != nil {
+		t.Fatal(err)
+	}
+
+	regular, ephemeral, err := store.DeleteSilentBootstrapNodes(ctx, now.Add(-30*24*time.Hour), now.Add(-time.Hour))
+	if err != nil {
+		t.Fatalf("DeleteSilentBootstrapNodes: %v", err)
+	}
+	if regular != 1 || ephemeral != 1 {
+		t.Errorf("deleted regular=%d ephemeral=%d, want 1 and 1", regular, ephemeral)
+	}
+	nodes, err := store.ListNodes(ctx, NodeFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var left []string
+	for _, n := range nodes {
+		left = append(left, n.PeerID)
+	}
+	slices.Sort(left)
+	want := []string{"banned-stale", "ephemeral-fresh", "oidc-stale", "regular-fresh"}
+	if !slices.Equal(left, want) {
+		t.Errorf("remaining = %v, want %v", left, want)
+	}
+}
+
+func TestDeleteStaleEnrollmentRecords(t *testing.T) {
+	store := newTestStore(t)
+	ctx := context.Background()
+	now := time.Now()
+	day := 24 * time.Hour
+	token := func(id string, expiresAt time.Time, ephemeral bool) {
+		t.Helper()
+		if err := store.SaveBootstrapToken(ctx, &BootstrapToken{
+			ID: id, TokenHash: "hash-" + id, Role: api.RoleNode, MaxUsages: 10,
+			CreatedAt: expiresAt.Add(-day), ExpiresAt: expiresAt, Ephemeral: ephemeral,
+		}); err != nil {
+			t.Fatalf("token %s: %v", id, err)
+		}
+	}
+	request := func(id, tokenID string, createdAt time.Time, resolvedAt *time.Time) {
+		t.Helper()
+		if err := store.CreateEnrollmentRequest(ctx, &EnrollmentRequest{
+			ID: id, PeerID: "peer-" + id, PublicKey: []byte("pub"), TokenID: tokenID,
+			Status: api.EnrollmentStatus_ENROLLMENT_STATUS_APPROVED, CreatedAt: createdAt, ResolvedAt: resolvedAt,
+		}); err != nil {
+			t.Fatalf("request %s: %v", id, err)
+		}
+	}
+	at := func(ago time.Duration) *time.Time { ts := now.Add(-ago); return &ts }
+
+	// A token still in use, one that expired long ago but whose request is
+	// recent, one expired long ago with an old request, an ephemeral one
+	// whose requests are two hours old, and one that just expired.
+	token("live", now.Add(day), false)
+	token("old-with-recent-request", now.Add(-40*day), false)
+	token("old", now.Add(-40*day), false)
+	token("ephemeral", now.Add(-2*time.Hour), true)
+	token("just-expired", now.Add(-time.Hour), false)
+	request("live-1", "live", now.Add(-time.Hour), at(time.Hour))
+	request("recent-on-old-token", "old-with-recent-request", now.Add(-41*day), at(2*day))
+	request("old-resolved", "old", now.Add(-41*day), at(40*day))
+	request("old-pending", "old", now.Add(-41*day), nil)
+	request("ephemeral-1", "ephemeral", now.Add(-2*time.Hour), at(2*time.Hour))
+	request("ephemeral-2", "ephemeral", now.Add(-2*time.Hour), at(2*time.Hour))
+	request("ephemeral-fresh", "ephemeral", now.Add(-10*time.Minute), at(10*time.Minute))
+
+	requests, err := store.DeleteStaleEnrollmentRequests(ctx, now.Add(-30*day), now.Add(-time.Hour))
+	if err != nil {
+		t.Fatalf("DeleteStaleEnrollmentRequests: %v", err)
+	}
+	if requests != 4 {
+		t.Errorf("deleted %d requests, want 4 (old-resolved, old-pending, ephemeral-1, ephemeral-2)", requests)
+	}
+	left, err := store.ListEnrollmentRequests(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var leftIDs []string
+	for _, r := range left {
+		leftIDs = append(leftIDs, r.ID)
+	}
+	slices.Sort(leftIDs)
+	if want := []string{"ephemeral-fresh", "live-1", "recent-on-old-token"}; !slices.Equal(leftIDs, want) {
+		t.Errorf("remaining requests = %v, want %v", leftIDs, want)
+	}
+
+	// "old" lost both requests and goes; "old-with-recent-request" is still
+	// referred to and stays; "ephemeral" keeps its fresh request; "just-expired"
+	// is within the retention.
+	tokens, err := store.DeleteExpiredBootstrapTokens(ctx, now.Add(-30*day))
+	if err != nil {
+		t.Fatalf("DeleteExpiredBootstrapTokens: %v", err)
+	}
+	if tokens != 1 {
+		t.Errorf("deleted %d tokens, want 1 (old)", tokens)
+	}
+	remaining, err := store.ListBootstrapTokens(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var tokenIDs []string
+	for i := range remaining {
+		tokenIDs = append(tokenIDs, remaining[i].ID)
+	}
+	slices.Sort(tokenIDs)
+	if want := []string{"ephemeral", "just-expired", "live", "old-with-recent-request"}; !slices.Equal(tokenIDs, want) {
+		t.Errorf("remaining tokens = %v, want %v", tokenIDs, want)
+	}
+}
+
+func TestDeleteExpiredRouterLeases(t *testing.T) {
+	store := newTestStore(t)
+	ctx := context.Background()
+	now := time.Now()
+	lease := func(id string, expiresAt time.Time) {
+		t.Helper()
+		if err := store.UpsertRouterLease(ctx, &RouterLease{
+			PeerID: id, Addresses: []string{"/ip4/127.0.0.1/tcp/1"}, LastRenewal: expiresAt.Add(-time.Minute), ExpiresAt: expiresAt,
+		}); err != nil {
+			t.Fatalf("lease %s: %v", id, err)
+		}
+	}
+	lease("live", now.Add(time.Minute))
+	lease("lapsed-today", now.Add(-time.Hour))
+	lease("gone", now.Add(-40*24*time.Hour))
+
+	deleted, err := store.DeleteExpiredRouterLeases(ctx, now.Add(-30*24*time.Hour))
+	if err != nil {
+		t.Fatalf("DeleteExpiredRouterLeases: %v", err)
+	}
+	if deleted != 1 {
+		t.Errorf("deleted %d leases, want 1 (gone)", deleted)
+	}
+	counts, err := store.CountRows(ctx)
+	if err != nil {
+		t.Fatalf("CountRows: %v", err)
+	}
+	if counts["routers"] != 2 {
+		t.Errorf("routers rows = %d, want 2 (live, lapsed-today); counts %v", counts["routers"], counts)
+	}
+	active, err := store.GetActiveRouters(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(active) != 1 || active[0].PeerID != "live" {
+		t.Errorf("active routers = %+v, want only live", active)
+	}
+}
+
+func TestCountRowsCoversEveryGrowingTable(t *testing.T) {
+	store := newTestStore(t)
+	counts, err := store.CountRows(context.Background())
+	if err != nil {
+		t.Fatalf("CountRows: %v", err)
+	}
+	for _, table := range []string{"nodes", "enrollment_requests", "bootstrap_tokens", "routers", "revoked_biscuits", "banned_identities", "users", "keyring"} {
+		if _, ok := counts[table]; !ok {
+			t.Errorf("CountRows lacks %q: %v", table, counts)
+		}
+	}
+}
+
 func TestDeleteExpiredNodesSparesBannedAndUnbounded(t *testing.T) {
 	store := newTestStore(t)
 	ctx := context.Background()
@@ -445,6 +633,7 @@ func TestBootstrapTokenRoundTripsEveryField(t *testing.T) {
 		ExpiresAt:   time.Now().Add(time.Hour),
 		// Non-default so the round trip proves the column is read back.
 		AutonomousRecovery: true,
+		Ephemeral:          true,
 	}
 	// RevokedAt is never set at creation - only RevokeBootstrapToken sets it,
 	// covered separately below.
diff --git a/internal/storage/sql_store.go b/internal/storage/sql_store.go
index b0587033..6ca97f52 100644
--- a/internal/storage/sql_store.go
+++ b/internal/storage/sql_store.go
@@ -568,6 +568,19 @@ var migrations = []migration{
 			`CREATE INDEX IF NOT EXISTS idx_nodes_enrolled_at ON nodes (enrolled_at, peer_id)`,
 		},
 	},
+	{
+		// An ephemeral token enrolls members that are forgotten soon after
+		// they fall silent; the flag is copied onto each node it enrolls.
+		version: 20,
+		postgres: []string{
+			`ALTER TABLE bootstrap_tokens ADD COLUMN IF NOT EXISTS ephemeral BOOLEAN DEFAULT FALSE NOT NULL`,
+			`ALTER TABLE nodes ADD COLUMN IF NOT EXISTS ephemeral BOOLEAN DEFAULT FALSE NOT NULL`,
+		},
+		sqlite: []string{
+			`ALTER TABLE bootstrap_tokens ADD COLUMN ephemeral BOOLEAN DEFAULT FALSE NOT NULL`,
+			`ALTER TABLE nodes ADD COLUMN ephemeral BOOLEAN DEFAULT FALSE NOT NULL`,
+		},
+	},
 }
 
 var meshPrefixMigration = []string{
@@ -893,16 +906,16 @@ func (s *SQLStore) EnrollNode(ctx context.Context, node *EnrolledNode) error {
 	var query string
 	if s.isPostgres() {
 		query = s.rebind(`
-			INSERT INTO nodes (peer_id, public_key, biscuit_token, role, enrollment_type, claims_json, owner_id, labels_json, enrolled_at, expires_at, autonomous_recovery, banned) 
-			VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, FALSE)
+			INSERT INTO nodes (peer_id, public_key, biscuit_token, role, enrollment_type, claims_json, owner_id, labels_json, enrolled_at, expires_at, autonomous_recovery, ephemeral, banned) 
+			VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, FALSE)
 			ON CONFLICT (peer_id) 
-			DO UPDATE SET public_key = EXCLUDED.public_key, biscuit_token = EXCLUDED.biscuit_token, role = EXCLUDED.role, enrollment_type = EXCLUDED.enrollment_type, claims_json = EXCLUDED.claims_json, owner_id = EXCLUDED.owner_id, labels_json = EXCLUDED.labels_json, enrolled_at = EXCLUDED.enrolled_at, expires_at = EXCLUDED.expires_at, autonomous_recovery = EXCLUDED.autonomous_recovery`)
+			DO UPDATE SET public_key = EXCLUDED.public_key, biscuit_token = EXCLUDED.biscuit_token, role = EXCLUDED.role, enrollment_type = EXCLUDED.enrollment_type, claims_json = EXCLUDED.claims_json, owner_id = EXCLUDED.owner_id, labels_json = EXCLUDED.labels_json, enrolled_at = EXCLUDED.enrolled_at, expires_at = EXCLUDED.expires_at, autonomous_recovery = EXCLUDED.autonomous_recovery, ephemeral = EXCLUDED.ephemeral`)
 	} else {
 		query = s.rebind(`
-			INSERT INTO nodes (peer_id, public_key, biscuit_token, role, enrollment_type, claims_json, owner_id, labels_json, enrolled_at, expires_at, autonomous_recovery, banned) 
-			VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0)
+			INSERT INTO nodes (peer_id, public_key, biscuit_token, role, enrollment_type, claims_json, owner_id, labels_json, enrolled_at, expires_at, autonomous_recovery, ephemeral, banned) 
+			VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0)
 			ON CONFLICT (peer_id) 
-			DO UPDATE SET public_key = excluded.public_key, biscuit_token = excluded.biscuit_token, role = excluded.role, enrollment_type = excluded.enrollment_type, claims_json = excluded.claims_json, owner_id = excluded.owner_id, labels_json = excluded.labels_json, enrolled_at = excluded.enrolled_at, expires_at = excluded.expires_at, autonomous_recovery = excluded.autonomous_recovery`)
+			DO UPDATE SET public_key = excluded.public_key, biscuit_token = excluded.biscuit_token, role = excluded.role, enrollment_type = excluded.enrollment_type, claims_json = excluded.claims_json, owner_id = excluded.owner_id, labels_json = excluded.labels_json, enrolled_at = excluded.enrolled_at, expires_at = excluded.expires_at, autonomous_recovery = excluded.autonomous_recovery, ephemeral = excluded.ephemeral`)
 	}
 
 	ownerIDNull := sql.NullString{String: node.OwnerID, Valid: node.OwnerID != ""}
@@ -918,13 +931,14 @@ func (s *SQLStore) EnrollNode(ctx context.Context, node *EnrolledNode) error {
 		node.EnrolledAt.UnixMilli(),
 		node.ExpiresAt.UnixMilli(),
 		node.AutonomousRecovery,
+		node.Ephemeral,
 	)
 	return err
 }
 
 // GetNode implements Store.
 func (s *SQLStore) GetNode(ctx context.Context, peerID string) (*EnrolledNode, error) {
-	query := s.rebind(`SELECT peer_id, public_key, biscuit_token, role, enrollment_type, claims_json, owner_id, labels_json, enrolled_at, expires_at, banned, autonomous_recovery FROM nodes WHERE peer_id = ?`)
+	query := s.rebind(`SELECT peer_id, public_key, biscuit_token, role, enrollment_type, claims_json, owner_id, labels_json, enrolled_at, expires_at, banned, autonomous_recovery, ephemeral FROM nodes WHERE peer_id = ?`)
 	var node EnrolledNode
 	var claimsJSON, ownerID, labelsJSON sql.NullString
 	var enrolledAtUnix, expiresAtUnix int64
@@ -941,6 +955,7 @@ func (s *SQLStore) GetNode(ctx context.Context, peerID string) (*EnrolledNode, e
 		&expiresAtUnix,
 		&node.Banned,
 		&node.AutonomousRecovery,
+		&node.Ephemeral,
 	)
 	if claimsJSON.Valid {
 		node.ClaimsJSON = claimsJSON.String
@@ -1086,6 +1101,84 @@ func (s *SQLStore) DeleteExpiredNodes(ctx context.Context, before time.Time) (in
 	return res.RowsAffected()
 }
 
+// DeleteSilentBootstrapNodes implements Store. Two statements, one per
+// retention, each leading with banned and expires_at so the
+// (banned, expires_at) index narrows them to the unbounded rows.
+func (s *SQLStore) DeleteSilentBootstrapNodes(ctx context.Context, before, ephemeralBefore time.Time) (int64, int64, error) {
+	query := s.rebind(`DELETE FROM nodes WHERE banned = ? AND expires_at <= 0 AND ephemeral = ? AND enrolled_at < ?`)
+	res, err := s.db.ExecContext(ctx, query, false, false, before.UnixMilli())
+	if err != nil {
+		return 0, 0, err
+	}
+	regular, err := res.RowsAffected()
+	if err != nil {
+		return 0, 0, err
+	}
+	res, err = s.db.ExecContext(ctx, query, false, true, ephemeralBefore.UnixMilli())
+	if err != nil {
+		return regular, 0, err
+	}
+	ephemeral, err := res.RowsAffected()
+	return regular, ephemeral, err
+}
+
+// DeleteStaleEnrollmentRequests implements Store.
+func (s *SQLStore) DeleteStaleEnrollmentRequests(ctx context.Context, before, ephemeralBefore time.Time) (int64, error) {
+	// The OR form, rather than COALESCE over the two columns, lets an index
+	// on either column serve the predicate.
+	res, err := s.db.ExecContext(ctx, s.rebind(`DELETE FROM enrollment_requests WHERE resolved_at < ? OR (resolved_at IS NULL AND created_at < ?)`), before.UnixMilli(), before.UnixMilli())
+	if err != nil {
+		return 0, err
+	}
+	regular, err := res.RowsAffected()
+	if err != nil {
+		return 0, err
+	}
+	res, err = s.db.ExecContext(ctx, s.rebind(`DELETE FROM enrollment_requests WHERE (resolved_at < ? OR (resolved_at IS NULL AND created_at < ?)) AND token_id IN (SELECT id FROM bootstrap_tokens WHERE ephemeral = ?)`), ephemeralBefore.UnixMilli(), ephemeralBefore.UnixMilli(), true)
+	if err != nil {
+		return regular, err
+	}
+	ephemeral, err := res.RowsAffected()
+	return regular + ephemeral, err
+}
+
+// DeleteExpiredBootstrapTokens implements Store. The NOT EXISTS keeps the
+// foreign key from enrollment_requests.token_id satisfied: a token goes once
+// its requests have.
+func (s *SQLStore) DeleteExpiredBootstrapTokens(ctx context.Context, before time.Time) (int64, error) {
+	res, err := s.db.ExecContext(ctx, s.rebind(`DELETE FROM bootstrap_tokens WHERE expires_at < ? AND NOT EXISTS (SELECT 1 FROM enrollment_requests r WHERE r.token_id = bootstrap_tokens.id)`), before.UnixMilli())
+	if err != nil {
+		return 0, err
+	}
+	return res.RowsAffected()
+}
+
+// DeleteExpiredRouterLeases implements Store.
+func (s *SQLStore) DeleteExpiredRouterLeases(ctx context.Context, before time.Time) (int64, error) {
+	res, err := s.db.ExecContext(ctx, s.rebind(`DELETE FROM routers WHERE expires_at < ?`), before.UnixMilli())
+	if err != nil {
+		return 0, err
+	}
+	return res.RowsAffected()
+}
+
+// countedTables are the tables whose row counts the control plane reports;
+// every one of them grows with mesh activity and has a reaper or a bound.
+var countedTables = []string{"nodes", "enrollment_requests", "bootstrap_tokens", "routers", "revoked_biscuits", "banned_identities", "users", "keyring"}
+
+// CountRows implements Store.
+func (s *SQLStore) CountRows(ctx context.Context) (map[string]int64, error) {
+	counts := make(map[string]int64, len(countedTables))
+	for _, table := range countedTables {
+		var n int64
+		if err := s.db.QueryRowContext(ctx, `SELECT COUNT(*) FROM `+table).Scan(&n); err != nil {
+			return nil, fmt.Errorf("count %s: %w", table, err)
+		}
+		counts[table] = n
+	}
+	return counts, nil
+}
+
 // ListBannedPeerIDs implements Store.
 func (s *SQLStore) ListBannedPeerIDs(ctx context.Context) ([]string, error) {
 	query := s.rebind(`SELECT peer_id FROM nodes WHERE banned = ?`)
@@ -1444,13 +1537,13 @@ func (s *SQLStore) SaveBootstrapToken(ctx context.Context, token *BootstrapToken
 	var query string
 	if s.isPostgres() {
 		query = s.rebind(`
-			INSERT INTO bootstrap_tokens (id, token_hash, role, owner_id, max_usages, usages_count, description, created_at, expires_at, autonomous_recovery)
-			VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+			INSERT INTO bootstrap_tokens (id, token_hash, role, owner_id, max_usages, usages_count, description, created_at, expires_at, autonomous_recovery, ephemeral)
+			VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 			ON CONFLICT (id) DO NOTHING`)
 	} else {
 		query = s.rebind(`
-			INSERT INTO bootstrap_tokens (id, token_hash, role, owner_id, max_usages, usages_count, description, created_at, expires_at, autonomous_recovery)
-			VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+			INSERT INTO bootstrap_tokens (id, token_hash, role, owner_id, max_usages, usages_count, description, created_at, expires_at, autonomous_recovery, ephemeral)
+			VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 			ON CONFLICT (id) DO NOTHING`)
 	}
 	ownerIDNull := sql.NullString{String: token.OwnerID, Valid: token.OwnerID != ""}
@@ -1465,13 +1558,14 @@ func (s *SQLStore) SaveBootstrapToken(ctx context.Context, token *BootstrapToken
 		token.CreatedAt.UnixMilli(),
 		token.ExpiresAt.UnixMilli(),
 		token.AutonomousRecovery,
+		token.Ephemeral,
 	)
 	return err
 }
 
 // GetBootstrapToken retrieves a bootstrap token by its ID (sha256 hash).
 func (s *SQLStore) GetBootstrapToken(ctx context.Context, id string) (*BootstrapToken, error) {
-	query := s.rebind(`SELECT id, token_hash, role, owner_id, max_usages, usages_count, description, created_at, expires_at, revoked_at, autonomous_recovery FROM bootstrap_tokens WHERE id = ?`)
+	query := s.rebind(`SELECT id, token_hash, role, owner_id, max_usages, usages_count, description, created_at, expires_at, revoked_at, autonomous_recovery, ephemeral FROM bootstrap_tokens WHERE id = ?`)
 	var t BootstrapToken
 	var created, expires int64
 	var ownerID sql.NullString
@@ -1488,6 +1582,7 @@ func (s *SQLStore) GetBootstrapToken(ctx context.Context, id string) (*Bootstrap
 		&expires,
 		&revokedAt,
 		&t.AutonomousRecovery,
+		&t.Ephemeral,
 	)
 	if err == sql.ErrNoRows {
 		return nil, ErrNotFound
@@ -1707,7 +1802,7 @@ func (s *SQLStore) ListNodes(ctx context.Context, filter NodeFilter) ([]Enrolled
 	}
 	// Neither blob is read: a list is a view of the rows, and the biscuit is
 	// a 2 KB column per row that only GetNode's single-row callers need.
-	query := `SELECT peer_id, role, enrollment_type, claims_json, owner_id, labels_json, enrolled_at, expires_at, banned, autonomous_recovery FROM nodes` + where + ` ORDER BY enrolled_at DESC, peer_id DESC`
+	query := `SELECT peer_id, role, enrollment_type, claims_json, owner_id, labels_json, enrolled_at, expires_at, banned, autonomous_recovery, ephemeral FROM nodes` + where + ` ORDER BY enrolled_at DESC, peer_id DESC`
 	if filter.Limit > 0 {
 		query += ` LIMIT ?`
 		args = append(args, filter.Limit)
@@ -1734,6 +1829,7 @@ func (s *SQLStore) ListNodes(ctx context.Context, filter NodeFilter) ([]Enrolled
 			&expiresAtUnix,
 			&node.Banned,
 			&node.AutonomousRecovery,
+			&node.Ephemeral,
 		)
 		if err != nil {
 			return nil, fmt.Errorf("failed to scan enrolled node: %w", err)
@@ -1846,7 +1942,7 @@ func (s *SQLStore) CountNodes(ctx context.Context, now time.Time) ([]NodeCount,
 
 // ListBootstrapTokens retrieves all bootstrap tokens.
 func (s *SQLStore) ListBootstrapTokens(ctx context.Context) ([]BootstrapToken, error) {
-	query := s.rebind(`SELECT id, token_hash, role, owner_id, max_usages, usages_count, description, created_at, expires_at, revoked_at, autonomous_recovery FROM bootstrap_tokens ORDER BY created_at DESC`)
+	query := s.rebind(`SELECT id, token_hash, role, owner_id, max_usages, usages_count, description, created_at, expires_at, revoked_at, autonomous_recovery, ephemeral FROM bootstrap_tokens ORDER BY created_at DESC`)
 	rows, err := s.db.QueryContext(ctx, query)
 	if err != nil {
 		return nil, fmt.Errorf("failed to query bootstrap tokens: %w", err)
@@ -1872,6 +1968,7 @@ func (s *SQLStore) ListBootstrapTokens(ctx context.Context) ([]BootstrapToken, e
 			&expires,
 			&revokedAt,
 			&t.AutonomousRecovery,
+			&t.Ephemeral,
 		)
 		if err != nil {
 			return nil, fmt.Errorf("failed to scan bootstrap token: %w", err)
diff --git a/internal/storage/storage.go b/internal/storage/storage.go
index 251b399c..52ad4730 100644
--- a/internal/storage/storage.go
+++ b/internal/storage/storage.go
@@ -110,11 +110,17 @@ type EnrolledNode struct {
 	// forgotten or stolen machine from rejoining on its own. Only ever set
 	// server-side, from the token that enrolled the node or by an admin.
 	AutonomousRecovery bool
+	// Ephemeral marks a member enrolled by an ephemeral bootstrap token: a
+	// fleet member, a probe, a CI job. Such a member is forgotten soon after
+	// it falls silent (DeleteSilentBootstrapNodes), where a regular one is
+	// kept for the full retention. Copied from the token at enrollment.
+	Ephemeral bool
 }
 
