Merge branch 'main' into add-atomic-cache-ops

Split the memory and Redis cache implementations into separate files and
provide backend-native atomic set-if-absent support.

.github/workflows/agent-network-e2e.yml

@@ -51,9 +51,6 @@ jobs:
           # token (and URL, for gateways) is unset, so partial coverage is fine.
           OPENAI_TOKEN: ${{ secrets.E2E_OPENAI_TOKEN }}
           ANTHROPIC_TOKEN: ${{ secrets.E2E_ANTHROPIC_TOKEN }}
-          # Moonshot AI platform key (platform.kimi.ai); drives both Kimi wire
-          # shapes (OpenAI /v1 and Anthropic /anthropic) through kimi_api.
-          KIMI_TOKEN: ${{ secrets.E2E_KIMI_TOKEN }}
           VERCEL_URL: ${{ secrets.E2E_VERCEL_URL }}
           VERCEL_TOKEN: ${{ secrets.E2E_VERCEL_TOKEN }}
           OPENROUTER_URL: ${{ secrets.E2E_OPENROUTER_URL }}

client/iface/iface_test.go

@@ -464,8 +464,6 @@ func Test_RemovePeer(t *testing.T) {
 }
 
 func Test_ConnectPeers(t *testing.T) {
-	t.Setenv("NB_DISABLE_EBPF_WG_PROXY", "true")
-
 	peer1ifaceName := fmt.Sprintf("utun%d", WgIntNumber+400)
 	peer1wgIP := netip.MustParsePrefix("10.99.99.17/30")
 	peer1Key, _ := wgtypes.GeneratePrivateKey()
@@ -507,8 +505,12 @@ func Test_ConnectPeers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	localIP1 := "127.0.0.1"
-	peer1endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP1, peer1wgPort))
+	localIP, err := getLocalIP()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	peer1endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP, peer1wgPort))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -544,8 +546,7 @@ func Test_ConnectPeers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	localIP2 := "127.0.0.1"
-	peer2endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP2, peer2wgPort))
+	peer2endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP, peer2wgPort))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -568,17 +569,17 @@ func Test_ConnectPeers(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	// The peers use userspace WireGuard (stdnet transport). A tight busy-loop
-	// here starves the wireguard-go goroutines that process the handshake, so
-	// poll on a ticker instead and yield the CPU between checks. WireGuard also
-	// only retries a lost handshake initiation every REKEY_TIMEOUT (5s), which
-	// is why the overall wait can occasionally stretch to tens of seconds.
+	// todo: investigate why in some tests execution we need 30s
 	timeout := 30 * time.Second
 	timeoutChannel := time.After(timeout)
-	ticker := time.NewTicker(500 * time.Millisecond)
-	defer ticker.Stop()
 
 	for {
+		select {
+		case <-timeoutChannel:
+			t.Fatalf("waiting for peer handshake timeout after %s", timeout.String())
+		default:
+		}
+
 		peer, gpErr := getPeer(peer1ifaceName, peer2Key.PublicKey().String())
 		if gpErr != nil {
 			t.Fatal(gpErr)
@@ -587,12 +588,6 @@ func Test_ConnectPeers(t *testing.T) {
 			t.Log("peers successfully handshake")
 			break
 		}
-
-		select {
-		case <-timeoutChannel:
-			t.Fatalf("waiting for peer handshake timeout after %s", timeout.String())
-		case <-ticker.C:
-		}
 	}
 
 }
@@ -620,3 +615,28 @@ func getPeer(ifaceName, peerPubKey string) (wgtypes.Peer, error) {
 	}
 	return wgtypes.Peer{}, fmt.Errorf("peer not found")
 }
+
+func getLocalIP() (string, error) {
+	// Get all interfaces
+	addrs, err := net.InterfaceAddrs()
+	if err != nil {
+		return "", err
+	}
+
+	for _, addr := range addrs {
+		ipNet, ok := addr.(*net.IPNet)
+		if !ok {
+			continue
+		}
+		if ipNet.IP.IsLoopback() {
+			continue
+		}
+
+		if ipNet.IP.To4() == nil {
+			continue
+		}
+		return ipNet.IP.String(), nil
+	}
+
+	return "", fmt.Errorf("no local IP found")
+}

client/internal/conn_mgr.go

@@ -49,21 +49,11 @@ type ConnMgr struct {
 	// engine.syncMsgMux; all other reads stay under engine.syncMsgMux only.
 	lazyConnMgrMu sync.RWMutex
 
-	// reconcileRoutedIPs re-applies a peer's routed allowed IPs after its lazy wake endpoint is
-	// (re)armed (Mode A at arm time). Injected by the engine; nil disables the reconcile.
-	reconcileRoutedIPs func(peerKey string) error
-
 	wg            sync.WaitGroup
 	lazyCtx       context.Context
 	lazyCtxCancel context.CancelFunc
 }
 
-// SetRoutedIPsReconciler injects the callback used to re-apply a peer's routed allowed IPs when
-// its lazy wake endpoint is (re)armed. Must be called before the lazy manager starts.
-func (e *ConnMgr) SetRoutedIPsReconciler(fn func(peerKey string) error) {
-	e.reconcileRoutedIPs = fn
-}
-
 func NewConnMgr(engineConfig *EngineConfig, statusRecorder *peer.Status, peerStore *peerstore.Store, iface lazyconn.WGIface) *ConnMgr {
 	e := &ConnMgr{
 		peerStore:        peerStore,
@@ -301,7 +291,6 @@ func (e *ConnMgr) Close() {
 func (e *ConnMgr) initLazyManager(engineCtx context.Context) {
 	cfg := manager.Config{
 		InactivityThreshold: inactivityThresholdEnv(),
-		ReconcileAllowedIPs: e.reconcileRoutedIPs,
 	}
 
 	e.lazyConnMgrMu.Lock()

client/internal/ebpf/ebpf/src/dns_fwd.c

@@ -52,14 +52,11 @@ int xdp_dns_fwd(struct iphdr  *ip, struct udphdr *udp) {
 
     if (udp->dest == GENERAL_DNS_PORT && ip->daddr == dns_ip) {
         udp->dest = dns_port;
-        // Clear the now-stale checksum; zero means "not computed" for IPv4.
-        udp->check = 0;
         return XDP_PASS;
     }
 
     if (udp->source == dns_port && ip->saddr == dns_ip) {
         udp->source = GENERAL_DNS_PORT;
-        udp->check = 0;
         return XDP_PASS;
     }
 

client/internal/ebpf/ebpf/src/wg_proxy.c

@@ -50,11 +50,5 @@ int xdp_wg_proxy(struct iphdr  *ip, struct udphdr *udp) {
     __be16 new_dst_port = htons(proxy_port);
     udp->dest = new_dst_port;
     udp->source = new_src_port;
-
-    // The ports are covered by the UDP checksum. This is an IPv4 loopback hop
-    // and the payload is already integrity-protected, so clear the checksum (a
-    // zero UDP checksum means "not computed" for IPv4) rather than leave a
-    // stale value the kernel would drop as UDP_CSUM.
-    udp->check = 0;
 	return XDP_PASS;
 }

client/internal/engine.go

@@ -663,12 +663,6 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	iceCfg := e.createICEConfig()
 
 	e.connMgr = NewConnMgr(e.config, e.statusRecorder, e.peerStore, wgIface)
-	e.connMgr.SetRoutedIPsReconciler(func(peerKey string) error {
-		if e.routeManager == nil {
-			return nil
-		}
-		return e.routeManager.ReconcilePeerAllowedIPs(peerKey)
-	})
 	e.connMgr.Start(e.ctx)
 
 	// Wire DNS-time lazy-connection warm-up now that the connection manager

client/internal/lazyconn/manager/manager.go

@@ -29,11 +29,6 @@ type managedPeer struct {
 
 type Config struct {
 	InactivityThreshold *time.Duration
-	// ReconcileAllowedIPs re-applies a peer's routed allowed IPs after its wake endpoint is
-	// armed. The activity listener creates the wake peer with the overlay /32 only; without the
-	// routed prefixes WireGuard would not steer subnet-bound traffic to the wake endpoint, so an
-	// idle routing peer could never be woken by that traffic. Optional; nil disables the reconcile.
-	ReconcileAllowedIPs func(peerKey string) error
 }
 
 // Manager manages lazy connections
@@ -61,9 +56,6 @@ type Manager struct {
 	peerToHAGroups map[string][]route.HAUniqueID // peer ID -> HA groups they belong to
 	haGroupToPeers map[route.HAUniqueID][]string // HA group -> peer IDs in the group
 	routesMu       sync.RWMutex
-
-	// reconcileAllowedIPs re-applies a peer's routed allowed IPs after its wake endpoint is armed.
-	reconcileAllowedIPs func(peerKey string) error
 }
 
 // NewManager creates a new lazy connection manager
@@ -81,7 +73,6 @@ func NewManager(config Config, engineCtx context.Context, peerStore *peerstore.S
 		activityManager:      activity.NewManager(wgIface),
 		peerToHAGroups:       make(map[string][]route.HAUniqueID),
 		haGroupToPeers:       make(map[route.HAUniqueID][]string),
-		reconcileAllowedIPs:  config.ReconcileAllowedIPs,
 	}
 
 	if wgIface.IsUserspaceBind() {
@@ -210,7 +201,7 @@ func (m *Manager) AddPeer(peerCfg lazyconn.PeerConfig) (bool, error) {
 		return false, nil
 	}
 
-	if err := m.armActivityListener(peerCfg); err != nil {
+	if err := m.activityManager.MonitorPeerActivity(peerCfg); err != nil {
 		return false, err
 	}
 
@@ -297,7 +288,7 @@ func (m *Manager) DeactivatePeer(peerID peerid.ConnID) {
 
 	m.inactivityManager.RemovePeer(mp.peerCfg.PublicKey)
 
-	if err := m.armActivityListener(*mp.peerCfg); err != nil {
+	if err := m.activityManager.MonitorPeerActivity(*mp.peerCfg); err != nil {
 		mp.peerCfg.Log.Errorf("failed to create activity monitor: %v", err)
 		return
 	}
@@ -474,31 +465,6 @@ func (m *Manager) close() {
 }
 
 // shouldDeferIdleForHA checks if peer should stay connected due to HA group requirements
-// armRoutedAllowedIPs re-applies the peer's routed allowed IPs onto its freshly armed wake
-// endpoint. The activity listener creates the wake peer with the overlay /32 only, so without
-// this the routed prefixes would be missing and traffic to a routed subnet could not wake the
-// idle routing peer. It is a no-op when no reconciler is configured.
-// armActivityListener (re)arms the peer's wake endpoint via the activity manager and then
-// re-applies its routed allowed IPs, so traffic to a routed subnet can wake an idle routing
-// peer. The routed prefixes must be re-applied after the wake endpoint exists because the
-// listener creates it with the overlay /32 only.
-func (m *Manager) armActivityListener(peerCfg lazyconn.PeerConfig) error {
-	if err := m.activityManager.MonitorPeerActivity(peerCfg); err != nil {
-		return err
-	}
-	m.armRoutedAllowedIPs(&peerCfg)
-	return nil
-}
-
-func (m *Manager) armRoutedAllowedIPs(peerCfg *lazyconn.PeerConfig) {
-	if m.reconcileAllowedIPs == nil {
-		return
-	}
-	if err := m.reconcileAllowedIPs(peerCfg.PublicKey); err != nil {
-		peerCfg.Log.Errorf("failed to reconcile routed allowed IPs on wake endpoint: %v", err)
-	}
-}
-
 func (m *Manager) shouldDeferIdleForHA(inactivePeers map[string]struct{}, peerID string) bool {
 	m.routesMu.RLock()
 	defer m.routesMu.RUnlock()
@@ -611,7 +577,7 @@ func (m *Manager) onPeerInactivityTimedOut(peerIDs map[string]struct{}) {
 
 		mp.peerCfg.Log.Infof("start activity monitor")
 
-		if err := m.armActivityListener(*mp.peerCfg); err != nil {
+		if err := m.activityManager.MonitorPeerActivity(*mp.peerCfg); err != nil {
 			mp.peerCfg.Log.Errorf("failed to create activity monitor: %v", err)
 			continue
 		}

client/internal/routemanager/manager.go

@@ -61,7 +61,6 @@ type Manager interface {
 	InitialRouteRange() []string
 	SetFirewall(firewall.Manager) error
 	SetDNSForwarderPort(port uint16)
-	ReconcilePeerAllowedIPs(peerKey string) error
 	Stop(stateManager *statemanager.Manager)
 }
 
@@ -233,30 +232,6 @@ func (m *DefaultManager) setupRefCounters(useNoop bool) {
 	)
 }
 
-// ReconcilePeerAllowedIPs re-applies every routed allowed IP currently tracked for the peer
-// onto the WireGuard device. The allowed-IP refcounter only calls its AddFunc (which pushes to
-// the device) on a prefix's 0->1 transition, so a peer whose device entry was rebuilt without a
-// matching refcounter change — e.g. a lazy connection cycling through idle->wake, which recreates
-// the WireGuard peer with the overlay /32 only — ends up missing routed prefixes the refcounter
-// still considers installed, and nothing retries. Calling this when the peer's WireGuard entry is
-// (re)created restores convergence. It is add-only and idempotent: AddAllowedIP is update-only, so
-// prefixes are re-added to an existing peer and an absent peer is left untouched.
-func (m *DefaultManager) ReconcilePeerAllowedIPs(peerKey string) error {
-	if m.allowedIPsRefCounter == nil {
-		return nil
-	}
-
-	return m.allowedIPsRefCounter.ReapplyMatching(
-		func(out string) bool { return out == peerKey },
-		func(prefix netip.Prefix) error {
-			if err := m.wgInterface.AddAllowedIP(peerKey, prefix); err != nil {
-				return fmt.Errorf("add allowed IP %s for peer %s: %w", prefix, peerKey, err)
-			}
-			return nil
-		},
-	)
-}
-
 // Init sets up the routing
 func (m *DefaultManager) Init() error {
 	m.routeSelector = m.initSelector()

client/internal/routemanager/mock.go

@@ -112,11 +112,6 @@ func (m *MockManager) SetFirewall(firewall.Manager) error {
 func (m *MockManager) SetDNSForwarderPort(port uint16) {
 }
 
-// ReconcilePeerAllowedIPs mock implementation of ReconcilePeerAllowedIPs from Manager interface
-func (m *MockManager) ReconcilePeerAllowedIPs(peerKey string) error {
-	return nil
-}
-
 // Stop mock implementation of Stop from Manager interface
 func (m *MockManager) Stop(stateManager *statemanager.Manager) {
 	if m.StopFunc != nil {

client/internal/routemanager/reconcile_test.go

@@ -1,90 +0,0 @@
-//go:build !windows
-
-package routemanager
-
-import (
-	"net"
-	"net/netip"
-	"sync"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/tun/netstack"
-
-	"github.com/netbirdio/netbird/client/iface/device"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-	"github.com/netbirdio/netbird/client/internal/routemanager/refcounter"
-)
-
-// reconcileWGMock is a minimal iface.WGIface that only records AddAllowedIP calls; every other
-// method is an inert stub because ReconcilePeerAllowedIPs exercises none of them.
-type reconcileWGMock struct {
-	mu   sync.Mutex
-	adds map[string][]netip.Prefix
-}
-
-func (m *reconcileWGMock) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	if m.adds == nil {
-		m.adds = map[string][]netip.Prefix{}
-	}
-	m.adds[peerKey] = append(m.adds[peerKey], allowedIP)
-	return nil
-}
-
-func (m *reconcileWGMock) added(peerKey string) []netip.Prefix {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	return m.adds[peerKey]
-}
-
-func (m *reconcileWGMock) RemoveAllowedIP(string, netip.Prefix) error { return nil }
-func (m *reconcileWGMock) Name() string                               { return "utun-test" }
-func (m *reconcileWGMock) Address() wgaddr.Address                    { return wgaddr.Address{} }
-func (m *reconcileWGMock) ToInterface() *net.Interface                { return nil }
-func (m *reconcileWGMock) IsUserspaceBind() bool                      { return false }
-func (m *reconcileWGMock) GetFilter() device.PacketFilter             { return nil }
-func (m *reconcileWGMock) GetDevice() *device.FilteredDevice          { return nil }
-func (m *reconcileWGMock) GetNet() *netstack.Net                      { return nil }
-
-// TestReconcilePeerAllowedIPs verifies the declarative reconcile re-applies every routed prefix
-// tracked for the peer (self-heal, independent of refcount level) and stays scoped to that peer.
-func TestReconcilePeerAllowedIPs(t *testing.T) {
-	wg := &reconcileWGMock{}
-	m := &DefaultManager{wgInterface: wg}
-	m.allowedIPsRefCounter = refcounter.New[netip.Prefix, string, string](
-		func(_ netip.Prefix, peerKey string) (string, error) { return peerKey, nil },
-		func(netip.Prefix, string) error { return nil },
-	)
-
-	peerA1 := netip.MustParsePrefix("10.0.0.0/24")
-	peerA2 := netip.MustParsePrefix("10.1.0.0/24")
-	peerB1 := netip.MustParsePrefix("10.2.0.0/24")
-
-	for prefix, peer := range map[netip.Prefix]string{peerA1: "peerA", peerA2: "peerA", peerB1: "peerB"} {
-		_, err := m.allowedIPsRefCounter.Increment(prefix, peer)
-		require.NoError(t, err)
-	}
-	// Extra reference: reconcile must still re-apply the prefix even though its refcount never
-	// hit 0 again (the exact case the plain incremental path skips).
-	_, err := m.allowedIPsRefCounter.Increment(peerA1, "peerA")
-	require.NoError(t, err)
-
-	require.NoError(t, m.ReconcilePeerAllowedIPs("peerA"))
-
-	assert.ElementsMatch(t, []netip.Prefix{peerA1, peerA2}, wg.added("peerA"),
-		"reconcile must re-apply all routed prefixes of the peer")
-	assert.Empty(t, wg.added("peerB"), "reconcile must not touch another peer's prefixes")
-}
-
-// TestReconcilePeerAllowedIPsNoCounter verifies reconcile is a safe no-op before the refcounter is
-// set up.
-func TestReconcilePeerAllowedIPsNoCounter(t *testing.T) {
-	wg := &reconcileWGMock{}
-	m := &DefaultManager{wgInterface: wg}
-
-	require.NoError(t, m.ReconcilePeerAllowedIPs("peerA"))
-	assert.Empty(t, wg.added("peerA"))
-}

client/internal/routemanager/refcounter/refcounter.go

@@ -94,26 +94,6 @@ func (rm *Counter[Key, I, O]) Get(key Key) (Ref[O], bool) {
 	return ref, ok
 }
 
-// ReapplyMatching calls apply for every key whose stored Out satisfies pred, holding the
-// counter lock for the whole pass. Running apply under the lock keeps it atomic with respect
-// to Increment/Decrement: a prefix dropped to zero is removed from the map (and had its
-// RemoveFunc called) before this pass observes it, so a stale key can never be re-applied.
-// pred and apply are invoked under the lock, so they must not call back into the counter.
-func (rm *Counter[Key, I, O]) ReapplyMatching(pred func(out O) bool, apply func(key Key) error) error {
-	rm.mu.Lock()
-	defer rm.mu.Unlock()
-
-	var merr *multierror.Error
-	for key, ref := range rm.refCountMap {
-		if pred(ref.Out) {
-			if err := apply(key); err != nil {
-				merr = multierror.Append(merr, err)
-			}
-		}
-	}
-	return nberrors.FormatErrorOrNil(merr)
-}
-
 // Increment increments the reference count for the given key.
 // If this is the first reference to the key, the AddFunc is called.
 func (rm *Counter[Key, I, O]) Increment(key Key, in I) (Ref[O], error) {

client/internal/routemanager/refcounter/refcounter_test.go

@@ -1,47 +0,0 @@
-package refcounter
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestReapplyMatching verifies ReapplyMatching invokes apply for exactly the keys whose stored
-// Out satisfies the predicate (no duplicates for multiply-referenced keys) — the primitive
-// ReconcilePeerAllowedIPs relies on to re-apply a single peer's routed prefixes.
-func TestReapplyMatching(t *testing.T) {
-	rc := New[netip.Prefix, string, string](
-		func(_ netip.Prefix, peerKey string) (string, error) { return peerKey, nil },
-		func(netip.Prefix, string) error { return nil },
-	)
-
-	peerA1 := netip.MustParsePrefix("10.0.0.0/24")
-	peerA2 := netip.MustParsePrefix("10.1.0.0/24")
-	peerB1 := netip.MustParsePrefix("10.2.0.0/24")
-
-	for prefix, peer := range map[netip.Prefix]string{peerA1: "peerA", peerA2: "peerA", peerB1: "peerB"} {
-		_, err := rc.Increment(prefix, peer)
-		require.NoError(t, err)
-	}
-	// a second reference must not make the key applied twice
-	_, err := rc.Increment(peerA1, "peerA")
-	require.NoError(t, err)
-
-	var applied []netip.Prefix
-	err = rc.ReapplyMatching(
-		func(out string) bool { return out == "peerA" },
-		func(key netip.Prefix) error { applied = append(applied, key); return nil },
-	)
-	require.NoError(t, err)
-	assert.ElementsMatch(t, []netip.Prefix{peerA1, peerA2}, applied)
-
-	var none []netip.Prefix
-	err = rc.ReapplyMatching(
-		func(out string) bool { return out == "missing" },
-		func(key netip.Prefix) error { none = append(none, key); return nil },
-	)
-	require.NoError(t, err)
-	assert.Empty(t, none)
-}

e2e/agentnetwork/chat_test.go

@@ -20,15 +20,14 @@ import (
 // covers whatever credentials are present (source ~/.llm-keys locally / set the
 // Actions secrets in CI).
 type providerCase struct {
-	name       string
-	catalogID  string
-	upstream   string
-	apiKey     string
-	model      string // body model (chat/messages) or path model@version (vertex)
-	kind       string // harness.WireChat, harness.WireMessages, or harness.WireVertex
-	project    string // vertex only: GCP project for the rawPredict path
-	region     string // vertex only: GCP region for the rawPredict path
-	pathPrefix string // base-URL path prefix the agent carries (e.g. "/anthropic" for Kimi)
+	name      string
+	catalogID string
+	upstream  string
+	apiKey    string
+	model     string // body model (chat/messages) or path model@version (vertex)
+	kind      string // harness.WireChat, harness.WireMessages, or harness.WireVertex
+	project   string // vertex only: GCP project for the rawPredict path
+	region    string // vertex only: GCP region for the rawPredict path
 }
 
