fix sonar

AGENTS.md

@@ -1,6 +1,6 @@
 # NetBird Agent Guidelines
 
-**NetBird** is an open source connectivity platform: a WireGuard®-based overlay
+**NetBird** is an open-source connectivity platform: a WireGuard®-based overlay
 network with a control plane. The **agent** (`client/`) runs on user machines as
 a privileged daemon and manages the WireGuard interface, routing, firewall, and
 DNS. **Management** (`management/`) is the control plane and REST/gRPC API,

CONTRIBUTING.md

@@ -479,7 +479,7 @@ go test -race ./client/internal/dns/...
 
 ## Checklist before submitting a PR
 
-As a critical network service and open source project, we must enforce a few
+As a critical network service and open-source project, we must enforce a few
 things before submitting a pull request. The
 [pull request template](/.github/pull_request_template.md) mirrors this list —
 fill it in rather than deleting it.

README.md

@@ -130,7 +130,7 @@ In November 2022, NetBird joined the [StartUpSecure program](https://www.forschu
 ![CISPA_Logo_BLACK_EN_RZ_RGB (1)](https://user-images.githubusercontent.com/700848/203091324-c6d311a0-22b5-4b05-a288-91cbc6cdcc46.png)
 
 ### Acknowledgements
-We build on open source technologies like [WireGuard®](https://www.wireguard.com/), [Pion ICE](https://github.com/pion/ice), and [Rosenpass](https://rosenpass.eu). We greatly appreciate the work these projects are doing, and we'd love it if you could support them too (e.g., by starring or contributing).
+We build on open-source technologies like [WireGuard®](https://www.wireguard.com/), [Pion ICE](https://github.com/pion/ice), and [Rosenpass](https://rosenpass.eu). We greatly appreciate the work these projects are doing, and we'd love it if you could support them too (e.g., by starring or contributing).
 
 ### Legal
 This repository is licensed under the BSD-3-Clause license, which applies to all parts of the repository except for the directories management/, signal/ and relay/.

SECURITY.md

@@ -14,7 +14,7 @@ Report security issues one of these two ways:
   on this repository. This is the preferred route: it keeps the discussion, the draft advisory, and the credit in one place.
 - **Email** — `security@netbird.io`.
 
-If the finding affects NetBird Cloud or our hosted infrastructure rather than the open source code, email us rather than
+If the finding affects NetBird Cloud or our hosted infrastructure rather than the open-source code, email us rather than
 filing a repository report.
 
 ### What to include

agent-network/README.md

@@ -67,30 +67,6 @@ components:
   — the management-side control plane: providers, policies, guardrails, limits, routing,
   and usage/access logs.
 
-## Access roles
-
-Agent Network permissions build on the account permission matrix
-([`management/server/permissions/`](../management/server/permissions)). The
-`agent_network` area is split into dotted submodules (`agent_network.providers`,
-`.policies`, `.guardrails`, `.budgets`, `.usage`, `.logs`, `.settings`); a role may
-grant a single submodule or the parent, which cascades to all of them.
-
-Two roles delegate Agent Network access without account-admin rights:
-
-- **`agent_network_admin`** — full control over the whole `agent_network` area plus
-  read-only users, groups, peers, and account info (needed to build policies).
-  Nothing else in the account.
-- **`usage_viewer`** — the regular User baseline plus read on
-  `agent_network.usage` (the aggregated usage and cost overview). No provider
-  configuration, no policies, no request-level access logs.
-
-Every authenticated user, regardless of role, can read the caller-scoped
-self-service endpoints: `GET /api/agent-network/me/setup` (the endpoint, providers,
-and models the caller's own policies allow — what a local AI tool needs and nothing
-more) and `GET /api/agent-network/me/consumption` (the caller's own token and cost
-counters). Role definitions live in
-[`management/server/permissions/roles/`](../management/server/permissions/roles).
-
 ## Documentation
 
 Full documentation, architecture, and quickstart:

client/android/login.go

@@ -204,9 +204,8 @@ func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
 
-	// An empty hint is deliberate, not a fallback: a fresh profile leaves the
-	// choice to the IdP. Switching accounts is done by switching or removing
-	// profiles, not by logging out — logout keeps the email.
+	// An empty hint is deliberate, not a fallback: a fresh or logged-out profile
+	// leaves the choice to the IdP, which is how accounts get switched.
 	if a.cfgPath != "" {
 		if hint := readProfileEmail(a.cfgPath); hint != "" {
 			if setter, ok := oAuthFlow.(loginHintSetter); ok {

client/android/profile_manager.go

@@ -22,8 +22,7 @@ type Profile struct {
 	ID   string
 	Name string
 	// Email is the account this profile last logged in with, "" if it never
-	// completed an SSO login. Kept across logouts; cleared when the profile is
-	// removed. See profile_state.go.
+	// completed an SSO login or was logged out. See profile_state.go.
 	Email    string
 	IsActive bool
 }
@@ -201,9 +200,11 @@ func (pm *ProfileManager) LogoutProfile(id string) error {
 		return fmt.Errorf("failed to save config: %w", err)
 	}
 
-	// The stored account email is kept on purpose, matching the desktop and CLI
-	// logout semantics: the next login passes it as the login_hint so the IdP
-	// preselects the account. Removing the profile is what deletes it.
+	// Not fatal: a stale hint costs an account switch, not the logout itself.
+	if err := removeProfileEmail(configPath); err != nil {
+		log.Warnf("failed to clear stored account email for profile %s: %v", id, err)
+	}
+
 	log.Infof("logged out from profile: %s", id)
 	return nil
 }
@@ -223,24 +224,11 @@ func (pm *ProfileManager) RenameProfile(id string, newName string) error {
 
 // RemoveProfile deletes a profile
 func (pm *ProfileManager) RemoveProfile(id string) error {
-	configPath, err := pm.getProfileConfigPath(id)
-	if err != nil {
-		return err
-	}
-
 	// Use ServiceManager (removes profile from profiles/ directory)
 	if err := pm.serviceMgr.RemoveProfile(profilemanager.ID(id), androidUsername); err != nil {
 		return fmt.Errorf("failed to remove profile: %w", err)
 	}
 
-	// The account file is this package's, not the ServiceManager's, so it must
-	// go here. The default profile has a fixed filename, so a recreated one
-	// would otherwise inherit the deleted profile's email as its login_hint.
-	// Not fatal: the profile itself is gone.
-	if err := removeProfileEmail(configPath); err != nil {
-		log.Warnf("failed to remove stored account email for profile %s: %v", id, err)
-	}
-
 	log.Infof("removed profile: %s", id)
 	return nil
 }

client/android/profile_state.go

@@ -90,10 +90,10 @@ func writeProfileEmail(configPath string, email string) error {
 	return nil
 }
 
-// removeProfileEmail drops the stored account email. Called on profile removal,
-// not on logout: a logged-out profile keeps its email so the next login passes
-// it as the login_hint, matching the desktop and CLI semantics. Mirrors the
-// desktop UI's RemoveProfileState call.
+// removeProfileEmail drops the stored account email. Called on logout: while the
+// email is on disk it goes out as a login_hint, which would steer the next login
+// straight back into the account just logged out of. Mirrors the desktop UI's
+// RemoveProfileState call.
 func removeProfileEmail(configPath string) error {
 	accountPath, err := profileAccountPathFor(configPath)
 	if err != nil {

client/android/profile_state_test.go

@@ -127,10 +127,10 @@ func TestWriteThenReadProfileEmail(t *testing.T) {
 		t.Fatalf("remove: %v", err)
 	}
 	if got := readProfileEmail(configPath); got != "" {
-		t.Errorf("expected no email after removal, got %q", got)
+		t.Errorf("expected no email after logout, got %q", got)
 	}
 
-	// Removal may run on a never-logged-in profile, so a second remove must pass.
+	// Logout may run on a never-logged-in profile, so a second remove must pass.
 	if err := removeProfileEmail(configPath); err != nil {
 		t.Fatalf("second remove should be a no-op: %v", err)
 	}

client/internal/profilemanager/state.go

@@ -87,10 +87,9 @@ func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 
 // RemoveProfileState deletes the per-profile state file (which holds the
 // account email used for the SSO login hint and the UI display). Called after
-// profile removal; logout keeps the file so the next login can pass the email
-// as the login_hint. The state file only stores the email, so deleting it is
-// equivalent to clearing it; the next SSO login recreates it. A missing file
-// is not an error.
+// a successful logout so a logged-out profile no longer shows a stale account
+// email. The state file only stores the email, so deleting it is equivalent to
+// clearing it; the next SSO login recreates it. A missing file is not an error.
 func (pm *ProfileManager) RemoveProfileState(profileName string) error {
 	configDir, err := getConfigDir()
 	if err != nil {

client/internal/routemanager/systemops/routeselection_windows_test.go

@@ -1,82 +0,0 @@
-//go:build windows
-
-package systemops
-
-import (
-	"math"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestSortRouteCandidates(t *testing.T) {
-	tests := []struct {
-		name       string
-		candidates []candidateRoute
-		wantOrder  []uint32
-	}{
-		{
-			name: "longest prefix wins over metrics",
-			candidates: []candidateRoute{
-				{interfaceIndex: 1, prefixLength: 0, routeMetric: 0, interfaceMetric: 5},
-				{interfaceIndex: 2, prefixLength: 24, routeMetric: 100, interfaceMetric: 50},
-			},
-			wantOrder: []uint32{2, 1},
-		},
-		{
-			// Windows ranks equal-length prefixes by route metric + interface metric,
-			// so a higher route metric on a low metric interface can still win.
-			name: "combined metric beats route metric alone",
-			candidates: []candidateRoute{
-				{interfaceIndex: 8, prefixLength: 0, routeMetric: 0, interfaceMetric: 100},
-				{interfaceIndex: 5, prefixLength: 0, routeMetric: 10, interfaceMetric: 5},
-			},
-			wantOrder: []uint32{5, 8},
-		},
-		{
-			name: "lower combined metric wins",
-			candidates: []candidateRoute{
-				{interfaceIndex: 5, prefixLength: 0, routeMetric: 300, interfaceMetric: 5},
-				{interfaceIndex: 8, prefixLength: 0, routeMetric: 0, interfaceMetric: 100},
-			},
-			wantOrder: []uint32{8, 5},
-		},
-		{
-			name: "equal combined metric falls back to route metric",
-			candidates: []candidateRoute{
-				{interfaceIndex: 1, prefixLength: 0, routeMetric: 20, interfaceMetric: 10},
-				{interfaceIndex: 2, prefixLength: 0, routeMetric: 5, interfaceMetric: 25},
-			},
-			wantOrder: []uint32{2, 1},
-		},
-		{
-			// The metrics are uint32 on the Windows side, so the sum must not wrap.
-			name: "combined metric beyond the uint32 range",
-			candidates: []candidateRoute{
-				{interfaceIndex: 1, prefixLength: 0, routeMetric: math.MaxUint32, interfaceMetric: 5},
-				{interfaceIndex: 2, prefixLength: 0, routeMetric: math.MaxUint32 - 10, interfaceMetric: 5},
-			},
-			wantOrder: []uint32{2, 1},
-		},
-		{
-			name: "unknown interface metric ranks on route metric only",
-			candidates: []candidateRoute{
-				{interfaceIndex: 1, prefixLength: 0, routeMetric: 30, interfaceMetric: -1},
-				{interfaceIndex: 2, prefixLength: 0, routeMetric: 5, interfaceMetric: 10},
-			},
-			wantOrder: []uint32{2, 1},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			sortRouteCandidates(tt.candidates)
-
-			got := make([]uint32, 0, len(tt.candidates))
-			for _, c := range tt.candidates {
-				got = append(got, c.interfaceIndex)
-			}
-			assert.Equal(t, tt.wantOrder, got)
-		})
-	}
-}

client/internal/routemanager/systemops/systemops_windows.go

@@ -882,40 +882,26 @@ func getInterfaceMetric(interfaceIndex uint32, family int16) int {
 	return int(ipInterfaceRow.Metric)
 }
 
-// sortRouteCandidates sorts route candidates by priority: prefix length -> combined metric -> route metric.
-// Windows prefers the longest matching prefix and, among prefixes of the same length, the lowest metric, see
-// https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-tcpip-interfaces-interface-routes-route-metric
+// sortRouteCandidates sorts route candidates by priority: prefix length -> route metric -> interface metric
 func sortRouteCandidates(candidates []candidateRoute) {
 	sort.Slice(candidates, func(i, j int) bool {
 		if candidates[i].prefixLength != candidates[j].prefixLength {
 			return candidates[i].prefixLength > candidates[j].prefixLength
 		}
-		mi, mj := combinedMetric(candidates[i]), combinedMetric(candidates[j])
-		if mi != mj {
-			return mi < mj
+		if candidates[i].routeMetric != candidates[j].routeMetric {
+			return candidates[i].routeMetric < candidates[j].routeMetric
 		}
-		return candidates[i].routeMetric < candidates[j].routeMetric
+		return candidates[i].interfaceMetric < candidates[j].interfaceMetric
 	})
 }
 
-// combinedMetric returns the effective metric Windows uses to rank routes with an equal prefix length:
-// the sum of the route metric and the metric of the interface the route is on, see
-// https://learn.microsoft.com/en-us/windows-server/networking/technologies/network-subsystem/net-sub-interface-metric
-// An unknown interface metric contributes nothing.
-func combinedMetric(candidate candidateRoute) uint64 {
-	if candidate.interfaceMetric < 0 {
-		return uint64(candidate.routeMetric)
-	}
-	return uint64(candidate.routeMetric) + uint64(candidate.interfaceMetric)
-}
-
 // GetBestInterface finds the best interface for reaching a destination,
 // excluding the VPN interface to avoid routing loops.
 //
 // Route selection priority:
 // 1. Longest prefix match (most specific route)
-// 2. Lowest combined metric (route metric + interface metric)
-// 3. Lowest route metric.
+// 2. Lowest route metric
+// 3. Lowest interface metric
 func GetBestInterface(dest netip.Addr, vpnIntf string) (*net.Interface, error) {
 	var skipInterfaceIndex int
 	if vpnIntf != "" {
@@ -939,6 +925,7 @@ func GetBestInterface(dest netip.Addr, vpnIntf string) (*net.Interface, error) {
 		return nil, fmt.Errorf("no route to %s", dest)
 	}
 
+	// Sort routes: prefix length -> route metric -> interface metric
 	sortRouteCandidates(candidates)
 
 	for _, candidate := range candidates {

client/internal/routemanager/systemops/v6route_linux_test.go

@@ -5,7 +5,6 @@ package systemops
 import (
 	"errors"
 	"net"
-	"net/netip"
 	"syscall"
 	"testing"
 
@@ -30,7 +29,6 @@ func ensureIPv6DefaultRoute(t *testing.T) {
 	}
 	if err := netlink.RouteAdd(route); err != nil {
 		if errors.Is(err, syscall.EEXIST) {
-			requireUsableIPv6Nexthop(t)
 			return
 		}
 		t.Skipf("install IPv6 fallback default route: %v", err)
@@ -40,36 +38,4 @@ func ensureIPv6DefaultRoute(t *testing.T) {
 			t.Logf("delete IPv6 fallback default route: %v", err)
 		}
 	})
-
-	requireUsableIPv6Nexthop(t)
-}
-
-// requireUsableIPv6Nexthop skips the test unless the resolved IPv6 default
-// nexthop can actually carry a route. Installing the default route succeeding
-// does not imply the kernel accepts it as a nexthop for a concrete prefix.
-func requireUsableIPv6Nexthop(t *testing.T) {
-	t.Helper()
-
-	nexthop, err := GetNextHop(netip.IPv6Unspecified())
-	if err != nil {
-		t.Skipf("resolve IPv6 default nexthop: %v", err)
-	}
-
-	probe := &netlink.Route{
-		Scope:  netlink.SCOPE_UNIVERSE,
-		Table:  syscall.RT_TABLE_MAIN,
-		Family: netlink.FAMILY_V6,
-		Dst:    &net.IPNet{IP: net.ParseIP("100::64"), Mask: net.CIDRMask(128, 128)},
-	}
-	require.NoError(t, addNextHop(nexthop, probe), "build IPv6 probe route")
-
-	switch err := netlink.RouteAdd(probe); {
-	case err == nil:
-		if err := netlink.RouteDel(probe); err != nil && !errors.Is(err, syscall.ESRCH) {
-			t.Logf("delete IPv6 probe route: %v", err)
-		}
-	case errors.Is(err, syscall.EEXIST):
-	default:
-		t.Skipf("IPv6 nexthop %s unusable for route installation: %v", nexthop, err)
-	}
 }

client/ui/authsession/service.go

@@ -6,11 +6,9 @@ import (
 	"context"
 	"time"
 
-	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc/codes"
 	gstatus "google.golang.org/grpc/status"
 
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
 )
 
@@ -62,19 +60,9 @@ func (s *Session) RequestExtend(ctx context.Context, p ExtendStartParams) (Exten
 
 	// a request from the UI implies a graphical session, which the daemon cannot detect itself
 	req := &proto.RequestExtendAuthSessionRequest{HasGraphicalSession: true}
-	hint := p.Hint
-	if hint == "" {
-		pm := profilemanager.NewProfileManager()
-		if active, perr := pm.GetActiveProfile(); perr != nil {
-			log.Debugf("failed to get active profile for login hint: %v", perr)
-		} else if state, serr := pm.GetProfileState(active.ID); serr != nil {
-			log.Debugf("failed to get profile state for login hint: %v", serr)
-		} else {
-			hint = state.Email
-		}
-	}
-	if hint != "" {
-		req.Hint = &hint
+	if p.Hint != "" {
+		h := p.Hint
+		req.Hint = &h
 	}
 
 	resp, err := cli.RequestExtendAuthSession(ctx, req)

client/ui/services/connection.go

@@ -123,16 +123,8 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 	if p.PreSharedKey != "" {
 		req.OptionalPreSharedKey = ptrStr(p.PreSharedKey)
 	}
-	hint := p.Hint
-	if hint == "" && profileID != "" {
-		if state, serr := profilemanager.NewProfileManager().GetProfileState(profilemanager.ID(profileID)); serr == nil {
-			hint = state.Email
-		} else {
-			log.Debugf("failed to get profile state for login hint: %v", serr)
-		}
-	}
-	if hint != "" {
-		req.Hint = ptrStr(hint)
+	if p.Hint != "" {
+		req.Hint = ptrStr(p.Hint)
 	}
 
 	resp, err := cli.Login(ctx, req)
@@ -236,6 +228,16 @@ func (s *Connection) Logout(ctx context.Context, p LogoutParams) error {
 		return s.classifyDaemonError(err)
 	}
 
