diff --git a/AGENTS.md b/AGENTS.md
index 1838e60..add5641 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -59,6 +59,12 @@ woff2, strict CSP, no runtime CDN) for air-gap use.
   encrypted key backup (PBES2 PKCS#8), reads it back, and builds the PKCS#12 with the backup's
   own passphrase; the credential wizards hold only the encrypted backup in memory. Tests assert
   on the request bodies that neither the key nor the passphrase is ever sent.
+- First run: `BootstrapGate` (`src/components/layout/bootstrap-gate.tsx`) wraps the auth gate and
+  asks `GetBootstrapState` before anything else. Open first run tries WhoAmI, then shows the
+  `FirstRunWizard` (`src/components/first-run/`). `src/lib/bootstrap.ts` keeps the session secret
+  in module memory only and sends it as the `Fleetos-Bootstrap-Session` header; never put it in
+  web storage, a cookie or a URL. Mock mode keeps first run closed; set
+  `VITE_BOOTSTRAP_MOCK_STATE=open` to try the wizard offline.
 - Operator CA registration is a preview then a confirm with `confirm_sha256`.
   `OperatorCARegisterForm` takes the submit call as a prop, so the admin page and first run share
   it; `registerRequestFields()` builds the body both RegisterOperatorCA RPCs take.
diff --git a/README.md b/README.md
index 058db7c..abe7cf9 100644
--- a/README.md
+++ b/README.md
@@ -27,6 +27,10 @@ The same bundle adapts at runtime based on the role of the node being viewed:
 - 🔌 **Intermediate / Issuing nodes** — issuance profiles, certificate inventory, CSR review, CRL / OCSP status, adapter health, audit log tail.
 - 👁️ **All nodes** — live status, configuration view (read-only when the node is linked to FM, which is the normal mode).
 
+## 🚀 First run
+
+A new Fleet Manager with no operator CA configured starts in first run. Before sign-in the web UI asks the manager for its first-run state. While it is open, a wizard takes the single-use bootstrap token from the manager's log (after a check of the server certificate's fingerprint), registers your external operator CA with its CRL source and OCSP mode once you confirm its fingerprint, and gets the first admin certificate. Path A makes the key in the browser, with a mandatory encrypted key backup, then builds the PKCS#12 once your CA signs the CSR. Path B gives the OpenSSL recipe and an optional pre-flight. It ends with install steps for each OS. The session secret stays in memory only.
+
 ## 🪪 Operator credentials
 
 Operator certificates come from your own external operator CA (an offline OpenSSL CA or an enterprise CA). The Fleet Manager never signs one; it records them and can deny them.
diff --git a/src/App.test.tsx b/src/App.test.tsx
index be07b05..c83fc50 100644
--- a/src/App.test.tsx
+++ b/src/App.test.tsx
@@ -50,9 +50,11 @@ describe("App routing", () => {
     expect(screen.queryByRole("button", { name: /log in/i })).not.toBeInTheDocument();
   });
 
-  it("keeps the console behind the login gate", () => {
+  // The gate asks the Fleet Manager whether first run is open before it shows
+  // the sign-in, so the Log in button appears once that answer is in.
+  it("keeps the console behind the login gate", async () => {
     renderAt("/agent-keys");
 
-    expect(screen.getByRole("button", { name: /log in/i })).toBeInTheDocument();
+    expect(await screen.findByRole("button", { name: /log in/i })).toBeInTheDocument();
   });
 });
diff --git a/src/App.tsx b/src/App.tsx
index d226ea8..a361507 100644
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -18,6 +18,7 @@ import { Route, Routes } from "react-router-dom";
 