 // availableProviders builds the matrix from the provider env vars that are set.
@@ -40,24 +39,6 @@ func availableProviders() []providerCase {
 	if k := os.Getenv("ANTHROPIC_TOKEN"); k != "" {
 		ps = append(ps, providerCase{name: "anthropic", catalogID: "anthropic_api", upstream: "https://api.anthropic.com", apiKey: k, model: "claude-haiku-4-5", kind: harness.WireMessages})
 	}
-	if k := os.Getenv("KIMI_TOKEN"); k != "" {
-		// Kimi (Moonshot AI) serves two body shapes from the same key: OpenAI
-		// Chat Completions on the bare host (/v1/...) and the Anthropic
-		// Messages API under the /anthropic path prefix (the endpoint
-		// Moonshot's Claude Code guide uses). The provider keeps the bare
-		// default upstream and the AGENT carries the /anthropic prefix in
-		// its base URL — exactly the documented Claude Code / Kimi CLI
-		// setup (ANTHROPIC_BASE_URL=https://<endpoint>/anthropic) — so one
-		// provider serves both shapes and the prefix rides through to
-		// Moonshot. Run the Anthropic shape, the flagship Claude Code path;
-		// the OpenAI wire shape is covered live by the other chat-shaped
-		// matrix providers, and Kimi-over-chat passed with kimi-k3 before
-		// the single-model constraint surfaced (run #73 on the kimi feature
-		// branch). The platform serves this account exactly ONE model —
-		// kimi-k3 (kimi-k2-thinking and even kimi-latest return
-		// resource_not_found_error on both surfaces).
-		ps = append(ps, providerCase{name: "kimi", catalogID: "kimi_api", upstream: "https://api.moonshot.ai", apiKey: k, model: "kimi-k3", kind: harness.WireMessages, pathPrefix: "/anthropic"})
-	}
 	if k, u := os.Getenv("VERCEL_TOKEN"), os.Getenv("VERCEL_URL"); k != "" && u != "" {
 		ps = append(ps, providerCase{name: "vercel", catalogID: "vercel_ai_gateway", upstream: u, apiKey: k, model: "openai/gpt-4o-mini", kind: harness.WireChat})
 	}
@@ -103,18 +84,12 @@ func availableProviders() []providerCase {
 		}
 	}
 
-	// Bedrock: path-routed, bearer auth. Model is the FULL cross-region
-	// inference-profile id exactly as AWS issues it — region-family prefix
-	// plus the date/version suffix. A bare or wrong-region id makes Bedrock
-	// reject the request with "The provided model identifier is invalid"
-	// before any inference runs. The proxy normalizes this id to the catalog
-	// key (anthropic.claude-haiku-4-5) for routing/pricing/allowlists.
-	// Defaults pair eu-central-1 with the eu.* profile; AWS_REGION overrides
-	// the region and the prefix follows its family.
+	// Bedrock: path-routed, bearer auth. Model is a cross-region inference
+	// profile id (distinct string from the first-party Anthropic case).
 	if k := os.Getenv("AWS_BEARER_TOKEN_BEDROCK"); k != "" {
 		region := os.Getenv("AWS_REGION")
 		if region == "" {
-			region = "eu-central-1"
+			region = "us-east-1"
 		}
 		// A valid Bedrock inference-profile id (region prefix + date + version),
 		// overridable per account. `global.` profiles can be invoked from any
@@ -241,7 +216,8 @@ func TestProvidersMatrix(t *testing.T) {
 	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
 
 	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
-	// Probe first: the GET resolves the endpoint (DNS error fails) and its first packet wakes the lazy proxy peer, so WaitProxyPeer sees it connected; any HTTP status counts.
+	// Resolve first: the DNS lookup triggers the lazy-connection warm-up, waking
+	// the proxy peer so WaitProxyPeer then observes it connected.
 	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
 	require.NoError(t, err, "resolve agent-network endpoint to proxy IP")
 	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
@@ -271,7 +247,7 @@ func TestProvidersMatrix(t *testing.T) {
 				case harness.WireBedrock:
 					c, b, cerr = cl.Bedrock(ctx, settings.Endpoint, proxyIP, pc.model, "Reply with exactly: pong", sessionID)
 				default:
-					c, b, cerr = cl.ChatPrefixed(ctx, settings.Endpoint, proxyIP, pc.pathPrefix, pc.kind, pc.model, "Reply with exactly: pong", sessionID)
+					c, b, cerr = cl.Chat(ctx, settings.Endpoint, proxyIP, pc.kind, pc.model, "Reply with exactly: pong", sessionID)
 				}
 				if cerr == nil {
 					code, body = c, b

e2e/agentnetwork/guardrail_test.go

@@ -52,9 +52,7 @@ func catalogModel(pc providerCase) string {
 func disallowedModel(pc providerCase) string {
 	switch pc.kind {
 	case harness.WireBedrock:
-		// Same profile prefix as the allowed model so only the model name
-		// differs; the guardrail must deny it before it reaches AWS.
-		return strings.SplitN(pc.model, ".", 2)[0] + ".anthropic.claude-opus-4-8"
+		return "us.anthropic.claude-opus-4-8"
 	case harness.WireVertex:
 		return "claude-opus-4-8@20250101"
 	default:
@@ -74,7 +72,7 @@ func sendModel(ctx context.Context, t *testing.T, cl *harness.Client, endpoint,
 	case harness.WireVertex:
 		code, _, err = cl.Vertex(ctx, endpoint, proxyIP, pc.project, pc.region, model, "Reply with exactly: pong", "")
 	default:
-		code, _, err = cl.ChatPrefixed(ctx, endpoint, proxyIP, pc.pathPrefix, pc.kind, model, "Reply with exactly: pong", "")
+		code, _, err = cl.Chat(ctx, endpoint, proxyIP, pc.kind, model, "Reply with exactly: pong", "")
 	}
 	require.NoError(t, err, "request must reach the proxy for %s", pc.name)
 	return code
@@ -166,7 +164,8 @@ func TestModelAllowlistEnforced(t *testing.T) {
 	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
 
 	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
-	// Probe first: the GET resolves the endpoint (DNS error fails) and its first packet wakes the lazy proxy peer, so WaitProxyPeer sees it connected; any HTTP status counts.
+	// Resolve first: the DNS lookup triggers the lazy-connection warm-up, waking
+	// the proxy peer so WaitProxyPeer then observes it connected.
 	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
 	require.NoError(t, err, "resolve agent-network endpoint to proxy IP")
 	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {

e2e/agentnetwork/skiptls_test.go

@@ -104,7 +104,8 @@ func TestProviderSkipTLSVerification(t *testing.T) {
 	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
 
 	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
-	// Probe first: the GET resolves the endpoint (DNS error fails) and its first packet wakes the lazy proxy peer, so WaitProxyPeer sees it connected; any HTTP status counts.
+	// Resolve first: the DNS lookup triggers the lazy-connection warm-up, waking
+	// the proxy peer so WaitProxyPeer then observes it connected.
 	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
 	require.NoError(t, err, "resolve endpoint to proxy IP")
 	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {

e2e/agentnetwork/vllm_test.go

@@ -106,7 +106,8 @@ func TestVLLMProvider(t *testing.T) {
 	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
 
 	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
-	// Probe first: the GET resolves the endpoint (DNS error fails) and its first packet wakes the lazy proxy peer, so WaitProxyPeer sees it connected; any HTTP status counts.
+	// Resolve first: the DNS lookup triggers the lazy-connection warm-up, waking
+	// the proxy peer so WaitProxyPeer then observes it connected.
 	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
 	require.NoError(t, err, "resolve endpoint to proxy IP")
 	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {

e2e/harness/client.go

@@ -4,7 +4,6 @@ package harness
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"io"
 	"os/exec"
@@ -168,54 +167,22 @@ func (cl *Client) pollStatus(ctx context.Context, timeout time.Duration, want st
 	return fmt.Errorf("timed out waiting for %q; last status:\n%s", want, last)
 }
 
-const (
-	// curlExitCouldNotResolve is curl's exit code for a DNS resolution failure, distinct from connection-level failures.
-	curlExitCouldNotResolve = 6
-	// dnsProbeRetryWindow bounds DNS-failure retries: the synthesized zone lands a beat after management connects, so early NXDOMAIN is propagation; a zone still absent after this window is a real failure.
-	dnsProbeRetryWindow   = 30 * time.Second
-	dnsProbeRetryInterval = 2 * time.Second
-)
-
-// ResolveProxyIP GETs https://<endpoint>/ from the client's netns: any HTTP status proves DNS + tunnel and wakes the lazy proxy peer; only DNS failures retry, within dnsProbeRetryWindow. Returns the connected IP for --resolve pinning.
+// ResolveProxyIP resolves the agent-network endpoint to the proxy peer's
+// NetBird IP from inside the client (via magic DNS).
 func (cl *Client) ResolveProxyIP(ctx context.Context, endpoint string) (string, error) {
-	args := []string{
-		"run", "--rm",
-		"--network", "container:" + cl.container.GetContainerID(),
-		curlImage,
-		"-ksS", "-o", "/dev/null",
-		"--connect-timeout", "30", "--max-time", "60",
-		"-w", "%{remote_ip}",
-		"https://" + endpoint + "/",
+	code, reader, err := cl.container.Exec(ctx, []string{"getent", "hosts", endpoint}, tcexec.Multiplexed())
+	if err != nil {
+		return "", err
 	}
-	deadline := time.Now().Add(dnsProbeRetryWindow)
-	for {
-		cmd := exec.CommandContext(ctx, "docker", args...)
-		var stdout, stderr strings.Builder
-		cmd.Stdout = &stdout
-		cmd.Stderr = &stderr
-		err := cmd.Run()
-		if err == nil {
-			ip := strings.TrimSpace(stdout.String())
-			if ip == "" {
-				return "", fmt.Errorf("got an HTTP response from %s but no remote IP", endpoint)
-			}
-			return ip, nil
-		}
-
-		var exitErr *exec.ExitError
-		if !errors.As(err, &exitErr) || exitErr.ExitCode() != curlExitCouldNotResolve {
-			return "", fmt.Errorf("no HTTP response from %s: %w (%s)", endpoint, err, strings.TrimSpace(stderr.String()))
-		}
-		dnsErr := fmt.Errorf("DNS resolution failed for %s: %s", endpoint, strings.TrimSpace(stderr.String()))
-		if time.Until(deadline) < dnsProbeRetryInterval {
-			return "", dnsErr
-		}
-		select {
-		case <-ctx.Done():
-			return "", fmt.Errorf("%w (%w)", dnsErr, ctx.Err())
-		case <-time.After(dnsProbeRetryInterval):
-		}
+	out, _ := io.ReadAll(reader)
+	if code != 0 {
+		return "", fmt.Errorf("getent hosts %s exited %d", endpoint, code)
 	}
+	fields := strings.Fields(string(out))
+	if len(fields) == 0 {
+		return "", fmt.Errorf("no address for %s", endpoint)
+	}
+	return fields[0], nil
 }
 
 // Wire shapes for Chat.
@@ -239,17 +206,6 @@ const (
 // the wire shape: WireChat (OpenAI) or WireMessages (Anthropic). A non-empty
 // sessionID is sent as the universal x-session-id header the proxy records.
 func (cl *Client) Chat(ctx context.Context, endpoint, proxyIP, kind, model, prompt, sessionID string) (int, string, error) {
-	return cl.ChatPrefixed(ctx, endpoint, proxyIP, "", kind, model, prompt, sessionID)
-}
-
-// ChatPrefixed is Chat with a base-URL path prefix prepended to the wire
-// path, mirroring agents whose base URL carries a shape-selecting prefix that
-// rides through to the upstream — e.g. Claude Code against a Kimi provider
-// sets ANTHROPIC_BASE_URL=https://<endpoint>/anthropic so the proxy forwards
-// /anthropic/v1/messages to Moonshot's Anthropic surface while the provider's
-// upstream URL stays the bare https://api.moonshot.ai. Empty prefix is plain
-// Chat.
-func (cl *Client) ChatPrefixed(ctx context.Context, endpoint, proxyIP, pathPrefix, kind, model, prompt, sessionID string) (int, string, error) {
 	var path, body string
 	var headers []string
 	switch kind {
@@ -261,7 +217,7 @@ func (cl *Client) ChatPrefixed(ctx context.Context, endpoint, proxyIP, pathPrefi
 		path = "/v1/chat/completions"
 		body = fmt.Sprintf(`{"model":%q,"messages":[{"role":"user","content":%q}]}`, model, prompt)
 	}
-	return cl.post(ctx, endpoint, proxyIP, pathPrefix+path, body, withSessionID(headers, sessionID))
+	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(headers, sessionID))
 }
 
 // Vertex issues an Anthropic-on-Vertex rawPredict POST over the tunnel. Unlike

infrastructure_files/getting-started-enterprise.sh

@@ -234,6 +234,9 @@ init_environment() {
 
   NETBIRD_LICENSE_KEY=$(read_secret "Enter license key (input hidden)")
 
+  GHCR_USERNAME="netbirdExtAccess1"
+  GHCR_TOKEN=$(read_secret "Enter GHCR token (input hidden)")
+
   POSTGRES_USER="netbird"
   POSTGRES_DB="netbird"
   POSTGRES_PASSWORD=$(rand_secret)
@@ -260,6 +263,10 @@ init_environment() {
   install -m 600 /dev/null config.yaml
   render_config_yaml >> config.yaml
 
+  echo "Logging in to ghcr.io ..."
+  printf '%s' "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_USERNAME" --password-stdin
+  unset GHCR_TOKEN
+
   echo ""
   echo "Pulling images ..."
   $DOCKER_COMPOSE_COMMAND pull

infrastructure_files/migrate-to-enterprise.sh

@@ -490,6 +490,8 @@ init_migration() {
   echo ""
   echo "Step 1: Image swap (community → Enterprise). License key required."
   NB_LICENSE_KEY=$(read_secret "  License key")
+  GHCR_USERNAME="netbirdExtAccess1"
+  GHCR_TOKEN=$(read_secret "  GHCR token (input hidden)")
 
   # Step 2 — optional
   echo ""
@@ -586,6 +588,11 @@ apply_changes() {
     fi
   } >> "$ENV_FILE"
 
+  echo ""
+  echo "Logging in to ghcr.io ..."
+  printf '%s' "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_USERNAME" --password-stdin
+  unset GHCR_TOKEN
+
   echo ""
   echo "Pulling enterprise images ..."
   $DOCKER_COMPOSE_COMMAND pull

management/internals/modules/agentnetwork/catalog/catalog.go

@@ -420,47 +420,6 @@ var providers = []Provider{
 			{ID: "mistral-embed", Label: "Mistral Embed", InputPer1k: 0.0001, OutputPer1k: 0, ContextWindow: 8192},
 		},
 	},
-	{
-		ID:                 "kimi_api",
-		Kind:               KindProvider,
-		Name:               "Kimi (Moonshot AI) API",
-		Description:        "Kimi K3 / K2 models via the Moonshot AI platform",
-		DefaultHost:        "api.moonshot.ai",
-		AuthHeaderName:     "Authorization",
-		AuthHeaderTemplate: "Bearer ${API_KEY}",
-		DefaultContentType: "application/json",
-		BrandColor:         "#1A1A2E",
-		// ParserID empty on purpose: Moonshot serves two body shapes on
-		// the same host and key, and the proxy's URL sniffer dispatches
-		// both (same pattern as Bifrost). /v1/chat/completions matches
-		// OpenAIParser; the Anthropic-compatible endpoint the official
-		// Claude Code guide uses (/anthropic/v1/messages) contains
-		// "/v1/messages" and matches AnthropicParser. Pinning "openai"
-		// here would misparse the Claude Code path — the primary way
-		// teams consume Kimi for coding today. Both endpoints accept the
-		// same Moonshot key via Authorization: Bearer (Claude Code's
-		// ANTHROPIC_AUTH_TOKEN rides that header too).
-		//
-		// api.moonshot.ai is the international platform; mainland-China
-		// accounts live on api.moonshot.cn with separate billing —
-		// operators there override the host on the provider record. The
-		// kimi.com subscription coding endpoint (api.kimi.com/coding,
-		// model id "k3") is account-bound seat licensing rather than a
-		// meterable platform key, so it's deliberately not the default.
-		ParserID: "",
-		// Pricing per Moonshot's platform rates at K3 launch (July 2026):
-		// $3/$15 per MTok with $0.30 cached input, flat across the 1M-token
-		// window. kimi-k3 is the ONLY model the platform serves newer
-		// accounts — K2-era ids (kimi-k2-thinking) and even the kimi-latest
-		// alias return resource_not_found_error, verified live 2026-07-21 —
-		// so it's the only catalog entry. Grandfathered accounts with K2
-		// access can still type those ids on the provider's model rows.
-		// The consumer app's "K3 Swarm Max" mode is not an API SKU, so it
-		// doesn't appear here.
-		Models: []Model{
-			{ID: "kimi-k3", Label: "Kimi K3", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 1000000},
-		},
-	},
 	{
 		ID:                 "litellm_proxy",
 		Kind:               KindGateway,