+	// The daemon runs as root and can't reach the user-owned per-profile state
+	// file holding the account email (see Profiles.List), so clear the stale
+	// email here; the next SSO login recreates it.
+	if p.ProfileName != "" {
+		if err := profilemanager.NewProfileManager().RemoveProfileState(p.ProfileName); err != nil {
+			// Non-fatal: the logout itself succeeded.
+			log.Warnf("failed to remove profile state for %s: %v", p.ProfileName, err)
+		}
+	}
+
 	return nil
 }
 
@@ -259,7 +261,7 @@ func (s *Connection) waitSSOLogin(ctx context.Context, p WaitSSOParams) (string,
 
 	// Persist the account email the same way the CLI does after its own
 	// WaitSSOLogin: the daemon returns it but cannot store it, since it runs as
-	// root and the per-profile state file is user-owned (see Profiles.List).
+	// root and the per-profile state file is user-owned (see Logout below).
 	// Without this the profile has no email, so Profiles.List shows no account
 	// and later logins and session extends go out without a login_hint —
 	// leaving the IdP to guess which account was meant.

client/ui/services/profile.go

@@ -162,9 +162,8 @@ func (s *Profiles) Remove(ctx context.Context, p ProfileRef) error {
 	}
 
 	// The daemon deletes what it owns but runs as root, so it leaves the
-	// user-owned state file holding the account email behind. Logout keeps the
-	// email on purpose so later logins can pass it as the login_hint; profile
-	// removal is what deletes it. Legacy profiles are keyed by name rather than by a
+	// user-owned state file holding the account email behind (same split as
+	// Connection.Logout). Legacy profiles are keyed by name rather than by a
 	// generated ID, so a recreated profile of the same name would inherit the
 	// deleted one's email and offer it as the login_hint.
 	//

docs/agent-networks/01-end-to-end-flows.md

@@ -115,7 +115,7 @@ sequenceDiagram
         Resp->>Resp: parse usage tokens, completion
         Note over Resp: capture_completion gates raw<br/>completion capture
         Resp->>Cost: tokens
-        Cost->>Cost: lookup rates from config-delivered<br/>pricing table + compute cost
+        Cost->>Cost: lookup pricing.yaml + compute cost
         Cost->>Rec: tokens + cost
         Rec->>MgmtGrpc: RecordLLMUsage(provider, model, prompt_t, completion_t, cost, groups, user)
         Rec-->>Log: emit access-log entry<br/>(if EnableLogCollection)

docs/agent-networks/modules/21-management-agentnetwork.md

@@ -15,10 +15,6 @@ Inside the package: `manager.go` is the CRUD + permissions-gated facade; `synthe
 | ---- | ---- |
 | `agentnetwork/manager.go` | Manager interface + CRUD + permission gates + bootstrap-settings + reconcile trigger |
 | `agentnetwork/synthesizer.go` | Settings/policy → wire-format synthesis; sole writer of the proxy middleware chain |
-| `agentnetwork/synthesizer_pricing.go` | `buildCostMeterConfigJSON` — default table + per-provider prices → `cost_meter` config |
-| `agentnetwork/pricing/defaults.go` | Default pricing table derived from the catalog + supplementals; `DefaultTable`, `LookupDefault`, wire `Entry` |
-| `agentnetwork/pricing/override.go` | `LoadFile`/`StartReloader` for `AgentNetwork.PricingDefaultsFile` (mtime poll, merge over compiled-in base) |
-| `agentnetwork/pricing/{exampleyaml,gen}.go` | Generates `defaults_llm_pricing.example.yaml` from the compiled-in table (golden-tested) |
 | `agentnetwork/policyselect.go` | Per-request policy attribution + account-budget ceiling (min-wins) |
 | `agentnetwork/reconcile.go` | Per-account synth diff vs in-memory cache → Create/Update/Delete |
 | `agentnetwork/catalog/catalog.go` | Static provider catalogue (auth headers, identity-injection shapes) |
@@ -52,8 +48,6 @@ flowchart TD
     I --> J[indexProviderGroups: providerID -> sorted source groups]
     J --> K[buildRouterConfigJSON drops orphan providers]
     J --> L[buildIdentityInjectConfigJSON per catalog entry]
-    J --> K2[buildCostMeterConfigJSON: default table + per-provider prices]
-    K2 --> P
     H --> M[mergeGuardrails: union allowlist, OR redact]
     M --> N[applyAccountCollectionControls account toggle = SOLE capture control]
     N --> O[marshalGuardrailConfig]
@@ -66,84 +60,6 @@ flowchart TD
     R --> T[accountManager.UpdateAccountPeers — fans synth ACLs into network map]
 ```
 
-### LLM pricing (management is the sole authority)
-
-**The proxy carries no price list.** Management synthesizes the entire pricing
-table and ships it inside `cost_meter`'s `ConfigJSON`, so a price change reaches
-the proxies as an ordinary mapping push — the chain rebuild installs a fresh
-table and there is nothing to reload on the proxy side.
-
-```mermaid
-flowchart TD
-    A[catalog.All — PricingSurfaces x Models] --> B[buildDefaultTable + supplementalDefaults]
-    B --> C{AgentNetwork.PricingDefaultsFile}
-    C -- absent --> D[compiled-in table serves]
-    C -- loaded --> E[LoadFile: merge file entries WHOLE over compiled base]
-    E --> F[mergedTable atomic.Pointer]
-    D --> G[DefaultTable]
-    F --> G
-    G --> H[buildCostMeterConfigJSON — pricing.defaults]
-    I[types.Provider.Models operator prices] --> J[normalizePricingModelID<br/>bedrock ARN/region/version, vertex @version]
-    J --> K[materializeEntry: default entry as base,<br/>operator input/output verbatim,<br/>cache pointers only when non-nil]
-    K --> L[pricing.providers keyed by provider record ID]
-    H --> M[cost_meter ConfigJSON]
-    L --> M
-    G --> N[GET /catalog — applyDefaultPricing prefills dashboard rows]
-    O[StartReloader: mtime poll every ReloadInterval 1m] --> E
-```
-
-**Two tiers, resolved per request on the proxy** (`synthesizer_pricing.go:22-35`):
-
-- `pricing.defaults` — surface (`openai`/`anthropic`/`bedrock`) → normalized model
-  id → rates. The **full** default table ships to every account: it is small
-  (~10 KB) and it is what keeps gateway-style providers (which enumerate no
-  models, so they claim every model) priced.
-- `pricing.providers` — provider **record** id → normalized model id → rates,
-  matched against the `llm.resolved_provider_id` the router stamps. Entries are
-  **fully materialized here**, at synth time: `materializeEntry` starts from the
-  default entry for that model so cache rates the operator didn't state are
-  inherited, overlays operator `input`/`output` verbatim (**including an explicit
-  0**, which prices a self-hosted or internal endpoint as free rather than
-  silently reverting to list price), and overlays cache-rate **pointers only when
-  non-nil** — `nil` means "inherit the default", an explicit `0` means "no
-  discount, bill this bucket at the input rate". The proxy therefore does two map
-  lookups and no merging.
-
-Same orphan rule as the router: a provider no enabled policy authorises is
-unreachable, so its prices aren't shipped. Model ids are normalized with the
-**same** functions the request parser uses (`NormalizeBedrockModel` /
-`NormalizeVertexModel`), which is what makes the per-record lookup key compare
-equal to the `llm.model` the proxy meters. Post-normalization duplicates resolve
-first-occurrence-wins, matching the routing dedup order.
-
-**`AgentNetwork.PricingDefaultsFile`** (`config.go:190-207`) lets an operator
-replace default rates without a rebuild. Schema is `surface → model → rates`
-(`input_per_1k`, `output_per_1k`, and optional `cached_input_per_1k` /
-`cache_read_per_1k` / `cache_creation_per_1k`). Semantics:
-
-- A **relative** path resolves against `<Datadir>`, so a bare filename lands
-  alongside the store. Empty config probes `<Datadir>/defaults_llm_pricing.yaml`.
-- An **explicitly configured** path is *required to load*: a typo or malformed
-  file fails startup, because the operator believes those rates are live. The
-  conventional probe is optional — an absent file just serves compiled-in
-  defaults, and the path stays watched in case it appears later.
-- File entries **replace** the compiled-in entry for the same (surface, model)
-  **whole** — they are not field-merged, so an entry must repeat the cache rates
-  it wants to keep. Everything the file doesn't mention keeps built-in rates.
-- Unknown YAML fields are rejected (`KnownFields(true)`) and every rate must be
-  finite and non-negative — the same constraints the HTTP API enforces on
-  operator per-provider prices.
-- Reload is an mtime poll (`ReloadInterval`, 1 min) and is **lenient at runtime**:
-  a parse error keeps the previous table, a deleted file reverts to compiled-in
-  defaults. A mid-edit save can never take pricing down.
-
-The live table feeds **both** consumers, which is what keeps them consistent: the
-synthesizer (what proxies actually bill with) and `GET /api/agent-network/catalog`
-via `applyDefaultPricing` (what the dashboard's model-row prices prefill with).
-`defaults_llm_pricing.example.yaml` is generated from the compiled-in table
-(`go generate ./management/internals/modules/agentnetwork/pricing`) and
-golden-tested, so operators start from a file matching the built-in rates exactly.
-
 ### Budget rule resolution (min-wins, group+user bound)
 
 ```mermaid
@@ -208,7 +124,7 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
   | on_request | 3 | `llm_identity_inject` | `{"providers":[{provider_id, header_pair?, json_metadata?, extra_headers?}]}` | **true** |
   | on_request | 4 | `llm_guardrail` | `{"provider_allowlists"?: {providerID: []model}, "prompt_capture":{enabled,redact_pii}}` | – |
   | on_response | 5 | `llm_limit_record` | `{}` (runs LAST at runtime) | – |
-  | on_response | 6 | `cost_meter` | `{"pricing":{"defaults":{surface:{model:rates}},"providers"?:{providerRecordID:{model:rates}}}}` — rates are `{input_per_1k, output_per_1k, cached_input_per_1k?, cache_read_per_1k?, cache_creation_per_1k?}` | – |
+  | on_response | 6 | `cost_meter` | `{}` | – |
   | on_response | 7 | `llm_response_parser` | `{"capture_completion": <bool>, "redact_pii"?: true}` | – |
 - **Synthesized service shape** (`synthesizer.go:739`): `Mode=HTTP`, `Private=true`, `Domain=<subdomain>.<cluster>`, `AccessGroups=unionSourceGroups(enabledPolicies)`, one `TargetTypeCluster` target with `Host=noop.invalid:443` (router rewrites per request), `Options.{DirectUpstream,AgentNetwork}=true`, `DisableAccessLog=!settings.EnableLogCollection`, `CaptureMax{Req,Resp}Bytes=1<<20`, `CaptureContentTypes=["application/json","text/event-stream"]`.
 
@@ -223,12 +139,6 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 - **Orphan providers (no enabled policy authorises them) NEVER reach the router** (`synthesizer.go:351-357`); skipped from `identity_inject` for symmetry.
 - **Provider creation refuses empty `api_key`** (`manager.go:175`); **deletion refuses while any policy still references it** (`manager.go:265-273`).
 - **Session keypair stability across provider edits** (`manager.go:226-228`) — server-managed, copied through every `UpdateProvider`, never API-surfaced.
-- **Management is the sole pricing authority.** The proxy has no embedded price list, so an account whose `cost_meter` config carries no `pricing` block bills **nothing** (`cost.skipped=unknown_model`, $0) rather than falling back to stale built-ins. The top-level `pricing` wrapper is also the feature-detection signal in both directions: an old proxy ignores it as an unknown field, and a new proxy reads its absence as "old management".
-- **Per-provider prices are materialized at synth time, not merged on the proxy** (`synthesizer_pricing.go:114-131`). A per-record entry is always complete, so the proxy's lookup is per-record-then-defaults with no field-level fallback between tiers.
-- **An explicit operator price of `0` prices the model as free** — it must not be treated as "unset" and reverted to list price (`synthesizer_pricing.go:49-54`). Only *cache*-rate fields distinguish unset from zero, via `*float64`.
-- **Pricing model ids are normalized with the same functions the request parser uses** (`normalizePricingModelID`). If the two ever diverge, per-record prices silently stop matching and every request falls through to surface defaults.
-- **The default table's coverage is structural, not curated.** It is derived from the catalog via each provider's `PricingSurfaces`; `TestDefaultTable_CoversEveryCatalogModel` fails on an unpriced catalog model and `TestDefaultTable_NoConflictingContributions` fails if two providers contribute the same (surface, model) at different rates.
-- **A pricing-defaults file failure is fatal only at startup, and only for an explicitly configured path.** Runtime reload failures keep the previous table; a deleted file reverts to compiled-in defaults (`pricing/override.go:62-81, 113-148`).
 
 ## Things to scrutinize
 
@@ -266,12 +176,10 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 - **Capture-pointer semantics (restated):** non-agent-network callers see no field → legacy nil-default emit, identical to pre-PR. Agent-network targets always carry an explicit `capture_*` value.
 - **`TestSynthesizeServices_HappyPath` was updated:** request-parser config moved from `{}` to `{"capture_prompt":false}` (`synthesizer_test.go:174`). External snapshot tests against synth output need updating.
 - **`MergedGuardrails` retains zeroed `TokenLimits`/`Budget`/`Retention`** even though `Policy.Limits` carries the real values now; `llm_limit_check` is the authoritative enforcement. Comment at `synthesizer.go:940-948` calls this out.
-- **`cost_meter`'s `pricing` block is version-skew-safe in both directions.** A proxy predating config-delivered pricing ignores the field as unknown JSON (it previously priced from its own embedded table, so it keeps billing — at its own rates, which is the skew to be aware of during a rolling upgrade). A current proxy paired with old management sees no `pricing` block, logs one warning at chain-build time, and records `cost.skipped=unknown_model` — token counting and cap enforcement are unaffected, only the USD annotation goes to $0.
 
 ### Performance
 
 - **`SynthesizeServices` runs on every controller tick / mutation reconcile.** Cost: 4 store reads + optional per-provider keypair backfill. Sort + index + merge are O(N log N) / O(P × G); dominant cost is JSON marshalling. No nested loops escape these dimensions.
-- **The full default pricing table is marshalled into every account's `cost_meter` config on every synth** (~10 KB serialized). This is a deliberate trade: it keeps gateway-style providers priced for every catalog model, and it is the largest single contributor to the synth JSON. `DefaultTable()` itself is a pointer load (or a `sync.Once`-built map) — the cost is the marshal, not the build.
 - **`reconcile.diffMappings` is O(N + M)** with N=M=1 per account today — effectively constant.
 - **`SynthesizeServicesForCluster`** (`synthesizer.go:71`) walks every account on a cluster; per-account failures are **swallowed** (`synthesizer.go:91-93`) so a single misconfigured account doesn't drop the cluster. Runs per proxy reconnect.
 
@@ -280,7 +188,6 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 - **Activity codes:** `AgentNetwork{Provider,Policy,Guardrail,BudgetRule}{Created,Updated,Deleted}`; `AgentNetworkSettingsUpdated` with `log_collection/prompt_collection/redact_pii` payload (`manager.go:567-571`). **No activity code for `SelectPolicyForRequest` denies** — surfaced via proxy access log only (likely intentional given volume).
 - **Deny codes** namespaced: `llm_policy.{token,budget}_cap_exceeded`, `llm_account.{token,budget}_cap_exceeded` (`policyselect.go:18-26`).
 - **Reconcile failures are logged at warn and swallowed** (`reconcile.go:42-44`). Persistent synth failures (e.g. unknown catalog id) silently keep the proxy out of sync — consider a manager-level synth-health surface if this becomes a support burden.
-- **Pricing-file lifecycle logs at info** (load, reload, revert-to-built-ins) and **at warn** for a runtime reload failure; the mtime check itself is `Debugf`. There is no metric on reload failures, so an operator who breaks the file mid-flight keeps billing at the previous table with only a log line to show it (`pricing/override.go:113-148`).
 