 import { AppShell } from "@/components/layout/app-shell";
 import { AuthGate } from "@/components/layout/auth-gate";
+import { BootstrapGate } from "@/components/layout/bootstrap-gate";
 import { AdoptPage } from "@/pages/adopt";
 import { AgentKeysPage } from "@/pages/agent-keys";
 import { ApprovalsPage } from "@/pages/approvals";
@@ -54,9 +55,11 @@ export const App = () => {
       <Route element={<CredentialRequestPage />} path="request-credential" />
       <Route
         element={
-          <AuthGate>
-            <AppShell />
-          </AuthGate>
+          <BootstrapGate>
+            <AuthGate>
+              <AppShell />
+            </AuthGate>
+          </BootstrapGate>
         }
       >
         <Route element={<DashboardPage />} index />
diff --git a/src/components/first-run/admin-step.tsx b/src/components/first-run/admin-step.tsx
new file mode 100644
index 0000000..1468228
--- /dev/null
+++ b/src/components/first-run/admin-step.tsx
@@ -0,0 +1,406 @@
+/*
+Copyright The CryptOS Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { useState } from "react";
+
+import { CopyBlock } from "@/components/copy-block";
+import { KeyBackupStep } from "@/components/key-backup-step";
+import { Button } from "@/components/ui/button";
+import { type FirstAdminResult, submitFirstAdminCertificate } from "@/lib/bootstrap";
+import {
+  buildCredentialPkcs12,
+  keyMatchesCertificate,
+  readCertificateDer,
+  readKeyBackup,
+} from "@/lib/crypto/key-backup";
+import { downloadBytes, readFileBytes } from "@/lib/download";
+import { fleetErrorMessage } from "@/lib/fleet/error-copy";
+import { fieldClass, labelClass, looksLikeEmail } from "@/lib/form";
+import { credentialFileBase, csrToPem, levelOpensslCommand } from "@/lib/operators";
+
+const SessionCaution = () => (
+  <p className="rounded-md border border-warning/40 bg-warning/10 p-3 text-xs text-muted-foreground">
+    The first-run session ends after 15 minutes without a call. If it ends while you are at the CA,
+    start again with the newest token from the log, confirm the CA&apos;s fingerprint again, and
+    continue from your key backup.
+  </p>
+);
+
+const certFrom = (text: string): Uint8Array =>
+  readCertificateDer(new TextEncoder().encode(text.trim()));
+
+// PathA: the browser makes the admin's P-384 key and CSR, with the key backup
+// saved first. The CA signs the CSR out of band; the signed certificate comes
+// back here, the manager checks and records it, and the browser builds the
+// PKCS#12 with the backup's passphrase.
+const PathA = ({
+  adminExtfile,
+  anchorDer,
+  onDone,
+}: {
+  adminExtfile: string;
+  anchorDer: null | Uint8Array;
+  onDone: () => void;
+}) => {
+  const [fullName, setFullName] = useState("");
+  const [email, setEmail] = useState("");
+  const [mode, setMode] = useState<"details" | "make" | "upload">("details");
+  const [backup, setBackup] = useState<null | Uint8Array>(null);
+  const [csrDer, setCsrDer] = useState<null | Uint8Array>(null);
+  const [certText, setCertText] = useState("");
+  const [chainText, setChainText] = useState("");
+  const [passphrase, setPassphrase] = useState("");
+  const [pending, setPending] = useState(false);
+  const [error, setError] = useState<null | string>(null);
+  const [result, setResult] = useState<FirstAdminResult | null>(null);
+
+  const cleanEmail = email.trim().toLowerCase();
+  const detailsReady = fullName.trim() !== "" && looksLikeEmail(email);
+
+  const record = async () => {
+    setPending(true);
+    setError(null);
+    try {
+      const certDer = certFrom(certText);
+      let chainDer: Uint8Array[] = [];
+      if (anchorDer) chainDer = [anchorDer];
+      else if (chainText.trim()) chainDer = [certFrom(chainText)];
+      const key = await readKeyBackup(backup ?? new Uint8Array(), passphrase);
+      if (!(await keyMatchesCertificate(key, certDer))) {
+        throw new Error(
+          "The certificate does not match the key in this backup. Check that it was signed from this CSR.",
+        );
+      }
+      let recorded: FirstAdminResult;
+      try {
+        recorded = await submitFirstAdminCertificate({
+          certDer,
+          csrDer: csrDer ?? undefined,
+          fullName,
+        });
+      } catch (error_: unknown) {
+        setError(fleetErrorMessage(error_, "Recording the certificate failed."));
+        return;
+      }
+      setResult(recorded);
+      const pfx = await buildCredentialPkcs12({
+        backup: backup ?? new Uint8Array(),
+        certDer,
+        chainDer,
+        friendlyName: `FleetOS admin (${cleanEmail})`,
+        passphrase,
+      });
+      downloadBytes(`${cleanEmail}.p12`, pfx, "application/x-pkcs12");
+      setPassphrase("");
+      onDone();
+    } catch (error_: unknown) {
+      setError(error_ instanceof Error ? error_.message : "Building the PKCS#12 failed.");
+    } finally {
+      setPending(false);
+    }
+  };
+
+  if (mode === "details") {
+    return (
+      <div className="space-y-3">
+        <label className="block space-y-1">
+          <span className={labelClass}>Full name</span>
+          <input
+            className={fieldClass}
+            onChange={(e) => setFullName(e.target.value)}
+            value={fullName}
+          />
+        </label>
+        <label className="block space-y-1">
+          <span className={labelClass}>Email (the certificate&apos;s CN)</span>
+          <input
+            autoComplete="off"
+            className={fieldClass}
+            onChange={(e) => setEmail(e.target.value)}
+            type="email"
+            value={email}
+          />
+        </label>
+        <div className="flex justify-end gap-2">
+          <Button
+            disabled={!detailsReady}
+            onClick={() => setMode("upload")}
+            size="sm"
+            variant="outline"
+          >
+            I already have a key backup
+          </Button>
+          <Button disabled={!detailsReady} onClick={() => setMode("make")} size="sm">
+            Make my admin key and CSR
+          </Button>
+        </div>
+      </div>
+    );
+  }
+
+  if (mode === "make" && !csrDer) {
+    return (
+      <KeyBackupStep
+        email={cleanEmail}
+        level="admin"
+        onBackedUp={(key) => {
+          setBackup(key.backup);
+          setCsrDer(key.csrDer);
+        }}
+      />
+    );
+  }
+
+  return (
+    <div className="space-y-3">
+      {csrDer ? (
+        <>
+          <CopyBlock
+            filename={`${credentialFileBase("admin", cleanEmail)}.csr`}
+            label="CSR"
+            text={csrToPem(csrDer)}
+          />
+          <CopyBlock label="Admin extension section" text={adminExtfile} />
+          <CopyBlock label="Signing command" text={levelOpensslCommand("admin", cleanEmail)} />
+          <p className="text-xs text-muted-foreground">
+            Take the CSR to your operator CA and sign it with the admin section above (add it to the
+            CA&apos;s OpenSSL config; never copy extensions from the CSR). Bring back the signed
+            certificate.
+          </p>
+          <SessionCaution />
+        </>
+      ) : (
+        <label className="block space-y-1 text-xs">
+          <span className={`${labelClass} block`}>Key backup file</span>
+          <input
+            accept=".pem,.key"
+            onChange={(e) => {
+              const chosen = e.target.files?.[0];
+              if (chosen) void readFileBytes(chosen).then(setBackup);
+            }}
+            type="file"
+          />
+        </label>
+      )}
+      <label className="block space-y-1">
+        <span className={labelClass}>Signed admin certificate (PEM)</span>
+        <textarea
+          className={`${fieldClass} h-28`}
+          onChange={(e) => setCertText(e.target.value)}
+          value={certText}
+        />
+      </label>
+      {anchorDer ? null : (
+        <label className="block space-y-1">
+          <span className={labelClass}>Operator CA certificate for the chain (optional)</span>
+          <textarea
+            className={`${fieldClass} h-20`}
+            onChange={(e) => setChainText(e.target.value)}
+            value={chainText}
+          />
+        </label>
+      )}
+      <label className="block space-y-1">
+        <span className={labelClass}>Key backup passphrase</span>
+        <input
+          autoComplete="off"
+          className={fieldClass}
+          onChange={(e) => setPassphrase(e.target.value)}
+          type="password"
+          value={passphrase}
+        />
+      </label>
+      {result?.warnings.map((w) => (
+        <p className="font-mono text-xs text-warning" key={w}>
+          {w}
+        </p>
+      ))}
+      {error ? (
+        <p className="font-mono text-xs text-destructive" role="alert">
+          {error}
+        </p>
+      ) : null}
+      <div className="flex justify-end">
+        <Button
+          disabled={!backup || certText.trim() === "" || passphrase === "" || pending}
+          onClick={() => void record()}
+          size="sm"
+        >
+          {pending ? "Working…" : "Record and build PKCS#12"}
+        </Button>
+      </div>
+    </div>
+  );
+};
+
+const pathBRecipe = (email: string): string =>
+  [
+    "# On your machine: the key and CSR (keep admin.key private)",
+    "openssl ecparam -name secp384r1 -genkey -noout -out admin.key",
+    `openssl req -new -key admin.key -sha384 -subj "/CN=${email}" -out admin.csr`,
+    "# At the CA: sign with the op_admin section",
+    "openssl ca -config operator-ca.cnf -extensions op_admin -notext -in admin.csr -out admin.crt",
+    "# On your machine: the PKCS#12 to install",
+    `openssl pkcs12 -export -inkey admin.key -in admin.crt -certfile operator-ca.crt -name "FleetOS admin (${email})" -out admin.p12`,
+  ].join("\n");
+
+// PathB: everything happens at the CA with OpenSSL. The optional pre-flight
+// sends only the certificate, so the manager can catch a missing or critical
+// level extension before the operator fights the browser's certificate store.
+const PathB = ({ adminExtfile, onDone }: { adminExtfile: string; onDone: () => void }) => {
+  const [email, setEmail] = useState("");
+  const [fullName, setFullName] = useState("");
+  const [certText, setCertText] = useState("");
+  const [pending, setPending] = useState(false);
+  const [error, setError] = useState<null | string>(null);
+  const [result, setResult] = useState<FirstAdminResult | null>(null);
+
+  const cleanEmail = email.trim().toLowerCase() || "you@example.org";
+
+  const preflight = async () => {
+    setPending(true);
+    setError(null);
+    try {
+      setResult(await submitFirstAdminCertificate({ certDer: certFrom(certText), fullName }));
+    } catch (error_: unknown) {
+      setError(fleetErrorMessage(error_, "The pre-flight failed."));
+    } finally {
+      setPending(false);
+    }
+  };
+
+  return (
+    <div className="space-y-3">
+      <label className="block space-y-1">
+        <span className={labelClass}>Email (the certificate&apos;s CN)</span>
+        <input
+          className={fieldClass}
+          onChange={(e) => setEmail(e.target.value)}
+          type="email"
+          value={email}
+        />
+      </label>
+      <CopyBlock label="Admin extension section" text={adminExtfile} />
+      <CopyBlock label="OpenSSL commands" text={pathBRecipe(cleanEmail)} />
+      <p className="text-xs text-muted-foreground">
+        Install the PKCS#12 yourself. Your first sign-in with it records the certificate as the
+        first admin and closes first run.
+      </p>
+      <div className="space-y-2 rounded-md border p-3">
+        <p className="text-sm font-semibold">Optional pre-flight</p>
+        <p className="text-xs text-muted-foreground">
+          Paste the signed certificate to have the Fleet Manager check it now. Only the certificate
+          is sent.
+        </p>
+        <label className="block space-y-1">
+          <span className={labelClass}>Full name</span>
+          <input
+            className={fieldClass}
+            onChange={(e) => setFullName(e.target.value)}
+            value={fullName}
+          />
+        </label>
+        <label className="block space-y-1">
+          <span className={labelClass}>Signed admin certificate (PEM)</span>
+          <textarea
+            className={`${fieldClass} h-24`}
+            onChange={(e) => setCertText(e.target.value)}
+            value={certText}
+          />
+        </label>
+        {error ? (
+          <p className="font-mono text-xs text-destructive" role="alert">
+            {error}
+          </p>
+        ) : null}
+        {result ? (
+          <p className="text-xs" role="status">
+            Recorded {result.email}, serial <span className="font-mono">{result.serialHex}</span>.
+            {result.warnings.length > 0 ? ` ${result.warnings.join(" ")}` : ""}
+          </p>
+        ) : null}
+        <Button
+          disabled={certText.trim() === "" || fullName.trim() === "" || pending}
+          onClick={() => void preflight()}
+          size="sm"
+          variant="outline"
+        >
+          Run the pre-flight
+        </Button>
+      </div>
+      <div className="flex justify-end">
+        <Button onClick={onDone} size="sm">
+          {result ? "Continue to install" : "Skip to install"}
+        </Button>
+      </div>
+    </div>
+  );
+};
+
+// AdminStep gets the first admin certificate, which the external CA signs.
+// The Fleet Manager never signs it.
+export const AdminStep = ({
+  adminExtfile,
+  anchorDer,
+  onDone,
+}: {
+  adminExtfile: string;
+  anchorDer: null | Uint8Array;
+  onDone: () => void;
+}) => {
+  const [path, setPath] = useState<"a" | "b">("a");
+  return (
+    <div className="space-y-4">
+      <fieldset className="space-y-2">
+        <legend className={labelClass}>How to make the certificate</legend>
+        <label className="flex items-start gap-2 text-sm">
+          <input
+            checked={path === "a"}
+            name="admin-path"
+            onChange={() => setPath("a")}
+            type="radio"
+          />
+          <span>
+            Path A (recommended): make the key here
+            <span className="block text-xs text-muted-foreground">
+              This browser makes the key and CSR; your CA signs the CSR; this page builds the
+              PKCS#12.
+            </span>
+          </span>
+        </label>
+        <label className="flex items-start gap-2 text-sm">
+          <input
+            checked={path === "b"}
+            name="admin-path"
+            onChange={() => setPath("b")}
+            type="radio"
+          />
+          <span>
+            Path B: everything at the CA with OpenSSL
+            <span className="block text-xs text-muted-foreground">
+              You make the key, certificate and PKCS#12 yourself.
+            </span>
+          </span>
+        </label>
+      </fieldset>
+      {path === "a" ? (
+        <PathA adminExtfile={adminExtfile} anchorDer={anchorDer} onDone={onDone} />
+      ) : (
+        <PathB adminExtfile={adminExtfile} onDone={onDone} />
+      )}
+    </div>
+  );
+};
diff --git a/src/components/first-run/ca-step.tsx b/src/components/first-run/ca-step.tsx
new file mode 100644
index 0000000..2d29609
--- /dev/null
+++ b/src/components/first-run/ca-step.tsx
@@ -0,0 +1,153 @@
+/*
+Copyright The CryptOS Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { useEffect, useState } from "react";
+
+import type { RegisterForm, RegisterResult } from "@/lib/operator-cas";
+
+import { OperatorCARegisterForm } from "@/components/operator-ca-register-form";
+import { Button } from "@/components/ui/button";
+import { registerOperatorCABootstrap } from "@/lib/bootstrap";
+import { readCertificateDer } from "@/lib/crypto/key-backup";
+import { colonFingerprint, normalizeFingerprint } from "@/lib/fingerprint";
+import { fleetErrorMessage } from "@/lib/fleet/error-copy";
+import { fieldClass, labelClass } from "@/lib/form";
+
+const EMPTY_FORM: RegisterForm = {
+  caCertDer: new Uint8Array(),
+  confirmSha256: "",
+  crl: { kind: "none" },
+  ocspMode: "aia",
+  ocspUrl: "",
+};
+
+const derOf = (bytes: Uint8Array): null | Uint8Array => {
+  try {
+    return readCertificateDer(bytes);
+  } catch {
+    return null;
+  }
+};
+
+// CaStep registers the external operator CA. When first run was already
+// started, a CA may be registered already: a new session keeps it but must
+// confirm its fingerprint again, so the operator always sees what they trust,
+// including a CA someone else registered with a leaked token.
+export const CaStep = ({
+  inProgress,
+  onRegistered,
+}: {
+  inProgress: boolean;
+  onRegistered: (result: RegisterResult, anchorDer: null | Uint8Array) => void;
+}) => {
+  const [current, setCurrent] = useState<"none" | null | RegisterResult>(
+    inProgress ? null : "none",
+  );
+  const [replace, setReplace] = useState(false);
+  const [pasted, setPasted] = useState("");
+  const [pending, setPending] = useState(false);
+  const [error, setError] = useState<null | string>(null);
+
+  useEffect(() => {
+    if (!inProgress) return;
+    let cancelled = false;
+    registerOperatorCABootstrap(EMPTY_FORM)
+      .then((r) => {
+        if (!cancelled) setCurrent(r.operatorCa.sha256 ? r : "none");
+      })
+      .catch(() => {
+        if (!cancelled) setCurrent("none");
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [inProgress]);
+
+  if (current === null) {
+    return (
+      <p className="font-mono text-xs text-muted-foreground" role="status">
+        Looking for a registered operator CA&hellip;
+      </p>
+    );
+  }
+
+  if (current !== "none" && !replace) {
+    const ca = current.operatorCa;
+    const matches = normalizeFingerprint(pasted) === ca.sha256;
+    const reconfirm = async () => {
+      setPending(true);
+      setError(null);
+      try {
+        const result = await registerOperatorCABootstrap({
+          ...EMPTY_FORM,
+          confirmSha256: ca.sha256,
+        });
+        onRegistered(result.confirmed ? result : { ...current, confirmed: true }, null);
+      } catch (error_: unknown) {
+        setError(fleetErrorMessage(error_, "Confirming the operator CA failed."));
+      } finally {
+        setPending(false);
+      }
+    };
+    return (
+      <div className="space-y-3">
+        <p className="text-sm">
+          An operator CA is already registered: <span className="font-mono">{ca.subject}</span>.
+          Confirm it is yours before you continue.
+        </p>
+        <code className="block break-all rounded-md border bg-secondary/40 p-2 font-mono text-xs">
+          {colonFingerprint(ca.sha256)}
+        </code>
+        <p className="text-xs text-muted-foreground">
+          On the CA machine, run{" "}
+          <code className="font-mono">
+            openssl x509 -in operator-ca.crt -noout -fingerprint -sha256
+          </code>{" "}
+          and paste the output. If it doesn&apos;t match, register your own CA: that retires this
+          one immediately.
+        </p>
+        <label className="block space-y-1">
+          <span className={labelClass}>Paste the fingerprint from the CA machine</span>
+          <input
+            className={fieldClass}
+            onChange={(e) => setPasted(e.target.value)}
+            value={pasted}
+          />
+        </label>
+        {error ? (
+          <p className="font-mono text-xs text-destructive" role="alert">
+            {error}
+          </p>
+        ) : null}
+        <div className="flex justify-end gap-2">
+          <Button onClick={() => setReplace(true)} size="sm" variant="outline">
+            Register a different CA
+          </Button>
+          <Button disabled={!matches || pending} onClick={() => void reconfirm()} size="sm">
+            Confirm this CA
+          </Button>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <OperatorCARegisterForm
+      onRegistered={(result, form) => onRegistered(result, derOf(form.caCertDer))}
+      submit={registerOperatorCABootstrap}
+    />
+  );
+};
diff --git a/src/components/first-run/first-run-wizard.test.tsx b/src/components/first-run/first-run-wizard.test.tsx
new file mode 100644
index 0000000..68d8344
--- /dev/null
+++ b/src/components/first-run/first-run-wizard.test.tsx
@@ -0,0 +1,287 @@
+/*
+Copyright The CryptOS Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import "reflect-metadata";
+import {
+  BasicConstraintsExtension,
+  KeyUsageFlags,
+  KeyUsagesExtension,
+  X509CertificateGenerator,
+} from "@peculiar/x509";
+import { fireEvent, render, screen, within } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { FirstRunWizard } from "@/components/first-run/first-run-wizard";
+import { __resetBootstrap } from "@/lib/bootstrap";
+import { base64 } from "@/lib/crypto/leaf-key";
+import { colonFingerprint } from "@/lib/fingerprint";
+import * as modeMod from "@/lib/fleet/mode";
+
+const { buildCredentialPkcs12, downloadBytes, downloadText } = vi.hoisted(() => ({
+  buildCredentialPkcs12: vi.fn(),
+  downloadBytes: vi.fn(),
+  downloadText: vi.fn(),
+}));
+vi.mock("@/lib/download", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/lib/download")>()),
+  downloadBytes: (...a: unknown[]) => downloadBytes(...a),
+  downloadText: (...a: unknown[]) => downloadText(...a),
+}));
+vi.mock("@/lib/crypto/key-backup", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@/lib/crypto/key-backup")>();
+  buildCredentialPkcs12.mockImplementation(actual.buildCredentialPkcs12);
+  return { ...actual, buildCredentialPkcs12: (...a: unknown[]) => buildCredentialPkcs12(...a) };
+});
+
+const P384 = { name: "ECDSA", namedCurve: "P-384" } as const;
+const EMAIL = "ada@example.org";
+
+const sha256Hex = async (der: Uint8Array) =>
+  Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array(der))), (b) =>
+    b.toString(16).padStart(2, "0"),
+  ).join("");
+
+const makeCA = async () => {
+  const keys = (await crypto.subtle.generateKey(P384, true, ["sign", "verify"])) as CryptoKeyPair;
+  const cert = await X509CertificateGenerator.createSelfSigned({
+    extensions: [
+      new BasicConstraintsExtension(true, 0, true),
+      new KeyUsagesExtension(KeyUsageFlags.keyCertSign | KeyUsageFlags.cRLSign, true),
+    ],
+    keys,
+    name: "CN=Example Operator CA",
+    notAfter: new Date(Date.now() + 3650 * 86_400_000),
+    notBefore: new Date(Date.now() - 60_000),
+    serialNumber: "01",
+    signingAlgorithm: { hash: "SHA-384", name: "ECDSA" },
+  });
+  return { der: new Uint8Array(cert.rawData), keys, pem: cert.toString("pem") };
+};
+
+// The leaf the CA "signs" for the browser's key: the test captures the key
+// pair the wizard generates and issues a certificate for its public half.
+const signLeaf = async (ca: Awaited<ReturnType<typeof makeCA>>, publicKey: CryptoKey) => {
+  const leaf = await X509CertificateGenerator.create({
+    issuer: "CN=Example Operator CA",
+    notAfter: new Date(Date.now() + 365 * 86_400_000),
+    notBefore: new Date(Date.now() - 60_000),
+    publicKey,
+    serialNumber: "0a",
+    signingAlgorithm: { hash: "SHA-384", name: "ECDSA" },
+    signingKey: ca.keys.privateKey,
+    subject: `CN=${EMAIL}`,
+  });
+  return leaf.toString("pem");
+};
+
+const fill = (label: RegExp, value: string, root: HTMLElement = document.body) =>
+  fireEvent.change(within(root).getByLabelText(label), { target: { value } });
+
+const captureKeys = () => {
+  const generated: CryptoKeyPair[] = [];
+  const real = crypto.subtle.generateKey.bind(crypto.subtle);
+  vi.spyOn(crypto.subtle, "generateKey").mockImplementation((async (
+    ...args: Parameters<SubtleCrypto["generateKey"]>
+  ) => {
+    const keys = await real(...args);
+    if ("privateKey" in (keys as CryptoKeyPair)) generated.push(keys as CryptoKeyPair);
+    return keys;
+  }) as SubtleCrypto["generateKey"]);
+  return generated;
+};
+
+const startSession = async () => {
+  fill(/bootstrap token/i, "fos_boot_7K3Q-M2XD-9FJA");
+  fireEvent.click(screen.getByRole("button", { name: /start first run/i }));
+  await screen.findByRole("button", { name: /check the ca/i });
+};
+
+const registerCA = async (ca: Awaited<ReturnType<typeof makeCA>>) => {
+  fill(/operator ca certificate/i, ca.pem);
+  fill(/crl url/i, "http://pki.example.org/fleetos-operator.crl");
+  fireEvent.click(screen.getByRole("button", { name: /check the ca/i }));
+  await screen.findByLabelText(/paste the fingerprint/i);
+  fill(/paste the fingerprint/i, colonFingerprint(await sha256Hex(ca.der)));
+  fireEvent.click(screen.getByRole("button", { name: /confirm and trust/i }));
+  await screen.findByRole("heading", { name: /first admin certificate/i });
+};
+
+const pathA = async (ca: Awaited<ReturnType<typeof makeCA>>, generated: CryptoKeyPair[]) => {
+  fill(/full name/i, "Ada Admin");
+  fill(/^email/i, EMAIL);
+  fireEvent.click(screen.getByRole("button", { name: /make my admin key/i }));
+  const shown = await screen.findByLabelText(
+    /key backup passphrase/i,
+    { selector: "code" },
+    { timeout: 10_000 },
+  );
+  const passphrase = shown.textContent ?? "";
+  expect(screen.queryByLabelText("CSR", { selector: "pre" })).not.toBeInTheDocument();
+  fireEvent.click(screen.getByRole("button", { name: /download key backup/i }));
+  fireEvent.click(screen.getByLabelText(/saved the passphrase/i));
+  fireEvent.click(screen.getByRole("button", { name: /continue/i }));
+  await screen.findByLabelText("CSR", { selector: "pre" });
+
+  const certPem = await signLeaf(ca, generated.at(-1)?.publicKey as CryptoKey);
+  fill(/signed admin certificate/i, certPem);
+  fill(/^key backup passphrase/i, passphrase);
+  fireEvent.click(screen.getByRole("button", { name: /record and build/i }));
+  await screen.findByRole(
+    "heading",
+    { name: /install your admin certificate/i },
+    { timeout: 15_000 },
+  );
+  return passphrase;
+};
+
+beforeEach(() => {
+  __resetBootstrap();
+  vi.clearAllMocks();
+});
+afterEach(() => {
+  vi.restoreAllMocks();
+  vi.unstubAllGlobals();
+});
+
+describe("FirstRunWizard token step", () => {
+  it("leads with the fingerprint check and shows where the token is on each OS", () => {
+    render(<FirstRunWizard inProgress={false} tokenExpiresAt="2026-09-30T13:00:00Z" />);
+    const danger = screen.getAllByRole("note")[0];
+    expect(danger).toHaveTextContent(/fingerprint/i);
+    expect(danger).toHaveTextContent(/server certificate SHA-256/);
+    expect(
+      screen.getByText(/docker logs <container> 2>&1 \| grep 'bootstrap token'/),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText(/journalctl -u fleet-manager \| grep 'bootstrap token'/),
+    ).toBeInTheDocument();
+    expect(screen.getByText(/Select-String 'bootstrap token'/)).toBeInTheDocument();
+    expect(screen.getByText(/can't be the operator CA/i)).toBeInTheDocument();
+    expect(screen.queryByText(/already started/i)).not.toBeInTheDocument();
+  });
+
+  it("warns when first run was already started", () => {
+    render(<FirstRunWizard inProgress tokenExpiresAt="" />);
+    expect(screen.getByText(/already started/i)).toBeInTheDocument();
+  });
+
+  it("explains a refused token by its code", async () => {
+    vi.spyOn(modeMod, "fleetMode").mockReturnValue("mock");
+    render(<FirstRunWizard inProgress={false} tokenExpiresAt="" />);
+    fill(/bootstrap token/i, "not-a-token");
+    fireEvent.click(screen.getByRole("button", { name: /start first run/i }));
+    expect(await screen.findByRole("alert")).toHaveTextContent(
+      /newest one from the Fleet Manager's log/,
+    );
+  });
+});
+
+describe("FirstRunWizard (mock mode)", () => {
+  beforeEach(() => {
+    vi.spyOn(modeMod, "fleetMode").mockReturnValue("mock");
+  });
+
+  it("path A: token, CA with fingerprint confirm, key backup before the CSR, upload, PKCS#12, install", async () => {
+    const generated = captureKeys();
+    const ca = await makeCA();
+    render(<FirstRunWizard inProgress={false} tokenExpiresAt="" />);
+    await startSession();
+    await registerCA(ca);
+    const passphrase = await pathA(ca, generated);
+
+    const [args] = buildCredentialPkcs12.mock.calls[0] as [
+      { chainDer: Uint8Array[]; friendlyName: string; passphrase: string },
+    ];
+    expect(args.passphrase).toBe(passphrase);
+    expect(args.chainDer).toEqual([ca.der]);
+    expect(args.friendlyName).toBe(`FleetOS admin (${EMAIL})`);
+    expect(downloadBytes.mock.calls[0][0]).toBe(`${EMAIL}.p12`);
+    expect(screen.getByText(/Current User/)).toBeInTheDocument();
+    expect(screen.getByRole("button", { name: /reload/i })).toBeInTheDocument();
+  }, 60_000);
+
+  it("path B: the recipe, an optional pre-flight, then install", async () => {
+    const ca = await makeCA();
+    render(<FirstRunWizard inProgress={false} tokenExpiresAt="" />);
+    await startSession();
+    await registerCA(ca);
+    fireEvent.click(screen.getByLabelText(/path b/i));
+    fill(/^email/i, EMAIL);
+    expect(screen.getByText(/openssl pkcs12 -export/)).toBeInTheDocument();
+    expect(
+      screen.getByLabelText(/admin extension section/i, { selector: "pre" }).textContent,
+    ).toContain("op_admin");
+    fireEvent.click(screen.getByRole("button", { name: /skip to install/i }));
+    await screen.findByRole("heading", { name: /install your admin certificate/i });
+  }, 60_000);
+});
+
+describe("FirstRunWizard (live mode)", () => {
+  it("never sends the key or the passphrase, and keeps nothing in storage", async () => {
+    vi.spyOn(modeMod, "fleetMode").mockReturnValue("live");
+    const generated = captureKeys();
+    const ca = await makeCA();
+    const caSha = await sha256Hex(ca.der);
+    const bodies: string[] = [];
+    let registerCalls = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+        const raw = init?.body;
+        bodies.push(ArrayBuffer.isView(raw) ? new TextDecoder().decode(raw) : String(raw ?? ""));
+        const method = String(input).split("/").pop();
+        const confirmed = method === "RegisterOperatorCA" && registerCalls++ > 0;
+        const body: Record<string, unknown> = {
+          RegisterOperatorCA: {
+            adminExtfile: "[ op_admin ]",
+            confirmed,
+            operatorCa: { sha256: caSha, subject: "CN=Example Operator CA" },
+          },
+          StartBootstrapSession: {
+            expiresAt: "2026-09-30T13:00:00Z",
+            sessionSecret: "fos_bsess_live",
+          },
+          SubmitFirstAdminCertificate: { email: EMAIL, serialHex: "0A" },
+        };
+        return Response.json(body[method ?? ""] ?? {}, {
+          headers: { "content-type": "application/json" },
+          status: 200,
+        });
+      }),
+    );
+
+    render(<FirstRunWizard inProgress={false} tokenExpiresAt="" />);
+    await startSession();
+    await registerCA(ca);
+    const passphrase = await pathA(ca, generated);
+
+    const key = generated.at(-1)?.privateKey as CryptoKey;
+    const pkcs8 = base64(new Uint8Array(await crypto.subtle.exportKey("pkcs8", key)));
+    const jwk = await crypto.subtle.exportKey("jwk", key);
+    expect(bodies.length).toBeGreaterThanOrEqual(4);
+    for (const body of bodies) {
+      for (const secret of [pkcs8, jwk.d ?? "unset", passphrase])
+        expect(body).not.toContain(secret);
+    }
+    const stored = [
+      ...Object.values(localStorage),
+      ...Object.values(sessionStorage),
+      document.cookie,
+    ].join("\n");
+    expect(stored).not.toContain("fos_bsess_live");
+    expect(stored).not.toContain(passphrase);
+  }, 60_000);
+});
diff --git a/src/components/first-run/first-run-wizard.tsx b/src/components/first-run/first-run-wizard.tsx
new file mode 100644
index 0000000..7ecaf06
--- /dev/null
+++ b/src/components/first-run/first-run-wizard.tsx
@@ -0,0 +1,143 @@
+/*
+Copyright The CryptOS Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { useState } from "react";
+
+import { AdminStep } from "@/components/first-run/admin-step";
+import { CaStep } from "@/components/first-run/ca-step";
+import { TokenStep } from "@/components/first-run/token-step";
+import { CertificateHelp } from "@/components/layout/certificate-help";
+import { Wordmark } from "@/components/layout/wordmark";
+import { Button } from "@/components/ui/button";
+import { endBootstrapSession } from "@/lib/bootstrap";
+import { levelExtfileSection } from "@/lib/operators";
+
+type Step = "admin" | "ca" | "install" | "token";
+
+const STEPS: { id: Step; label: string }[] = [
+  { id: "token", label: "Token" },
+  { id: "ca", label: "Operator CA" },
+  { id: "admin", label: "First admin" },
+  { id: "install", label: "Install" },
+];
+
+const InstallStep = () => (
+  <div className="space-y-4">
+    <h2 className="text-lg font-bold">Install your admin certificate</h2>
+    <p className="text-sm text-muted-foreground">
+      Import the PKCS#12 with its passphrase (the key backup&apos;s), then reload this page and
+      choose the FleetOS certificate when the browser asks. If it doesn&apos;t ask, quit the browser
+      fully and start it again: Chrome remembers a &quot;no certificate&quot; answer per site. Your
+      first sign-in as admin closes first run.
+    </p>
+    <CertificateHelp />
+    <p className="text-xs text-muted-foreground">
+      Keep the key backup somewhere safe, or delete it once the PKCS#12 is imported.
+    </p>
+    <Button onClick={() => globalThis.location.reload()} size="sm">
+      Reload and sign in
+    </Button>
+  </div>
+);
+
+// FirstRunWizard stands a Fleet Manager up from nothing: the bootstrap token,
+// then the external operator CA (with the fingerprint confirm), then the
+// first admin certificate, which that CA signs, then the install hand-off.
+// The session secret stays in memory; leaving or reloading the page drops it.
+export const FirstRunWizard = ({
+  inProgress,
+  tokenExpiresAt,
+}: {
+  inProgress: boolean;
+  tokenExpiresAt: string;
+}) => {
+  const [step, setStep] = useState<Step>("token");
+  const [anchorDer, setAnchorDer] = useState<null | Uint8Array>(null);
+  const [adminExtfile, setAdminExtfile] = useState(levelExtfileSection("admin"));
+
+  const restart = () => {
+    endBootstrapSession();
+    setStep("token");
+  };
+
+  return (
+    <main className="mx-auto flex min-h-screen max-w-2xl flex-col gap-6 bg-background px-6 py-10">
+      <Wordmark className="text-2xl" />
+      <div className="space-y-2">
+        <h1 className="text-2xl font-bold tracking-tight">First run</h1>
+        <p className="text-sm text-muted-foreground">
+          No operator can sign in yet. Register your operator CA and get the first admin
+          certificate.
+        </p>
+        <ol className="flex gap-3 font-mono text-[11px] uppercase tracking-wider">
+          {STEPS.map((s) => (
+            <li
+              aria-current={s.id === step ? "step" : undefined}
+              className={s.id === step ? "text-primary" : "text-muted-foreground"}
+              key={s.id}
+            >
+              {s.label}
+            </li>
+          ))}
+        </ol>
+      </div>
+
+      <section className="space-y-3 rounded-xl border bg-card p-5">
+        {step === "token" ? (
+          <TokenStep
+            inProgress={inProgress}
+            onStarted={() => setStep("ca")}
+            tokenExpiresAt={tokenExpiresAt}
+          />
+        ) : null}
+        {step === "ca" ? (
+          <>
+            <h2 className="text-lg font-bold">Register your operator CA</h2>
+            <CaStep
+              inProgress={inProgress}
+              onRegistered={(result, der) => {
+                setAnchorDer(der);
+                if (result.adminExtfile) setAdminExtfile(result.adminExtfile);
+                setStep("admin");
+              }}
+            />
+          </>
+        ) : null}
+        {step === "admin" ? (
+          <>
+            <h2 className="text-lg font-bold">First admin certificate</h2>
+            <AdminStep
+              adminExtfile={adminExtfile}
+              anchorDer={anchorDer}
+              onDone={() => setStep("install")}
+            />
+          </>
+        ) : null}
+        {step === "install" ? <InstallStep /> : null}
+      </section>
+
+      {step === "ca" || step === "admin" ? (
+        <button
+          className="self-start text-xs text-primary underline"
+          onClick={restart}
+          type="button"
+        >
+          Session ended? Start again with a new token
+        </button>
+      ) : null}
+    </main>
+  );
+};
diff --git a/src/components/first-run/token-step.tsx b/src/components/first-run/token-step.tsx
new file mode 100644
index 0000000..de57eb3
--- /dev/null
+++ b/src/components/first-run/token-step.tsx
@@ -0,0 +1,136 @@
+/*
+Copyright The CryptOS Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { useState } from "react";
+
+import { Button } from "@/components/ui/button";
+import { startBootstrapSession } from "@/lib/bootstrap";
+import { fleetErrorMessage } from "@/lib/fleet/error-copy";
+import { fieldClass, labelClass } from "@/lib/form";
+
+const Command = ({ children }: { children: string }) => (
+  <code className="block break-all rounded-md border bg-secondary/40 px-2 py-1 font-mono text-[11px]">
+    {children}
+  </code>
+);
+
+// TokenStep starts the first-run session with the bootstrap token from the
+// manager's log. The fingerprint check comes first: the server certificate is
+// self-signed, so comparing its SHA-256 with the log is the only defence
+// against someone in the middle capturing the token.
+export const TokenStep = ({
+  inProgress,
+  onStarted,
+  tokenExpiresAt,
+}: {
+  inProgress: boolean;
+  onStarted: () => void;
+  tokenExpiresAt: string;
+}) => {
+  const [token, setToken] = useState("");
+  const [pending, setPending] = useState(false);
+  const [error, setError] = useState<null | string>(null);
+
+  const start = async () => {
+    setPending(true);
+    setError(null);
+    try {
+      await startBootstrapSession(token);
+      setToken("");
+      onStarted();
+    } catch (error_: unknown) {
+      setError(fleetErrorMessage(error_, "Starting first run failed."));
+    } finally {
+      setPending(false);
+    }
+  };
+
+  return (
+    <div className="space-y-4">
+      <div
+        className="space-y-1 rounded-md border border-destructive/40 bg-destructive/5 p-3"
+        role="note"
+      >
+        <p className="text-sm font-semibold text-foreground">Check the fingerprint first</p>
+        <p className="text-xs text-muted-foreground">
+          This Fleet Manager serves a self-signed certificate until you give it one. Before you type
+          the token, open the certificate details from the browser&apos;s address bar and compare
+          its SHA-256 fingerprint with the{" "}
+          <code className="font-mono">server certificate SHA-256</code> line in the Fleet
+          Manager&apos;s log. If they differ, stop: someone may be intercepting the connection, and
+          the token would be theirs.
+        </p>
+      </div>
+
+      {inProgress ? (
+        <p className="rounded-md border border-warning/40 bg-warning/10 p-3 text-xs text-muted-foreground">
+          First run was already started. If that wasn&apos;t you, continue with the newest token
+          from the log. That ends the earlier session, and replacing the registered CA retires
+          anything it trusted.
+        </p>
+      ) : null}
+
+      <div className="space-y-1 rounded-md border p-3">
+        <p className="text-sm font-semibold">Before you start</p>
+        <p className="text-xs text-muted-foreground">
+          You need an external operator CA: an OpenSSL CA, or an enterprise or offline CA that can
+          issue the operator certificate profile. Have its CA certificate file, and a way to get a
+          CSR signed by it. A CryptOS node can&apos;t be the operator CA.
+        </p>
+      </div>
+
+      <div className="space-y-2">
+        <p className="text-sm font-semibold">Find the bootstrap token</p>
+        <p className="text-xs text-muted-foreground">
+          The Fleet Manager prints a single-use token in its log at start, and a new one each time
+          one is used or expires. Take the newest.
+        </p>
+        <p className={labelClass}>Linux / macOS</p>
+        <Command>{"docker logs <container> 2>&1 | grep 'bootstrap token'"}</Command>
+        <Command>{"journalctl -u fleet-manager | grep 'bootstrap token'"}</Command>
+        <p className={labelClass}>Windows (PowerShell)</p>
+        <Command>{"docker logs <container> 2>&1 | Select-String 'bootstrap token'"}</Command>
+        {tokenExpiresAt ? (
+          <p className="text-xs text-muted-foreground">
+            The current token expires at <span className="font-mono">{tokenExpiresAt}</span>.
+          </p>
+        ) : null}
+      </div>
+
+      <label className="block space-y-1">
+        <span className={labelClass}>Bootstrap token</span>
+        <input
+          autoComplete="off"
+          className={fieldClass}
+          onChange={(e) => setToken(e.target.value)}
+          placeholder="fos_boot_..."
+          spellCheck={false}
+          value={token}
+        />
+      </label>
+      {error ? (
+        <p className="font-mono text-xs text-destructive" role="alert">
+          {error}
+        </p>
+      ) : null}
+      <div className="flex justify-end">
+        <Button disabled={token.trim() === "" || pending} onClick={() => void start()} size="sm">
+          {pending ? "Starting…" : "Start first run"}
+        </Button>
+      </div>
+    </div>
+  );
+};
diff --git a/src/components/layout/bootstrap-gate.test.tsx b/src/components/layout/bootstrap-gate.test.tsx
new file mode 100644
index 0000000..80288ca
--- /dev/null
+++ b/src/components/layout/bootstrap-gate.test.tsx
@@ -0,0 +1,135 @@
+/*
+Copyright The CryptOS Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { render, screen, waitFor } from "@testing-library/react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { BootstrapGate } from "@/components/layout/bootstrap-gate";
+import { BootstrapState } from "@/gen/fleet/cryptos/fleet/v1/bootstrap_pb";
+import { ErrorReason } from "@/gen/fleet/cryptos/fleet/v1/errors_pb";
+
+const auth = vi.hoisted(() => ({
+  login: vi.fn(),
+  state: { status: "anonymous" } as { status: string },
+}));
+vi.mock("@/context/auth", () => ({
+  useAuth: () => ({ login: auth.login, operator: null, reason: null, status: auth.state.status }),
+}));
+
+const getBootstrapState = vi.hoisted(() => vi.fn());
+vi.mock("@/lib/bootstrap", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/lib/bootstrap")>()),
+  getBootstrapState,
+}));
+
+const wizard = vi.hoisted(() => vi.fn());
+vi.mock("@/components/first-run/first-run-wizard", () => ({
+  FirstRunWizard: (props: unknown) => {
+    wizard(props);
+    return <p>first-run wizard</p>;
+  },
+}));
+vi.mock("@/components/layout/diagnostics-copy", () => ({ DiagnosticsCopy: () => null }));
+
+const status = (state: BootstrapState, reasonCode = ErrorReason.UNSPECIFIED) => ({
+  reasonCode,
+  state,
+  tokenExpiresAt: "2026-09-30T13:00:00Z",
+});
+
+const renderGate = () =>
+  render(
+    <BootstrapGate>
+      <p>auth gate</p>
+    </BootstrapGate>,
+  );
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  auth.state.status = "anonymous";
+});
+
+describe("BootstrapGate", () => {
+  it.each([BootstrapState.CLOSED, BootstrapState.NOT_APPLICABLE, BootstrapState.UNSPECIFIED])(
+    "hands state %i to the normal sign-in without asking WhoAmI",
+    async (state) => {
+      getBootstrapState.mockResolvedValue(status(state));
+      renderGate();
+      await screen.findByText("auth gate");
+      expect(auth.login).not.toHaveBeenCalled();
+      expect(screen.queryByText("first-run wizard")).not.toBeInTheDocument();
+    },
+  );
+
+  it("asks the bootstrap state before anything else", () => {
+    getBootstrapState.mockReturnValue(new Promise(() => {}));
+    renderGate();
+    expect(screen.queryByText("auth gate")).not.toBeInTheDocument();
+    expect(screen.getByText(/checking the fleet manager/i)).toBeInTheDocument();
+  });
+
+  it("falls back to sign-in when the manager has no first run to report", async () => {
+    getBootstrapState.mockRejectedValue(new Error("unimplemented"));
+    renderGate();
+    await screen.findByText("auth gate");
+  });
+
+  it("explains why first run is unavailable, then offers sign-in", async () => {
+    getBootstrapState.mockResolvedValue(
+      status(BootstrapState.UNAVAILABLE, ErrorReason.DATABASE_REQUIRED),
+    );
+    renderGate();
+    await screen.findByText("auth gate");
+    expect(screen.getByRole("note")).toHaveTextContent(/Postgres/);
+  });
+
+  it.each([BootstrapState.OPEN, BootstrapState.OPEN_IN_PROGRESS])(
+    "with state %i tries WhoAmI and opens the console when an admin certificate is presented",
+    async (state) => {
+      getBootstrapState.mockResolvedValue(status(state));
+      const view = renderGate();
+      await waitFor(() => expect(auth.login).toHaveBeenCalledTimes(1));
+      auth.state.status = "authenticated";
+      view.rerender(
+        <BootstrapGate>
+          <p>auth gate</p>
+        </BootstrapGate>,
+      );
+      await screen.findByText("auth gate");
+      expect(screen.queryByText("first-run wizard")).not.toBeInTheDocument();
+    },
+  );
+
+  it.each([BootstrapState.OPEN, BootstrapState.OPEN_IN_PROGRESS])(
+    "with state %i shows the first-run wizard when WhoAmI fails",
+    async (state) => {
+      getBootstrapState.mockResolvedValue(status(state));
+      const view = renderGate();
+      await waitFor(() => expect(auth.login).toHaveBeenCalled());
+      auth.state.status = "denied";
+      view.rerender(
+        <BootstrapGate>
+          <p>auth gate</p>
+        </BootstrapGate>,
+      );
+      await screen.findByText("first-run wizard");
+      expect(wizard).toHaveBeenLastCalledWith(
+        expect.objectContaining({ inProgress: state === BootstrapState.OPEN_IN_PROGRESS }),
+      );
+      expect(screen.queryByText("auth gate")).not.toBeInTheDocument();
+    },
+  );
+});
diff --git a/src/components/layout/bootstrap-gate.tsx b/src/components/layout/bootstrap-gate.tsx
new file mode 100644
index 0000000..d40ddda
--- /dev/null
+++ b/src/components/layout/bootstrap-gate.tsx
@@ -0,0 +1,113 @@
+/*
+Copyright The CryptOS Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { type ReactNode, useEffect, useRef, useState } from "react";
+
+import { FirstRunWizard } from "@/components/first-run/first-run-wizard";
+import { GateShell } from "@/components/layout/auth-gate";
+import { useAuth } from "@/context/auth";
+import { BootstrapState } from "@/gen/fleet/cryptos/fleet/v1/bootstrap_pb";
+import { ErrorReason } from "@/gen/fleet/cryptos/fleet/v1/errors_pb";
+import { type BootstrapStatus, getBootstrapState } from "@/lib/bootstrap";
+
+const UNAVAILABLE_COPY: Partial<Record<ErrorReason, string>> = {
+  [ErrorReason.DATABASE_REQUIRED]:
+    "First run needs Postgres (database_url), which this Fleet Manager runs without, and no operator CA is configured. Set operatorCAPath, or add a database, and restart it.",
+  [ErrorReason.FIRST_RUN_DISABLED]:
+    "First run is switched off (firstRun: disabled) and no operator CA is configured. Set operatorCAPath and restart the Fleet Manager.",
+};
+
+const Checking = ({ text }: { text: string }) => (
+  <GateShell>
+    <div className="flex items-center gap-3 font-mono text-sm text-muted-foreground">
+      <span aria-hidden="true" className="size-2 animate-pulse rounded-full bg-primary" />
+      {text}
+    </div>
+  </GateShell>
+);
+
+// BootstrapGate asks GetBootstrapState before anything else. Closed, not
+// applicable, or a manager without first run: the normal sign-in. Open: try
+// WhoAmI first, because a browser that already holds an admin certificate
+// from the registered CA closes first run by signing in; otherwise show the
+// first-run wizard. Unavailable: say why, then the normal sign-in.
+export const BootstrapGate = ({ children }: { children: ReactNode }) => {
+  const { login, status } = useAuth();
+  const [bootstrap, setBootstrap] = useState<"unknown" | BootstrapStatus | null>(null);
+  const tried = useRef(false);
+
+  useEffect(() => {
+    let cancelled = false;
+    getBootstrapState()
+      .then((s) => {
+        if (!cancelled) setBootstrap(s);
+      })
+      .catch((error_: unknown) => {
+        console.info("fleet: GetBootstrapState unavailable; using the normal sign-in", error_);
+        if (!cancelled) setBootstrap("unknown");
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  const open =
+    bootstrap !== null &&
+    bootstrap !== "unknown" &&
+    (bootstrap.state === BootstrapState.OPEN ||
+      bootstrap.state === BootstrapState.OPEN_IN_PROGRESS);
+
+  useEffect(() => {
+    if (open && !tried.current) {
+      tried.current = true;
+      login();
+    }
+  }, [open, login]);
+
+  if (bootstrap === null) {
+    return <Checking text="Checking the Fleet Manager…" />;
+  }
+
+  if (open) {
+    if (status === "authenticated") return <>{children}</>;
+    if (status === "denied") {
+      return (
+        <FirstRunWizard
+          inProgress={bootstrap.state === BootstrapState.OPEN_IN_PROGRESS}
+          tokenExpiresAt={bootstrap.tokenExpiresAt}
+        />
+      );
+    }
+    return <Checking text="Checking for an operator certificate…" />;
+  }
+
+  if (bootstrap !== "unknown" && bootstrap.state === BootstrapState.UNAVAILABLE) {
+    return (
+      <>
+        <p
+          className="mx-auto mt-4 max-w-xl rounded-md border border-warning/40 bg-warning/10 p-3 text-sm text-muted-foreground"
+          role="note"
+        >
+          {UNAVAILABLE_COPY[bootstrap.reasonCode] ??
+            "First run is unavailable on this Fleet Manager, and no operator CA is configured."}
+        </p>
+        {children}
+      </>
+    );
+  }
+
+  return <>{children}</>;
+};
diff --git a/src/components/operator-ca-register-form.tsx b/src/components/operator-ca-register-form.tsx
index 30c66a1..e3591d8 100644
--- a/src/components/operator-ca-register-form.tsx
+++ b/src/components/operator-ca-register-form.tsx
@@ -172,7 +172,7 @@ export const OperatorCARegisterForm = ({
   onRegistered,
   submit,
 }: {
-  onRegistered: (result: RegisterResult) => void;
+  onRegistered: (result: RegisterResult, form: RegisterForm) => void;
   submit: (form: RegisterForm) => Promise<RegisterResult>;
 }) => {
   const [caText, setCaText] = useState("");
@@ -207,9 +207,10 @@ export const OperatorCARegisterForm = ({
     setPending(true);
     setError(null);
     try {
-      const result = await submit(form(confirmSha256));
+      const sent = form(confirmSha256);
+      const result = await submit(sent);
       if (result.confirmed) {
-        onRegistered(result);
+        onRegistered(result, sent);
       } else {
         setPreview(result);
       }
diff --git a/src/context/auth.tsx b/src/context/auth.tsx
index 05d9466..a84ddf6 100644
--- a/src/context/auth.tsx
+++ b/src/context/auth.tsx
@@ -162,6 +162,15 @@ export const AuthProvider = ({ children }: { children: ReactNode }) => {
     setReason(null);
 