management/internals/modules/agentnetwork/policyselect_model_test.go

@@ -1,336 +0,0 @@
-package agentnetwork
-
-import (
-	"context"
-	"errors"
-	"testing"
-	"time"
-
-	"github.com/golang/mock/gomock"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/server/store"
-)
-
-// guardedPolicy builds an enabled, uncapped policy that authorises sourceGroups
-// to reach providerID under the given guardrails. Uncapped keeps the selector's
-// headroom scoring trivial so these tests isolate the model-allowlist gate.
-func guardedPolicy(id, account string, sourceGroups []string, providerID string, guardrailIDs ...string) *types.Policy {
-	return &types.Policy{
-		ID:                     id,
-		AccountID:              account,
-		Enabled:                true,
-		SourceGroups:           sourceGroups,
-		DestinationProviderIDs: []string{providerID},
-		GuardrailIDs:           guardrailIDs,
-		CreatedAt:              time.Now().UTC(),
-	}
-}
-
-// allowlistGuardrail builds a guardrail whose model allowlist is enabled and
-// carries the given models.
-func allowlistGuardrail(id, account string, models ...string) *types.Guardrail {
-	return &types.Guardrail{
-		ID:        id,
-		AccountID: account,
-		Checks: types.GuardrailChecks{
-			ModelAllowlist: types.GuardrailModelAllowlist{Enabled: true, Models: models},
-		},
-	}
-}
-
-func expectPolicies(mockStore *store.MockStore, account string, policies ...*types.Policy) {
-	mockStore.EXPECT().
-		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), account).
-		Return(policies, nil)
-}
-
-func expectGuardrails(mockStore *store.MockStore, account string, guardrails ...*types.Guardrail) {
-	mockStore.EXPECT().
-		GetAccountAgentNetworkGuardrails(gomock.Any(), gomock.Any(), account).
-		Return(guardrails, nil)
-}
-
-// TestSelectPolicy_ModelBlockedByAllowlist proves the authoritative allowlist
-// decision: a policy authorises the (provider, group) but restricts the model,
-// and the requested model isn't on the list, so the request is denied.
-func TestSelectPolicy_ModelBlockedByAllowlist(t *testing.T) {
-	ctrl := gomock.NewController(t)
-	mgr, mockStore := newSelectorMgr(t, ctrl)
-
-	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
-	expectPolicies(mockStore, "acc-1", policy)
-	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "gpt-4o"))
-
-	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
-		AccountID:  "acc-1",
-		UserID:     "user-1",
-		GroupIDs:   []string{"grp-eng"},
-		ProviderID: "prov-1",
-		Model:      "claude-opus-4",
-	})
-	require.NoError(t, err)
-	assert.False(t, res.Allow, "a model outside the only applicable policy's allowlist must be denied")
-	assert.Equal(t, denyCodeModelBlocked, res.DenyCode, "deny code must be model_blocked")
-	assert.NotEmpty(t, res.DenyReason, "deny reason must be populated")
-}
-
-// TestSelectPolicy_ModelAllowedByAllowlist is the allow counterpart: the model
-// is on the applicable policy's allowlist, so selection proceeds normally.
-func TestSelectPolicy_ModelAllowedByAllowlist(t *testing.T) {
-	ctrl := gomock.NewController(t)
-	mgr, mockStore := newSelectorMgr(t, ctrl)
-
-	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
-	expectPolicies(mockStore, "acc-1", policy)
-	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "gpt-4o", "claude-opus-4"))
-	expectConsumptionBatch(mockStore, nil)
-
-	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
-		AccountID:  "acc-1",
-		UserID:     "user-1",
-		GroupIDs:   []string{"grp-eng"},
-		ProviderID: "prov-1",
-		Model:      "claude-opus-4",
-	})
-	require.NoError(t, err)
-	assert.True(t, res.Allow, "a model on the applicable policy's allowlist must be allowed")
-	assert.Equal(t, "pol-A", res.SelectedPolicyID)
-}
-
-// TestSelectPolicy_CaseInsensitiveModelMatch proves the compare tolerates case
-// and surrounding whitespace, matching the proxy guardrail's normalisation.
-func TestSelectPolicy_CaseInsensitiveModelMatch(t *testing.T) {
-	ctrl := gomock.NewController(t)
-	mgr, mockStore := newSelectorMgr(t, ctrl)
-
-	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
-	expectPolicies(mockStore, "acc-1", policy)
-	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "  GPT-4o  "))
-	expectConsumptionBatch(mockStore, nil)
-
-	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
-		AccountID:  "acc-1",
-		GroupIDs:   []string{"grp-eng"},
-		ProviderID: "prov-1",
-		Model:      "gpt-4o",
-	})
-	require.NoError(t, err)
-	assert.True(t, res.Allow, "case/whitespace variants must match the allowlist entry")
-}
-
-// TestSelectPolicy_UnguardedPolicyIsUnrestricted is the false-deny fix: when two
-// policies authorise the same (provider, group) and one has no guardrail, that
-// policy makes the request unrestricted — not caught by the other's allowlist.
-func TestSelectPolicy_UnguardedPolicyIsUnrestricted(t *testing.T) {
-	ctrl := gomock.NewController(t)
-	mgr, mockStore := newSelectorMgr(t, ctrl)
-
-	restricted := guardedPolicy("pol-restricted", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
-	open := guardedPolicy("pol-open", "acc-1", []string{"grp-eng"}, "prov-1") // no guardrail
-	expectPolicies(mockStore, "acc-1", restricted, open)
-	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "gpt-4o"))
-	expectConsumptionBatch(mockStore, nil)
-
-	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
-		AccountID:  "acc-1",
-		GroupIDs:   []string{"grp-eng"},
-		ProviderID: "prov-1",
-		Model:      "claude-opus-4",
-	})
-	require.NoError(t, err)
-	assert.True(t, res.Allow, "an un-guardrailed policy for the same (provider, group) must leave the request unrestricted")
-	assert.Equal(t, "pol-open", res.SelectedPolicyID, "the unrestricted policy must be the one that pays")
-}
-
-// TestSelectPolicy_AllowlistDoesNotLeakAcrossGroups is the false-allow fix: a
-// model allowlisted only for grp-b must not be usable by a grp-a caller. The
-// selector considers only policies applicable to the caller's groups.
-func TestSelectPolicy_AllowlistDoesNotLeakAcrossGroups(t *testing.T) {
-	ctrl := gomock.NewController(t)
-	mgr, mockStore := newSelectorMgr(t, ctrl)
-
-	polA := guardedPolicy("pol-a", "acc-1", []string{"grp-a"}, "prov-1", "g-a")
-	polB := guardedPolicy("pol-b", "acc-1", []string{"grp-b"}, "prov-1", "g-b")
-	expectPolicies(mockStore, "acc-1", polA, polB)
-	expectGuardrails(mockStore, "acc-1",
-		allowlistGuardrail("g-a", "acc-1", "gpt-4o"),
-		allowlistGuardrail("g-b", "acc-1", "claude-opus-4"),
-	)
-
-	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
-		AccountID:  "acc-1",
-		GroupIDs:   []string{"grp-a"},
-		ProviderID: "prov-1",
-		Model:      "claude-opus-4", // only allowed for grp-b
-	})
-	require.NoError(t, err)
-	assert.False(t, res.Allow, "grp-b's allowlisted model must not leak to a grp-a caller")
-	assert.Equal(t, denyCodeModelBlocked, res.DenyCode)
-}
-
-// TestSelectPolicy_UndeterminedModelFailsClosed proves the fail-closed contract
-// mirrors the proxy: with a restricted applicable policy and an empty model
-// (e.g. a path-routed shape the parser couldn't map), the request is denied.
-func TestSelectPolicy_UndeterminedModelFailsClosed(t *testing.T) {
-	ctrl := gomock.NewController(t)
-	mgr, mockStore := newSelectorMgr(t, ctrl)
-
-	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
-	expectPolicies(mockStore, "acc-1", policy)
-	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "gpt-4o"))
-
-	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
-		AccountID:  "acc-1",
-		GroupIDs:   []string{"grp-eng"},
-		ProviderID: "prov-1",
-		Model:      "", // undetermined
-	})
-	require.NoError(t, err)
-	assert.False(t, res.Allow, "an undetermined model must fail closed against a restricted policy")
-	assert.Equal(t, denyCodeModelBlocked, res.DenyCode)
-}
-
-// TestSelectPolicy_DisabledAllowlistDoesNotRestrict proves a guardrail whose
-// model allowlist is disabled imposes no model restriction, even though the
-// policy references it.
-func TestSelectPolicy_DisabledAllowlistDoesNotRestrict(t *testing.T) {
-	ctrl := gomock.NewController(t)
-	mgr, mockStore := newSelectorMgr(t, ctrl)
-
-	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
-	disabled := &types.Guardrail{
-		ID:        "g-1",
-		AccountID: "acc-1",
-		Checks: types.GuardrailChecks{
-			ModelAllowlist: types.GuardrailModelAllowlist{Enabled: false, Models: []string{"gpt-4o"}},
-		},
-	}
-	expectPolicies(mockStore, "acc-1", policy)
-	expectGuardrails(mockStore, "acc-1", disabled)
-	expectConsumptionBatch(mockStore, nil)
-
-	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
-		AccountID:  "acc-1",
-		GroupIDs:   []string{"grp-eng"},
-		ProviderID: "prov-1",
-		Model:      "anything-goes",
-	})
-	require.NoError(t, err)
-	assert.True(t, res.Allow, "a disabled allowlist must not restrict the model")
-	assert.Equal(t, "pol-A", res.SelectedPolicyID)
-}
-
-// TestSelectPolicy_UnionAcrossPolicyGuardrails proves a policy with multiple
-// allowlist guardrails permits the union of their models (not just the first).
-func TestSelectPolicy_UnionAcrossPolicyGuardrails(t *testing.T) {
-	ctrl := gomock.NewController(t)
-	mgr, mockStore := newSelectorMgr(t, ctrl)
-
-	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1", "g-2")
-	expectPolicies(mockStore, "acc-1", policy)
-	expectGuardrails(mockStore, "acc-1",
-		allowlistGuardrail("g-1", "acc-1", "gpt-4o"),
-		allowlistGuardrail("g-2", "acc-1", "claude-opus-4"),
-	)
-	expectConsumptionBatch(mockStore, nil)
-
-	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
-		AccountID:  "acc-1",
-		GroupIDs:   []string{"grp-eng"},
-		ProviderID: "prov-1",
-		Model:      "claude-opus-4", // only in the second guardrail's list
-	})
-	require.NoError(t, err)
-	assert.True(t, res.Allow, "a model in any of the policy's allowlist guardrails must be permitted")
-	assert.Equal(t, "pol-A", res.SelectedPolicyID)
-}
-
-// TestSelectPolicy_GuardrailLookupErrorPropagates proves a store failure while
-// resolving the candidate policies' guardrails surfaces as an error rather than
-// silently allowing or denying the request.
-func TestSelectPolicy_GuardrailLookupErrorPropagates(t *testing.T) {
-	ctrl := gomock.NewController(t)
-	mgr, mockStore := newSelectorMgr(t, ctrl)
-
-	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
-	expectPolicies(mockStore, "acc-1", policy)
-	mockStore.EXPECT().
-		GetAccountAgentNetworkGuardrails(gomock.Any(), gomock.Any(), "acc-1").
-		Return(nil, errors.New("store unavailable"))
-
-	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
-		AccountID:  "acc-1",
-		GroupIDs:   []string{"grp-eng"},
-		ProviderID: "prov-1",
-		Model:      "gpt-4o",
-	})
-	require.Error(t, err, "a guardrail-lookup failure must surface as an error, not a silent allow/deny")
-	assert.Nil(t, res)
-}
-
-// TestSelectPolicy_MissingGuardrailReferenceTreatedAsUnrestricted proves a
-// policy referencing a guardrail ID absent from the account's guardrails (a
-// stale/orphaned reference) imposes no model restriction on its own — it is
-// treated the same as no guardrail at all rather than failing closed.
-func TestSelectPolicy_MissingGuardrailReferenceTreatedAsUnrestricted(t *testing.T) {
-	ctrl := gomock.NewController(t)
-	mgr, mockStore := newSelectorMgr(t, ctrl)
-
-	// pol-A references "g-missing", which does not exist in the returned
-	// guardrails set.
-	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-missing")
-	expectPolicies(mockStore, "acc-1", policy)
-	expectGuardrails(mockStore, "acc-1")
-	expectConsumptionBatch(mockStore, nil)
-
-	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
-		AccountID:  "acc-1",
-		GroupIDs:   []string{"grp-eng"},
-		ProviderID: "prov-1",
-		Model:      "anything-goes",
-	})
-	require.NoError(t, err)
-	assert.True(t, res.Allow, "an orphaned guardrail reference must not restrict the model")
-	assert.Equal(t, "pol-A", res.SelectedPolicyID)
-}
-
-// TestSelectPolicy_PartialCandidatesPermittedAfterModelFilter proves the
-// model-allowlist gate narrows candidates before cap-based scoring runs: when
-// two policies are otherwise applicable but only one permits the requested
-// model, the permitting policy must be selected even though the other has a
-// larger, more attractive cap.
-func TestSelectPolicy_PartialCandidatesPermittedAfterModelFilter(t *testing.T) {
-	ctrl := gomock.NewController(t)
-	mgr, mockStore := newSelectorMgr(t, ctrl)
-
-	// pol-big has a much larger group token cap and would normally win the
-	// "bigger pool first" tiebreak, but its guardrail blocks the requested model.
-	polBig := guardedPolicy("pol-big", "acc-1", []string{"grp-eng"}, "prov-1", "g-restrict")
-	polBig.Limits = types.PolicyLimits{
-		TokenLimit: types.PolicyTokenLimit{Enabled: true, GroupCap: 1_000_000, WindowSeconds: 3600},
-	}
-	polSmall := guardedPolicy("pol-small", "acc-1", []string{"grp-eng"}, "prov-1", "g-permit")
-	polSmall.Limits = types.PolicyLimits{
-		TokenLimit: types.PolicyTokenLimit{Enabled: true, GroupCap: 100, WindowSeconds: 3600},
-	}
-	expectPolicies(mockStore, "acc-1", polBig, polSmall)
-	expectGuardrails(mockStore, "acc-1",
-		allowlistGuardrail("g-restrict", "acc-1", "gpt-4o"),
-		allowlistGuardrail("g-permit", "acc-1", "claude-opus-4"),
-	)
-	expectConsumptionBatch(mockStore, nil)
-
-	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
-		AccountID:  "acc-1",
-		GroupIDs:   []string{"grp-eng"},
-		ProviderID: "prov-1",
-		Model:      "claude-opus-4", // only pol-small's guardrail permits this
-	})
-	require.NoError(t, err)
-	assert.True(t, res.Allow)
-	assert.Equal(t, "pol-small", res.SelectedPolicyID,
-		"the model filter must exclude pol-big before cap scoring, even though it would otherwise outrank pol-small")
-}

management/internals/server/boot.go

@@ -20,17 +20,15 @@ import (
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/keepalive"
 
-	cachestore "github.com/eko/gocache/lib/v4/store"
-
 	"github.com/netbirdio/netbird/encryption"
 	"github.com/netbirdio/netbird/formatter/hook"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	accesslogsmanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs/manager"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/activity"
 	activitystore "github.com/netbirdio/netbird/management/server/activity/store"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	nbContext "github.com/netbirdio/netbird/management/server/context"
 	nbhttp "github.com/netbirdio/netbird/management/server/http"
@@ -70,8 +68,8 @@ func (s *BaseServer) Metrics() telemetry.AppMetrics {
 
 // CacheStore returns a shared cache store backed by Redis or in-memory depending on the environment.
 // All consumers should reuse this store to avoid creating multiple Redis connections.
-func (s *BaseServer) CacheStore() cachestore.StoreInterface {
-	return Create(s, func() cachestore.StoreInterface {
+func (s *BaseServer) CacheStore() nbcache.Store {
+	return Create(s, func() nbcache.Store {
 		cs, err := nbcache.NewStore(context.Background(), nbcache.DefaultStoreMaxTimeout, nbcache.DefaultStoreCleanupInterval, nbcache.DefaultStoreMaxConn)
 		if err != nil {
 			log.Fatalf("failed to create shared cache store: %v", err)

management/internals/shared/grpc/components_encoder.go

@@ -5,6 +5,9 @@ import (
 	"strconv"
 
 	nbdns "github.com/netbirdio/netbird/dns"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
+	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/types"
 	nbroute "github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/networkmap"
@@ -163,7 +166,7 @@ func (e *componentEncoder) indexAllPeers() {
 	}
 }
 
-func (e *componentEncoder) appendPeer(p *types.ComponentPeer) uint32 {
+func (e *componentEncoder) appendPeer(p *nbpeer.Peer) uint32 {
 	if idx, ok := e.peerOrder[p.ID]; ok {
 		return idx
 	}
@@ -177,7 +180,7 @@ func (e *componentEncoder) appendPeer(p *types.ComponentPeer) uint32 {
 // (c.RouterPeers may contain peers not in c.Peers when validation rules drop
 // them) and returns their wire indexes for the RouterPeerIndexes field. Must
 // run before any encoder that resolves peer ids via e.peerOrder.
-func (e *componentEncoder) indexRouterPeers(routers map[string]*types.ComponentPeer) []uint32 {
+func (e *componentEncoder) indexRouterPeers(routers map[string]*nbpeer.Peer) []uint32 {
 	if len(routers) == 0 {
 		return nil
 	}
@@ -511,7 +514,7 @@ func encodeCustomZones(zones []nbdns.CustomZone) []*proto.CustomZone {
 	return out
 }
 
-func (e *componentEncoder) encodeNetworkResources(resources []*types.ComponentResource) []*proto.NetworkResourceRaw {
+func (e *componentEncoder) encodeNetworkResources(resources []*resourceTypes.NetworkResource) []*proto.NetworkResourceRaw {
 	if len(resources) == 0 {
 		return nil
 	}
@@ -540,7 +543,7 @@ func (e *componentEncoder) encodeNetworkResources(resources []*types.ComponentRe
 	return out
 }
 
-func (e *componentEncoder) encodeRoutersMap(routersMap map[string]map[string]*types.ComponentRouter) map[string]*proto.NetworkRouterList {
+func (e *componentEncoder) encodeRoutersMap(routersMap map[string]map[string]*routerTypes.NetworkRouter) map[string]*proto.NetworkRouterList {
 	if len(routersMap) == 0 {
 		return nil
 	}
@@ -689,20 +692,20 @@ func toAccountNetwork(n *types.Network) *proto.AccountNetwork {
 	return out
 }
 
-func toPeerCompact(p *types.ComponentPeer) *proto.PeerCompact {
+func toPeerCompact(p *nbpeer.Peer) *proto.PeerCompact {
 	pc := &proto.PeerCompact{
 		WgPubKey:               decodeWgKey(p.Key),
 		SshPubKey:              []byte(p.SSHKey),
 		DnsLabel:               p.DNSLabel,
-		AgentVersion:           p.AgentVersion,
-		AddedWithSsoLogin:      p.AddedWithSSOLogin,
+		AgentVersion:           p.Meta.WtVersion,
+		AddedWithSsoLogin:      p.UserID != "",
 		LoginExpirationEnabled: p.LoginExpirationEnabled,
 		SshEnabled:             p.SSHEnabled,
-		SupportsIpv6:           p.SupportsIPv6,
-		SupportsSourcePrefixes: p.SupportsSourcePrefixes,
-		ServerSshAllowed:       p.ServerSSHAllowed,
+		SupportsIpv6:           p.SupportsIPv6(),
+		SupportsSourcePrefixes: p.SupportsSourcePrefixes(),
+		ServerSshAllowed:       p.Meta.Flags.ServerSSHAllowed,
 	}
-	if !p.LastLogin.IsZero() {
+	if p.LastLogin != nil {
 		pc.LastLoginUnixNano = p.LastLogin.UnixNano()
 	}
 	switch {

management/internals/shared/grpc/components_encoder_test.go

@@ -15,6 +15,9 @@ import (
 	goproto "google.golang.org/protobuf/proto"
 
 	nbdns "github.com/netbirdio/netbird/dns"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
+	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/types"
 	nbroute "github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/proto"
@@ -152,28 +155,29 @@ func envelopesEquivalent(a, b *proto.NetworkMapEnvelope) bool {
 }
 
 func newTestComponents() *types.NetworkMapComponents {
-	peerA := &types.ComponentPeer{
-		ID:           "peer-a",
-		Key:          testWgKeyA,
-		IP:           netip.AddrFrom4([4]byte{100, 64, 0, 1}),
-		DNSLabel:     "peera",
-		SSHKey:       "ssh-a",
-		AgentVersion: "0.40.0",
+	peerA := &nbpeer.Peer{
+		ID:       "peer-a",
+		Key:      testWgKeyA,
+		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 1}),
+		DNSLabel: "peera",
+		SSHKey:   "ssh-a",
+		Status:   &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now()},
+		Meta:     nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
 	}
-	peerB := &types.ComponentPeer{
-		ID:           "peer-b",
-		Key:          testWgKeyB,
-		IP:           netip.AddrFrom4([4]byte{100, 64, 0, 2}),
-		IPv6:         netip.AddrFrom16([16]byte{0xfd, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2}),
-		DNSLabel:     "peerb",
-		AgentVersion: "0.25.0",
+	peerB := &nbpeer.Peer{
+		ID:       "peer-b",
+		Key:      testWgKeyB,
+		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 2}),
+		IPv6:     netip.AddrFrom16([16]byte{0xfd, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2}),
+		DNSLabel: "peerb",
+		Meta:     nbpeer.PeerSystemMeta{WtVersion: "0.25.0"},
 	}
-	peerC := &types.ComponentPeer{
-		ID:           "peer-c",
-		Key:          testWgKeyC,
-		IP:           netip.AddrFrom4([4]byte{100, 64, 0, 3}),
-		DNSLabel:     "peerc",
-		AgentVersion: "0.40.0",
+	peerC := &nbpeer.Peer{
+		ID:       "peer-c",
+		Key:      testWgKeyC,
+		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 3}),
+		DNSLabel: "peerc",
+		Meta:     nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
 	}
 
 	return &types.NetworkMapComponents{
@@ -187,12 +191,12 @@ func newTestComponents() *types.NetworkMapComponents {
 			PeerLoginExpirationEnabled: true,
 			PeerLoginExpiration:        2 * time.Hour,
 		},
-		Peers: map[string]*types.ComponentPeer{
+		Peers: map[string]*nbpeer.Peer{
 			"peer-a": peerA,
 			"peer-b": peerB,
 			"peer-c": peerC,
 		},
-		Groups: map[string]*types.ComponentGroup{
+		Groups: map[string]*types.Group{
 			"group-src": {ID: "group-src", PublicID: "1", Name: "Src", Peers: []string{"peer-a"}},
 			"group-dst": {ID: "group-dst", PublicID: "2", Name: "Dst", Peers: []string{"peer-b", "peer-c"}},
 		},
@@ -211,7 +215,7 @@ func newTestComponents() *types.NetworkMapComponents {
 				}},
 			},
 		},
-		RouterPeers: map[string]*types.ComponentPeer{"peer-c": peerC},
+		RouterPeers: map[string]*nbpeer.Peer{"peer-c": peerC},
 	}
 }
 
@@ -377,12 +381,12 @@ func TestEncodeNetworkMapEnvelope_MalformedWgKey(t *testing.T) {
 
 func TestEncodeNetworkMapEnvelope_IPv6OnlyPeer(t *testing.T) {
 	c := newTestComponents()
-	v6Only := &types.ComponentPeer{
-		ID:           "peer-v6",
-		Key:          testWgKeyA,
-		IPv6:         netip.AddrFrom16([16]byte{0xfd, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 9}),
-		DNSLabel:     "peerv6",
-		AgentVersion: "0.40.0",
+	v6Only := &nbpeer.Peer{
+		ID:       "peer-v6",
+		Key:      testWgKeyA,
+		IPv6:     netip.AddrFrom16([16]byte{0xfd, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 9}),
+		DNSLabel: "peerv6",
+		Meta:     nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
 	}
 	c.Peers["peer-v6"] = v6Only
 
@@ -401,11 +405,11 @@ func TestEncodeNetworkMapEnvelope_IPv6OnlyPeer(t *testing.T) {
 
 func TestEncodeNetworkMapEnvelope_PeerWithoutIP(t *testing.T) {
 	c := newTestComponents()
-	c.Peers["peer-noip"] = &types.ComponentPeer{
-		ID:           "peer-noip",
-		Key:          testWgKeyA,
-		DNSLabel:     "peernoip",
-		AgentVersion: "0.40.0",
+	c.Peers["peer-noip"] = &nbpeer.Peer{
+		ID:       "peer-noip",
+		Key:      testWgKeyA,
+		DNSLabel: "peernoip",
+		Meta:     nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
 	}
 
 	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
@@ -440,9 +444,9 @@ func TestEncodeNetworkMapEnvelope_EmptyInput(t *testing.T) {
 func TestEncodeNetworkMapEnvelope_PeerLoginExpirationFields(t *testing.T) {
 	c := newTestComponents()
 	now := time.Date(2024, 1, 2, 3, 4, 5, 0, time.UTC)
-	c.Peers["peer-a"].AddedWithSSOLogin = true
+	c.Peers["peer-a"].UserID = "user-1"
 	c.Peers["peer-a"].LoginExpirationEnabled = true
-	c.Peers["peer-a"].LastLogin = now
+	c.Peers["peer-a"].LastLogin = &now
 
 	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
 
@@ -553,7 +557,7 @@ func TestEncodeNetworkMapEnvelope_ResourceOnlyPolicyShippedAndIndexed(t *testing
 	}
 	// Resource must appear in components.NetworkResources with a seq id —
 	// encoder uses that to translate the xid map key to uint32.
-	c.NetworkResources = []*types.ComponentResource{
+	c.NetworkResources = []*resourceTypes.NetworkResource{
 		{ID: "resource-x", PublicID: "77", Name: "res-x", Enabled: true},
 	}
 
@@ -621,11 +625,11 @@ func TestEncodeNetworkMapEnvelope_PostureFailedPeers(t *testing.T) {
 func TestEncodeNetworkMapEnvelope_RoutersMap(t *testing.T) {
 	c := newTestComponents()
 	c.NetworkXIDToPublicID = map[string]string{"net-1": "5"}
-	c.RoutersMap = map[string]map[string]*types.ComponentRouter{
+	c.RoutersMap = map[string]map[string]*routerTypes.NetworkRouter{
 		"net-1": {
 			"peer-c": {
-				PublicID: "200",
-				Peer:     "peer-c", Masquerade: true, Metric: 10, Enabled: true,
+				ID: "router-1", PublicID: "200",
+				Peer: "peer-c", Masquerade: true, Metric: 10, Enabled: true,
 			},
 		},
 	}
@@ -651,14 +655,14 @@ func TestEncodeNetworkMapEnvelope_RouterPeerNotInComponentsPeers(t *testing.T) {
 	// peer_index reference must still resolve.
 	c := newTestComponents()
 	delete(c.Peers, "peer-c")
-	routerPeer := &types.ComponentPeer{
+	routerPeer := &nbpeer.Peer{
 		ID: "peer-c", Key: testWgKeyC, IP: netip.AddrFrom4([4]byte{100, 64, 0, 3}),
-		DNSLabel: "peerc", AgentVersion: "0.40.0",
+		DNSLabel: "peerc", Meta: nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
 	}
-	c.RouterPeers = map[string]*types.ComponentPeer{"peer-c": routerPeer}
+	c.RouterPeers = map[string]*nbpeer.Peer{"peer-c": routerPeer}
 	c.NetworkXIDToPublicID = map[string]string{"net-1": "5"}
-	c.RoutersMap = map[string]map[string]*types.ComponentRouter{
-		"net-1": {"peer-c": {PublicID: "1", Peer: "peer-c", Enabled: true}},
+	c.RoutersMap = map[string]map[string]*routerTypes.NetworkRouter{
+		"net-1": {"peer-c": {ID: "r-1", PublicID: "1", Peer: "peer-c", Enabled: true}},
 	}
 