 // NodeState is what CheckAdmission says of a node at some instant. "admitted"
 // is not liveness: a node that enrolled once and went away stays admitted
-// until its session expires.
+// until its session expires, or, for a bootstrap enrollment that has none,
+// until it has been silent for the retention and is deleted.
 type NodeState string
 
 const (
@@ -184,6 +190,9 @@ type BootstrapToken struct {
 	// AutonomousRecovery is copied onto every node this token enrolls; see
 	// EnrolledNode.AutonomousRecovery.
 	AutonomousRecovery bool
+	// Ephemeral is copied onto every node this token enrolls; see
+	// EnrolledNode.Ephemeral.
+	Ephemeral bool
 }
 
 // IsRevoked reports whether the token has been explicitly revoked, as
@@ -364,9 +373,40 @@ type Store interface {
 	// lapsed session already refuses every refresh, so the row only records
 	// that the node once existed; a ban, by contrast, is the row, and must
 	// outlive the session it was placed on. Nodes with no session bound
-	// (zero ExpiresAt) are never removed.
+	// (zero ExpiresAt) are not removed here; see DeleteSilentBootstrapNodes.
 	DeleteExpiredNodes(ctx context.Context, before time.Time) (int64, error)
 
+	// DeleteSilentBootstrapNodes removes enrolled nodes that have no session
+	// bound (a bootstrap enrollment) and are not banned, whose last refresh
+	// (EnrolledAt, which a refresh rewrites) is before `before`, or before
+	// `ephemeralBefore` for a node an ephemeral token enrolled. A member
+	// that refreshes keeps its row; one that fell silent for the retention
+	// is forgotten, and enrolls again if it comes back. It returns how many
+	// regular and how many ephemeral rows went.
+	DeleteSilentBootstrapNodes(ctx context.Context, before, ephemeralBefore time.Time) (regular, ephemeral int64, err error)
+
+	// DeleteStaleEnrollmentRequests removes enrollment requests created, or
+	// resolved, before `before`, and before `ephemeralBefore` when the token
+	// that made them is ephemeral. A resolved request is a record of a
+	// decision; a pending one that old was abandoned by its enrollee long
+	// ago. It returns how many went.
+	DeleteStaleEnrollmentRequests(ctx context.Context, before, ephemeralBefore time.Time) (int64, error)
+
+	// DeleteExpiredBootstrapTokens removes tokens that expired before
+	// `before` and that no enrollment request refers to any more; a token
+	// is the proof a member gave once, and once its requests are gone
+	// nothing points at it. It returns how many went.
+	DeleteExpiredBootstrapTokens(ctx context.Context, before time.Time) (int64, error)
+
+	// DeleteExpiredRouterLeases removes router leases that expired before
+	// `before`. A router that comes back leases again under its peer ID; a
+	// lease long expired is a router that is gone. It returns how many went.
+	DeleteExpiredRouterLeases(ctx context.Context, before time.Time) (int64, error)
+
+	// CountRows counts the rows of every table whose size the control plane
+	// reports, keyed by table name.
+	CountRows(ctx context.Context) (map[string]int64, error)
+
 	// ListBootstrapTokens retrieves all bootstrap tokens.
 	ListBootstrapTokens(ctx context.Context) ([]BootstrapToken, error)
 