     if (fleetMode() === "mock") {
+      // With mock first run open, act like a browser holding no certificate,
+      // so the first-run wizard can be tried offline.
+      if (import.meta.env.VITE_BOOTSTRAP_MOCK_STATE === "open") {
+        setOperator(null);
+        setReason("no-certificate");
+        setStatus("denied");
+
+        return;
+      }
       setOperator(DEV_OPERATOR);
       setStatus("authenticated");
 
diff --git a/src/gen/fleet/cryptos/fleet/v1/errors_pb.ts b/src/gen/fleet/cryptos/fleet/v1/errors_pb.ts
index 47c5ac0..6e453a1 100644
--- a/src/gen/fleet/cryptos/fleet/v1/errors_pb.ts
+++ b/src/gen/fleet/cryptos/fleet/v1/errors_pb.ts
@@ -9,7 +9,7 @@ import { enumDesc, fileDesc } from "@bufbuild/protobuf/codegenv2";
  * Describes the file cryptos/fleet/v1/errors.proto.
  */
 export const file_cryptos_fleet_v1_errors: GenFile = /*@__PURE__*/
-  fileDesc("Ch1jcnlwdG9zL2ZsZWV0L3YxL2Vycm9ycy5wcm90bxIQY3J5cHRvcy5mbGVldC52MSq3AwoJRXJyb3JDb2RlEhoKFkVSUk9SX0NPREVfVU5TUEVDSUZJRUQQABIdChhFUlJPUl9DT0RFX1RPS0VOX0lOVkFMSUQQwAwSFgoRRVJST1JfQ09ERV9DTE9TRUQQwQwSHAoXRVJST1JfQ09ERV9SQVRFX0xJTUlURUQQwgwSGwoWRVJST1JfQ09ERV9VTkFWQUlMQUJMRRDDDBIfChpFUlJPUl9DT0RFX1NFU1NJT05fSU5WQUxJRBDEDBIkCh9FUlJPUl9DT0RFX09QRVJBVE9SX0NBX1JFSkVDVEVEEMUMEhwKF0VSUk9SX0NPREVfQ1NSX1JFSkVDVEVEEMYMEi0KKEVSUk9SX0NPREVfT1BFUkFUT1JfQ0FfTUFOQUdFRF9CWV9DT05GSUcQxwwSJAofRVJST1JfQ09ERV9OT19SRVZPQ0FUSU9OX1NPVVJDRRDIDBIiCh1FUlJPUl9DT0RFX09QRVJBVE9SX0NBX0lOX1VTRRDJDBIdChhFUlJPUl9DT0RFX0NFUlRfUkVKRUNURUQQygwSHwoaRVJST1JfQ09ERV9SRVFVRVNUX0lOVkFMSUQQywwqogkKC0Vycm9yUmVhc29uEhwKGEVSUk9SX1JFQVNPTl9VTlNQRUNJRklFRBAAEiIKHkVSUk9SX1JFQVNPTl9EQVRBQkFTRV9SRVFVSVJFRBABEiMKH0VSUk9SX1JFQVNPTl9GSVJTVF9SVU5fRElTQUJMRUQQAhIZChVFUlJPUl9SRUFTT05fTk9UX0FfQ0EQAxIZChVFUlJPUl9SRUFTT05fRVhQSVJJTkcQBBIZChVFUlJPUl9SRUFTT05fS0VZX1RZUEUQBRIbChdFUlJPUl9SRUFTT05fSVNfTk9ERV9DQRAGEiEKHUVSUk9SX1JFQVNPTl9DUkxfU0lHTl9NSVNTSU5HEAcSKAokRVJST1JfUkVBU09OX05PX0NSTF9OT1RfQUNLTk9XTEVER0VEEAgSIAocRVJST1JfUkVBU09OX0NSTF9VTlJFQUNIQUJMRRAJEhwKGEVSUk9SX1JFQVNPTl9DUkxfSU5WQUxJRBAKEh0KGUVSUk9SX1JFQVNPTl9DUkxfUk9MTEJBQ0sQCxIhCh1FUlJPUl9SRUFTT05fT0NTUF9VTlJFQUNIQUJMRRAMEh0KGUVSUk9SX1JFQVNPTl9PQ1NQX0lOVkFMSUQQDRIeChpFUlJPUl9SRUFTT05fTk9UX0NPTkZJUk1FRBAOEiUKIUVSUk9SX1JFQVNPTl9ST1RBVElPTl9JTl9QUk9HUkVTUxAPEhUKEUVSUk9SX1JFQVNPTl9TSVpFEBASGgoWRVJST1JfUkVBU09OX1NJR05BVFVSRRAREiEKHUVSUk9SX1JFQVNPTl9TVUJKRUNUX01JU01BVENIEBISGgoWRVJST1JfUkVBU09OX1NUQUxFX0NSTBATEhsKF0VSUk9SX1JFQVNPTl9TVEFMRV9PQ1NQEBQSHwobRVJST1JfUkVBU09OX1NUQUxFX0RFTllMSVNUEBUSFwoTRVJST1JfUkVBU09OX05PX0NSTBAWEhwKGEVSUk9SX1JFQVNPTl9OT1RfQ0hBSU5FRBAXEiIKHkVSUk9SX1JFQVNPTl9OT1RfQUNUSVZFX0FOQ0hPUhAYEhwKGEVSUk9SX1JFQVNPTl9XUk9OR19MRVZFTBAZEiMKH0VSUk9SX1JFQVNPTl9MRVZFTF9FWFRfQ1JJVElDQUwQGhIUChBFUlJPUl9SRUFTT05fRUtVEBsSGgoWRVJST1JfUkVBU09OX0tFWV9VU0FHRRAcEiIKHkVSUk9SX1JFQVNPTl9CQVNJQ19DT05TVFJBSU5UUxAdEh0KGUVSUk9SX1JFQVNPTl9LRVlfTUlTTUFUQ0gQHhIYChRFUlJPUl9SRUFTT05fUkVWT0tFRBAfEh0KGUVSUk9SX1JFQVNPTl9SRVZPS0VEX09DU1AQIBIdChlFUlJPUl9SRUFTT05fT0NTUF9VTktOT1dOECESGgoWRVJST1JfUkVBU09OX0RVUExJQ0FURRAiEhoKFkVSUk9SX1JFQVNPTl9OT1RfRk9VTkQQIxIYChRFUlJPUl9SRUFTT05fRVhQSVJFRBAkEhwKGEVSUk9SX1JFQVNPTl9OT1RfUEVORElORxAlQjhaNmdpdGh1Yi5jb20vQ3J5cHRPUy1QS0kvYXBpL2dvL2NyeXB0b3MvZmxlZXQvdjE7ZmxlZXR2MWIGcHJvdG8z");
+  fileDesc("Ch1jcnlwdG9zL2ZsZWV0L3YxL2Vycm9ycy5wcm90bxIQY3J5cHRvcy5mbGVldC52MSq3AwoJRXJyb3JDb2RlEhoKFkVSUk9SX0NPREVfVU5TUEVDSUZJRUQQABIdChhFUlJPUl9DT0RFX1RPS0VOX0lOVkFMSUQQwAwSFgoRRVJST1JfQ09ERV9DTE9TRUQQwQwSHAoXRVJST1JfQ09ERV9SQVRFX0xJTUlURUQQwgwSGwoWRVJST1JfQ09ERV9VTkFWQUlMQUJMRRDDDBIfChpFUlJPUl9DT0RFX1NFU1NJT05fSU5WQUxJRBDEDBIkCh9FUlJPUl9DT0RFX09QRVJBVE9SX0NBX1JFSkVDVEVEEMUMEhwKF0VSUk9SX0NPREVfQ1NSX1JFSkVDVEVEEMYMEi0KKEVSUk9SX0NPREVfT1BFUkFUT1JfQ0FfTUFOQUdFRF9CWV9DT05GSUcQxwwSJAofRVJST1JfQ09ERV9OT19SRVZPQ0FUSU9OX1NPVVJDRRDIDBIiCh1FUlJPUl9DT0RFX09QRVJBVE9SX0NBX0lOX1VTRRDJDBIdChhFUlJPUl9DT0RFX0NFUlRfUkVKRUNURUQQygwSHwoaRVJST1JfQ09ERV9SRVFVRVNUX0lOVkFMSUQQywwqvgkKC0Vycm9yUmVhc29uEhwKGEVSUk9SX1JFQVNPTl9VTlNQRUNJRklFRBAAEiIKHkVSUk9SX1JFQVNPTl9EQVRBQkFTRV9SRVFVSVJFRBABEiMKH0VSUk9SX1JFQVNPTl9GSVJTVF9SVU5fRElTQUJMRUQQAhIZChVFUlJPUl9SRUFTT05fTk9UX0FfQ0EQAxIZChVFUlJPUl9SRUFTT05fRVhQSVJJTkcQBBIZChVFUlJPUl9SRUFTT05fS0VZX1RZUEUQBRIbChdFUlJPUl9SRUFTT05fSVNfTk9ERV9DQRAGEiEKHUVSUk9SX1JFQVNPTl9DUkxfU0lHTl9NSVNTSU5HEAcSKAokRVJST1JfUkVBU09OX05PX0NSTF9OT1RfQUNLTk9XTEVER0VEEAgSIAocRVJST1JfUkVBU09OX0NSTF9VTlJFQUNIQUJMRRAJEhwKGEVSUk9SX1JFQVNPTl9DUkxfSU5WQUxJRBAKEh0KGUVSUk9SX1JFQVNPTl9DUkxfUk9MTEJBQ0sQCxIhCh1FUlJPUl9SRUFTT05fT0NTUF9VTlJFQUNIQUJMRRAMEh0KGUVSUk9SX1JFQVNPTl9PQ1NQX0lOVkFMSUQQDRIeChpFUlJPUl9SRUFTT05fTk9UX0NPTkZJUk1FRBAOEiUKIUVSUk9SX1JFQVNPTl9ST1RBVElPTl9JTl9QUk9HUkVTUxAPEhUKEUVSUk9SX1JFQVNPTl9TSVpFEBASGgoWRVJST1JfUkVBU09OX1NJR05BVFVSRRAREiEKHUVSUk9SX1JFQVNPTl9TVUJKRUNUX01JU01BVENIEBISGgoWRVJST1JfUkVBU09OX1NUQUxFX0NSTBATEhsKF0VSUk9SX1JFQVNPTl9TVEFMRV9PQ1NQEBQSHwobRVJST1JfUkVBU09OX1NUQUxFX0RFTllMSVNUEBUSFwoTRVJST1JfUkVBU09OX05PX0NSTBAWEhwKGEVSUk9SX1JFQVNPTl9OT1RfQ0hBSU5FRBAXEiIKHkVSUk9SX1JFQVNPTl9OT1RfQUNUSVZFX0FOQ0hPUhAYEhwKGEVSUk9SX1JFQVNPTl9XUk9OR19MRVZFTBAZEiMKH0VSUk9SX1JFQVNPTl9MRVZFTF9FWFRfQ1JJVElDQUwQGhIUChBFUlJPUl9SRUFTT05fRUtVEBsSGgoWRVJST1JfUkVBU09OX0tFWV9VU0FHRRAcEiIKHkVSUk9SX1JFQVNPTl9CQVNJQ19DT05TVFJBSU5UUxAdEh0KGUVSUk9SX1JFQVNPTl9LRVlfTUlTTUFUQ0gQHhIYChRFUlJPUl9SRUFTT05fUkVWT0tFRBAfEh0KGUVSUk9SX1JFQVNPTl9SRVZPS0VEX09DU1AQIBIdChlFUlJPUl9SRUFTT05fT0NTUF9VTktOT1dOECESGgoWRVJST1JfUkVBU09OX0RVUExJQ0FURRAiEhoKFkVSUk9SX1JFQVNPTl9OT1RfRk9VTkQQIxIYChRFUlJPUl9SRUFTT05fRVhQSVJFRBAkEhwKGEVSUk9SX1JFQVNPTl9OT1RfUEVORElORxAlEhoKFkVSUk9SX1JFQVNPTl9GVUxMX05BTUUQJkI4WjZnaXRodWIuY29tL0NyeXB0T1MtUEtJL2FwaS9nby9jcnlwdG9zL2ZsZWV0L3YxO2ZsZWV0djFiBnByb3RvMw");
 
 /**
  * ErrorCode is the 1600-1699 block of the Fleet Manager's error codes: first
@@ -408,6 +408,14 @@ export enum ErrorReason {
    * @generated from enum value: ERROR_REASON_NOT_PENDING = 37;
    */
   NOT_PENDING = 37,
+
+  /**
+   * 1610: the full name is empty, longer than 128 characters, or has a
+   * control character.
+   *
+   * @generated from enum value: ERROR_REASON_FULL_NAME = 38;
+   */
+  FULL_NAME = 38,
 }
 