 ## Test coverage
 
@@ -291,9 +198,6 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
 | `synthesizer_guardrail_realstore_test.go` | `PromptCaptureAccountIsSoleControl`; `PromptCaptureFlowsWhenAccountOptsIn`; `AccountRedactWithoutGuardrailRedact`; `NoGuardrail_CaptureOff`. |
 | `synthesizer_log_collection_realstore_test.go` | `LogCollection{Off_SuppressesAccessLog,On_PermitsAccessLog}` — verifies `DisableAccessLog` propagation through `ToProtoMapping`. |
 | `synthesizer_parser_redact_realstore_test.go` | **Capture-pointer regression suite:** `ParserConfigsCarryRedactPii`; `ParserConfigsSuppressCaptureWhenLogCollectionOnly` (log=on/prompt=off ⇒ both capture flags false); `ParserConfigsOmitRedactPiiWhenOff`. |
-| `synthesizer_pricing_test.go` | `BuildCostMeterConfig_{BedrockModelNormalization,CacheRateNilVsZero,OrphanAndGatewayProviders}` — the per-record tier's three load-bearing rules: keys normalized like the parser's, `nil` cache pointer inherits vs explicit `0` bills at input rate, and orphan / gateway (empty `Models`) providers ship no per-record entry. |
-| `pricing/defaults_test.go` | `DefaultTable_{CoversEveryCatalogModel,NoConflictingContributions,AllRatesFiniteNonNegative,PinnedRates}`; `LookupDefault_SurfaceOrder`. Catalog-derived coverage + rate sanity are structural, not curated. |
-| `pricing/override_test.go` | `LoadFile_{MergesOverCompiledDefaults,MissingPath,RejectsInvalid}`; `Reload_LifeCycle` (mtime detect, parse error keeps previous, delete reverts to built-ins); `ExampleYAML_InSyncWithBuiltins` golden. |
 | `policyselect_test.go` | Mock-store: `NoApplicablePolicies`; `AllowWithLowestGroupAttribution`; `LargerPoolWinsAcrossUsageLevels`; `StaysOnLargerPoolAfterPartialDrain`; `FallsThroughToSmallerPoolWhenLargerExhausted`; `TiebreakBy{LargerGroupPool,CreatedAt}`; `DeniesWhenAllExhausted`; `UncappedPolicyAlwaysWinsAgainstCapped`; `DisabledPolicyIgnored`; `StoreErrorPropagates`; `RejectsEmptyAccount`; `SharesGroupCounterAcrossPolicies`; `AntiFallThroughOnLowestGroup`; `BudgetOnlyExhaustionDenies`; `BudgetTighterThanTokenWins`. |
 | `policyselect_realstore_test.go` | Real-sqlite regression guard: `NoApplicablePolicies`; `AllowAndLowestGroupAttribution`; `LargerPoolWins_FallsThroughWhenExhausted`; `BudgetCapDenies`; `GroupCounterSharedAcrossPolicies`; `DisabledPolicyIgnored`. |
 | `policyselect_account_realstore_test.go` | Account budget rules: `AccountCeilingBindsEvenWithUncappedPolicy` (min-wins); `AccountGroupCeiling`; `AccountTargetUsersBindsOnlyThatUser`; `AccountRuleRecordsToOwnWindow`. |

docs/agent-networks/modules/31-proxy-middleware-builtin.md

@@ -5,7 +5,7 @@ LLM request. The two highest-blast-radius areas are the **capture-pointer
 semantics** and the **limit_check ⇒ limit_record** record-once invariant.
 
 Sibling module: [32-proxy-llm-parsers.md](./32-proxy-llm-parsers.md) — the SDK
-adapters + pricing table and cost formula this chain delegates to.
+adapters + pricing catalog this chain delegates to.
 
 ---
 
@@ -34,7 +34,7 @@ rewrites.
 | `llm_identity_inject` | OnRequest | `llm.{resolved_provider_id,authorising_groups}`, `Input.{UserEmail,UserID,UserGroups,UserGroupNames}` | none | header strip/inject + optional body rewrite |
 | `llm_guardrail` | OnRequest | `llm.{model,request_prompt_raw}` | `llm_policy.{decision,reason}`, `llm.request_prompt` | none (model allowlist deny) |
 | `llm_response_parser` | OnResponse | `llm.provider`, `Input.{RespHeaders,RespBody,Status}` | `llm.{input,output,total,cached_input,cache_creation}_tokens`, `llm.response_completion` | none |
-| `cost_meter` | OnResponse | `llm.{provider,model,resolved_provider_id}`, token buckets | `cost.usd_{input,cached_input,cache_creation,output,total,cache}` or `cost.skipped` | none (in-memory pricing lookup) |
+| `cost_meter` | OnResponse | `llm.{provider,model}`, token buckets | `cost.usd_total` or `cost.skipped` | pricing lookup |
 | `llm_limit_record` | OnResponse | `llm.{attribution_group_id,attribution_window_seconds,input_tokens,output_tokens}`, `cost.usd_total` | none | gRPC `RecordLLMUsage` |
 
 [all_test.go:26–40](../../../proxy/internal/middleware/builtin/all_test.go)
@@ -44,7 +44,7 @@ locks the ID set; adding or removing one is a conscious extension.
 
 | File | LOC | Notes |
 |---|---:|---|
-| `builtin.go` | 90 | Registry + `FactoryContext` (ctx, meter, logger, mgmt client) |
+| `builtin.go` | 86 | Registry + `FactoryContext` (ctx, data dir, meter, logger, mgmt client) |
 | `all_test.go` | 41 | Locks the 8-ID registry surface |
 | `agentnetwork_chain_integration_test.go` | 319 | Live sqlite + real gRPC bufconn; gate→recorder wire path |
 | `llm_request_parser/*` | 162 / 66 / 356 | Provider detection, body parse, prompt extraction with capture-pointer gating |
@@ -53,7 +53,7 @@ locks the ID set; adding or removing one is a conscious extension.
 | `llm_identity_inject/*` | 440 / 108 / 666 | HeaderPair (LiteLLM) + JSONMetadata (Portkey) + ExtraHeaders |
 | `llm_guardrail/*` | 176 / 82 / 75 / 219 / 217 | Model allowlist + optional prompt capture with PII redaction |
 | `llm_response_parser/*` | 258 / 222 / 43 / 433 / 169 / 111 | Buffered + SSE accumulation; AWS event-stream accumulator (`streaming_bedrock.go`) for Bedrock; capture-pointer gates completion emit |
-| `cost_meter/*` | 236 / 98 / 586 | Token → USD via `proxy/internal/llm/pricing`; both pricing tiers arrive in the middleware config |
+| `cost_meter/*` | 181 / 84 / 439 | Token → USD via `proxy/internal/llm/pricing` |
 | `llm_limit_record/*` | 144 / 35 / 191 | Post-flight `RecordLLMUsage` (5s, debug-on-error) |
 
 ## Per-middleware
@@ -168,46 +168,12 @@ token schema.
 
 ### cost_meter
 
-Reads `llm.provider` + `llm.model` + token buckets, looks up the per-1k rates,
-and emits the full `cost.usd_*` breakdown (four per-bucket values plus the
-`_total` and `_cache` aggregates) or a closed-set `cost.skipped` reason
-(`missing_provider/model/tokens`, `unparseable_tokens`, `zero_tokens`,
-`unknown_model`).
-
-**Management owns pricing.** The proxy carries no embedded price list: the whole
-table arrives in this middleware's `ConfigJSON` as
-`{pricing: {defaults, providers}}`, synthesized by management from the catalog
-plus the operator's stored per-provider prices
-([factory.go:13–34](../../../proxy/internal/middleware/builtin/cost_meter/factory.go)).
-Both tiers are validated by `pricing.NewTable` / `pricing.NewEntries` at
-construction, so a non-finite or negative rate fails the chain build. A price
-change is an ordinary mapping push — the chain rebuild yields a fresh instance
-over a fresh immutable table, so there is no data dir, no pricing file, no
-reload goroutine, and nothing to invalidate.
-
-**Two-tier lookup**
-([middleware.go:165–183](../../../proxy/internal/middleware/builtin/cost_meter/middleware.go)):
-
-1. **Per-provider-record** — the operator's stored price for the route that
-   actually served the request, keyed by the `llm.resolved_provider_id` that
-   `llm_router` stamped on the allow path, then by normalized model id. Entries
-   arrive fully materialized (management folds default cache rates in at synth
-   time), so there is no merging here. Absent metadata — no router in the chain
-   — skips this tier.
-2. **Surface defaults** — the catalog-derived table keyed by `llm.provider`
-   (`openai`/`anthropic`/`bedrock`). This is also what prices gateway-style
-   providers, which enumerate no models and therefore get no per-record entry.
-
-**Backward compatibility:** a config with no `pricing` block means management
-predates config-delivered pricing. The factory logs one warning at build time
-and the instance records `cost.skipped=unknown_model` ($0) for every request
-rather than falling back to a stale built-in price list
-([factory.go:55–60](../../../proxy/internal/middleware/builtin/cost_meter/factory.go)).
-
-**Key invariant:** the provider-shape switch lives in `pricing.EntryCosts`
-(sibling doc) and is selected by the **surface**, not by which tier the entry
-came from — `cost_meter` stays provider-agnostic, and a per-record override on
-an Anthropic route still bills its cache buckets additively.
+Reads `llm.provider` + `llm.model` + token buckets, looks up per-1k rate via
+`pricing.Loader`, emits `cost.usd_total` or a closed-set `cost.skipped`
+reason (`missing_provider/model/tokens`, `unparseable_tokens`, `zero_tokens`,
+`unknown_model`). Loader's hot-reload goroutine is bound to proxy-lifetime
+context via `startReloader`. **Key invariant:** provider-shape switch lives
+in `pricing.Table.Cost` (sibling doc) — `cost_meter` stays provider-agnostic.
 
 ### llm_limit_record
 
@@ -280,14 +246,12 @@ no mocks. Tests: `TestChain_AllowPath_StampsAttributionAndRecordsCounter`
 | `llm_identity_inject` | `{providers: [{provider_id, header_pair?|json_metadata?, extra_headers?}]}` |
 | `llm_guardrail` | `{provider_allowlists: {providerID: []string}, prompt_capture: {enabled, redact_pii}}` — allowlist keyed by resolved provider id; a provider absent from the map is unrestricted (fail-closed backstop; authoritative per-policy/group check is management's `CheckLLMPolicyLimits`) |
 | `llm_response_parser` | `{redact_pii?, capture_completion?: *bool}` |
-| `cost_meter` | `{pricing: {defaults: {surface: {model: rates}}, providers: {providerRecordID: {model: rates}}}}` — rates are `{input_per_1k, output_per_1k, cached_input_per_1k?, cache_read_per_1k?, cache_creation_per_1k?}`. A missing `pricing` key means "management predates config-delivered pricing": every request records `cost.skipped=unknown_model` |
+| `cost_meter` | `{pricing_path?}` (basename inside data-dir; defaults `pricing.yaml`) |
 | `llm_limit_record` | `{}` — same pattern as `llm_limit_check` |
 
 All factories accept empty / null / `{}` / whitespace as zero-value config;
 only structurally invalid JSON is rejected so misconfig surfaces at chain
-build time. `cost_meter` adds a semantic check on top of that: a `pricing`
-block carrying a negative or non-finite rate fails the build too, rather than
-mispricing live traffic.
+build time.
 
 ## Invariants
 
@@ -356,11 +320,10 @@ non-object `metadata` field
 — header path still attributes, but body-level tag-budget enforcement
 doesn't run for that request.
 
-**Concurrency.** `cost_meter`'s two pricing tables are built once from the
-middleware config and never mutated, so the lookup path needs no lock or atomic
-swap — a price change replaces the whole instance. Every middleware is
-otherwise a stateless value receiver. Integration test uses real bufconn gRPC —
-race detector is the meaningful bar.
+**Concurrency.** `cost_meter` shares a `pricing.Loader` via
+`atomic.Pointer[Table]`; readers always see a consistent table. Every
+middleware is a stateless value receiver. Integration test uses real bufconn
+gRPC — race detector is the meaningful bar.
 
 **Perf.** Hot path is `lookupKV` linear scan over <10 KVs; `cost_meter.Cost`
 is O(1); SSE accumulation is single-pass. No map allocation per call.
@@ -386,13 +349,13 @@ counter accuracy.
 | `llm_guardrail/redact_test.go` | 15 | Email, SSN, phone (E.164 + NA), bearer, IPv4; fixture-driven |
 | `llm_response_parser/middleware_test.go` | 18 | Buffered OAI+Anthro, capture-pointer, redact, truncation |
 | `llm_response_parser/streaming_test.go` | 7 | OAI usage frame, Anthro message_delta, truncated body best-effort |
-| `cost_meter/middleware_test.go` | 22 | Each skip reason, provider-shape formulas, config-delivered defaults, per-record-beats-defaults + miss-falls-back, per-record uses surface formula, nil-pricing skips everything, invalid-rate rejection |
+| `cost_meter/middleware_test.go` | 17 | Each skip reason, provider-shape, pricing loader integration |
 | `llm_limit_record/middleware_test.go` | 7 | Skip-on-no-signal, skip-on-missing-attribution, RPC failure swallowed |
 
 ## Cross-references
 
 - Sibling: [32-proxy-llm-parsers.md](./32-proxy-llm-parsers.md) — SDK adapters
-  + SSE framer + pricing table and cost formula.
+  + SSE framer + pricing loader.
 - Path-routed providers (Vertex AI + Bedrock), `keyfile::` credential, GCP
   token minting, `/bedrock` prefix:
   [50-path-routed-providers.md](./50-path-routed-providers.md).

docs/agent-networks/modules/32-proxy-llm-parsers.md

@@ -9,7 +9,7 @@ pricing table's per-provider cost formula is the highest-leverage place a
 small bug would silently mis-bill operators.
 
 Sibling module: [31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md)
-— the 8 middlewares that consume this package's parsers + pricing table.
+— the 8 middlewares that consume this package's parsers + pricing loader.
 
 ---
 
@@ -24,9 +24,8 @@ proxy-framework dependencies:
 - `openai.go` / `anthropic.go` / `bedrock.go` — per-provider `Parser` impls.
 - `sse.go` — SSE scanner (`Scanner`, `Event`, `NewScanner`).
 - `errors.go` — sentinels callers branch on with `errors.Is`.
-- `pricing/` — immutable pricing table + the per-surface cost formula. The
-  rates themselves come from management inside `cost_meter`'s middleware
-  config; this package holds no price list and reads no files.
+- `pricing/` — embedded-default + hot-reload override table with
+  symlink-safe Unix loader (build-tagged stub elsewhere).
 - `fixtures/` — captured request/response/stream bodies the tests replay.
 
 The package carries zero proxy-framework dependencies so the same parsers can
@@ -48,9 +47,12 @@ be reused later by a WASM adapter
 | `sse_test.go` | 175 | 12 tests; fixture replay + multiline + size limits |
 | `parser_test.go` | 53 | `Parsers()`, `DetectParser`, provider enum values |
 | `errors.go` | 31 | 6 sentinels: `Err{Unknown,Unsupported}Provider/Model`, `Err{NotLLM,Malformed}Response`, `ErrStreamingUnsupported`, `ErrMalformedRequest` |
-| `pricing/pricing.go` | 234 | `Table`, `Entry`, `EntryJSON`, `Costs`; `NewTable`/`NewEntries` validation + `EntryCosts` formula. No I/O, no reload, no embedded rates |
-| `pricing/pricing_test.go` | 177 | 10 tests — provider-shape formulas, cached clamp, rate fallback, nil-safety, rate validation |
-| `fixtures/*` | 21–59 | OAI chat/responses/stream + Anthro messages/stream |
+| `pricing/pricing.go` | 421 | `Loader`, `Table`, `Entry`; embedded defaults + atomic swap + mtime reload |
+| `pricing/pricing_unix.go` | 69 | `O_NOFOLLOW` + fstat-from-FD + 1 MiB cap |
+| `pricing/pricing_other.go` | 21 | Stub returning "not supported on this platform" |
+| `pricing/pricing_test.go` | 432 | 21 tests — symlink rejection, reload race, path traversal, oversize |
+| `pricing/defaults_pricing.yaml` | 85 | go:embed source of truth |
+| `fixtures/*` | 21–59 | OAI chat/responses/stream + Anthro messages/stream + pricing starter |
 
 ## Request body → parser dispatch
 
@@ -186,11 +188,9 @@ response leg, covering both Bedrock body shapes:
   `totalTokens`). `firstNonZero` folds the two naming conventions into one
   `Usage`; when Converse omits `totalTokens` the parser sums the buckets.
 
-`ProviderName()` returns `"bedrock"` — its own pricing surface in the table
-management ships, keyed by the **normalised** model id (region prefix + version
-suffix stripped by the request parser; management normalises its keys the same
-way at synth time so the two compare equal). `ParseResponse` returns
-`ErrStreamingUnsupported` for an
+`ProviderName()` returns `"bedrock"` — its own `defaults_pricing.yaml` block,
+keyed by the **normalised** model id (region prefix + version suffix stripped by
+the request parser). `ParseResponse` returns `ErrStreamingUnsupported` for an
 AWS binary event-stream content-type (`application/vnd.amazon.eventstream`,
 `isAWSEventStream`) so the caller routes to the streaming accumulator instead.
 
@@ -205,34 +205,11 @@ response body. Streaming accumulators live in the middleware package
 ([llm_response_parser/streaming.go](../../../proxy/internal/middleware/builtin/llm_response_parser/streaming.go))
 but use `llm.NewScanner` so the framing contract stays here.
 
-### Pricing table
+### Pricing catalog
 
-**Management is the sole pricing authority.** The proxy carries no embedded
-price list and reads no pricing file: the whole table arrives inside
-`cost_meter`'s `ConfigJSON` on the ordinary mapping push, and a price change
-is just another push — the chain rebuild constructs a fresh `Table`, so there
-is nothing to reload
-([pricing.go:1–7](../../../proxy/internal/llm/pricing/pricing.go)). The
-management side of the contract (catalog defaults, the operator's stored
-per-provider prices, and `AgentNetwork.PricingDefaultsFile`) is covered in the
-management-side module guide; `cost_meter`'s wire shape is in
-[31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md).
-
-`EntryJSON`
-([pricing.go:36–45](../../../proxy/internal/llm/pricing/pricing.go)) is the
-management→proxy contract — five USD-per-1k rates under `input_per_1k`,
-`output_per_1k`, `cached_input_per_1k`, `cache_read_per_1k`,
-`cache_creation_per_1k`. Management's `pricing.Entry` marshals the identical
-names, and `EntryJSON`/`Entry` are field-identical so `NewEntries` converts by
-direct struct conversion rather than field-by-field copying (a new rate can't
-be silently dropped in transit).
-
-`EntryCosts`
-([pricing.go:183–234](../../../proxy/internal/llm/pricing/pricing.go))
-is the cost formula — most security-relevant math in this module. The
-**surface** (the `llm.provider` value the request parser stamped) selects the
-formula, never the tier the entry came from: a per-provider-record override on
-an Anthropic route still bills its cache buckets additively.
+`Table.Cost`
+([pricing.go:129–174](../../../proxy/internal/llm/pricing/pricing.go))
+is the cost formula — most security-relevant math in this module:
 
 | Provider | Formula |
 |---|---|
@@ -241,7 +218,7 @@ an Anthropic route still bills its cache buckets additively.
 | default | `inTokens × InputPer1K + outTokens × OutputPer1K` |
 
 `bedrock` shares the Anthropic additive-cache formula
-([pricing.go:214–229](../../../proxy/internal/llm/pricing/pricing.go)):
+([pricing.go:172-174](../../../proxy/internal/llm/pricing/pricing.go)):
 Anthropic-on-Bedrock reports the same additive cache buckets, while non-Anthropic
 Bedrock models (Nova, Llama) simply report zero in those buckets so cost reduces
 to `input + output`.
@@ -249,12 +226,15 @@ to `input + output`.
 Each per-bucket rate falls back to `InputPer1K` when zero — operators opt in
 to discounts by setting the field.
 