diff --git a/sdk/js/src/gen/agentmesh_pb.ts b/sdk/js/src/gen/agentmesh_pb.ts
index 4a4df4d4..0b34214a 100644
--- a/sdk/js/src/gen/agentmesh_pb.ts
+++ b/sdk/js/src/gen/agentmesh_pb.ts
@@ -26,7 +26,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file agentmesh.proto.
  */
 export const file_agentmesh: GenFile = /*@__PURE__*/
-  fileDesc("Cg9hZ2VudG1lc2gucHJvdG8SDGFnZW50bWVzaC52MSI0CglBdXRoRnJhbWUSDwoHYmlzY3VpdBgBIAEoDBIWCg50YXJnZXRfc2VydmljZRgCIAEoCSI/CgxBdXRoUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCBINCgVlcnJvchgCIAEoCRIPCgdiaXNjdWl0GAMgASgMIrEBCgxSb3V0ZXJHb0F3YXkSMQoGcmVhc29uGAEgASgOMiEuYWdlbnRtZXNoLnYxLlJvdXRlckdvQXdheS5SZWFzb24SLgoLcmV0cnlfYWZ0ZXIYAiABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb24iPgoGUmVhc29uEhYKElJFQVNPTl9VTlNQRUNJRklFRBAAEgwKCERSQUlOSU5HEAESDgoKT1ZFUkxPQURFRBACItwBCglNZXNoRXZlbnQSKgoEdHlwZRgBIAEoDjIcLmFnZW50bWVzaC52MS5NZXNoRXZlbnQuVHlwZRIPCgdwZWVyX2lkGAIgASgJEi4KCmV2ZW50X3RpbWUYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhYKDm5ld19wdWJsaWNfa2V5GAQgASgMEhEKCXNpZ25hdHVyZRgFIAEoDCI3CgRUeXBlEgoKBkJBTk5FRBAAEhAKDEtFWV9ST1RBVElPThABEhEKDVBPTElDWV9VUERBVEUQAiL5AQoNRW5yb2xsUmVxdWVzdBILCgNqd3QYASABKAkSDwoHcGVlcl9pZBgCIAEoCRISCgpwdWJsaWNfa2V5GAMgASgMEhYKDnJlcXVlc3RlZF9yb2xlGAQgASgJEjcKBmxhYmVscxgFIAMoCzInLmFnZW50bWVzaC52MS5FbnJvbGxSZXF1ZXN0LkxhYmVsc0VudHJ5EhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKrAQoORW5yb2xsUmVzcG9uc2USFQoNYmlzY3VpdF90b2tlbhgBIAEoDBIVCg1lcnJvcl9tZXNzYWdlGAIgASgJEiAKGGNvbnRyb2xfcGxhbmVfcHVibGljX2tleRgDIAEoDBIYChByb3V0ZXJfYWRkcmVzc2VzGAQgAygJEi8KC2V4cGlyZV90aW1lGAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCKXAgoWQm9vdHN0cmFwRW5yb2xsUmVxdWVzdBIXCg9ib290c3RyYXBfdG9rZW4YASABKAkSDwoHcGVlcl9pZBgCIAEoCRISCgpwdWJsaWNfa2V5GAMgASgMEhYKDnJlcXVlc3RlZF9yb2xlGAQgASgJEkAKBmxhYmVscxgFIAMoCzIwLmFnZW50bWVzaC52MS5Cb290c3RyYXBFbnJvbGxSZXF1ZXN0LkxhYmVsc0VudHJ5EhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKDAgoXQm9vdHN0cmFwRW5yb2xsUmVzcG9uc2USLgoGc3RhdHVzGAEgASgOMh4uYWdlbnRtZXNoLnYxLkVucm9sbG1lbnRTdGF0dXMSFQoNYmlzY3VpdF90b2tlbhgCIAEoDBIdChVwb2xsX2ludGVydmFsX3NlY29uZHMYAyABKAUSFQoNZXJyb3JfbWVzc2FnZRgEIAEoCRIgChhjb250cm9sX3BsYW5lX3B1YmxpY19rZXkYBSABKAwSGAoQcm91dGVyX2FkZHJlc3NlcxgGIAMoCRIvCgtleHBpcmVfdGltZRgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiWQoLU2VydmljZUluZm8SJwoEdHlwZRgBIAEoDjIZLmFnZW50bWVzaC52MS5TZXJ2aWNlVHlwZRIMCgRuYW1lGAIgASgJEhMKC2Rlc2NyaXB0aW9uGAMgASgJIoEBCg5Db21tYW5kQmFja2VuZBIPCgdjb21tYW5kGAEgAygJEjIKA2VudhgCIAMoCzIlLmFnZW50bWVzaC52MS5Db21tYW5kQmFja2VuZC5FbnZFbnRyeRoqCghFbnZFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIpYBChZSZWdpc3RlclNlcnZpY2VSZXF1ZXN0EioKB3NlcnZpY2UYASABKAsyGS5hZ2VudG1lc2gudjEuU2VydmljZUluZm8SFAoKdGFyZ2V0X3VybBgCIAEoCUgAEi8KB2NvbW1hbmQYAyABKAsyHC5hZ2VudG1lc2gudjEuQ29tbWFuZEJhY2tlbmRIAEIJCgdiYWNrZW5kImkKEkRpc2NvdmVyZWRQcm92aWRlchIPCgdwZWVyX2lkGAEgASgJEhcKD2xvY2FsX3Byb3h5X3VybBgCIAEoCRIQCghzcnZfbmFtZRgDIAEoCRIXCg9zcnZfZGVzY3JpcHRpb24YBCABKAki6AEKGENvbnRyb2xQbGFuZUluZm9SZXNwb25zZRITCgtvaWRjX2lzc3VlchgBIAEoCRIRCgljbGllbnRfaWQYAiABKAkSEAoIYXVkaWVuY2UYAyABKAkSGAoQcm91dGVyX2FkZHJlc3NlcxgEIAMoCRIXCg9iYW5uZWRfcGVlcl9pZHMYBSADKAkSKQoHcm91dGVycxgGIAMoCzIYLmFnZW50bWVzaC52MS5Sb3V0ZXJJbmZvEjQKCWRpcmVjdG9yeRgHIAEoCzIhLmFnZW50bWVzaC52MS5EaXJlY3RvcnlQYXJhbWV0ZXJzIpABChNEaXJlY3RvcnlQYXJhbWV0ZXJzEhMKC3JlcGxpY2F0aW9uGAEgASgFEjUKEnJlcHJvdmlkZV9pbnRlcnZhbBgCIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbhItCgpyZWNvcmRfdHRsGAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uIvsBChBEaXJlY3RvcnlSZXF1ZXN0EjEKB3Byb3ZpZGUYASABKAsyHi5hZ2VudG1lc2gudjEuRGlyZWN0b3J5UHJvdmlkZUgAEj4KDmZpbmRfcHJvdmlkZXJzGAIgASgLMiQuYWdlbnRtZXNoLnYxLkRpcmVjdG9yeUZpbmRQcm92aWRlcnNIABI0CglmaW5kX3BlZXIYAyABKAsyHy5hZ2VudG1lc2gudjEuRGlyZWN0b3J5RmluZFBlZXJIABIzCgh3aXRoZHJhdxgEIAEoCzIfLmFnZW50bWVzaC52MS5EaXJlY3RvcnlXaXRoZHJhd0gAQgkKB3JlcXVlc3QiUQoQRGlyZWN0b3J5UHJvdmlkZRILCgNrZXkYASABKAwSDQoFYWRkcnMYAiADKAkSEAoIcHJvdmlkZXIYAyABKAkSDwoHc2VydmljZRgEIAEoCSIyChFEaXJlY3RvcnlXaXRoZHJhdxILCgNrZXkYASABKAwSEAoIcHJvdmlkZXIYAiABKAkiNAoWRGlyZWN0b3J5RmluZFByb3ZpZGVycxILCgNrZXkYASABKAwSDQoFbGltaXQYAiABKA0iJAoRRGlyZWN0b3J5RmluZFBlZXISDwoHcGVlcl9pZBgBIAEoCSJ3ChFEaXJlY3RvcnlSZXNwb25zZRIrCglwcm92aWRlcnMYASADKAsyGC5hZ2VudG1lc2gudjEuUGVlclJlY29yZBImCgRwZWVyGAIgASgLMhguYWdlbnRtZXNoLnYxLlBlZXJSZWNvcmQSDQoFZXJyb3IYAyABKAkiLAoKUGVlclJlY29yZBIPCgdwZWVyX2lkGAEgASgJEg0KBWFkZHJzGAIgAygJIsQBCgpSb3V0ZXJJbmZvEg8KB3BlZXJfaWQYASABKAkSEQoJYWRkcmVzc2VzGAIgAygJEjQKBmxhYmVscxgDIAMoCzIkLmFnZW50bWVzaC52MS5Sb3V0ZXJJbmZvLkxhYmVsc0VudHJ5EhMKC2Nvbm5lY3Rpb25zGAQgASgFEhgKEGNvbm5lY3Rpb25fbGltaXQYBSABKAUaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKDAgoSUm91dGVyTGVhc2VSZXF1ZXN0Eg8KB3BlZXJfaWQYASABKAkSEQoJYWRkcmVzc2VzGAIgAygJEg8KB2Jpc2N1aXQYAyABKAwSFwoPY29ubmVjdGVkX3BlZXJzGAQgAygJEhAKCGRodF9zaXplGAUgASgFEhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwSJgoDdHRsGAggASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uEhMKC2Nvbm5lY3Rpb25zGAkgASgFEhgKEGNvbm5lY3Rpb25fbGltaXQYCiABKAUiZgoTUm91dGVyTGVhc2VSZXNwb25zZRIPCgdzdWNjZXNzGAEgASgIEg0KBWVycm9yGAIgASgJEi8KC2V4cGlyZV90aW1lGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCK9AQoKUG9saWN5Um9sZRIMCgRuYW1lGAEgASgJEhcKD2FsbG93ZWRfdGFyZ2V0cxgCIAMoCRIYChBhbGxvd2VkX3NlcnZpY2VzGAMgAygJEhYKDmN1c3RvbV9kYXRhbG9nGAQgAygJEhYKDmFsbG93ZWRfbGFiZWxzGAUgAygJEiUKBGh0dHAYBiADKAsyFy5hZ2VudG1lc2gudjEuSFRUUEdyYW50EhcKD2FsbG93ZWRfcHVibGlzaBgHIAMoCSI8CglIVFRQR3JhbnQSDwoHc2VydmljZRgBIAEoCRIPCgdtZXRob2RzGAIgAygJEg0KBXBhdGhzGAMgAygJIqECChFFZ3Jlc3NEZXN0aW5hdGlvbhIMCgRuYW1lGAEgASgJEhIKCnRhcmdldF91cmwYAiABKAkSEgoKY3JlZGVudGlhbBgDIAEoCRIRCglzZXJ2ZWRfYnkYBCADKAkSLgoGYnJva2VyGAUgASgLMh4uYWdlbnRtZXNoLnYxLkNyZWRlbnRpYWxCcm9rZXISLAoKaW5zcGVjdGlvbhgGIAEoCzIYLmFnZW50bWVzaC52MS5JbnNwZWN0aW9uEiYKBG1vZGUYByABKA4yGC5hZ2VudG1lc2gudjEuRWdyZXNzTW9kZRINCgVwb3J0cxgIIAMoDRIVCg1wcmVzZXJ2ZV9ob3N0GAkgASgIEhcKD2ZvcndhcmRfY29udGV4dBgKIAEoCCI5CgpJbnNwZWN0aW9uEisKCmluc3BlY3RvcnMYASADKAsyFy5hZ2VudG1lc2gudjEuSW5zcGVjdG9yIm8KCUluc3BlY3RvchIvCgttb2RlbF9hcm1vchgBIAEoCzIYLmFnZW50bWVzaC52MS5Nb2RlbEFybW9ySAASKQoIZXh0X3Byb2MYAiABKAsyFS5hZ2VudG1lc2gudjEuRXh0UHJvY0gAQgYKBGtpbmQikQEKCk1vZGVsQXJtb3ISEAoIdGVtcGxhdGUYASABKAkSMgoIcmVzcG9uc2UYAiABKA4yIC5hZ2VudG1lc2gudjEuUmVzcG9uc2VJbnNwZWN0aW9uEhEKCWZhaWxfb3BlbhgDIAEoCBIqCgd0aW1lb3V0GAQgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uIogCCgdFeHRQcm9jEg4KBnRhcmdldBgBIAEoCRIKCgJjYRgCIAEoCRIaChJjbGllbnRfY2VydGlmaWNhdGUYAyABKAkSPAoPcHJvY2Vzc2luZ19tb2RlGAQgASgLMiMuYWdlbnRtZXNoLnYxLkV4dFByb2NQcm9jZXNzaW5nTW9kZRIbChNhbGxvd19tb2RlX292ZXJyaWRlGAUgASgIEjIKD21lc3NhZ2VfdGltZW91dBgGIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbhIaChJmYWlsdXJlX21vZGVfYWxsb3cYByABKAgSGgoSbWF4X2J1ZmZlcmVkX2J5dGVzGAggASgNIv8EChVFeHRQcm9jUHJvY2Vzc2luZ01vZGUSSwoTcmVxdWVzdF9oZWFkZXJfbW9kZRgBIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJMChRyZXNwb25zZV9oZWFkZXJfbW9kZRgCIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJHChFyZXF1ZXN0X2JvZHlfbW9kZRgDIAEoDjIsLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuQm9keU1vZGUSSAoScmVzcG9uc2VfYm9keV9tb2RlGAQgASgOMiwuYWdlbnRtZXNoLnYxLkV4dFByb2NQcm9jZXNzaW5nTW9kZS5Cb2R5TW9kZRJMChRyZXF1ZXN0X3RyYWlsZXJfbW9kZRgFIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJNChVyZXNwb25zZV90cmFpbGVyX21vZGUYBiABKA4yLi5hZ2VudG1lc2gudjEuRXh0UHJvY1Byb2Nlc3NpbmdNb2RlLkhlYWRlck1vZGUiOQoKSGVhZGVyTW9kZRIXChNIRUFERVJfTU9ERV9ERUZBVUxUEAASCAoEU0VORBABEggKBFNLSVAQAiJgCghCb2R5TW9kZRIICgROT05FEAASDAoIU1RSRUFNRUQQARIMCghCVUZGRVJFRBACEhQKEEJVRkZFUkVEX1BBUlRJQUwQAxIYChRGVUxMX0RVUExFWF9TVFJFQU1FRBAEIuEBChBDcmVkZW50aWFsQnJva2VyEhcKDXN0YXRpY19zZWNyZXQYASABKAlIABI3Cg9vaWRjX2ZlZGVyYXRpb24YAiABKAsyHC5hZ2VudG1lc2gudjEuT0lEQ0ZlZGVyYXRpb25IABI2Cg9hd3NfYXNzdW1lX3JvbGUYAyABKAsyGy5hZ2VudG1lc2gudjEuQVdTQXNzdW1lUm9sZUgAEjsKEXBsYXRmb3JtX2lkZW50aXR5GAQgASgLMh4uYWdlbnRtZXNoLnYxLlBsYXRmb3JtSWRlbnRpdHlIAEIGCgRraW5kIl8KDk9JRENGZWRlcmF0aW9uEhYKDnRva2VuX2VuZHBvaW50GAEgASgJEhAKCGF1ZGllbmNlGAIgASgJEhMKC2ltcGVyc29uYXRlGAMgASgJEg4KBnNjb3BlcxgEIAMoCSI5Cg1BV1NBc3N1bWVSb2xlEhAKCHJvbGVfYXJuGAEgASgJEhYKDnNlc3Npb25fcG9saWN5GAIgASgJIiIKEFBsYXRmb3JtSWRlbnRpdHkSDgoGc2NvcGVzGAEgAygJIi4KDVBvbGljeUJpbmRpbmcSDAoEcm9sZRgBIAEoCRIPCgdtZW1iZXJzGAIgAygJIpcBCgxQb2xpY3lDb25maWcSJwoFcm9sZXMYASADKAsyGC5hZ2VudG1lc2gudjEuUG9saWN5Um9sZRItCghiaW5kaW5ncxgCIAMoCzIbLmFnZW50bWVzaC52MS5Qb2xpY3lCaW5kaW5nEi8KBmVncmVzcxgDIAMoCzIfLmFnZW50bWVzaC52MS5FZ3Jlc3NEZXN0aW5hdGlvbiIYChZQb2xpY3lDb25maWdHZXRSZXF1ZXN0IjAKF1BvbGljeUNvbmZpZ0dldFJlc3BvbnNlEhUKDWRhdGFsb2dfcnVsZXMYASADKAkiPAoaUG9saWN5Q29uZmlnVXBkYXRlUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCBINCgVlcnJvchgCIAEoCSIaChhFZ3Jlc3NBc3NpZ25tZW50c1JlcXVlc3QiTAoZRWdyZXNzQXNzaWdubWVudHNSZXNwb25zZRIvCgZlZ3Jlc3MYASADKAsyHy5hZ2VudG1lc2gudjEuRWdyZXNzRGVzdGluYXRpb24iZgoMS2V5c1Jlc3BvbnNlEhMKC3B1YmxpY19rZXlzGAEgAygMEi0KCXNpZ25fdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASEgoKc2lnbmF0dXJlcxgDIAMoDCJrChNUb2tlblJlZnJlc2hSZXF1ZXN0EhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYASABKAwSGQoRY2hhbGxlbmdlX3VuaXhfbXMYAiABKAMSDwoHcGVlcl9pZBgDIAEoCRILCgNqd3QYBCABKAkidQoUVG9rZW5SZWZyZXNoUmVzcG9uc2USFQoNYmlzY3VpdF90b2tlbhgBIAEoDBIvCgtleHBpcmVfdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASFQoNZXJyb3JfbWVzc2FnZRgDIAEoCSJAChFOb2RlQ2F0YWxvZ1JlcG9ydBIrCghzZXJ2aWNlcxgBIAMoCzIZLmFnZW50bWVzaC52MS5TZXJ2aWNlSW5mbyIlChJUb2tlblJldm9rZVJlcXVlc3QSDwoHcGVlcl9pZBgBIAEoCSI1ChNUb2tlblJldm9rZVJlc3BvbnNlEg8KB3N1Y2Nlc3MYASABKAgSDQoFZXJyb3IYAiABKAkilgEKG0Jvb3RzdHJhcFRva2VuQ3JlYXRlUmVxdWVzdBIMCgRyb2xlGAEgASgJEhAKCG93bmVyX2lkGAIgASgJEhEKCXR0bF9ob3VycxgDIAEoBRISCgptYXhfdXNhZ2VzGAQgASgFEhMKC2Rlc2NyaXB0aW9uGAUgASgJEhsKE2F1dG9ub21vdXNfcmVjb3ZlcnkYBiABKAgiigEKHEJvb3RzdHJhcFRva2VuQ3JlYXRlUmVzcG9uc2USCgoCaWQYASABKAkSDQoFdG9rZW4YAiABKAkSDAoEcm9sZRgDIAEoCRIQCghvd25lcl9pZBgEIAEoCRIvCgtleHBpcmVfdGltZRgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiqwIKDkJvb3RzdHJhcFRva2VuEgoKAmlkGAEgASgJEgwKBHJvbGUYAiABKAkSEAoIb3duZXJfaWQYAyABKAkSEgoKbWF4X3VzYWdlcxgEIAEoBRIUCgx1c2FnZXNfY291bnQYBSABKAUSEwoLZGVzY3JpcHRpb24YBiABKAkSLwoLY3JlYXRlX3RpbWUYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi8KC2V4cGlyZV90aW1lGAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIvCgtyZXZva2VfdGltZRgJIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGwoTYXV0b25vbW91c19yZWNvdmVyeRgKIAEoCCJKChpCb290c3RyYXBUb2tlbkxpc3RSZXNwb25zZRIsCgZ0b2tlbnMYASADKAsyHC5hZ2VudG1lc2gudjEuQm9vdHN0cmFwVG9rZW4i1gIKEUVucm9sbG1lbnRSZXF1ZXN0EgoKAmlkGAEgASgJEg8KB3BlZXJfaWQYAiABKAkSEAoIdG9rZW5faWQYAyABKAkSLgoGc3RhdHVzGAQgASgOMh4uYWdlbnRtZXNoLnYxLkVucm9sbG1lbnRTdGF0dXMSOwoGbGFiZWxzGAUgAygLMisuYWdlbnRtZXNoLnYxLkVucm9sbG1lbnRSZXF1ZXN0LkxhYmVsc0VudHJ5Ei8KC2NyZWF0ZV90aW1lGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIwCgxyZXNvbHZlX3RpbWUYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhMKC3Jlc29sdmVkX2J5GAggASgJGi0KC0xhYmVsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiUgodRW5yb2xsbWVudFJlcXVlc3RMaXN0UmVzcG9uc2USMQoIcmVxdWVzdHMYASADKAsyHy5hZ2VudG1lc2gudjEuRW5yb2xsbWVudFJlcXVlc3QicAoEVXNlchIKCgJpZBgBIAEoCRIOCgZpc3N1ZXIYAiABKAkSDQoFZW1haWwYAyABKAkSDAoEcm9sZRgEIAEoCRIvCgtjcmVhdGVfdGltZRgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAi4wIKDEVucm9sbGVkTm9kZRIPCgdwZWVyX2lkGAEgASgJEgwKBHJvbGUYAiABKAkSFwoPZW5yb2xsbWVudF90eXBlGAMgASgJEhMKC2NsYWltc19qc29uGAQgASgJEhAKCG93bmVyX2lkGAUgASgJEjYKBmxhYmVscxgGIAMoCzImLmFnZW50bWVzaC52MS5FbnJvbGxlZE5vZGUuTGFiZWxzRW50cnkSLwoLZW5yb2xsX3RpbWUYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi8KC2V4cGlyZV90aW1lGAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIOCgZiYW5uZWQYCSABKAgSGwoTYXV0b25vbW91c19yZWNvdmVyeRgKIAEoCBotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIsQBCgtSb3V0ZXJMZWFzZRIPCgdwZWVyX2lkGAEgASgJEhEKCWFkZHJlc3NlcxgCIAMoCRI1ChFsYXN0X3JlbmV3YWxfdGltZRgDIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLwoLZXhwaXJlX3RpbWUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhcKD2Nvbm5lY3RlZF9wZWVycxgFIAMoCRIQCghkaHRfc2l6ZRgGIAEoBSJsCgxOb2RlU2VydmljZXMSKwoIc2VydmljZXMYASADKAsyGS5hZ2VudG1lc2gudjEuU2VydmljZUluZm8SLwoLcmVwb3J0X3RpbWUYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wItsDChNBZG1pblN0YXR1c1Jlc3BvbnNlEiEKBXVzZXJzGAEgAygLMhIuYWdlbnRtZXNoLnYxLlVzZXISMQoOYWN0aXZlX3JvdXRlcnMYAiADKAsyGS5hZ2VudG1lc2gudjEuUm91dGVyTGVhc2USMgoOZW5yb2xsZWRfbm9kZXMYAyADKAsyGi5hZ2VudG1lc2gudjEuRW5yb2xsZWROb2RlEjwKE2Vucm9sbG1lbnRfcmVxdWVzdHMYBCADKAsyHy5hZ2VudG1lc2gudjEuRW5yb2xsbWVudFJlcXVlc3QSNgoQYm9vdHN0cmFwX3Rva2VucxgFIAMoCzIcLmFnZW50bWVzaC52MS5Cb290c3RyYXBUb2tlbhIqCgZwb2xpY3kYBiABKAsyGi5hZ2VudG1lc2gudjEuUG9saWN5Q29uZmlnEkgKDG5vZGVfY2F0YWxvZxgHIAMoCzIyLmFnZW50bWVzaC52MS5BZG1pblN0YXR1c1Jlc3BvbnNlLk5vZGVDYXRhbG9nRW50cnkaTgoQTm9kZUNhdGFsb2dFbnRyeRILCgNrZXkYASABKAkSKQoFdmFsdWUYAiABKAsyGi5hZ2VudG1lc2gudjEuTm9kZVNlcnZpY2VzOgI4ASKBAgoSVXNlclN0YXR1c1Jlc3BvbnNlEiAKBHVzZXIYASABKAsyEi5hZ2VudG1lc2gudjEuVXNlchIyCg5lbnJvbGxlZF9ub2RlcxgCIAMoCzIaLmFnZW50bWVzaC52MS5FbnJvbGxlZE5vZGUSNgoQYm9vdHN0cmFwX3Rva2VucxgDIAMoCzIcLmFnZW50bWVzaC52MS5Cb290c3RyYXBUb2tlbhIxCg5hY3RpdmVfcm91dGVycxgEIAMoCzIZLmFnZW50bWVzaC52MS5Sb3V0ZXJMZWFzZRIqCgZwb2xpY3kYBSABKAsyGi5hZ2VudG1lc2gudjEuUG9saWN5Q29uZmlnIlYKEE5vZGVMaXN0UmVzcG9uc2USKQoFbm9kZXMYASADKAsyGi5hZ2VudG1lc2gudjEuRW5yb2xsZWROb2RlEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCSLkAQoYSWRlbnRpdHlFdmlkZW5jZVJlc3BvbnNlEg8KB3BlZXJfaWQYASABKAkSDwoHYmlzY3VpdBgCIAEoDBI3ChNiaXNjdWl0X2V4cGlyZV90aW1lGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIZChFjb250cm9sX3BsYW5lX3VybBgEIAEoCRIiChp0cnVzdGVkX2NvbnRyb2xfcGxhbmVfa2V5cxgFIAMoDBIuCgpjaGVja190aW1lGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCLGAgoUUGVlckV2aWRlbmNlUmVzcG9uc2USDwoHcGVlcl9pZBgBIAEoCRIPCgdiaXNjdWl0GAIgASgMEhUKDXZlcmlmeWluZ19rZXkYAyABKAwSDQoFcm9sZXMYBCADKAkSPgoGbGFiZWxzGAUgAygLMi4uYWdlbnRtZXNoLnYxLlBlZXJFdmlkZW5jZVJlc3BvbnNlLkxhYmVsc0VudHJ5Ei8KC2V4cGlyZV90aW1lGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIWCg5yZXZvY2F0aW9uX2lkcxgHIAMoCRIuCgpjaGVja190aW1lGAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIowCChBNZW1iZXJDcmVkZW50aWFsEhkKEWNvbnRyb2xfcGxhbmVfdXJsGAEgASgJEg8KB2Jpc2N1aXQYAiABKAwSLwoLZXhwaXJlX3RpbWUYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjUKDHRydXN0ZWRfa2V5cxgEIAMoCzIfLmFnZW50bWVzaC52MS5UcnVzdGVkU2lnbmluZ0tleRIZChFpc3N1ZWRfdW5kZXJfa2V5cxgFIAMoDBIYChByb3V0ZXJfYWRkcmVzc2VzGAYgAygJEi8KDG9pZGNfc2Vzc2lvbhgHIAEoCzIZLmFnZW50bWVzaC52MS5PSURDU2Vzc2lvbiJZChFUcnVzdGVkU2lnbmluZ0tleRISCgpwdWJsaWNfa2V5GAEgASgMEjAKDHJlY2VpdmVfdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiWQoLT0lEQ1Nlc3Npb24SDgoGaXNzdWVyGAEgASgJEhEKCWNsaWVudF9pZBgCIAEoCRIQCghhdWRpZW5jZRgDIAEoCRIVCg1yZWZyZXNoX3Rva2VuGAQgASgJIpMBChVUYXNrQXV0aG9yaXphdGlvblJ1bGUSDAoEbmFtZRgBIAEoCRIUCgxkaXNwbGF5X25hbWUYAiABKAkSJQoFcnVsZXMYAyADKAsyFi5hZ2VudG1lc2gudjEuVGFza1J1bGUSLwoLZXhwaXJlX3RpbWUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIoQBCghUYXNrUnVsZRITCgtkZXNjcmlwdGlvbhgBIAEoCRIYChBhbGxvd2VkX3NlcnZpY2VzGAIgAygJEi4KCW9wZXJhdGlvbhgDIAEoCzIbLmFnZW50bWVzaC52MS5UYXNrT3BlcmF0aW9uEhkKEWFsbG93ZWRfcmVzb3VyY2VzGAQgAygJInMKDVRhc2tPcGVyYXRpb24SFQoNYWxsb3dlZF90b29scxgBIAMoCRIXCg9hbGxvd2VkX21ldGhvZHMYAiADKAkSFQoNYWxsb3dlZF9wYXRocxgDIAMoCRIbChNhbGxvd2VkX3Blcm1pc3Npb25zGAQgAygJIqsBChRUb2tlbkV4Y2hhbmdlUmVxdWVzdBIVCg1zdWJqZWN0X3Rva2VuGAEgASgJEjYKCXRhc2tfcnVsZRgCIAEoCzIjLmFnZW50bWVzaC52MS5UYXNrQXV0aG9yaXphdGlvblJ1bGUSDAoEc2VhbBgDIAEoCBIZChFjaGFsbGVuZ2VfdW5peF9tcxgEIAEoAxIbChNjaGFsbGVuZ2Vfc2lnbmF0dXJlGAUgASgMIn8KFVRva2VuRXhjaGFuZ2VSZXNwb25zZRIVCg1iaXNjdWl0X3Rva2VuGAEgASgMEi8KC2V4cGlyZV90aW1lGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBINCgVyb2xlcxgDIAMoCRIPCgdzdWJqZWN0GAQgASgJIoEBCg9TVFNUb2tlblJlcXVlc3QSDwoHYmlzY3VpdBgBIAEoDBITCgtkZXN0aW5hdGlvbhgCIAEoCRIQCghhdWRpZW5jZRgDIAEoCRIZChFjaGFsbGVuZ2VfdW5peF9tcxgEIAEoAxIbChNjaGFsbGVuZ2Vfc2lnbmF0dXJlGAUgASgMIoMBChBTVFNUb2tlblJlc3BvbnNlEgsKA2p3dBgBIAEoCRIvCgtleHBpcmVfdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASDwoHc3ViamVjdBgDIAEoCRINCgVyb2xlcxgEIAMoCRIRCgl0YXNrX25hbWUYBSABKAkiRgoTUmV2b2NhdGlvbnNSZXNwb25zZRIWCg5yZXZvY2F0aW9uX2lkcxgBIAMoCRIXCg9iYW5uZWRfcGVlcl9pZHMYAiADKAkqlAEKEEVucm9sbG1lbnRTdGF0dXMSIQodRU5ST0xMTUVOVF9TVEFUVVNfVU5TUEVDSUZJRUQQABIdChlFTlJPTExNRU5UX1NUQVRVU19QRU5ESU5HEAESHgoaRU5ST0xMTUVOVF9TVEFUVVNfQVBQUk9WRUQQAhIeChpFTlJPTExNRU5UX1NUQVRVU19SRUpFQ1RFRBADKowBCgtTZXJ2aWNlVHlwZRIcChhTRVJWSUNFX1RZUEVfVU5TUEVDSUZJRUQQABIUChBTRVJWSUNFX1RZUEVfTUNQEAESGgoWU0VSVklDRV9UWVBFX0lORkVSRU5DRRACEhQKEFNFUlZJQ0VfVFlQRV9BMkEQAxIXChNTRVJWSUNFX1RZUEVfRUdSRVNTEAQqNwoKRWdyZXNzTW9kZRIUChBFR1JFU1NfTU9ERV9IVFRQEAASEwoPRUdSRVNTX01PREVfVENQEAEqXAoSUmVzcG9uc2VJbnNwZWN0aW9uEiAKHFJFU1BPTlNFX0lOU1BFQ1RJT05fQlVGRkVSRUQQABIkCiBSRVNQT05TRV9JTlNQRUNUSU9OX1JFUVVFU1RfT05MWRABQiFaH2dpdGh1Yi5jb20vZ29vZ2xlL2FnZW50bWVzaC9hcGliBnByb3RvMw", [file_google_protobuf_duration, file_google_protobuf_timestamp]);
+  fileDesc("Cg9hZ2VudG1lc2gucHJvdG8SDGFnZW50bWVzaC52MSI0CglBdXRoRnJhbWUSDwoHYmlzY3VpdBgBIAEoDBIWCg50YXJnZXRfc2VydmljZRgCIAEoCSI/CgxBdXRoUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCBINCgVlcnJvchgCIAEoCRIPCgdiaXNjdWl0GAMgASgMIrEBCgxSb3V0ZXJHb0F3YXkSMQoGcmVhc29uGAEgASgOMiEuYWdlbnRtZXNoLnYxLlJvdXRlckdvQXdheS5SZWFzb24SLgoLcmV0cnlfYWZ0ZXIYAiABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb24iPgoGUmVhc29uEhYKElJFQVNPTl9VTlNQRUNJRklFRBAAEgwKCERSQUlOSU5HEAESDgoKT1ZFUkxPQURFRBACItwBCglNZXNoRXZlbnQSKgoEdHlwZRgBIAEoDjIcLmFnZW50bWVzaC52MS5NZXNoRXZlbnQuVHlwZRIPCgdwZWVyX2lkGAIgASgJEi4KCmV2ZW50X3RpbWUYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhYKDm5ld19wdWJsaWNfa2V5GAQgASgMEhEKCXNpZ25hdHVyZRgFIAEoDCI3CgRUeXBlEgoKBkJBTk5FRBAAEhAKDEtFWV9ST1RBVElPThABEhEKDVBPTElDWV9VUERBVEUQAiL5AQoNRW5yb2xsUmVxdWVzdBILCgNqd3QYASABKAkSDwoHcGVlcl9pZBgCIAEoCRISCgpwdWJsaWNfa2V5GAMgASgMEhYKDnJlcXVlc3RlZF9yb2xlGAQgASgJEjcKBmxhYmVscxgFIAMoCzInLmFnZW50bWVzaC52MS5FbnJvbGxSZXF1ZXN0LkxhYmVsc0VudHJ5EhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKrAQoORW5yb2xsUmVzcG9uc2USFQoNYmlzY3VpdF90b2tlbhgBIAEoDBIVCg1lcnJvcl9tZXNzYWdlGAIgASgJEiAKGGNvbnRyb2xfcGxhbmVfcHVibGljX2tleRgDIAEoDBIYChByb3V0ZXJfYWRkcmVzc2VzGAQgAygJEi8KC2V4cGlyZV90aW1lGAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCKXAgoWQm9vdHN0cmFwRW5yb2xsUmVxdWVzdBIXCg9ib290c3RyYXBfdG9rZW4YASABKAkSDwoHcGVlcl9pZBgCIAEoCRISCgpwdWJsaWNfa2V5GAMgASgMEhYKDnJlcXVlc3RlZF9yb2xlGAQgASgJEkAKBmxhYmVscxgFIAMoCzIwLmFnZW50bWVzaC52MS5Cb290c3RyYXBFbnJvbGxSZXF1ZXN0LkxhYmVsc0VudHJ5EhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKDAgoXQm9vdHN0cmFwRW5yb2xsUmVzcG9uc2USLgoGc3RhdHVzGAEgASgOMh4uYWdlbnRtZXNoLnYxLkVucm9sbG1lbnRTdGF0dXMSFQoNYmlzY3VpdF90b2tlbhgCIAEoDBIdChVwb2xsX2ludGVydmFsX3NlY29uZHMYAyABKAUSFQoNZXJyb3JfbWVzc2FnZRgEIAEoCRIgChhjb250cm9sX3BsYW5lX3B1YmxpY19rZXkYBSABKAwSGAoQcm91dGVyX2FkZHJlc3NlcxgGIAMoCRIvCgtleHBpcmVfdGltZRgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiWQoLU2VydmljZUluZm8SJwoEdHlwZRgBIAEoDjIZLmFnZW50bWVzaC52MS5TZXJ2aWNlVHlwZRIMCgRuYW1lGAIgASgJEhMKC2Rlc2NyaXB0aW9uGAMgASgJIoEBCg5Db21tYW5kQmFja2VuZBIPCgdjb21tYW5kGAEgAygJEjIKA2VudhgCIAMoCzIlLmFnZW50bWVzaC52MS5Db21tYW5kQmFja2VuZC5FbnZFbnRyeRoqCghFbnZFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIpYBChZSZWdpc3RlclNlcnZpY2VSZXF1ZXN0EioKB3NlcnZpY2UYASABKAsyGS5hZ2VudG1lc2gudjEuU2VydmljZUluZm8SFAoKdGFyZ2V0X3VybBgCIAEoCUgAEi8KB2NvbW1hbmQYAyABKAsyHC5hZ2VudG1lc2gudjEuQ29tbWFuZEJhY2tlbmRIAEIJCgdiYWNrZW5kImkKEkRpc2NvdmVyZWRQcm92aWRlchIPCgdwZWVyX2lkGAEgASgJEhcKD2xvY2FsX3Byb3h5X3VybBgCIAEoCRIQCghzcnZfbmFtZRgDIAEoCRIXCg9zcnZfZGVzY3JpcHRpb24YBCABKAki6AEKGENvbnRyb2xQbGFuZUluZm9SZXNwb25zZRITCgtvaWRjX2lzc3VlchgBIAEoCRIRCgljbGllbnRfaWQYAiABKAkSEAoIYXVkaWVuY2UYAyABKAkSGAoQcm91dGVyX2FkZHJlc3NlcxgEIAMoCRIXCg9iYW5uZWRfcGVlcl9pZHMYBSADKAkSKQoHcm91dGVycxgGIAMoCzIYLmFnZW50bWVzaC52MS5Sb3V0ZXJJbmZvEjQKCWRpcmVjdG9yeRgHIAEoCzIhLmFnZW50bWVzaC52MS5EaXJlY3RvcnlQYXJhbWV0ZXJzIpABChNEaXJlY3RvcnlQYXJhbWV0ZXJzEhMKC3JlcGxpY2F0aW9uGAEgASgFEjUKEnJlcHJvdmlkZV9pbnRlcnZhbBgCIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbhItCgpyZWNvcmRfdHRsGAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uIvsBChBEaXJlY3RvcnlSZXF1ZXN0EjEKB3Byb3ZpZGUYASABKAsyHi5hZ2VudG1lc2gudjEuRGlyZWN0b3J5UHJvdmlkZUgAEj4KDmZpbmRfcHJvdmlkZXJzGAIgASgLMiQuYWdlbnRtZXNoLnYxLkRpcmVjdG9yeUZpbmRQcm92aWRlcnNIABI0CglmaW5kX3BlZXIYAyABKAsyHy5hZ2VudG1lc2gudjEuRGlyZWN0b3J5RmluZFBlZXJIABIzCgh3aXRoZHJhdxgEIAEoCzIfLmFnZW50bWVzaC52MS5EaXJlY3RvcnlXaXRoZHJhd0gAQgkKB3JlcXVlc3QiUQoQRGlyZWN0b3J5UHJvdmlkZRILCgNrZXkYASABKAwSDQoFYWRkcnMYAiADKAkSEAoIcHJvdmlkZXIYAyABKAkSDwoHc2VydmljZRgEIAEoCSIyChFEaXJlY3RvcnlXaXRoZHJhdxILCgNrZXkYASABKAwSEAoIcHJvdmlkZXIYAiABKAkiNAoWRGlyZWN0b3J5RmluZFByb3ZpZGVycxILCgNrZXkYASABKAwSDQoFbGltaXQYAiABKA0iJAoRRGlyZWN0b3J5RmluZFBlZXISDwoHcGVlcl9pZBgBIAEoCSJ3ChFEaXJlY3RvcnlSZXNwb25zZRIrCglwcm92aWRlcnMYASADKAsyGC5hZ2VudG1lc2gudjEuUGVlclJlY29yZBImCgRwZWVyGAIgASgLMhguYWdlbnRtZXNoLnYxLlBlZXJSZWNvcmQSDQoFZXJyb3IYAyABKAkiLAoKUGVlclJlY29yZBIPCgdwZWVyX2lkGAEgASgJEg0KBWFkZHJzGAIgAygJIsQBCgpSb3V0ZXJJbmZvEg8KB3BlZXJfaWQYASABKAkSEQoJYWRkcmVzc2VzGAIgAygJEjQKBmxhYmVscxgDIAMoCzIkLmFnZW50bWVzaC52MS5Sb3V0ZXJJbmZvLkxhYmVsc0VudHJ5EhMKC2Nvbm5lY3Rpb25zGAQgASgFEhgKEGNvbm5lY3Rpb25fbGltaXQYBSABKAUaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKDAgoSUm91dGVyTGVhc2VSZXF1ZXN0Eg8KB3BlZXJfaWQYASABKAkSEQoJYWRkcmVzc2VzGAIgAygJEg8KB2Jpc2N1aXQYAyABKAwSFwoPY29ubmVjdGVkX3BlZXJzGAQgAygJEhAKCGRodF9zaXplGAUgASgFEhkKEWNoYWxsZW5nZV91bml4X21zGAYgASgDEhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYByABKAwSJgoDdHRsGAggASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uEhMKC2Nvbm5lY3Rpb25zGAkgASgFEhgKEGNvbm5lY3Rpb25fbGltaXQYCiABKAUiZgoTUm91dGVyTGVhc2VSZXNwb25zZRIPCgdzdWNjZXNzGAEgASgIEg0KBWVycm9yGAIgASgJEi8KC2V4cGlyZV90aW1lGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCK9AQoKUG9saWN5Um9sZRIMCgRuYW1lGAEgASgJEhcKD2FsbG93ZWRfdGFyZ2V0cxgCIAMoCRIYChBhbGxvd2VkX3NlcnZpY2VzGAMgAygJEhYKDmN1c3RvbV9kYXRhbG9nGAQgAygJEhYKDmFsbG93ZWRfbGFiZWxzGAUgAygJEiUKBGh0dHAYBiADKAsyFy5hZ2VudG1lc2gudjEuSFRUUEdyYW50EhcKD2FsbG93ZWRfcHVibGlzaBgHIAMoCSI8CglIVFRQR3JhbnQSDwoHc2VydmljZRgBIAEoCRIPCgdtZXRob2RzGAIgAygJEg0KBXBhdGhzGAMgAygJIqECChFFZ3Jlc3NEZXN0aW5hdGlvbhIMCgRuYW1lGAEgASgJEhIKCnRhcmdldF91cmwYAiABKAkSEgoKY3JlZGVudGlhbBgDIAEoCRIRCglzZXJ2ZWRfYnkYBCADKAkSLgoGYnJva2VyGAUgASgLMh4uYWdlbnRtZXNoLnYxLkNyZWRlbnRpYWxCcm9rZXISLAoKaW5zcGVjdGlvbhgGIAEoCzIYLmFnZW50bWVzaC52MS5JbnNwZWN0aW9uEiYKBG1vZGUYByABKA4yGC5hZ2VudG1lc2gudjEuRWdyZXNzTW9kZRINCgVwb3J0cxgIIAMoDRIVCg1wcmVzZXJ2ZV9ob3N0GAkgASgIEhcKD2ZvcndhcmRfY29udGV4dBgKIAEoCCI5CgpJbnNwZWN0aW9uEisKCmluc3BlY3RvcnMYASADKAsyFy5hZ2VudG1lc2gudjEuSW5zcGVjdG9yIm8KCUluc3BlY3RvchIvCgttb2RlbF9hcm1vchgBIAEoCzIYLmFnZW50bWVzaC52MS5Nb2RlbEFybW9ySAASKQoIZXh0X3Byb2MYAiABKAsyFS5hZ2VudG1lc2gudjEuRXh0UHJvY0gAQgYKBGtpbmQikQEKCk1vZGVsQXJtb3ISEAoIdGVtcGxhdGUYASABKAkSMgoIcmVzcG9uc2UYAiABKA4yIC5hZ2VudG1lc2gudjEuUmVzcG9uc2VJbnNwZWN0aW9uEhEKCWZhaWxfb3BlbhgDIAEoCBIqCgd0aW1lb3V0GAQgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uIogCCgdFeHRQcm9jEg4KBnRhcmdldBgBIAEoCRIKCgJjYRgCIAEoCRIaChJjbGllbnRfY2VydGlmaWNhdGUYAyABKAkSPAoPcHJvY2Vzc2luZ19tb2RlGAQgASgLMiMuYWdlbnRtZXNoLnYxLkV4dFByb2NQcm9jZXNzaW5nTW9kZRIbChNhbGxvd19tb2RlX292ZXJyaWRlGAUgASgIEjIKD21lc3NhZ2VfdGltZW91dBgGIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbhIaChJmYWlsdXJlX21vZGVfYWxsb3cYByABKAgSGgoSbWF4X2J1ZmZlcmVkX2J5dGVzGAggASgNIv8EChVFeHRQcm9jUHJvY2Vzc2luZ01vZGUSSwoTcmVxdWVzdF9oZWFkZXJfbW9kZRgBIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJMChRyZXNwb25zZV9oZWFkZXJfbW9kZRgCIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJHChFyZXF1ZXN0X2JvZHlfbW9kZRgDIAEoDjIsLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuQm9keU1vZGUSSAoScmVzcG9uc2VfYm9keV9tb2RlGAQgASgOMiwuYWdlbnRtZXNoLnYxLkV4dFByb2NQcm9jZXNzaW5nTW9kZS5Cb2R5TW9kZRJMChRyZXF1ZXN0X3RyYWlsZXJfbW9kZRgFIAEoDjIuLmFnZW50bWVzaC52MS5FeHRQcm9jUHJvY2Vzc2luZ01vZGUuSGVhZGVyTW9kZRJNChVyZXNwb25zZV90cmFpbGVyX21vZGUYBiABKA4yLi5hZ2VudG1lc2gudjEuRXh0UHJvY1Byb2Nlc3NpbmdNb2RlLkhlYWRlck1vZGUiOQoKSGVhZGVyTW9kZRIXChNIRUFERVJfTU9ERV9ERUZBVUxUEAASCAoEU0VORBABEggKBFNLSVAQAiJgCghCb2R5TW9kZRIICgROT05FEAASDAoIU1RSRUFNRUQQARIMCghCVUZGRVJFRBACEhQKEEJVRkZFUkVEX1BBUlRJQUwQAxIYChRGVUxMX0RVUExFWF9TVFJFQU1FRBAEIuEBChBDcmVkZW50aWFsQnJva2VyEhcKDXN0YXRpY19zZWNyZXQYASABKAlIABI3Cg9vaWRjX2ZlZGVyYXRpb24YAiABKAsyHC5hZ2VudG1lc2gudjEuT0lEQ0ZlZGVyYXRpb25IABI2Cg9hd3NfYXNzdW1lX3JvbGUYAyABKAsyGy5hZ2VudG1lc2gudjEuQVdTQXNzdW1lUm9sZUgAEjsKEXBsYXRmb3JtX2lkZW50aXR5GAQgASgLMh4uYWdlbnRtZXNoLnYxLlBsYXRmb3JtSWRlbnRpdHlIAEIGCgRraW5kIl8KDk9JRENGZWRlcmF0aW9uEhYKDnRva2VuX2VuZHBvaW50GAEgASgJEhAKCGF1ZGllbmNlGAIgASgJEhMKC2ltcGVyc29uYXRlGAMgASgJEg4KBnNjb3BlcxgEIAMoCSI5Cg1BV1NBc3N1bWVSb2xlEhAKCHJvbGVfYXJuGAEgASgJEhYKDnNlc3Npb25fcG9saWN5GAIgASgJIiIKEFBsYXRmb3JtSWRlbnRpdHkSDgoGc2NvcGVzGAEgAygJIi4KDVBvbGljeUJpbmRpbmcSDAoEcm9sZRgBIAEoCRIPCgdtZW1iZXJzGAIgAygJIpcBCgxQb2xpY3lDb25maWcSJwoFcm9sZXMYASADKAsyGC5hZ2VudG1lc2gudjEuUG9saWN5Um9sZRItCghiaW5kaW5ncxgCIAMoCzIbLmFnZW50bWVzaC52MS5Qb2xpY3lCaW5kaW5nEi8KBmVncmVzcxgDIAMoCzIfLmFnZW50bWVzaC52MS5FZ3Jlc3NEZXN0aW5hdGlvbiIYChZQb2xpY3lDb25maWdHZXRSZXF1ZXN0IjAKF1BvbGljeUNvbmZpZ0dldFJlc3BvbnNlEhUKDWRhdGFsb2dfcnVsZXMYASADKAkiPAoaUG9saWN5Q29uZmlnVXBkYXRlUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCBINCgVlcnJvchgCIAEoCSIaChhFZ3Jlc3NBc3NpZ25tZW50c1JlcXVlc3QiTAoZRWdyZXNzQXNzaWdubWVudHNSZXNwb25zZRIvCgZlZ3Jlc3MYASADKAsyHy5hZ2VudG1lc2gudjEuRWdyZXNzRGVzdGluYXRpb24iZgoMS2V5c1Jlc3BvbnNlEhMKC3B1YmxpY19rZXlzGAEgAygMEi0KCXNpZ25fdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASEgoKc2lnbmF0dXJlcxgDIAMoDCJrChNUb2tlblJlZnJlc2hSZXF1ZXN0EhsKE2NoYWxsZW5nZV9zaWduYXR1cmUYASABKAwSGQoRY2hhbGxlbmdlX3VuaXhfbXMYAiABKAMSDwoHcGVlcl9pZBgDIAEoCRILCgNqd3QYBCABKAkidQoUVG9rZW5SZWZyZXNoUmVzcG9uc2USFQoNYmlzY3VpdF90b2tlbhgBIAEoDBIvCgtleHBpcmVfdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASFQoNZXJyb3JfbWVzc2FnZRgDIAEoCSJAChFOb2RlQ2F0YWxvZ1JlcG9ydBIrCghzZXJ2aWNlcxgBIAMoCzIZLmFnZW50bWVzaC52MS5TZXJ2aWNlSW5mbyIlChJUb2tlblJldm9rZVJlcXVlc3QSDwoHcGVlcl9pZBgBIAEoCSI1ChNUb2tlblJldm9rZVJlc3BvbnNlEg8KB3N1Y2Nlc3MYASABKAgSDQoFZXJyb3IYAiABKAkiqQEKG0Jvb3RzdHJhcFRva2VuQ3JlYXRlUmVxdWVzdBIMCgRyb2xlGAEgASgJEhAKCG93bmVyX2lkGAIgASgJEhEKCXR0bF9ob3VycxgDIAEoBRISCgptYXhfdXNhZ2VzGAQgASgFEhMKC2Rlc2NyaXB0aW9uGAUgASgJEhsKE2F1dG9ub21vdXNfcmVjb3ZlcnkYBiABKAgSEQoJZXBoZW1lcmFsGAcgASgIIooBChxCb290c3RyYXBUb2tlbkNyZWF0ZVJlc3BvbnNlEgoKAmlkGAEgASgJEg0KBXRva2VuGAIgASgJEgwKBHJvbGUYAyABKAkSEAoIb3duZXJfaWQYBCABKAkSLwoLZXhwaXJlX3RpbWUYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIr4CCg5Cb290c3RyYXBUb2tlbhIKCgJpZBgBIAEoCRIMCgRyb2xlGAIgASgJEhAKCG93bmVyX2lkGAMgASgJEhIKCm1heF91c2FnZXMYBCABKAUSFAoMdXNhZ2VzX2NvdW50GAUgASgFEhMKC2Rlc2NyaXB0aW9uGAYgASgJEi8KC2NyZWF0ZV90aW1lGAcgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIvCgtleHBpcmVfdGltZRgIIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLwoLcmV2b2tlX3RpbWUYCSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhsKE2F1dG9ub21vdXNfcmVjb3ZlcnkYCiABKAgSEQoJZXBoZW1lcmFsGAsgASgIIkoKGkJvb3RzdHJhcFRva2VuTGlzdFJlc3BvbnNlEiwKBnRva2VucxgBIAMoCzIcLmFnZW50bWVzaC52MS5Cb290c3RyYXBUb2tlbiLWAgoRRW5yb2xsbWVudFJlcXVlc3QSCgoCaWQYASABKAkSDwoHcGVlcl9pZBgCIAEoCRIQCgh0b2tlbl9pZBgDIAEoCRIuCgZzdGF0dXMYBCABKA4yHi5hZ2VudG1lc2gudjEuRW5yb2xsbWVudFN0YXR1cxI7CgZsYWJlbHMYBSADKAsyKy5hZ2VudG1lc2gudjEuRW5yb2xsbWVudFJlcXVlc3QuTGFiZWxzRW50cnkSLwoLY3JlYXRlX3RpbWUYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjAKDHJlc29sdmVfdGltZRgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASEwoLcmVzb2x2ZWRfYnkYCCABKAkaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASJSCh1FbnJvbGxtZW50UmVxdWVzdExpc3RSZXNwb25zZRIxCghyZXF1ZXN0cxgBIAMoCzIfLmFnZW50bWVzaC52MS5FbnJvbGxtZW50UmVxdWVzdCJwCgRVc2VyEgoKAmlkGAEgASgJEg4KBmlzc3VlchgCIAEoCRINCgVlbWFpbBgDIAEoCRIMCgRyb2xlGAQgASgJEi8KC2NyZWF0ZV90aW1lGAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCL2AgoMRW5yb2xsZWROb2RlEg8KB3BlZXJfaWQYASABKAkSDAoEcm9sZRgCIAEoCRIXCg9lbnJvbGxtZW50X3R5cGUYAyABKAkSEwoLY2xhaW1zX2pzb24YBCABKAkSEAoIb3duZXJfaWQYBSABKAkSNgoGbGFiZWxzGAYgAygLMiYuYWdlbnRtZXNoLnYxLkVucm9sbGVkTm9kZS5MYWJlbHNFbnRyeRIvCgtlbnJvbGxfdGltZRgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLwoLZXhwaXJlX3RpbWUYCCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEg4KBmJhbm5lZBgJIAEoCBIbChNhdXRvbm9tb3VzX3JlY292ZXJ5GAogASgIEhEKCWVwaGVtZXJhbBgLIAEoCBotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIsQBCgtSb3V0ZXJMZWFzZRIPCgdwZWVyX2lkGAEgASgJEhEKCWFkZHJlc3NlcxgCIAMoCRI1ChFsYXN0X3JlbmV3YWxfdGltZRgDIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLwoLZXhwaXJlX3RpbWUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhcKD2Nvbm5lY3RlZF9wZWVycxgFIAMoCRIQCghkaHRfc2l6ZRgGIAEoBSJsCgxOb2RlU2VydmljZXMSKwoIc2VydmljZXMYASADKAsyGS5hZ2VudG1lc2gudjEuU2VydmljZUluZm8SLwoLcmVwb3J0X3RpbWUYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wItsDChNBZG1pblN0YXR1c1Jlc3BvbnNlEiEKBXVzZXJzGAEgAygLMhIuYWdlbnRtZXNoLnYxLlVzZXISMQoOYWN0aXZlX3JvdXRlcnMYAiADKAsyGS5hZ2VudG1lc2gudjEuUm91dGVyTGVhc2USMgoOZW5yb2xsZWRfbm9kZXMYAyADKAsyGi5hZ2VudG1lc2gudjEuRW5yb2xsZWROb2RlEjwKE2Vucm9sbG1lbnRfcmVxdWVzdHMYBCADKAsyHy5hZ2VudG1lc2gudjEuRW5yb2xsbWVudFJlcXVlc3QSNgoQYm9vdHN0cmFwX3Rva2VucxgFIAMoCzIcLmFnZW50bWVzaC52MS5Cb290c3RyYXBUb2tlbhIqCgZwb2xpY3kYBiABKAsyGi5hZ2VudG1lc2gudjEuUG9saWN5Q29uZmlnEkgKDG5vZGVfY2F0YWxvZxgHIAMoCzIyLmFnZW50bWVzaC52MS5BZG1pblN0YXR1c1Jlc3BvbnNlLk5vZGVDYXRhbG9nRW50cnkaTgoQTm9kZUNhdGFsb2dFbnRyeRILCgNrZXkYASABKAkSKQoFdmFsdWUYAiABKAsyGi5hZ2VudG1lc2gudjEuTm9kZVNlcnZpY2VzOgI4ASKBAgoSVXNlclN0YXR1c1Jlc3BvbnNlEiAKBHVzZXIYASABKAsyEi5hZ2VudG1lc2gudjEuVXNlchIyCg5lbnJvbGxlZF9ub2RlcxgCIAMoCzIaLmFnZW50bWVzaC52MS5FbnJvbGxlZE5vZGUSNgoQYm9vdHN0cmFwX3Rva2VucxgDIAMoCzIcLmFnZW50bWVzaC52MS5Cb290c3RyYXBUb2tlbhIxCg5hY3RpdmVfcm91dGVycxgEIAMoCzIZLmFnZW50bWVzaC52MS5Sb3V0ZXJMZWFzZRIqCgZwb2xpY3kYBSABKAsyGi5hZ2VudG1lc2gudjEuUG9saWN5Q29uZmlnIlYKEE5vZGVMaXN0UmVzcG9uc2USKQoFbm9kZXMYASADKAsyGi5hZ2VudG1lc2gudjEuRW5yb2xsZWROb2RlEhcKD25leHRfcGFnZV90b2tlbhgCIAEoCSLkAQoYSWRlbnRpdHlFdmlkZW5jZVJlc3BvbnNlEg8KB3BlZXJfaWQYASABKAkSDwoHYmlzY3VpdBgCIAEoDBI3ChNiaXNjdWl0X2V4cGlyZV90aW1lGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIZChFjb250cm9sX3BsYW5lX3VybBgEIAEoCRIiChp0cnVzdGVkX2NvbnRyb2xfcGxhbmVfa2V5cxgFIAMoDBIuCgpjaGVja190aW1lGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCLGAgoUUGVlckV2aWRlbmNlUmVzcG9uc2USDwoHcGVlcl9pZBgBIAEoCRIPCgdiaXNjdWl0GAIgASgMEhUKDXZlcmlmeWluZ19rZXkYAyABKAwSDQoFcm9sZXMYBCADKAkSPgoGbGFiZWxzGAUgAygLMi4uYWdlbnRtZXNoLnYxLlBlZXJFdmlkZW5jZVJlc3BvbnNlLkxhYmVsc0VudHJ5Ei8KC2V4cGlyZV90aW1lGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIWCg5yZXZvY2F0aW9uX2lkcxgHIAMoCRIuCgpjaGVja190aW1lGAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIowCChBNZW1iZXJDcmVkZW50aWFsEhkKEWNvbnRyb2xfcGxhbmVfdXJsGAEgASgJEg8KB2Jpc2N1aXQYAiABKAwSLwoLZXhwaXJlX3RpbWUYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjUKDHRydXN0ZWRfa2V5cxgEIAMoCzIfLmFnZW50bWVzaC52MS5UcnVzdGVkU2lnbmluZ0tleRIZChFpc3N1ZWRfdW5kZXJfa2V5cxgFIAMoDBIYChByb3V0ZXJfYWRkcmVzc2VzGAYgAygJEi8KDG9pZGNfc2Vzc2lvbhgHIAEoCzIZLmFnZW50bWVzaC52MS5PSURDU2Vzc2lvbiJZChFUcnVzdGVkU2lnbmluZ0tleRISCgpwdWJsaWNfa2V5GAEgASgMEjAKDHJlY2VpdmVfdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiWQoLT0lEQ1Nlc3Npb24SDgoGaXNzdWVyGAEgASgJEhEKCWNsaWVudF9pZBgCIAEoCRIQCghhdWRpZW5jZRgDIAEoCRIVCg1yZWZyZXNoX3Rva2VuGAQgASgJIpMBChVUYXNrQXV0aG9yaXphdGlvblJ1bGUSDAoEbmFtZRgBIAEoCRIUCgxkaXNwbGF5X25hbWUYAiABKAkSJQoFcnVsZXMYAyADKAsyFi5hZ2VudG1lc2gudjEuVGFza1J1bGUSLwoLZXhwaXJlX3RpbWUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIoQBCghUYXNrUnVsZRITCgtkZXNjcmlwdGlvbhgBIAEoCRIYChBhbGxvd2VkX3NlcnZpY2VzGAIgAygJEi4KCW9wZXJhdGlvbhgDIAEoCzIbLmFnZW50bWVzaC52MS5UYXNrT3BlcmF0aW9uEhkKEWFsbG93ZWRfcmVzb3VyY2VzGAQgAygJInMKDVRhc2tPcGVyYXRpb24SFQoNYWxsb3dlZF90b29scxgBIAMoCRIXCg9hbGxvd2VkX21ldGhvZHMYAiADKAkSFQoNYWxsb3dlZF9wYXRocxgDIAMoCRIbChNhbGxvd2VkX3Blcm1pc3Npb25zGAQgAygJIqsBChRUb2tlbkV4Y2hhbmdlUmVxdWVzdBIVCg1zdWJqZWN0X3Rva2VuGAEgASgJEjYKCXRhc2tfcnVsZRgCIAEoCzIjLmFnZW50bWVzaC52MS5UYXNrQXV0aG9yaXphdGlvblJ1bGUSDAoEc2VhbBgDIAEoCBIZChFjaGFsbGVuZ2VfdW5peF9tcxgEIAEoAxIbChNjaGFsbGVuZ2Vfc2lnbmF0dXJlGAUgASgMIn8KFVRva2VuRXhjaGFuZ2VSZXNwb25zZRIVCg1iaXNjdWl0X3Rva2VuGAEgASgMEi8KC2V4cGlyZV90aW1lGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBINCgVyb2xlcxgDIAMoCRIPCgdzdWJqZWN0GAQgASgJIoEBCg9TVFNUb2tlblJlcXVlc3QSDwoHYmlzY3VpdBgBIAEoDBITCgtkZXN0aW5hdGlvbhgCIAEoCRIQCghhdWRpZW5jZRgDIAEoCRIZChFjaGFsbGVuZ2VfdW5peF9tcxgEIAEoAxIbChNjaGFsbGVuZ2Vfc2lnbmF0dXJlGAUgASgMIoMBChBTVFNUb2tlblJlc3BvbnNlEgsKA2p3dBgBIAEoCRIvCgtleHBpcmVfdGltZRgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASDwoHc3ViamVjdBgDIAEoCRINCgVyb2xlcxgEIAMoCRIRCgl0YXNrX25hbWUYBSABKAkiRgoTUmV2b2NhdGlvbnNSZXNwb25zZRIWCg5yZXZvY2F0aW9uX2lkcxgBIAMoCRIXCg9iYW5uZWRfcGVlcl9pZHMYAiADKAkqlAEKEEVucm9sbG1lbnRTdGF0dXMSIQodRU5ST0xMTUVOVF9TVEFUVVNfVU5TUEVDSUZJRUQQABIdChlFTlJPTExNRU5UX1NUQVRVU19QRU5ESU5HEAESHgoaRU5ST0xMTUVOVF9TVEFUVVNfQVBQUk9WRUQQAhIeChpFTlJPTExNRU5UX1NUQVRVU19SRUpFQ1RFRBADKowBCgtTZXJ2aWNlVHlwZRIcChhTRVJWSUNFX1RZUEVfVU5TUEVDSUZJRUQQABIUChBTRVJWSUNFX1RZUEVfTUNQEAESGgoWU0VSVklDRV9UWVBFX0lORkVSRU5DRRACEhQKEFNFUlZJQ0VfVFlQRV9BMkEQAxIXChNTRVJWSUNFX1RZUEVfRUdSRVNTEAQqNwoKRWdyZXNzTW9kZRIUChBFR1JFU1NfTU9ERV9IVFRQEAASEwoPRUdSRVNTX01PREVfVENQEAEqXAoSUmVzcG9uc2VJbnNwZWN0aW9uEiAKHFJFU1BPTlNFX0lOU1BFQ1RJT05fQlVGRkVSRUQQABIkCiBSRVNQT05TRV9JTlNQRUNUSU9OX1JFUVVFU1RfT05MWRABQiFaH2dpdGh1Yi5jb20vZ29vZ2xlL2FnZW50bWVzaC9hcGliBnByb3RvMw", [file_google_protobuf_duration, file_google_protobuf_timestamp]);
 