 	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
@@ -691,9 +695,9 @@ func TestToProxyPatch_EmptyInputReturnsNil(t *testing.T) {
 
 func TestToProxyPatch_PopulatesAllFields(t *testing.T) {
 	nm := &types.NetworkMap{
-		Peers: []*types.ComponentPeer{{
+		Peers: []*nbpeer.Peer{{
 			ID: "ext-peer", Key: testWgKeyA, IP: netip.AddrFrom4([4]byte{100, 64, 0, 9}),
-			DNSLabel: "extpeer", AgentVersion: "0.40.0",
+			DNSLabel: "extpeer", Meta: nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
 		}},
 		FirewallRules: []*types.FirewallRule{{
 			PeerIP: "100.64.0.9", Action: "accept", Direction: 0, Protocol: "tcp",
@@ -776,6 +780,6 @@ func TestEncodeNetworkMapEnvelope_AccountSettingsAlwaysEmitted(t *testing.T) {
 func emptyNetworkMapComponents() *types.NetworkMapComponents {
 	return types.EmptyNetworkMapComponents(
 		&types.NetworkMapComponents{
-			PeerID: "peer-id", Peers: map[string]*types.ComponentPeer{"peer-id": {}}},
+			PeerID: "peer-id", Peers: map[string]*nbpeer.Peer{"peer-id": {}}},
 	)
 }

management/internals/shared/grpc/components_envelope_response_test.go

@@ -19,10 +19,10 @@ func TestComputeSSHEnabledForPeer(t *testing.T) {
 
 	mkComponents := func(rule *types.PolicyRule, sshEnabled bool) (*types.NetworkMapComponents, *nbpeer.Peer) {
 		peer := &nbpeer.Peer{ID: targetPeerID, SSHEnabled: sshEnabled}
-		group := &types.ComponentGroup{ID: targetGroupID, Name: "dst", Peers: []string{targetPeerID}}
+		group := &types.Group{ID: targetGroupID, Name: "dst", Peers: []string{targetPeerID}}
 		return &types.NetworkMapComponents{
-			Peers:  map[string]*types.ComponentPeer{targetPeerID: peer.ToComponent()},
-			Groups: map[string]*types.ComponentGroup{targetGroupID: group},
+			Peers:  map[string]*nbpeer.Peer{targetPeerID: peer},
+			Groups: map[string]*types.Group{targetGroupID: group},
 			Policies: []*types.Policy{{
 				ID:      "p",
 				Enabled: true,
@@ -158,8 +158,8 @@ func TestComputeSSHEnabledForPeer(t *testing.T) {
 func TestComputeSSHEnabledForPeer_TargetMissingFromComponents(t *testing.T) {
 	peer := &nbpeer.Peer{ID: "missing", SSHEnabled: true}
 	c := &types.NetworkMapComponents{
-		Peers: map[string]*types.ComponentPeer{}, // target peer NOT present
-		Groups: map[string]*types.ComponentGroup{
+		Peers: map[string]*nbpeer.Peer{}, // target peer NOT present
+		Groups: map[string]*types.Group{
 			"g": {ID: "g", Peers: []string{"missing"}},
 		},
 		Policies: []*types.Policy{{

management/internals/shared/grpc/proxy_llm_policy_limits_test.go

@@ -1,145 +0,0 @@
-package grpc
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc/codes"
-	grpcstatus "google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
-	"github.com/netbirdio/netbird/shared/management/proto"
-)
-
-// fakeAgentNetworkLimits is a minimal AgentNetworkLimitsService double that
-// records the PolicySelectionInput it was invoked with and returns a
-// pre-programmed result, so tests can assert exactly what CheckLLMPolicyLimits
-// forwards to the selector.
-type fakeAgentNetworkLimits struct {
-	gotInput agentnetwork.PolicySelectionInput
-	result   *agentnetwork.PolicySelectionResult
-	err      error
-}
-
-func (f *fakeAgentNetworkLimits) SelectPolicyForRequest(_ context.Context, in agentnetwork.PolicySelectionInput) (*agentnetwork.PolicySelectionResult, error) {
-	f.gotInput = in
-	if f.err != nil {
-		return nil, f.err
-	}
-	return f.result, nil
-}
-
-func (f *fakeAgentNetworkLimits) RecordUsage(_ context.Context, _ agentnetwork.RecordUsageInput) error {
-	return nil
-}
-
-// TestCheckLLMPolicyLimits_ForwardsModelToSelector proves the wiring added in
-// this PR: the model the proxy extracted from the request body must reach the
-// selector's PolicySelectionInput.Model unchanged, alongside the pre-existing
-// account/user/group/provider fields.
-func TestCheckLLMPolicyLimits_ForwardsModelToSelector(t *testing.T) {
-	fake := &fakeAgentNetworkLimits{result: &agentnetwork.PolicySelectionResult{Allow: true, SelectedPolicyID: "pol-1"}}
-	s := &ProxyServiceServer{}
-	s.SetAgentNetworkLimitsService(fake)
-
-	req := &proto.CheckLLMPolicyLimitsRequest{
-		AccountId:  "acc-1",
-		UserId:     "user-1",
-		GroupIds:   []string{"grp-a", "grp-b"},
-		ProviderId: "prov-1",
-		Model:      "claude-opus-4",
-	}
-
-	resp, err := s.CheckLLMPolicyLimits(context.Background(), req)
-	require.NoError(t, err)
-	require.NotNil(t, resp)
-
-	assert.Equal(t, "acc-1", fake.gotInput.AccountID)
-	assert.Equal(t, "user-1", fake.gotInput.UserID)
-	assert.Equal(t, []string{"grp-a", "grp-b"}, fake.gotInput.GroupIDs)
-	assert.Equal(t, "prov-1", fake.gotInput.ProviderID)
-	assert.Equal(t, "claude-opus-4", fake.gotInput.Model,
-		"the request's model must be forwarded to the selector's PolicySelectionInput")
-}
-
-// TestCheckLLMPolicyLimits_EmptyModelForwardedAsEmpty proves an
-// undetermined model (empty string) is forwarded as-is rather than defaulted
-// to some sentinel — the selector is the one that decides how to treat it
-// (fail closed when a restriction applies).
-func TestCheckLLMPolicyLimits_EmptyModelForwardedAsEmpty(t *testing.T) {
-	fake := &fakeAgentNetworkLimits{result: &agentnetwork.PolicySelectionResult{Allow: true}}
-	s := &ProxyServiceServer{}
-	s.SetAgentNetworkLimitsService(fake)
-
-	req := &proto.CheckLLMPolicyLimitsRequest{
-		AccountId:  "acc-1",
-		ProviderId: "prov-1",
-	}
-
-	_, err := s.CheckLLMPolicyLimits(context.Background(), req)
-	require.NoError(t, err)
-	assert.Equal(t, "", fake.gotInput.Model, "an absent model must be forwarded as empty, not fabricated")
-}
-
-// TestCheckLLMPolicyLimits_DenyResponseCarriesModelBlockedCode proves the deny
-// envelope surfaces the model-allowlist deny code + reason end to end through
-// the gRPC response, matching the proxy guardrail's code so both layers agree.
-func TestCheckLLMPolicyLimits_DenyResponseCarriesModelBlockedCode(t *testing.T) {
-	fake := &fakeAgentNetworkLimits{result: &agentnetwork.PolicySelectionResult{
-		Allow:      false,
-		DenyCode:   "llm_policy.model_blocked",
-		DenyReason: `model "claude-opus-4" is not permitted by any applicable policy allowlist`,
-	}}
-	s := &ProxyServiceServer{}
-	s.SetAgentNetworkLimitsService(fake)
-
-	resp, err := s.CheckLLMPolicyLimits(context.Background(), &proto.CheckLLMPolicyLimitsRequest{
-		AccountId:  "acc-1",
-		ProviderId: "prov-1",
-		Model:      "claude-opus-4",
-	})
-	require.NoError(t, err)
-	require.NotNil(t, resp)
-	assert.Equal(t, "deny", resp.Decision)
-	assert.Equal(t, "llm_policy.model_blocked", resp.DenyCode)
-	assert.NotEmpty(t, resp.DenyReason)
-	assert.Empty(t, resp.SelectedPolicyId, "a denied request must carry no selected policy")
-}
-
-// TestCheckLLMPolicyLimits_SelectorErrorSurfacesAsInternal proves a selector
-// failure (e.g. a store error propagated from SelectPolicyForRequest) is
-// surfaced as an Internal gRPC error rather than silently allowed.
-func TestCheckLLMPolicyLimits_SelectorErrorSurfacesAsInternal(t *testing.T) {
-	fake := &fakeAgentNetworkLimits{err: errors.New("boom")}
-	s := &ProxyServiceServer{}
-	s.SetAgentNetworkLimitsService(fake)
-
-	_, err := s.CheckLLMPolicyLimits(context.Background(), &proto.CheckLLMPolicyLimitsRequest{
-		AccountId:  "acc-1",
-		ProviderId: "prov-1",
-		Model:      "gpt-4o",
-	})
-	require.Error(t, err)
-	st, ok := grpcstatus.FromError(err)
-	require.True(t, ok)
-	assert.Equal(t, codes.Internal, st.Code(), "selector errors must never fail open on the hot path")
-}
-
-// TestCheckLLMPolicyLimits_UnconfiguredServiceReturnsUnimplemented locks the
-// documented fallback: with no AgentNetworkLimitsService wired, the RPC must
-// return Unimplemented rather than panic or silently allow.
-func TestCheckLLMPolicyLimits_UnconfiguredServiceReturnsUnimplemented(t *testing.T) {
-	s := &ProxyServiceServer{}
-
-	_, err := s.CheckLLMPolicyLimits(context.Background(), &proto.CheckLLMPolicyLimitsRequest{
-		AccountId:  "acc-1",
-		ProviderId: "prov-1",
-	})
-	require.Error(t, err)
-	st, ok := grpcstatus.FromError(err)
-	require.True(t, ok)
-	assert.Equal(t, codes.Unimplemented, st.Code())
-}

management/server/auth/session.go

@@ -7,9 +7,6 @@ import (
 	"errors"
 	"fmt"
 	"time"
-
-	"github.com/eko/gocache/lib/v4/cache"
-	"github.com/eko/gocache/lib/v4/store"
 )
 
 const (
@@ -22,12 +19,17 @@ var (
 	ErrTokenExpired     = errors.New("JWT expired")
 )
 
-type SessionStore struct {
-	cache *cache.Cache[string]
+// TokenCache atomically records used JWTs until their expiration.
+type TokenCache interface {
+	SetNX(ctx context.Context, key, value string, ttl time.Duration) (bool, error)
 }
 
-func NewSessionStore(cacheStore store.StoreInterface) *SessionStore {
-	return &SessionStore{cache: cache.New[string](cacheStore)}
+type SessionStore struct {
+	cache TokenCache
+}
+
+func NewSessionStore(cacheStore TokenCache) *SessionStore {
+	return &SessionStore{cache: cacheStore}
 }
 
 // RegisterToken records a JWT until its exp time and rejects reuse.
@@ -38,19 +40,13 @@ func (s *SessionStore) RegisterToken(ctx context.Context, token string, expiresA
 	}
 
 	key := usedTokenKeyPrefix + hashToken(token)
-	_, err := s.cache.Get(ctx, key)
-	if err == nil {
-		return ErrTokenAlreadyUsed
-	}
-
-	var notFound *store.NotFound
-	if !errors.As(err, &notFound) {
-		return fmt.Errorf("failed to lookup used token entry: %w", err)
-	}
-
-	if err := s.cache.Set(ctx, key, usedTokenMarker, store.WithExpiration(ttl)); err != nil {
+	created, err := s.cache.SetNX(ctx, key, usedTokenMarker, ttl)
+	if err != nil {
 		return fmt.Errorf("failed to store used token entry: %w", err)
 	}
+	if !created {
+		return ErrTokenAlreadyUsed
+	}
 
 	return nil
 }

management/server/auth/session_test.go

@@ -2,6 +2,7 @@ package auth
 
 import (
 	"context"
+	"errors"
 	"testing"
 	"time"
 
@@ -38,6 +39,39 @@ func TestSessionStore_RegisterSameTokenTwiceIsRejected(t *testing.T) {
 	assert.ErrorIs(t, err, ErrTokenAlreadyUsed)
 }
 
+func TestSessionStore_ConcurrentRegistrationAllowsOneCaller(t *testing.T) {
+	s := newTestSessionStore(t)
+	ctx := context.Background()
+	const attempts = 100
+
+	start := make(chan struct{})
+	results := make(chan error, attempts)
+	for range attempts {
+		go func() {
+			<-start
+			results <- s.RegisterToken(ctx, "token", time.Now().Add(time.Hour))
+		}()
+	}
+	close(start)
+
+	succeeded := 0
+	alreadyUsed := 0
+	for range attempts {
+		err := <-results
+		switch {
+		case err == nil:
+			succeeded++
+		case errors.Is(err, ErrTokenAlreadyUsed):
+			alreadyUsed++
+		default:
+			require.NoError(t, err)
+		}
+	}
+
+	assert.Equal(t, 1, succeeded)
+	assert.Equal(t, attempts-1, alreadyUsed)
+}
+
 func TestSessionStore_RegisterDifferentTokensAreIndependent(t *testing.T) {
 	s := newTestSessionStore(t)
 	ctx := context.Background()
@@ -72,6 +106,23 @@ func TestSessionStore_EntryEvictsAtTTLAndAllowsReRegistration(t *testing.T) {
 	require.NoError(t, s.RegisterToken(ctx, token, time.Now().Add(time.Hour)))
 }
 
+type failingTokenCache struct {
+	err error
+}
+
+func (f failingTokenCache) SetNX(context.Context, string, string, time.Duration) (bool, error) {
+	return false, f.err
+}
+
+func TestSessionStore_CacheErrorIsReturned(t *testing.T) {
+	cacheErr := errors.New("cache unavailable")
+	s := NewSessionStore(failingTokenCache{err: cacheErr})
+
+	err := s.RegisterToken(context.Background(), "token", time.Now().Add(time.Hour))
+	require.Error(t, err)
+	assert.ErrorIs(t, err, cacheErr)
+}
+
 func TestHashToken_StableAndDoesNotLeak(t *testing.T) {
 	a := hashToken("tokenA")
 	b := hashToken("tokenB")

management/server/cache/memory.go

@@ -0,0 +1,31 @@
+package cache
+
+import (
+	"context"
+	"time"
+
+	"github.com/eko/gocache/lib/v4/store"
+	gocachestore "github.com/eko/gocache/store/go_cache/v4"
+	gocache "github.com/patrickmn/go-cache"
+)
+
+type goCacheStore struct {
+	store.StoreInterface
+	client *gocache.Cache
+}
+
+func newMemoryStore(maxTimeout, cleanupInterval time.Duration) Store {
+	client := gocache.New(maxTimeout, cleanupInterval)
+	return &goCacheStore{
+		StoreInterface: gocachestore.NewGoCache(client),
+		client:         client,
+	}
+}
+
+func (s *goCacheStore) SetNX(_ context.Context, key, value string, ttl time.Duration) (bool, error) {
+	// Add only returns an error when a non-expired entry already exists.
+	if err := s.client.Add(key, value, ttl); err != nil {
+		return false, nil
+	}
+	return true, nil
+}

management/server/cache/memory_test.go

@@ -0,0 +1,49 @@
+package cache_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/netbirdio/netbird/management/server/cache"
+)
+
+func TestMemoryStore(t *testing.T) {
+	memStore, err := cache.NewStore(context.Background(), 100*time.Millisecond, 300*time.Millisecond, 100)
+	if err != nil {
+		t.Fatalf("couldn't create memory store: %s", err)
+	}
+	ctx := context.Background()
+	key, value := "testing", "tested"
+	err = memStore.Set(ctx, key, value)
+	if err != nil {
+		t.Errorf("couldn't set testing data: %s", err)
+	}
+	result, err := memStore.Get(ctx, key)
+	if err != nil {
+		t.Errorf("couldn't get testing data: %s", err)
+	}
+	if value != result.(string) {
+		t.Errorf("value returned doesn't match testing data, got %s, expected %s", result, value)
+	}
+	created, err := memStore.SetNX(ctx, "atomic", value, 100*time.Millisecond)
+	if err != nil {
+		t.Fatalf("couldn't atomically set testing data: %s", err)
+	}
+	if !created {
+		t.Fatal("first atomic set should create the entry")
+	}
+	created, err = memStore.SetNX(ctx, "atomic", value, 100*time.Millisecond)
+	if err != nil {
+		t.Fatalf("couldn't atomically check testing data: %s", err)
+	}
+	if created {
+		t.Fatal("second atomic set should not replace the entry")
+	}
+	// test expiration
+	time.Sleep(300 * time.Millisecond)
+	_, err = memStore.Get(ctx, key)
+	if err == nil {
+		t.Error("value should not be found")
+	}
+}

management/server/cache/redis.go

@@ -0,0 +1,51 @@
+package cache
+
+import (
+	"context"
+	"fmt"
+	"math"
+	"time"
+
+	"github.com/eko/gocache/lib/v4/store"
+	redisstore "github.com/eko/gocache/store/redis/v4"
+	"github.com/redis/go-redis/v9"
+	log "github.com/sirupsen/logrus"
+)
+
+type redisStore struct {
+	store.StoreInterface
+	client *redis.Client
+}
+
+func getRedisStore(ctx context.Context, redisEnvAddr string, maxConn int) (Store, error) {
+	options, err := redis.ParseURL(redisEnvAddr)
+	if err != nil {
+		return nil, fmt.Errorf("parsing redis cache url: %s", err)
+	}
+
+	options.MaxIdleConns = int(math.Ceil(float64(maxConn) * 0.5)) // 50% of max conns
+	options.MinIdleConns = int(math.Ceil(float64(maxConn) * 0.1)) // 10% of max conns
+	options.MaxActiveConns = maxConn
+	options.ConnMaxIdleTime = 30 * time.Minute
+	options.ConnMaxLifetime = 0
+	options.PoolTimeout = 10 * time.Second
+	redisClient := redis.NewClient(options)
+	subCtx, cancel := context.WithTimeout(ctx, 2*time.Second)
+	defer cancel()
+
+	_, err = redisClient.Ping(subCtx).Result()
+	if err != nil {
+		return nil, err
+	}
+
+	log.WithContext(subCtx).Infof("using redis cache at %s", redisEnvAddr)
+
+	return &redisStore{
+		StoreInterface: redisstore.NewRedis(redisClient),
+		client:         redisClient,
+	}, nil
+}
+
+func (s *redisStore) SetNX(ctx context.Context, key, value string, ttl time.Duration) (bool, error) {
+	return s.client.SetNX(ctx, key, value, ttl).Result()
+}

management/server/cache/redis_test.go

@@ -12,32 +12,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/cache"
 )
 
-func TestMemoryStore(t *testing.T) {
-	memStore, err := cache.NewStore(context.Background(), 100*time.Millisecond, 300*time.Millisecond, 100)
-	if err != nil {
-		t.Fatalf("couldn't create memory store: %s", err)
-	}
-	ctx := context.Background()
-	key, value := "testing", "tested"
-	err = memStore.Set(ctx, key, value)
-	if err != nil {
-		t.Errorf("couldn't set testing data: %s", err)
-	}
-	result, err := memStore.Get(ctx, key)
-	if err != nil {
-		t.Errorf("couldn't get testing data: %s", err)
-	}
-	if value != result.(string) {
-		t.Errorf("value returned doesn't match testing data, got %s, expected %s", result, value)
-	}
-	// test expiration
-	time.Sleep(300 * time.Millisecond)
-	_, err = memStore.Get(ctx, key)
-	if err == nil {
-		t.Error("value should not be found")
-	}
-}
-
 func TestRedisStoreConnectionFailure(t *testing.T) {
 	t.Setenv(cache.RedisStoreEnvVar, "redis://127.0.0.1:6379")
 	_, err := cache.NewStore(context.Background(), 10*time.Millisecond, 30*time.Millisecond, 100)
@@ -94,6 +68,47 @@ func TestRedisStoreConnectionSuccess(t *testing.T) {
 	if value != r {
 		t.Errorf("value returned from redis doesn't match testing data, got %s, expected %s", r, value)
 	}
+
+	secondRedisStore, err := cache.NewStore(context.Background(), 100*time.Millisecond, 300*time.Millisecond, 100)
+	if err != nil {
+		t.Fatalf("couldn't create second redis store: %s", err)
+	}
+	start := make(chan struct{})
+	type setResult struct {
+		created bool
+		err     error
+	}
+	results := make(chan setResult, 2)
+	for _, cacheStore := range []cache.Store{redisStore, secondRedisStore} {
+		go func() {
+			<-start
+			created, err := cacheStore.SetNX(ctx, "atomic", value, time.Second)
+			results <- setResult{created: created, err: err}
+		}()
+	}
+	close(start)
+
+	created := 0
+	for range 2 {
+		result := <-results
+		if result.err != nil {
+			t.Fatalf("atomic redis set failed: %s", result.err)
+		}
+		if result.created {
+			created++
+		}
+	}
+	if created != 1 {
+		t.Fatalf("expected exactly one redis client to create the entry, got %d", created)
+	}
+	ttl, err := redisClient.PTTL(ctx, "atomic").Result()
+	if err != nil {
+		t.Fatalf("couldn't read atomic entry TTL: %s", err)
+	}
+	if ttl <= 0 {
+		t.Fatalf("atomic entry should have a positive TTL, got %s", ttl)
+	}
+
 	// test expiration
 	time.Sleep(300 * time.Millisecond)
 	_, err = redisStore.Get(ctx, key)

management/server/cache/store.go

@@ -2,17 +2,10 @@ package cache
 
 import (
 	"context"
-	"fmt"
-	"math"
 	"os"
 	"time"
 
 	"github.com/eko/gocache/lib/v4/store"
-	gocache_store "github.com/eko/gocache/store/go_cache/v4"
-	redis_store "github.com/eko/gocache/store/redis/v4"
-	gocache "github.com/patrickmn/go-cache"
-	"github.com/redis/go-redis/v9"
-	log "github.com/sirupsen/logrus"
 )
 
 // RedisStoreEnvVar is the environment variable that determines if a redis store should be used.
@@ -31,15 +24,21 @@ const (
 	DefaultStoreMaxConn = 1000
 )
 
+// Store extends the shared cache interface with atomic insertion support.
+type Store interface {
+	store.StoreInterface
+	// SetNX atomically stores a value with a TTL only when the key does not exist.
+	SetNX(ctx context.Context, key, value string, ttl time.Duration) (bool, error)
+}
+
 // NewStore creates a new cache store with the given max timeout and cleanup interval. It checks for the environment Variable RedisStoreEnvVar
 // to determine if a redis store should be used. If the environment variable is set, it will attempt to connect to the redis store.
-func NewStore(ctx context.Context, maxTimeout, cleanupInterval time.Duration, maxConn int) (store.StoreInterface, error) {
+func NewStore(ctx context.Context, maxTimeout, cleanupInterval time.Duration, maxConn int) (Store, error) {
 	redisAddr := GetAddrFromEnv()
 	if redisAddr != "" {
 		return getRedisStore(ctx, redisAddr, maxConn)
 	}
-	goc := gocache.New(maxTimeout, cleanupInterval)
-	return gocache_store.NewGoCache(goc), nil
+	return newMemoryStore(maxTimeout, cleanupInterval), nil
 }
 
 // GetAddrFromEnv returns the redis address from the environment variable RedisStoreEnvVar or its legacy counterpart.
@@ -50,29 +49,3 @@ func GetAddrFromEnv() string {
 	}
 	return addr
 }
-
-func getRedisStore(ctx context.Context, redisEnvAddr string, maxConn int) (store.StoreInterface, error) {
-	options, err := redis.ParseURL(redisEnvAddr)
-	if err != nil {
-		return nil, fmt.Errorf("parsing redis cache url: %s", err)
-	}
-
-	options.MaxIdleConns = int(math.Ceil(float64(maxConn) * 0.5)) // 50% of max conns
-	options.MinIdleConns = int(math.Ceil(float64(maxConn) * 0.1)) // 10% of max conns
-	options.MaxActiveConns = maxConn
-	options.ConnMaxIdleTime = 30 * time.Minute
-	options.ConnMaxLifetime = 0
-	options.PoolTimeout = 10 * time.Second
-	redisClient := redis.NewClient(options)
-	subCtx, cancel := context.WithTimeout(ctx, 2*time.Second)
-	defer cancel()
-
-	_, err = redisClient.Ping(subCtx).Result()
-	if err != nil {
-		return nil, err
-	}
-
-	log.WithContext(subCtx).Infof("using redis cache at %s", redisEnvAddr)
-
-	return redis_store.NewRedis(redisClient), nil
-}

management/server/groups/manager.go

@@ -6,7 +6,6 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
-	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
@@ -31,10 +30,6 @@ type managerImpl struct {
 	accountManager     account.Manager
 }
 
-func eventMetaResource(group *types.Group, resource *resourceTypes.NetworkResource) map[string]any {
-	return map[string]any{"name": group.Name, "id": group.ID, "resource_name": resource.Name, "resource_id": resource.ID, "resource_type": resource.Type}
-}
-
 type mockManager struct {
 }
 