-`Costs`
-([pricing.go:143–163](../../../proxy/internal/llm/pricing/pricing.go)) is the
-per-request split. The four per-bucket fields are the base; `TotalUSD` and
-`CacheUSD` are **derived** in `newCosts` so the aggregates can never drift from
-the breakdown. `InputUSD` is always the non-cached input bucket on both
-provider shapes, so input and cached-input never double-count.
+`Loader`
+([pricing.go:212–268](../../../proxy/internal/llm/pricing/pricing.go))
+overlays an optional `pricing.yaml` from data-dir on top of the go:embed
+defaults. Atomic pointer swap means readers never observe a partial update.
+The mtime-poll reloader (30s default cadence) keeps the previous table on
+parse failure so cost annotation never goes blank during a botched edit.
+
+`defaults_pricing.yaml` is the source of truth for built-in pricing.
+Operator overrides only carry the entries they want to change.
 
 ## Public contracts
 
@@ -284,38 +264,29 @@ Order matters: `DetectFromURL` ties resolve by registration order.
 `ProviderBedrock = 3`. Numeric values are persisted in nothing today but treat
 them as wire-stable — new providers must take fresh numbers.
 
-**`Pricing` construction + lookup**
-([pricing.go:60–130](../../../proxy/internal/llm/pricing/pricing.go)):
+**`Pricing` lookup**
+([pricing.go:129](../../../proxy/internal/llm/pricing/pricing.go)):
 
 ```go
-func NewEntries(raw map[string]map[string]EntryJSON) (map[string]map[string]Entry, error)
-func NewTable(raw map[string]map[string]EntryJSON) (*Table, error)
-
-func (t *Table) Lookup(provider, model string) (Entry, bool)
 func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (float64, bool)
-func (t *Table) Costs(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (Costs, bool)
-func EntryCosts(entry Entry, surface string, inTokens, outTokens, cachedInput, cacheCreation int64) Costs
 ```
 
-`NewTable` is the surface-keyed defaults table; `NewEntries` returns the raw
-two-level map `cost_meter` uses for the per-provider-record tier (it looks up an
-`Entry` directly and calls `EntryCosts`, so it needs no `Table` wrapper). Both
-reject any non-finite or negative rate, so a corrupt config fails the chain
-build rather than mispricing silently. Nil input yields an empty,
-never-matching table.
-
-Nil-safe: `t.Cost`/`t.Lookup` on a nil receiver returns `ok=false`
-([pricing.go:96–99](../../../proxy/internal/llm/pricing/pricing.go)).
-`ok=false` means the surface or model is absent from the table management sent;
-the caller emits `cost.skipped=unknown_model`.
+Nil-safe: `t.Cost` on a nil receiver returns `(0, false)`
+([pricing.go:130–132](../../../proxy/internal/llm/pricing/pricing.go)).
+`ok=false` means provider or model is absent from the loaded table; the caller
+emits `cost.skipped=unknown_model`.
 
 ## Invariants
 
-1. **The pricing package is pure and platform-independent.** No file I/O, no
-   `//go:embed`, no goroutines, no build tags — the rates arrive as config, so
-   there is nothing platform-specific left to port. Anything reintroducing a
-   read-from-disk path here re-splits pricing authority between management and
-   the proxy, which is exactly what this design removed.
+1. **Cross-platform pricing build.** `pricing_unix.go` carries the only
+   functional `loadPricing` (uses `syscall.O_NOFOLLOW` and `f.Stat()` on an
+   open descriptor — both Unix-only). `pricing_other.go` is a build-tag
+   fallback that returns `"not supported on this platform"`
+   ([pricing_other.go:14–16](../../../proxy/internal/llm/pricing/pricing_other.go)).
+   The proxy is Linux-only in production today; a Windows port needs an
+   equivalent path-as-handle implementation. Reviewers building on Windows
+   should expect this surface to return an error at startup if an override
+   file is configured.
 
 2. **SSE scanner handles partial chunks.** A buffered prefix that doesn't end
    in `\n\n` still yields its accumulated event before `io.EOF`
@@ -327,45 +298,38 @@ the caller emits `cost.skipped=unknown_model`.
    usage rather than aborting
    ([streaming.go:68–73, 144–150](../../../proxy/internal/middleware/builtin/llm_response_parser/streaming.go)).
 
-3. **Management is the only source of rates.** `Table` has no constructor that
-   invents prices: the only way in is `NewTable`/`NewEntries` over the wire map
-   management sent. A missing or empty `pricing` block therefore means *no
-   prices at all* (`cost_meter` records `cost.skipped=unknown_model`, $0) —
-   never a stale built-in fallback that would silently bill list price.
+3. **`defaults_pricing.yaml` is the source of truth.** Compiled into the
+   binary via `//go:embed`
+   ([pricing.go:29–30](../../../proxy/internal/llm/pricing/pricing.go)).
+   `DefaultTable()` parses once and panics on parse failure
+   ([pricing.go:42–49](../../../proxy/internal/llm/pricing/pricing.go))
+   — by design: a broken embedded YAML must not ship to production.
 
-4. **Tables are immutable once built.** `Table.entries` is written only in
-   `NewEntries` and never mutated afterwards, and `cost_meter`'s `perRecord`
-   map is likewise build-time-only
-   ([pricing.go:47–52](../../../proxy/internal/llm/pricing/pricing.go)). This
-   is what makes the no-reload design safe: a price change arrives as a mapping
-   push that builds a new middleware instance over a new table, so concurrent
-   readers can't observe a half-updated price list and no atomic swap or lock
-   is needed on the hot path.
+4. **Loader path validation.** `resolveMiddlewareDataPath`
+   ([pricing.go:370–394](../../../proxy/internal/llm/pricing/pricing.go))
+   rejects absolute paths, traversal segments, and basenames that fail
+   `basenameRegex = ^[a-zA-Z0-9._-]+$`. The resolved path must remain
+   inside `baseDir` even after `filepath.Clean`. Tests:
+   `TestNewLoader_PathValidation`, `TestNewLoader_PathValidation_Extended`,
+   `TestNewLoader_SymlinkOutsideBaseDirRejected`, `TestNewLoader_SymlinkRejected`.
 
-5. **Rate validation happens at chain-build time, not per request.**
-   `NewEntries` rejects negative, NaN, and ±Inf rates field by field
-   ([pricing.go:60–83](../../../proxy/internal/llm/pricing/pricing.go)), naming
-   the offending surface/model/field in the error. Management enforces the same
-   constraints at its API boundary and in its YAML parser, so this is
-   defense-in-depth — but it means a corrupt push fails loudly at build instead
-   of producing negative costs on live traffic. Test:
-   `TestNewTable_ValidatesRates`.
+5. **Unix loader symlink safety.** `O_NOFOLLOW` on open, `f.Stat()` on the
+   open descriptor (never re-stat by path), `info.Mode().IsRegular()` check,
+   `io.LimitReader(f, maxPricingBytes+1)` with a final size assertion
+   ([pricing_unix.go:25–57](../../../proxy/internal/llm/pricing/pricing_unix.go)).
+   A mid-read symlink swap is detected because the fstat is on the original
+   fd. Test: `TestNewLoader_RejectsOversizedFile_FixesM4`.
 
-6. **New rates must be added to `Entry`, `EntryJSON`, *and* management's
-   `pricing.Entry` together.** `NewEntries` converts by direct struct
-   conversion `Entry(e)`
-   ([pricing.go:76–78](../../../proxy/internal/llm/pricing/pricing.go)), which
-   only compiles while the two structs stay field-identical — so the proxy half
-   is compiler-enforced. The management half is not: a rate added there but not
-   here unmarshals into nothing and prices that bucket at `InputPer1K`.
+6. **`yaml.NewDecoder(...).KnownFields(true)`**
+   ([pricing.go:397–398](../../../proxy/internal/llm/pricing/pricing.go))
+   rejects YAML files that carry fields not in the schema. A typo in an
+   operator override file fails loud instead of silently zeroing rates.
 
 ## Things to scrutinise
 
-**Correctness.** Verify the OpenAI cached-prompt clamp at
-[pricing.go:203–206](../../../proxy/internal/llm/pricing/pricing.go)
-short-circuits before subtraction. Negative token counts are clamped to zero up
-front ([pricing.go:186–197](../../../proxy/internal/llm/pricing/pricing.go)) so
-no formula can yield a negative cost. `Anthropic.TotalTokens` sums all four
+**Correctness.** Verify OpenAI cached-prompt clamp at
+[pricing.go:147–149](../../../proxy/internal/llm/pricing/pricing.go)
+short-circuits before subtraction. `Anthropic.TotalTokens` sums all four
 buckets (in + out + cache_read + cache_creation) — downstream dashboards
 need to know this differs from `input + output`.
 `OpenAIParser.ExtractPrompt` falls through `messages → input → prompt`; a
@@ -374,27 +338,22 @@ noting).
 
 **Security.** `Scanner.maxLine = 1 MiB`; a 2 MiB single-line `data:` event
 errors from `Scanner.Next` and both accumulators stop with partial usage.
-Pricing is no longer file-backed, so the loader's path-traversal / symlink /
-oversize surface is gone entirely — the config channel (an authenticated
-mapping push from management) is now the only way rates enter the proxy, and
-`NewEntries` is the validation boundary on it. A new rate added to management's
-`pricing.Entry` but not to `EntryJSON` here is the remaining silent-mispricing
-path (see invariant 6).
+Pricing file 1 MiB cap is orders of magnitude larger than realistic. Confirm
+new schema additions are mirrored in both `pricingFile` and `Entry`;
+`KnownFields(true)` will reject silently-typo'd operator overrides
+otherwise.
 
-**Concurrency.** Nothing in this package is shared mutable state: tables are
-built once and never written again, so `cost_meter`'s hot path is lock-free by
-construction rather than by atomic swap. Per-call `Scanner` instances mean no
-shared state across concurrent response-parser calls.
+**Concurrency.** `Loader.table` is `atomic.Pointer[Table]`; readers never
+block or see a torn table. `Loader.Reload` is one goroutine, cancelled via
+context (`TestLoader_ReloadBackgroundLoopCancellation`). `DefaultTable()`
+uses `sync.Once`. Per-call `Scanner` instances mean no shared state across
+concurrent response-parser calls.
 
-**Perf.** `Table.Cost` is two map lookups + multiplications, O(1); the
-per-provider-record tier adds at most one more lookup. `Scanner.Next` is one
-`ReadString('\n')` per line. No background goroutines and no per-request
-allocation of pricing state.
+**Perf.** `Table.Cost` is two map lookups + multiplications, O(1).
+`Scanner.Next` is one `ReadString('\n')` per line. Pricing reload poll 30s.
 
-**Observability.** A config carrying no `pricing` block logs one warning at
-chain-build time (`cost_meter` factory) and then records
-`cost.skipped=unknown_model` per request, so an old-management deployment is
-visible in both logs and the access log rather than quietly reporting $0.
+**Observability.** Reload failures count via `metric.Int64Counter` keyed
+`plugin`; warning log rate-limited at 5 min so a broken file doesn't flood.
 Parser errors return sentinels — middleware uses `errors.Is` to map to the
 right `cost.skipped` reason.
 
@@ -406,7 +365,7 @@ right `cost.skipped` reason.
 | `openai_test.go` | 11 | Chat Completions + Responses API + legacy `prompt`; cached-tokens subset for both naming conventions; fixture replays |
 | `anthropic_test.go` | 7 | Messages + legacy `/v1/complete`; streaming REJECTED on `ParseResponse` (must use scanner); fixture replays |
 | `sse_test.go` | 12 | Fixture replay both providers; multiline `data:`; CRLF; comment skip; trailing-event-without-blank-line; oversize rejection |
-| `pricing/pricing_test.go` | 10 | Provider-shape switch (surface selects the formula); cached-rate + cache-read/creation fallback to `InputPer1K`; cached-clamp; negative-token clamp; nil-receiver safety; rate validation (negative / NaN / Inf rejected); nil + empty table |
+| `pricing/pricing_test.go` | 21 | Provider-shape switch; cached-rate fallback; cached-clamp; symlink rejection (target outside basedir + symlink to file); path validation matrix; oversize rejection; reload-keeps-previous-on-parse-error; mtime change detection; goroutine cancellation |
 
 **Fixtures** ([proxy/internal/llm/fixtures/](../../../proxy/internal/llm/fixtures/)):
 `openai_chat_completion.json` (chat.completions with usage),
@@ -414,15 +373,14 @@ right `cost.skipped` reason.
 `openai_stream.txt` (3 deltas + usage + `[DONE]`),
 `anthropic_messages.json` (Messages API non-streaming),
 `anthropic_stream.txt` (full 7-event sequence: message_start →
-content_block_{start,delta×2,stop} → message_delta (usage) → message_stop).
-No pricing fixture: the table is config-delivered, so pricing tests construct
-it in-process from a wire-shape map.
+content_block_{start,delta×2,stop} → message_delta (usage) → message_stop),
+`pricing.yaml` (realistic-pricing starter for operator overrides).
 
 ## Cross-references
 
 - Sibling: [31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md)
   — the chain that calls `llm.Parsers()`, `llm.ParserByName`,
-  `llm.NewScanner`, `pricing.NewTable` / `pricing.NewEntries`.
+  `llm.NewScanner`, `pricing.NewLoader`.
 - Path-routed providers (Vertex AI + Bedrock), credential syntax, and the
   Bedrock AWS event-stream accumulator:
   [50-path-routed-providers.md](./50-path-routed-providers.md).

docs/agent-networks/modules/33-proxy-runtime.md

@@ -1,7 +1,7 @@
 # proxy/runtime — translate + serve + log
 
 > **Risk level:** High — every config push from management is translated here, and the chain runs on every HTTP request to a synth target.
-> **Backward-compat impact:** Additive at the wire (`PathTargetOptions.middlewares`, `agent_network`, `disable_access_log`, capture caps) and on the proxy `Server` struct (`MiddlewareCaptureBudgetBytes`). Non-agent-network targets stay on the no-middleware fast path. Middleware config is entirely wire-delivered — no proxy-side data dir is involved, including for LLM pricing, which management ships inside `cost_meter`'s config.
+> **Backward-compat impact:** Additive at the wire (`PathTargetOptions.middlewares`, `agent_network`, `disable_access_log`, capture caps) and on the proxy `Server` struct (`MiddlewareDataDir`, `MiddlewareCaptureBudgetBytes`). Non-agent-network targets stay on the no-middleware fast path.
 
 ## Module boundary
 
@@ -114,7 +114,8 @@ At **request time** the access-log middleware stamps `CapturedData`; the auth ch
 
 ## Public contracts touched
 
-- `proxy.Server.MiddlewareCaptureBudgetBytes` (int64) — process-wide capture cap; defaults to 256 MiB (server.go:249-253). There is no `MiddlewareDataDir`: no built-in middleware reads config from disk, so `builtin.FactoryContext` carries only the proxy-lifetime context, meter, logger, and management client.
+- `proxy.Server.MiddlewareDataDir` (string) — base dir for file-backed middleware config (server.go:238-241).
+- `proxy.Server.MiddlewareCaptureBudgetBytes` (int64) — process-wide capture cap; defaults to 256 MiB (server.go:248-250).
 - `proxy/internal/proxy.WithMiddlewareManager(*middleware.Manager) Option` — new option on `NewReverseProxy`; nil keeps the fast path (reverseproxy.go:48-56).
 - `proxy/internal/proxy.PathTarget` adds `Middlewares`, `CaptureConfig`, `AgentNetwork`, `DisableAccessLog` (servicemapping.go:27-51), all zero-default.
 - `proxy/internal/proxy.CapturedData` adds `agentNetwork`, `suppressAccessLog`, `userGroupNames` behind `sync.RWMutex`; slices deep-copied (context.go:47-66, 183-258).

docs/agent-networks/modules/50-path-routed-providers.md

@@ -87,9 +87,9 @@ strips the `@version` suffix from the model, and maps the publisher to a parser
 surface via `vertexPublisherVendor`:
 
 - `anthropic` → `llm.provider="anthropic"` → metered through the Anthropic
-  parser, priced under the **`anthropic`** surface of the pricing table
-  management ships (the parser emits the standard Anthropic provider label, so
-  Vertex Claude reuses first-party Anthropic prices).
+  parser, priced under the **`anthropic`** block in `defaults_pricing.yaml`
+  (the parser emits the standard Anthropic provider label, so Vertex Claude
+  reuses first-party Anthropic prices).
 - `openai` → `llm.provider="openai"` (reserved; not in the catalog lineup
   today).
 - anything else (notably `google` / Gemini) → empty vendor → **no parser**.
@@ -104,9 +104,8 @@ is omitted from the catalog.
 