 /**
diff --git a/src/gen/fleet/cryptos/fleet/v1/fleet_pb.ts b/src/gen/fleet/cryptos/fleet/v1/fleet_pb.ts
index 96e5628..d36e9b9 100644
--- a/src/gen/fleet/cryptos/fleet/v1/fleet_pb.ts
+++ b/src/gen/fleet/cryptos/fleet/v1/fleet_pb.ts
@@ -18,7 +18,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file cryptos/fleet/v1/fleet.proto.
  */
 export const file_cryptos_fleet_v1_fleet: GenFile = /*@__PURE__*/
-  fileDesc("ChxjcnlwdG9zL2ZsZWV0L3YxL2ZsZWV0LnByb3RvEhBjcnlwdG9zLmZsZWV0LnYxIhIKEExpc3ROb2Rlc1JlcXVlc3QiQQoRTGlzdE5vZGVzUmVzcG9uc2USLAoFbm9kZXMYASADKAsyHS5jcnlwdG9zLmZsZWV0LnYxLk5vZGVTdW1tYXJ5Ii8KDkdldE5vZGVSZXF1ZXN0EgwKBG5hbWUYASABKAkSDwoHbm9kZV9pZBgCIAEoCSI9Cg9HZXROb2RlUmVzcG9uc2USKgoEbm9kZRgBIAEoCzIcLmNyeXB0b3MuZmxlZXQudjEuTm9kZURldGFpbCI4ChdMaXN0Q2VydGlmaWNhdGVzUmVxdWVzdBIMCgRub2RlGAEgASgJEg8KB25vZGVfaWQYAiABKAkiTwoYTGlzdENlcnRpZmljYXRlc1Jlc3BvbnNlEjMKDGNlcnRpZmljYXRlcxgBIAMoCzIdLmNyeXB0b3MuZmxlZXQudjEuQ2VydGlmaWNhdGUiFQoTTGlzdFByb2ZpbGVzUmVxdWVzdCJFChRMaXN0UHJvZmlsZXNSZXNwb25zZRItCgVpdGVtcxgBIAMoCzIeLmNyeXB0b3MudjEuQ2VydGlmaWNhdGVQcm9maWxlIkcKFENyZWF0ZVByb2ZpbGVSZXF1ZXN0Ei8KB3Byb2ZpbGUYASABKAsyHi5jcnlwdG9zLnYxLkNlcnRpZmljYXRlUHJvZmlsZSIXChVDcmVhdGVQcm9maWxlUmVzcG9uc2UiRwoUVXBkYXRlUHJvZmlsZVJlcXVlc3QSLwoHcHJvZmlsZRgBIAEoCzIeLmNyeXB0b3MudjEuQ2VydGlmaWNhdGVQcm9maWxlIhcKFVVwZGF0ZVByb2ZpbGVSZXNwb25zZSIkChREZWxldGVQcm9maWxlUmVxdWVzdBIMCgRuYW1lGAEgASgJIhcKFURlbGV0ZVByb2ZpbGVSZXNwb25zZSJVChlBcHBseVByb2ZpbGVUb05vZGVSZXF1ZXN0EhEKCW5vZGVfbmFtZRgBIAEoCRIUCgxwcm9maWxlX25hbWUYAiABKAkSDwoHbm9kZV9pZBgDIAEoCSJJChpBcHBseVByb2ZpbGVUb05vZGVSZXNwb25zZRISCgpnZW5lcmF0aW9uGAEgASgEEhcKD3JlcXVpcmVzX3JlYm9vdBgCIAEoCCIVChNMaXN0QWRhcHRlcnNSZXF1ZXN0IkoKFExpc3RBZGFwdGVyc1Jlc3BvbnNlEjIKBWl0ZW1zGAEgAygLMiMuY3J5cHRvcy5mbGVldC52MS5FbnJvbGxtZW50QWRhcHRlciI5ChhTZXRBZGFwdGVyRW5hYmxlZFJlcXVlc3QSDAoEbmFtZRgBIAEoCRIPCgdlbmFibGVkGAIgASgIIlEKGVNldEFkYXB0ZXJFbmFibGVkUmVzcG9uc2USNAoHYWRhcHRlchgBIAEoCzIjLmNyeXB0b3MuZmxlZXQudjEuRW5yb2xsbWVudEFkYXB0ZXIiEgoQTGlzdEF1ZGl0UmVxdWVzdCJAChFMaXN0QXVkaXRSZXNwb25zZRIrCgVpdGVtcxgBIAMoCzIcLmNyeXB0b3MuZmxlZXQudjEuQXVkaXRFdmVudCIYChZMaXN0RW5yb2xsbWVudHNSZXF1ZXN0Ik0KF0xpc3RFbnJvbGxtZW50c1Jlc3BvbnNlEjIKBWl0ZW1zGAEgAygLMiMuY3J5cHRvcy5mbGVldC52MS5FbnJvbGxtZW50UmVxdWVzdCKDAgoLTm9kZVN1bW1hcnkSDAoEbmFtZRgBIAEoCRIPCgdhZGRyZXNzGAIgASgJEgwKBHJvbGUYAyABKAkSFgoOaWRlbnRpdHlfc3RhdGUYBCABKAkSCgoCY24YBSABKAkSDgoGaXNzdWVyGAYgASgJEigKBmhlYWx0aBgHIAEoDjIYLmNyeXB0b3MuZmxlZXQudjEuSGVhbHRoEhUKDWhlYWx0aF9kZXRhaWwYCCABKAkSCgoCaWQYCSABKAkSLQoJcHJvdG9jb2xzGAogAygLMhouY3J5cHRvcy52MS5Qcm90b2NvbFN0YXR1cxIXCg9yZWJvb3RfcmVxdWlyZWQYCyABKAgiSQoMTm9kZUlkZW50aXR5EhEKCWNoYWluX3BlbRgBIAEoCRIRCgljaGFpbl9kZXIYAiADKAwSEwoLbGVhZl9zaGEyNTYYAyABKAkiqQEKCk5vZGVEZXRhaWwSLgoHc3VtbWFyeRgBIAEoCzIdLmNyeXB0b3MuZmxlZXQudjEuTm9kZVN1bW1hcnkSMAoIaWRlbnRpdHkYAiABKAsyHi5jcnlwdG9zLmZsZWV0LnYxLk5vZGVJZGVudGl0eRIVCg10cG1fYXZhaWxhYmxlGAMgASgIEhIKCmJvb3RfY291bnQYBCABKAQSDgoGdXB0aW1lGAUgASgJItgBCgtDZXJ0aWZpY2F0ZRIOCgZzZXJpYWwYASABKAkSEgoKc3ViamVjdF9jbhgCIAEoCRITCgtpc3N1ZXJfbm9kZRgDIAEoCRIMCgRraW5kGAQgASgJEg4KBnN0YXR1cxgFIAEoCRISCgpub3RfYmVmb3JlGAYgASgJEhEKCW5vdF9hZnRlchgHIAEoCRIPCgdwcm9maWxlGAggASgJEhIKCnJldm9rZWRfYXQYCSABKAkSDgoGcmVhc29uGAogASgJEhYKDmlzc3Vlcl9ub2RlX2lkGAsgASgJIo0BChFFbnJvbGxtZW50QWRhcHRlchIMCgRraW5kGAEgASgJEgwKBG5hbWUYAiABKAkSEAoIZW5kcG9pbnQYAyABKAkSDwoHcHJvZmlsZRgEIAEoCRIPCgdlbmFibGVkGAUgASgIEhIKCmNoYWxsZW5nZXMYBiADKAkSFAoMZ3BvX3RlbXBsYXRlGAcgASgJIrwCCgpBdWRpdEV2ZW50EgoKAmlkGAEgASgJEgoKAmF0GAIgASgJEgwKBGtpbmQYAyABKAkSDwoHc3VtbWFyeRgEIAEoCRITCgt0YXJnZXRfa2luZBgFIAEoCRITCgt0YXJnZXRfcGF0aBgGIAEoCRISCgphY3Rvcl9raW5kGAcgASgJEhAKCGFjdG9yX2NuGAggASgJEhQKDGFjdG9yX3NlcmlhbBgJIAEoCRIOCgZrZXlfaWQYCiABKAkSCwoDdmlhGAsgASgJEgwKBHRvb2wYDCABKAkSFgoOcmVxdWVzdF9kaWdlc3QYDSABKAkSDwoHb3V0Y29tZRgOIAEoCRITCgthcHByb3ZhbF9pZBgPIAEoCRIXCg9hcHByb3Zlcl9zZXJpYWwYECABKAkSDwoHbm9kZV9pZBgRIAEoCSLvAgoRRW5yb2xsbWVudFJlcXVlc3QSCgoCaWQYASABKAkSFQoNcHJvcG9zZWRfbmFtZRgCIAEoCRIMCgRyb2xlGAMgASgJEhEKCXBhcmVudF9jbhgEIAEoCRIPCgdhZGRyZXNzGAUgASgJEg4KBnN0YXR1cxgGIAEoCRIbChNhdHRlc3RhdGlvbl9zdW1tYXJ5GAcgASgJEhsKE2F0dGVzdGF0aW9uX25vZGVfaWQYCCABKAkSFAoMY3NyX2tleV90eXBlGAkgASgJEhYKDmNzcl9zdWJqZWN0X2NuGAogASgJEhQKDHJlcXVlc3RlZF9hdBgLIAEoCRIYChByZWplY3Rpb25fcmVhc29uGAwgASgJEhoKEmFkbWl0dGVkX25vZGVfbmFtZRgNIAEoCRIMCgRraW5kGA4gASgJEhkKEXBpbm5lZF9rZXlfc2hhMjU2GA8gASgJEhgKEGFkbWl0dGVkX25vZGVfaWQYECABKAkizAEKF0NyZWF0ZUVucm9sbG1lbnRSZXF1ZXN0EgwKBGtpbmQYASABKAkSFQoNbm9kZV9lbmRwb2ludBgCIAEoCRIWCg5hZG1pbl9jZXJ0X3BlbRgDIAEoCRIVCg1hZG1pbl9rZXlfcGVtGAQgASgJEg4KBmNhX3BlbRgFIAEoCRISCgpjaGlsZF9ub2RlGAYgASgJEhEKCXBhcmVudF9jbhgHIAEoCRIPCgdwcm9maWxlGAggASgJEhUKDWNoaWxkX25vZGVfaWQYCSABKAkiUwoYQ3JlYXRlRW5yb2xsbWVudFJlc3BvbnNlEjcKCmVucm9sbG1lbnQYASABKAsyIy5jcnlwdG9zLmZsZWV0LnYxLkVucm9sbG1lbnRSZXF1ZXN0InwKGEFwcHJvdmVFbnJvbGxtZW50UmVxdWVzdBIKCgJpZBgBIAEoCRIVCg1ub2RlX2VuZHBvaW50GAIgASgJEhYKDmFkbWluX2NlcnRfcGVtGAMgASgJEhUKDWFkbWluX2tleV9wZW0YBCABKAkSDgoGY2FfcGVtGAUgASgJIlQKGUFwcHJvdmVFbnJvbGxtZW50UmVzcG9uc2USNwoKZW5yb2xsbWVudBgBIAEoCzIjLmNyeXB0b3MuZmxlZXQudjEuRW5yb2xsbWVudFJlcXVlc3QiNQoXUmVqZWN0RW5yb2xsbWVudFJlcXVlc3QSCgoCaWQYASABKAkSDgoGcmVhc29uGAIgASgJIlMKGFJlamVjdEVucm9sbG1lbnRSZXNwb25zZRI3CgplbnJvbGxtZW50GAEgASgLMiMuY3J5cHRvcy5mbGVldC52MS5FbnJvbGxtZW50UmVxdWVzdCIPCg1XaG9BbUlSZXF1ZXN0Ij0KEE9wZXJhdG9ySWRlbnRpdHkSCgoCY24YASABKAkSDgoGc2VyaWFsGAIgASgJEg0KBWxldmVsGAMgASgJIkYKDldob0FtSVJlc3BvbnNlEjQKCG9wZXJhdG9yGAEgASgLMiIuY3J5cHRvcy5mbGVldC52MS5PcGVyYXRvcklkZW50aXR5ImcKGFJldm9rZUNlcnRpZmljYXRlUmVxdWVzdBIRCglub2RlX25hbWUYASABKAkSEgoKc2VyaWFsX2hleBgCIAEoCRITCgtyZWFzb25fY29kZRgDIAEoBRIPCgdub2RlX2lkGAQgASgJIlgKGVJldm9rZUNlcnRpZmljYXRlUmVzcG9uc2USEgoKc2VyaWFsX2hleBgBIAEoCRISCgpyZXZva2VkX2F0GAIgASgJEhMKC3JlYXNvbl9jb2RlGAMgASgFIj4KFUdldENlcnRpZmljYXRlUmVxdWVzdBIRCglub2RlX25hbWUYASABKAkSEgoKc2VyaWFsX2hleBgCIAEoCSJoChZHZXRDZXJ0aWZpY2F0ZVJlc3BvbnNlEhcKD2NlcnRpZmljYXRlX3BlbRgBIAEoCRIRCgljaGFpbl9wZW0YAiABKAkSDgoGc3RhdHVzGAMgASgJEhIKCnJldm9rZWRfYXQYBCABKAkiXQoQSXNzdWVMZWFmUmVxdWVzdBIRCglub2RlX25hbWUYASABKAkSDwoHY3NyX2RlchgCIAEoDBIUCgxwcm9maWxlX25hbWUYAyABKAkSDwoHbm9kZV9pZBgEIAEoCSIlChFJc3N1ZUxlYWZSZXNwb25zZRIQCghjZXJ0X2RlchgBIAEoDCJMChBSZWtleU5vZGVSZXF1ZXN0EhEKCW5vZGVfbmFtZRgBIAEoCRIUCgxwcm9maWxlX25hbWUYAiABKAkSDwoHbm9kZV9pZBgDIAEoCSJNChFSZWtleU5vZGVSZXNwb25zZRISCgpzdWJqZWN0X2NuGAEgASgJEhEKCWlzc3Vlcl9jbhgCIAEoCRIRCgljaGFpbl9sZW4YAyABKAUiOgoUR2V0Tm9kZUNvbmZpZ1JlcXVlc3QSEQoJbm9kZV9uYW1lGAEgASgJEg8KB25vZGVfaWQYAiABKAkiQgoVR2V0Tm9kZUNvbmZpZ1Jlc3BvbnNlEikKBmNvbmZpZxgBIAEoCzIZLmNyeXB0b3MudjEuTWFjaGluZUNvbmZpZyJnChZBcHBseU5vZGVDb25maWdSZXF1ZXN0EhEKCW5vZGVfbmFtZRgBIAEoCRIpCgZjb25maWcYAiABKAsyGS5jcnlwdG9zLnYxLk1hY2hpbmVDb25maWcSDwoHbm9kZV9pZBgDIAEoCSJGChdBcHBseU5vZGVDb25maWdSZXNwb25zZRISCgpnZW5lcmF0aW9uGAEgASgEEhcKD3JlcXVpcmVzX3JlYm9vdBgCIAEoCCJrChZTZXROb2RlUHJvdG9jb2xSZXF1ZXN0EhEKCW5vZGVfbmFtZRgBIAEoCRItCghwcm90b2NvbBgCIAEoDjIbLmNyeXB0b3MudjEuU2VydmljZVByb3RvY29sEg8KB2VuYWJsZWQYAyABKAgiRgoXU2V0Tm9kZVByb3RvY29sUmVzcG9uc2USEgoKZ2VuZXJhdGlvbhgBIAEoBBIXCg9yZXF1aXJlc19yZWJvb3QYAiABKAgiTAoSRXhwb3J0Q0FLZXlSZXF1ZXN0EhEKCW5vZGVfbmFtZRgBIAEoCRISCgpwYXNzcGhyYXNlGAIgASgMEg8KB25vZGVfaWQYAyABKAkiJwoTRXhwb3J0Q0FLZXlSZXNwb25zZRIQCghlbnZlbG9wZRgBIAEoDCJeChJJbXBvcnRDQUtleVJlcXVlc3QSEQoJbm9kZV9uYW1lGAEgASgJEhAKCGVudmVsb3BlGAIgASgMEhIKCnBhc3NwaHJhc2UYAyABKAwSDwoHbm9kZV9pZBgEIAEoCSI8ChNJbXBvcnRDQUtleVJlc3BvbnNlEhIKCnN1YmplY3RfY24YASABKAkSEQoJaXNzdWVyX2NuGAIgASgJIm8KH1Jldm9rZU9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3QSEgoKc2VyaWFsX2hleBgBIAEoCRITCgtyZWFzb25fY29kZRgCIAEoBRIVCg1pc3N1ZXJfc2hhMjU2GAMgASgJEgwKBG5vdGUYBCABKAkicwogUmV2b2tlT3BlcmF0b3JDcmVkZW50aWFsUmVzcG9uc2USEgoKc2VyaWFsX2hleBgBIAEoCRISCgpyZXZva2VkX2F0GAIgASgJEhUKDWlzc3Vlcl9zaGEyNTYYAyABKAkSEAoId2FybmluZ3MYBCADKAkiIAoeTGlzdE9wZXJhdG9yQ3JlZGVudGlhbHNSZXF1ZXN0Io0CChJPcGVyYXRvckNyZWRlbnRpYWwSEwoLY29tbW9uX25hbWUYASABKAkSEgoKc2VyaWFsX2hleBgCIAEoCRINCgVsZXZlbBgDIAEoCRIRCglub3RfYWZ0ZXIYBCABKAkSDwoHcmV2b2tlZBgFIAEoCBIMCgRraW5kGAYgASgJEhUKDWlzc3Vlcl9zaGEyNTYYByABKAkSDQoFZW1haWwYCCABKAkSEQoJZnVsbF9uYW1lGAkgASgJEhIKCmRlbnlsaXN0ZWQYCiABKAgSEwoLY3JsX3Jldm9rZWQYCyABKAgSFQoNZmlyc3Rfc2Vlbl9hdBgMIAEoCRIUCgxsYXN0X3NlZW5fYXQYDSABKAkiVgofTGlzdE9wZXJhdG9yQ3JlZGVudGlhbHNSZXNwb25zZRIzCgVpdGVtcxgBIAMoCzIkLmNyeXB0b3MuZmxlZXQudjEuT3BlcmF0b3JDcmVkZW50aWFsImoKJkNyZWF0ZU9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3RSZXF1ZXN0Eg0KBWxldmVsGAEgASgJEg0KBWVtYWlsGAIgASgJEhEKCWZ1bGxfbmFtZRgDIAEoCRIPCgdjc3JfZGVyGAQgASgMIpQBCidDcmVhdGVPcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0UmVzcG9uc2USEgoKcmVxdWVzdF9pZBgBIAEoCRIPCgdjc3JfcGVtGAIgASgJEhcKD2V4dGZpbGVfc2VjdGlvbhgDIAEoCRIXCg9vcGVuc3NsX2NvbW1hbmQYBCABKAkSEgoKZXhwaXJlc19hdBgFIAEoCSI2CiVMaXN0T3BlcmF0b3JDcmVkZW50aWFsUmVxdWVzdHNSZXF1ZXN0Eg0KBXN0YXRlGAEgASgJImQKJkxpc3RPcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0c1Jlc3BvbnNlEjoKBWl0ZW1zGAEgAygLMisuY3J5cHRvcy5mbGVldC52MS5PcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0IjwKJkNhbmNlbE9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3RSZXF1ZXN0EhIKCnJlcXVlc3RfaWQYASABKAkiZwonQ2FuY2VsT3BlcmF0b3JDcmVkZW50aWFsUmVxdWVzdFJlc3BvbnNlEjwKB3JlcXVlc3QYASABKAsyKy5jcnlwdG9zLmZsZWV0LnYxLk9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3Qi0QEKGU9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3QSCgoCaWQYASABKAkSDQoFbGV2ZWwYAiABKAkSDQoFZW1haWwYAyABKAkSEQoJZnVsbF9uYW1lGAQgASgJEg8KB2Nzcl9wZW0YBSABKAkSDQoFc3RhdGUYBiABKAkSFQoNY3JlYXRlZF9ieV9jbhgHIAEoCRISCgpjcmVhdGVkX2F0GAggASgJEhIKCmV4cGlyZXNfYXQYCSABKAkSGAoQY29tcGxldGVkX3NlcmlhbBgKIAEoCSJaCh9SZWNvcmRPcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0EhAKCGNlcnRfZGVyGAEgASgMEhIKCnJlcXVlc3RfaWQYAiABKAkSEQoJZnVsbF9uYW1lGAMgASgJIm4KIFJlY29yZE9wZXJhdG9yQ3JlZGVudGlhbFJlc3BvbnNlEjgKCmNyZWRlbnRpYWwYASABKAsyJC5jcnlwdG9zLmZsZWV0LnYxLk9wZXJhdG9yQ3JlZGVudGlhbBIQCgh3YXJuaW5ncxgCIAMoCSIYChZMaXN0T3BlcmF0b3JDQXNSZXF1ZXN0IkYKF0xpc3RPcGVyYXRvckNBc1Jlc3BvbnNlEisKBWl0ZW1zGAEgAygLMhwuY3J5cHRvcy5mbGVldC52MS5PcGVyYXRvckNBIpACChlSZWdpc3Rlck9wZXJhdG9yQ0FSZXF1ZXN0EhMKC2NhX2NlcnRfZGVyGAEgASgMEg0KA3VybBgCIAEoCUgAEhEKB2NybF9kZXIYAyABKAxIABIOCgRub25lGAQgASgISAASLQoJb2NzcF9tb2RlGAUgASgOMhouY3J5cHRvcy5mbGVldC52MS5PY3NwTW9kZRIQCghvY3NwX3VybBgGIAEoCRJFChBhY2tub3dsZWRnZW1lbnRzGAcgAygOMisuY3J5cHRvcy5mbGVldC52MS5PcGVyYXRvckNBQWNrbm93bGVkZ2VtZW50EhYKDmNvbmZpcm1fc2hhMjU2GAggASgJQgwKCmNybF9zb3VyY2UisAEKGlJlZ2lzdGVyT3BlcmF0b3JDQVJlc3BvbnNlEjEKC29wZXJhdG9yX2NhGAEgASgLMhwuY3J5cHRvcy5mbGVldC52MS5PcGVyYXRvckNBEhEKCWNvbmZpcm1lZBgCIAEoCBIVCg1hZG1pbl9leHRmaWxlGAMgASgJEjUKCm9jc3BfcHJvYmUYBCABKAsyIS5jcnlwdG9zLmZsZWV0LnYxLk9jc3BQcm9iZVJlc3VsdCJMChdSZXRpcmVPcGVyYXRvckNBUmVxdWVzdBIOCgZzaGEyNTYYASABKAkSIQoZaV91bmRlcnN0YW5kX3NlbGZfbG9ja291dBgCIAEoCCJNChhSZXRpcmVPcGVyYXRvckNBUmVzcG9uc2USMQoLb3BlcmF0b3JfY2EYASABKAsyHC5jcnlwdG9zLmZsZWV0LnYxLk9wZXJhdG9yQ0EitgEKHVNldE9wZXJhdG9yQ0FDUkxTb3VyY2VSZXF1ZXN0Eg4KBnNoYTI1NhgBIAEoCRINCgN1cmwYAiABKAlIABIOCgRub25lGAMgASgISAASEQoHY3JsX2RlchgFIAEoDEgAEkUKEGFja25vd2xlZGdlbWVudHMYBCADKA4yKy5jcnlwdG9zLmZsZWV0LnYxLk9wZXJhdG9yQ0FBY2tub3dsZWRnZW1lbnRCDAoKY3JsX3NvdXJjZSJTCh5TZXRPcGVyYXRvckNBQ1JMU291cmNlUmVzcG9uc2USMQoLb3BlcmF0b3JfY2EYASABKAsyHC5jcnlwdG9zLmZsZWV0LnYxLk9wZXJhdG9yQ0EiOwoYVXBsb2FkT3BlcmF0b3JDUkxSZXF1ZXN0Eg4KBnNoYTI1NhgBIAEoCRIPCgdjcmxfZGVyGAIgASgMIk4KGVVwbG9hZE9wZXJhdG9yQ1JMUmVzcG9uc2USMQoLb3BlcmF0b3JfY2EYASABKAsyHC5jcnlwdG9zLmZsZWV0LnYxLk9wZXJhdG9yQ0EiawoYU2V0T3BlcmF0b3JDQU9DU1BSZXF1ZXN0Eg4KBnNoYTI1NhgBIAEoCRItCglvY3NwX21vZGUYAiABKA4yGi5jcnlwdG9zLmZsZWV0LnYxLk9jc3BNb2RlEhAKCG9jc3BfdXJsGAMgASgJIoUBChlTZXRPcGVyYXRvckNBT0NTUFJlc3BvbnNlEjEKC29wZXJhdG9yX2NhGAEgASgLMhwuY3J5cHRvcy5mbGVldC52MS5PcGVyYXRvckNBEjUKCm9jc3BfcHJvYmUYAiABKAsyIS5jcnlwdG9zLmZsZWV0LnYxLk9jc3BQcm9iZVJlc3VsdCIqChZQcmV2aWV3QWRvcHRpb25SZXF1ZXN0EhAKCGVuZHBvaW50GAEgASgJIj8KF1ByZXZpZXdBZG9wdGlvblJlc3BvbnNlEhMKC2NlcnRfc2hhMjU2GAEgASgJEg8KB3N1YmplY3QYAiABKAkiRwoXTGlzdEluc3RhbGxEaXNrc1JlcXVlc3QSEAoIZW5kcG9pbnQYASABKAkSGgoScGlubmVkX2NlcnRfc2hhMjU2GAIgASgJIkIKGExpc3RJbnN0YWxsRGlza3NSZXNwb25zZRImCgVkaXNrcxgBIAMoCzIXLmNyeXB0b3MudjEuSW5zdGFsbERpc2siawoQQWRvcHROb2RlUmVxdWVzdBIQCghlbmRwb2ludBgBIAEoCRIaChJwaW5uZWRfY2VydF9zaGEyNTYYAiABKAkSKQoGY29uZmlnGAMgASgLMhkuY3J5cHRvcy52MS5NYWNoaW5lQ29uZmlnIoUBChFBZG9wdE5vZGVSZXNwb25zZRINCgVwaGFzZRgBIAEoCRIOCgZkZXRhaWwYAiABKAkSDAoEZG9uZRgDIAEoCBIPCgdub2RlX2lkGAQgASgJEhMKC2Fkb3B0aW9uX2lkGAUgASgJEh0KFXByZXNlbnRlZF9jZXJ0X3NoYTI1NhgGIAEoCSJNCiFDb25maXJtQWRvcHRpb25GaW5nZXJwcmludFJlcXVlc3QSEwoLYWRvcHRpb25faWQYASABKAkSEwoLY2VydF9zaGEyNTYYAiABKAkiJAoiQ29uZmlybUFkb3B0aW9uRmluZ2VycHJpbnRSZXNwb25zZSJaChdEZWNvbW1pc3Npb25Ob2RlUmVxdWVzdBIRCglub2RlX25hbWUYASABKAkSGwoTY29uZmlybV9jb21tb25fbmFtZRgCIAEoCRIPCgdub2RlX2lkGAMgASgJIi0KGERlY29tbWlzc2lvbk5vZGVSZXNwb25zZRIRCglyZWJvb3RpbmcYASABKAgiNgoRUmVuYW1lTm9kZVJlcXVlc3QSDwoHbm9kZV9pZBgBIAEoCRIQCghuZXdfbmFtZRgCIAEoCSJBChJSZW5hbWVOb2RlUmVzcG9uc2USKwoEbm9kZRgBIAEoCzIdLmNyeXB0b3MuZmxlZXQudjEuTm9kZVN1bW1hcnkiIQoSTGlzdE1jcEtleXNSZXF1ZXN0EgsKA2FsbBgBIAEoCCI+ChNMaXN0TWNwS2V5c1Jlc3BvbnNlEicKBWl0ZW1zGAEgAygLMhguY3J5cHRvcy5mbGVldC52MS5NY3BLZXkiIQoTUmV2b2tlTWNwS2V5UmVxdWVzdBIKCgJpZBgBIAEoCSJBChRSZXZva2VNY3BLZXlSZXNwb25zZRIpCgdtY3Bfa2V5GAEgASgLMhguY3J5cHRvcy5mbGVldC52MS5NY3BLZXkiOwoTQ3JlYXRlTWNwS2V5UmVxdWVzdBINCgVsYWJlbBgBIAEoCRIVCg1sZXZlbF9jZWlsaW5nGAIgASgJIlgKFENyZWF0ZU1jcEtleVJlc3BvbnNlEhUKDXBsYWludGV4dF9rZXkYASABKAkSKQoHbWNwX2tleRgCIAEoCzIYLmNyeXB0b3MuZmxlZXQudjEuTWNwS2V5IrsBCgZNY3BLZXkSCgoCaWQYASABKAkSDQoFbGFiZWwYAiABKAkSEwoLY2xpZW50X25hbWUYAyABKAkSEwoLb3BlcmF0b3JfY24YBCABKAkSFwoPb3BlcmF0b3Jfc2VyaWFsGAUgASgJEhUKDWxldmVsX2NlaWxpbmcYBiABKAkSEgoKY3JlYXRlZF9hdBgHIAEoCRIUCgxsYXN0X3VzZWRfYXQYCCABKAkSEgoKcmV2b2tlZF9hdBgJIAEoCSImChRMaXN0QXBwcm92YWxzUmVxdWVzdBIOCgZzdGF0dXMYASABKAkiQgoVTGlzdEFwcHJvdmFsc1Jlc3BvbnNlEikKBWl0ZW1zGAEgAygLMhouY3J5cHRvcy5mbGVldC52MS5BcHByb3ZhbCI0ChVEZWNpZGVBcHByb3ZhbFJlcXVlc3QSCgoCaWQYASABKAkSDwoHYXBwcm92ZRgCIAEoCCJGChZEZWNpZGVBcHByb3ZhbFJlc3BvbnNlEiwKCGFwcHJvdmFsGAEgASgLMhouY3J5cHRvcy5mbGVldC52MS5BcHByb3ZhbCKpAgoIQXBwcm92YWwSCgoCaWQYASABKAkSDAoEdG9vbBgCIAEoCRIPCgdzdW1tYXJ5GAMgASgJEhYKDnJlcXVlc3RfZGlnZXN0GAQgASgJEhcKD3JlcXVlc3RlZF9ieV9jbhgFIAEoCRIbChNyZXF1ZXN0ZWRfYnlfc2VyaWFsGAYgASgJEg4KBmtleV9pZBgHIAEoCRIWCg5yZXF1aXJlZF9sZXZlbBgIIAEoCRISCgpjcmVhdGVkX2F0GAkgASgJEhIKCmV4cGlyZXNfYXQYCiABKAkSDgoGc3RhdHVzGAsgASgJEhUKDWRlY2lkZWRfYnlfY24YDCABKAkSGQoRZGVjaWRlZF9ieV9zZXJpYWwYDSABKAkSEgoKZGVjaWRlZF9hdBgOIAEoCSpSCgZIZWFsdGgSFgoSSEVBTFRIX1VOU1BFQ0lGSUVEEAASDQoJSEVBTFRIX1VQEAESDwoLSEVBTFRIX0RPV04QAhIQCgxIRUFMVEhfRVJST1IQAzLhJwoMRmxlZXRTZXJ2aWNlElQKCUxpc3ROb2RlcxIiLmNyeXB0b3MuZmxlZXQudjEuTGlzdE5vZGVzUmVxdWVzdBojLmNyeXB0b3MuZmxlZXQudjEuTGlzdE5vZGVzUmVzcG9uc2USTgoHR2V0Tm9kZRIgLmNyeXB0b3MuZmxlZXQudjEuR2V0Tm9kZVJlcXVlc3QaIS5jcnlwdG9zLmZsZWV0LnYxLkdldE5vZGVSZXNwb25zZRJpChBMaXN0Q2VydGlmaWNhdGVzEikuY3J5cHRvcy5mbGVldC52MS5MaXN0Q2VydGlmaWNhdGVzUmVxdWVzdBoqLmNyeXB0b3MuZmxlZXQudjEuTGlzdENlcnRpZmljYXRlc1Jlc3BvbnNlEl0KDExpc3RQcm9maWxlcxIlLmNyeXB0b3MuZmxlZXQudjEuTGlzdFByb2ZpbGVzUmVxdWVzdBomLmNyeXB0b3MuZmxlZXQudjEuTGlzdFByb2ZpbGVzUmVzcG9uc2USYAoNQ3JlYXRlUHJvZmlsZRImLmNyeXB0b3MuZmxlZXQudjEuQ3JlYXRlUHJvZmlsZVJlcXVlc3QaJy5jcnlwdG9zLmZsZWV0LnYxLkNyZWF0ZVByb2ZpbGVSZXNwb25zZRJgCg1VcGRhdGVQcm9maWxlEiYuY3J5cHRvcy5mbGVldC52MS5VcGRhdGVQcm9maWxlUmVxdWVzdBonLmNyeXB0b3MuZmxlZXQudjEuVXBkYXRlUHJvZmlsZVJlc3BvbnNlEmAKDURlbGV0ZVByb2ZpbGUSJi5jcnlwdG9zLmZsZWV0LnYxLkRlbGV0ZVByb2ZpbGVSZXF1ZXN0GicuY3J5cHRvcy5mbGVldC52MS5EZWxldGVQcm9maWxlUmVzcG9uc2USbwoSQXBwbHlQcm9maWxlVG9Ob2RlEisuY3J5cHRvcy5mbGVldC52MS5BcHBseVByb2ZpbGVUb05vZGVSZXF1ZXN0GiwuY3J5cHRvcy5mbGVldC52MS5BcHBseVByb2ZpbGVUb05vZGVSZXNwb25zZRJdCgxMaXN0QWRhcHRlcnMSJS5jcnlwdG9zLmZsZWV0LnYxLkxpc3RBZGFwdGVyc1JlcXVlc3QaJi5jcnlwdG9zLmZsZWV0LnYxLkxpc3RBZGFwdGVyc1Jlc3BvbnNlEmwKEVNldEFkYXB0ZXJFbmFibGVkEiouY3J5cHRvcy5mbGVldC52MS5TZXRBZGFwdGVyRW5hYmxlZFJlcXVlc3QaKy5jcnlwdG9zLmZsZWV0LnYxLlNldEFkYXB0ZXJFbmFibGVkUmVzcG9uc2USZgoPU2V0Tm9kZVByb3RvY29sEiguY3J5cHRvcy5mbGVldC52MS5TZXROb2RlUHJvdG9jb2xSZXF1ZXN0GikuY3J5cHRvcy5mbGVldC52MS5TZXROb2RlUHJvdG9jb2xSZXNwb25zZRJUCglMaXN0QXVkaXQSIi5jcnlwdG9zLmZsZWV0LnYxLkxpc3RBdWRpdFJlcXVlc3QaIy5jcnlwdG9zLmZsZWV0LnYxLkxpc3RBdWRpdFJlc3BvbnNlEmYKD0xpc3RFbnJvbGxtZW50cxIoLmNyeXB0b3MuZmxlZXQudjEuTGlzdEVucm9sbG1lbnRzUmVxdWVzdBopLmNyeXB0b3MuZmxlZXQudjEuTGlzdEVucm9sbG1lbnRzUmVzcG9uc2USaQoQQ3JlYXRlRW5yb2xsbWVudBIpLmNyeXB0b3MuZmxlZXQudjEuQ3JlYXRlRW5yb2xsbWVudFJlcXVlc3QaKi5jcnlwdG9zLmZsZWV0LnYxLkNyZWF0ZUVucm9sbG1lbnRSZXNwb25zZRJsChFBcHByb3ZlRW5yb2xsbWVudBIqLmNyeXB0b3MuZmxlZXQudjEuQXBwcm92ZUVucm9sbG1lbnRSZXF1ZXN0GisuY3J5cHRvcy5mbGVldC52MS5BcHByb3ZlRW5yb2xsbWVudFJlc3BvbnNlEmkKEFJlamVjdEVucm9sbG1lbnQSKS5jcnlwdG9zLmZsZWV0LnYxLlJlamVjdEVucm9sbG1lbnRSZXF1ZXN0GiouY3J5cHRvcy5mbGVldC52MS5SZWplY3RFbnJvbGxtZW50UmVzcG9uc2USSwoGV2hvQW1JEh8uY3J5cHRvcy5mbGVldC52MS5XaG9BbUlSZXF1ZXN0GiAuY3J5cHRvcy5mbGVldC52MS5XaG9BbUlSZXNwb25zZRJsChFSZXZva2VDZXJ0aWZpY2F0ZRIqLmNyeXB0b3MuZmxlZXQudjEuUmV2b2tlQ2VydGlmaWNhdGVSZXF1ZXN0GisuY3J5cHRvcy5mbGVldC52MS5SZXZva2VDZXJ0aWZpY2F0ZVJlc3BvbnNlEmMKDkdldENlcnRpZmljYXRlEicuY3J5cHRvcy5mbGVldC52MS5HZXRDZXJ0aWZpY2F0ZVJlcXVlc3QaKC5jcnlwdG9zLmZsZWV0LnYxLkdldENlcnRpZmljYXRlUmVzcG9uc2USVAoJSXNzdWVMZWFmEiIuY3J5cHRvcy5mbGVldC52MS5Jc3N1ZUxlYWZSZXF1ZXN0GiMuY3J5cHRvcy5mbGVldC52MS5Jc3N1ZUxlYWZSZXNwb25zZRJUCglSZWtleU5vZGUSIi5jcnlwdG9zLmZsZWV0LnYxLlJla2V5Tm9kZVJlcXVlc3QaIy5jcnlwdG9zLmZsZWV0LnYxLlJla2V5Tm9kZVJlc3BvbnNlEmAKDUdldE5vZGVDb25maWcSJi5jcnlwdG9zLmZsZWV0LnYxLkdldE5vZGVDb25maWdSZXF1ZXN0GicuY3J5cHRvcy5mbGVldC52MS5HZXROb2RlQ29uZmlnUmVzcG9uc2USZgoPQXBwbHlOb2RlQ29uZmlnEiguY3J5cHRvcy5mbGVldC52MS5BcHBseU5vZGVDb25maWdSZXF1ZXN0GikuY3J5cHRvcy5mbGVldC52MS5BcHBseU5vZGVDb25maWdSZXNwb25zZRJaCgtFeHBvcnRDQUtleRIkLmNyeXB0b3MuZmxlZXQudjEuRXhwb3J0Q0FLZXlSZXF1ZXN0GiUuY3J5cHRvcy5mbGVldC52MS5FeHBvcnRDQUtleVJlc3BvbnNlEloKC0ltcG9ydENBS2V5EiQuY3J5cHRvcy5mbGVldC52MS5JbXBvcnRDQUtleVJlcXVlc3QaJS5jcnlwdG9zLmZsZWV0LnYxLkltcG9ydENBS2V5UmVzcG9uc2USlgEKH0NyZWF0ZU9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3QSOC5jcnlwdG9zLmZsZWV0LnYxLkNyZWF0ZU9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3RSZXF1ZXN0GjkuY3J5cHRvcy5mbGVldC52MS5DcmVhdGVPcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0UmVzcG9uc2USkwEKHkxpc3RPcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0cxI3LmNyeXB0b3MuZmxlZXQudjEuTGlzdE9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3RzUmVxdWVzdBo4LmNyeXB0b3MuZmxlZXQudjEuTGlzdE9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3RzUmVzcG9uc2USlgEKH0NhbmNlbE9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3QSOC5jcnlwdG9zLmZsZWV0LnYxLkNhbmNlbE9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3RSZXF1ZXN0GjkuY3J5cHRvcy5mbGVldC52MS5DYW5jZWxPcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0UmVzcG9uc2USgQEKGFJlY29yZE9wZXJhdG9yQ3JlZGVudGlhbBIxLmNyeXB0b3MuZmxlZXQudjEuUmVjb3JkT3BlcmF0b3JDcmVkZW50aWFsUmVxdWVzdBoyLmNyeXB0b3MuZmxlZXQudjEuUmVjb3JkT3BlcmF0b3JDcmVkZW50aWFsUmVzcG9uc2USgQEKGFJldm9rZU9wZXJhdG9yQ3JlZGVudGlhbBIxLmNyeXB0b3MuZmxlZXQudjEuUmV2b2tlT3BlcmF0b3JDcmVkZW50aWFsUmVxdWVzdBoyLmNyeXB0b3MuZmxlZXQudjEuUmV2b2tlT3BlcmF0b3JDcmVkZW50aWFsUmVzcG9uc2USfgoXTGlzdE9wZXJhdG9yQ3JlZGVudGlhbHMSMC5jcnlwdG9zLmZsZWV0LnYxLkxpc3RPcGVyYXRvckNyZWRlbnRpYWxzUmVxdWVzdBoxLmNyeXB0b3MuZmxlZXQudjEuTGlzdE9wZXJhdG9yQ3JlZGVudGlhbHNSZXNwb25zZRJmCg9MaXN0T3BlcmF0b3JDQXMSKC5jcnlwdG9zLmZsZWV0LnYxLkxpc3RPcGVyYXRvckNBc1JlcXVlc3QaKS5jcnlwdG9zLmZsZWV0LnYxLkxpc3RPcGVyYXRvckNBc1Jlc3BvbnNlEm8KElJlZ2lzdGVyT3BlcmF0b3JDQRIrLmNyeXB0b3MuZmxlZXQudjEuUmVnaXN0ZXJPcGVyYXRvckNBUmVxdWVzdBosLmNyeXB0b3MuZmxlZXQudjEuUmVnaXN0ZXJPcGVyYXRvckNBUmVzcG9uc2USaQoQUmV0aXJlT3BlcmF0b3JDQRIpLmNyeXB0b3MuZmxlZXQudjEuUmV0aXJlT3BlcmF0b3JDQVJlcXVlc3QaKi5jcnlwdG9zLmZsZWV0LnYxLlJldGlyZU9wZXJhdG9yQ0FSZXNwb25zZRJ7ChZTZXRPcGVyYXRvckNBQ1JMU291cmNlEi8uY3J5cHRvcy5mbGVldC52MS5TZXRPcGVyYXRvckNBQ1JMU291cmNlUmVxdWVzdBowLmNyeXB0b3MuZmxlZXQudjEuU2V0T3BlcmF0b3JDQUNSTFNvdXJjZVJlc3BvbnNlEmwKEVVwbG9hZE9wZXJhdG9yQ1JMEiouY3J5cHRvcy5mbGVldC52MS5VcGxvYWRPcGVyYXRvckNSTFJlcXVlc3QaKy5jcnlwdG9zLmZsZWV0LnYxLlVwbG9hZE9wZXJhdG9yQ1JMUmVzcG9uc2USbAoRU2V0T3BlcmF0b3JDQU9DU1ASKi5jcnlwdG9zLmZsZWV0LnYxLlNldE9wZXJhdG9yQ0FPQ1NQUmVxdWVzdBorLmNyeXB0b3MuZmxlZXQudjEuU2V0T3BlcmF0b3JDQU9DU1BSZXNwb25zZRJmCg9QcmV2aWV3QWRvcHRpb24SKC5jcnlwdG9zLmZsZWV0LnYxLlByZXZpZXdBZG9wdGlvblJlcXVlc3QaKS5jcnlwdG9zLmZsZWV0LnYxLlByZXZpZXdBZG9wdGlvblJlc3BvbnNlEmkKEExpc3RJbnN0YWxsRGlza3MSKS5jcnlwdG9zLmZsZWV0LnYxLkxpc3RJbnN0YWxsRGlza3NSZXF1ZXN0GiouY3J5cHRvcy5mbGVldC52MS5MaXN0SW5zdGFsbERpc2tzUmVzcG9uc2USVgoJQWRvcHROb2RlEiIuY3J5cHRvcy5mbGVldC52MS5BZG9wdE5vZGVSZXF1ZXN0GiMuY3J5cHRvcy5mbGVldC52MS5BZG9wdE5vZGVSZXNwb25zZTABEocBChpDb25maXJtQWRvcHRpb25GaW5nZXJwcmludBIzLmNyeXB0b3MuZmxlZXQudjEuQ29uZmlybUFkb3B0aW9uRmluZ2VycHJpbnRSZXF1ZXN0GjQuY3J5cHRvcy5mbGVldC52MS5Db25maXJtQWRvcHRpb25GaW5nZXJwcmludFJlc3BvbnNlEmkKEERlY29tbWlzc2lvbk5vZGUSKS5jcnlwdG9zLmZsZWV0LnYxLkRlY29tbWlzc2lvbk5vZGVSZXF1ZXN0GiouY3J5cHRvcy5mbGVldC52MS5EZWNvbW1pc3Npb25Ob2RlUmVzcG9uc2USVwoKUmVuYW1lTm9kZRIjLmNyeXB0b3MuZmxlZXQudjEuUmVuYW1lTm9kZVJlcXVlc3QaJC5jcnlwdG9zLmZsZWV0LnYxLlJlbmFtZU5vZGVSZXNwb25zZRJaCgtMaXN0TWNwS2V5cxIkLmNyeXB0b3MuZmxlZXQudjEuTGlzdE1jcEtleXNSZXF1ZXN0GiUuY3J5cHRvcy5mbGVldC52MS5MaXN0TWNwS2V5c1Jlc3BvbnNlEl0KDFJldm9rZU1jcEtleRIlLmNyeXB0b3MuZmxlZXQudjEuUmV2b2tlTWNwS2V5UmVxdWVzdBomLmNyeXB0b3MuZmxlZXQudjEuUmV2b2tlTWNwS2V5UmVzcG9uc2USXQoMQ3JlYXRlTWNwS2V5EiUuY3J5cHRvcy5mbGVldC52MS5DcmVhdGVNY3BLZXlSZXF1ZXN0GiYuY3J5cHRvcy5mbGVldC52MS5DcmVhdGVNY3BLZXlSZXNwb25zZRJgCg1MaXN0QXBwcm92YWxzEiYuY3J5cHRvcy5mbGVldC52MS5MaXN0QXBwcm92YWxzUmVxdWVzdBonLmNyeXB0b3MuZmxlZXQudjEuTGlzdEFwcHJvdmFsc1Jlc3BvbnNlEmMKDkRlY2lkZUFwcHJvdmFsEicuY3J5cHRvcy5mbGVldC52MS5EZWNpZGVBcHByb3ZhbFJlcXVlc3QaKC5jcnlwdG9zLmZsZWV0LnYxLkRlY2lkZUFwcHJvdmFsUmVzcG9uc2VCOFo2Z2l0aHViLmNvbS9DcnlwdE9TLVBLSS9hcGkvZ28vY3J5cHRvcy9mbGVldC92MTtmbGVldHYxYgZwcm90bzM", [file_cryptos_fleet_v1_operator_ca, file_cryptos_v1_config, file_cryptos_v1_node, file_cryptos_v1_status]);
+  fileDesc("ChxjcnlwdG9zL2ZsZWV0L3YxL2ZsZWV0LnByb3RvEhBjcnlwdG9zLmZsZWV0LnYxIhIKEExpc3ROb2Rlc1JlcXVlc3QiQQoRTGlzdE5vZGVzUmVzcG9uc2USLAoFbm9kZXMYASADKAsyHS5jcnlwdG9zLmZsZWV0LnYxLk5vZGVTdW1tYXJ5Ii8KDkdldE5vZGVSZXF1ZXN0EgwKBG5hbWUYASABKAkSDwoHbm9kZV9pZBgCIAEoCSI9Cg9HZXROb2RlUmVzcG9uc2USKgoEbm9kZRgBIAEoCzIcLmNyeXB0b3MuZmxlZXQudjEuTm9kZURldGFpbCI4ChdMaXN0Q2VydGlmaWNhdGVzUmVxdWVzdBIMCgRub2RlGAEgASgJEg8KB25vZGVfaWQYAiABKAkiTwoYTGlzdENlcnRpZmljYXRlc1Jlc3BvbnNlEjMKDGNlcnRpZmljYXRlcxgBIAMoCzIdLmNyeXB0b3MuZmxlZXQudjEuQ2VydGlmaWNhdGUiFQoTTGlzdFByb2ZpbGVzUmVxdWVzdCJFChRMaXN0UHJvZmlsZXNSZXNwb25zZRItCgVpdGVtcxgBIAMoCzIeLmNyeXB0b3MudjEuQ2VydGlmaWNhdGVQcm9maWxlIkcKFENyZWF0ZVByb2ZpbGVSZXF1ZXN0Ei8KB3Byb2ZpbGUYASABKAsyHi5jcnlwdG9zLnYxLkNlcnRpZmljYXRlUHJvZmlsZSIXChVDcmVhdGVQcm9maWxlUmVzcG9uc2UiRwoUVXBkYXRlUHJvZmlsZVJlcXVlc3QSLwoHcHJvZmlsZRgBIAEoCzIeLmNyeXB0b3MudjEuQ2VydGlmaWNhdGVQcm9maWxlIhcKFVVwZGF0ZVByb2ZpbGVSZXNwb25zZSIkChREZWxldGVQcm9maWxlUmVxdWVzdBIMCgRuYW1lGAEgASgJIhcKFURlbGV0ZVByb2ZpbGVSZXNwb25zZSJVChlBcHBseVByb2ZpbGVUb05vZGVSZXF1ZXN0EhEKCW5vZGVfbmFtZRgBIAEoCRIUCgxwcm9maWxlX25hbWUYAiABKAkSDwoHbm9kZV9pZBgDIAEoCSJJChpBcHBseVByb2ZpbGVUb05vZGVSZXNwb25zZRISCgpnZW5lcmF0aW9uGAEgASgEEhcKD3JlcXVpcmVzX3JlYm9vdBgCIAEoCCIVChNMaXN0QWRhcHRlcnNSZXF1ZXN0IkoKFExpc3RBZGFwdGVyc1Jlc3BvbnNlEjIKBWl0ZW1zGAEgAygLMiMuY3J5cHRvcy5mbGVldC52MS5FbnJvbGxtZW50QWRhcHRlciI5ChhTZXRBZGFwdGVyRW5hYmxlZFJlcXVlc3QSDAoEbmFtZRgBIAEoCRIPCgdlbmFibGVkGAIgASgIIlEKGVNldEFkYXB0ZXJFbmFibGVkUmVzcG9uc2USNAoHYWRhcHRlchgBIAEoCzIjLmNyeXB0b3MuZmxlZXQudjEuRW5yb2xsbWVudEFkYXB0ZXIiEgoQTGlzdEF1ZGl0UmVxdWVzdCJAChFMaXN0QXVkaXRSZXNwb25zZRIrCgVpdGVtcxgBIAMoCzIcLmNyeXB0b3MuZmxlZXQudjEuQXVkaXRFdmVudCIYChZMaXN0RW5yb2xsbWVudHNSZXF1ZXN0Ik0KF0xpc3RFbnJvbGxtZW50c1Jlc3BvbnNlEjIKBWl0ZW1zGAEgAygLMiMuY3J5cHRvcy5mbGVldC52MS5FbnJvbGxtZW50UmVxdWVzdCKDAgoLTm9kZVN1bW1hcnkSDAoEbmFtZRgBIAEoCRIPCgdhZGRyZXNzGAIgASgJEgwKBHJvbGUYAyABKAkSFgoOaWRlbnRpdHlfc3RhdGUYBCABKAkSCgoCY24YBSABKAkSDgoGaXNzdWVyGAYgASgJEigKBmhlYWx0aBgHIAEoDjIYLmNyeXB0b3MuZmxlZXQudjEuSGVhbHRoEhUKDWhlYWx0aF9kZXRhaWwYCCABKAkSCgoCaWQYCSABKAkSLQoJcHJvdG9jb2xzGAogAygLMhouY3J5cHRvcy52MS5Qcm90b2NvbFN0YXR1cxIXCg9yZWJvb3RfcmVxdWlyZWQYCyABKAgiSQoMTm9kZUlkZW50aXR5EhEKCWNoYWluX3BlbRgBIAEoCRIRCgljaGFpbl9kZXIYAiADKAwSEwoLbGVhZl9zaGEyNTYYAyABKAkiqQEKCk5vZGVEZXRhaWwSLgoHc3VtbWFyeRgBIAEoCzIdLmNyeXB0b3MuZmxlZXQudjEuTm9kZVN1bW1hcnkSMAoIaWRlbnRpdHkYAiABKAsyHi5jcnlwdG9zLmZsZWV0LnYxLk5vZGVJZGVudGl0eRIVCg10cG1fYXZhaWxhYmxlGAMgASgIEhIKCmJvb3RfY291bnQYBCABKAQSDgoGdXB0aW1lGAUgASgJItgBCgtDZXJ0aWZpY2F0ZRIOCgZzZXJpYWwYASABKAkSEgoKc3ViamVjdF9jbhgCIAEoCRITCgtpc3N1ZXJfbm9kZRgDIAEoCRIMCgRraW5kGAQgASgJEg4KBnN0YXR1cxgFIAEoCRISCgpub3RfYmVmb3JlGAYgASgJEhEKCW5vdF9hZnRlchgHIAEoCRIPCgdwcm9maWxlGAggASgJEhIKCnJldm9rZWRfYXQYCSABKAkSDgoGcmVhc29uGAogASgJEhYKDmlzc3Vlcl9ub2RlX2lkGAsgASgJIo0BChFFbnJvbGxtZW50QWRhcHRlchIMCgRraW5kGAEgASgJEgwKBG5hbWUYAiABKAkSEAoIZW5kcG9pbnQYAyABKAkSDwoHcHJvZmlsZRgEIAEoCRIPCgdlbmFibGVkGAUgASgIEhIKCmNoYWxsZW5nZXMYBiADKAkSFAoMZ3BvX3RlbXBsYXRlGAcgASgJIrwCCgpBdWRpdEV2ZW50EgoKAmlkGAEgASgJEgoKAmF0GAIgASgJEgwKBGtpbmQYAyABKAkSDwoHc3VtbWFyeRgEIAEoCRITCgt0YXJnZXRfa2luZBgFIAEoCRITCgt0YXJnZXRfcGF0aBgGIAEoCRISCgphY3Rvcl9raW5kGAcgASgJEhAKCGFjdG9yX2NuGAggASgJEhQKDGFjdG9yX3NlcmlhbBgJIAEoCRIOCgZrZXlfaWQYCiABKAkSCwoDdmlhGAsgASgJEgwKBHRvb2wYDCABKAkSFgoOcmVxdWVzdF9kaWdlc3QYDSABKAkSDwoHb3V0Y29tZRgOIAEoCRITCgthcHByb3ZhbF9pZBgPIAEoCRIXCg9hcHByb3Zlcl9zZXJpYWwYECABKAkSDwoHbm9kZV9pZBgRIAEoCSLvAgoRRW5yb2xsbWVudFJlcXVlc3QSCgoCaWQYASABKAkSFQoNcHJvcG9zZWRfbmFtZRgCIAEoCRIMCgRyb2xlGAMgASgJEhEKCXBhcmVudF9jbhgEIAEoCRIPCgdhZGRyZXNzGAUgASgJEg4KBnN0YXR1cxgGIAEoCRIbChNhdHRlc3RhdGlvbl9zdW1tYXJ5GAcgASgJEhsKE2F0dGVzdGF0aW9uX25vZGVfaWQYCCABKAkSFAoMY3NyX2tleV90eXBlGAkgASgJEhYKDmNzcl9zdWJqZWN0X2NuGAogASgJEhQKDHJlcXVlc3RlZF9hdBgLIAEoCRIYChByZWplY3Rpb25fcmVhc29uGAwgASgJEhoKEmFkbWl0dGVkX25vZGVfbmFtZRgNIAEoCRIMCgRraW5kGA4gASgJEhkKEXBpbm5lZF9rZXlfc2hhMjU2GA8gASgJEhgKEGFkbWl0dGVkX25vZGVfaWQYECABKAkizAEKF0NyZWF0ZUVucm9sbG1lbnRSZXF1ZXN0EgwKBGtpbmQYASABKAkSFQoNbm9kZV9lbmRwb2ludBgCIAEoCRIWCg5hZG1pbl9jZXJ0X3BlbRgDIAEoCRIVCg1hZG1pbl9rZXlfcGVtGAQgASgJEg4KBmNhX3BlbRgFIAEoCRISCgpjaGlsZF9ub2RlGAYgASgJEhEKCXBhcmVudF9jbhgHIAEoCRIPCgdwcm9maWxlGAggASgJEhUKDWNoaWxkX25vZGVfaWQYCSABKAkiUwoYQ3JlYXRlRW5yb2xsbWVudFJlc3BvbnNlEjcKCmVucm9sbG1lbnQYASABKAsyIy5jcnlwdG9zLmZsZWV0LnYxLkVucm9sbG1lbnRSZXF1ZXN0InwKGEFwcHJvdmVFbnJvbGxtZW50UmVxdWVzdBIKCgJpZBgBIAEoCRIVCg1ub2RlX2VuZHBvaW50GAIgASgJEhYKDmFkbWluX2NlcnRfcGVtGAMgASgJEhUKDWFkbWluX2tleV9wZW0YBCABKAkSDgoGY2FfcGVtGAUgASgJIlQKGUFwcHJvdmVFbnJvbGxtZW50UmVzcG9uc2USNwoKZW5yb2xsbWVudBgBIAEoCzIjLmNyeXB0b3MuZmxlZXQudjEuRW5yb2xsbWVudFJlcXVlc3QiNQoXUmVqZWN0RW5yb2xsbWVudFJlcXVlc3QSCgoCaWQYASABKAkSDgoGcmVhc29uGAIgASgJIlMKGFJlamVjdEVucm9sbG1lbnRSZXNwb25zZRI3CgplbnJvbGxtZW50GAEgASgLMiMuY3J5cHRvcy5mbGVldC52MS5FbnJvbGxtZW50UmVxdWVzdCIPCg1XaG9BbUlSZXF1ZXN0Ij0KEE9wZXJhdG9ySWRlbnRpdHkSCgoCY24YASABKAkSDgoGc2VyaWFsGAIgASgJEg0KBWxldmVsGAMgASgJIkYKDldob0FtSVJlc3BvbnNlEjQKCG9wZXJhdG9yGAEgASgLMiIuY3J5cHRvcy5mbGVldC52MS5PcGVyYXRvcklkZW50aXR5ImcKGFJldm9rZUNlcnRpZmljYXRlUmVxdWVzdBIRCglub2RlX25hbWUYASABKAkSEgoKc2VyaWFsX2hleBgCIAEoCRITCgtyZWFzb25fY29kZRgDIAEoBRIPCgdub2RlX2lkGAQgASgJIlgKGVJldm9rZUNlcnRpZmljYXRlUmVzcG9uc2USEgoKc2VyaWFsX2hleBgBIAEoCRISCgpyZXZva2VkX2F0GAIgASgJEhMKC3JlYXNvbl9jb2RlGAMgASgFIj4KFUdldENlcnRpZmljYXRlUmVxdWVzdBIRCglub2RlX25hbWUYASABKAkSEgoKc2VyaWFsX2hleBgCIAEoCSJoChZHZXRDZXJ0aWZpY2F0ZVJlc3BvbnNlEhcKD2NlcnRpZmljYXRlX3BlbRgBIAEoCRIRCgljaGFpbl9wZW0YAiABKAkSDgoGc3RhdHVzGAMgASgJEhIKCnJldm9rZWRfYXQYBCABKAkiXQoQSXNzdWVMZWFmUmVxdWVzdBIRCglub2RlX25hbWUYASABKAkSDwoHY3NyX2RlchgCIAEoDBIUCgxwcm9maWxlX25hbWUYAyABKAkSDwoHbm9kZV9pZBgEIAEoCSIlChFJc3N1ZUxlYWZSZXNwb25zZRIQCghjZXJ0X2RlchgBIAEoDCJMChBSZWtleU5vZGVSZXF1ZXN0EhEKCW5vZGVfbmFtZRgBIAEoCRIUCgxwcm9maWxlX25hbWUYAiABKAkSDwoHbm9kZV9pZBgDIAEoCSJNChFSZWtleU5vZGVSZXNwb25zZRISCgpzdWJqZWN0X2NuGAEgASgJEhEKCWlzc3Vlcl9jbhgCIAEoCRIRCgljaGFpbl9sZW4YAyABKAUiOgoUR2V0Tm9kZUNvbmZpZ1JlcXVlc3QSEQoJbm9kZV9uYW1lGAEgASgJEg8KB25vZGVfaWQYAiABKAkiQgoVR2V0Tm9kZUNvbmZpZ1Jlc3BvbnNlEikKBmNvbmZpZxgBIAEoCzIZLmNyeXB0b3MudjEuTWFjaGluZUNvbmZpZyJnChZBcHBseU5vZGVDb25maWdSZXF1ZXN0EhEKCW5vZGVfbmFtZRgBIAEoCRIpCgZjb25maWcYAiABKAsyGS5jcnlwdG9zLnYxLk1hY2hpbmVDb25maWcSDwoHbm9kZV9pZBgDIAEoCSJGChdBcHBseU5vZGVDb25maWdSZXNwb25zZRISCgpnZW5lcmF0aW9uGAEgASgEEhcKD3JlcXVpcmVzX3JlYm9vdBgCIAEoCCJrChZTZXROb2RlUHJvdG9jb2xSZXF1ZXN0EhEKCW5vZGVfbmFtZRgBIAEoCRItCghwcm90b2NvbBgCIAEoDjIbLmNyeXB0b3MudjEuU2VydmljZVByb3RvY29sEg8KB2VuYWJsZWQYAyABKAgiRgoXU2V0Tm9kZVByb3RvY29sUmVzcG9uc2USEgoKZ2VuZXJhdGlvbhgBIAEoBBIXCg9yZXF1aXJlc19yZWJvb3QYAiABKAgiTAoSRXhwb3J0Q0FLZXlSZXF1ZXN0EhEKCW5vZGVfbmFtZRgBIAEoCRISCgpwYXNzcGhyYXNlGAIgASgMEg8KB25vZGVfaWQYAyABKAkiJwoTRXhwb3J0Q0FLZXlSZXNwb25zZRIQCghlbnZlbG9wZRgBIAEoDCJeChJJbXBvcnRDQUtleVJlcXVlc3QSEQoJbm9kZV9uYW1lGAEgASgJEhAKCGVudmVsb3BlGAIgASgMEhIKCnBhc3NwaHJhc2UYAyABKAwSDwoHbm9kZV9pZBgEIAEoCSI8ChNJbXBvcnRDQUtleVJlc3BvbnNlEhIKCnN1YmplY3RfY24YASABKAkSEQoJaXNzdWVyX2NuGAIgASgJIm8KH1Jldm9rZU9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3QSEgoKc2VyaWFsX2hleBgBIAEoCRITCgtyZWFzb25fY29kZRgCIAEoBRIVCg1pc3N1ZXJfc2hhMjU2GAMgASgJEgwKBG5