@@ -114,7 +109,7 @@ func (m *managerImpl) AddResourceToGroupInTransaction(ctx context.Context, trans
 	}
 
 	event := func() {
-		m.accountManager.StoreEvent(ctx, userID, groupID, accountID, activity.ResourceAddedToGroup, eventMetaResource(group, networkResource))
+		m.accountManager.StoreEvent(ctx, userID, groupID, accountID, activity.ResourceAddedToGroup, group.EventMetaResource(networkResource))
 	}
 
 	return event, nil
@@ -138,7 +133,7 @@ func (m *managerImpl) RemoveResourceFromGroupInTransaction(ctx context.Context,
 	}
 
 	event := func() {
-		m.accountManager.StoreEvent(ctx, userID, groupID, accountID, activity.ResourceRemovedFromGroup, eventMetaResource(group, networkResource))
+		m.accountManager.StoreEvent(ctx, userID, groupID, accountID, activity.ResourceRemovedFromGroup, group.EventMetaResource(networkResource))
 	}
 
 	return event, nil

management/server/http/handlers/peers/peers_handler.go

@@ -446,7 +446,7 @@ func (h *Handler) GetAccessiblePeers(w http.ResponseWriter, r *http.Request) {
 
 	netMap := account.GetPeerNetworkMapFromComponents(ctx, peerID, dns.CustomZone{}, nil, validPeers, account.GetResourcePoliciesMap(), account.GetResourceRoutersMap(), nil, account.GetActiveGroupUsers())
 
-	util.WriteJSONObject(ctx, w, toAccessiblePeers(netMap, account.Peers, dnsDomain))
+	util.WriteJSONObject(ctx, w, toAccessiblePeers(netMap, dnsDomain))
 }
 
 func (h *Handler) CreateTemporaryAccess(w http.ResponseWriter, r *http.Request) {
@@ -534,20 +534,15 @@ func (h *Handler) CreateTemporaryAccess(w http.ResponseWriter, r *http.Request)
 	util.WriteJSONObject(r.Context(), w, resp)
 }
 
-// toAccessiblePeers rehydrates the calculated map's component peers into the
-// account's full peer objects, which carry the location/status/meta fields
-// the API response needs.
-func toAccessiblePeers(netMap *types.NetworkMap, accountPeers map[string]*nbpeer.Peer, dnsDomain string) []api.AccessiblePeer {
+func toAccessiblePeers(netMap *types.NetworkMap, dnsDomain string) []api.AccessiblePeer {
 	accessiblePeers := make([]api.AccessiblePeer, 0, len(netMap.Peers)+len(netMap.OfflinePeers))
-	add := func(peers []*types.ComponentPeer) {
-		for _, p := range peers {
-			if peer := accountPeers[p.ID]; peer != nil {
-				accessiblePeers = append(accessiblePeers, peerToAccessiblePeer(peer, dnsDomain))
-			}
-		}
+	for _, p := range netMap.Peers {
+		accessiblePeers = append(accessiblePeers, peerToAccessiblePeer(p, dnsDomain))
+	}
+
+	for _, p := range netMap.OfflinePeers {
+		accessiblePeers = append(accessiblePeers, peerToAccessiblePeer(p, dnsDomain))
 	}
-	add(netMap.Peers)
-	add(netMap.OfflinePeers)
 
 	return accessiblePeers
 }

management/server/networks/resources/types/resource.go

@@ -14,7 +14,6 @@ import (
 	nbDomain "github.com/netbirdio/netbird/shared/management/domain"
 
 	"github.com/netbirdio/netbird/shared/management/http/api"
-	sharedTypes "github.com/netbirdio/netbird/shared/management/types"
 )
 
 type NetworkResourceType string
@@ -65,27 +64,6 @@ func NewNetworkResource(accountID, networkID, name, description, address string,
 	}, nil
 }
 
-// ToComponent converts the resource to its self-contained components
-// representation. Returns nil for a nil resource.
-func (n *NetworkResource) ToComponent() *sharedTypes.ComponentResource {
-	if n == nil {
-		return nil
-	}
-	return &sharedTypes.ComponentResource{
-		ID:          n.ID,
-		PublicID:    n.PublicID,
-		NetworkID:   n.NetworkID,
-		AccountID:   n.AccountID,
-		Name:        n.Name,
-		Description: n.Description,
-		Type:        sharedTypes.ComponentResourceType(n.Type),
-		Address:     n.Address,
-		Domain:      n.Domain,
-		Prefix:      n.Prefix,
-		Enabled:     n.Enabled,
-	}
-}
-
 func (n *NetworkResource) ToAPIResponse(groups []api.GroupMinimum) *api.NetworkResource {
 	addr := n.Prefix.String()
 	if n.Type == Domain {

management/server/networks/routers/types/router.go

@@ -7,7 +7,6 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/networks/types"
 	"github.com/netbirdio/netbird/shared/management/http/api"
-	sharedTypes "github.com/netbirdio/netbird/shared/management/types"
 )
 
 type NetworkRouter struct {
@@ -22,36 +21,6 @@ type NetworkRouter struct {
 	Enabled    bool
 }
 
-// ToComponent converts the router to its self-contained components
-// representation. Returns nil for a nil router.
-func (n *NetworkRouter) ToComponent() *sharedTypes.ComponentRouter {
-	if n == nil {
-		return nil
-	}
-	return &sharedTypes.ComponentRouter{
-		NetworkID:  n.NetworkID,
-		PublicID:   n.PublicID,
-		Peer:       n.Peer,
-		PeerGroups: n.PeerGroups,
-		Masquerade: n.Masquerade,
-		Metric:     n.Metric,
-		Enabled:    n.Enabled,
-	}
-}
-
-// ToComponentMap converts a peer-keyed router map to its components
-// representation.
-func ToComponentMap(routers map[string]*NetworkRouter) map[string]*sharedTypes.ComponentRouter {
-	if routers == nil {
-		return nil
-	}
-	out := make(map[string]*sharedTypes.ComponentRouter, len(routers))
-	for id, r := range routers {
-		out[id] = r.ToComponent()
-	}
-	return out
-}
-
 func NewNetworkRouter(accountID string, networkID string, peer string, peerGroups []string, masquerade bool, metric int, enabled bool) (*NetworkRouter, error) {
 	r := &NetworkRouter{
 		ID:         xid.New().String(),

management/server/peer.go

@@ -405,7 +405,7 @@ func (am *DefaultAccountManager) CreatePeerJob(ctx context.Context, accountID, p
 		return status.NewPeerNotPartOfAccountError()
 	}
 
-	meetMinVer, err := version.MeetsMinVersion(remoteJobsMinVer, p.Meta.WtVersion)
+	meetMinVer, err := posture.MeetsMinVersion(remoteJobsMinVer, p.Meta.WtVersion)
 	if !version.IsDevelopmentVersion(p.Meta.WtVersion) && (!meetMinVer || err != nil) {
 		return status.Errorf(status.PreconditionFailed, "peer version %s does not meet the minimum required version %s for remote jobs", p.Meta.WtVersion, remoteJobsMinVer)
 	}
@@ -1588,7 +1588,7 @@ func affectedPeerIDsFromNetworkMap(nmap *types.NetworkMap, selfPeerID string) []
 	}
 	seen := make(map[string]struct{}, len(nmap.Peers)+len(nmap.OfflinePeers))
 	ids := make([]string, 0, len(nmap.Peers)+len(nmap.OfflinePeers))
-	add := func(peers []*types.ComponentPeer) {
+	add := func(peers []*nbpeer.Peer) {
 		for _, p := range peers {
 			if p == nil || p.ID == "" || p.ID == selfPeerID {
 				continue

management/server/peer/peer.go

@@ -13,7 +13,6 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/util"
 	"github.com/netbirdio/netbird/shared/management/http/api"
-	sharedTypes "github.com/netbirdio/netbird/shared/management/types"
 )
 
 // Peer capability constants mirror the proto enum values.
@@ -206,35 +205,6 @@ func (p *Peer) AddedWithSSOLogin() bool {
 	return p.UserID != ""
 }
 
-// ToComponent converts the peer to its self-contained components
-// representation, carrying exactly the subset of peer data that crosses the
-// components wire format. Returns nil for a nil peer so callers can convert
-// possibly-missing peers without guarding.
-func (p *Peer) ToComponent() *sharedTypes.ComponentPeer {
-	if p == nil {
-		return nil
-	}
-	cp := &sharedTypes.ComponentPeer{
-		ID:                     p.ID,
-		Key:                    p.Key,
-		IP:                     p.IP,
-		IPv6:                   p.IPv6,
-		DNSLabel:               p.DNSLabel,
-		SSHKey:                 p.SSHKey,
-		SSHEnabled:             p.SSHEnabled,
-		ServerSSHAllowed:       p.Meta.Flags.ServerSSHAllowed,
-		AgentVersion:           p.Meta.WtVersion,
-		SupportsSourcePrefixes: p.SupportsSourcePrefixes(),
-		SupportsIPv6:           p.SupportsIPv6(),
-		LoginExpirationEnabled: p.LoginExpirationEnabled,
-		AddedWithSSOLogin:      p.AddedWithSSOLogin(),
-	}
-	if p.LastLogin != nil {
-		cp.LastLogin = *p.LastLogin
-	}
-	return cp
-}
-
 // HasCapability reports whether the peer has the given capability.
 func (p *Peer) HasCapability(capability int32) bool {
 	return slices.Contains(p.Meta.Capabilities, capability)

management/server/peer_test.go

@@ -1092,14 +1092,14 @@ func TestToSyncResponse(t *testing.T) {
 	}
 	networkMap := &types.NetworkMap{
 		Network: &types.Network{Net: *ipnet, Serial: 1000},
-		Peers: []*types.ComponentPeer{{
+		Peers: []*nbpeer.Peer{{
 			IP:         netip.MustParseAddr("192.168.1.2"),
 			IPv6:       netip.MustParseAddr("fd00::2"),
 			Key:        "peer2-key",
 			DNSLabel:   "peer2",
 			SSHEnabled: true,
 			SSHKey:     "peer2-ssh-key"}},
-		OfflinePeers: []*types.ComponentPeer{{
+		OfflinePeers: []*nbpeer.Peer{{
 			IP:         netip.MustParseAddr("192.168.1.3"),
 			IPv6:       netip.MustParseAddr("fd00::3"),
 			Key:        "peer3-key",

management/server/posture/nb_version.go

@@ -3,9 +3,11 @@ package posture
 import (
 	"context"
 	"fmt"
+	"strings"
+
+	"github.com/hashicorp/go-version"
 
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	nbversion "github.com/netbirdio/netbird/version"
 )
 
 type NBVersionCheck struct {
@@ -14,8 +16,14 @@ type NBVersionCheck struct {
 
 var _ Check = (*NBVersionCheck)(nil)
 
+// sanitizeVersion removes anything after the pre-release tag (e.g., "-dev", "-alpha", etc.)
+func sanitizeVersion(version string) string {
+	parts := strings.Split(version, "-")
+	return parts[0]
+}
+
 func (n *NBVersionCheck) Check(ctx context.Context, peer nbpeer.Peer) (bool, error) {
-	meetsMin, err := nbversion.MeetsMinVersion(n.MinVersion, peer.Meta.WtVersion)
+	meetsMin, err := MeetsMinVersion(n.MinVersion, peer.Meta.WtVersion)
 	if err != nil {
 		return false, err
 	}
@@ -40,3 +48,21 @@ func (n *NBVersionCheck) Validate() error {
 	}
 	return nil
 }
+
+// MeetsMinVersion checks if the peer's version meets or exceeds the minimum required version
+func MeetsMinVersion(minVer, peerVer string) (bool, error) {
+	peerVer = sanitizeVersion(peerVer)
+	minVer = sanitizeVersion(minVer)
+
+	peerNBVer, err := version.NewVersion(peerVer)
+	if err != nil {
+		return false, err
+	}
+
+	constraints, err := version.NewConstraint(">= " + minVer)
+	if err != nil {
+		return false, err
+	}
+
+	return constraints.Check(peerNBVer), nil
+}

management/server/posture/nb_version_test.go

@@ -139,3 +139,68 @@ func TestNBVersionCheck_Validate(t *testing.T) {
 		})
 	}
 }
+
+func TestMeetsMinVersion(t *testing.T) {
+	tests := []struct {
+		name    string
+		minVer  string
+		peerVer string
+		want    bool
+		wantErr bool
+	}{
+		{
+			name:    "Peer version greater than min version",
+			minVer:  "0.26.0",
+			peerVer: "0.60.1",
+			want:    true,
+			wantErr: false,
+		},
+		{
+			name:    "Peer version equals min version",
+			minVer:  "1.0.0",
+			peerVer: "1.0.0",
+			want:    true,
+			wantErr: false,
+		},
+		{
+			name:    "Peer version less than min version",
+			minVer:  "1.0.0",
+			peerVer: "0.9.9",
+			want:    false,
+			wantErr: false,
+		},
+		{
+			name:    "Peer version with pre-release tag greater than min version",
+			minVer:  "1.0.0",
+			peerVer: "1.0.1-alpha",
+			want:    true,
+			wantErr: false,
+		},
+		{
+			name:    "Invalid peer version format",
+			minVer:  "1.0.0",
+			peerVer: "dev",
+			want:    false,
+			wantErr: true,
+		},
+		{
+			name:    "Invalid min version format",
+			minVer:  "invalid.version",
+			peerVer: "1.0.0",
+			want:    false,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := MeetsMinVersion(tt.minVer, tt.peerVer)
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+			}
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}

management/server/types/account.go

@@ -283,8 +283,8 @@ func (a *Account) SynthesizePrivateServiceZones(peerID string) []nbdns.CustomZon
 			// it, adding a single private service would black-hole every
 			// other name under the zone apex.
 			zone = &nbdns.CustomZone{
-				Domain:               dns.Fqdn(serviceDomainZone),
-				Records:              []nbdns.SimpleRecord{},
+				Domain:           dns.Fqdn(serviceDomainZone),
+				Records:          []nbdns.SimpleRecord{},
 				NonAuthoritative:     true,
 				SearchDomainDisabled: true,
 			}
@@ -1082,7 +1082,6 @@ func (a *Account) connResourcesGenerator(ctx context.Context, targetPeer *nbpeer
 	peersExists := make(map[string]struct{})
 	rules := make([]*FirewallRule, 0)
 	peers := make([]*nbpeer.Peer, 0)
-	targetComponent := targetPeer.ToComponent()
 
 	return func(rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int) {
 			for _, peer := range groupPeers {
@@ -1118,10 +1117,10 @@ func (a *Account) connResourcesGenerator(ctx context.Context, targetPeer *nbpeer
 				if len(rule.Ports) == 0 && len(rule.PortRanges) == 0 {
 					rules = append(rules, &fr)
 				} else {
-					rules = append(rules, ExpandPortsAndRanges(fr, rule, targetComponent)...)
+					rules = append(rules, ExpandPortsAndRanges(fr, rule, targetPeer)...)
 				}
 
-				rules = AppendIPv6FirewallRule(rules, rulesExists, peer.ToComponent(), targetComponent, rule, FirewallRuleContext{
+				rules = AppendIPv6FirewallRule(rules, rulesExists, peer, targetPeer, rule, FirewallRuleContext{
 					Direction:   direction,
 					DirStr:      strconv.Itoa(direction),
 					ProtocolStr: string(protocol),
@@ -1281,7 +1280,7 @@ func (a *Account) getRouteFirewallRules(ctx context.Context, peerID string, poli
 	return fwRules
 }
 
-func (a *Account) getRulePeers(rule *PolicyRule, postureChecks []string, peerID string, distributionPeers map[string]struct{}, validatedPeersMap map[string]struct{}) []*ComponentPeer {
+func (a *Account) getRulePeers(rule *PolicyRule, postureChecks []string, peerID string, distributionPeers map[string]struct{}, validatedPeersMap map[string]struct{}) []*nbpeer.Peer {
 	distPeersWithPolicy := make(map[string]struct{})
 	for _, id := range rule.Sources {
 		group := a.Groups[id]
@@ -1308,13 +1307,13 @@ func (a *Account) getRulePeers(rule *PolicyRule, postureChecks []string, peerID
 		}
 	}
 
-	distributionGroupPeers := make([]*ComponentPeer, 0, len(distPeersWithPolicy))
+	distributionGroupPeers := make([]*nbpeer.Peer, 0, len(distPeersWithPolicy))
 	for pID := range distPeersWithPolicy {
 		peer := a.Peers[pID]
 		if peer == nil {
 			continue
 		}
-		distributionGroupPeers = append(distributionGroupPeers, peer.ToComponent())
+		distributionGroupPeers = append(distributionGroupPeers, peer)
 	}
 	return distributionGroupPeers
 }

management/server/types/account_components.go

@@ -9,7 +9,9 @@ import (
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	"github.com/netbirdio/netbird/route"
 )
@@ -111,7 +113,7 @@ func (a *Account) GetPeerNetworkMapComponents(
 			PeerID:  peerID,
 			Network: a.Network.Copy(),
 			// must include the target peer as it's required on the client
-			Peers: map[string]*ComponentPeer{peerID: peer.ToComponent()},
+			Peers: map[string]*nbpeer.Peer{peerID: peer},
 		})
 	}
 
@@ -124,7 +126,7 @@ func (a *Account) GetPeerNetworkMapComponents(
 			PeerID:  peerID,
 			Network: a.Network.Copy(),
 			// must include the target peer as it's required on the client
-			Peers: map[string]*ComponentPeer{peerID: peer.ToComponent()},
+			Peers: map[string]*nbpeer.Peer{peerID: peer},
 		})
 	}
 
@@ -134,10 +136,10 @@ func (a *Account) GetPeerNetworkMapComponents(
 		NameServerGroups:          make([]*nbdns.NameServerGroup, 0),
 		CustomZoneDomain:          peersCustomZone.Domain,
 		ResourcePoliciesMap:       make(map[string][]*Policy),
-		RoutersMap:                make(map[string]map[string]*ComponentRouter),
-		NetworkResources:          make([]*ComponentResource, 0),
+		RoutersMap:                make(map[string]map[string]*routerTypes.NetworkRouter),
+		NetworkResources:          make([]*resourceTypes.NetworkResource, 0),
 		PostureFailedPeers:        make(map[string]map[string]struct{}, len(a.PostureChecks)),
-		RouterPeers:               make(map[string]*ComponentPeer),
+		RouterPeers:               make(map[string]*nbpeer.Peer),
 		NetworkXIDToPublicID:      make(map[string]string, len(a.Networks)),
 		PostureCheckXIDToPublicID: make(map[string]string, len(a.PostureChecks)),
 	}
@@ -172,7 +174,7 @@ func (a *Account) GetPeerNetworkMapComponents(
 	}
 
 	components.Peers = relevantPeers
-	components.Groups = GroupsToComponent(relevantGroups)
+	components.Groups = relevantGroups
 	components.Policies = relevantPolicies
 	components.Routes = relevantRoutes
 	components.AllDNSRecords = filterDNSRecordsByPeers(peersCustomZone.Records, relevantPeers, peer.SupportsIPv6() && peer.IPv6.IsValid())
@@ -221,7 +223,7 @@ func (a *Account) GetPeerNetworkMapComponents(
 				}
 				for _, pID := range a.getPostureValidPeersSaveFailed(peers, policy.SourcePostureChecks, validatedPeersMap, &components.PostureFailedPeers) {
 					if _, exists := components.Peers[pID]; !exists {
-						components.Peers[pID] = a.GetPeer(pID).ToComponent()
+						components.Peers[pID] = a.GetPeer(pID)
 					}
 				}
 			} else {
@@ -254,14 +256,14 @@ func (a *Account) GetPeerNetworkMapComponents(
 				for _, srcGroupID := range rule.Sources {
 					if g := a.Groups[srcGroupID]; g != nil {
 						if _, exists := components.Groups[srcGroupID]; !exists {
-							components.Groups[srcGroupID] = g.ToComponent()
+							components.Groups[srcGroupID] = g
 						}
 					}
 				}
 				for _, dstGroupID := range rule.Destinations {
 					if g := a.Groups[dstGroupID]; g != nil {
 						if _, exists := components.Groups[dstGroupID]; !exists {
-							components.Groups[dstGroupID] = g.ToComponent()
+							components.Groups[dstGroupID] = g
 						}
 					}
 				}
@@ -276,22 +278,20 @@ func (a *Account) GetPeerNetworkMapComponents(
 		// network in the account — accounts with many tenants/networks
 		// shipped tens of unrelated peers in `peers[]` and `routers_map`.
 		if addSourcePeers {
-			components.RoutersMap[resource.NetworkID] = routerTypes.ToComponentMap(networkRoutingPeers)
+			components.RoutersMap[resource.NetworkID] = networkRoutingPeers
 			for peerIDKey := range networkRoutingPeers {
 				if p := a.Peers[peerIDKey]; p != nil {
-					cp := components.RouterPeers[peerIDKey]
-					if cp == nil {
-						cp = p.ToComponent()
-						components.RouterPeers[peerIDKey] = cp
+					if _, exists := components.RouterPeers[peerIDKey]; !exists {
+						components.RouterPeers[peerIDKey] = p
 					}
 					if _, exists := components.Peers[peerIDKey]; !exists {
 						if _, validated := validatedPeersMap[peerIDKey]; validated {
-							components.Peers[peerIDKey] = cp
+							components.Peers[peerIDKey] = p
 						}
 					}
 				}
 			}
-			components.NetworkResources = append(components.NetworkResources, resource.ToComponent())
+			components.NetworkResources = append(components.NetworkResources, resource)
 		}
 	}
 
@@ -312,14 +312,14 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 	peerSSHEnabled bool,
 	validatedPeersMap map[string]struct{},
 	postureFailedPeers *map[string]map[string]struct{},
-) (map[string]*ComponentPeer, map[string]*Group, []*Policy, []*route.Route, sshRequirements) {
-	relevantPeerIDs := make(map[string]*ComponentPeer, len(a.Peers)/4)
+) (map[string]*nbpeer.Peer, map[string]*Group, []*Policy, []*route.Route, sshRequirements) {
+	relevantPeerIDs := make(map[string]*nbpeer.Peer, len(a.Peers)/4)
 	relevantGroupIDs := make(map[string]*Group, len(a.Groups)/4)
 	relevantPolicies := make([]*Policy, 0, len(a.Policies))
 	relevantRoutes := make([]*route.Route, 0, len(a.Routes))
 	sshReqs := sshRequirements{neededGroupIDs: make(map[string]struct{})}
 