 > Caveat: cross-region inference profiles in `eu` / `apac` carry a ~10% price
 > premium that the base per-token rates do **not** model — cost annotations for
-> those regions read low. Operators who need exact regional billing set the
-> affected models' prices on the provider record, or replace the default entries
-> via management's `AgentNetwork.PricingDefaultsFile`.
+> those regions read low. Operators who need exact regional billing override
+> the affected entries in `pricing.yaml`.
 
 ## AWS Bedrock (`bedrock_api`)
 
@@ -212,19 +211,15 @@ so a model-listing call can't be rewritten onto an upstream that would 404 it.
 ## Catalog ↔ pricing cross-check
 
 Catalog prices and context windows are cross-checked against LiteLLM's
-`model_prices_and_context_window.json`. The **catalog is the source of default
-prices**: management's `pricing.DefaultTable` folds every catalog provider's
-models into the surfaces that provider declares (`PricingSurfaces`), so coverage
-is structural rather than maintained in a parallel file
-([pricing/defaults.go](../../../management/internals/modules/agentnetwork/pricing/defaults.go)).
-`TestDefaultTable_CoversEveryCatalogModel` fails if a catalog model ends up
-unpriced, and `TestDefaultTable_NoConflictingContributions` fails if two
-providers contribute the same (surface, model) at different rates. Bedrock
-entries are keyed by the **normalised** id the request parser emits (region
-prefix + version suffix stripped) — management applies the same normalisation to
-per-provider prices at synth time, so the two keys compare equal. Vertex Claude
-carries no Bedrock-style prefix, so it prices straight off the `anthropic`
-surface.
+`model_prices_and_context_window.json`. The proxy's embedded
+`defaults_pricing.yaml` covers **every metered first-party model** the catalog
+enumerates — guarded by
+`TestDefaultTable_FirstPartyModelCoverage`
+([pricing/defaults_coverage_test.go](../../../proxy/internal/llm/pricing/defaults_coverage_test.go)),
+which fails if a catalog model has no embedded price. Bedrock entries are keyed
+by the **normalised** id the request parser emits (region prefix + version
+suffix stripped). Vertex Claude carries no Bedrock-style prefix, so it prices
+straight off the `anthropic` block.
 
 ## Things to scrutinise
 
@@ -237,17 +232,16 @@ operator-misconfigured Vertex provider and unmetered Gemini traffic; verify
 publishers).
 
 **Correctness.** `normalizeBedrockModel` is the join between the wire id and the
-pricing key — a model that normalises to something absent from the shipped
-pricing table meters at `cost.skipped=unknown_model` rather than failing the
-request. The
+pricing key — a model that normalises to something not in `defaults_pricing.yaml`
+meters at `cost.skipped=unknown_model` rather than failing the request. The
 `/bedrock` prefix strip must run on both the parser side (so the model is
 extracted) and the router side (so the upstream path is native); a regression in
 either silently breaks the other.
 
 **Metering caveats.** eu/apac cross-region Bedrock + Vertex profiles carry a
-~10% premium not modelled by base pricing — flagged in the catalog comment.
-Operators needing exact regional billing set per-provider prices on the model
-rows (or replace the default entries via `AgentNetwork.PricingDefaultsFile`).
+~10% premium not modelled by base pricing — flagged in both the catalog comment
+and `defaults_pricing.yaml`. Operators needing exact regional billing override
+the relevant entries.
 
 ## Cross-references
 

funding.json

@@ -6,7 +6,7 @@
     "name": "NetBird GmbH",
     "email": "hello@netbird.io",
     "phone": "",
-    "description": "NetBird GmbH is a Berlin-based software company specializing in the development of open source network security solutions. Network security is utterly complex and expensive, accessible only to companies with multi-million dollar IT budgets. In contrast, there are millions of companies left behind. Our mission is to create an advanced network and cybersecurity platform that is both easy-to-use and affordable for teams of all sizes and budgets. By leveraging the open source strategy and technological advancements, NetBird aims to set the industry standard for connecting and securing IT infrastructure.",
+    "description": "NetBird GmbH is a Berlin-based software company specializing in the development of open-source network security solutions. Network security is utterly complex and expensive, accessible only to companies with multi-million dollar IT budgets. In contrast, there are millions of companies left behind. Our mission is to create an advanced network and cybersecurity platform that is both easy-to-use and affordable for teams of all sizes and budgets. By leveraging the open-source strategy and technological advancements, NetBird aims to set the industry standard for connecting and securing IT infrastructure.",
     "webpageUrl": {
       "url": "https://github.com/netbirdio"
     }
@@ -15,7 +15,7 @@
     {
       "guid": "netbird",
       "name": "NetBird",
-      "description": "NetBird is a configuration-free peer-to-peer private network and a centralized access control system combined in a single open source platform. It makes it easy to create secure WireGuard-based private networks for your organization or home.",
+      "description": "NetBird is a configuration-free peer-to-peer private network and a centralized access control system combined in a single open-source platform. It makes it easy to create secure WireGuard-based private networks for your organization or home.",
       "webpageUrl": {
         "url": "https://github.com/netbirdio/netbird"
       },
@@ -59,7 +59,7 @@
         "guid": "support-yearly",
         "status": "active",
         "name": "Support Open Source Development and Maintenance - Yearly",
-        "description": "This will help us partially cover the yearly cost of maintaining the open source NetBird project.",
+        "description": "This will help us partially cover the yearly cost of maintaining the open-source NetBird project.",
         "amount": 100000,
         "currency": "USD",
         "frequency": "yearly",
@@ -72,7 +72,7 @@
         "guid": "support-one-time-year",
         "status": "active",
         "name": "Support Open Source Development and Maintenance - One Year",
-        "description": "This will help us partially cover the yearly cost of maintaining the open source NetBird project.",
+        "description": "This will help us partially cover the yearly cost of maintaining the open-source NetBird project.",
         "amount": 100000,
         "currency": "USD",
         "frequency": "one-time",
@@ -85,7 +85,7 @@
         "guid": "support-one-time-monthly",
         "status": "active",
         "name": "Support Open Source Development and Maintenance - Monthly",
-        "description": "This will help us partially cover the monthly cost of maintaining the open source NetBird project.",
+        "description": "This will help us partially cover the monthly cost of maintaining the open-source NetBird project.",
         "amount": 10000,
         "currency": "USD",
         "frequency": "monthly",
@@ -98,7 +98,7 @@
         "guid": "support-monthly",
         "status": "active",
         "name": "Support Open Source Development and Maintenance - One Month",
-        "description": "This will help us partially cover the monthly cost of maintaining the open source NetBird project.",
+        "description": "This will help us partially cover the monthly cost of maintaining the open-source NetBird project.",
         "amount": 10000,
         "currency": "USD",
         "frequency": "monthly",

infrastructure_files/migrate-to-enterprise.sh

@@ -15,6 +15,12 @@ set -o pipefail
 #   2. Postgres migration — add Postgres, migrate SQLite data via migrate-store.
 #   3. Traffic flow       — add NATS + flow-enricher + flow-receiver.
 #
+# Step 2 is skipped when the deployment already runs on Postgres
+# (server.store.engine: postgres in config.yaml). Nothing is provisioned or
+# migrated in that case and the store config is left exactly as the operator
+# wrote it — the enterprise image reads the same Postgres the community image
+# did. Such a deployment gets the image swap, and can still opt into step 3.
+#
 # If any step fails once the stack has been touched, the script rolls itself
 # back automatically: generated files are removed, the Postgres volume this run
 # created is dropped, and the original deployment is started again.
@@ -38,6 +44,18 @@ ENV_BACKUP=""
 PG_VOLUME_NAME=""
 BACKUP_DIR=""
 
+# Store state. STORE_ENGINE is what the deployment runs on today; when it is
+# already postgres, MIGRATE_POSTGRES stays "no" and nothing is provisioned.
+# POSTGRES_SERVICE is empty when Postgres lives outside this compose project.
+STORE_ENGINE=""
+EXISTING_POSTGRES="no"
+POSTGRES_DSN=""
+POSTGRES_SERVICE=""
+POSTGRES_DEPENDS_CONDITION="service_healthy"
+# Whether this run needs to generate config.yaml.enterprise at all. A pure
+# image swap does not.
+ENTERPRISE_CONFIG="no"
+
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
 check_docker_compose() {
@@ -192,6 +210,85 @@ detect_exposed_address() {
   yq eval '.server.exposedAddress // ""' "$CONFIG_YAML_HOST"
 }
 
+# The engine is a config.yaml-only setting — there is no env override for it
+# (combined/cmd/root.go reads it from YAML and derives the env vars), so
+# config.yaml is authoritative. Absent means the sqlite default.
+detect_store_engine() {
+  local engine
+  engine=$(yq eval '.server.store.engine // ""' "$CONFIG_YAML_HOST")
+  if [[ -z "$engine" ]] || [[ "$engine" == "null" ]]; then
+    engine="sqlite"
+  fi
+  echo "$engine" | tr '[:upper:]' '[:lower:]'
+}
+
+detect_store_dsn() {
+  yq eval '.server.store.dsn // ""' "$CONFIG_YAML_HOST"
+}
+
+# config.yaml is where a combined deployment carries its DSN; this only covers
+# hand-rolled installs that keep it in the environment instead.
+detect_store_dsn_from_compose() {
+  # `compose config` re-escapes a literal $ as $$ on the way out, so undo that
+  # to get the value the container actually receives.
+  $DOCKER_COMPOSE_COMMAND config 2>/dev/null | yq eval "
+    .services[\"$COMBINED_SERVICE\"].environment.NB_STORE_ENGINE_POSTGRES_DSN //
+    .services[\"$COMBINED_SERVICE\"].environment.NETBIRD_STORE_ENGINE_POSTGRES_DSN // \"\"
+  " - 2>/dev/null | sed 's/\$\$/$/g'
+}
+
+# Reads either DSN form: "host=db ..." or "postgres://user:pass@db:5432/name".
+dsn_host() {
+  local dsn="$1"
+  case "$dsn" in
+    *://*) printf '%s' "$dsn" | sed -n 's,^[a-zA-Z+]*://\([^/?]*\).*,\1,p' | sed -e 's,.*@,,' -e 's,:.*,,' ;;
+    *) printf '%s' "$dsn" | sed -n 's/.*[[:space:]]*host=\([^[:space:]]*\).*/\1/p' ;;
+  esac
+}
+
+# flow-enricher is its own container, so a loopback host or a socket path would
+# reach the enricher rather than Postgres. Only flag hosts we can positively
+# identify — an unparseable DSN must not leave the operator with no way forward.
+dsn_host_reachable() {
+  local dsn="$1"
+  case "$(dsn_host "$dsn")" in
+    localhost | 127.* | ::1 | 0.0.0.0 | /*) return 1 ;;
+    *) return 0 ;;
+  esac
+}
+
+# Names the compose service running this deployment's Postgres, for depends_on.
+# Empty means external — the DSN host matched no service. A DSN with no readable
+# host falls back to matching on image.
+detect_postgres_service() {
+  local host
+  host=$(dsn_host "$POSTGRES_DSN")
+  if [[ -n "$host" ]]; then
+    if [[ "$(host="$host" yq eval '.services | has(env(host))' "$COMPOSE_FILE" 2>/dev/null)" == "true" ]]; then
+      echo "$host"
+    fi
+    return
+  fi
+  yq eval '.services | to_entries | map(select(.value.image // "" | test("(^|/)(postgres|postgis|pgvector|timescaledb)(:|@|$)"))) | .[0].key // ""' "$COMPOSE_FILE"
+}
+
+# depends_on: service_healthy is only legal if the service defines a healthcheck.
+detect_postgres_depends_condition() {
+  local tag
+  tag=$(yq eval ".services[\"$POSTGRES_SERVICE\"].healthcheck | tag" "$COMPOSE_FILE" 2>/dev/null)
+  if [[ "$tag" == "!!map" ]]; then
+    echo "service_healthy"
+  else
+    echo "service_started"
+  fi
+}
+
+env_value() {
+  local value="$1"
+  value=$(printf '%s' "$value" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\$/$$/g')
+  printf '"%s"' "$value"
+}
+
 detect_compose_network() {
   local tag
   tag=$(yq eval ".services[\"$COMBINED_SERVICE\"].networks | tag" "$COMPOSE_FILE" 2>/dev/null)
@@ -231,16 +328,30 @@ services:
       NETBIRD_LICENSE_SERVER_BASE_URL: \${NETBIRD_LICENSE_SERVER_BASE_URL}
 EOF
 
+  # An existing Postgres is already wired up by the operator's own compose file,
+  # so only a Postgres this run creates needs a depends_on.
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
     cat <<EOF
     depends_on:
-      postgres:
-        condition: service_healthy
+      ${POSTGRES_SERVICE}:
+        condition: ${POSTGRES_DEPENDS_CONDITION}
+EOF
+  fi
+
+  # The server is only pointed at a different config file when this run
+  # generates one. A pure image swap leaves it on its original config.yaml.
+  if [[ "$ENTERPRISE_CONFIG" == "yes" ]]; then
+    cat <<EOF
     volumes:
       - ./${ENTERPRISE_CONFIG_FILE}:/etc/netbird/config.yaml.enterprise:ro
     command: ["--config", "/etc/netbird/config.yaml.enterprise"]
+EOF
+  fi
 
-  postgres:
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+    cat <<EOF
+
+  ${POSTGRES_SERVICE}:
     image: postgres:17
     container_name: netbird-postgres
     restart: unless-stopped
@@ -260,6 +371,14 @@ EOF
   fi
 
   if [[ "$ENABLE_FLOW" == "yes" ]]; then
+    # Nothing to wait on when Postgres is managed outside this compose project.
+    local enricher_depends=""
+    if [[ -n "$POSTGRES_SERVICE" ]]; then
+      enricher_depends="
+      ${POSTGRES_SERVICE}:
+        condition: ${POSTGRES_DEPENDS_CONDITION}"
+    fi
+
     cat <<EOF
 
   nats:
@@ -276,9 +395,7 @@ EOF
     container_name: netbird-flow-enricher
     restart: unless-stopped
     networks: [${COMPOSE_NETWORK}]
-    depends_on:
-      postgres:
-        condition: service_healthy
+    depends_on:${enricher_depends}
       nats:
         condition: service_started
     environment:
@@ -286,10 +403,10 @@ EOF
       NETBIRD_LICENSE_SERVER_BASE_URL: \${NETBIRD_LICENSE_SERVER_BASE_URL}
       NB_DATADIR: /var/lib/netbird
       NB_MANAGEMENT_STORE_ENGINE: postgres
-      NB_MANAGEMENT_POSTGRES_DSN: "host=postgres user=netbird password=\${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
-      NB_STORE_ENGINE_POSTGRES_DSN: "host=postgres user=netbird password=\${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+      NB_MANAGEMENT_POSTGRES_DSN: \${NB_ENTERPRISE_POSTGRES_DSN}
+      NB_STORE_ENGINE_POSTGRES_DSN: \${NB_ENTERPRISE_POSTGRES_DSN}
       NB_TRAFFIC_EVENT_STORE_ENGINE: postgres
-      NB_TRAFFIC_EVENT_POSTGRES_DSN: "host=postgres user=netbird password=\${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+      NB_TRAFFIC_EVENT_POSTGRES_DSN: \${NB_ENTERPRISE_POSTGRES_DSN}
       NB_MANAGEMENT_STORE_KEY: \${NETBIRD_ENCRYPTION_KEY}
       NB_FLOW_ADAPTER_TYPE: nats
       NB_FLOW_NATS_ENDPOINTS: nats://nats:4222
@@ -346,27 +463,41 @@ EOF
   fi
 }
 
-# Build config.yaml.enterprise by yq-editing the operator's existing
-# config.yaml. We don't touch the original file.
+# Build config.yaml.enterprise from the operator's existing config.yaml. We
+# don't touch the original file. Values go through strenv() so a DSN carrying
+# quotes, backslashes or $ cannot break out of the expression.
 render_enterprise_config() {
-  local pg_dsn="host=postgres user=netbird password=${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+  {
+    echo "# Generated by migrate-to-enterprise.sh from ${CONFIG_YAML_HOST}."
+    echo "# The enterprise server is started with --config pointing at this file,"
+    echo "# so later edits to ${CONFIG_YAML_HOST} have no effect until copied here."
+    cat "$CONFIG_YAML_HOST"
+  } > "$ENTERPRISE_CONFIG_FILE"
 
-  yq eval "
-    .server.store.engine = \"postgres\" |
-    .server.store.dsn = \"$pg_dsn\" |
-    .server.activityStore.engine = \"postgres\" |
-    .server.activityStore.dsn = \"$pg_dsn\" |
-    .server.authStore.engine = \"postgres\" |
-    .server.authStore.dsn = \"$pg_dsn\"
-  " "$CONFIG_YAML_HOST" > "$ENTERPRISE_CONFIG_FILE"
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+    # Fresh Postgres: point every store section at it. migrate-store carries the
+    # SQLite contents across.
+    POSTGRES_DSN="$POSTGRES_DSN" yq eval -i '
+      .server.store.engine = "postgres" |
+      .server.store.dsn = strenv(POSTGRES_DSN) |
+      .server.activityStore.engine = "postgres" |
+      .server.activityStore.dsn = strenv(POSTGRES_DSN) |
+      .server.authStore.engine = "postgres" |
+      .server.authStore.dsn = strenv(POSTGRES_DSN)
+    ' "$ENTERPRISE_CONFIG_FILE"
+  fi
+  # Otherwise the store config is the operator's and stays untouched.
+  # activityStore and authStore do not inherit from server.store — each falls
+  # back to its own SQLite file under dataDir — so repointing them at Postgres
+  # here would silently strand the existing audit log and the embedded IdP's
+  # users, with no migrate-store run to carry them over.
 