vdGUYBCABKAkicwogUmV2b2tlT3BlcmF0b3JDcmVkZW50aWFsUmVzcG9uc2USEgoKc2VyaWFsX2hleBgBIAEoCRISCgpyZXZva2VkX2F0GAIgASgJEhUKDWlzc3Vlcl9zaGEyNTYYAyABKAkSEAoId2FybmluZ3MYBCADKAkiIAoeTGlzdE9wZXJhdG9yQ3JlZGVudGlhbHNSZXF1ZXN0Io0CChJPcGVyYXRvckNyZWRlbnRpYWwSEwoLY29tbW9uX25hbWUYASABKAkSEgoKc2VyaWFsX2hleBgCIAEoCRINCgVsZXZlbBgDIAEoCRIRCglub3RfYWZ0ZXIYBCABKAkSDwoHcmV2b2tlZBgFIAEoCBIMCgRraW5kGAYgASgJEhUKDWlzc3Vlcl9zaGEyNTYYByABKAkSDQoFZW1haWwYCCABKAkSEQoJZnVsbF9uYW1lGAkgASgJEhIKCmRlbnlsaXN0ZWQYCiABKAgSEwoLY3JsX3Jldm9rZWQYCyABKAgSFQoNZmlyc3Rfc2Vlbl9hdBgMIAEoCRIUCgxsYXN0X3NlZW5fYXQYDSABKAkiVgofTGlzdE9wZXJhdG9yQ3JlZGVudGlhbHNSZXNwb25zZRIzCgVpdGVtcxgBIAMoCzIkLmNyeXB0b3MuZmxlZXQudjEuT3BlcmF0b3JDcmVkZW50aWFsImoKJkNyZWF0ZU9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3RSZXF1ZXN0Eg0KBWxldmVsGAEgASgJEg0KBWVtYWlsGAIgASgJEhEKCWZ1bGxfbmFtZRgDIAEoCRIPCgdjc3JfZGVyGAQgASgMIpQBCidDcmVhdGVPcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0UmVzcG9uc2USEgoKcmVxdWVzdF9pZBgBIAEoCRIPCgdjc3JfcGVtGAIgASgJEhcKD2V4dGZpbGVfc2VjdGlvbhgDIAEoCRIXCg9vcGVuc3NsX2NvbW1hbmQYBCABKAkSEgoKZXhwaXJlc19hdBgFIAEoCSI2CiVMaXN0T3BlcmF0b3JDcmVkZW50aWFsUmVxdWVzdHNSZXF1ZXN0Eg0KBXN0YXRlGAEgASgJImQKJkxpc3RPcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0c1Jlc3BvbnNlEjoKBWl0ZW1zGAEgAygLMisuY3J5cHRvcy5mbGVldC52MS5PcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0IjwKJkNhbmNlbE9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3RSZXF1ZXN0EhIKCnJlcXVlc3RfaWQYASABKAkiZwonQ2FuY2VsT3BlcmF0b3JDcmVkZW50aWFsUmVxdWVzdFJlc3BvbnNlEjwKB3JlcXVlc3QYASABKAsyKy5jcnlwdG9zLmZsZWV0LnYxLk9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3Qi0QEKGU9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3QSCgoCaWQYASABKAkSDQoFbGV2ZWwYAiABKAkSDQoFZW1haWwYAyABKAkSEQoJZnVsbF9uYW1lGAQgASgJEg8KB2Nzcl9wZW0YBSABKAkSDQoFc3RhdGUYBiABKAkSFQoNY3JlYXRlZF9ieV9jbhgHIAEoCRISCgpjcmVhdGVkX2F0GAggASgJEhIKCmV4cGlyZXNfYXQYCSABKAkSGAoQY29tcGxldGVkX3NlcmlhbBgKIAEoCSJaCh9SZWNvcmRPcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0EhAKCGNlcnRfZGVyGAEgASgMEhIKCnJlcXVlc3RfaWQYAiABKAkSEQoJZnVsbF9uYW1lGAMgASgJIm4KIFJlY29yZE9wZXJhdG9yQ3JlZGVudGlhbFJlc3BvbnNlEjgKCmNyZWRlbnRpYWwYASABKAsyJC5jcnlwdG9zLmZsZWV0LnYxLk9wZXJhdG9yQ3JlZGVudGlhbBIQCgh3YXJuaW5ncxgCIAMoCSIYChZMaXN0T3BlcmF0b3JDQXNSZXF1ZXN0IkYKF0xpc3RPcGVyYXRvckNBc1Jlc3BvbnNlEisKBWl0ZW1zGAEgAygLMhwuY3J5cHRvcy5mbGVldC52MS5PcGVyYXRvckNBIpACChlSZWdpc3Rlck9wZXJhdG9yQ0FSZXF1ZXN0EhMKC2NhX2NlcnRfZGVyGAEgASgMEg0KA3VybBgCIAEoCUgAEhEKB2NybF9kZXIYAyABKAxIABIOCgRub25lGAQgASgISAASLQoJb2NzcF9tb2RlGAUgASgOMhouY3J5cHRvcy5mbGVldC52MS5PY3NwTW9kZRIQCghvY3NwX3VybBgGIAEoCRJFChBhY2tub3dsZWRnZW1lbnRzGAcgAygOMisuY3J5cHRvcy5mbGVldC52MS5PcGVyYXRvckNBQWNrbm93bGVkZ2VtZW50EhYKDmNvbmZpcm1fc2hhMjU2GAggASgJQgwKCmNybF9zb3VyY2UisAEKGlJlZ2lzdGVyT3BlcmF0b3JDQVJlc3BvbnNlEjEKC29wZXJhdG9yX2NhGAEgASgLMhwuY3J5cHRvcy5mbGVldC52MS5PcGVyYXRvckNBEhEKCWNvbmZpcm1lZBgCIAEoCBIVCg1hZG1pbl9leHRmaWxlGAMgASgJEjUKCm9jc3BfcHJvYmUYBCABKAsyIS5jcnlwdG9zLmZsZWV0LnYxLk9jc3BQcm9iZVJlc3VsdCJMChdSZXRpcmVPcGVyYXRvckNBUmVxdWVzdBIOCgZzaGEyNTYYASABKAkSIQoZaV91bmRlcnN0YW5kX3NlbGZfbG9ja291dBgCIAEoCCJNChhSZXRpcmVPcGVyYXRvckNBUmVzcG9uc2USMQoLb3BlcmF0b3JfY2EYASABKAsyHC5jcnlwdG9zLmZsZWV0LnYxLk9wZXJhdG9yQ0EitgEKHVNldE9wZXJhdG9yQ0FDUkxTb3VyY2VSZXF1ZXN0Eg4KBnNoYTI1NhgBIAEoCRINCgN1cmwYAiABKAlIABIOCgRub25lGAMgASgISAASEQoHY3JsX2RlchgFIAEoDEgAEkUKEGFja25vd2xlZGdlbWVudHMYBCADKA4yKy5jcnlwdG9zLmZsZWV0LnYxLk9wZXJhdG9yQ0FBY2tub3dsZWRnZW1lbnRCDAoKY3JsX3NvdXJjZSJTCh5TZXRPcGVyYXRvckNBQ1JMU291cmNlUmVzcG9uc2USMQoLb3BlcmF0b3JfY2EYASABKAsyHC5jcnlwdG9zLmZsZWV0LnYxLk9wZXJhdG9yQ0EiOwoYVXBsb2FkT3BlcmF0b3JDUkxSZXF1ZXN0Eg4KBnNoYTI1NhgBIAEoCRIPCgdjcmxfZGVyGAIgASgMIk4KGVVwbG9hZE9wZXJhdG9yQ1JMUmVzcG9uc2USMQoLb3BlcmF0b3JfY2EYASABKAsyHC5jcnlwdG9zLmZsZWV0LnYxLk9wZXJhdG9yQ0EiawoYU2V0T3BlcmF0b3JDQU9DU1BSZXF1ZXN0Eg4KBnNoYTI1NhgBIAEoCRItCglvY3NwX21vZGUYAiABKA4yGi5jcnlwdG9zLmZsZWV0LnYxLk9jc3BNb2RlEhAKCG9jc3BfdXJsGAMgASgJIoUBChlTZXRPcGVyYXRvckNBT0NTUFJlc3BvbnNlEjEKC29wZXJhdG9yX2NhGAEgASgLMhwuY3J5cHRvcy5mbGVldC52MS5PcGVyYXRvckNBEjUKCm9jc3BfcHJvYmUYAiABKAsyIS5jcnlwdG9zLmZsZWV0LnYxLk9jc3BQcm9iZVJlc3VsdCIqChZQcmV2aWV3QWRvcHRpb25SZXF1ZXN0EhAKCGVuZHBvaW50GAEgASgJIj8KF1ByZXZpZXdBZG9wdGlvblJlc3BvbnNlEhMKC2NlcnRfc2hhMjU2GAEgASgJEg8KB3N1YmplY3QYAiABKAkiRwoXTGlzdEluc3RhbGxEaXNrc1JlcXVlc3QSEAoIZW5kcG9pbnQYASABKAkSGgoScGlubmVkX2NlcnRfc2hhMjU2GAIgASgJIkIKGExpc3RJbnN0YWxsRGlza3NSZXNwb25zZRImCgVkaXNrcxgBIAMoCzIXLmNyeXB0b3MudjEuSW5zdGFsbERpc2siawoQQWRvcHROb2RlUmVxdWVzdBIQCghlbmRwb2ludBgBIAEoCRIaChJwaW5uZWRfY2VydF9zaGEyNTYYAiABKAkSKQoGY29uZmlnGAMgASgLMhkuY3J5cHRvcy52MS5NYWNoaW5lQ29uZmlnIoUBChFBZG9wdE5vZGVSZXNwb25zZRINCgVwaGFzZRgBIAEoCRIOCgZkZXRhaWwYAiABKAkSDAoEZG9uZRgDIAEoCBIPCgdub2RlX2lkGAQgASgJEhMKC2Fkb3B0aW9uX2lkGAUgASgJEh0KFXByZXNlbnRlZF9jZXJ0X3NoYTI1NhgGIAEoCSJNCiFDb25maXJtQWRvcHRpb25GaW5nZXJwcmludFJlcXVlc3QSEwoLYWRvcHRpb25faWQYASABKAkSEwoLY2VydF9zaGEyNTYYAiABKAkiJAoiQ29uZmlybUFkb3B0aW9uRmluZ2VycHJpbnRSZXNwb25zZSJaChdEZWNvbW1pc3Npb25Ob2RlUmVxdWVzdBIRCglub2RlX25hbWUYASABKAkSGwoTY29uZmlybV9jb21tb25fbmFtZRgCIAEoCRIPCgdub2RlX2lkGAMgASgJIi0KGERlY29tbWlzc2lvbk5vZGVSZXNwb25zZRIRCglyZWJvb3RpbmcYASABKAgiNgoRUmVuYW1lTm9kZVJlcXVlc3QSDwoHbm9kZV9pZBgBIAEoCRIQCghuZXdfbmFtZRgCIAEoCSJBChJSZW5hbWVOb2RlUmVzcG9uc2USKwoEbm9kZRgBIAEoCzIdLmNyeXB0b3MuZmxlZXQudjEuTm9kZVN1bW1hcnkiOgoRUmVtb3ZlTm9kZVJlcXVlc3QSDwoHbm9kZV9pZBgBIAEoCRIUCgxjb25maXJtX25hbWUYAiABKAkiQQoSUmVtb3ZlTm9kZVJlc3BvbnNlEisKBG5vZGUYASABKAsyHS5jcnlwdG9zLmZsZWV0LnYxLk5vZGVTdW1tYXJ5IiEKEkxpc3RNY3BLZXlzUmVxdWVzdBILCgNhbGwYASABKAgiPgoTTGlzdE1jcEtleXNSZXNwb25zZRInCgVpdGVtcxgBIAMoCzIYLmNyeXB0b3MuZmxlZXQudjEuTWNwS2V5IiEKE1Jldm9rZU1jcEtleVJlcXVlc3QSCgoCaWQYASABKAkiQQoUUmV2b2tlTWNwS2V5UmVzcG9uc2USKQoHbWNwX2tleRgBIAEoCzIYLmNyeXB0b3MuZmxlZXQudjEuTWNwS2V5IjsKE0NyZWF0ZU1jcEtleVJlcXVlc3QSDQoFbGFiZWwYASABKAkSFQoNbGV2ZWxfY2VpbGluZxgCIAEoCSJYChRDcmVhdGVNY3BLZXlSZXNwb25zZRIVCg1wbGFpbnRleHRfa2V5GAEgASgJEikKB21jcF9rZXkYAiABKAsyGC5jcnlwdG9zLmZsZWV0LnYxLk1jcEtleSK7AQoGTWNwS2V5EgoKAmlkGAEgASgJEg0KBWxhYmVsGAIgASgJEhMKC2NsaWVudF9uYW1lGAMgASgJEhMKC29wZXJhdG9yX2NuGAQgASgJEhcKD29wZXJhdG9yX3NlcmlhbBgFIAEoCRIVCg1sZXZlbF9jZWlsaW5nGAYgASgJEhIKCmNyZWF0ZWRfYXQYByABKAkSFAoMbGFzdF91c2VkX2F0GAggASgJEhIKCnJldm9rZWRfYXQYCSABKAkiJgoUTGlzdEFwcHJvdmFsc1JlcXVlc3QSDgoGc3RhdHVzGAEgASgJIkIKFUxpc3RBcHByb3ZhbHNSZXNwb25zZRIpCgVpdGVtcxgBIAMoCzIaLmNyeXB0b3MuZmxlZXQudjEuQXBwcm92YWwiNAoVRGVjaWRlQXBwcm92YWxSZXF1ZXN0EgoKAmlkGAEgASgJEg8KB2FwcHJvdmUYAiABKAgiRgoWRGVjaWRlQXBwcm92YWxSZXNwb25zZRIsCghhcHByb3ZhbBgBIAEoCzIaLmNyeXB0b3MuZmxlZXQudjEuQXBwcm92YWwiqQIKCEFwcHJvdmFsEgoKAmlkGAEgASgJEgwKBHRvb2wYAiABKAkSDwoHc3VtbWFyeRgDIAEoCRIWCg5yZXF1ZXN0X2RpZ2VzdBgEIAEoCRIXCg9yZXF1ZXN0ZWRfYnlfY24YBSABKAkSGwoTcmVxdWVzdGVkX2J5X3NlcmlhbBgGIAEoCRIOCgZrZXlfaWQYByABKAkSFgoOcmVxdWlyZWRfbGV2ZWwYCCABKAkSEgoKY3JlYXRlZF9hdBgJIAEoCRISCgpleHBpcmVzX2F0GAogASgJEg4KBnN0YXR1cxgLIAEoCRIVCg1kZWNpZGVkX2J5X2NuGAwgASgJEhkKEWRlY2lkZWRfYnlfc2VyaWFsGA0gASgJEhIKCmRlY2lkZWRfYXQYDiABKAkqUgoGSGVhbHRoEhYKEkhFQUxUSF9VTlNQRUNJRklFRBAAEg0KCUhFQUxUSF9VUBABEg8KC0hFQUxUSF9ET1dOEAISEAoMSEVBTFRIX0VSUk9SEAMyuigKDEZsZWV0U2VydmljZRJUCglMaXN0Tm9kZXMSIi5jcnlwdG9zLmZsZWV0LnYxLkxpc3ROb2Rlc1JlcXVlc3QaIy5jcnlwdG9zLmZsZWV0LnYxLkxpc3ROb2Rlc1Jlc3BvbnNlEk4KB0dldE5vZGUSIC5jcnlwdG9zLmZsZWV0LnYxLkdldE5vZGVSZXF1ZXN0GiEuY3J5cHRvcy5mbGVldC52MS5HZXROb2RlUmVzcG9uc2USaQoQTGlzdENlcnRpZmljYXRlcxIpLmNyeXB0b3MuZmxlZXQudjEuTGlzdENlcnRpZmljYXRlc1JlcXVlc3QaKi5jcnlwdG9zLmZsZWV0LnYxLkxpc3RDZXJ0aWZpY2F0ZXNSZXNwb25zZRJdCgxMaXN0UHJvZmlsZXMSJS5jcnlwdG9zLmZsZWV0LnYxLkxpc3RQcm9maWxlc1JlcXVlc3QaJi5jcnlwdG9zLmZsZWV0LnYxLkxpc3RQcm9maWxlc1Jlc3BvbnNlEmAKDUNyZWF0ZVByb2ZpbGUSJi5jcnlwdG9zLmZsZWV0LnYxLkNyZWF0ZVByb2ZpbGVSZXF1ZXN0GicuY3J5cHRvcy5mbGVldC52MS5DcmVhdGVQcm9maWxlUmVzcG9uc2USYAoNVXBkYXRlUHJvZmlsZRImLmNyeXB0b3MuZmxlZXQudjEuVXBkYXRlUHJvZmlsZVJlcXVlc3QaJy5jcnlwdG9zLmZsZWV0LnYxLlVwZGF0ZVByb2ZpbGVSZXNwb25zZRJgCg1EZWxldGVQcm9maWxlEiYuY3J5cHRvcy5mbGVldC52MS5EZWxldGVQcm9maWxlUmVxdWVzdBonLmNyeXB0b3MuZmxlZXQudjEuRGVsZXRlUHJvZmlsZVJlc3BvbnNlEm8KEkFwcGx5UHJvZmlsZVRvTm9kZRIrLmNyeXB0b3MuZmxlZXQudjEuQXBwbHlQcm9maWxlVG9Ob2RlUmVxdWVzdBosLmNyeXB0b3MuZmxlZXQudjEuQXBwbHlQcm9maWxlVG9Ob2RlUmVzcG9uc2USXQoMTGlzdEFkYXB0ZXJzEiUuY3J5cHRvcy5mbGVldC52MS5MaXN0QWRhcHRlcnNSZXF1ZXN0GiYuY3J5cHRvcy5mbGVldC52MS5MaXN0QWRhcHRlcnNSZXNwb25zZRJsChFTZXRBZGFwdGVyRW5hYmxlZBIqLmNyeXB0b3MuZmxlZXQudjEuU2V0QWRhcHRlckVuYWJsZWRSZXF1ZXN0GisuY3J5cHRvcy5mbGVldC52MS5TZXRBZGFwdGVyRW5hYmxlZFJlc3BvbnNlEmYKD1NldE5vZGVQcm90b2NvbBIoLmNyeXB0b3MuZmxlZXQudjEuU2V0Tm9kZVByb3RvY29sUmVxdWVzdBopLmNyeXB0b3MuZmxlZXQudjEuU2V0Tm9kZVByb3RvY29sUmVzcG9uc2USVAoJTGlzdEF1ZGl0EiIuY3J5cHRvcy5mbGVldC52MS5MaXN0QXVkaXRSZXF1ZXN0GiMuY3J5cHRvcy5mbGVldC52MS5MaXN0QXVkaXRSZXNwb25zZRJmCg9MaXN0RW5yb2xsbWVudHMSKC5jcnlwdG9zLmZsZWV0LnYxLkxpc3RFbnJvbGxtZW50c1JlcXVlc3QaKS5jcnlwdG9zLmZsZWV0LnYxLkxpc3RFbnJvbGxtZW50c1Jlc3BvbnNlEmkKEENyZWF0ZUVucm9sbG1lbnQSKS5jcnlwdG9zLmZsZWV0LnYxLkNyZWF0ZUVucm9sbG1lbnRSZXF1ZXN0GiouY3J5cHRvcy5mbGVldC52MS5DcmVhdGVFbnJvbGxtZW50UmVzcG9uc2USbAoRQXBwcm92ZUVucm9sbG1lbnQSKi5jcnlwdG9zLmZsZWV0LnYxLkFwcHJvdmVFbnJvbGxtZW50UmVxdWVzdBorLmNyeXB0b3MuZmxlZXQudjEuQXBwcm92ZUVucm9sbG1lbnRSZXNwb25zZRJpChBSZWplY3RFbnJvbGxtZW50EikuY3J5cHRvcy5mbGVldC52MS5SZWplY3RFbnJvbGxtZW50UmVxdWVzdBoqLmNyeXB0b3MuZmxlZXQudjEuUmVqZWN0RW5yb2xsbWVudFJlc3BvbnNlEksKBldob0FtSRIfLmNyeXB0b3MuZmxlZXQudjEuV2hvQW1JUmVxdWVzdBogLmNyeXB0b3MuZmxlZXQudjEuV2hvQW1JUmVzcG9uc2USbAoRUmV2b2tlQ2VydGlmaWNhdGUSKi5jcnlwdG9zLmZsZWV0LnYxLlJldm9rZUNlcnRpZmljYXRlUmVxdWVzdBorLmNyeXB0b3MuZmxlZXQudjEuUmV2b2tlQ2VydGlmaWNhdGVSZXNwb25zZRJjCg5HZXRDZXJ0aWZpY2F0ZRInLmNyeXB0b3MuZmxlZXQudjEuR2V0Q2VydGlmaWNhdGVSZXF1ZXN0GiguY3J5cHRvcy5mbGVldC52MS5HZXRDZXJ0aWZpY2F0ZVJlc3BvbnNlElQKCUlzc3VlTGVhZhIiLmNyeXB0b3MuZmxlZXQudjEuSXNzdWVMZWFmUmVxdWVzdBojLmNyeXB0b3MuZmxlZXQudjEuSXNzdWVMZWFmUmVzcG9uc2USVAoJUmVrZXlOb2RlEiIuY3J5cHRvcy5mbGVldC52MS5SZWtleU5vZGVSZXF1ZXN0GiMuY3J5cHRvcy5mbGVldC52MS5SZWtleU5vZGVSZXNwb25zZRJgCg1HZXROb2RlQ29uZmlnEiYuY3J5cHRvcy5mbGVldC52MS5HZXROb2RlQ29uZmlnUmVxdWVzdBonLmNyeXB0b3MuZmxlZXQudjEuR2V0Tm9kZUNvbmZpZ1Jlc3BvbnNlEmYKD0FwcGx5Tm9kZUNvbmZpZxIoLmNyeXB0b3MuZmxlZXQudjEuQXBwbHlOb2RlQ29uZmlnUmVxdWVzdBopLmNyeXB0b3MuZmxlZXQudjEuQXBwbHlOb2RlQ29uZmlnUmVzcG9uc2USWgoLRXhwb3J0Q0FLZXkSJC5jcnlwdG9zLmZsZWV0LnYxLkV4cG9ydENBS2V5UmVxdWVzdBolLmNyeXB0b3MuZmxlZXQudjEuRXhwb3J0Q0FLZXlSZXNwb25zZRJaCgtJbXBvcnRDQUtleRIkLmNyeXB0b3MuZmxlZXQudjEuSW1wb3J0Q0FLZXlSZXF1ZXN0GiUuY3J5cHRvcy5mbGVldC52MS5JbXBvcnRDQUtleVJlc3BvbnNlEpYBCh9DcmVhdGVPcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0EjguY3J5cHRvcy5mbGVldC52MS5DcmVhdGVPcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0UmVxdWVzdBo5LmNyeXB0b3MuZmxlZXQudjEuQ3JlYXRlT3BlcmF0b3JDcmVkZW50aWFsUmVxdWVzdFJlc3BvbnNlEpMBCh5MaXN0T3BlcmF0b3JDcmVkZW50aWFsUmVxdWVzdHMSNy5jcnlwdG9zLmZsZWV0LnYxLkxpc3RPcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0c1JlcXVlc3QaOC5jcnlwdG9zLmZsZWV0LnYxLkxpc3RPcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0c1Jlc3BvbnNlEpYBCh9DYW5jZWxPcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0EjguY3J5cHRvcy5mbGVldC52MS5DYW5jZWxPcGVyYXRvckNyZWRlbnRpYWxSZXF1ZXN0UmVxdWVzdBo5LmNyeXB0b3MuZmxlZXQudjEuQ2FuY2VsT3BlcmF0b3JDcmVkZW50aWFsUmVxdWVzdFJlc3BvbnNlEoEBChhSZWNvcmRPcGVyYXRvckNyZWRlbnRpYWwSMS5jcnlwdG9zLmZsZWV0LnYxLlJlY29yZE9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3QaMi5jcnlwdG9zLmZsZWV0LnYxLlJlY29yZE9wZXJhdG9yQ3JlZGVudGlhbFJlc3BvbnNlEoEBChhSZXZva2VPcGVyYXRvckNyZWRlbnRpYWwSMS5jcnlwdG9zLmZsZWV0LnYxLlJldm9rZU9wZXJhdG9yQ3JlZGVudGlhbFJlcXVlc3QaMi5jcnlwdG9zLmZsZWV0LnYxLlJldm9rZU9wZXJhdG9yQ3JlZGVudGlhbFJlc3BvbnNlEn4KF0xpc3RPcGVyYXRvckNyZWRlbnRpYWxzEjAuY3J5cHRvcy5mbGVldC52MS5MaXN0T3BlcmF0b3JDcmVkZW50aWFsc1JlcXVlc3QaMS5jcnlwdG9zLmZsZWV0LnYxLkxpc3RPcGVyYXRvckNyZWRlbnRpYWxzUmVzcG9uc2USZgoPTGlzdE9wZXJhdG9yQ0FzEiguY3J5cHRvcy5mbGVldC52MS5MaXN0T3BlcmF0b3JDQXNSZXF1ZXN0GikuY3J5cHRvcy5mbGVldC52MS5MaXN0T3BlcmF0b3JDQXNSZXNwb25zZRJvChJSZWdpc3Rlck9wZXJhdG9yQ0ESKy5jcnlwdG9zLmZsZWV0LnYxLlJlZ2lzdGVyT3BlcmF0b3JDQVJlcXVlc3QaLC5jcnlwdG9zLmZsZWV0LnYxLlJlZ2lzdGVyT3BlcmF0b3JDQVJlc3BvbnNlEmkKEFJldGlyZU9wZXJhdG9yQ0ESKS5jcnlwdG9zLmZsZWV0LnYxLlJldGlyZU9wZXJhdG9yQ0FSZXF1ZXN0GiouY3J5cHRvcy5mbGVldC52MS5SZXRpcmVPcGVyYXRvckNBUmVzcG9uc2USewoWU2V0T3BlcmF0b3JDQUNSTFNvdXJjZRIvLmNyeXB0b3MuZmxlZXQudjEuU2V0T3BlcmF0b3JDQUNSTFNvdXJjZVJlcXVlc3QaMC5jcnlwdG9zLmZsZWV0LnYxLlNldE9wZXJhdG9yQ0FDUkxTb3VyY2VSZXNwb25zZRJsChFVcGxvYWRPcGVyYXRvckNSTBIqLmNyeXB0b3MuZmxlZXQudjEuVXBsb2FkT3BlcmF0b3JDUkxSZXF1ZXN0GisuY3J5cHRvcy5mbGVldC52MS5VcGxvYWRPcGVyYXRvckNSTFJlc3BvbnNlEmwKEVNldE9wZXJhdG9yQ0FPQ1NQEiouY3J5cHRvcy5mbGVldC52MS5TZXRPcGVyYXRvckNBT0NTUFJlcXVlc3QaKy5jcnlwdG9zLmZsZWV0LnYxLlNldE9wZXJhdG9yQ0FPQ1NQUmVzcG9uc2USZgoPUHJldmlld0Fkb3B0aW9uEiguY3J5cHRvcy5mbGVldC52MS5QcmV2aWV3QWRvcHRpb25SZXF1ZXN0GikuY3J5cHRvcy5mbGVldC52MS5QcmV2aWV3QWRvcHRpb25SZXNwb25zZRJpChBMaXN0SW5zdGFsbERpc2tzEikuY3J5cHRvcy5mbGVldC52MS5MaXN0SW5zdGFsbERpc2tzUmVxdWVzdBoqLmNyeXB0b3MuZmxlZXQudjEuTGlzdEluc3RhbGxEaXNrc1Jlc3BvbnNlElYKCUFkb3B0Tm9kZRIiLmNyeXB0b3MuZmxlZXQudjEuQWRvcHROb2RlUmVxdWVzdBojLmNyeXB0b3MuZmxlZXQudjEuQWRvcHROb2RlUmVzcG9uc2UwARKHAQoaQ29uZmlybUFkb3B0aW9uRmluZ2VycHJpbnQSMy5jcnlwdG9zLmZsZWV0LnYxLkNvbmZpcm1BZG9wdGlvbkZpbmdlcnByaW50UmVxdWVzdBo0LmNyeXB0b3MuZmxlZXQudjEuQ29uZmlybUFkb3B0aW9uRmluZ2VycHJpbnRSZXNwb25zZRJpChBEZWNvbW1pc3Npb25Ob2RlEikuY3J5cHRvcy5mbGVldC52MS5EZWNvbW1pc3Npb25Ob2RlUmVxdWVzdBoqLmNyeXB0b3MuZmxlZXQudjEuRGVjb21taXNzaW9uTm9kZVJlc3BvbnNlElcKClJlbmFtZU5vZGUSIy5jcnlwdG9zLmZsZWV0LnYxLlJlbmFtZU5vZGVSZXF1ZXN0GiQuY3J5cHRvcy5mbGVldC52MS5SZW5hbWVOb2RlUmVzcG9uc2USVwoKUmVtb3ZlTm9kZRIjLmNyeXB0b3MuZmxlZXQudjEuUmVtb3ZlTm9kZVJlcXVlc3QaJC5jcnlwdG9zLmZsZWV0LnYxLlJlbW92ZU5vZGVSZXNwb25zZRJaCgtMaXN0TWNwS2V5cxIkLmNyeXB0b3MuZmxlZXQudjEuTGlzdE1jcEtleXNSZXF1ZXN0GiUuY3J5cHRvcy5mbGVldC52MS5MaXN0TWNwS2V5c1Jlc3BvbnNlEl0KDFJldm9rZU1jcEtleRIlLmNyeXB0b3MuZmxlZXQudjEuUmV2b2tlTWNwS2V5UmVxdWVzdBomLmNyeXB0b3MuZmxlZXQudjEuUmV2b2tlTWNwS2V5UmVzcG9uc2USXQoMQ3JlYXRlTWNwS2V5EiUuY3J5cHRvcy5mbGVldC52MS5DcmVhdGVNY3BLZXlSZXF1ZXN0GiYuY3J5cHRvcy5mbGVldC52MS5DcmVhdGVNY3BLZXlSZXNwb25zZRJgCg1MaXN0QXBwcm92YWxzEiYuY3J5cHRvcy5mbGVldC52MS5MaXN0QXBwcm92YWxzUmVxdWVzdBonLmNyeXB0b3MuZmxlZXQudjEuTGlzdEFwcHJvdmFsc1Jlc3BvbnNlEmMKDkRlY2lkZUFwcHJvdmFsEicuY3J5cHRvcy5mbGVldC52MS5EZWNpZGVBcHByb3ZhbFJlcXVlc3QaKC5jcnlwdG9zLmZsZWV0LnYxLkRlY2lkZUFwcHJvdmFsUmVzcG9uc2VCOFo2Z2l0aHViLmNvbS9DcnlwdE9TLVBLSS9hcGkvZ28vY3J5cHRvcy9mbGVldC92MTtmbGVldHYxYgZwcm90bzM", [file_cryptos_fleet_v1_operator_ca, file_cryptos_v1_config, file_cryptos_v1_node, file_cryptos_v1_status]);
 