 /**
  * @generated from message agentmesh.v1.AuthFrame
@@ -2007,6 +2007,17 @@ export type BootstrapTokenCreateRequest = Message<"agentmesh.v1.BootstrapTokenCr
    * @generated from field: bool autonomous_recovery = 6;
    */
   autonomousRecovery: boolean;
+
+  /**
+   * Copied onto every node the token enrolls: such a node is forgotten
+   * soon after it falls silent (the control plane's
+   * --ephemeral-node-retention, an hour by default) instead of being kept
+   * for --node-retention. For members that come and go: a fleet in a scale
+   * test, a probe, a CI job.
+   *
+   * @generated from field: bool ephemeral = 7;
+   */
+  ephemeral: boolean;
 };
 
 /**
@@ -2115,6 +2126,11 @@ export type BootstrapToken = Message<"agentmesh.v1.BootstrapToken"> & {
    * @generated from field: bool autonomous_recovery = 10;
    */
   autonomousRecovery: boolean;
+
+  /**
+   * @generated from field: bool ephemeral = 11;
+   */
+  ephemeral: boolean;
 };
 
 /**
@@ -2323,6 +2339,14 @@ export type EnrolledNode = Message<"agentmesh.v1.EnrolledNode"> & {
    * @generated from field: bool autonomous_recovery = 10;
    */
   autonomousRecovery: boolean;
+
+  /**
+   * The node was enrolled by an ephemeral token and is forgotten soon after
+   * it falls silent.
+   *
+   * @generated from field: bool ephemeral = 11;
+   */
+  ephemeral: boolean;
 };
 