   if [[ "$ENABLE_FLOW" == "yes" ]]; then
-    local flow_addr="${NETBIRD_DOMAIN}"
-    yq eval -i "
+    NETBIRD_DOMAIN="$NETBIRD_DOMAIN" yq eval -i '
       .server.trafficFlow.enabled = true |
-      .server.trafficFlow.address = \"$flow_addr\" |
-      .server.trafficFlow.interval = \"60s\"
-    " "$ENTERPRISE_CONFIG_FILE"
+      .server.trafficFlow.address = strenv(NETBIRD_DOMAIN) |
+      .server.trafficFlow.interval = "60s"
+    ' "$ENTERPRISE_CONFIG_FILE"
   fi
 }
 
@@ -633,6 +764,91 @@ on_exit() {
 # Main
 # ---------------------------------------------------------------------------
 
+# Already on Postgres: there is nothing to provision and nothing to migrate.
+# The enterprise image reads the very same store config the community image
+# did, so step 2 collapses to a no-op and the run is a plain image swap.
+configure_existing_postgres() {
+  EXISTING_POSTGRES="yes"
+  MIGRATE_POSTGRES="no"
+
+  # DSN first — detect_postgres_service prefers the host it names.
+  POSTGRES_DSN=$(detect_store_dsn)
+  if [[ -z "$POSTGRES_DSN" ]] || [[ "$POSTGRES_DSN" == "null" ]]; then
+    POSTGRES_DSN=$(detect_store_dsn_from_compose)
+  fi
+  if [[ "$POSTGRES_DSN" == "null" ]]; then
+    POSTGRES_DSN=""
+  fi
+
+  POSTGRES_SERVICE=$(detect_postgres_service)
+  if [[ -n "$POSTGRES_SERVICE" ]]; then
+    POSTGRES_DEPENDS_CONDITION=$(detect_postgres_depends_condition)
+  fi
+
+  echo "Step 2: Postgres migration not needed — this deployment already runs on"
+  echo "        Postgres. Its store configuration is reused as-is and left"
+  echo "        untouched; no database is created and no data is moved."
+  if [[ -n "$POSTGRES_SERVICE" ]]; then
+    echo "        Postgres service: $POSTGRES_SERVICE (in $COMPOSE_FILE)"
+  else
+    echo "        Postgres service: managed outside $COMPOSE_FILE"
+  fi
+}
+
+configure_sqlite_store() {
+  MIGRATE_POSTGRES=$(read_yes_no "Step 2: Migrate storage from SQLite to Postgres? (recommended)" "n")
+  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
+
+  # The override would otherwise merge into a service of the same name and
+  # quietly rewrite its image and credentials.
+  local existing
+  existing=$(yq eval '.services | has("postgres")' "$COMPOSE_FILE")
+  if [[ "$existing" == "true" ]]; then
+    echo "" > /dev/stderr
+    echo "$COMPOSE_FILE already defines a service named 'postgres', but config.yaml" > /dev/stderr
+    echo "still has server.store.engine: sqlite. This script would add its own" > /dev/stderr
+    echo "'postgres' service and Compose would merge the two." > /dev/stderr
+    echo "" > /dev/stderr
+    echo "Point server.store.engine at that Postgres yourself, or rename the service," > /dev/stderr
+    echo "then re-run." > /dev/stderr
+    exit 1
+  fi
+
+  echo ""
+  echo "  ⚠  Data will be migrated from SQLite to Postgres. The SQLite store"
+  echo "     will be backed up automatically. To fully revert later, restore"
+  echo "     that backup and delete docker-compose.override.yml +"
+  echo "     config.yaml.enterprise."
+  local confirm
+  confirm=$(read_yes_no "  Continue?" "y")
+  if [[ "$confirm" != "yes" ]]; then
+    MIGRATE_POSTGRES="no"
+    echo "  Skipping Postgres migration."
+    return 0
+  fi
+
+  POSTGRES_PASSWORD=$(rand_password)
+  POSTGRES_SERVICE="postgres"
+  POSTGRES_DEPENDS_CONDITION="service_healthy"
+  POSTGRES_DSN="host=postgres user=netbird password=${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+}
+
+# mysql, or something this script has never seen. Swapping the images is still
+# valid; touching the store is not.
+configure_unsupported_store() {
+  MIGRATE_POSTGRES="no"
+  echo "  ⚠  server.store.engine is '$STORE_ENGINE'. This script only migrates"
+  echo "     SQLite to Postgres, and traffic flow requires Postgres, so both are"
+  echo "     unavailable here. The store configuration will be left untouched."
+  echo ""
+  local proceed
+  proceed=$(read_yes_no "Step 2 skipped. Continue with the image swap only?" "n")
+  if [[ "$proceed" != "yes" ]]; then
+    echo "Aborted."
+    exit 0
+  fi
+}
+
 init_migration() {
   DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
   check_yq
@@ -682,12 +898,15 @@ init_migration() {
     exit 1
   fi
 
+  STORE_ENGINE=$(detect_store_engine)
+
   echo "Detected existing deployment:"
   echo "  Combined service: $COMBINED_SERVICE"
   echo "  Dashboard:        $DASHBOARD_SERVICE"
   echo "  config.yaml:      $CONFIG_YAML_HOST"
   echo "  Data volume:      $DATA_VOLUME"
   echo "  Network:          $COMPOSE_NETWORK"
+  echo "  Store engine:     $STORE_ENGINE"
   echo ""
 
   require_eula_acceptance
@@ -706,28 +925,17 @@ init_migration() {
   echo "Step 1: Image swap (community → Enterprise). License key required."
   NB_LICENSE_KEY=$(read_secret "  License key")
 
-  # Step 2 — optional
+  # Step 2 — what this does depends on what the deployment already stores in.
   echo ""
-  MIGRATE_POSTGRES=$(read_yes_no "Step 2: Migrate storage from SQLite to Postgres? (recommended)" "n")
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    echo ""
-    echo "  ⚠  Data will be migrated from SQLite to Postgres. The SQLite store"
-    echo "     will be backed up automatically. To fully revert later, restore"
-    echo "     that backup and delete docker-compose.override.yml +"
-    echo "     config.yaml.enterprise."
-    local confirm
-    confirm=$(read_yes_no "  Continue?" "y")
-    if [[ "$confirm" != "yes" ]]; then
-      MIGRATE_POSTGRES="no"
-      echo "  Skipping Postgres migration."
-    else
-      POSTGRES_PASSWORD=$(rand_password)
-    fi
-  fi
+  case "$STORE_ENGINE" in
+    postgres) configure_existing_postgres ;;
+    sqlite) configure_sqlite_store ;;
+    *) configure_unsupported_store ;;
+  esac
 
   # Step 3 — optional, only if Postgres is on (flow requires Postgres)
   echo ""
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]] || [[ "$EXISTING_POSTGRES" == "yes" ]]; then
     ENABLE_FLOW=$(read_yes_no "Step 3: Enable traffic flow? (requires Postgres)" "n")
     if [[ "$ENABLE_FLOW" == "yes" ]]; then
       # Auth secret MUST match server.authSecret from config.yaml
@@ -751,12 +959,43 @@ init_migration() {
         echo "Could not read server.store.encryptionKey from $CONFIG_YAML_HOST." > /dev/stderr
         exit 1
       fi
+
+      # flow-enricher talks to Postgres directly, so this is the one place an
+      # existing deployment's DSN is actually needed — and the one place a host
+      # that only works from inside the server container shows up.
+      while :; do
+        local dsn_problem=""
+        if [[ -z "$POSTGRES_DSN" ]]; then
+          dsn_problem="No DSN could be read from $CONFIG_YAML_HOST or from the $COMBINED_SERVICE environment."
+        elif ! dsn_host_reachable "$POSTGRES_DSN"; then
+          dsn_problem="Its host '$(dsn_host "$POSTGRES_DSN")' only resolves inside the server container."
+        fi
+        [[ -n "$dsn_problem" ]] || break
+
+        echo ""
+        echo "  The flow enricher reaches Postgres from a container of its own."
+        echo "  $dsn_problem"
+        echo "  Enter a DSN reachable from other containers, or press Ctrl-C to abort."
+        POSTGRES_DSN=$(read_required "  Postgres DSN (host=… user=… password=… dbname=… port=5432 sslmode=disable)")
+      done
+
+      # A DSN entered above names a different host, which decides what to wait on.
+      POSTGRES_SERVICE=$(detect_postgres_service)
+      if [[ -n "$POSTGRES_SERVICE" ]]; then
+        POSTGRES_DEPENDS_CONDITION=$(detect_postgres_depends_condition)
+      fi
     fi
   else
     ENABLE_FLOW="no"
     echo "Step 3 (traffic flow) skipped — requires Postgres."
   fi
 
+  # config.yaml.enterprise only exists to hold changes; without any there is
+  # nothing to generate and the server keeps running on its own config.yaml.
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]] || [[ "$ENABLE_FLOW" == "yes" ]]; then
+    ENTERPRISE_CONFIG="yes"
+  fi
+
   check_data_directory
   check_stale_postgres_volume
 }
@@ -774,7 +1013,7 @@ apply_changes() {
     sed -i.bak '/NETBIRD_LICENSE_SERVER_BASE_URL/d' "$OVERRIDE_FILE" && rm -f "$OVERRIDE_FILE.bak"
   fi
 
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+  if [[ "$ENTERPRISE_CONFIG" == "yes" ]]; then
     echo "Writing $ENTERPRISE_CONFIG_FILE ..."
     install -m 600 /dev/null "$ENTERPRISE_CONFIG_FILE"
     render_enterprise_config
@@ -810,6 +1049,9 @@ apply_changes() {
       echo "POSTGRES_PASSWORD=${POSTGRES_PASSWORD}"
     fi
     if [[ "$ENABLE_FLOW" == "yes" ]]; then
+      # Own variable name rather than NB_STORE_ENGINE_POSTGRES_DSN so that a
+      # deployment already setting that one keeps its own value.
+      echo "NB_ENTERPRISE_POSTGRES_DSN=$(env_value "$POSTGRES_DSN")"
       echo "NB_FLOW_AUTH_SECRET=${NB_FLOW_AUTH_SECRET}"
       echo "NETBIRD_ENCRYPTION_KEY=${NETBIRD_ENCRYPTION_KEY}"
     fi
@@ -871,14 +1113,19 @@ print_summary() {
   echo " Summary"
   echo "──────────────────────────────────────────────────────────────────────"
   echo "  Images:           swapped to enterprise"
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "  Storage:          Postgres (data migrated from SQLite)"
-  [[ "$MIGRATE_POSTGRES" != "yes" ]] && echo "  Storage:          SQLite (unchanged)"
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+    echo "  Storage:          Postgres (data migrated from SQLite)"
+  elif [[ "$EXISTING_POSTGRES" == "yes" ]]; then
+    echo "  Storage:          Postgres (pre-existing, configuration unchanged)"
+  else
+    echo "  Storage:          $STORE_ENGINE (unchanged)"
+  fi
   [[ "$ENABLE_FLOW" == "yes" ]] && echo "  Traffic flow:     enabled"
   [[ "$ENABLE_FLOW" != "yes" ]] && echo "  Traffic flow:     disabled"
   echo ""
   echo "  Generated files (next to your docker-compose.yml):"
   echo "    $OVERRIDE_FILE"
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
+  [[ "$ENTERPRISE_CONFIG" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
   echo "    .env  (license key + secrets, mode 600)"
   [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]] && echo "    $ENV_BACKUP  (.env as it was before this run)"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    backups/sqlite-pre-enterprise-*/  (SQLite backup)"
@@ -902,7 +1149,11 @@ print_summary() {
   else
     echo "  $DOCKER_COMPOSE_COMMAND down"
   fi
-  echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
+  if [[ "$ENTERPRISE_CONFIG" == "yes" ]]; then
+    echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
+  else
+    echo "  rm -f $OVERRIDE_FILE"
+  fi
   if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
     echo "  mv $ENV_BACKUP .env   # restores .env as it was before this run"
   elif [[ "$ENV_EXISTED" == "no" ]]; then

management/internals/modules/agentnetwork/handlers/me_handler.go

@@ -1,75 +0,0 @@
-package handlers
-
-import (
-	"net/http"
-
-	"github.com/gorilla/mux"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	nbcontext "github.com/netbirdio/netbird/management/server/context"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-	"github.com/netbirdio/netbird/shared/management/http/util"
-)
-
-// addMeEndpoints registers the self-service "My Agent Network" routes.
-// Both are available to every authenticated user regardless of role: the
-// responses are scoped strictly to the caller, which is tighter than any
-// role gate could be.
-func (h *handler) addMeEndpoints(router *mux.Router) {
-	router.HandleFunc("/agent-network/me/setup", h.getMySetup).Methods("GET", "OPTIONS")
-	router.HandleFunc("/agent-network/me/consumption", h.listMyConsumption).Methods("GET", "OPTIONS")
-}
-
-func (h *handler) getMySetup(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	setup, err := h.manager.GetSetupForUser(r.Context(), userAuth.AccountId, userAuth.UserId)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	util.WriteJSONObject(r.Context(), w, setupToAPI(setup))
-}
-
-func (h *handler) listMyConsumption(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	rows, err := h.manager.ListConsumptionForUser(r.Context(), userAuth.AccountId, userAuth.UserId)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	out := make([]api.AgentNetworkConsumption, 0, len(rows))
-	for _, row := range rows {
-		out = append(out, consumptionToAPI(row))
-	}
-	util.WriteJSONObject(r.Context(), w, out)
-}
-
-func setupToAPI(setup *types.EffectiveSetup) api.AgentNetworkMeSetup {
-	providers := make([]api.AgentNetworkMeProvider, 0, len(setup.Providers))
-	for _, p := range setup.Providers {
-		providers = append(providers, api.AgentNetworkMeProvider{
-			Name:             p.Name,
-			CatalogId:        p.CatalogID,
-			ApiFlavor:        p.APIFlavor,
-			AllModelsAllowed: p.AllModelsAllowed,
-			Models:           p.Models,
-		})
-	}
-	return api.AgentNetworkMeSetup{
-		Configured: setup.Configured,
-		Endpoint:   setup.Endpoint,
-		Providers:  providers,
-	}
-}

management/internals/modules/agentnetwork/handlers/providers_handler.go

@@ -43,7 +43,6 @@ func RegisterEndpoints(manager agentnetwork.Manager, router *mux.Router) {
 	h.addConsumptionEndpoints(router)
 	h.addAccessLogEndpoints(router)
 	h.addBudgetRuleEndpoints(router)
-	h.addMeEndpoints(router)
 }
 
 func (h *handler) getCatalogProviders(w http.ResponseWriter, r *http.Request) {

management/internals/modules/agentnetwork/manager.go

@@ -83,12 +83,6 @@ type Manager interface {
 	RecordAccountBudgetUsage(ctx context.Context, accountID, userID string, groupIDs []string, tokensIn, tokensOut int64, costUSD float64) error
 	RecordUsage(ctx context.Context, in RecordUsageInput) error
 	SelectPolicyForRequest(ctx context.Context, in PolicySelectionInput) (*PolicySelectionResult, error)
-
-	// GetSetupForUser and ListConsumptionForUser back the self-service
-	// "My Agent Network" endpoints. Both are caller-scoped and skip the
-	// role permission gate; see the implementations.
-	GetSetupForUser(ctx context.Context, accountID, userID string) (*types.EffectiveSetup, error)
-	ListConsumptionForUser(ctx context.Context, accountID, userID string) ([]*types.Consumption, error)
 }
 