-	relevantPeerIDs[peerID] = a.GetPeer(peerID).ToComponent()
+	relevantPeerIDs[peerID] = a.GetPeer(peerID)
 
 	peerGroupSet := make(map[string]struct{}, 8)
 	for groupID, group := range a.Groups {
@@ -384,7 +384,7 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 		if r.Peer != "" {
 			if _, ok := validatedPeersMap[r.Peer]; ok {
 				if p := a.GetPeer(r.Peer); p != nil {
-					relevantPeerIDs[r.Peer] = p.ToComponent()
+					relevantPeerIDs[r.Peer] = p
 				}
 			}
 		}
@@ -401,7 +401,7 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 					continue
 				}
 				if p := a.GetPeer(pid); p != nil {
-					relevantPeerIDs[pid] = p.ToComponent()
+					relevantPeerIDs[pid] = p
 				}
 			}
 		}
@@ -458,9 +458,7 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 			if peerInSources {
 				policyRelevant = true
 				for _, pid := range destinationPeers {
-					if _, exists := relevantPeerIDs[pid]; !exists {
-						relevantPeerIDs[pid] = a.GetPeer(pid).ToComponent()
-					}
+					relevantPeerIDs[pid] = a.GetPeer(pid)
 				}
 				for _, dstGroupID := range rule.Destinations {
 					relevantGroupIDs[dstGroupID] = a.GetGroup(dstGroupID)
@@ -470,9 +468,7 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 			if peerInDestinations {
 				policyRelevant = true
 				for _, pid := range sourcePeers {
-					if _, exists := relevantPeerIDs[pid]; !exists {
-						relevantPeerIDs[pid] = a.GetPeer(pid).ToComponent()
-					}
+					relevantPeerIDs[pid] = a.GetPeer(pid)
 				}
 				for _, srcGroupID := range rule.Sources {
 					relevantGroupIDs[srcGroupID] = a.GetGroup(srcGroupID)
@@ -628,7 +624,7 @@ func (a *Account) getPostureValidPeersSaveFailed(inputPeers []string, postureChe
 // that name them. Calculate() tolerates groups with empty Peers (the inner
 // loops simply iterate zero times), so retaining them is behaviourally a
 // no-op for the legacy path that consumes the same NetworkMapComponents.
-func filterGroupPeers(groups *map[string]*ComponentGroup, peers map[string]*ComponentPeer) {
+func filterGroupPeers(groups *map[string]*Group, peers map[string]*nbpeer.Peer) {
 	for groupID, groupInfo := range *groups {
 		filteredPeers := make([]string, 0, len(groupInfo.Peers))
 		for _, pid := range groupInfo.Peers {
@@ -638,14 +634,14 @@ func filterGroupPeers(groups *map[string]*ComponentGroup, peers map[string]*Comp
 		}
 
 		if len(filteredPeers) != len(groupInfo.Peers) {
-			ng := *groupInfo
+			ng := groupInfo.Copy()
 			ng.Peers = filteredPeers
-			(*groups)[groupID] = &ng
+			(*groups)[groupID] = ng
 		}
 	}
 }
 
-func filterPostureFailedPeers(postureFailedPeers *map[string]map[string]struct{}, policies []*Policy, resourcePoliciesMap map[string][]*Policy, peers map[string]*ComponentPeer) {
+func filterPostureFailedPeers(postureFailedPeers *map[string]map[string]struct{}, policies []*Policy, resourcePoliciesMap map[string][]*Policy, peers map[string]*nbpeer.Peer) {
 	if len(*postureFailedPeers) == 0 {
 		return
 	}
@@ -680,7 +676,7 @@ func filterPostureFailedPeers(postureFailedPeers *map[string]map[string]struct{}
 	}
 }
 
-func filterDNSRecordsByPeers(records []nbdns.SimpleRecord, peers map[string]*ComponentPeer, includeIPv6 bool) []nbdns.SimpleRecord {
+func filterDNSRecordsByPeers(records []nbdns.SimpleRecord, peers map[string]*nbpeer.Peer, includeIPv6 bool) []nbdns.SimpleRecord {
 	if len(records) == 0 || len(peers) == 0 {
 		return nil
 	}

management/server/types/account_private_netmap_test.go

@@ -9,6 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	nbdns "github.com/netbirdio/netbird/dns"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 )
 
 func TestPrivateService_NetworkMap_UserPeer_AndProxyPeer(t *testing.T) {
@@ -48,7 +49,7 @@ func TestPrivateService_NetworkMap_UserPeer_AndProxyPeer(t *testing.T) {
 	})
 }
 
-func netmapPeerIDs(peers []*ComponentPeer) []string {
+func netmapPeerIDs(peers []*nbpeer.Peer) []string {
 	ids := make([]string, 0, len(peers))
 	for _, p := range peers {
 		if p == nil {

management/server/types/account_test.go

@@ -666,7 +666,7 @@ func Test_ExpandPortsAndRanges_SSHRuleExpansion(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result := ExpandPortsAndRanges(tt.base, tt.rule, tt.peer.ToComponent())
+			result := ExpandPortsAndRanges(tt.base, tt.rule, tt.peer)
 
 			var ports []string
 			for _, fr := range result {

management/server/types/aliases.go

@@ -6,6 +6,7 @@ import (
 	"net"
 	"net/netip"
 
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	nbroute "github.com/netbirdio/netbird/route"
 	sharedtypes "github.com/netbirdio/netbird/shared/management/types"
 )
@@ -17,6 +18,9 @@ type DNSSettings = sharedtypes.DNSSettings
 
 type FirewallRule = sharedtypes.FirewallRule
 
+type Group = sharedtypes.Group
+type GroupPeer = sharedtypes.GroupPeer
+
 type Network = sharedtypes.Network
 type NetworkMap = sharedtypes.NetworkMap
 type ForwardingRule = sharedtypes.ForwardingRule
@@ -38,18 +42,6 @@ type RouteFirewallRule = sharedtypes.RouteFirewallRule
 
 type NetworkMapComponents = sharedtypes.NetworkMapComponents
 
-type ComponentPeer = sharedtypes.ComponentPeer
-type ComponentGroup = sharedtypes.ComponentGroup
-type ComponentRouter = sharedtypes.ComponentRouter
-type ComponentResource = sharedtypes.ComponentResource
-type ComponentResourceType = sharedtypes.ComponentResourceType
-
-const (
-	ComponentResourceHost   = sharedtypes.ComponentResourceHost
-	ComponentResourceSubnet = sharedtypes.ComponentResourceSubnet
-	ComponentResourceDomain = sharedtypes.ComponentResourceDomain
-)
-
 var EmptyNetworkMapComponents = sharedtypes.EmptyNetworkMapComponents
 
 type AccountSettingsInfo = sharedtypes.AccountSettingsInfo
@@ -60,7 +52,12 @@ type NetworkMapComponentsCompact = sharedtypes.NetworkMapComponentsCompact
 type LookupMap = sharedtypes.LookupMap
 type FirewallRuleContext = sharedtypes.FirewallRuleContext
 
-const GroupAllName = sharedtypes.GroupAllName
+const (
+	GroupIssuedAPI         = sharedtypes.GroupIssuedAPI
+	GroupIssuedJWT         = sharedtypes.GroupIssuedJWT
+	GroupIssuedIntegration = sharedtypes.GroupIssuedIntegration
+	GroupAllName           = sharedtypes.GroupAllName
+)
 
 // Function forwarders preserve types.X(...) call sites that previously
 // resolved to package-local funcs. Plain forwarders (not var aliases) keep
@@ -70,11 +67,11 @@ func PolicyRuleImpliesLegacySSH(rule *PolicyRule) bool {
 	return sharedtypes.PolicyRuleImpliesLegacySSH(rule)
 }
 
-func ExpandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *ComponentPeer) []*FirewallRule {
+func ExpandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *nbpeer.Peer) []*FirewallRule {
 	return sharedtypes.ExpandPortsAndRanges(base, rule, peer)
 }
 
-func AppendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *ComponentPeer, rule *PolicyRule, rc FirewallRuleContext) []*FirewallRule {
+func AppendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *nbpeer.Peer, rule *PolicyRule, rc FirewallRuleContext) []*FirewallRule {
 	return sharedtypes.AppendIPv6FirewallRule(rules, rulesExists, peer, targetPeer, rule, rc)
 }
 
@@ -82,7 +79,7 @@ func CalculateNetworkMapFromComponents(ctx context.Context, components *NetworkM
 	return sharedtypes.CalculateNetworkMapFromComponents(ctx, components)
 }
 
-func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*ComponentPeer, direction int, includeIPv6 bool) []*RouteFirewallRule {
+func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int, includeIPv6 bool) []*RouteFirewallRule {
 	return sharedtypes.GenerateRouteFirewallRules(ctx, route, rule, groupPeers, direction, includeIPv6)
 }
 

management/server/types/ipv6_endtoend_test.go

@@ -9,7 +9,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/types"
 )
 
 func TestNetworkMapComponents_IPv6EndToEnd(t *testing.T) {
@@ -105,7 +104,7 @@ func TestNetworkMapComponents_RemotePeerWithoutCapability(t *testing.T) {
 	require.NotNil(t, nm)
 
 	t.Run("AllowedIPs include remote v6", func(t *testing.T) {
-		var dst *types.ComponentPeer
+		var dst *nbpeer.Peer
 		for _, p := range nm.Peers {
 			if p.ID == "peer-dst-1" {
 				dst = p

management/server/types/networkmap_components_test.go

@@ -49,7 +49,7 @@ func allPeersValidated(account *types.Account, excludePeerIDs ...string) map[str
 	return validated
 }
 
-func peerIDs(peers []*types.ComponentPeer) []string {
+func peerIDs(peers []*nbpeer.Peer) []string {
 	ids := make([]string, len(peers))
 	for i, p := range peers {
 		ids[i] = p.ID

management/server/util/util.go

@@ -19,3 +19,34 @@ func Difference(a, b []string) []string {
 func ToPtr[T any](value T) *T {
 	return &value
 }
+
+type comparableObject[T any] interface {
+	Equal(other T) bool
+}
+
+func MergeUnique[T comparableObject[T]](arr1, arr2 []T) []T {
+	var result []T
+
+	for _, item := range arr1 {
+		if !contains(result, item) {
+			result = append(result, item)
+		}
+	}
+
+	for _, item := range arr2 {
+		if !contains(result, item) {
+			result = append(result, item)
+		}
+	}
+
+	return result
+}
+
+func contains[T comparableObject[T]](slice []T, element T) bool {
+	for _, item := range slice {
+		if item.Equal(element) {
+			return true
+		}
+	}
+	return false
+}

management/server/util/util_test.go

@@ -1,4 +1,4 @@
-package types
+package util
 
 import (
 	"testing"
@@ -17,7 +17,7 @@ func (t testObject) Equal(other testObject) bool {
 func Test_MergeUniqueArraysWithoutDuplicates(t *testing.T) {
 	arr1 := []testObject{{value: 1}, {value: 2}}
 	arr2 := []testObject{{value: 2}, {value: 3}}
-	result := mergeUnique(arr1, arr2)
+	result := MergeUnique(arr1, arr2)
 	assert.Len(t, result, 3)
 	assert.Contains(t, result, testObject{value: 1})
 	assert.Contains(t, result, testObject{value: 2})
@@ -27,14 +27,14 @@ func Test_MergeUniqueArraysWithoutDuplicates(t *testing.T) {
 func Test_MergeUniqueHandlesEmptyArrays(t *testing.T) {
 	arr1 := []testObject{}
 	arr2 := []testObject{}
-	result := mergeUnique(arr1, arr2)
+	result := MergeUnique(arr1, arr2)
 	assert.Empty(t, result)
 }
 
 func Test_MergeUniqueHandlesOneEmptyArray(t *testing.T) {
 	arr1 := []testObject{{value: 1}, {value: 2}}
 	arr2 := []testObject{}
-	result := mergeUnique(arr1, arr2)
+	result := MergeUnique(arr1, arr2)
 	assert.Len(t, result, 2)
 	assert.Contains(t, result, testObject{value: 1})
 	assert.Contains(t, result, testObject{value: 2})

proxy/Dockerfile.multistage

@@ -10,7 +10,6 @@ COPY encryption ./encryption
 COPY flow ./flow
 COPY formatter ./formatter
 COPY monotime ./monotime
-COPY management ./management
 COPY proxy ./proxy
 COPY route ./route
 COPY shared ./shared

proxy/internal/llm/pricing/defaults_pricing.yaml

@@ -161,16 +161,6 @@ openai:
     input_per_1k: 0.0001
     output_per_1k: 0
 
-  # Kimi / Moonshot AI (kimi_api) — OpenAI-compatible /v1 endpoint. Moonshot
-  # reports cache hits OpenAI-style when present; cached input is 10% of
-  # input ($0.30 vs $3.00 per MTok). kimi-k3 is the only model the platform
-  # serves newer accounts (K2-era ids and kimi-latest 404), matching the
-  # management catalog.
-  kimi-k3:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cached_input_per_1k: 0.0003
-
 anthropic:
   # Claude 4.x family — cache reads ≈10% of input, cache writes ≈125% of input.
   # Pricing source: Anthropic's current published rates per million tokens,
@@ -216,20 +206,6 @@ anthropic:
     cache_read_per_1k: 0.0001
     cache_creation_per_1k: 0.00125
 
-  # Kimi / Moonshot AI (kimi_api) via the Anthropic-compatible endpoint
-  # (/anthropic/v1/messages — the official Claude Code setup). Same rates
-  # as the OpenAI-shape entry above. "kimi-k3[1m]" is the model id some
-  # Claude Code guides set for the 1M-context alias; priced identically so
-  # cost metering doesn't silently skip those requests.
-  kimi-k3:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-  "kimi-k3[1m]":
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-
 bedrock:
   # AWS Bedrock model ids, normalised by the request parser (cross-region
   # inference-profile prefix + version/throughput suffix stripped), e.g.

proxy/internal/middleware/builtin/llm_guardrail/middleware_test.go

@@ -26,25 +26,6 @@ func newInput(meta ...middleware.KV) *middleware.Input {
 	return &middleware.Input{Slot: middleware.SlotOnRequest, Metadata: meta}
 }
 
-const (
-	testProvider  = "prov-1"
-	otherProvider = "prov-2"
-)
-
-// providerCfg builds a Config restricting testProvider to the given models.
-func providerCfg(models ...string) Config {
-	return Config{ProviderAllowlists: map[string][]string{testProvider: models}}
-}
-
-// newInputProvider builds an input that carries a resolved provider id (as
-// llm_router would stamp) plus any extra metadata.
-func newInputProvider(provider string, meta ...middleware.KV) *middleware.Input {
-	all := make([]middleware.KV, 0, len(meta)+1)
-	all = append(all, middleware.KV{Key: middleware.KeyLLMResolvedProviderID, Value: provider})
-	all = append(all, meta...)
-	return &middleware.Input{Slot: middleware.SlotOnRequest, Metadata: all}
-}
-
 func TestMiddlewareIdentity(t *testing.T) {
 	mw := New(Config{})
 	assert.Equal(t, ID, mw.ID(), "middleware ID must be llm_guardrail")
@@ -66,12 +47,12 @@ func TestMiddlewareIdentity(t *testing.T) {
 
 func TestAllowlistEmptyAllowsAnyModel(t *testing.T) {
 	mw := New(Config{})
-	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+	out, err := mw.Invoke(context.Background(), newInput(
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
 	))
 	require.NoError(t, err)
 	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision, "no provider allowlists must allow any model")
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "empty allowlist must allow any model")
 	v, ok := metaValue(t, out.Metadata, middleware.KeyLLMPolicyDecision)
 	require.True(t, ok, "decision metadata must be emitted")
 	assert.Equal(t, "allow", v, "decision must be allow")
@@ -81,8 +62,8 @@ func TestAllowlistEmptyAllowsAnyModel(t *testing.T) {
 }
 
 func TestAllowlistMatchAllows(t *testing.T) {
-	mw := New(providerCfg("gpt-4o", "claude-opus-4"))
-	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+	mw := New(Config{ModelAllowlist: []string{"gpt-4o", "claude-opus-4"}})
+	out, err := mw.Invoke(context.Background(), newInput(
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
 	))
 	require.NoError(t, err)
@@ -90,8 +71,8 @@ func TestAllowlistMatchAllows(t *testing.T) {
 }
 
 func TestAllowlistMissDenies(t *testing.T) {
-	mw := New(providerCfg("gpt-4o"))
-	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+	mw := New(Config{ModelAllowlist: []string{"gpt-4o"}})
+	out, err := mw.Invoke(context.Background(), newInput(
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-opus-4"},
 	))
 	require.NoError(t, err)
@@ -110,10 +91,10 @@ func TestAllowlistMissDenies(t *testing.T) {
 }
 
 func TestAllowlistCaseInsensitive(t *testing.T) {
-	mw := New(providerCfg("  GPT-4o  ", "Claude-OPUS-4"))
+	mw := New(Config{ModelAllowlist: []string{"  GPT-4o  ", "Claude-OPUS-4"}})
 	cases := []string{"gpt-4o", "GPT-4O", "  claude-opus-4 "}
 	for _, model := range cases {
-		out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+		out, err := mw.Invoke(context.Background(), newInput(
 			middleware.KV{Key: middleware.KeyLLMModel, Value: model},
 		))
 		require.NoError(t, err)
@@ -122,15 +103,14 @@ func TestAllowlistCaseInsensitive(t *testing.T) {
 }
 
 func TestAllowlistMissingModelKeyDenies(t *testing.T) {
-	// Fail closed: with an allowlist in effect for the resolved provider, a
-	// request whose model the parser could not extract (URL/path-routed
-	// providers such as Bedrock or Vertex whose shape wasn't recognised) must be
-	// denied, not allowed.
-	mw := New(providerCfg("gpt-4o"))
-	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider))
+	// Fail closed: with an allowlist configured, a request whose model the
+	// parser could not extract (URL/path-routed providers such as Bedrock or
+	// Vertex whose shape wasn't recognised) must be denied, not allowed.
+	mw := New(Config{ModelAllowlist: []string{"gpt-4o"}})
+	out, err := mw.Invoke(context.Background(), newInput())
 	require.NoError(t, err)
 	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionDeny, out.Decision, "absent model must be denied when the provider is restricted")
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "absent model must be denied when an allowlist is set")
 	assert.Equal(t, 403, out.DenyStatus, "deny status must be 403")
 	require.NotNil(t, out.DenyReason, "deny reason must be populated")
 	assert.Equal(t, "llm_policy.model_unknown", out.DenyReason.Code, "deny code must be model_unknown")
@@ -142,86 +122,26 @@ func TestAllowlistMissingModelKeyDenies(t *testing.T) {
 
 func TestAllowlistEmptyModelValueDenies(t *testing.T) {
 	// A present-but-empty model is as undeterminable as an absent one.
-	mw := New(providerCfg("gpt-4o"))
-	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+	mw := New(Config{ModelAllowlist: []string{"gpt-4o"}})
+	out, err := mw.Invoke(context.Background(), newInput(
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "   "},
 	))
 	require.NoError(t, err)
 	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionDeny, out.Decision, "empty model must be denied when the provider is restricted")
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "empty model must be denied when an allowlist is set")
 	require.NotNil(t, out.DenyReason, "deny reason must be populated")
 	assert.Equal(t, "llm_policy.model_unknown", out.DenyReason.Code, "deny code must be model_unknown")
 }
 
 func TestAllowlistEmptyListAllowsMissingModel(t *testing.T) {
-	// Without any provider allowlists there is nothing to enforce, so a missing
-	// model is still allowed — the fail-closed rule only applies when a
-	// restriction is in effect.
+	// Without an allowlist there is nothing to enforce, so a missing model is
+	// still allowed — the fail-closed rule only applies when a list is set.
 	mw := New(Config{})
 	out, err := mw.Invoke(context.Background(), newInput())
 	require.NoError(t, err)
 	assert.Equal(t, middleware.DecisionAllow, out.Decision, "no allowlist must allow even without a model")
 }
 
-func TestUnrestrictedProviderAllowsAnyModel(t *testing.T) {
-	// The request resolved to otherProvider, which has no allowlist, so its
-	// traffic must not be caught by testProvider's restriction — the
-	// cross-provider-leak / false-deny guard.
-	mw := New(providerCfg("gpt-4o"))
-	out, err := mw.Invoke(context.Background(), newInputProvider(otherProvider,
-		middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-opus-4"},
-	))
-	require.NoError(t, err)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision, "an unrestricted provider must not inherit another provider's allowlist")
-}
-
-func TestPerProviderAllowlistsAreIsolated(t *testing.T) {
-	// gpt-4o is allowed only on testProvider; claude-opus-4 only on
-	// otherProvider. A model allowlisted for one provider must not be usable on
-	// the other — the fail-closed layer never unions allowlists across providers.
-	mw := New(Config{ProviderAllowlists: map[string][]string{
-		testProvider:  {"gpt-4o"},
-		otherProvider: {"claude-opus-4"},
-	}})
-	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
-		middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-opus-4"},
-	))
-	require.NoError(t, err)
-	assert.Equal(t, middleware.DecisionDeny, out.Decision, "claude-opus-4 is allowed only on otherProvider, not testProvider")
-	require.NotNil(t, out.DenyReason)
-	assert.Equal(t, "llm_policy.model_blocked", out.DenyReason.Code, "cross-provider model must be blocked, not model_unknown")
-}
-
-func TestRestrictionsButNoResolvedProviderFailsClosed(t *testing.T) {
-	// Restrictions exist for the account but the resolved provider id is absent,
-	// so the request cannot be scoped to a provider. Fail closed rather than
-	// wave it through.
-	mw := New(providerCfg("gpt-4o"))
-	out, err := mw.Invoke(context.Background(), newInput(
-		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
-	))
-	require.NoError(t, err)
-	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionDeny, out.Decision, "missing resolved provider must fail closed when restrictions exist")
-	require.NotNil(t, out.DenyReason)
-	assert.Equal(t, "llm_policy.model_unknown", out.DenyReason.Code, "deny code must be model_unknown")
-}
-
-func TestEnabledButEmptyAllowlistDeniesEveryModel(t *testing.T) {
-	// An allowlist-enabled provider with zero models is distinct from an
-	// unrestricted (absent) provider: it must deny every model, not allow
-	// everything through.
-	mw := New(providerCfg())
-	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
-		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
-	))
-	require.NoError(t, err)
-	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionDeny, out.Decision, "an enabled-but-empty allowlist must deny every model")
-	require.NotNil(t, out.DenyReason)
-	assert.Equal(t, "llm_policy.model_blocked", out.DenyReason.Code, "deny code must be model_blocked, not model_unknown")
-}
-
 func TestPromptCaptureDisabledEmitsNoPrompt(t *testing.T) {
 	mw := New(Config{})
 	out, err := mw.Invoke(context.Background(), newInput(
@@ -297,8 +217,8 @@ func TestFactoryAcceptsZeroConfigs(t *testing.T) {
 
 func TestFactoryDecodesValidConfig(t *testing.T) {
 	cfg := Config{
-		ProviderAllowlists: map[string][]string{testProvider: {"gpt-4o"}},
-		PromptCapture:      PromptCapture{Enabled: true, RedactPii: true},
+		ModelAllowlist: []string{"gpt-4o"},
+		PromptCapture:  PromptCapture{Enabled: true, RedactPii: true},
 	}
 	raw, err := json.Marshal(cfg)
 	require.NoError(t, err, "marshalling test config must succeed")
@@ -313,33 +233,16 @@ func TestFactoryRejectsMalformedJSON(t *testing.T) {
 	assert.Nil(t, mw, "no middleware must be returned on malformed config")
 }
 