 /**
diff --git a/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.py b/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.py
index d1597202..34b120d1 100644
--- a/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.py
+++ b/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.py
@@ -15,7 +15,7 @@
 from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x0f\x61gentmesh.proto\x12\x0c\x61gentmesh.v1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"4\n\tAuthFrame\x12\x0f\n\x07\x62iscuit\x18\x01 \x01(\x0c\x12\x16\n\x0etarget_service\x18\x02 \x01(\t\"?\n\x0c\x41uthResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x03 \x01(\x0c\"\xb1\x01\n\x0cRouterGoAway\x12\x31\n\x06reason\x18\x01 \x01(\x0e\x32!.agentmesh.v1.RouterGoAway.Reason\x12.\n\x0bretry_after\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\">\n\x06Reason\x12\x16\n\x12REASON_UNSPECIFIED\x10\x00\x12\x0c\n\x08\x44RAINING\x10\x01\x12\x0e\n\nOVERLOADED\x10\x02\"\xdc\x01\n\tMeshEvent\x12*\n\x04type\x18\x01 \x01(\x0e\x32\x1c.agentmesh.v1.MeshEvent.Type\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12.\n\nevent_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x16\n\x0enew_public_key\x18\x04 \x01(\x0c\x12\x11\n\tsignature\x18\x05 \x01(\x0c\"7\n\x04Type\x12\n\n\x06\x42\x41NNED\x10\x00\x12\x10\n\x0cKEY_ROTATION\x10\x01\x12\x11\n\rPOLICY_UPDATE\x10\x02\"\xf9\x01\n\rEnrollRequest\x12\x0b\n\x03jwt\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x12\n\npublic_key\x18\x03 \x01(\x0c\x12\x16\n\x0erequested_role\x18\x04 \x01(\t\x12\x37\n\x06labels\x18\x05 \x03(\x0b\x32\'.agentmesh.v1.EnrollRequest.LabelsEntry\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xab\x01\n\x0e\x45nrollResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12 \n\x18\x63ontrol_plane_public_key\x18\x03 \x01(\x0c\x12\x18\n\x10router_addresses\x18\x04 \x03(\t\x12/\n\x0b\x65xpire_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x97\x02\n\x16\x42ootstrapEnrollRequest\x12\x17\n\x0f\x62ootstrap_token\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x12\n\npublic_key\x18\x03 \x01(\x0c\x12\x16\n\x0erequested_role\x18\x04 \x01(\t\x12@\n\x06labels\x18\x05 \x03(\x0b\x32\x30.agentmesh.v1.BootstrapEnrollRequest.LabelsEntry\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x83\x02\n\x17\x42ootstrapEnrollResponse\x12.\n\x06status\x18\x01 \x01(\x0e\x32\x1e.agentmesh.v1.EnrollmentStatus\x12\x15\n\rbiscuit_token\x18\x02 \x01(\x0c\x12\x1d\n\x15poll_interval_seconds\x18\x03 \x01(\x05\x12\x15\n\rerror_message\x18\x04 \x01(\t\x12 \n\x18\x63ontrol_plane_public_key\x18\x05 \x01(\x0c\x12\x18\n\x10router_addresses\x18\x06 \x03(\t\x12/\n\x0b\x65xpire_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"Y\n\x0bServiceInfo\x12\'\n\x04type\x18\x01 \x01(\x0e\x32\x19.agentmesh.v1.ServiceType\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x03 \x01(\t\"\x81\x01\n\x0e\x43ommandBackend\x12\x0f\n\x07\x63ommand\x18\x01 \x03(\t\x12\x32\n\x03\x65nv\x18\x02 \x03(\x0b\x32%.agentmesh.v1.CommandBackend.EnvEntry\x1a*\n\x08\x45nvEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x96\x01\n\x16RegisterServiceRequest\x12*\n\x07service\x18\x01 \x01(\x0b\x32\x19.agentmesh.v1.ServiceInfo\x12\x14\n\ntarget_url\x18\x02 \x01(\tH\x00\x12/\n\x07\x63ommand\x18\x03 \x01(\x0b\x32\x1c.agentmesh.v1.CommandBackendH\x00\x42\t\n\x07\x62\x61\x63kend\"i\n\x12\x44iscoveredProvider\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x17\n\x0flocal_proxy_url\x18\x02 \x01(\t\x12\x10\n\x08srv_name\x18\x03 \x01(\t\x12\x17\n\x0fsrv_description\x18\x04 \x01(\t\"\xe8\x01\n\x18\x43ontrolPlaneInfoResponse\x12\x13\n\x0boidc_issuer\x18\x01 \x01(\t\x12\x11\n\tclient_id\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x18\n\x10router_addresses\x18\x04 \x03(\t\x12\x17\n\x0f\x62\x61nned_peer_ids\x18\x05 \x03(\t\x12)\n\x07routers\x18\x06 \x03(\x0b\x32\x18.agentmesh.v1.RouterInfo\x12\x34\n\tdirectory\x18\x07 \x01(\x0b\x32!.agentmesh.v1.DirectoryParameters\"\x90\x01\n\x13\x44irectoryParameters\x12\x13\n\x0breplication\x18\x01 \x01(\x05\x12\x35\n\x12reprovide_interval\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12-\n\nrecord_ttl\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\"\xfb\x01\n\x10\x44irectoryRequest\x12\x31\n\x07provide\x18\x01 \x01(\x0b\x32\x1e.agentmesh.v1.DirectoryProvideH\x00\x12>\n\x0e\x66ind_providers\x18\x02 \x01(\x0b\x32$.agentmesh.v1.DirectoryFindProvidersH\x00\x12\x34\n\tfind_peer\x18\x03 \x01(\x0b\x32\x1f.agentmesh.v1.DirectoryFindPeerH\x00\x12\x33\n\x08withdraw\x18\x04 \x01(\x0b\x32\x1f.agentmesh.v1.DirectoryWithdrawH\x00\x42\t\n\x07request\"Q\n\x10\x44irectoryProvide\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\r\n\x05\x61\x64\x64rs\x18\x02 \x03(\t\x12\x10\n\x08provider\x18\x03 \x01(\t\x12\x0f\n\x07service\x18\x04 \x01(\t\"2\n\x11\x44irectoryWithdraw\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\x10\n\x08provider\x18\x02 \x01(\t\"4\n\x16\x44irectoryFindProviders\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\r\n\x05limit\x18\x02 \x01(\r\"$\n\x11\x44irectoryFindPeer\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\"w\n\x11\x44irectoryResponse\x12+\n\tproviders\x18\x01 \x03(\x0b\x32\x18.agentmesh.v1.PeerRecord\x12&\n\x04peer\x18\x02 \x01(\x0b\x32\x18.agentmesh.v1.PeerRecord\x12\r\n\x05\x65rror\x18\x03 \x01(\t\",\n\nPeerRecord\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\r\n\x05\x61\x64\x64rs\x18\x02 \x03(\t\"\xc4\x01\n\nRouterInfo\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x34\n\x06labels\x18\x03 \x03(\x0b\x32$.agentmesh.v1.RouterInfo.LabelsEntry\x12\x13\n\x0b\x63onnections\x18\x04 \x01(\x05\x12\x18\n\x10\x63onnection_limit\x18\x05 \x01(\x05\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x83\x02\n\x12RouterLeaseRequest\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x0f\n\x07\x62iscuit\x18\x03 \x01(\x0c\x12\x17\n\x0f\x63onnected_peers\x18\x04 \x03(\t\x12\x10\n\x08\x64ht_size\x18\x05 \x01(\x05\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x12&\n\x03ttl\x18\x08 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x13\n\x0b\x63onnections\x18\t \x01(\x05\x12\x18\n\x10\x63onnection_limit\x18\n \x01(\x05\"f\n\x13RouterLeaseResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xbd\x01\n\nPolicyRole\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x17\n\x0f\x61llowed_targets\x18\x02 \x03(\t\x12\x18\n\x10\x61llowed_services\x18\x03 \x03(\t\x12\x16\n\x0e\x63ustom_datalog\x18\x04 \x03(\t\x12\x16\n\x0e\x61llowed_labels\x18\x05 \x03(\t\x12%\n\x04http\x18\x06 \x03(\x0b\x32\x17.agentmesh.v1.HTTPGrant\x12\x17\n\x0f\x61llowed_publish\x18\x07 \x03(\t\"<\n\tHTTPGrant\x12\x0f\n\x07service\x18\x01 \x01(\t\x12\x0f\n\x07methods\x18\x02 \x03(\t\x12\r\n\x05paths\x18\x03 \x03(\t\"\xa1\x02\n\x11\x45gressDestination\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x12\n\ntarget_url\x18\x02 \x01(\t\x12\x12\n\ncredential\x18\x03 \x01(\t\x12\x11\n\tserved_by\x18\x04 \x03(\t\x12.\n\x06\x62roker\x18\x05 \x01(\x0b\x32\x1e.agentmesh.v1.CredentialBroker\x12,\n\ninspection\x18\x06 \x01(\x0b\x32\x18.agentmesh.v1.Inspection\x12&\n\x04mode\x18\x07 \x01(\x0e\x32\x18.agentmesh.v1.EgressMode\x12\r\n\x05ports\x18\x08 \x03(\r\x12\x15\n\rpreserve_host\x18\t \x01(\x08\x12\x17\n\x0f\x66orward_context\x18\n \x01(\x08\"9\n\nInspection\x12+\n\ninspectors\x18\x01 \x03(\x0b\x32\x17.agentmesh.v1.Inspector\"o\n\tInspector\x12/\n\x0bmodel_armor\x18\x01 \x01(\x0b\x32\x18.agentmesh.v1.ModelArmorH\x00\x12)\n\x08\x65xt_proc\x18\x02 \x01(\x0b\x32\x15.agentmesh.v1.ExtProcH\x00\x42\x06\n\x04kind\"\x91\x01\n\nModelArmor\x12\x10\n\x08template\x18\x01 \x01(\t\x12\x32\n\x08response\x18\x02 \x01(\x0e\x32 .agentmesh.v1.ResponseInspection\x12\x11\n\tfail_open\x18\x03 \x01(\x08\x12*\n\x07timeout\x18\x04 \x01(\x0b\x32\x19.google.protobuf.Duration\"\x88\x02\n\x07\x45xtProc\x12\x0e\n\x06target\x18\x01 \x01(\t\x12\n\n\x02\x63\x61\x18\x02 \x01(\t\x12\x1a\n\x12\x63lient_certificate\x18\x03 \x01(\t\x12<\n\x0fprocessing_mode\x18\x04 \x01(\x0b\x32#.agentmesh.v1.ExtProcProcessingMode\x12\x1b\n\x13\x61llow_mode_override\x18\x05 \x01(\x08\x12\x32\n\x0fmessage_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x1a\n\x12\x66\x61ilure_mode_allow\x18\x07 \x01(\x08\x12\x1a\n\x12max_buffered_bytes\x18\x08 \x01(\r\"\xff\x04\n\x15\x45xtProcProcessingMode\x12K\n\x13request_header_mode\x18\x01 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12L\n\x14response_header_mode\x18\x02 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12G\n\x11request_body_mode\x18\x03 \x01(\x0e\x32,.agentmesh.v1.ExtProcProcessingMode.BodyMode\x12H\n\x12response_body_mode\x18\x04 \x01(\x0e\x32,.agentmesh.v1.ExtProcProcessingMode.BodyMode\x12L\n\x14request_trailer_mode\x18\x05 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12M\n\x15response_trailer_mode\x18\x06 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\"9\n\nHeaderMode\x12\x17\n\x13HEADER_MODE_DEFAULT\x10\x00\x12\x08\n\x04SEND\x10\x01\x12\x08\n\x04SKIP\x10\x02\"`\n\x08\x42odyMode\x12\x08\n\x04NONE\x10\x00\x12\x0c\n\x08STREAMED\x10\x01\x12\x0c\n\x08\x42UFFERED\x10\x02\x12\x14\n\x10\x42UFFERED_PARTIAL\x10\x03\x12\x18\n\x14\x46ULL_DUPLEX_STREAMED\x10\x04\"\xe1\x01\n\x10\x43redentialBroker\x12\x17\n\rstatic_secret\x18\x01 \x01(\tH\x00\x12\x37\n\x0foidc_federation\x18\x02 \x01(\x0b\x32\x1c.agentmesh.v1.OIDCFederationH\x00\x12\x36\n\x0f\x61ws_assume_role\x18\x03 \x01(\x0b\x32\x1b.agentmesh.v1.AWSAssumeRoleH\x00\x12;\n\x11platform_identity\x18\x04 \x01(\x0b\x32\x1e.agentmesh.v1.PlatformIdentityH\x00\x42\x06\n\x04kind\"_\n\x0eOIDCFederation\x12\x16\n\x0etoken_endpoint\x18\x01 \x01(\t\x12\x10\n\x08\x61udience\x18\x02 \x01(\t\x12\x13\n\x0bimpersonate\x18\x03 \x01(\t\x12\x0e\n\x06scopes\x18\x04 \x03(\t\"9\n\rAWSAssumeRole\x12\x10\n\x08role_arn\x18\x01 \x01(\t\x12\x16\n\x0esession_policy\x18\x02 \x01(\t\"\"\n\x10PlatformIdentity\x12\x0e\n\x06scopes\x18\x01 \x03(\t\".\n\rPolicyBinding\x12\x0c\n\x04role\x18\x01 \x01(\t\x12\x0f\n\x07members\x18\x02 \x03(\t\"\x97\x01\n\x0cPolicyConfig\x12\'\n\x05roles\x18\x01 \x03(\x0b\x32\x18.agentmesh.v1.PolicyRole\x12-\n\x08\x62indings\x18\x02 \x03(\x0b\x32\x1b.agentmesh.v1.PolicyBinding\x12/\n\x06\x65gress\x18\x03 \x03(\x0b\x32\x1f.agentmesh.v1.EgressDestination\"\x18\n\x16PolicyConfigGetRequest\"0\n\x17PolicyConfigGetResponse\x12\x15\n\rdatalog_rules\x18\x01 \x03(\t\"<\n\x1aPolicyConfigUpdateResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\"\x1a\n\x18\x45gressAssignmentsRequest\"L\n\x19\x45gressAssignmentsResponse\x12/\n\x06\x65gress\x18\x01 \x03(\x0b\x32\x1f.agentmesh.v1.EgressDestination\"f\n\x0cKeysResponse\x12\x13\n\x0bpublic_keys\x18\x01 \x03(\x0c\x12-\n\tsign_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x12\n\nsignatures\x18\x03 \x03(\x0c\"k\n\x13TokenRefreshRequest\x12\x1b\n\x13\x63hallenge_signature\x18\x01 \x01(\x0c\x12\x19\n\x11\x63hallenge_unix_ms\x18\x02 \x01(\x03\x12\x0f\n\x07peer_id\x18\x03 \x01(\t\x12\x0b\n\x03jwt\x18\x04 \x01(\t\"u\n\x14TokenRefreshResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x15\n\rerror_message\x18\x03 \x01(\t\"@\n\x11NodeCatalogReport\x12+\n\x08services\x18\x01 \x03(\x0b\x32\x19.agentmesh.v1.ServiceInfo\"%\n\x12TokenRevokeRequest\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\"5\n\x13TokenRevokeResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\"\x96\x01\n\x1b\x42ootstrapTokenCreateRequest\x12\x0c\n\x04role\x18\x01 \x01(\t\x12\x10\n\x08owner_id\x18\x02 \x01(\t\x12\x11\n\tttl_hours\x18\x03 \x01(\x05\x12\x12\n\nmax_usages\x18\x04 \x01(\x05\x12\x13\n\x0b\x64\x65scription\x18\x05 \x01(\t\x12\x1b\n\x13\x61utonomous_recovery\x18\x06 \x01(\x08\"\x8a\x01\n\x1c\x42ootstrapTokenCreateResponse\x12\n\n\x02id\x18\x01 \x01(\t\x12\r\n\x05token\x18\x02 \x01(\t\x12\x0c\n\x04role\x18\x03 \x01(\t\x12\x10\n\x08owner_id\x18\x04 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xab\x02\n\x0e\x42ootstrapToken\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0c\n\x04role\x18\x02 \x01(\t\x12\x10\n\x08owner_id\x18\x03 \x01(\t\x12\x12\n\nmax_usages\x18\x04 \x01(\x05\x12\x14\n\x0cusages_count\x18\x05 \x01(\x05\x12\x13\n\x0b\x64\x65scription\x18\x06 \x01(\t\x12/\n\x0b\x63reate_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0brevoke_time\x18\t \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x1b\n\x13\x61utonomous_recovery\x18\n \x01(\x08\"J\n\x1a\x42ootstrapTokenListResponse\x12,\n\x06tokens\x18\x01 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\"\xd6\x02\n\x11\x45nrollmentRequest\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x10\n\x08token_id\x18\x03 \x01(\t\x12.\n\x06status\x18\x04 \x01(\x0e\x32\x1e.agentmesh.v1.EnrollmentStatus\x12;\n\x06labels\x18\x05 \x03(\x0b\x32+.agentmesh.v1.EnrollmentRequest.LabelsEntry\x12/\n\x0b\x63reate_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x30\n\x0cresolve_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x13\n\x0bresolved_by\x18\x08 \x01(\t\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"R\n\x1d\x45nrollmentRequestListResponse\x12\x31\n\x08requests\x18\x01 \x03(\x0b\x32\x1f.agentmesh.v1.EnrollmentRequest\"p\n\x04User\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0e\n\x06issuer\x18\x02 \x01(\t\x12\r\n\x05\x65mail\x18\x03 \x01(\t\x12\x0c\n\x04role\x18\x04 \x01(\t\x12/\n\x0b\x63reate_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xe3\x02\n\x0c\x45nrolledNode\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0c\n\x04role\x18\x02 \x01(\t\x12\x17\n\x0f\x65nrollment_type\x18\x03 \x01(\t\x12\x13\n\x0b\x63laims_json\x18\x04 \x01(\t\x12\x10\n\x08owner_id\x18\x05 \x01(\t\x12\x36\n\x06labels\x18\x06 \x03(\x0b\x32&.agentmesh.v1.EnrolledNode.LabelsEntry\x12/\n\x0b\x65nroll_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0e\n\x06\x62\x61nned\x18\t \x01(\x08\x12\x1b\n\x13\x61utonomous_recovery\x18\n \x01(\x08\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xc4\x01\n\x0bRouterLease\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x35\n\x11last_renewal_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x17\n\x0f\x63onnected_peers\x18\x05 \x03(\t\x12\x10\n\x08\x64ht_size\x18\x06 \x01(\x05\"l\n\x0cNodeServices\x12+\n\x08services\x18\x01 \x03(\x0b\x32\x19.agentmesh.v1.ServiceInfo\x12/\n\x0breport_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xdb\x03\n\x13\x41\x64minStatusResponse\x12!\n\x05users\x18\x01 \x03(\x0b\x32\x12.agentmesh.v1.User\x12\x31\n\x0e\x61\x63tive_routers\x18\x02 \x03(\x0b\x32\x19.agentmesh.v1.RouterLease\x12\x32\n\x0e\x65nrolled_nodes\x18\x03 \x03(\x0b\x32\x1a.agentmesh.v1.EnrolledNode\x12<\n\x13\x65nrollment_requests\x18\x04 \x03(\x0b\x32\x1f.agentmesh.v1.EnrollmentRequest\x12\x36\n\x10\x62ootstrap_tokens\x18\x05 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\x12*\n\x06policy\x18\x06 \x01(\x0b\x32\x1a.agentmesh.v1.PolicyConfig\x12H\n\x0cnode_catalog\x18\x07 \x03(\x0b\x32\x32.agentmesh.v1.AdminStatusResponse.NodeCatalogEntry\x1aN\n\x10NodeCatalogEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12)\n\x05value\x18\x02 \x01(\x0b\x32\x1a.agentmesh.v1.NodeServices:\x02\x38\x01\"\x81\x02\n\x12UserStatusResponse\x12 \n\x04user\x18\x01 \x01(\x0b\x32\x12.agentmesh.v1.User\x12\x32\n\x0e\x65nrolled_nodes\x18\x02 \x03(\x0b\x32\x1a.agentmesh.v1.EnrolledNode\x12\x36\n\x10\x62ootstrap_tokens\x18\x03 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\x12\x31\n\x0e\x61\x63tive_routers\x18\x04 \x03(\x0b\x32\x19.agentmesh.v1.RouterLease\x12*\n\x06policy\x18\x05 \x01(\x0b\x32\x1a.agentmesh.v1.PolicyConfig\"V\n\x10NodeListResponse\x12)\n\x05nodes\x18\x01 \x03(\x0b\x32\x1a.agentmesh.v1.EnrolledNode\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\"\xe4\x01\n\x18IdentityEvidenceResponse\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12\x37\n\x13\x62iscuit_expire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x19\n\x11\x63ontrol_plane_url\x18\x04 \x01(\t\x12\"\n\x1atrusted_control_plane_keys\x18\x05 \x03(\x0c\x12.\n\ncheck_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xc6\x02\n\x14PeerEvidenceResponse\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12\x15\n\rverifying_key\x18\x03 \x01(\x0c\x12\r\n\x05roles\x18\x04 \x03(\t\x12>\n\x06labels\x18\x05 \x03(\x0b\x32..agentmesh.v1.PeerEvidenceResponse.LabelsEntry\x12/\n\x0b\x65xpire_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x16\n\x0erevocation_ids\x18\x07 \x03(\t\x12.\n\ncheck_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x8c\x02\n\x10MemberCredential\x12\x19\n\x11\x63ontrol_plane_url\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x0ctrusted_keys\x18\x04 \x03(\x0b\x32\x1f.agentmesh.v1.TrustedSigningKey\x12\x19\n\x11issued_under_keys\x18\x05 \x03(\x0c\x12\x18\n\x10router_addresses\x18\x06 \x03(\t\x12/\n\x0coidc_session\x18\x07 \x01(\x0b\x32\x19.agentmesh.v1.OIDCSession\"Y\n\x11TrustedSigningKey\x12\x12\n\npublic_key\x18\x01 \x01(\x0c\x12\x30\n\x0creceive_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"Y\n\x0bOIDCSession\x12\x0e\n\x06issuer\x18\x01 \x01(\t\x12\x11\n\tclient_id\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x15\n\rrefresh_token\x18\x04 \x01(\t\"\x93\x01\n\x15TaskAuthorizationRule\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x14\n\x0c\x64isplay_name\x18\x02 \x01(\t\x12%\n\x05rules\x18\x03 \x03(\x0b\x32\x16.agentmesh.v1.TaskRule\x12/\n\x0b\x65xpire_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x84\x01\n\x08TaskRule\x12\x13\n\x0b\x64\x65scription\x18\x01 \x01(\t\x12\x18\n\x10\x61llowed_services\x18\x02 \x03(\t\x12.\n\toperation\x18\x03 \x01(\x0b\x32\x1b.agentmesh.v1.TaskOperation\x12\x19\n\x11\x61llowed_resources\x18\x04 \x03(\t\"s\n\rTaskOperation\x12\x15\n\rallowed_tools\x18\x01 \x03(\t\x12\x17\n\x0f\x61llowed_methods\x18\x02 \x03(\t\x12\x15\n\rallowed_paths\x18\x03 \x03(\t\x12\x1b\n\x13\x61llowed_permissions\x18\x04 \x03(\t\"\xab\x01\n\x14TokenExchangeRequest\x12\x15\n\rsubject_token\x18\x01 \x01(\t\x12\x36\n\ttask_rule\x18\x02 \x01(\x0b\x32#.agentmesh.v1.TaskAuthorizationRule\x12\x0c\n\x04seal\x18\x03 \x01(\x08\x12\x19\n\x11\x63hallenge_unix_ms\x18\x04 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x05 \x01(\x0c\"\x7f\n\x15TokenExchangeResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\r\n\x05roles\x18\x03 \x03(\t\x12\x0f\n\x07subject\x18\x04 \x01(\t\"\x81\x01\n\x0fSTSTokenRequest\x12\x0f\n\x07\x62iscuit\x18\x01 \x01(\x0c\x12\x13\n\x0b\x64\x65stination\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x19\n\x11\x63hallenge_unix_ms\x18\x04 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x05 \x01(\x0c\"\x83\x01\n\x10STSTokenResponse\x12\x0b\n\x03jwt\x18\x01 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0f\n\x07subject\x18\x03 \x01(\t\x12\r\n\x05roles\x18\x04 \x03(\t\x12\x11\n\ttask_name\x18\x05 \x01(\t\"F\n\x13RevocationsResponse\x12\x16\n\x0erevocation_ids\x18\x01 \x03(\t\x12\x17\n\x0f\x62\x61nned_peer_ids\x18\x02 \x03(\t*\x94\x01\n\x10\x45nrollmentStatus\x12!\n\x1d\x45NROLLMENT_STATUS_UNSPECIFIED\x10\x00\x12\x1d\n\x19\x45NROLLMENT_STATUS_PENDING\x10\x01\x12\x1e\n\x1a\x45NROLLMENT_STATUS_APPROVED\x10\x02\x12\x1e\n\x1a\x45NROLLMENT_STATUS_REJECTED\x10\x03*\x8c\x01\n\x0bServiceType\x12\x1c\n\x18SERVICE_TYPE_UNSPECIFIED\x10\x00\x12\x14\n\x10SERVICE_TYPE_MCP\x10\x01\x12\x1a\n\x16SERVICE_TYPE_INFERENCE\x10\x02\x12\x14\n\x10SERVICE_TYPE_A2A\x10\x03\x12\x17\n\x13SERVICE_TYPE_EGRESS\x10\x04*7\n\nEgressMode\x12\x14\n\x10\x45GRESS_MODE_HTTP\x10\x00\x12\x13\n\x0f\x45GRESS_MODE_TCP\x10\x01*\\\n\x12ResponseInspection\x12 \n\x1cRESPONSE_INSPECTION_BUFFERED\x10\x00\x12$\n RESPONSE_INSPECTION_REQUEST_ONLY\x10\x01\x42!Z\x1fgithub.com/google/agentmesh/apib\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x0f\x61gentmesh.proto\x12\x0c\x61gentmesh.v1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"4\n\tAuthFrame\x12\x0f\n\x07\x62iscuit\x18\x01 \x01(\x0c\x12\x16\n\x0etarget_service\x18\x02 \x01(\t\"?\n\x0c\x41uthResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x03 \x01(\x0c\"\xb1\x01\n\x0cRouterGoAway\x12\x31\n\x06reason\x18\x01 \x01(\x0e\x32!.agentmesh.v1.RouterGoAway.Reason\x12.\n\x0bretry_after\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\">\n\x06Reason\x12\x16\n\x12REASON_UNSPECIFIED\x10\x00\x12\x0c\n\x08\x44RAINING\x10\x01\x12\x0e\n\nOVERLOADED\x10\x02\"\xdc\x01\n\tMeshEvent\x12*\n\x04type\x18\x01 \x01(\x0e\x32\x1c.agentmesh.v1.MeshEvent.Type\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12.\n\nevent_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x16\n\x0enew_public_key\x18\x04 \x01(\x0c\x12\x11\n\tsignature\x18\x05 \x01(\x0c\"7\n\x04Type\x12\n\n\x06\x42\x41NNED\x10\x00\x12\x10\n\x0cKEY_ROTATION\x10\x01\x12\x11\n\rPOLICY_UPDATE\x10\x02\"\xf9\x01\n\rEnrollRequest\x12\x0b\n\x03jwt\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x12\n\npublic_key\x18\x03 \x01(\x0c\x12\x16\n\x0erequested_role\x18\x04 \x01(\t\x12\x37\n\x06labels\x18\x05 \x03(\x0b\x32\'.agentmesh.v1.EnrollRequest.LabelsEntry\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xab\x01\n\x0e\x45nrollResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12\x15\n\rerror_message\x18\x02 \x01(\t\x12 \n\x18\x63ontrol_plane_public_key\x18\x03 \x01(\x0c\x12\x18\n\x10router_addresses\x18\x04 \x03(\t\x12/\n\x0b\x65xpire_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x97\x02\n\x16\x42ootstrapEnrollRequest\x12\x17\n\x0f\x62ootstrap_token\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x12\n\npublic_key\x18\x03 \x01(\x0c\x12\x16\n\x0erequested_role\x18\x04 \x01(\t\x12@\n\x06labels\x18\x05 \x03(\x0b\x32\x30.agentmesh.v1.BootstrapEnrollRequest.LabelsEntry\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x83\x02\n\x17\x42ootstrapEnrollResponse\x12.\n\x06status\x18\x01 \x01(\x0e\x32\x1e.agentmesh.v1.EnrollmentStatus\x12\x15\n\rbiscuit_token\x18\x02 \x01(\x0c\x12\x1d\n\x15poll_interval_seconds\x18\x03 \x01(\x05\x12\x15\n\rerror_message\x18\x04 \x01(\t\x12 \n\x18\x63ontrol_plane_public_key\x18\x05 \x01(\x0c\x12\x18\n\x10router_addresses\x18\x06 \x03(\t\x12/\n\x0b\x65xpire_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"Y\n\x0bServiceInfo\x12\'\n\x04type\x18\x01 \x01(\x0e\x32\x19.agentmesh.v1.ServiceType\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x03 \x01(\t\"\x81\x01\n\x0e\x43ommandBackend\x12\x0f\n\x07\x63ommand\x18\x01 \x03(\t\x12\x32\n\x03\x65nv\x18\x02 \x03(\x0b\x32%.agentmesh.v1.CommandBackend.EnvEntry\x1a*\n\x08\x45nvEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x96\x01\n\x16RegisterServiceRequest\x12*\n\x07service\x18\x01 \x01(\x0b\x32\x19.agentmesh.v1.ServiceInfo\x12\x14\n\ntarget_url\x18\x02 \x01(\tH\x00\x12/\n\x07\x63ommand\x18\x03 \x01(\x0b\x32\x1c.agentmesh.v1.CommandBackendH\x00\x42\t\n\x07\x62\x61\x63kend\"i\n\x12\x44iscoveredProvider\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x17\n\x0flocal_proxy_url\x18\x02 \x01(\t\x12\x10\n\x08srv_name\x18\x03 \x01(\t\x12\x17\n\x0fsrv_description\x18\x04 \x01(\t\"\xe8\x01\n\x18\x43ontrolPlaneInfoResponse\x12\x13\n\x0boidc_issuer\x18\x01 \x01(\t\x12\x11\n\tclient_id\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x18\n\x10router_addresses\x18\x04 \x03(\t\x12\x17\n\x0f\x62\x61nned_peer_ids\x18\x05 \x03(\t\x12)\n\x07routers\x18\x06 \x03(\x0b\x32\x18.agentmesh.v1.RouterInfo\x12\x34\n\tdirectory\x18\x07 \x01(\x0b\x32!.agentmesh.v1.DirectoryParameters\"\x90\x01\n\x13\x44irectoryParameters\x12\x13\n\x0breplication\x18\x01 \x01(\x05\x12\x35\n\x12reprovide_interval\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12-\n\nrecord_ttl\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\"\xfb\x01\n\x10\x44irectoryRequest\x12\x31\n\x07provide\x18\x01 \x01(\x0b\x32\x1e.agentmesh.v1.DirectoryProvideH\x00\x12>\n\x0e\x66ind_providers\x18\x02 \x01(\x0b\x32$.agentmesh.v1.DirectoryFindProvidersH\x00\x12\x34\n\tfind_peer\x18\x03 \x01(\x0b\x32\x1f.agentmesh.v1.DirectoryFindPeerH\x00\x12\x33\n\x08withdraw\x18\x04 \x01(\x0b\x32\x1f.agentmesh.v1.DirectoryWithdrawH\x00\x42\t\n\x07request\"Q\n\x10\x44irectoryProvide\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\r\n\x05\x61\x64\x64rs\x18\x02 \x03(\t\x12\x10\n\x08provider\x18\x03 \x01(\t\x12\x0f\n\x07service\x18\x04 \x01(\t\"2\n\x11\x44irectoryWithdraw\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\x10\n\x08provider\x18\x02 \x01(\t\"4\n\x16\x44irectoryFindProviders\x12\x0b\n\x03key\x18\x01 \x01(\x0c\x12\r\n\x05limit\x18\x02 \x01(\r\"$\n\x11\x44irectoryFindPeer\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\"w\n\x11\x44irectoryResponse\x12+\n\tproviders\x18\x01 \x03(\x0b\x32\x18.agentmesh.v1.PeerRecord\x12&\n\x04peer\x18\x02 \x01(\x0b\x32\x18.agentmesh.v1.PeerRecord\x12\r\n\x05\x65rror\x18\x03 \x01(\t\",\n\nPeerRecord\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\r\n\x05\x61\x64\x64rs\x18\x02 \x03(\t\"\xc4\x01\n\nRouterInfo\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x34\n\x06labels\x18\x03 \x03(\x0b\x32$.agentmesh.v1.RouterInfo.LabelsEntry\x12\x13\n\x0b\x63onnections\x18\x04 \x01(\x05\x12\x18\n\x10\x63onnection_limit\x18\x05 \x01(\x05\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x83\x02\n\x12RouterLeaseRequest\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x0f\n\x07\x62iscuit\x18\x03 \x01(\x0c\x12\x17\n\x0f\x63onnected_peers\x18\x04 \x03(\t\x12\x10\n\x08\x64ht_size\x18\x05 \x01(\x05\x12\x19\n\x11\x63hallenge_unix_ms\x18\x06 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x07 \x01(\x0c\x12&\n\x03ttl\x18\x08 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x13\n\x0b\x63onnections\x18\t \x01(\x05\x12\x18\n\x10\x63onnection_limit\x18\n \x01(\x05\"f\n\x13RouterLeaseResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xbd\x01\n\nPolicyRole\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x17\n\x0f\x61llowed_targets\x18\x02 \x03(\t\x12\x18\n\x10\x61llowed_services\x18\x03 \x03(\t\x12\x16\n\x0e\x63ustom_datalog\x18\x04 \x03(\t\x12\x16\n\x0e\x61llowed_labels\x18\x05 \x03(\t\x12%\n\x04http\x18\x06 \x03(\x0b\x32\x17.agentmesh.v1.HTTPGrant\x12\x17\n\x0f\x61llowed_publish\x18\x07 \x03(\t\"<\n\tHTTPGrant\x12\x0f\n\x07service\x18\x01 \x01(\t\x12\x0f\n\x07methods\x18\x02 \x03(\t\x12\r\n\x05paths\x18\x03 \x03(\t\"\xa1\x02\n\x11\x45gressDestination\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x12\n\ntarget_url\x18\x02 \x01(\t\x12\x12\n\ncredential\x18\x03 \x01(\t\x12\x11\n\tserved_by\x18\x04 \x03(\t\x12.\n\x06\x62roker\x18\x05 \x01(\x0b\x32\x1e.agentmesh.v1.CredentialBroker\x12,\n\ninspection\x18\x06 \x01(\x0b\x32\x18.agentmesh.v1.Inspection\x12&\n\x04mode\x18\x07 \x01(\x0e\x32\x18.agentmesh.v1.EgressMode\x12\r\n\x05ports\x18\x08 \x03(\r\x12\x15\n\rpreserve_host\x18\t \x01(\x08\x12\x17\n\x0f\x66orward_context\x18\n \x01(\x08\"9\n\nInspection\x12+\n\ninspectors\x18\x01 \x03(\x0b\x32\x17.agentmesh.v1.Inspector\"o\n\tInspector\x12/\n\x0bmodel_armor\x18\x01 \x01(\x0b\x32\x18.agentmesh.v1.ModelArmorH\x00\x12)\n\x08\x65xt_proc\x18\x02 \x01(\x0b\x32\x15.agentmesh.v1.ExtProcH\x00\x42\x06\n\x04kind\"\x91\x01\n\nModelArmor\x12\x10\n\x08template\x18\x01 \x01(\t\x12\x32\n\x08response\x18\x02 \x01(\x0e\x32 .agentmesh.v1.ResponseInspection\x12\x11\n\tfail_open\x18\x03 \x01(\x08\x12*\n\x07timeout\x18\x04 \x01(\x0b\x32\x19.google.protobuf.Duration\"\x88\x02\n\x07\x45xtProc\x12\x0e\n\x06target\x18\x01 \x01(\t\x12\n\n\x02\x63\x61\x18\x02 \x01(\t\x12\x1a\n\x12\x63lient_certificate\x18\x03 \x01(\t\x12<\n\x0fprocessing_mode\x18\x04 \x01(\x0b\x32#.agentmesh.v1.ExtProcProcessingMode\x12\x1b\n\x13\x61llow_mode_override\x18\x05 \x01(\x08\x12\x32\n\x0fmessage_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x1a\n\x12\x66\x61ilure_mode_allow\x18\x07 \x01(\x08\x12\x1a\n\x12max_buffered_bytes\x18\x08 \x01(\r\"\xff\x04\n\x15\x45xtProcProcessingMode\x12K\n\x13request_header_mode\x18\x01 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12L\n\x14response_header_mode\x18\x02 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12G\n\x11request_body_mode\x18\x03 \x01(\x0e\x32,.agentmesh.v1.ExtProcProcessingMode.BodyMode\x12H\n\x12response_body_mode\x18\x04 \x01(\x0e\x32,.agentmesh.v1.ExtProcProcessingMode.BodyMode\x12L\n\x14request_trailer_mode\x18\x05 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\x12M\n\x15response_trailer_mode\x18\x06 \x01(\x0e\x32..agentmesh.v1.ExtProcProcessingMode.HeaderMode\"9\n\nHeaderMode\x12\x17\n\x13HEADER_MODE_DEFAULT\x10\x00\x12\x08\n\x04SEND\x10\x01\x12\x08\n\x04SKIP\x10\x02\"`\n\x08\x42odyMode\x12\x08\n\x04NONE\x10\x00\x12\x0c\n\x08STREAMED\x10\x01\x12\x0c\n\x08\x42UFFERED\x10\x02\x12\x14\n\x10\x42UFFERED_PARTIAL\x10\x03\x12\x18\n\x14\x46ULL_DUPLEX_STREAMED\x10\x04\"\xe1\x01\n\x10\x43redentialBroker\x12\x17\n\rstatic_secret\x18\x01 \x01(\tH\x00\x12\x37\n\x0foidc_federation\x18\x02 \x01(\x0b\x32\x1c.agentmesh.v1.OIDCFederationH\x00\x12\x36\n\x0f\x61ws_assume_role\x18\x03 \x01(\x0b\x32\x1b.agentmesh.v1.AWSAssumeRoleH\x00\x12;\n\x11platform_identity\x18\x04 \x01(\x0b\x32\x1e.agentmesh.v1.PlatformIdentityH\x00\x42\x06\n\x04kind\"_\n\x0eOIDCFederation\x12\x16\n\x0etoken_endpoint\x18\x01 \x01(\t\x12\x10\n\x08\x61udience\x18\x02 \x01(\t\x12\x13\n\x0bimpersonate\x18\x03 \x01(\t\x12\x0e\n\x06scopes\x18\x04 \x03(\t\"9\n\rAWSAssumeRole\x12\x10\n\x08role_arn\x18\x01 \x01(\t\x12\x16\n\x0esession_policy\x18\x02 \x01(\t\"\"\n\x10PlatformIdentity\x12\x0e\n\x06scopes\x18\x01 \x03(\t\".\n\rPolicyBinding\x12\x0c\n\x04role\x18\x01 \x01(\t\x12\x0f\n\x07members\x18\x02 \x03(\t\"\x97\x01\n\x0cPolicyConfig\x12\'\n\x05roles\x18\x01 \x03(\x0b\x32\x18.agentmesh.v1.PolicyRole\x12-\n\x08\x62indings\x18\x02 \x03(\x0b\x32\x1b.agentmesh.v1.PolicyBinding\x12/\n\x06\x65gress\x18\x03 \x03(\x0b\x32\x1f.agentmesh.v1.EgressDestination\"\x18\n\x16PolicyConfigGetRequest\"0\n\x17PolicyConfigGetResponse\x12\x15\n\rdatalog_rules\x18\x01 \x03(\t\"<\n\x1aPolicyConfigUpdateResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\"\x1a\n\x18\x45gressAssignmentsRequest\"L\n\x19\x45gressAssignmentsResponse\x12/\n\x06\x65gress\x18\x01 \x03(\x0b\x32\x1f.agentmesh.v1.EgressDestination\"f\n\x0cKeysResponse\x12\x13\n\x0bpublic_keys\x18\x01 \x03(\x0c\x12-\n\tsign_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x12\n\nsignatures\x18\x03 \x03(\x0c\"k\n\x13TokenRefreshRequest\x12\x1b\n\x13\x63hallenge_signature\x18\x01 \x01(\x0c\x12\x19\n\x11\x63hallenge_unix_ms\x18\x02 \x01(\x03\x12\x0f\n\x07peer_id\x18\x03 \x01(\t\x12\x0b\n\x03jwt\x18\x04 \x01(\t\"u\n\x14TokenRefreshResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x15\n\rerror_message\x18\x03 \x01(\t\"@\n\x11NodeCatalogReport\x12+\n\x08services\x18\x01 \x03(\x0b\x32\x19.agentmesh.v1.ServiceInfo\"%\n\x12TokenRevokeRequest\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\"5\n\x13TokenRevokeResponse\x12\x0f\n\x07success\x18\x01 \x01(\x08\x12\r\n\x05\x65rror\x18\x02 \x01(\t\"\xa9\x01\n\x1b\x42ootstrapTokenCreateRequest\x12\x0c\n\x04role\x18\x01 \x01(\t\x12\x10\n\x08owner_id\x18\x02 \x01(\t\x12\x11\n\tttl_hours\x18\x03 \x01(\x05\x12\x12\n\nmax_usages\x18\x04 \x01(\x05\x12\x13\n\x0b\x64\x65scription\x18\x05 \x01(\t\x12\x1b\n\x13\x61utonomous_recovery\x18\x06 \x01(\x08\x12\x11\n\tephemeral\x18\x07 \x01(\x08\"\x8a\x01\n\x1c\x42ootstrapTokenCreateResponse\x12\n\n\x02id\x18\x01 \x01(\t\x12\r\n\x05token\x18\x02 \x01(\t\x12\x0c\n\x04role\x18\x03 \x01(\t\x12\x10\n\x08owner_id\x18\x04 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xbe\x02\n\x0e\x42ootstrapToken\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0c\n\x04role\x18\x02 \x01(\t\x12\x10\n\x08owner_id\x18\x03 \x01(\t\x12\x12\n\nmax_usages\x18\x04 \x01(\x05\x12\x14\n\x0cusages_count\x18\x05 \x01(\x05\x12\x13\n\x0b\x64\x65scription\x18\x06 \x01(\t\x12/\n\x0b\x63reate_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0brevoke_time\x18\t \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x1b\n\x13\x61utonomous_recovery\x18\n \x01(\x08\x12\x11\n\tephemeral\x18\x0b \x01(\x08\"J\n\x1a\x42ootstrapTokenListResponse\x12,\n\x06tokens\x18\x01 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\"\xd6\x02\n\x11\x45nrollmentRequest\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0f\n\x07peer_id\x18\x02 \x01(\t\x12\x10\n\x08token_id\x18\x03 \x01(\t\x12.\n\x06status\x18\x04 \x01(\x0e\x32\x1e.agentmesh.v1.EnrollmentStatus\x12;\n\x06labels\x18\x05 \x03(\x0b\x32+.agentmesh.v1.EnrollmentRequest.LabelsEntry\x12/\n\x0b\x63reate_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x30\n\x0cresolve_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x13\n\x0bresolved_by\x18\x08 \x01(\t\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"R\n\x1d\x45nrollmentRequestListResponse\x12\x31\n\x08requests\x18\x01 \x03(\x0b\x32\x1f.agentmesh.v1.EnrollmentRequest\"p\n\x04User\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0e\n\x06issuer\x18\x02 \x01(\t\x12\r\n\x05\x65mail\x18\x03 \x01(\t\x12\x0c\n\x04role\x18\x04 \x01(\t\x12/\n\x0b\x63reate_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xf6\x02\n\x0c\x45nrolledNode\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0c\n\x04role\x18\x02 \x01(\t\x12\x17\n\x0f\x65nrollment_type\x18\x03 \x01(\t\x12\x13\n\x0b\x63laims_json\x18\x04 \x01(\t\x12\x10\n\x08owner_id\x18\x05 \x01(\t\x12\x36\n\x06labels\x18\x06 \x03(\x0b\x32&.agentmesh.v1.EnrolledNode.LabelsEntry\x12/\n\x0b\x65nroll_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0e\n\x06\x62\x61nned\x18\t \x01(\x08\x12\x1b\n\x13\x61utonomous_recovery\x18\n \x01(\x08\x12\x11\n\tephemeral\x18\x0b \x01(\x08\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xc4\x01\n\x0bRouterLease\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12\x35\n\x11last_renewal_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x17\n\x0f\x63onnected_peers\x18\x05 \x03(\t\x12\x10\n\x08\x64ht_size\x18\x06 \x01(\x05\"l\n\x0cNodeServices\x12+\n\x08services\x18\x01 \x03(\x0b\x32\x19.agentmesh.v1.ServiceInfo\x12/\n\x0breport_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xdb\x03\n\x13\x41\x64minStatusResponse\x12!\n\x05users\x18\x01 \x03(\x0b\x32\x12.agentmesh.v1.User\x12\x31\n\x0e\x61\x63tive_routers\x18\x02 \x03(\x0b\x32\x19.agentmesh.v1.RouterLease\x12\x32\n\x0e\x65nrolled_nodes\x18\x03 \x03(\x0b\x32\x1a.agentmesh.v1.EnrolledNode\x12<\n\x13\x65nrollment_requests\x18\x04 \x03(\x0b\x32\x1f.agentmesh.v1.EnrollmentRequest\x12\x36\n\x10\x62ootstrap_tokens\x18\x05 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\x12*\n\x06policy\x18\x06 \x01(\x0b\x32\x1a.agentmesh.v1.PolicyConfig\x12H\n\x0cnode_catalog\x18\x07 \x03(\x0b\x32\x32.agentmesh.v1.AdminStatusResponse.NodeCatalogEntry\x1aN\n\x10NodeCatalogEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12)\n\x05value\x18\x02 \x01(\x0b\x32\x1a.agentmesh.v1.NodeServices:\x02\x38\x01\"\x81\x02\n\x12UserStatusResponse\x12 \n\x04user\x18\x01 \x01(\x0b\x32\x12.agentmesh.v1.User\x12\x32\n\x0e\x65nrolled_nodes\x18\x02 \x03(\x0b\x32\x1a.agentmesh.v1.EnrolledNode\x12\x36\n\x10\x62ootstrap_tokens\x18\x03 \x03(\x0b\x32\x1c.agentmesh.v1.BootstrapToken\x12\x31\n\x0e\x61\x63tive_routers\x18\x04 \x03(\x0b\x32\x19.agentmesh.v1.RouterLease\x12*\n\x06policy\x18\x05 \x01(\x0b\x32\x1a.agentmesh.v1.PolicyConfig\"V\n\x10NodeListResponse\x12)\n\x05nodes\x18\x01 \x03(\x0b\x32\x1a.agentmesh.v1.EnrolledNode\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\"\xe4\x01\n\x18IdentityEvidenceResponse\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12\x37\n\x13\x62iscuit_expire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x19\n\x11\x63ontrol_plane_url\x18\x04 \x01(\t\x12\"\n\x1atrusted_control_plane_keys\x18\x05 \x03(\x0c\x12.\n\ncheck_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xc6\x02\n\x14PeerEvidenceResponse\x12\x0f\n\x07peer_id\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12\x15\n\rverifying_key\x18\x03 \x01(\x0c\x12\r\n\x05roles\x18\x04 \x03(\t\x12>\n\x06labels\x18\x05 \x03(\x0b\x32..agentmesh.v1.PeerEvidenceResponse.LabelsEntry\x12/\n\x0b\x65xpire_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x16\n\x0erevocation_ids\x18\x07 \x03(\t\x12.\n\ncheck_time\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x8c\x02\n\x10MemberCredential\x12\x19\n\x11\x63ontrol_plane_url\x18\x01 \x01(\t\x12\x0f\n\x07\x62iscuit\x18\x02 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x0ctrusted_keys\x18\x04 \x03(\x0b\x32\x1f.agentmesh.v1.TrustedSigningKey\x12\x19\n\x11issued_under_keys\x18\x05 \x03(\x0c\x12\x18\n\x10router_addresses\x18\x06 \x03(\t\x12/\n\x0coidc_session\x18\x07 \x01(\x0b\x32\x19.agentmesh.v1.OIDCSession\"Y\n\x11TrustedSigningKey\x12\x12\n\npublic_key\x18\x01 \x01(\x0c\x12\x30\n\x0creceive_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"Y\n\x0bOIDCSession\x12\x0e\n\x06issuer\x18\x01 \x01(\t\x12\x11\n\tclient_id\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x15\n\rrefresh_token\x18\x04 \x01(\t\"\x93\x01\n\x15TaskAuthorizationRule\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x14\n\x0c\x64isplay_name\x18\x02 \x01(\t\x12%\n\x05rules\x18\x03 \x03(\x0b\x32\x16.agentmesh.v1.TaskRule\x12/\n\x0b\x65xpire_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x84\x01\n\x08TaskRule\x12\x13\n\x0b\x64\x65scription\x18\x01 \x01(\t\x12\x18\n\x10\x61llowed_services\x18\x02 \x03(\t\x12.\n\toperation\x18\x03 \x01(\x0b\x32\x1b.agentmesh.v1.TaskOperation\x12\x19\n\x11\x61llowed_resources\x18\x04 \x03(\t\"s\n\rTaskOperation\x12\x15\n\rallowed_tools\x18\x01 \x03(\t\x12\x17\n\x0f\x61llowed_methods\x18\x02 \x03(\t\x12\x15\n\rallowed_paths\x18\x03 \x03(\t\x12\x1b\n\x13\x61llowed_permissions\x18\x04 \x03(\t\"\xab\x01\n\x14TokenExchangeRequest\x12\x15\n\rsubject_token\x18\x01 \x01(\t\x12\x36\n\ttask_rule\x18\x02 \x01(\x0b\x32#.agentmesh.v1.TaskAuthorizationRule\x12\x0c\n\x04seal\x18\x03 \x01(\x08\x12\x19\n\x11\x63hallenge_unix_ms\x18\x04 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x05 \x01(\x0c\"\x7f\n\x15TokenExchangeResponse\x12\x15\n\rbiscuit_token\x18\x01 \x01(\x0c\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\r\n\x05roles\x18\x03 \x03(\t\x12\x0f\n\x07subject\x18\x04 \x01(\t\"\x81\x01\n\x0fSTSTokenRequest\x12\x0f\n\x07\x62iscuit\x18\x01 \x01(\x0c\x12\x13\n\x0b\x64\x65stination\x18\x02 \x01(\t\x12\x10\n\x08\x61udience\x18\x03 \x01(\t\x12\x19\n\x11\x63hallenge_unix_ms\x18\x04 \x01(\x03\x12\x1b\n\x13\x63hallenge_signature\x18\x05 \x01(\x0c\"\x83\x01\n\x10STSTokenResponse\x12\x0b\n\x03jwt\x18\x01 \x01(\t\x12/\n\x0b\x65xpire_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0f\n\x07subject\x18\x03 \x01(\t\x12\r\n\x05roles\x18\x04 \x03(\t\x12\x11\n\ttask_name\x18\x05 \x01(\t\"F\n\x13RevocationsResponse\x12\x16\n\x0erevocation_ids\x18\x01 \x03(\t\x12\x17\n\x0f\x62\x61nned_peer_ids\x18\x02 \x03(\t*\x94\x01\n\x10\x45nrollmentStatus\x12!\n\x1d\x45NROLLMENT_STATUS_UNSPECIFIED\x10\x00\x12\x1d\n\x19\x45NROLLMENT_STATUS_PENDING\x10\x01\x12\x1e\n\x1a\x45NROLLMENT_STATUS_APPROVED\x10\x02\x12\x1e\n\x1a\x45NROLLMENT_STATUS_REJECTED\x10\x03*\x8c\x01\n\x0bServiceType\x12\x1c\n\x18SERVICE_TYPE_UNSPECIFIED\x10\x00\x12\x14\n\x10SERVICE_TYPE_MCP\x10\x01\x12\x1a\n\x16SERVICE_TYPE_INFERENCE\x10\x02\x12\x14\n\x10SERVICE_TYPE_A2A\x10\x03\x12\x17\n\x13SERVICE_TYPE_EGRESS\x10\x04*7\n\nEgressMode\x12\x14\n\x10\x45GRESS_MODE_HTTP\x10\x00\x12\x13\n\x0f\x45GRESS_MODE_TCP\x10\x01*\\\n\x12ResponseInspection\x12 \n\x1cRESPONSE_INSPECTION_BUFFERED\x10\x00\x12$\n RESPONSE_INSPECTION_REQUEST_ONLY\x10\x01\x42!Z\x1fgithub.com/google/agentmesh/apib\x06proto3')
 