 // PolicySelectionInput is the per-request selection envelope. The

management/internals/modules/agentnetwork/setup.go

@@ -1,261 +0,0 @@
-package agentnetwork
-
-import (
-	"context"
-	"fmt"
-	"sort"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/server/store"
-)
-
-// GetSetupForUser returns the Agent Network setup the calling user's
-// groups authorize. It deliberately performs no role permission check:
-// the result is scoped to the caller's own groups, which is strictly
-// tighter than any role gate, so every authenticated user (any role) may
-// read it. Peers and users carry the same groups, so the answer matches
-// what the proxy enforces for the caller's machines at request time.
-func (m *managerImpl) GetSetupForUser(ctx context.Context, accountID, userID string) (*types.EffectiveSetup, error) {
-	user, err := m.store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
-	if err != nil {
-		return nil, fmt.Errorf("get user: %w", err)
-	}
-	return m.effectiveSetupForGroups(ctx, accountID, user.AutoGroups)
-}
-
-// ListConsumptionForUser returns the caller's own consumption counters:
-// the user-dimension rows recorded for userID. Caller-scoped by design —
-// no role permission check, mirroring GetSetupForUser.
-func (m *managerImpl) ListConsumptionForUser(ctx context.Context, accountID, userID string) ([]*types.Consumption, error) {
-	rows, err := m.store.ListAgentNetworkConsumption(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		return nil, err
-	}
-	own := make([]*types.Consumption, 0)
-	for _, row := range rows {
-		if row.DimensionKind == types.DimensionUser && row.DimensionID == userID {
-			own = append(own, row)
-		}
-	}
-	return own, nil
-}
-
-// effectiveSetupForGroups computes the effective Agent Network setup for
-// a set of caller groups: the account endpoint plus, per authorized
-// provider, the effective model set. It mirrors what the proxy enforces
-// at request time — the policy filter matches filterApplicablePolicies,
-// the model logic matches policyPermitsModel, and orphan providers
-// (enabled but referenced by no applicable policy) are omitted just like
-// the router synthesizer omits them — so the answer never advertises
-// anything the proxy would refuse.
-//
-// Every "nothing available" shape returns Configured=false rather than
-// an error, and "account not set up" is indistinguishable from "caller
-// has no access" by design: the response must not leak what exists for
-// others.
-func (m *managerImpl) effectiveSetupForGroups(ctx context.Context, accountID string, groupIDs []string) (*types.EffectiveSetup, error) {
-	notConfigured := &types.EffectiveSetup{Providers: []types.EffectiveProvider{}}
-
-	settings, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
-	switch {
-	case err == nil:
-	case isNotFound(err):
-		return notConfigured, nil
-	default:
-		return nil, fmt.Errorf("get agent network settings: %w", err)
-	}
-	if settings.Endpoint() == "" {
-		return notConfigured, nil
-	}
-
-	policies, err := m.store.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		return nil, fmt.Errorf("list account policies: %w", err)
-	}
-	applicable := filterPoliciesByGroups(policies, groupIDs)
-	if len(applicable) == 0 {
-		return notConfigured, nil
-	}
-
-	providers, err := m.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		return nil, fmt.Errorf("list account providers: %w", err)
-	}
-
-	var guardrailsByID map[string]*types.Guardrail
-	if anyPolicyHasGuardrails(applicable) {
-		guardrailsByID, err = m.loadGuardrailsByID(ctx, accountID)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	authorized := make([]*types.Provider, 0, len(providers))
-	for _, p := range providers {
-		if p == nil || !p.Enabled {
-			continue
-		}
-		if len(policiesForProvider(applicable, p.ID)) == 0 {
-			continue
-		}
-		authorized = append(authorized, p)
-	}
-	if len(authorized) == 0 {
-		return notConfigured, nil
-	}
-	// created_at order, ID tiebreak — same deterministic order the router
-	// synthesizer presents.
-	sort.SliceStable(authorized, func(i, j int) bool {
-		if !authorized[i].CreatedAt.Equal(authorized[j].CreatedAt) {
-			return authorized[i].CreatedAt.Before(authorized[j].CreatedAt)
-		}
-		return authorized[i].ID < authorized[j].ID
-	})
-
-	out := &types.EffectiveSetup{
-		Configured: true,
-		Endpoint:   "https://" + settings.Endpoint(),
-		Providers:  make([]types.EffectiveProvider, 0, len(authorized)),
-	}
-	for _, p := range authorized {
-		allAllowed, models := effectiveModelsForProvider(p, policiesForProvider(applicable, p.ID), guardrailsByID)
-		flavor := ""
-		if entry, ok := catalog.Lookup(p.ProviderID); ok {
-			flavor = entry.ParserID
-		}
-		out.Providers = append(out.Providers, types.EffectiveProvider{
-			Name:             p.Name,
-			CatalogID:        p.ProviderID,
-			APIFlavor:        flavor,
-			AllModelsAllowed: allAllowed,
-			Models:           models,
-		})
-	}
-	return out, nil
-}
-
-// filterPoliciesByGroups returns the enabled policies whose SourceGroups
-// intersect the caller's groups. Same group matching as
-// filterApplicablePolicies, without the per-provider filter — the setup
-// answer spans every provider the caller can reach.
-func filterPoliciesByGroups(policies []*types.Policy, groupIDs []string) []*types.Policy {
-	groupSet := make(map[string]struct{}, len(groupIDs))
-	for _, g := range groupIDs {
-		if g != "" {
-			groupSet[g] = struct{}{}
-		}
-	}
-	out := make([]*types.Policy, 0, len(policies))
-	for _, p := range policies {
-		if p == nil || !p.Enabled {
-			continue
-		}
-		if !anyGroupMatches(p.SourceGroups, groupSet) {
-			continue
-		}
-		out = append(out, p)
-	}
-	return out
-}
-
-// policiesForProvider returns the subset of policies targeting the
-// provider, order preserved.
-func policiesForProvider(policies []*types.Policy, providerID string) []*types.Policy {
-	out := make([]*types.Policy, 0, len(policies))
-	for _, p := range policies {
-		if sliceContains(p.DestinationProviderIDs, providerID) {
-			out = append(out, p)
-		}
-	}
-	return out
-}
-
-// effectiveModelsForProvider derives the caller's effective model set for
-// one provider from the applicable policies that target it, mirroring
-// policyPermitsModel: a policy with no allowlist-enabled guardrail is
-// unrestricted, and one unrestricted policy makes the whole provider
-// unrestricted (the proxy would admit any model through it). Otherwise
-// the union of the policies' allowlists applies, intersected with the
-// provider's declared models when the operator declared any — the router
-// only claims declared models, so an allowlisted-but-undeclared model is
-// unreachable and must not be advertised. With no declared models the
-// router claims every model, so the allowlist union stands alone.
-func effectiveModelsForProvider(provider *types.Provider, policies []*types.Policy, guardrailsByID map[string]*types.Guardrail) (bool, []string) {
-	restricted := true
-	union := make([]string, 0)
-	seen := make(map[string]struct{})
-	for _, p := range policies {
-		policyRestricted := false
-		for _, gID := range p.GuardrailIDs {
-			g, ok := guardrailsByID[gID]
-			if !ok || g == nil || !g.Checks.ModelAllowlist.Enabled {
-				continue
-			}
-			policyRestricted = true
-			for _, model := range g.Checks.ModelAllowlist.Models {
-				key := normaliseModelID(model)
-				if key == "" {
-					continue
-				}
-				if _, dup := seen[key]; dup {
-					continue
-				}
-				seen[key] = struct{}{}
-				union = append(union, key)
-			}
-		}
-		if !policyRestricted {
-			restricted = false
-		}
-	}
-
-	declared := declaredModelIDs(provider)
-	if !restricted {
-		return true, declared
-	}
-	if len(provider.Models) == 0 {
-		// No operator declaration: the router claims every model, so the
-		// allowlist union is the effective set as-is.
-		return false, union
-	}
-	out := make([]string, 0, len(declared))
-	for _, id := range declared {
-		if _, ok := seen[normaliseModelID(id)]; ok {
-			out = append(out, id)
-		}
-	}
-	return false, out
-}
-
-// declaredModelIDs returns the models a provider exposes: the operator's
-// curated list when present, otherwise the catalog entry's models (an
-// empty operator list means "all catalog models"). Gateway/custom catalog
-// entries declare no models, so the result may be empty.
-func declaredModelIDs(provider *types.Provider) []string {
-	if ids := providerModelIDs(provider); len(ids) > 0 {
-		return ids
-	}
-	entry, ok := catalog.Lookup(provider.ProviderID)
-	if !ok {
-		return []string{}
-	}
-	out := make([]string, 0, len(entry.Models))
-	for _, m := range entry.Models {
-		if m.ID != "" {
-			out = append(out, m.ID)
-		}
-	}
-	return out
-}
-
-// GetSetupForUser on the mock manager reports "not configured" so tests
-// that don't care about setup still compile.
-func (*mockManager) GetSetupForUser(_ context.Context, _, _ string) (*types.EffectiveSetup, error) {
-	return &types.EffectiveSetup{Providers: []types.EffectiveProvider{}}, nil
-}
-
-// ListConsumptionForUser on the mock manager returns no rows.
-func (*mockManager) ListConsumptionForUser(_ context.Context, _, _ string) ([]*types.Consumption, error) {
-	return nil, nil
-}

management/internals/modules/agentnetwork/setup_realstore_test.go

@@ -1,295 +0,0 @@
-package agentnetwork
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/server/store"
-	nbtypes "github.com/netbirdio/netbird/management/server/types"
-)
-
-// These tests drive the effective-setup computation through the real
-// sqlite store, mirroring the policyselect realstore suite: assert on
-// observable answers (configured / providers / models), not on which
-// store methods get called. The computation must agree with what the
-// proxy enforces — policy filtering matches filterApplicablePolicies,
-// model logic matches policyPermitsModel, and orphan providers are
-// omitted like the router synthesizer omits them.
-
-func newSetupTestMgr(t *testing.T) (*managerImpl, store.Store) {
-	t.Helper()
-	ctx := context.Background()
-	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
-	require.NoError(t, err, "real sqlite test store must come up")
-	t.Cleanup(cleanup)
-	return &managerImpl{store: s}, s
-}
-
-// newSetupTestGuardrail returns an allowlist-enabled guardrail.
-func newSetupTestGuardrail(id string, models ...string) *types.Guardrail {
-	return &types.Guardrail{
-		ID:        id,
-		AccountID: testAccountID,
-		Name:      "allowlist " + id,
-		Checks: types.GuardrailChecks{
-			ModelAllowlist: types.GuardrailModelAllowlist{Enabled: true, Models: models},
-		},
-	}
-}
-
-func TestEffectiveSetup_RealStore_NoSettingsRow(t *testing.T) {
-	mgr, _ := newSetupTestMgr(t)
-
-	setup, err := mgr.effectiveSetupForGroups(context.Background(), testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	assert.False(t, setup.Configured, "account without settings must read as not configured")
-	assert.Empty(t, setup.Endpoint)
-	assert.Empty(t, setup.Providers)
-}
-
-func TestEffectiveSetup_RealStore_NoApplicablePolicy(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-other"})
-	require.NoError(t, err)
-	assert.False(t, setup.Configured, "caller outside every policy's source groups must read as not configured")
-	assert.Empty(t, setup.Endpoint, "no-access answer must not leak the endpoint")
-	assert.Empty(t, setup.Providers)
-}
-
-func TestEffectiveSetup_RealStore_UnrestrictedPolicyListsDeclaredModels(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	assert.True(t, setup.Configured)
-	assert.Equal(t, "https://"+testEndpoint, setup.Endpoint)
-	require.Len(t, setup.Providers, 1)
-	p := setup.Providers[0]
-	assert.Equal(t, "OpenAI", p.Name)
-	assert.Equal(t, "openai_api", p.CatalogID)
-	assert.Equal(t, "openai", p.APIFlavor)
-	assert.True(t, p.AllModelsAllowed, "policy without allowlist guardrail is unrestricted")
-	assert.Equal(t, []string{"gpt-5.4"}, p.Models, "declared models listed as a courtesy")
-}
-
-func TestEffectiveSetup_RealStore_AllowlistIntersectsDeclaredModels(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	provider.Models = []types.ProviderModel{{ID: "gpt-5.4"}, {ID: "gpt-4o"}}
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	// Allowlist admits gpt-5.4 (declared, odd casing/spacing) and gpt-4.1
-	// (NOT declared — the router would never route it, so it must not be
-	// advertised).
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", " GPT-5.4 ", "gpt-4.1")))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 1)
-	p := setup.Providers[0]
-	assert.False(t, p.AllModelsAllowed)
-	assert.Equal(t, []string{"gpt-5.4"}, p.Models, "allowlist ∩ declared, in declared order and casing")
-}
-
-func TestEffectiveSetup_RealStore_UnrestrictedPolicyWinsOverRestricted(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", "gpt-5.4")))
-	restricted := newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, restricted))
-	open := newSynthTestPolicy(provider.ID, "grp-eng", "")
-	open.ID = "pol-2"
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, open))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 1)
-	assert.True(t, setup.Providers[0].AllModelsAllowed,
-		"one applicable policy without an allowlist makes the provider unrestricted — the proxy would admit any model through it")
-}
-
-func TestEffectiveSetup_RealStore_AllowlistUnionAcrossPolicies(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	provider.Models = []types.ProviderModel{{ID: "gpt-5.4"}, {ID: "gpt-4o"}, {ID: "o4-mini"}}
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", "gpt-5.4")))
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-2", "gpt-4o")))
-	p1 := newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, p1))
-	p2 := newSynthTestPolicy(provider.ID, "grp-eng", "guard-2")
-	p2.ID = "pol-2"
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, p2))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 1)
-	p := setup.Providers[0]
-	assert.False(t, p.AllModelsAllowed)
-	assert.ElementsMatch(t, []string{"gpt-5.4", "gpt-4o"}, p.Models, "union of allowlists across applicable policies")
-}
-
-func TestEffectiveSetup_RealStore_OrphanAndDisabledProvidersOmitted(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	// Orphan: enabled but referenced by no policy.
-	orphan := newSynthTestProvider()
-	orphan.ID = "prov-orphan"
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, orphan))
-	// Disabled but referenced by an applicable policy.
-	disabled := newSynthTestProvider()
-	disabled.ID = "prov-disabled"
-	disabled.Enabled = false
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, disabled))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(disabled.ID, "grp-eng", "")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	assert.False(t, setup.Configured, "neither an orphan nor a disabled provider is reachable, so nothing is configured for the caller")
-	assert.Empty(t, setup.Providers)
-}
-
-func TestEffectiveSetup_RealStore_DisabledPolicyIgnored(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	policy := newSynthTestPolicy(provider.ID, "grp-eng", "")
-	policy.Enabled = false
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, policy))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	assert.False(t, setup.Configured)
-}
-
-func TestEffectiveSetup_RealStore_UndeclaredModelsUseAllowlistAsIs(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	// Gateway-style provider: no declared models — the router claims every
-	// model, so the allowlist union is the effective set on its own.
-	provider := newSynthTestProvider()
-	provider.ProviderID = "litellm_proxy"
-	provider.Name = "LiteLLM"
-	provider.Models = nil
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", "claude-sonnet-4-5")))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 1)
-	p := setup.Providers[0]
-	assert.False(t, p.AllModelsAllowed)
-	assert.Equal(t, []string{"claude-sonnet-4-5"}, p.Models)
-}
-
-func TestEffectiveSetup_RealStore_ProvidersInCreatedAtOrder(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	newer := newSynthTestProvider()
-	newer.ID = "prov-newer"
-	newer.Name = "Newer"
-	newer.CreatedAt = time.Date(2026, 2, 1, 0, 0, 0, 0, time.UTC)
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, newer))
-	older := newSynthTestProvider()
-	older.ID = "prov-older"
-	older.Name = "Older"
-	older.CreatedAt = time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, older))
-
-	policy := newSynthTestPolicy(newer.ID, "grp-eng", "")
-	policy.DestinationProviderIDs = []string{newer.ID, older.ID}
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, policy))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 2)
-	assert.Equal(t, "Older", setup.Providers[0].Name)
-	assert.Equal(t, "Newer", setup.Providers[1].Name)
-}
-
-// TestGetSetupForUser_RealStore pins the self-service entry point: the
-// user's group memberships (AutoGroups — the same groups the user's peers
-// carry) scope the answer, and users outside every policy get the
-// indistinguishable not-configured shape.
-func TestGetSetupForUser_RealStore(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
-
-	require.NoError(t, s.SaveUser(ctx, &nbtypes.User{
-		Id: "user-in", AccountID: testAccountID, Role: nbtypes.UserRoleUser, AutoGroups: []string{"grp-eng"},
-	}))
-	require.NoError(t, s.SaveUser(ctx, &nbtypes.User{
-		Id: "user-out", AccountID: testAccountID, Role: nbtypes.UserRoleUser, AutoGroups: []string{"grp-other"},
-	}))
-
-	setupIn, err := mgr.GetSetupForUser(ctx, testAccountID, "user-in")
-	require.NoError(t, err)
-	assert.True(t, setupIn.Configured)
-	require.Len(t, setupIn.Providers, 1)
-
-	setupOut, err := mgr.GetSetupForUser(ctx, testAccountID, "user-out")
-	require.NoError(t, err)
-	assert.False(t, setupOut.Configured, "user outside the policy's source groups gets the not-configured answer")
-}
-
-// TestListConsumptionForUser_RealStore pins the own-consumption scope: only
-// the caller's user-dimension rows come back, never another user's rows or
-// group rows.
-func TestListConsumptionForUser_RealStore(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	now := time.Now().UTC().Truncate(time.Hour)
-	require.NoError(t, s.IncrementAgentNetworkConsumption(ctx, testAccountID, types.DimensionUser, "user-a", 3600, now, 100, 50, 0.5))
-	require.NoError(t, s.IncrementAgentNetworkConsumption(ctx, testAccountID, types.DimensionUser, "user-b", 3600, now, 999, 999, 9.9))
-	require.NoError(t, s.IncrementAgentNetworkConsumption(ctx, testAccountID, types.DimensionGroup, "grp-eng", 3600, now, 1, 1, 0.1))
-
-	rows, err := mgr.ListConsumptionForUser(ctx, testAccountID, "user-a")
-	require.NoError(t, err)
-	require.Len(t, rows, 1, "only the caller's own user-dimension rows are visible")
-	assert.Equal(t, "user-a", rows[0].DimensionID)
-	assert.Equal(t, int64(100), rows[0].TokensInput)
-}

management/internals/modules/agentnetwork/types/setup.go

@@ -1,40 +0,0 @@
-package types
-
-// EffectiveSetup is the caller-scoped answer to "what may this caller
-// use on the Agent Network?" — the account's proxy endpoint plus the
-// providers and models the caller's groups authorize. It intentionally
-// carries display metadata only: no keys, no upstream URLs, no policy or
-// guardrail structure, and no hint of providers the caller cannot reach.
-type EffectiveSetup struct {
-	// Configured is false when the account has no Agent Network set up or
-	// when nothing is authorized for the caller's groups — the two cases
-	// are deliberately indistinguishable so the response leaks nothing
-	// about what exists for others.
-	Configured bool
-	// Endpoint is the account's proxy base URL
-	// ("https://<subdomain>.<cluster>"), reachable over the NetBird tunnel
-	// only. Empty when Configured is false.
-	Endpoint string
-	// Providers lists the providers at least one applicable policy
-	// authorizes for the caller, in the account's created_at order.
-	Providers []EffectiveProvider
-}
-
-// EffectiveProvider is one authorized provider in an EffectiveSetup.
-type EffectiveProvider struct {
-	// Name is the operator-assigned label, e.g. "Bedrock prod".
-	Name string
-	// CatalogID names the catalog entry, e.g. "anthropic_api".
-	CatalogID string
-	// APIFlavor is the request-body shape the provider speaks — the
-	// catalog entry's parser id ("anthropic", "openai"); empty when the
-	// proxy dispatches the provider by URL path instead.
-	APIFlavor string
-	// AllModelsAllowed is true when no model allowlist restricts this
-	// provider for the caller. Models then lists the declared/catalog
-	// models as a courtesy (possibly none for gateway-style providers).
-	AllModelsAllowed bool
-	// Models is the effective model allowlist for the caller, or the
-	// declared/catalog models when AllModelsAllowed is true.
-	Models []string
-}