 /**
  * @generated from message cryptos.fleet.v1.ListNodesRequest
@@ -3016,6 +3016,56 @@ export type RenameNodeResponse = Message<"cryptos.fleet.v1.RenameNodeResponse">
 export const RenameNodeResponseSchema: GenMessage<RenameNodeResponse> = /*@__PURE__*/
   messageDesc(file_cryptos_fleet_v1_fleet, 95);
 
+/**
+ * RemoveNodeRequest names the node to remove from the inventory.
+ *
+ * @generated from message cryptos.fleet.v1.RemoveNodeRequest
+ */
+export type RemoveNodeRequest = Message<"cryptos.fleet.v1.RemoveNodeRequest"> & {
+  /**
+   * node_id is the stable ID (NodeSummary.id) of the node to remove.
+   *
+   * @generated from field: string node_id = 1;
+   */
+  nodeId: string;
+
+  /**
+   * confirm_name must equal the node's current name, so a mistyped ID
+   * can't remove another node.
+   *
+   * @generated from field: string confirm_name = 2;
+   */
+  confirmName: string;
+};
+
+/**
+ * Describes the message cryptos.fleet.v1.RemoveNodeRequest.
+ * Use `create(RemoveNodeRequestSchema)` to create a new message.
+ */
+export const RemoveNodeRequestSchema: GenMessage<RemoveNodeRequest> = /*@__PURE__*/
+  messageDesc(file_cryptos_fleet_v1_fleet, 96);
+
+/**
+ * RemoveNodeResponse carries the node as it was before removal.
+ *
+ * @generated from message cryptos.fleet.v1.RemoveNodeResponse
+ */
+export type RemoveNodeResponse = Message<"cryptos.fleet.v1.RemoveNodeResponse"> & {
+  /**
+   * node is the removed node's id, name, address and role.
+   *
+   * @generated from field: cryptos.fleet.v1.NodeSummary node = 1;
+   */
+  node?: NodeSummary | undefined;
+};
+
+/**
+ * Describes the message cryptos.fleet.v1.RemoveNodeResponse.
+ * Use `create(RemoveNodeResponseSchema)` to create a new message.
+ */
+export const RemoveNodeResponseSchema: GenMessage<RemoveNodeResponse> = /*@__PURE__*/
+  messageDesc(file_cryptos_fleet_v1_fleet, 97);
+
 /**
  * ListMcpKeysRequest scopes the MCP key listing.
  *
@@ -3035,7 +3085,7 @@ export type ListMcpKeysRequest = Message<"cryptos.fleet.v1.ListMcpKeysRequest">
  * Use `create(ListMcpKeysRequestSchema)` to create a new message.
  */
 export const ListMcpKeysRequestSchema: GenMessage<ListMcpKeysRequest> = /*@__PURE__*/
-  messageDesc(file_cryptos_fleet_v1_fleet, 96);
+  messageDesc(file_cryptos_fleet_v1_fleet, 98);
 