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, globals())
 _builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'agentmesh_pb2', globals())
@@ -39,14 +39,14 @@
   _ADMINSTATUSRESPONSE_NODECATALOGENTRY._serialized_options = b'8\001'
   _PEEREVIDENCERESPONSE_LABELSENTRY._options = None
   _PEEREVIDENCERESPONSE_LABELSENTRY._serialized_options = b'8\001'
-  _ENROLLMENTSTATUS._serialized_start=11566
-  _ENROLLMENTSTATUS._serialized_end=11714
-  _SERVICETYPE._serialized_start=11717
-  _SERVICETYPE._serialized_end=11857
-  _EGRESSMODE._serialized_start=11859
-  _EGRESSMODE._serialized_end=11914
-  _RESPONSEINSPECTION._serialized_start=11916
-  _RESPONSEINSPECTION._serialized_end=12008
+  _ENROLLMENTSTATUS._serialized_start=11623
+  _ENROLLMENTSTATUS._serialized_end=11771
+  _SERVICETYPE._serialized_start=11774
+  _SERVICETYPE._serialized_end=11914
+  _EGRESSMODE._serialized_start=11916
+  _EGRESSMODE._serialized_end=11971
+  _RESPONSEINSPECTION._serialized_start=11973
+  _RESPONSEINSPECTION._serialized_end=12065
   _AUTHFRAME._serialized_start=98
   _AUTHFRAME._serialized_end=150
   _AUTHRESPONSE._serialized_start=152
@@ -162,63 +162,63 @@
   _TOKENREVOKERESPONSE._serialized_start=6746
   _TOKENREVOKERESPONSE._serialized_end=6799
   _BOOTSTRAPTOKENCREATEREQUEST._serialized_start=6802
-  _BOOTSTRAPTOKENCREATEREQUEST._serialized_end=6952
-  _BOOTSTRAPTOKENCREATERESPONSE._serialized_start=6955
-  _BOOTSTRAPTOKENCREATERESPONSE._serialized_end=7093
-  _BOOTSTRAPTOKEN._serialized_start=7096
-  _BOOTSTRAPTOKEN._serialized_end=7395
-  _BOOTSTRAPTOKENLISTRESPONSE._serialized_start=7397
-  _BOOTSTRAPTOKENLISTRESPONSE._serialized_end=7471
-  _ENROLLMENTREQUEST._serialized_start=7474
-  _ENROLLMENTREQUEST._serialized_end=7816
+  _BOOTSTRAPTOKENCREATEREQUEST._serialized_end=6971
+  _BOOTSTRAPTOKENCREATERESPONSE._serialized_start=6974
+  _BOOTSTRAPTOKENCREATERESPONSE._serialized_end=7112
+  _BOOTSTRAPTOKEN._serialized_start=7115
+  _BOOTSTRAPTOKEN._serialized_end=7433
+  _BOOTSTRAPTOKENLISTRESPONSE._serialized_start=7435
+  _BOOTSTRAPTOKENLISTRESPONSE._serialized_end=7509
+  _ENROLLMENTREQUEST._serialized_start=7512
+  _ENROLLMENTREQUEST._serialized_end=7854
   _ENROLLMENTREQUEST_LABELSENTRY._serialized_start=825
   _ENROLLMENTREQUEST_LABELSENTRY._serialized_end=870
-  _ENROLLMENTREQUESTLISTRESPONSE._serialized_start=7818
-  _ENROLLMENTREQUESTLISTRESPONSE._serialized_end=7900
-  _USER._serialized_start=7902
-  _USER._serialized_end=8014
-  _ENROLLEDNODE._serialized_start=8017
-  _ENROLLEDNODE._serialized_end=8372
+  _ENROLLMENTREQUESTLISTRESPONSE._serialized_start=7856
+  _ENROLLMENTREQUESTLISTRESPONSE._serialized_end=7938
+  _USER._serialized_start=7940
+  _USER._serialized_end=8052
+  _ENROLLEDNODE._serialized_start=8055
+  _ENROLLEDNODE._serialized_end=8429
   _ENROLLEDNODE_LABELSENTRY._serialized_start=825
   _ENROLLEDNODE_LABELSENTRY._serialized_end=870
-  _ROUTERLEASE._serialized_start=8375
-  _ROUTERLEASE._serialized_end=8571
-  _NODESERVICES._serialized_start=8573
-  _NODESERVICES._serialized_end=8681
-  _ADMINSTATUSRESPONSE._serialized_start=8684
-  _ADMINSTATUSRESPONSE._serialized_end=9159
-  _ADMINSTATUSRESPONSE_NODECATALOGENTRY._serialized_start=9081
-  _ADMINSTATUSRESPONSE_NODECATALOGENTRY._serialized_end=9159
-  _USERSTATUSRESPONSE._serialized_start=9162
-  _USERSTATUSRESPONSE._serialized_end=9419
-  _NODELISTRESPONSE._serialized_start=9421
-  _NODELISTRESPONSE._serialized_end=9507
-  _IDENTITYEVIDENCERESPONSE._serialized_start=9510
-  _IDENTITYEVIDENCERESPONSE._serialized_end=9738
-  _PEEREVIDENCERESPONSE._serialized_start=9741
-  _PEEREVIDENCERESPONSE._serialized_end=10067
+  _ROUTERLEASE._serialized_start=8432
+  _ROUTERLEASE._serialized_end=8628
+  _NODESERVICES._serialized_start=8630
+  _NODESERVICES._serialized_end=8738
+  _ADMINSTATUSRESPONSE._serialized_start=8741
+  _ADMINSTATUSRESPONSE._serialized_end=9216
+  _ADMINSTATUSRESPONSE_NODECATALOGENTRY._serialized_start=9138
+  _ADMINSTATUSRESPONSE_NODECATALOGENTRY._serialized_end=9216
+  _USERSTATUSRESPONSE._serialized_start=9219
+  _USERSTATUSRESPONSE._serialized_end=9476
+  _NODELISTRESPONSE._serialized_start=9478
+  _NODELISTRESPONSE._serialized_end=9564
+  _IDENTITYEVIDENCERESPONSE._serialized_start=9567
+  _IDENTITYEVIDENCERESPONSE._serialized_end=9795
+  _PEEREVIDENCERESPONSE._serialized_start=9798
+  _PEEREVIDENCERESPONSE._serialized_end=10124
   _PEEREVIDENCERESPONSE_LABELSENTRY._serialized_start=825
   _PEEREVIDENCERESPONSE_LABELSENTRY._serialized_end=870
-  _MEMBERCREDENTIAL._serialized_start=10070
-  _MEMBERCREDENTIAL._serialized_end=10338
-  _TRUSTEDSIGNINGKEY._serialized_start=10340
-  _TRUSTEDSIGNINGKEY._serialized_end=10429
-  _OIDCSESSION._serialized_start=10431
-  _OIDCSESSION._serialized_end=10520
-  _TASKAUTHORIZATIONRULE._serialized_start=10523
-  _TASKAUTHORIZATIONRULE._serialized_end=10670
-  _TASKRULE._serialized_start=10673
-  _TASKRULE._serialized_end=10805
-  _TASKOPERATION._serialized_start=10807
-  _TASKOPERATION._serialized_end=10922
-  _TOKENEXCHANGEREQUEST._serialized_start=10925
-  _TOKENEXCHANGEREQUEST._serialized_end=11096
-  _TOKENEXCHANGERESPONSE._serialized_start=11098
-  _TOKENEXCHANGERESPONSE._serialized_end=11225
-  _STSTOKENREQUEST._serialized_start=11228
-  _STSTOKENREQUEST._serialized_end=11357
-  _STSTOKENRESPONSE._serialized_start=11360
-  _STSTOKENRESPONSE._serialized_end=11491
-  _REVOCATIONSRESPONSE._serialized_start=11493
-  _REVOCATIONSRESPONSE._serialized_end=11563
+  _MEMBERCREDENTIAL._serialized_start=10127
+  _MEMBERCREDENTIAL._serialized_end=10395
+  _TRUSTEDSIGNINGKEY._serialized_start=10397
+  _TRUSTEDSIGNINGKEY._serialized_end=10486
+  _OIDCSESSION._serialized_start=10488
+  _OIDCSESSION._serialized_end=10577
+  _TASKAUTHORIZATIONRULE._serialized_start=10580
+  _TASKAUTHORIZATIONRULE._serialized_end=10727
+  _TASKRULE._serialized_start=10730
+  _TASKRULE._serialized_end=10862
+  _TASKOPERATION._serialized_start=10864
+  _TASKOPERATION._serialized_end=10979
+  _TOKENEXCHANGEREQUEST._serialized_start=10982
+  _TOKENEXCHANGEREQUEST._serialized_end=11153
+  _TOKENEXCHANGERESPONSE._serialized_start=11155
+  _TOKENEXCHANGERESPONSE._serialized_end=11282
+  _STSTOKENREQUEST._serialized_start=11285
+  _STSTOKENREQUEST._serialized_end=11414
+  _STSTOKENRESPONSE._serialized_start=11417
+  _STSTOKENRESPONSE._serialized_end=11548
+  _REVOCATIONSRESPONSE._serialized_start=11550
+  _REVOCATIONSRESPONSE._serialized_end=11620
 # @@protoc_insertion_point(module_scope)
diff --git a/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.pyi b/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.pyi
index f814b46b..865d7aaf 100644
--- a/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.pyi
+++ b/sdk/python/src/agent_mesh/_proto/agentmesh_pb2.pyi
@@ -116,10 +116,11 @@ class BootstrapEnrollResponse(_message.Message):
     def __init__(self, status: _Optional[_Union[EnrollmentStatus, str]] = ..., biscuit_token: _Optional[bytes] = ..., poll_interval_seconds: _Optional[int] = ..., error_message: _Optional[str] = ..., control_plane_public_key: _Optional[bytes] = ..., router_addresses: _Optional[_Iterable[str]] = ..., expire_time: _Optional[_Union[_timestamp_pb2.Timestamp, _Mapping]] = ...) -> None: ...
 