management/server/permissions/agent_network_roles_test.go

@@ -1,130 +0,0 @@
-package permissions
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/server/permissions/modules"
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/permissions/roles"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-var allOps = []operations.Operation{operations.Read, operations.Create, operations.Update, operations.Delete}
-
-// TestAgentNetworkAdminRole pins the delegated-admin contract: full control
-// over the whole agent_network area (parent grant cascades to every
-// submodule), read-only on the account objects needed to build policies,
-// and nothing else in the account.
-func TestAgentNetworkAdminRole(t *testing.T) {
-	manager := NewManager(nil)
-	ctx := context.Background()
-
-	role, ok := roles.RolesMap[types.UserRoleAgentNetworkAdmin]
-	require.True(t, ok, "agent_network_admin must exist in RolesMap")
-
-	agentNetworkModules := []modules.Module{
-		modules.AgentNetwork,
-		modules.AgentNetworkProviders,
-		modules.AgentNetworkPolicies,
-		modules.AgentNetworkGuardrails,
-		modules.AgentNetworkBudgets,
-		modules.AgentNetworkUsage,
-		modules.AgentNetworkLogs,
-		modules.AgentNetworkSettings,
-	}
-	for _, m := range agentNetworkModules {
-		for _, op := range allOps {
-			assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
-				"agent_network_admin must have %s on %s", op, m)
-		}
-	}
-
-	for _, m := range []modules.Module{modules.Users, modules.Groups, modules.Peers, modules.Accounts} {
-		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, operations.Read),
-			"agent_network_admin must read %s to build policies", m)
-		for _, op := range []operations.Operation{operations.Create, operations.Update, operations.Delete} {
-			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
-				"agent_network_admin must not have %s on %s", op, m)
-		}
-	}
-
-	for _, m := range []modules.Module{modules.Networks, modules.Dns, modules.SetupKeys, modules.Routes, modules.Settings} {
-		for _, op := range allOps {
-			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
-				"agent_network_admin must not have %s on %s", op, m)
-		}
-	}
-}
-
-// TestUsageViewerRole pins the least-privilege cost role: read on the
-// aggregated usage overview and nothing else — no providers, no policies,
-// no request-level logs (which can contain captured prompts), nothing in
-// the rest of the account.
-func TestUsageViewerRole(t *testing.T) {
-	manager := NewManager(nil)
-	ctx := context.Background()
-
-	role, ok := roles.RolesMap[types.UserRoleUsageViewer]
-	require.True(t, ok, "usage_viewer must exist in RolesMap")
-
-	assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkUsage, operations.Read),
-		"usage_viewer must read the usage overview")
-	for _, op := range []operations.Operation{operations.Create, operations.Update, operations.Delete} {
-		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkUsage, op),
-			"usage_viewer must not have %s on usage", op)
-	}
-
-	denied := []modules.Module{
-		modules.AgentNetwork,
-		modules.AgentNetworkProviders,
-		modules.AgentNetworkPolicies,
-		modules.AgentNetworkGuardrails,
-		modules.AgentNetworkBudgets,
-		modules.AgentNetworkLogs,
-		modules.AgentNetworkSettings,
-		modules.Networks,
-		modules.Users,
-		modules.SetupKeys,
-	}
-	for _, m := range denied {
-		for _, op := range allOps {
-			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
-				"usage_viewer must not have %s on %s", op, m)
-		}
-	}
-}
-
-// TestBillingAdminRoleResolves pins that billing_admin has a proper entry
-// in the permission map. Its plan/seat/invoice permissions are enforced
-// outside this map; management-side it carries the regular User baseline
-// instead of failing role resolution.
-func TestBillingAdminRoleResolves(t *testing.T) {
-	manager := NewManager(nil)
-	ctx := context.Background()
-
-	role, ok := roles.RolesMap[types.UserRoleBillingAdmin]
-	require.True(t, ok, "billing_admin must exist in RolesMap")
-
-	permissions, err := manager.GetPermissionsByRole(ctx, types.UserRoleBillingAdmin)
-	require.NoError(t, err, "billing_admin role must resolve")
-	require.NotEmpty(t, permissions)
-
-	for _, m := range []modules.Module{modules.AgentNetwork, modules.Networks, modules.Users, modules.Peers} {
-		for _, op := range allOps {
-			assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, m, op),
-				"billing_admin must not have %s on %s", op, m)
-		}
-	}
-}
-
-// TestNewRolesParse pins the API role strings, which are permanent once
-// released.
-func TestNewRolesParse(t *testing.T) {
-	assert.Equal(t, types.UserRoleAgentNetworkAdmin, types.StrRoleToUserRole("agent_network_admin"))
-	assert.Equal(t, types.UserRoleUsageViewer, types.StrRoleToUserRole("usage_viewer"))
-	assert.Equal(t, types.UserRoleBillingAdmin, types.StrRoleToUserRole("billing_admin"))
-}

management/server/permissions/roles/agent_network_admin.go

@@ -1,54 +0,0 @@
-package roles
-
-import (
-	"github.com/netbirdio/netbird/management/server/permissions/modules"
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// AgentNetworkAdmin is the delegated administrator for the Agent Network
-// area: full control over providers, policies, guardrails, budgets, usage,
-// logs, and its settings, plus read-only visibility into the account
-// objects needed to build policies (users, groups, peers). Nothing else in
-// the account is visible.
-var AgentNetworkAdmin = RolePermissions{
-	Role: types.UserRoleAgentNetworkAdmin,
-	AutoAllowNew: map[operations.Operation]bool{
-		operations.Read:   false,
-		operations.Create: false,
-		operations.Update: false,
-		operations.Delete: false,
-	},
-	Permissions: Permissions{
-		modules.AgentNetwork: {
-			operations.Read:   true,
-			operations.Create: true,
-			operations.Update: true,
-			operations.Delete: true,
-		},
-		modules.Users: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-		modules.Groups: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-		modules.Peers: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-		modules.Accounts: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-	},
-}

management/server/permissions/roles/billing_admin.go

@@ -1,20 +0,0 @@
-package roles
-
-import (
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// BillingAdmin manages plans, seats, and invoices, which are enforced
-// outside this permission map (NetBird Cloud). Management-side it carries
-// the regular User baseline; the explicit entry keeps role resolution from
-// failing with a role-not-found error.
-var BillingAdmin = RolePermissions{
-	Role: types.UserRoleBillingAdmin,
-	AutoAllowNew: map[operations.Operation]bool{
-		operations.Read:   false,
-		operations.Create: false,
-		operations.Update: false,
-		operations.Delete: false,
-	},
-}

management/server/permissions/roles/role_permissions.go

@@ -15,12 +15,9 @@ type RolePermissions struct {
 type Permissions map[modules.Module]map[operations.Operation]bool
 
 var RolesMap = map[types.UserRole]RolePermissions{
-	types.UserRoleOwner:             Owner,
-	types.UserRoleAdmin:             Admin,
-	types.UserRoleUser:              User,
-	types.UserRoleAuditor:           Auditor,
-	types.UserRoleNetworkAdmin:      NetworkAdmin,
-	types.UserRoleAgentNetworkAdmin: AgentNetworkAdmin,
-	types.UserRoleUsageViewer:       UsageViewer,
-	types.UserRoleBillingAdmin:      BillingAdmin,
+	types.UserRoleOwner:        Owner,
+	types.UserRoleAdmin:        Admin,
+	types.UserRoleUser:         User,
+	types.UserRoleAuditor:      Auditor,
+	types.UserRoleNetworkAdmin: NetworkAdmin,
 }

management/server/permissions/roles/usage_viewer.go

@@ -1,30 +0,0 @@
-package roles
-
-import (
-	"github.com/netbirdio/netbird/management/server/permissions/modules"
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// UsageViewer is the regular User baseline plus read access to the
-// aggregated Agent Network usage and cost overview. It sees no provider
-// configuration, no policies, and no request-level access logs (which can
-// contain captured prompts): usage rows carry user and group display names
-// in the response itself, so no team-wide read access is needed.
-var UsageViewer = RolePermissions{
-	Role: types.UserRoleUsageViewer,
-	AutoAllowNew: map[operations.Operation]bool{
-		operations.Read:   false,
-		operations.Create: false,
-		operations.Update: false,
-		operations.Delete: false,
-	},
-	Permissions: Permissions{
-		modules.AgentNetworkUsage: {
-			operations.Read:   true,
-			operations.Create: false,
-			operations.Update: false,
-			operations.Delete: false,
-		},
-	},
-}

management/server/types/user.go

@@ -11,15 +11,13 @@ import (
 )
 
 const (
-	UserRoleOwner             UserRole = "owner"
-	UserRoleAdmin             UserRole = "admin"
-	UserRoleUser              UserRole = "user"
-	UserRoleUnknown           UserRole = "unknown"
-	UserRoleBillingAdmin      UserRole = "billing_admin"
-	UserRoleAuditor           UserRole = "auditor"
-	UserRoleNetworkAdmin      UserRole = "network_admin"
-	UserRoleAgentNetworkAdmin UserRole = "agent_network_admin"
-	UserRoleUsageViewer       UserRole = "usage_viewer"
+	UserRoleOwner        UserRole = "owner"
+	UserRoleAdmin        UserRole = "admin"
+	UserRoleUser         UserRole = "user"
+	UserRoleUnknown      UserRole = "unknown"
+	UserRoleBillingAdmin UserRole = "billing_admin"
+	UserRoleAuditor      UserRole = "auditor"
+	UserRoleNetworkAdmin UserRole = "network_admin"
 
 	UserStatusActive   UserStatus = "active"
 	UserStatusDisabled UserStatus = "disabled"
@@ -44,10 +42,6 @@ func StrRoleToUserRole(strRole string) UserRole {
 		return UserRoleAuditor
 	case "network_admin":
 		return UserRoleNetworkAdmin
-	case "agent_network_admin":
-		return UserRoleAgentNetworkAdmin
-	case "usage_viewer":
-		return UserRoleUsageViewer
 	default:
 		return UserRoleUnknown
 	}
@@ -146,7 +140,7 @@ func (u *User) IsRegularUser() bool {
 
 // IsRestrictable checks whether a user is in a restrictable role.
 func (u *User) IsRestrictable() bool {
-	return u.Role == UserRoleUser || u.Role == UserRoleBillingAdmin || u.Role == UserRoleUsageViewer
+	return u.Role == UserRoleUser || u.Role == UserRoleBillingAdmin
 }
 
 // ToUserInfo converts a User object to a UserInfo object.

shared/management/http/api/openapi.yml

@@ -4608,7 +4608,7 @@ components:
 
     FleetDMMatchAttributes:
       type: object
-      description: Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly
+      description: Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open-source version. Premium-only attributes are marked accordingly
       additionalProperties: false
       properties:
         disk_encryption_enabled:
@@ -5729,57 +5729,6 @@ components:
       required:
         - name
         - checks
-    AgentNetworkMeSetup:
-      type: object
-      description: The caller-scoped Agent Network connection info backing the "My Agent Network" self-service view. Available to every authenticated user; the answer is computed from the caller's own groups and carries display metadata only.
-      properties:
-        configured:
-          type: boolean
-          description: False when the account has no Agent Network set up or the caller's groups authorize none of it. The two cases are deliberately indistinguishable.
-        endpoint:
-          type: string
-          description: The account's Agent Network base URL, reachable over the NetBird tunnel only. Empty when configured is false.
-          example: https://calm-otter.proxy.example.com
-        providers:
-          type: array
-          description: The providers at least one of the caller's policies authorizes, in creation order.
-          items:
-            $ref: '#/components/schemas/AgentNetworkMeProvider'
-      required:
-        - configured
-        - endpoint
-        - providers
-    AgentNetworkMeProvider:
-      type: object
-      description: One provider the caller may use, reduced to what a local tool needs for configuration.
-      properties:
-        name:
-          type: string
-          description: Operator-assigned provider label.
-          example: Bedrock prod
-        catalog_id:
-          type: string
-          description: Catalog entry id naming the provider type.
-          example: bedrock_api
-        api_flavor:
-          type: string
-          description: Request-body shape the provider speaks ("anthropic", "openai"). Empty when the gateway dispatches it by URL path instead.
-          example: anthropic
-        all_models_allowed:
-          type: boolean
-          description: True when no model allowlist restricts this provider for the caller; models then lists the declared or catalog models as a courtesy.
-        models:
-          type: array
-          description: The effective model allowlist for the caller (or the declared/catalog models when all_models_allowed is true).
-          items:
-            type: string
-          example: [ "anthropic.claude-sonnet-4-5" ]
-      required:
-        - name
-        - catalog_id
-        - api_flavor
-        - all_models_allowed
-        - models
     AgentNetworkConsumption:
       type: object
       description: One per-(dimension, window) consumption counter row. The proxy ticks one row per dimension on every served LLM request; the dashboard reads this listing to surface live counter growth.
@@ -13774,46 +13723,6 @@ paths:
           "$ref": "#/components/responses/forbidden"
         '500':
           "$ref": "#/components/responses/internal_error"
-  /api/agent-network/me/setup:
-    get:
-      summary: Retrieve the caller's Agent Network setup
-      description: Returns everything the caller needs to configure a local AI tool and nothing more - the account's Agent Network endpoint plus the providers and models the caller's own policies allow. Available to every authenticated user regardless of role; the response never contains provider credentials, policy or guardrail configuration, or providers the caller cannot reach.
-      tags: [ Agent Network ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      responses:
-        '200':
-          description: The caller-scoped Agent Network connection info
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AgentNetworkMeSetup'
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-  /api/agent-network/me/consumption:
-    get:
-      summary: List the caller's own Agent Network consumption
-      description: Returns the caller's own per-window token and cost counters (the user dimension recorded for the calling user), ordered window-newest-first. Available to every authenticated user regardless of role. Empty list when the caller has not consumed anything yet.
-      tags: [ Agent Network ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      responses:
-        '200':
-          description: A JSON Array of the caller's own consumption counter rows
-          content:
-            application/json:
-              schema:
-                type: array
-                items:
-                  $ref: '#/components/schemas/AgentNetworkConsumption'
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '500':
-          "$ref": "#/components/responses/internal_error"
   /api/agent-network/settings:
     get:
       summary: Retrieve Agent Network settings

shared/management/http/api/types.gen.go

@@ -2167,36 +2167,6 @@ type AgentNetworkGuardrailRequest struct {
 	Name string `json:"name"`
 }
 
-// AgentNetworkMeProvider One provider the caller may use, reduced to what a local tool needs for configuration.
-type AgentNetworkMeProvider struct {
-	// AllModelsAllowed True when no model allowlist restricts this provider for the caller; models then lists the declared or catalog models as a courtesy.
-	AllModelsAllowed bool `json:"all_models_allowed"`
-
-	// ApiFlavor Request-body shape the provider speaks ("anthropic", "openai"). Empty when the gateway dispatches it by URL path instead.
-	ApiFlavor string `json:"api_flavor"`
-
-	// CatalogId Catalog entry id naming the provider type.
-	CatalogId string `json:"catalog_id"`
-
-	// Models The effective model allowlist for the caller (or the declared/catalog models when all_models_allowed is true).
-	Models []string `json:"models"`
-
-	// Name Operator-assigned provider label.
-	Name string `json:"name"`
-}
-
-// AgentNetworkMeSetup The caller-scoped Agent Network connection info backing the "My Agent Network" self-service view. Available to every authenticated user; the answer is computed from the caller's own groups and carries display metadata only.
-type AgentNetworkMeSetup struct {
-	// Configured False when the account has no Agent Network set up or the caller's groups authorize none of it. The two cases are deliberately indistinguishable.
-	Configured bool `json:"configured"`
-
-	// Endpoint The account's Agent Network base URL, reachable over the NetBird tunnel only. Empty when configured is false.
-	Endpoint string `json:"endpoint"`
-
-	// Providers The providers at least one of the caller's policies authorizes, in creation order.
-	Providers []AgentNetworkMeProvider `json:"providers"`
-}
-
 // AgentNetworkPolicy defines model for AgentNetworkPolicy.
 type AgentNetworkPolicy struct {
 	// CreatedAt Timestamp when the policy was created.
@@ -2906,7 +2876,7 @@ type EDRFleetDMRequest struct {
 	// LastSyncedInterval The devices last sync requirement interval in hours. Minimum value is 24 hours
 	LastSyncedInterval int `json:"last_synced_interval"`
 
-	// MatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly
+	// MatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open-source version. Premium-only attributes are marked accordingly
 	MatchAttributes FleetDMMatchAttributes `json:"match_attributes"`
 }
 
@@ -2939,7 +2909,7 @@ type EDRFleetDMResponse struct {
 	// LastSyncedInterval The devices last sync requirement interval in hours.
 	LastSyncedInterval int `json:"last_synced_interval"`
 
-	// MatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly
+	// MatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open-source version. Premium-only attributes are marked accordingly
 	MatchAttributes FleetDMMatchAttributes `json:"match_attributes"`
 
 	// UpdatedAt Timestamp of when the integration was last updated.
@@ -3159,7 +3129,7 @@ type Event struct {
 // EventActivityCode The string code of the activity that occurred during the event
 type EventActivityCode string
 
-// FleetDMMatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open source version. Premium-only attributes are marked accordingly
+// FleetDMMatchAttributes Attribute conditions to match when approving FleetDM hosts. Most attributes work with FleetDM's free/open-source version. Premium-only attributes are marked accordingly
 type FleetDMMatchAttributes struct {
 	// DiskEncryptionEnabled Whether disk encryption (FileVault/BitLocker) must be enabled on the host
 	DiskEncryptionEnabled *bool `json:"disk_encryption_enabled,omitempty"`