 /**
  * ListMcpKeysResponse carries the listed MCP keys, revoked ones included.
@@ -3056,7 +3106,7 @@ export type ListMcpKeysResponse = Message<"cryptos.fleet.v1.ListMcpKeysResponse"
  * Use `create(ListMcpKeysResponseSchema)` to create a new message.
  */
 export const ListMcpKeysResponseSchema: GenMessage<ListMcpKeysResponse> = /*@__PURE__*/
-  messageDesc(file_cryptos_fleet_v1_fleet, 97);
+  messageDesc(file_cryptos_fleet_v1_fleet, 99);
 
 /**
  * RevokeMcpKeyRequest names the MCP key to revoke.
@@ -3077,7 +3127,7 @@ export type RevokeMcpKeyRequest = Message<"cryptos.fleet.v1.RevokeMcpKeyRequest"
  * Use `create(RevokeMcpKeyRequestSchema)` to create a new message.
  */
 export const RevokeMcpKeyRequestSchema: GenMessage<RevokeMcpKeyRequest> = /*@__PURE__*/
-  messageDesc(file_cryptos_fleet_v1_fleet, 98);
+  messageDesc(file_cryptos_fleet_v1_fleet, 100);
 
 /**
  * RevokeMcpKeyResponse returns the key after revocation.
@@ -3098,7 +3148,7 @@ export type RevokeMcpKeyResponse = Message<"cryptos.fleet.v1.RevokeMcpKeyRespons
  * Use `create(RevokeMcpKeyResponseSchema)` to create a new message.
  */
 export const RevokeMcpKeyResponseSchema: GenMessage<RevokeMcpKeyResponse> = /*@__PURE__*/
-  messageDesc(file_cryptos_fleet_v1_fleet, 99);
+  messageDesc(file_cryptos_fleet_v1_fleet, 101);
 
 /**
  * CreateMcpKeyRequest carries the operator's label for the new key and an
@@ -3129,7 +3179,7 @@ export type CreateMcpKeyRequest = Message<"cryptos.fleet.v1.CreateMcpKeyRequest"
  * Use `create(CreateMcpKeyRequestSchema)` to create a new message.
  */
 export const CreateMcpKeyRequestSchema: GenMessage<CreateMcpKeyRequest> = /*@__PURE__*/
-  messageDesc(file_cryptos_fleet_v1_fleet, 100);
+  messageDesc(file_cryptos_fleet_v1_fleet, 102);
 
 /**
  * CreateMcpKeyResponse carries the new key. plaintext_key is returned only
@@ -3159,7 +3209,7 @@ export type CreateMcpKeyResponse = Message<"cryptos.fleet.v1.CreateMcpKeyRespons
  * Use `create(CreateMcpKeyResponseSchema)` to create a new message.
  */
 export const CreateMcpKeyResponseSchema: GenMessage<CreateMcpKeyResponse> = /*@__PURE__*/
-  messageDesc(file_cryptos_fleet_v1_fleet, 101);
+  messageDesc(file_cryptos_fleet_v1_fleet, 103);
 
 /**
  * McpKey is the metadata of one MCP agent key. It never carries the key or
@@ -3243,7 +3293,7 @@ export type McpKey = Message<"cryptos.fleet.v1.McpKey"> & {
  * Use `create(McpKeySchema)` to create a new message.
  */
 export const McpKeySchema: GenMessage<McpKey> = /*@__PURE__*/
-  messageDesc(file_cryptos_fleet_v1_fleet, 102);
+  messageDesc(file_cryptos_fleet_v1_fleet, 104);
 
 /**
  * ListApprovalsRequest filters the approval listing.
@@ -3265,7 +3315,7 @@ export type ListApprovalsRequest = Message<"cryptos.fleet.v1.ListApprovalsReques
  * Use `create(ListApprovalsRequestSchema)` to create a new message.
  */
 export const ListApprovalsRequestSchema: GenMessage<ListApprovalsRequest> = /*@__PURE__*/
-  messageDesc(file_cryptos_fleet_v1_fleet, 103);
+  messageDesc(file_cryptos_fleet_v1_fleet, 105);
 
 /**
  * ListApprovalsResponse carries the listed approvals.
@@ -3286,7 +3336,7 @@ export type ListApprovalsResponse = Message<"cryptos.fleet.v1.ListApprovalsRespo
  * Use `create(ListApprovalsResponseSchema)` to create a new message.
  */
 export const ListApprovalsResponseSchema: GenMessage<ListApprovalsResponse> = /*@__PURE__*/
-  messageDesc(file_cryptos_fleet_v1_fleet, 104);
+  messageDesc(file_cryptos_fleet_v1_fleet, 106);
 
 /**
  * DecideApprovalRequest names the approval to decide and the decision.
@@ -3314,7 +3364,7 @@ export type DecideApprovalRequest = Message<"cryptos.fleet.v1.DecideApprovalRequ
  * Use `create(DecideApprovalRequestSchema)` to create a new message.
  */
 export const DecideApprovalRequestSchema: GenMessage<DecideApprovalRequest> = /*@__PURE__*/
-  messageDesc(file_cryptos_fleet_v1_fleet, 105);
+  messageDesc(file_cryptos_fleet_v1_fleet, 107);
 
 /**
  * DecideApprovalResponse returns the approval after the decision.
@@ -3336,7 +3386,7 @@ export type DecideApprovalResponse = Message<"cryptos.fleet.v1.DecideApprovalRes
  * Use `create(DecideApprovalResponseSchema)` to create a new message.
  */
 export const DecideApprovalResponseSchema: GenMessage<DecideApprovalResponse> = /*@__PURE__*/
-  messageDesc(file_cryptos_fleet_v1_fleet, 106);
+  messageDesc(file_cryptos_fleet_v1_fleet, 108);
 
 /**
  * Approval is one step-up approval request for an MCP tool call. Listing and
@@ -3457,7 +3507,7 @@ export type Approval = Message<"cryptos.fleet.v1.Approval"> & {
  * Use `create(ApprovalSchema)` to create a new message.
  */
 export const ApprovalSchema: GenMessage<Approval> = /*@__PURE__*/
-  messageDesc(file_cryptos_fleet_v1_fleet, 107);
+  messageDesc(file_cryptos_fleet_v1_fleet, 109);
 
 /**
  * Health reports the manager's view of node reachability, independent of
@@ -4056,6 +4106,24 @@ export const FleetService: GenService<{
     input: typeof RenameNodeRequestSchema;
     output: typeof RenameNodeResponseSchema;
   },
+  /**
+   * RemoveNode removes a node from the manager's inventory without contacting
+   * the node, for a node that is gone (destroyed, or wiped and not coming
+   * back). It does not reset or unlink the node; DecommissionNode does that.
+   * confirm_name must equal the node's current name. The node's audit
+   * history and name history are kept, and its credentials folder is moved
+   * aside rather than deleted. NotFound if no node has node_id;
+   * InvalidArgument if confirm_name doesn't match; FailedPrecondition while
+   * something still depends on the node, such as a pending enrollment that
+   * names it. Admin-gated and audited (node-removed, with the name and ID).
+   *
+   * @generated from rpc cryptos.fleet.v1.FleetService.RemoveNode
+   */
+  removeNode: {
+    methodKind: "unary";
+    input: typeof RemoveNodeRequestSchema;
+    output: typeof RemoveNodeResponseSchema;
+  },
   /**
    * ListMcpKeys returns the MCP agent keys bound to the calling operator's
    * certificate. An admin may set all to list every operator's keys; a
diff --git a/src/lib/bootstrap.test.ts b/src/lib/bootstrap.test.ts
new file mode 100644
index 0000000..a0de2c2
--- /dev/null
+++ b/src/lib/bootstrap.test.ts
@@ -0,0 +1,149 @@
+/*
+Copyright The CryptOS Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { BootstrapState } from "@/gen/fleet/cryptos/fleet/v1/bootstrap_pb";
+import { ErrorReason } from "@/gen/fleet/cryptos/fleet/v1/errors_pb";
+import {
+  __resetBootstrap,
+  BOOTSTRAP_SESSION_HEADER,
+  endBootstrapSession,
+  getBootstrapState,
+  hasBootstrapSession,
+  registerOperatorCABootstrap,
+  startBootstrapSession,
+  submitFirstAdminCertificate,
+} from "@/lib/bootstrap";
+import * as modeMod from "@/lib/fleet/mode";
+
+const SECRET = "fos_bsess_" + "A".repeat(52);
+
+interface Call {
+  body: string;
+  headers: Headers;
+  url: string;
+}
+
+const stubManager = (responses: Record<string, unknown>) => {
+  const calls: Call[] = [];
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = String(input);
+      const raw = init?.body;
+      calls.push({
+        body: ArrayBuffer.isView(raw) ? new TextDecoder().decode(raw) : String(raw ?? ""),
+        headers: new Headers(init?.headers),
+        url,
+      });
+      const method = url.split("/").pop() ?? "";
+      return new Response(JSON.stringify(responses[method] ?? {}), {
+        headers: { "content-type": "application/json" },
+        status: 200,
+      });
+    }),
+  );
+  return calls;
+};
+
+beforeEach(() => {
+  __resetBootstrap();
+  vi.spyOn(modeMod, "fleetMode").mockReturnValue("live");
+  localStorage.clear();
+  sessionStorage.clear();
+});
+afterEach(() => {
+  vi.restoreAllMocks();
+  vi.unstubAllGlobals();
+});
+
+describe("bootstrap client", () => {
+  it("reads the state anonymously", async () => {
+    const calls = stubManager({
+      GetBootstrapState: {
+        reasonCode: "ERROR_REASON_DATABASE_REQUIRED",
+        state: "BOOTSTRAP_STATE_UNAVAILABLE",
+      },
+    });
+    const state = await getBootstrapState();
+    expect(state.state).toBe(BootstrapState.UNAVAILABLE);
+    expect(state.reasonCode).toBe(ErrorReason.DATABASE_REQUIRED);
+    expect(calls[0].url).toMatch(/cryptos\.fleet\.v1\.BootstrapService\/GetBootstrapState$/);
+    expect(calls[0].headers.has(BOOTSTRAP_SESSION_HEADER)).toBe(false);
+  });
+
+  it("sends the session secret only in the header, and stores it nowhere", async () => {
+    const calls = stubManager({
+      RegisterOperatorCA: { confirmed: false, operatorCa: { sha256: "ab".repeat(32) } },
+      StartBootstrapSession: { expiresAt: "2026-09-30T13:00:00Z", sessionSecret: SECRET },
+      SubmitFirstAdminCertificate: { email: "admin@example.org", serialHex: "01" },
+    });
+    await startBootstrapSession("fos_boot_7K3Q-M2XD");
+    expect(hasBootstrapSession()).toBe(true);
+
+    await registerOperatorCABootstrap({
+      caCertDer: new Uint8Array([1]),
+      confirmSha256: "",
+      crl: { kind: "none" },
+      ocspMode: "aia",
+      ocspUrl: "",
+    });
+    await submitFirstAdminCertificate({ certDer: new Uint8Array([2]), fullName: "Ada Admin" });
+
+    expect(calls[0].headers.has(BOOTSTRAP_SESSION_HEADER)).toBe(false);
+    for (const call of calls.slice(1)) {
+      expect(call.headers.get(BOOTSTRAP_SESSION_HEADER)).toBe(SECRET);
+      expect(call.body).not.toContain(SECRET);
+      expect(call.url).not.toContain(SECRET);
+    }
+    const stored = [
+      ...Object.values(localStorage),
+      ...Object.values(sessionStorage),
+      document.cookie,
+    ].join("\n");
+    expect(stored).not.toContain(SECRET);
+    expect(stored).not.toContain("fos_boot_");
+  });
+
+  it("forgets the session when it ends", async () => {
+    stubManager({ StartBootstrapSession: { sessionSecret: SECRET } });
+    await startBootstrapSession("fos_boot_x");
+    endBootstrapSession();
+    expect(hasBootstrapSession()).toBe(false);
+  });
+
+  it("sends the CSR with the first admin certificate only when there is one", async () => {
+    const calls = stubManager({
+      StartBootstrapSession: { sessionSecret: SECRET },
+      SubmitFirstAdminCertificate: { serialHex: "01" },
+    });
+    await startBootstrapSession("fos_boot_x");
+    await submitFirstAdminCertificate({
+      certDer: new Uint8Array([2]),
+      csrDer: new Uint8Array([3]),
+      fullName: "A",
+    });
+    expect(JSON.parse(calls[1].body)).toEqual({ certDer: "Ag==", csrDer: "Aw==", fullName: "A" });
+  });
+});
+
+describe("bootstrap client (mock mode)", () => {
+  it("starts closed, so the console behaves as before", async () => {
+    vi.spyOn(modeMod, "fleetMode").mockReturnValue("mock");
+    expect((await getBootstrapState()).state).toBe(BootstrapState.CLOSED);
+  });
+});
diff --git a/src/lib/bootstrap.ts b/src/lib/bootstrap.ts
new file mode 100644
index 0000000..e948a03
--- /dev/null
+++ b/src/lib/bootstrap.ts
@@ -0,0 +1,191 @@
+/*
+Copyright The CryptOS Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { Code, ConnectError, createClient, type Interceptor } from "@connectrpc/connect";
+import { createConnectTransport } from "@connectrpc/connect-web";
+
+import { BootstrapService, BootstrapState } from "@/gen/fleet/cryptos/fleet/v1/bootstrap_pb";
+import { ErrorReason } from "@/gen/fleet/cryptos/fleet/v1/errors_pb";
+import { fleetMode } from "@/lib/fleet/mode";
+import { normalizeFingerprint } from "@/lib/fingerprint";
+import {
+  mockPreview,
+  mockProbe,
+  type RegisterForm,
+  type RegisterResult,
+  registerRequestFields,
+  toRegisterResult,
+} from "@/lib/operator-cas";
+import { levelExtfileSection } from "@/lib/operators";
+
+// The first-run (day-zero) client. BootstrapService runs outside the
+// certificate gate: GetBootstrapState is anonymous, StartBootstrapSession
+// takes the token from the manager's log, and the other two calls carry the
+// session secret in the Fleetos-Bootstrap-Session header. The secret lives
+// only in this module's memory: never a cookie, never web storage, never a
+// URL. A reload loses it, and the operator starts again with the newest token.
+
+export const BOOTSTRAP_SESSION_HEADER = "Fleetos-Bootstrap-Session";
+
+let sessionSecret: null | string = null;
+
+const sessionHeader: Interceptor = (next) => (request) => {
+  if (sessionSecret !== null) request.header.set(BOOTSTRAP_SESSION_HEADER, sessionSecret);
+  return next(request);
+};
+
+const bootstrapClient = () =>
+  createClient(
+    BootstrapService,
+    createConnectTransport({
+      baseUrl: import.meta.env.VITE_FLEET_API ?? "http://localhost:8080",
+      interceptors: [sessionHeader],
+    }),
+  );
+
+export interface BootstrapStatus {
+  reasonCode: ErrorReason;
+  state: BootstrapState;
+  tokenExpiresAt: string;
+}
+
+export interface FirstAdminResult {
+  email: string;
+  issuerSha256: string;
+  notAfter: string;
+  serialHex: string;
+  warnings: string[];
+}
+
+// Mock mode stays closed unless a test (or VITE_BOOTSTRAP_MOCK_STATE=open for
+// offline UI work) opens it, so the mock console behaves as before.
+const initialMockState = (): BootstrapState =>
+  import.meta.env.VITE_BOOTSTRAP_MOCK_STATE === "open"
+    ? BootstrapState.OPEN
+    : BootstrapState.CLOSED;
+let mockState = initialMockState();
+let mockRegistered: null | RegisterResult = null;
+
+export const getBootstrapState = async (): Promise<BootstrapStatus> => {
+  if (fleetMode() === "mock") {
+    return { reasonCode: ErrorReason.UNSPECIFIED, state: mockState, tokenExpiresAt: "" };
+  }
+  const response = await bootstrapClient().getBootstrapState({});
+  return {
+    reasonCode: response.reasonCode,
+    state: response.state,
+    tokenExpiresAt: response.tokenExpiresAt,
+  };
+};
+
+export const hasBootstrapSession = (): boolean => sessionSecret !== null;
+
+export const endBootstrapSession = (): void => {
+  sessionSecret = null;
+};
+
+// startBootstrapSession trades the bootstrap token for a session. The token is
+// single use: the manager prints a new one at once.
+export const startBootstrapSession = async (token: string): Promise<{ expiresAt: string }> => {
+  if (fleetMode() === "mock") {
+    if (!token.trim().startsWith("fos_boot_")) {
+      throw new ConnectError("token invalid", Code.Unauthenticated, {
+        "x-cryptos-error-code": "1600",
+      });
+    }
+    sessionSecret = "fos_bsess_mock";
+    mockState = BootstrapState.OPEN_IN_PROGRESS;
+    return { expiresAt: new Date(Date.now() + 3_600_000).toISOString() };
+  }
+  const response = await bootstrapClient().startBootstrapSession({ token: token.trim() });
+  sessionSecret = response.sessionSecret;
+  return { expiresAt: response.expiresAt };
+};
+
+export const registerOperatorCABootstrap = async (form: RegisterForm): Promise<RegisterResult> => {
+  if (fleetMode() === "mock") {
+    if (form.caCertDer.length === 0) {
+      if (!mockRegistered) {
+        throw new ConnectError("no registration", Code.FailedPrecondition, {
+          "x-cryptos-error-code": "1605",
+          "x-cryptos-error-reason": "NOT_CONFIRMED",
+        });
+      }
+      return {
+        ...mockRegistered,
+        confirmed: normalizeFingerprint(form.confirmSha256) === mockRegistered.operatorCa.sha256,
+      };
+    }
+    const preview: RegisterResult = {
+      adminExtfile: levelExtfileSection("admin"),
+      confirmed: false,
+      ocspProbe: mockProbe(form.ocspMode),
+      operatorCa: await mockPreview(form),
+    };
+    if (form.confirmSha256 === "") return preview;
+    if (normalizeFingerprint(form.confirmSha256) !== preview.operatorCa.sha256) {
+      throw new ConnectError("not confirmed", Code.FailedPrecondition, {
+        "x-cryptos-error-code": "1605",
+        "x-cryptos-error-reason": "NOT_CONFIRMED",
+      });
+    }
+    mockRegistered = { ...preview, confirmed: true };
+    return mockRegistered;
+  }
+  return toRegisterResult(await bootstrapClient().registerOperatorCA(registerRequestFields(form)));
+};
+
+// submitFirstAdminCertificate records the first admin's certificate, which
+// the operator CA signed. With the CSR, the manager also checks the key
+// matches; without it this is path B's pre-flight. The key never goes here.
+export const submitFirstAdminCertificate = async (params: {
+  certDer: Uint8Array;
+  csrDer?: Uint8Array;
+  fullName: string;
+}): Promise<FirstAdminResult> => {
+  if (fleetMode() === "mock") {
+    return {
+      email: "admin@example.org",
+      issuerSha256: mockRegistered?.operatorCa.sha256 ?? "",
+      notAfter: new Date(Date.now() + 365 * 86_400_000).toISOString(),
+      serialHex: "4F:00:A1",
+      warnings: [],
+    };
+  }
+  const response = await bootstrapClient().submitFirstAdminCertificate({
+    certDer: new Uint8Array(params.certDer),
+    csrDer: new Uint8Array(params.csrDer ?? []),
+    fullName: params.fullName.trim(),
+  });
+  return {
+    email: response.email,
+    issuerSha256: response.issuerSha256,
+    notAfter: response.notAfter,
+    serialHex: response.serialHex,
+    warnings: [...response.warnings],
+  };
+};
+
+// Test-only: forget the session and reset the mock state.
+export const __resetBootstrap = (): void => {
+  sessionSecret = null;
+  mockState = initialMockState();
+  mockRegistered = null;
+};
+
+export const __setMockBootstrapState = (state: BootstrapState): void => {
+  mockState = state;
+};
diff --git a/src/lib/fleet/error-copy.test.ts b/src/lib/fleet/error-copy.test.ts
index cef202c..fe12b1d 100644
--- a/src/lib/fleet/error-copy.test.ts
+++ b/src/lib/fleet/error-copy.test.ts
@@ -68,6 +68,7 @@ const REASONS_BY_CODE: Record<number, string[]> = {
     "REVOKED_OCSP",
     "OCSP_UNKNOWN",
     "DUPLICATE",
+    "FULL_NAME",
   ],
   1611: ["NOT_FOUND", "EXPIRED", "NOT_PENDING"],
 };
diff --git a/src/lib/fleet/error-copy.ts b/src/lib/fleet/error-copy.ts
index d7e1adf..e07a3ad 100644
--- a/src/lib/fleet/error-copy.ts
+++ b/src/lib/fleet/error-copy.ts
@@ -157,6 +157,7 @@ const REASON_COPY: Record<string, string> = {
   "1610/OCSP_UNKNOWN":
     "The operator CA's OCSP responder doesn't know this certificate, which counts as revoked.",
   "1610/DUPLICATE": "This certificate is already recorded.",
+  "1610/FULL_NAME": "The full name must be 1 to 128 characters, with no control characters.",
 
   "1611/NOT_FOUND": "No credential request has that id.",
   "1611/EXPIRED": "The credential request has expired (after 30 days). Make a new request.",
diff --git a/src/lib/operator-cas.ts b/src/lib/operator-cas.ts
index bd48032..3ffed07 100644
--- a/src/lib/operator-cas.ts
+++ b/src/lib/operator-cas.ts
@@ -360,7 +360,7 @@ const refusal = (code: number, reason: string, message: string): ConnectError =>
 const hex = (buf: ArrayBuffer): string =>
   Array.from(new Uint8Array(buf), (b) => b.toString(16).padStart(2, "0")).join("");
 
-const mockPreview = async (form: RegisterForm): Promise<OperatorCARow> => {
+export const mockPreview = async (form: RegisterForm): Promise<OperatorCARow> => {
   const cert = new X509Certificate(new Uint8Array(form.caCertDer));
   const sha256 = hex(await crypto.subtle.digest("SHA-256", new Uint8Array(cert.rawData)));
   return toCARow({
@@ -382,7 +382,7 @@ const mockPreview = async (form: RegisterForm): Promise<OperatorCARow> => {
   });
 };
 
-const mockProbe = (mode: OcspChoice): OcspProbeRow | undefined =>
+export const mockProbe = (mode: OcspChoice): OcspProbeRow | undefined =>
   mode === "url"
     ? {
         certStatus: "unknown",
diff --git a/vite.config.ts b/vite.config.ts
index cae90e0..2da3d3b 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -30,6 +30,10 @@ export default defineConfig({
   // via VITE_MANAGER_PROXY for the local ESXi E2E.
   server: {
     proxy: {
+      "/cryptos.fleet.v1.BootstrapService": {
+        changeOrigin: true,
+        target: process.env.VITE_MANAGER_PROXY ?? "http://127.0.0.1:18099",
+      },
       "/cryptos.fleet.v1.FleetService": {
         changeOrigin: true,
         target: process.env.VITE_MANAGER_PROXY ?? "http://127.0.0.1:18099",