 class BootstrapToken(_message.Message):
-    __slots__ = ["autonomous_recovery", "create_time", "description", "expire_time", "id", "max_usages", "owner_id", "revoke_time", "role", "usages_count"]
+    __slots__ = ["autonomous_recovery", "create_time", "description", "ephemeral", "expire_time", "id", "max_usages", "owner_id", "revoke_time", "role", "usages_count"]
     AUTONOMOUS_RECOVERY_FIELD_NUMBER: _ClassVar[int]
     CREATE_TIME_FIELD_NUMBER: _ClassVar[int]
     DESCRIPTION_FIELD_NUMBER: _ClassVar[int]
+    EPHEMERAL_FIELD_NUMBER: _ClassVar[int]
     EXPIRE_TIME_FIELD_NUMBER: _ClassVar[int]
     ID_FIELD_NUMBER: _ClassVar[int]
     MAX_USAGES_FIELD_NUMBER: _ClassVar[int]
@@ -130,6 +131,7 @@ class BootstrapToken(_message.Message):
     autonomous_recovery: bool
     create_time: _timestamp_pb2.Timestamp
     description: str
+    ephemeral: bool
     expire_time: _timestamp_pb2.Timestamp
     id: str
     max_usages: int
@@ -137,23 +139,25 @@ class BootstrapToken(_message.Message):
     revoke_time: _timestamp_pb2.Timestamp
     role: str
     usages_count: int
-    def __init__(self, id: _Optional[str] = ..., role: _Optional[str] = ..., owner_id: _Optional[str] = ..., max_usages: _Optional[int] = ..., usages_count: _Optional[int] = ..., description: _Optional[str] = ..., create_time: _Optional[_Union[_timestamp_pb2.Timestamp, _Mapping]] = ..., expire_time: _Optional[_Union[_timestamp_pb2.Timestamp, _Mapping]] = ..., revoke_time: _Optional[_Union[_timestamp_pb2.Timestamp, _Mapping]] = ..., autonomous_recovery: bool = ...) -> None: ...
+    def __init__(self, id: _Optional[str] = ..., role: _Optional[str] = ..., owner_id: _Optional[str] = ..., max_usages: _Optional[int] = ..., usages_count: _Optional[int] = ..., description: _Optional[str] = ..., create_time: _Optional[_Union[_timestamp_pb2.Timestamp, _Mapping]] = ..., expire_time: _Optional[_Union[_timestamp_pb2.Timestamp, _Mapping]] = ..., revoke_time: _Optional[_Union[_timestamp_pb2.Timestamp, _Mapping]] = ..., autonomous_recovery: bool = ..., ephemeral: bool = ...) -> None: ...
 
 class BootstrapTokenCreateRequest(_message.Message):
-    __slots__ = ["autonomous_recovery", "description", "max_usages", "owner_id", "role", "ttl_hours"]
+    __slots__ = ["autonomous_recovery", "description", "ephemeral", "max_usages", "owner_id", "role", "ttl_hours"]
     AUTONOMOUS_RECOVERY_FIELD_NUMBER: _ClassVar[int]
     DESCRIPTION_FIELD_NUMBER: _ClassVar[int]
+    EPHEMERAL_FIELD_NUMBER: _ClassVar[int]
     MAX_USAGES_FIELD_NUMBER: _ClassVar[int]
     OWNER_ID_FIELD_NUMBER: _ClassVar[int]
     ROLE_FIELD_NUMBER: _ClassVar[int]
     TTL_HOURS_FIELD_NUMBER: _ClassVar[int]
     autonomous_recovery: bool
     description: str
+    ephemeral: bool
     max_usages: int
     owner_id: str
     role: str
     ttl_hours: int
-    def __init__(self, role: _Optional[str] = ..., owner_id: _Optional[str] = ..., ttl_hours: _Optional[int] = ..., max_usages: _Optional[int] = ..., description: _Optional[str] = ..., autonomous_recovery: bool = ...) -> None: ...
+    def __init__(self, role: _Optional[str] = ..., owner_id: _Optional[str] = ..., ttl_hours: _Optional[int] = ..., max_usages: _Optional[int] = ..., description: _Optional[str] = ..., autonomous_recovery: bool = ..., ephemeral: bool = ...) -> None: ...
 
 class BootstrapTokenCreateResponse(_message.Message):
     __slots__ = ["expire_time", "id", "owner_id", "role", "token"]
@@ -372,7 +376,7 @@ class EnrollResponse(_message.Message):
     def __init__(self, biscuit_token: _Optional[bytes] = ..., error_message: _Optional[str] = ..., control_plane_public_key: _Optional[bytes] = ..., router_addresses: _Optional[_Iterable[str]] = ..., expire_time: _Optional[_Union[_timestamp_pb2.Timestamp, _Mapping]] = ...) -> None: ...
 
 class EnrolledNode(_message.Message):
-    __slots__ = ["autonomous_recovery", "banned", "claims_json", "enroll_time", "enrollment_type", "expire_time", "labels", "owner_id", "peer_id", "role"]
+    __slots__ = ["autonomous_recovery", "banned", "claims_json", "enroll_time", "enrollment_type", "ephemeral", "expire_time", "labels", "owner_id", "peer_id", "role"]
     class LabelsEntry(_message.Message):
         __slots__ = ["key", "value"]
         KEY_FIELD_NUMBER: _ClassVar[int]
@@ -385,6 +389,7 @@ class EnrolledNode(_message.Message):
     CLAIMS_JSON_FIELD_NUMBER: _ClassVar[int]
     ENROLLMENT_TYPE_FIELD_NUMBER: _ClassVar[int]
     ENROLL_TIME_FIELD_NUMBER: _ClassVar[int]
+    EPHEMERAL_FIELD_NUMBER: _ClassVar[int]
     EXPIRE_TIME_FIELD_NUMBER: _ClassVar[int]
     LABELS_FIELD_NUMBER: _ClassVar[int]
     OWNER_ID_FIELD_NUMBER: _ClassVar[int]
@@ -395,12 +400,13 @@ class EnrolledNode(_message.Message):
     claims_json: str
     enroll_time: _timestamp_pb2.Timestamp
     enrollment_type: str
+    ephemeral: bool
     expire_time: _timestamp_pb2.Timestamp
     labels: _containers.ScalarMap[str, str]
     owner_id: str
     peer_id: str
     role: str
-    def __init__(self, peer_id: _Optional[str] = ..., role: _Optional[str] = ..., enrollment_type: _Optional[str] = ..., claims_json: _Optional[str] = ..., owner_id: _Optional[str] = ..., labels: _Optional[_Mapping[str, str]] = ..., enroll_time: _Optional[_Union[_timestamp_pb2.Timestamp, _Mapping]] = ..., expire_time: _Optional[_Union[_timestamp_pb2.Timestamp, _Mapping]] = ..., banned: bool = ..., autonomous_recovery: bool = ...) -> None: ...
+    def __init__(self, peer_id: _Optional[str] = ..., role: _Optional[str] = ..., enrollment_type: _Optional[str] = ..., claims_json: _Optional[str] = ..., owner_id: _Optional[str] = ..., labels: _Optional[_Mapping[str, str]] = ..., enroll_time: _Optional[_Union[_timestamp_pb2.Timestamp, _Mapping]] = ..., expire_time: _Optional[_Union[_timestamp_pb2.Timestamp, _Mapping]] = ..., banned: bool = ..., autonomous_recovery: bool = ..., ephemeral: bool = ...) -> None: ...
 
 class EnrollmentRequest(_message.Message):
     __slots__ = ["create_time", "id", "labels", "peer_id", "resolve_time", "resolved_by", "status", "token_id"]
diff --git a/site/content/docs/concepts/identity.md b/site/content/docs/concepts/identity.md
index 4fb15ace..a16403db 100644
--- a/site/content/docs/concepts/identity.md
+++ b/site/content/docs/concepts/identity.md
@@ -188,7 +188,13 @@ Refresh without a fresh platform JWT is bounded by the **session**, which is
 a record on the control plane, not a field in the token. A human OIDC session
 lasts `--oidc-session-ttl` (90 days by default), and a workload OIDC session
 (`--workload-issuer`) lasts `--workload-session-ttl` (48 hours by default). A
-bootstrap enrollment has no session expiry. A ban also acts on the session
+bootstrap enrollment has no session expiry: the token was the proof the member
+gave once, and refreshing on its key is what keeps it enrolled. Its record is
+kept for `--node-retention` (30 days) after its last refresh and then deleted,
+as a self-hosted CI runner is removed after a fortnight without connecting; a
+member that comes back later enrolls again. A token minted with `ephemeral`
+enrolls members kept for `--ephemeral-node-retention` (an hour) instead, for
+fleets, probes and CI jobs that come and go. A ban also acts on the session
 record.
 
 A node that enrolled interactively with `--offline-access` also keeps an OIDC
diff --git a/site/content/docs/guides/headless-enrollment.md b/site/content/docs/guides/headless-enrollment.md
index 871433cd..be858390 100644
--- a/site/content/docs/guides/headless-enrollment.md
+++ b/site/content/docs/guides/headless-enrollment.md
@@ -231,6 +231,10 @@ afterwards:
 # on the token, at mint time
 -d '{"role":"mesh:role:node","max_usages":10,"autonomous_recovery":true}'
 
+# members that come and go (a fleet, a probe, a CI job): forgotten an hour
+# after they stop refreshing instead of kept for --node-retention
+-d '{"role":"mesh:role:node","max_usages":1000,"ephemeral":true}'
+
 # on an enrolled node
 curl -fsS -X POST https://mesh.example.com/admin/nodes/<peer-id>/autonomous-recovery \
   -H "Authorization: Bearer $AGENTMESH_ADMIN_TOKEN" -H "Content-Type: application/json" \
diff --git a/site/content/docs/reference/agentmesh-one.md b/site/content/docs/reference/agentmesh-one.md
index 2755bb36..a58e9464 100644
--- a/site/content/docs/reference/agentmesh-one.md
+++ b/site/content/docs/reference/agentmesh-one.md
@@ -65,6 +65,7 @@ of zero leaves the default of that component unchanged.
 | `--control-plane-biscuit-ttl` | `--biscuit-ttl` |
 | `--control-plane-workload-session-ttl` | `--workload-session-ttl` |
 | `--control-plane-node-retention` | `--node-retention` |
+| `--control-plane-ephemeral-node-retention` | `--ephemeral-node-retention` |
 | `--control-plane-manual-enrollment` | The opposite of `--auto-approve-enrollment`: queue bootstrap enrollments for approval. |
 | `--router-control-plane-sync-interval` | `agentmesh-router --control-plane-sync-interval` |
 | `--router-low-watermark`, `--router-high-watermark` | `--low-watermark`, `--high-watermark` |
diff --git a/site/content/docs/reference/control-plane.md b/site/content/docs/reference/control-plane.md
index 15f73a6c..b0d0d50f 100644
--- a/site/content/docs/reference/control-plane.md
+++ b/site/content/docs/reference/control-plane.md
@@ -39,7 +39,8 @@ agentmesh-control-plane admin unban --peer <id>     lift a ban
 | `--lease-duration` | `15m` | How long a router lease lasts without renewal. |
 | `--dht-replication` | `3` | How many routers each record a member announces is placed on: the router it announced to keeps it, and places a copy on this many routers closest to the key. A record on three routers survives two of them down at once; each replica more is a copy more of every record. Members are not concerned: they ask the routers they hold. Published on `/info`; every router of the mesh runs on it. |
 | `--dht-reprovide-interval` | `5m` | How often a member re-announces each service it publishes. A provider that stopped without unpublishing stays listed for three intervals, which is how long routers keep a record after its last announcement; the mesh pays its providers divided by the interval in announcements a minute. Published on `/info`. |
-| `--node-retention` | `720h` (30 days) | How long the record of an enrolled node is kept after its session expires. Banned nodes are kept forever. Must be positive; records are never kept forever. |
+| `--node-retention` | `720h` (30 days) | How long the record of an enrolled node is kept after its session expires, or, for a node enrolled with a bootstrap token, after its last refresh. Banned nodes are kept forever. Must be positive; records are never kept forever. |
+| `--ephemeral-node-retention` | `1h` | `--node-retention` for a node enrolled with an ephemeral bootstrap token (`BootstrapTokenCreateRequest.ephemeral`): how long after its last refresh its record is kept. For members that come and go: a fleet in a scale test, a probe, a CI job. |
 | `--mesh-reconnect-interval` | `30s` | How often the event publisher re-reads the router leases and dials any router it is not connected to. On each router it runs the mesh handshake with a credential it mints for its own peer under the signing key, with the role `mesh:role:control-plane`, so the router holds its connection as a member's. |
 | `--log-level` | `info` | `debug`, `info`, `warn`, `error`. |
 | `--log-format` | `text` | `text` or `json`. |
@@ -112,7 +113,7 @@ names; unknown fields are rejected.
 | `GET /admin/policy` | The mesh policy as `PolicyConfig`, the same document `POST /policies` takes. |
 | `POST /policies`, `PUT /policies` | Replace the mesh policy. The body is `PolicyConfig`, so a misspelt grant fails instead of being dropped. |
 | `GET /admin/bootstrap-tokens` | `BootstrapTokenListResponse`: every token, including revoked and expired ones. |
-| `POST /admin/bootstrap-tokens` | Mint a token. Body `BootstrapTokenCreateRequest`: `role` (required), `ttl_hours` (default 24), `max_usages` (default 1), `description`, `autonomous_recovery` (default false). Returns `201` with `BootstrapTokenCreateResponse`: `id`, `token` (shown once), `role`, `expire_time`. |
+| `POST /admin/bootstrap-tokens` | Mint a token. Body `BootstrapTokenCreateRequest`: `role` (required), `ttl_hours` (default 24), `max_usages` (default 1), `description`, `autonomous_recovery` (default false), `ephemeral` (default false: nodes enrolled with the token are kept for `--ephemeral-node-retention` after their last refresh instead of `--node-retention`). Returns `201` with `BootstrapTokenCreateResponse`: `id`, `token` (shown once), `role`, `expire_time`. |
 | `DELETE /admin/bootstrap-tokens/{id}` | Revoke a token. Can be repeated. The token stays in the list with `revoke_time` set. |
 | `GET /admin/enrollments` | `EnrollmentRequestListResponse`: bootstrap enrollment requests, pending and decided. |
 | `POST /admin/enrollments/{id}/approve` | Approve. Spends a token usage. Checks the token again, and checks the labels against the role's `allowed_labels`. |
@@ -149,12 +150,29 @@ with `403`). The console uses these routes.
   routers that start or restart. A signed mesh event reaches the ones that
   are already running.
 - **Node records are garbage-collected.** A node whose session has expired is
-  deleted after `--node-retention`. A node without a persistent data
-  directory enrolls a new identity on every restart, so without this the
-  node table would only grow.
+  deleted after `--node-retention`. A node enrolled with a bootstrap token
+  has no session; its record is deleted once it has not refreshed its
+  credential for `--node-retention`, or for `--ephemeral-node-retention`
+  when the token was ephemeral, and a node that comes back after that
+  enrolls again. A node without a persistent data directory enrolls a new
+  identity on every restart, so without this the node table would only grow.
+  `agentmesh_control_plane_nodes_deleted_total{reason}` counts the deletions:
+  `session`, `silent`, `ephemeral`.
+- **The records around an enrollment are garbage-collected with it.** The
+  same sweep deletes enrollment requests resolved, or left pending, for
+  `--node-retention` (for `--ephemeral-node-retention` when an ephemeral
+  token made them), bootstrap tokens that expired `--node-retention` ago and
+  that no remaining request refers to, and router leases that expired
+  `--node-retention` ago. It also drops the service report held in memory
+  for every node that is no longer admitted.
+  `agentmesh_control_plane_storage_rows_deleted_total{table}` counts these
+  deletions; `agentmesh_control_plane_storage_rows{table}` is the size of
+  each table, and a table that keeps growing past its retention is a sweep
+  that is failing, which the log says.
 
 ## Metrics
 
 `/metrics` exposes `agentmesh_control_plane_*` counters and gauges: enrolled nodes
 by role and state, active routers, mesh-connected peers as reported by
-router leases, per-route request counts and latencies, and the Go runtime.
+router leases, rows per store table, service reports held in memory,
+per-route request counts and latencies, and the Go runtime.
diff --git a/tests/integration/node_lifecycle_test.go b/tests/integration/node_lifecycle_test.go
index b7f9afd7..3eb2f8a0 100644
--- a/tests/integration/node_lifecycle_test.go
+++ b/tests/integration/node_lifecycle_test.go
@@ -22,6 +22,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"sync"
 	"testing"
@@ -91,6 +92,92 @@ func (m *oidcMember) refresh(t *testing.T, cpURL, jwt string) (int, string) {
 	return resp.StatusCode, string(data)
 }
 
+// bootstrapMember is a member enrolled with a bootstrap token, driven over
+// the control plane API alone: the test decides when it refreshes.
+type bootstrapMember struct {
+	priv    crypto.PrivKey
+	peerID  peer.ID
+	biscuit []byte
+}
+
+// enrollBootstrapMember spends one use of token at POST /enroll.
+func enrollBootstrapMember(t *testing.T, cpURL, token string) *bootstrapMember {
+	t.Helper()
+	priv, _, err := crypto.GenerateKeyPair(crypto.Ed25519, -1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pID, err := peer.IDFromPrivateKey(priv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pub, err := crypto.MarshalPublicKey(priv.GetPublic())
+	if err != nil {
+		t.Fatal(err)
+	}
+	ts := time.Now().UnixMilli()
+	sig, err := priv.Sign(api.EnrollChallenge(pID.String(), ts))
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, err := proto.Marshal(&api.BootstrapEnrollRequest{
+		BootstrapToken: token, PeerId: pID.String(), PublicKey: pub, RequestedRole: api.RoleNode,
+		ChallengeUnixMs: ts, ChallengeSignature: sig,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := http.Post(cpURL+"/enroll", "application/x-protobuf", bytes.NewReader(body))
+	if err != nil {
+		t.Fatalf("POST /enroll: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	data, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("POST /enroll: %d %s", resp.StatusCode, data)
+	}
+	var enrolled api.BootstrapEnrollResponse
+	if err := proto.Unmarshal(data, &enrolled); err != nil {
+		t.Fatal(err)
+	}
+	if enrolled.Status != api.EnrollmentStatus_ENROLLMENT_STATUS_APPROVED || len(enrolled.BiscuitToken) == 0 {
+		t.Fatalf("POST /enroll answered %s: %s", enrolled.Status, enrolled.ErrorMessage)
+	}
+	return &bootstrapMember{priv: priv, peerID: pID, biscuit: enrolled.BiscuitToken}
+}
+
+// refresh is one POST /refresh with the member's current credential; on
+// success the member holds the new one. It returns the status and body.
+func (m *bootstrapMember) refresh(t *testing.T, cpURL string) (int, string) {
+	t.Helper()
+	ts := time.Now().UnixMilli()
+	sig, err := m.priv.Sign(api.RefreshChallenge(m.peerID.String(), ts))
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, err := proto.Marshal(&api.TokenRefreshRequest{ChallengeUnixMs: ts, ChallengeSignature: sig})
+	if err != nil {
+		t.Fatal(err)
+	}
+	req, _ := http.NewRequest(http.MethodPost, cpURL+"/refresh", bytes.NewReader(body))
+	req.Header.Set("Authorization", "Bearer "+base64.StdEncoding.EncodeToString(m.biscuit))
+	req.Header.Set("Content-Type", "application/x-protobuf")
+	resp, err := (&http.Client{Timeout: 5 * time.Second}).Do(req)
+	if err != nil {
+		t.Fatalf("POST /refresh: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	data, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode == http.StatusOK {
+		var refreshed api.TokenRefreshResponse
+		if err := proto.Unmarshal(data, &refreshed); err != nil {
+			t.Fatal(err)
+		}
+		m.biscuit = refreshed.BiscuitToken
+	}
+	return resp.StatusCode, string(data)
+}
+
 // listNodes is GET /user/nodes as the administrator, one page.
 func listNodes(t *testing.T, cpURL, adminToken, query string) *api.NodeListResponse {
 	t.Helper()
@@ -270,8 +357,8 @@ func TestLapsedMembersAreCollected(t *testing.T) {
 		}
 		time.Sleep(200 * time.Millisecond)
 	}
-	if v, ok := controlPlaneMetric(t, cpURL, "agentmesh_control_plane_nodes_deleted_total"); !ok || v != leaving {
-		t.Errorf("nodes_deleted_total = %v (present %v), want %d", v, ok, leaving)
+	if v, ok := controlPlaneMetric(t, cpURL, `agentmesh_control_plane_nodes_deleted_total{reason="session"}`); !ok || v != leaving {
+		t.Errorf("nodes_deleted_total{reason=session} = %v (present %v), want %d", v, ok, leaving)
 	}
 	stopRefreshing()
 	if err := <-refreshed; err != nil {
@@ -284,3 +371,178 @@ func TestLapsedMembersAreCollected(t *testing.T) {
 		t.Fatalf("admin status after the sweep lists %d nodes, want 1", len(nodes))
 	}
 }
+
+// TestSilentEphemeralMembersAreForgotten is the ladder's fleet and the
+// probe's identities in seconds. A bootstrap enrollment has no session, so
+// a member that leaves used to stay enrolled forever; it is now forgotten
+// once it has not refreshed for the retention, and a member an ephemeral
+// token enrolled, which the ladder and the probes mint, within the
+// ephemeral retention. A regular member that is silent for less than the
+// retention, and one that refreshes, stay.
+func TestSilentEphemeralMembersAreForgotten(t *testing.T) {
+	tmpDir := t.TempDir()
+	oidcURL, _ := startCustomMockOIDC(t)
+	policyFile := filepath.Join(tmpDir, "policies.yaml")
+	if err := os.WriteFile(policyFile, []byte("roles: []\nbindings: []\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	// Ephemeral members are kept for a second after their last refresh,
+	// regular ones for an hour; the GC sweeps every second for the shorter
+	// of the two to matter.
+	cpPort, _ := startControlPlane(t, tmpDir, oidcURL, policyFile,
+		"--auto-approve-enrollment",
+		"--ephemeral-node-retention", "1s",
+		"--node-retention", "10s",
+	)
+	cpURL := fmt.Sprintf("http://127.0.0.1:%d", cpPort)
+
+	const fleet = 12
+	ephemeralToken := mintBootstrapTokenWithUses(t, cpURL, testAdminToken, fleet, true)
+	regularToken := mintBootstrapTokenWithUses(t, cpURL, testAdminToken, 2, false)
+	silent := enrollBootstrapMember(t, cpURL, regularToken)
+	refreshing := enrollBootstrapMember(t, cpURL, regularToken)
+	members := make([]*bootstrapMember, fleet)
+	for i := range members {
+		members[i] = enrollBootstrapMember(t, cpURL, ephemeralToken)
+	}
+	enrolledAt := time.Now()
+	if got := len(fetchAdminStatus(t, cpPort, testAdminToken).GetEnrolledNodes()); got != fleet+2 {
+		t.Fatalf("admin status lists %d nodes right after enrollment, want %d", got, fleet+2)
+	}
+	for _, n := range fetchAdminStatus(t, cpPort, testAdminToken).GetEnrolledNodes() {
+		if n.GetEphemeral() != (n.GetPeerId() != silent.peerID.String() && n.GetPeerId() != refreshing.peerID.String()) {
+			t.Fatalf("node %s ephemeral=%v, want the flag on the fleet's members only", n.GetPeerId(), n.GetEphemeral())
+		}
+	}
+
+	// The fleet falls silent and is forgotten; the regular members stay,
+	// the one that refreshes with its row's last refresh moving.
+	if status, body := refreshing.refresh(t, cpURL); status != http.StatusOK {
+		t.Fatalf("refresh: %d %s", status, body)
+	}
+	deadline := time.Now().Add(8 * time.Second)
+	for {
+		nodes := fetchAdminStatus(t, cpPort, testAdminToken).GetEnrolledNodes()
+		if len(nodes) == 2 {
+			var left []string
+			for _, n := range nodes {
+				left = append(left, n.GetPeerId())
+			}
+			slices.Sort(left)
+			want := []string{silent.peerID.String(), refreshing.peerID.String()}
+			slices.Sort(want)
+			if !slices.Equal(left, want) {
+				t.Fatalf("after the sweep the status lists %v, want the two regular members %v", left, want)
+			}
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("%d nodes still listed %s after the fleet enrolled; want the fleet forgotten after a second of silence", len(nodes), time.Since(enrolledAt))
+		}
+		time.Sleep(200 * time.Millisecond)
+	}
+	if v, ok := controlPlaneMetric(t, cpURL, `agentmesh_control_plane_nodes_deleted_total{reason="ephemeral"}`); !ok || v != fleet {
+		t.Errorf("nodes_deleted_total{reason=ephemeral} = %v (present %v), want %d", v, ok, fleet)
+	}
+	if v, ok := controlPlaneMetric(t, cpURL, `agentmesh_control_plane_nodes_deleted_total{reason="silent"}`); !ok || v != 0 {
+		t.Errorf("nodes_deleted_total{reason=silent} = %v (present %v), want 0: the regular members are within their retention", v, ok)
+	}
+
+	// The fleet's enrollment requests go with its rows: auto-approval wrote
+	// one per member, and a table of approved requests from members long
+	// gone is what the testnet accumulated a hundred thousand of. The two
+	// regular members' requests are within their retention and stay.
+	if v, ok := controlPlaneMetric(t, cpURL, `agentmesh_control_plane_storage_rows_deleted_total{table="enrollment_requests"}`); !ok || v != fleet {
+		t.Errorf("storage_rows_deleted_total{table=enrollment_requests} = %v (present %v), want %d", v, ok, fleet)
+	}
+	requests := fetchAdminEnrollments(t, cpURL, testAdminToken)
+	if len(requests) != 2 {
+		var left []string
+		for _, r := range requests {
+			left = append(left, r.GetPeerId())
+		}
+		t.Errorf("%d enrollment requests remain after the sweep (%v), want the two regular members' only", len(requests), left)
+	}
+	for _, r := range requests {
+		if r.GetPeerId() != silent.peerID.String() && r.GetPeerId() != refreshing.peerID.String() {
+			t.Errorf("enrollment request of %s survived the sweep; it belongs to the forgotten fleet", r.GetPeerId())
+		}
+	}
+	// Both tokens are within their hour; no lease was ever taken.
+	for _, series := range []string{
+		`agentmesh_control_plane_storage_rows_deleted_total{table="bootstrap_tokens"}`,
+		`agentmesh_control_plane_storage_rows_deleted_total{table="routers"}`,
+	} {
+		if v, ok := controlPlaneMetric(t, cpURL, series); !ok || v != 0 {
+			t.Errorf("%s = %v (present %v), want 0", series, v, ok)
+		}
+	}
+	for _, table := range []string{"nodes", "enrollment_requests", "bootstrap_tokens", "routers"} {
+		if _, ok := controlPlaneMetric(t, cpURL, fmt.Sprintf(`agentmesh_control_plane_storage_rows{table="%s"}`, table)); !ok {
+			t.Errorf("/metrics lacks agentmesh_control_plane_storage_rows{table=%q}", table)
+		}
+	}
+
+	// A forgotten member is a stranger: its credential still verifies, its
+	// row is gone, so it is told to enroll again. The regular ones refresh.
+	if status, body := members[0].refresh(t, cpURL); status != http.StatusUnauthorized {
+		t.Fatalf("refresh of a forgotten member: %d %s, want 401", status, strings.TrimSpace(body))
+	}
+	for _, m := range []*bootstrapMember{silent, refreshing} {
+		if status, body := m.refresh(t, cpURL); status != http.StatusOK {
+			t.Fatalf("refresh of a regular member after the sweep: %d %s", status, body)
+		}
+	}
+}
+
+// fetchAdminEnrollments lists every enrollment request the control plane
+// still holds.
+func fetchAdminEnrollments(t *testing.T, cpURL, adminToken string) []*api.EnrollmentRequest {
+	t.Helper()
+	req, err := http.NewRequest(http.MethodGet, cpURL+"/admin/enrollments", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Authorization", "Bearer "+adminToken)
+	resp, err := (&http.Client{Timeout: 5 * time.Second}).Do(req)
+	if err != nil {
+		t.Fatalf("GET /admin/enrollments: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	data, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("GET /admin/enrollments: %d %s", resp.StatusCode, data)
+	}
+	var list api.EnrollmentRequestListResponse
+	if err := protojson.Unmarshal(data, &list); err != nil {
+		t.Fatalf("decode /admin/enrollments: %v", err)
+	}
+	return list.GetRequests()
+}
+
+// mintBootstrapTokenWithUses mints a node bootstrap token good for uses
+// enrollments, ephemeral or not.
+func mintBootstrapTokenWithUses(t *testing.T, cpURL, adminToken string, uses int, ephemeral bool) string {
+	t.Helper()
+	body, err := protojson.Marshal(&api.BootstrapTokenCreateRequest{Role: api.RoleNode, TtlHours: 1, MaxUsages: int32(uses), Description: "lifecycle", Ephemeral: ephemeral})
+	if err != nil {
+		t.Fatal(err)
+	}
+	req, _ := http.NewRequest(http.MethodPost, cpURL+"/admin/bootstrap-tokens", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+adminToken)
+	resp, err := (&http.Client{Timeout: 5 * time.Second}).Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	data, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("POST /admin/bootstrap-tokens: %d %s", resp.StatusCode, data)
+	}
+	var created api.BootstrapTokenCreateResponse
+	if err := protojson.Unmarshal(data, &created); err != nil {
+		t.Fatal(err)
+	}
+	return created.GetToken()
+}
diff --git a/tests/scale/member-journey.sh b/tests/scale/member-journey.sh
index fe7a62df..2c67d100 100755
--- a/tests/scale/member-journey.sh
+++ b/tests/scale/member-journey.sh
@@ -196,7 +196,7 @@ admin_api() {
 mint_token() {
   local uses=$(( COUNT + 2 * LATE + 5 ))
   admin_api POST /admin/bootstrap-tokens -H 'Content-Type: application/json' \
-    -d "{\"role\":\"mesh:role:node\",\"max_usages\":${uses},\"ttl_hours\":48,\"description\":\"member-journey ${COUNT}+${LATE} from $(hostname)\"}" \
+    -d "{\"role\":\"mesh:role:node\",\"max_usages\":${uses},\"ttl_hours\":48,\"ephemeral\":true,\"description\":\"member-journey ${COUNT}+${LATE} from $(hostname)\"}" \
     > "$OUT/token.json" || fail "minting a bootstrap token failed"
   python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["token"])' "$OUT/token.json" > "$OUT/bootstrap-token"
   TOKEN_ID=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["id"])' "$OUT/token.json")
diff --git a/tests/scale/member-ladder.sh b/tests/scale/member-ladder.sh
index 2dd4c28e..3b13057f 100755
--- a/tests/scale/member-ladder.sh
+++ b/tests/scale/member-ladder.sh
@@ -176,7 +176,7 @@ summarize() {
 # One token for the whole ladder.
 uses=$(( TOTAL + TOTAL / 10 + 20 ))
 admin_api POST /admin/bootstrap-tokens -H 'Content-Type: application/json' \
-  -d "{\"role\":\"mesh:role:node\",\"max_usages\":${uses},\"ttl_hours\":48,\"description\":\"member-ladder ${TOTAL} from ${#ALL_MINIONS[@]} minions\"}" > "$OUT/token.json" || fail "minting the bootstrap token failed"
+  -d "{\"role\":\"mesh:role:node\",\"max_usages\":${uses},\"ttl_hours\":48,\"ephemeral\":true,\"description\":\"member-ladder ${TOTAL} from ${#ALL_MINIONS[@]} minions\"}" > "$OUT/token.json" || fail "minting the bootstrap token failed"
 python3 -c 'import json,sys; t=json.load(open(sys.argv[1])); open(sys.argv[2],"w").write(t["token"])' "$OUT/token.json" "$OUT/bootstrap-token"
 TOKEN_ID=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["id"])' "$OUT/token.json")
 rm -f "$OUT/token.json"; chmod 600 "$OUT/bootstrap-token"