-func TestFactoryAllEmptyEntriesDenyEveryModel(t *testing.T) {
-	// All the provider's allowlist entries are blank/whitespace-only. They must
-	// collapse to a non-nil empty list (deny everything for that provider),
-	// not to "no restriction" for the provider.
-	raw := []byte(`{"provider_allowlists":{"prov-1":["","   "]}}`)
-	mw, err := Factory{}.New(raw)
-	require.NoError(t, err)
-	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
-		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
-	))
-	require.NoError(t, err)
-	require.NotNil(t, out)
-	assert.Equal(t, middleware.DecisionDeny, out.Decision, "all-blank allowlist entries must still restrict the provider")
-	require.NotNil(t, out.DenyReason)
-	assert.Equal(t, "llm_policy.model_blocked", out.DenyReason.Code, "deny code must be model_blocked, confirming the provider is treated as restricted-to-none")
-}
-
 func TestFactoryNormalisesAllowlist(t *testing.T) {
-	raw := []byte(`{"provider_allowlists":{"prov-1":["  GPT-4o  ","",""," Claude-3 "]}}`)
+	raw := []byte(`{"model_allowlist":["  GPT-4o  ","",""," Claude-3 "]}`)
 	mw, err := Factory{}.New(raw)
 	require.NoError(t, err)
-	out, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+	out, err := mw.Invoke(context.Background(), newInput(
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
 	))
 	require.NoError(t, err)
 	assert.Equal(t, middleware.DecisionAllow, out.Decision, "factory must lowercase + trim allowlist entries")
-	out2, err := mw.Invoke(context.Background(), newInputProvider(testProvider,
+	out2, err := mw.Invoke(context.Background(), newInput(
 		middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-3"},
 	))
 	require.NoError(t, err)

release_files/freebsd-port-diff.sh

@@ -3,8 +3,8 @@
 # FreeBSD Port Diff Generator for NetBird
 #
 # This script generates the diff file required for submitting a FreeBSD port update.
-# It works on macOS, Linux, and FreeBSD by fetching files from the FreeBSD ports
-# GitHub mirror and computing checksums from the Go module proxy.
+# It works on macOS, Linux, and FreeBSD by fetching files from FreeBSD cgit and
+# computing checksums from the Go module proxy.
 #
 # Usage: ./freebsd-port-diff.sh [new_version]
 # Example: ./freebsd-port-diff.sh 0.60.7
@@ -14,7 +14,7 @@
 set -e
 
 GITHUB_REPO="netbirdio/netbird"
-PORTS_MIRROR_BASE="https://raw.githubusercontent.com/freebsd/freebsd-ports/main/security/netbird"
+PORTS_CGIT_BASE="https://cgit.freebsd.org/ports/plain/security/netbird"
 GO_PROXY="https://proxy.golang.org/github.com/netbirdio/netbird/@v"
 OUTPUT_DIR="${OUTPUT_DIR:-.}"
 AWK_FIRST_FIELD='{print $1}'
@@ -30,17 +30,10 @@ fetch_all_tags() {
 
 fetch_current_ports_version() {
     echo "Fetching current version from FreeBSD ports..." >&2
-    local makefile version
-    makefile=$(fetch_ports_file "Makefile") || return 1
-    version=$(echo "$makefile" | \
+    curl -sL "${PORTS_CGIT_BASE}/Makefile" 2>/dev/null | \
         grep -E "^DISTVERSION=" | \
         sed 's/DISTVERSION=[[:space:]]*//' | \
-        tr -d '\t ')
-    if [[ -z "$version" ]]; then
-        echo "Error: Could not extract DISTVERSION from ports Makefile" >&2
-        return 1
-    fi
-    echo "$version"
+        tr -d '\t '
     return 0
 }
 
@@ -52,16 +45,7 @@ fetch_latest_github_release() {
 
 fetch_ports_file() {
     local filename="$1"
-    local content
-    if ! content=$(curl -fsL --proto '=https' --proto-redir '=https' --retry 3 "${PORTS_MIRROR_BASE}/${filename}" 2>/dev/null); then
-        echo "Error: Could not fetch ${filename} from ${PORTS_MIRROR_BASE}" >&2
-        return 1
-    fi
-    if [[ "$content" == \<* ]]; then
-        echo "Error: Received HTML instead of ${filename} from ${PORTS_MIRROR_BASE}" >&2
-        return 1
-    fi
-    printf '%s' "$content"
+    curl -sL "${PORTS_CGIT_BASE}/${filename}" 2>/dev/null
     return 0
 }
 

release_files/freebsd-port-issue-body.sh

@@ -9,22 +9,18 @@
 # Example: ./freebsd-port-issue-body.sh 0.56.0 0.59.1
 #
 # If no versions are provided, the script will:
-#   - Fetch OLD version from the FreeBSD ports GitHub mirror (current version in ports tree)
+#   - Fetch OLD version from FreeBSD ports cgit (current version in ports tree)
 #   - Fetch NEW version from latest NetBird GitHub release tag
 
 set -e
 
 GITHUB_REPO="netbirdio/netbird"
-PORTS_MAKEFILE_URL="https://raw.githubusercontent.com/freebsd/freebsd-ports/main/security/netbird/Makefile"
+PORTS_CGIT_URL="https://cgit.freebsd.org/ports/plain/security/netbird/Makefile"
 
 fetch_current_ports_version() {
     echo "Fetching current version from FreeBSD ports..." >&2
     local makefile_content
-    makefile_content=$(curl -fsL --proto '=https' --proto-redir '=https' --retry 3 "$PORTS_MAKEFILE_URL" 2>/dev/null) || makefile_content=""
-    if [[ "$makefile_content" == \<* ]]; then
-        echo "Error: Received HTML instead of Makefile from ${PORTS_MAKEFILE_URL}" >&2
-        return 1
-    fi
+    makefile_content=$(curl -sL "$PORTS_CGIT_URL" 2>/dev/null)
     if [[ -z "$makefile_content" ]]; then
         echo "Error: Could not fetch Makefile from FreeBSD ports" >&2
         return 1

shared/management/client/grpc.go

@@ -187,16 +187,16 @@ func (c *GrpcClient) ready() bool {
 // Sync wraps the real client's Sync endpoint call and takes care of retries and encryption/decryption of messages
 // Blocking request. The result will be sent via msgHandler callback function
 func (c *GrpcClient) Sync(ctx context.Context, sysInfo *system.Info, msgHandler func(msg *proto.SyncResponse) error) error {
-	return c.withMgmtStream(ctx, func(ctx context.Context, serverPubKey wgtypes.Key, backOff backoff.BackOff) error {
-		return c.handleSyncStream(ctx, serverPubKey, sysInfo, msgHandler, backOff)
+	return c.withMgmtStream(ctx, func(ctx context.Context, serverPubKey wgtypes.Key) error {
+		return c.handleSyncStream(ctx, serverPubKey, sysInfo, msgHandler)
 	})
 }
 
 // Job wraps the real client's Job endpoint call and takes care of retries and encryption/decryption of messages
 // Blocking request. The result will be sent via msgHandler callback function
 func (c *GrpcClient) Job(ctx context.Context, msgHandler func(msg *proto.JobRequest) *proto.JobResponse) error {
-	return c.withMgmtStream(ctx, func(ctx context.Context, serverPubKey wgtypes.Key, backOff backoff.BackOff) error {
-		return c.handleJobStream(ctx, serverPubKey, msgHandler, backOff)
+	return c.withMgmtStream(ctx, func(ctx context.Context, serverPubKey wgtypes.Key) error {
+		return c.handleJobStream(ctx, serverPubKey, msgHandler)
 	})
 }
 
@@ -204,7 +204,7 @@ func (c *GrpcClient) Job(ctx context.Context, msgHandler func(msg *proto.JobRequ
 // It takes care of retries, connection readiness, and fetching server public key.
 func (c *GrpcClient) withMgmtStream(
 	ctx context.Context,
-	handler func(ctx context.Context, serverPubKey wgtypes.Key, backOff backoff.BackOff) error,
+	handler func(ctx context.Context, serverPubKey wgtypes.Key) error,
 ) error {
 	backOff := defaultBackoff(ctx)
 	operation := func() error {
@@ -224,7 +224,7 @@ func (c *GrpcClient) withMgmtStream(
 			return err
 		}
 
-		return handler(ctx, *serverPubKey, backOff)
+		return handler(ctx, *serverPubKey)
 	}
 
 	err := backoff.Retry(operation, backOff)
@@ -239,7 +239,6 @@ func (c *GrpcClient) handleJobStream(
 	ctx context.Context,
 	serverPubKey wgtypes.Key,
 	msgHandler func(msg *proto.JobRequest) *proto.JobResponse,
-	backOff backoff.BackOff,
 ) error {
 	ctx, cancelStream := context.WithCancel(ctx)
 	defer cancelStream()
@@ -257,19 +256,6 @@ func (c *GrpcClient) handleJobStream(
 
 	log.Debug("job stream handshake sent successfully")
 
-	// The stream is up, so reset the backoff. This matters for two reasons,
-	// both caused by the backoff lib not resetting its state on a successful
-	// connection:
-	//  1. Without a reset, after a connect followed by an error the next retry
-	//     starts from the accumulated (large) interval instead of retrying
-	//     promptly, delaying reconnection.
-	//  2. Worse, once the accumulated elapsed time exceeds MaxElapsedTime, the
-	//     next stream error makes NextBackOff() return Stop, so the retry loop
-	//     exits immediately. That error is then mislabeled unrecoverable and
-	//     bubbles up to trigger a full engine restart / data-plane teardown
-	//     instead of a silent reconnection.
-	backOff.Reset()
-
 	// Main loop: receive, process, respond
 	for {
 		jobReq, err := c.receiveJobRequest(ctx, stream, serverPubKey)
@@ -385,7 +371,7 @@ func (c *GrpcClient) sendJobResponse(
 	return nil
 }
 
-func (c *GrpcClient) handleSyncStream(ctx context.Context, serverPubKey wgtypes.Key, sysInfo *system.Info, msgHandler func(msg *proto.SyncResponse) error, backOff backoff.BackOff) error {
+func (c *GrpcClient) handleSyncStream(ctx context.Context, serverPubKey wgtypes.Key, sysInfo *system.Info, msgHandler func(msg *proto.SyncResponse) error) error {
 	ctx, cancelStream := context.WithCancel(ctx)
 	defer cancelStream()
 
@@ -404,19 +390,6 @@ func (c *GrpcClient) handleSyncStream(ctx context.Context, serverPubKey wgtypes.
 	c.notifyConnected()
 	c.setSyncStreamConnected()
 
-	// The stream is up, so reset the backoff. This matters for two reasons,
-	// both caused by the backoff lib not resetting its state on a successful
-	// connection:
-	//  1. Without a reset, after a connect followed by an error the next retry
-	//     starts from the accumulated (large) interval instead of retrying
-	//     promptly, delaying reconnection.
-	//  2. Worse, once the accumulated elapsed time exceeds MaxElapsedTime, the
-	//     next stream error makes NextBackOff() return Stop, so the retry loop
-	//     exits immediately. That error is then mislabeled unrecoverable and
-	//     bubbles up to trigger a full engine restart / data-plane teardown
-	//     instead of a silent reconnection.
-	backOff.Reset()
-
 	// blocking until error
 	err = c.receiveUpdatesEvents(stream, serverPubKey, msgHandler)
 	if err != nil {

shared/management/networkmap/decode.go

@@ -11,6 +11,9 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	nbdns "github.com/netbirdio/netbird/dns"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
+	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	nbroute "github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/shared/management/proto"
@@ -35,17 +38,17 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 		Network:             decodeAccountNetwork(full.Network),
 		AccountSettings:     decodeAccountSettings(full.AccountSettings),
 		CustomZoneDomain:    full.CustomZoneDomain,
-		Peers:               make(map[string]*types.ComponentPeer, len(full.Peers)),
-		Groups:              make(map[string]*types.ComponentGroup, len(full.Groups)),
+		Peers:               make(map[string]*nbpeer.Peer, len(full.Peers)),
+		Groups:              make(map[string]*types.Group, len(full.Groups)),
 		Policies:            make([]*types.Policy, 0, len(full.Policies)),
 		Routes:              make([]*nbroute.Route, 0, len(full.Routes)),
 		NameServerGroups:    make([]*nbdns.NameServerGroup, 0, len(full.NameserverGroups)),
 		AllDNSRecords:       decodeSimpleRecords(full.AllDnsRecords),
 		AccountZones:        decodeCustomZones(full.AccountZones),
 		ResourcePoliciesMap: make(map[string][]*types.Policy),
-		RoutersMap:          make(map[string]map[string]*types.ComponentRouter),
-		NetworkResources:    make([]*types.ComponentResource, 0, len(full.NetworkResources)),
-		RouterPeers:         make(map[string]*types.ComponentPeer),
+		RoutersMap:          make(map[string]map[string]*routerTypes.NetworkRouter),
+		NetworkResources:    make([]*resourceTypes.NetworkResource, 0, len(full.NetworkResources)),
+		RouterPeers:         make(map[string]*nbpeer.Peer),
 		AllowedUserIDs:      stringSliceToSet(full.AllowedUserIds),
 		PostureFailedPeers:  make(map[string]map[string]struct{}, len(full.PostureFailedPeers)),
 		GroupIDToUserIDs:    make(map[string][]string, len(full.GroupIdToUserIds)),
@@ -98,7 +101,7 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 				log.WithField("peer idx", idx).Error("unrecognized peer idx during decoding")
 			}
 		}
-		group := &types.ComponentGroup{
+		group := &types.Group{
 			ID:       groupID,
 			PublicID: gc.Id,
 			Peers:    peerIDs,
@@ -148,7 +151,7 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 	// Phase 7: routers_map (outer key = network seq id, inner key = peer-id
 	// reconstructed from peer_index). Synthesized network id is "net_<seq>".
 	for networkID, list := range full.RoutersMap {
-		inner := make(map[string]*types.ComponentRouter, len(list.Entries))
+		inner := make(map[string]*routerTypes.NetworkRouter, len(list.Entries))
 		for _, entry := range list.Entries {
 			if !entry.PeerIndexSet {
 				continue
@@ -158,7 +161,8 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 				continue
 			}
 			peerID := peerIDByIndex[entry.PeerIndex]
-			inner[peerID] = &types.ComponentRouter{
+			inner[peerID] = &routerTypes.NetworkRouter{
+				ID:         "",
 				NetworkID:  networkID,
 				PublicID:   entry.Id,
 				Peer:       peerID,
@@ -260,22 +264,40 @@ func decodeAccountSettings(as *proto.AccountSettingsCompact) *types.AccountSetti
 	}
 }
 
-func decodePeerCompact(pc *proto.PeerCompact, peerID string) *types.ComponentPeer {
-	peer := &types.ComponentPeer{
+func decodePeerCompact(pc *proto.PeerCompact, peerID string) *nbpeer.Peer {
+	var caps []int32
+	if pc.SupportsSourcePrefixes {
+		caps = append(caps, nbpeer.PeerCapabilitySourcePrefixes)
+	}
+	if pc.SupportsIpv6 {
+		caps = append(caps, nbpeer.PeerCapabilityIPv6Overlay)
+	}
+	peer := &nbpeer.Peer{
 		ID:                     peerID,
 		Key:                    peerID,
 		SSHKey:                 string(pc.SshPubKey),
 		SSHEnabled:             pc.SshEnabled,
 		DNSLabel:               pc.DnsLabel,
 		LoginExpirationEnabled: pc.LoginExpirationEnabled,
-		AgentVersion:           pc.AgentVersion,
-		SupportsSourcePrefixes: pc.SupportsSourcePrefixes,
-		SupportsIPv6:           pc.SupportsIpv6,
-		ServerSSHAllowed:       pc.ServerSshAllowed,
-		AddedWithSSOLogin:      pc.AddedWithSsoLogin,
+		Meta: nbpeer.PeerSystemMeta{
+			WtVersion:    pc.AgentVersion,
+			Capabilities: caps,
+			Flags: nbpeer.Flags{
+				ServerSSHAllowed: pc.ServerSshAllowed,
+			},
+		},
+	}
+	if pc.AddedWithSsoLogin {
+		// Set a non-empty UserID so (*Peer).AddedWithSSOLogin() returns true.
+		// The original UserID isn't on the wire; the value is intentionally
+		// visibly synthetic so any future consumer that mistakes UserID for a
+		// real account user xid won't silently match (or worse, write the
+		// sentinel into a downstream record).
+		peer.UserID = "<env-sso>"
 	}
 	if pc.LastLoginUnixNano != 0 {
-		peer.LastLogin = time.Unix(0, pc.LastLoginUnixNano)
+		t := time.Unix(0, pc.LastLoginUnixNano)
+		peer.LastLogin = &t
 	}
 	switch len(pc.Ip) {
 	case 4:
@@ -402,14 +424,14 @@ func decodeNameServerGroupRaw(nsg *proto.NameServerGroupRaw) *nbdns.NameServerGr
 	return out
 }
 
-func decodeNetworkResource(nr *proto.NetworkResourceRaw) *types.ComponentResource {
-	out := &types.ComponentResource{
+func decodeNetworkResource(nr *proto.NetworkResourceRaw) *resourceTypes.NetworkResource {
+	out := &resourceTypes.NetworkResource{
 		ID:          nr.Id,
 		PublicID:    nr.Id,
 		NetworkID:   nr.NetworkSeq,
 		Name:        nr.Name,
 		Description: nr.Description,
-		Type:        types.ComponentResourceType(nr.Type),
+		Type:        resourceTypes.NetworkResourceType(nr.Type),
 		Address:     nr.Address,
 		Domain:      nr.DomainValue,
 		Enabled:     nr.Enabled,

shared/management/networkmap/encode.go

@@ -20,9 +20,10 @@ import (
 	nbdns "github.com/netbirdio/netbird/dns"
 	"net/netip"
 
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/shared/management/types"
 	nbroute "github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/proto"
-	"github.com/netbirdio/netbird/shared/management/types"
 	"github.com/netbirdio/netbird/shared/netiputil"
 	"github.com/netbirdio/netbird/shared/sshauth"
 )
@@ -273,7 +274,7 @@ func ToProtocolDNSConfig(update nbdns.Config, cache DNSConfigCache, forwardPort
 
 // AppendRemotePeerConfig appends typed peers as proto.RemotePeerConfig
 // entries to dst and returns the result.
-func AppendRemotePeerConfig(dst []*proto.RemotePeerConfig, peers []*types.ComponentPeer, dnsName string, includeIPv6 bool) []*proto.RemotePeerConfig {
+func AppendRemotePeerConfig(dst []*proto.RemotePeerConfig, peers []*nbpeer.Peer, dnsName string, includeIPv6 bool) []*proto.RemotePeerConfig {
 	for _, rPeer := range peers {
 		allowedIPs := []string{rPeer.IP.String() + "/32"}
 		if includeIPv6 && rPeer.IPv6.IsValid() {
@@ -284,7 +285,7 @@ func AppendRemotePeerConfig(dst []*proto.RemotePeerConfig, peers []*types.Compon
 			AllowedIps:   allowedIPs,
 			SshConfig:    &proto.SSHConfig{SshPubKey: []byte(rPeer.SSHKey)},
 			Fqdn:         rPeer.FQDN(dnsName),
-			AgentVersion: rPeer.AgentVersion,
+			AgentVersion: rPeer.Meta.WtVersion,
 		})
 	}
 	return dst

shared/management/networkmap/envelope.go

@@ -54,8 +54,8 @@ func EnvelopeToNetworkMap(ctx context.Context, env *proto.NetworkMapEnvelope, lo
 	}
 	components.PeerID = canonicalKey
 
-	includeIPv6 := localPeer.SupportsIPv6 && localPeer.IPv6.IsValid()
-	useSourcePrefixes := localPeer.SupportsSourcePrefixes
+	includeIPv6 := localPeer.SupportsIPv6() && localPeer.IPv6.IsValid()
+	useSourcePrefixes := localPeer.SupportsSourcePrefixes()
 
 	typedNM := components.Calculate(ctx)
 

shared/management/networkmap/envelope_test.go

@@ -13,6 +13,7 @@ import (
 	goproto "google.golang.org/protobuf/proto"
 
 	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/types"
 	nbnetworkmap "github.com/netbirdio/netbird/shared/management/networkmap"
 	"github.com/netbirdio/netbird/shared/management/proto"
@@ -143,14 +144,14 @@ func TestDecodeEnvelope_MalformedWgKeyPeerSkipped(t *testing.T) {
 func TestEnvelopeRoundTrip_AllGroupShortCircuitParity(t *testing.T) {
 	ctx := context.Background()
 
-	peers := map[string]*types.ComponentPeer{}
+	peers := map[string]*nbpeer.Peer{}
 	for i, id := range []string{"peer-T", "peer-S", "peer-ALL", "peer-O"} {
-		peers[id] = &types.ComponentPeer{
-			ID:           id,
-			Key:          randomWgKey(t),
-			IP:           netip.AddrFrom4([4]byte{100, 64, 0, byte(i + 1)}),
-			DNSLabel:     id,
-			AgentVersion: "0.40.0",
+		peers[id] = &nbpeer.Peer{
+			ID:       id,
+			Key:      randomWgKey(t),
+			IP:       netip.AddrFrom4([4]byte{100, 64, 0, byte(i + 1)}),
+			DNSLabel: id,
+			Meta:     nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
 		}
 	}
 
@@ -164,7 +165,7 @@ func TestEnvelopeRoundTrip_AllGroupShortCircuitParity(t *testing.T) {
 		AccountSettings: &types.AccountSettingsInfo{},
 		DNSSettings:     &types.DNSSettings{},
 		Peers:           peers,
-		Groups: map[string]*types.ComponentGroup{
+		Groups: map[string]*types.Group{
 			"g-src": {ID: "g-src", PublicID: "1", Name: "staff", Peers: []string{"peer-T", "peer-S"}},
 			"g-all": {ID: "g-all", PublicID: "2", Name: "All", Peers: []string{"peer-ALL"}},
 			"g-two": {ID: "g-two", PublicID: "3", Name: "second", Peers: []string{"peer-T", "peer-O"}},
@@ -231,22 +232,22 @@ func buildSmokeComponents(t *testing.T) (*types.NetworkMapComponents, string) {
 	peerAKey := randomWgKey(t)
 	peerBKey := randomWgKey(t)
 
-	peerA := &types.ComponentPeer{
-		ID:           "peer-A",
-		Key:          peerAKey,
-		IP:           netip.AddrFrom4([4]byte{100, 64, 0, 1}),
-		DNSLabel:     "peerA",
-		AgentVersion: "0.40.0",
+	peerA := &nbpeer.Peer{
+		ID:       "peer-A",
+		Key:      peerAKey,
+		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 1}),
+		DNSLabel: "peerA",
+		Meta:     nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
 	}
-	peerB := &types.ComponentPeer{
-		ID:           "peer-B",
-		Key:          peerBKey,
-		IP:           netip.AddrFrom4([4]byte{100, 64, 0, 2}),
-		DNSLabel:     "peerB",
-		AgentVersion: "0.40.0",
+	peerB := &nbpeer.Peer{
+		ID:       "peer-B",
+		Key:      peerBKey,
+		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 2}),
+		DNSLabel: "peerB",
+		Meta:     nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
 	}
 
-	group := &types.ComponentGroup{
+	group := &types.Group{
 		ID: "group-all", PublicID: "1", Name: "All",
 		Peers: []string{"peer-A", "peer-B"},
 	}
@@ -273,11 +274,11 @@ func buildSmokeComponents(t *testing.T) (*types.NetworkMapComponents, string) {
 		},
 		AccountSettings: &types.AccountSettingsInfo{},
 		DNSSettings:     &types.DNSSettings{},
-		Peers: map[string]*types.ComponentPeer{
+		Peers: map[string]*nbpeer.Peer{
 			"peer-A": peerA,
 			"peer-B": peerB,
 		},
-		Groups: map[string]*types.ComponentGroup{
+		Groups: map[string]*types.Group{
 			"group-all": group,
 		},
 		Policies: []*types.Policy{policy},

shared/management/types/component_types.go

@@ -1,103 +0,0 @@
-package types
-
-import (
-	"net/netip"
-	"time"
-)
-
-// ComponentPeer is the self-contained peer representation used by
-// NetworkMapComponents and the calculated NetworkMap. It carries exactly the
-// subset of peer data that crosses the components wire format, so the shared
-// calculation layer stays independent of the management server's domain
-// types.
-type ComponentPeer struct {
-	ID                     string
-	Key                    string
-	IP                     netip.Addr
-	IPv6                   netip.Addr
-	DNSLabel               string
-	SSHKey                 string
-	SSHEnabled             bool
-	ServerSSHAllowed       bool
-	AgentVersion           string
-	SupportsSourcePrefixes bool
-	SupportsIPv6           bool
-	LoginExpirationEnabled bool
-	AddedWithSSOLogin      bool
-	LastLogin              time.Time
-}
-
-// FQDN returns the peer's FQDN combined of the peer's DNS label and the system's DNS domain.
-func (p *ComponentPeer) FQDN(dnsDomain string) string {
-	if dnsDomain == "" {
-		return ""
-	}
-	return p.DNSLabel + "." + dnsDomain
-}
-
-// LoginExpired indicates whether the peer's login has expired, mirroring the
-// server-side peer semantics: only SSO-added peers with login expiration
-// enabled can expire.
-func (p *ComponentPeer) LoginExpired(expiresIn time.Duration) (bool, time.Duration) {
-	if !p.AddedWithSSOLogin || !p.LoginExpirationEnabled {
-		return false, 0
-	}
-	timeLeft := time.Until(p.LastLogin.Add(expiresIn))
-	return timeLeft <= 0, timeLeft
-}
-
-// GroupAllName is the reserved name of the default group that contains every peer in an account.
-const GroupAllName = "All"
-
-// ComponentGroup is the self-contained group representation used by
-// NetworkMapComponents: just the membership view the network-map calculation
-// needs, without the server's storage fields.
-type ComponentGroup struct {
-	ID       string
-	PublicID string
-	Name     string
-	Peers    []string
-}
-
-// IsGroupAll checks if the group is a default "All" group.
-func (g *ComponentGroup) IsGroupAll() bool {
-	return g.Name == GroupAllName
-}
-
-// ComponentRouter is the self-contained network-router representation used by
-// NetworkMapComponents.
-type ComponentRouter struct {
-	NetworkID  string
-	PublicID   string
-	Peer       string
-	PeerGroups []string
-	Masquerade bool
-	Metric     int
-	Enabled    bool
-}
-
-// ComponentResourceType mirrors the network-resource type enum on the
-// components wire format.
-type ComponentResourceType string
-
-const (
-	ComponentResourceHost   ComponentResourceType = "host"
-	ComponentResourceSubnet ComponentResourceType = "subnet"
-	ComponentResourceDomain ComponentResourceType = "domain"
-)
-
-// ComponentResource is the self-contained network-resource representation
-// used by NetworkMapComponents.
-type ComponentResource struct {
-	ID          string
-	PublicID    string
-	NetworkID   string
-	AccountID   string
-	Name        string
-	Description string
-	Type        ComponentResourceType
-	Address     string
-	Domain      string
-	Prefix      netip.Prefix
-	Enabled     bool
-}

shared/management/types/firewall_helpers.go

@@ -3,6 +3,8 @@ package types
 import (
 	"strconv"
 
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/version"
 )
 
@@ -46,8 +48,8 @@ func portsIncludesSSH(ports []string) bool {
 }
 
 // ExpandPortsAndRanges expands Ports and PortRanges of a rule into individual firewall rules.
-func ExpandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *ComponentPeer) []*FirewallRule {
-	features := peerSupportedFirewallFeatures(peer.AgentVersion)
+func ExpandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *nbpeer.Peer) []*FirewallRule {
+	features := peerSupportedFirewallFeatures(peer.Meta.WtVersion)
 
 	var expanded []*FirewallRule
 
@@ -104,8 +106,8 @@ func isPortInRule(portString string, portInt uint16, rule *FirewallRule) bool {
 	return rule.Port == portString || (rule.PortRange.Start <= portInt && portInt <= rule.PortRange.End)
 }
 
-func shouldCheckRulesForNativeSSH(supportsNative bool, rule *PolicyRule, peer *ComponentPeer) bool {
-	return supportsNative && peer.SSHEnabled && peer.ServerSSHAllowed && rule.Protocol == PolicyRuleProtocolTCP
+func shouldCheckRulesForNativeSSH(supportsNative bool, rule *PolicyRule, peer *nbpeer.Peer) bool {
+	return supportsNative && peer.SSHEnabled && peer.Meta.Flags.ServerSSHAllowed && rule.Protocol == PolicyRuleProtocolTCP
 }
 
 func peerSupportedFirewallFeatures(peerVer string) supportedFeatures {
@@ -115,13 +117,13 @@ func peerSupportedFirewallFeatures(peerVer string) supportedFeatures {
 
 	var features supportedFeatures
 
-	meetMinVer, err := version.MeetsMinVersion(firewallRuleMinNativeSSHVer, peerVer)
+	meetMinVer, err := posture.MeetsMinVersion(firewallRuleMinNativeSSHVer, peerVer)
 	features.nativeSSH = err == nil && meetMinVer
 
 	if features.nativeSSH {
 		features.portRanges = true
 	} else {
-		meetMinVer, err = version.MeetsMinVersion(firewallRuleMinPortRangesVer, peerVer)
+		meetMinVer, err = posture.MeetsMinVersion(firewallRuleMinPortRangesVer, peerVer)
 		features.portRanges = err == nil && meetMinVer
 	}
 

shared/management/types/firewall_rule.go

@@ -9,6 +9,7 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	nbroute "github.com/netbirdio/netbird/route"
 )
 
@@ -50,7 +51,7 @@ func (r *FirewallRule) Equal(other *FirewallRule) bool {
 // For static routes, source ranges match the destination family (v4 or v6).
 // For dynamic routes (domain-based), separate v4 and v6 rules are generated
 // so the routing peer's forwarding chain allows both address families.
-func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*ComponentPeer, direction int, includeIPv6 bool) []*RouteFirewallRule {
+func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int, includeIPv6 bool) []*RouteFirewallRule {
 	rulesExists := make(map[string]struct{})
 	rules := make([]*RouteFirewallRule, 0)
 
@@ -106,7 +107,7 @@ func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule
 }
 
 // splitPeerSourcesByFamily separates peer IPs into v4 (/32) and v6 (/128) source ranges.
-func splitPeerSourcesByFamily(groupPeers []*ComponentPeer) (v4, v6 []string) {
+func splitPeerSourcesByFamily(groupPeers []*nbpeer.Peer) (v4, v6 []string) {
 	v4 = make([]string, 0, len(groupPeers))
 	v6 = make([]string, 0, len(groupPeers))
 	for _, peer := range groupPeers {

shared/management/types/firewall_rule_test.go

@@ -8,12 +8,13 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
 func TestSplitPeerSourcesByFamily(t *testing.T) {
-	peers := []*ComponentPeer{
+	peers := []*nbpeer.Peer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -35,7 +36,7 @@ func TestSplitPeerSourcesByFamily(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_V4Route(t *testing.T) {
-	peers := []*ComponentPeer{
+	peers := []*nbpeer.Peer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -64,7 +65,7 @@ func TestGenerateRouteFirewallRules_V4Route(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_V6Route(t *testing.T) {
-	peers := []*ComponentPeer{
+	peers := []*nbpeer.Peer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -92,7 +93,7 @@ func TestGenerateRouteFirewallRules_V6Route(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_DynamicRoute_DualStack(t *testing.T) {
-	peers := []*ComponentPeer{
+	peers := []*nbpeer.Peer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -125,7 +126,7 @@ func TestGenerateRouteFirewallRules_DynamicRoute_DualStack(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_DynamicRoute_NoV6Peers(t *testing.T) {
-	peers := []*ComponentPeer{
+	peers := []*nbpeer.Peer{
 		{IP: netip.MustParseAddr("100.64.0.1")},
 		{IP: netip.MustParseAddr("100.64.0.2")},
 	}
@@ -149,7 +150,7 @@ func TestGenerateRouteFirewallRules_DynamicRoute_NoV6Peers(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_IncludeIPv6False(t *testing.T) {
-	peers := []*ComponentPeer{
+	peers := []*nbpeer.Peer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),

shared/management/types/group.go

@@ -2,6 +2,7 @@ package types
 
 import (
 	"github.com/netbirdio/netbird/management/server/integration_reference"
+	"github.com/netbirdio/netbird/management/server/networks/resources/types"
 )
 
 const (
@@ -67,6 +68,10 @@ func (g *Group) EventMeta() map[string]any {
 	return map[string]any{"name": g.Name}
 }
 
+func (g *Group) EventMetaResource(resource *types.NetworkResource) map[string]any {
+	return map[string]any{"name": g.Name, "id": g.ID, "resource_name": resource.Name, "resource_id": resource.ID, "resource_type": resource.Type}
+}
+
 func (g *Group) Copy() *Group {
 	group := &Group{
 		ID:                   g.ID,
@@ -90,39 +95,14 @@ func (g *Group) HasPeers() bool {
 	return len(g.Peers) > 0
 }
 
+// GroupAllName is the reserved name of the default group that contains every peer in an account.
+const GroupAllName = "All"
+
 // IsGroupAll checks if the group is a default "All" group.
 func (g *Group) IsGroupAll() bool {
 	return g.Name == GroupAllName
 }
 
-// ToComponent converts the group to its self-contained components
-// representation. The Peers slice is shared, not copied — components are
-// treated as immutable snapshots. Returns nil for a nil group.
-func (g *Group) ToComponent() *ComponentGroup {
-	if g == nil {
-		return nil
-	}
-	return &ComponentGroup{
-		ID:       g.ID,
-		PublicID: g.PublicID,
-		Name:     g.Name,
-		Peers:    g.Peers,
-	}
-}
-
-// GroupsToComponent converts an id-keyed group map to its components
-// representation, preserving nil entries.
-func GroupsToComponent(groups map[string]*Group) map[string]*ComponentGroup {
-	if groups == nil {
-		return nil
-	}
-	out := make(map[string]*ComponentGroup, len(groups))
-	for id, g := range groups {
-		out[id] = g.ToComponent()
-	}
-	return out
-}
-
 // AddPeer adds peerID to Peers if not present, returning true if added.
 func (g *Group) AddPeer(peerID string) bool {
 	if peerID == "" {

shared/management/types/network.go

@@ -15,6 +15,8 @@ import (
 	"golang.org/x/exp/maps"
 
 	nbdns "github.com/netbirdio/netbird/dns"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/util"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/status"
@@ -37,11 +39,11 @@ const (
 )
 
 type NetworkMap struct {
-	Peers               []*ComponentPeer
+	Peers               []*nbpeer.Peer
 	Network             *Network
 	Routes              []*route.Route
 	DNSConfig           nbdns.Config
-	OfflinePeers        []*ComponentPeer
+	OfflinePeers        []*nbpeer.Peer
 	FirewallRules       []*FirewallRule
 	RoutesFirewallRules []*RouteFirewallRule
 	ForwardingRules     []*ForwardingRule
@@ -51,46 +53,15 @@ type NetworkMap struct {
 
 func (nm *NetworkMap) Merge(other *NetworkMap) {
 	nm.Peers = mergeUniquePeersByID(nm.Peers, other.Peers)
-	nm.Routes = mergeUnique(nm.Routes, other.Routes)
+	nm.Routes = util.MergeUnique(nm.Routes, other.Routes)
 	nm.OfflinePeers = mergeUniquePeersByID(nm.OfflinePeers, other.OfflinePeers)
-	nm.FirewallRules = mergeUnique(nm.FirewallRules, other.FirewallRules)
-	nm.RoutesFirewallRules = mergeUnique(nm.RoutesFirewallRules, other.RoutesFirewallRules)
-	nm.ForwardingRules = mergeUnique(nm.ForwardingRules, other.ForwardingRules)
+	nm.FirewallRules = util.MergeUnique(nm.FirewallRules, other.FirewallRules)
+	nm.RoutesFirewallRules = util.MergeUnique(nm.RoutesFirewallRules, other.RoutesFirewallRules)
+	nm.ForwardingRules = util.MergeUnique(nm.ForwardingRules, other.ForwardingRules)
 }
 
-type comparableObject[T any] interface {
-	Equal(other T) bool
-}
-
-func mergeUnique[T comparableObject[T]](arr1, arr2 []T) []T {
-	var result []T
-
-	for _, item := range arr1 {
-		if !containsEqual(result, item) {
-			result = append(result, item)
-		}
-	}
-
-	for _, item := range arr2 {
-		if !containsEqual(result, item) {
-			result = append(result, item)
-		}
-	}
-
-	return result
-}
-
-func containsEqual[T comparableObject[T]](slice []T, element T) bool {
-	for _, item := range slice {
-		if item.Equal(element) {
-			return true
-		}
-	}
-	return false
-}
-
-func mergeUniquePeersByID(peers1, peers2 []*ComponentPeer) []*ComponentPeer {
-	result := make(map[string]*ComponentPeer)
+func mergeUniquePeersByID(peers1, peers2 []*nbpeer.Peer) []*nbpeer.Peer {
+	result := make(map[string]*nbpeer.Peer)
 	for _, peer := range peers1 {
 		result[peer.ID] = peer
 	}

shared/management/types/networkmap_components.go

@@ -12,6 +12,9 @@ import (
 
 	"github.com/netbirdio/netbird/client/ssh/auth"
 	nbdns "github.com/netbirdio/netbird/dns"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
+	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
@@ -24,22 +27,22 @@ type NetworkMapComponents struct {
 	DNSSettings      *DNSSettings
 	CustomZoneDomain string
 
-	Peers               map[string]*ComponentPeer
-	Groups              map[string]*ComponentGroup
+	Peers               map[string]*nbpeer.Peer
+	Groups              map[string]*Group
 	Policies            []*Policy
 	Routes              []*route.Route
 	NameServerGroups    []*nbdns.NameServerGroup
 	AllDNSRecords       []nbdns.SimpleRecord
 	AccountZones        []nbdns.CustomZone
 	ResourcePoliciesMap map[string][]*Policy
-	RoutersMap          map[string]map[string]*ComponentRouter
-	NetworkResources    []*ComponentResource
+	RoutersMap          map[string]map[string]*routerTypes.NetworkRouter
+	NetworkResources    []*resourceTypes.NetworkResource
 
 	GroupIDToUserIDs   map[string][]string
 	AllowedUserIDs     map[string]struct{}
 	PostureFailedPeers map[string]map[string]struct{}
 
-	RouterPeers map[string]*ComponentPeer
+	RouterPeers map[string]*nbpeer.Peer
 
 	// NetworkXIDToPublicID maps Network.ID (xid) → PublicID.
 	// Consumed by the envelope encoder to
@@ -75,15 +78,15 @@ func EmptyNetworkMapComponents(nm *NetworkMapComponents) *NetworkMapComponents {
 	return nm
 }
 
-func (c *NetworkMapComponents) GetPeerInfo(peerID string) *ComponentPeer {
+func (c *NetworkMapComponents) GetPeerInfo(peerID string) *nbpeer.Peer {
 	return c.Peers[peerID]
 }
 
-func (c *NetworkMapComponents) GetRouterPeerInfo(peerID string) *ComponentPeer {
+func (c *NetworkMapComponents) GetRouterPeerInfo(peerID string) *nbpeer.Peer {
 	return c.RouterPeers[peerID]
 }
 
-func (c *NetworkMapComponents) GetGroupInfo(groupID string) *ComponentGroup {
+func (c *NetworkMapComponents) GetGroupInfo(groupID string) *Group {
 	return c.Groups[groupID]
 }
 
@@ -139,7 +142,7 @@ func (c *NetworkMapComponents) Calculate(ctx context.Context) *NetworkMap {
 
 	includeIPv6 := false
 	if p := c.Peers[targetPeerID]; p != nil {
-		includeIPv6 = p.SupportsIPv6 && p.IPv6.IsValid()
+		includeIPv6 = p.SupportsIPv6() && p.IPv6.IsValid()
 	}
 	routesUpdate := filterAndExpandRoutes(c.getRoutesToSync(targetPeerID, peersToConnect, peerGroups), includeIPv6)
 	routesFirewallRules := c.getPeerRoutesFirewallRules(ctx, targetPeerID, includeIPv6)
@@ -197,7 +200,7 @@ func (c *NetworkMapComponents) IsEmpty() bool {
 	return c.empty
 }
 
-func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) ([]*ComponentPeer, []*FirewallRule, map[string]map[string]struct{}, bool) {
+func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) ([]*nbpeer.Peer, []*FirewallRule, map[string]map[string]struct{}, bool) {
 	targetPeer := c.GetPeerInfo(targetPeerID)
 	if targetPeer == nil {
 		return nil, nil, nil, false
@@ -217,7 +220,7 @@ func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) (
 				continue
 			}
 
-			var sourcePeers, destinationPeers []*ComponentPeer
+			var sourcePeers, destinationPeers []*nbpeer.Peer
 			var peerInSources, peerInDestinations bool
 
 			if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID != "" {
@@ -300,13 +303,13 @@ func (c *NetworkMapComponents) getAllowedUserIDs() map[string]struct{} {
 	return make(map[string]struct{})
 }
 
-func (c *NetworkMapComponents) connResourcesGenerator(targetPeer *ComponentPeer) (func(*PolicyRule, []*ComponentPeer, int), func() ([]*ComponentPeer, []*FirewallRule)) {
+func (c *NetworkMapComponents) connResourcesGenerator(targetPeer *nbpeer.Peer) (func(*PolicyRule, []*nbpeer.Peer, int), func() ([]*nbpeer.Peer, []*FirewallRule)) {
 	rulesExists := make(map[string]struct{})
 	peersExists := make(map[string]struct{})
 	rules := make([]*FirewallRule, 0)
-	peers := make([]*ComponentPeer, 0)
+	peers := make([]*nbpeer.Peer, 0)
 
-	return func(rule *PolicyRule, groupPeers []*ComponentPeer, direction int) {
+	return func(rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int) {
 			protocol := rule.Protocol
 			if protocol == PolicyRuleProtocolNetbirdSSH {
 				protocol = PolicyRuleProtocolTCP
@@ -358,15 +361,15 @@ func (c *NetworkMapComponents) connResourcesGenerator(targetPeer *ComponentPeer)
 					PortsJoined: portsJoined,
 				})
 			}
-		}, func() ([]*ComponentPeer, []*FirewallRule) {
+		}, func() ([]*nbpeer.Peer, []*FirewallRule) {
 			return peers, rules
 		}
 }
 
-func (c *NetworkMapComponents) getAllPeersFromGroups(groups []string, peerID string, sourcePostureChecksIDs []string) ([]*ComponentPeer, bool) {
+func (c *NetworkMapComponents) getAllPeersFromGroups(groups []string, peerID string, sourcePostureChecksIDs []string) ([]*nbpeer.Peer, bool) {
 	peerInGroups := false
 	uniquePeerIDs := c.getUniquePeerIDsFromGroupsIDs(groups)
-	filteredPeers := make([]*ComponentPeer, 0, len(uniquePeerIDs))
+	filteredPeers := make([]*nbpeer.Peer, 0, len(uniquePeerIDs))
 
 	for _, p := range uniquePeerIDs {
 		peerInfo := c.GetPeerInfo(p)
@@ -418,22 +421,22 @@ func (c *NetworkMapComponents) getUniquePeerIDsFromGroupsIDs(groups []string) []
 	return ids
 }
 
-func (c *NetworkMapComponents) getPeerFromResource(resource Resource, peerID string) ([]*ComponentPeer, bool) {
+func (c *NetworkMapComponents) getPeerFromResource(resource Resource, peerID string) ([]*nbpeer.Peer, bool) {
 	if resource.ID == peerID {
-		return []*ComponentPeer{}, true
+		return []*nbpeer.Peer{}, true
 	}
 
 	peerInfo := c.GetPeerInfo(resource.ID)
 	if peerInfo == nil {
-		return []*ComponentPeer{}, false
+		return []*nbpeer.Peer{}, false
 	}
 
-	return []*ComponentPeer{peerInfo}, false
+	return []*nbpeer.Peer{peerInfo}, false
 }
 
-func (c *NetworkMapComponents) filterPeersByLoginExpiration(aclPeers []*ComponentPeer) ([]*ComponentPeer, []*ComponentPeer) {
-	peersToConnect := make([]*ComponentPeer, 0, len(aclPeers))
-	var expiredPeers []*ComponentPeer
+func (c *NetworkMapComponents) filterPeersByLoginExpiration(aclPeers []*nbpeer.Peer) ([]*nbpeer.Peer, []*nbpeer.Peer) {
+	peersToConnect := make([]*nbpeer.Peer, 0, len(aclPeers))
+	var expiredPeers []*nbpeer.Peer
 
 	for _, p := range aclPeers {
 		expired, _ := p.LoginExpired(c.AccountSettings.PeerLoginExpiration)
@@ -515,7 +518,7 @@ func filterAndExpandRoutes(routes []*route.Route, includeIPv6 bool) []*route.Rou
 	return filtered
 }
 
-func (c *NetworkMapComponents) getRoutesToSync(peerID string, aclPeers []*ComponentPeer, peerGroups LookupMap) []*route.Route {
+func (c *NetworkMapComponents) getRoutesToSync(peerID string, aclPeers []*nbpeer.Peer, peerGroups LookupMap) []*route.Route {
 	routes, peerDisabledRoutes := c.getRoutingPeerRoutes(peerID)
 	peerRoutesMembership := make(LookupMap)
 	for _, r := range append(routes, peerDisabledRoutes...) {
@@ -729,7 +732,7 @@ func (c *NetworkMapComponents) getRouteFirewallRules(ctx context.Context, peerID
 	return fwRules
 }
 
-func (c *NetworkMapComponents) getRulePeers(rule *PolicyRule, postureChecks []string, peerID string, distributionPeers map[string]struct{}) []*ComponentPeer {
+func (c *NetworkMapComponents) getRulePeers(rule *PolicyRule, postureChecks []string, peerID string, distributionPeers map[string]struct{}) []*nbpeer.Peer {
 	distPeersWithPolicy := make(map[string]struct{})
 	for _, id := range rule.Sources {
 		group := c.GetGroupInfo(id)
@@ -756,7 +759,7 @@ func (c *NetworkMapComponents) getRulePeers(rule *PolicyRule, postureChecks []st
 		}
 	}
 
-	distributionGroupPeers := make([]*ComponentPeer, 0, len(distPeersWithPolicy))
+	distributionGroupPeers := make([]*nbpeer.Peer, 0, len(distPeersWithPolicy))
 	for pID := range distPeersWithPolicy {
 		peerInfo := c.GetPeerInfo(pID)
 		if peerInfo == nil {
@@ -796,8 +799,8 @@ func (c *NetworkMapComponents) getNetworkResourcesRoutesToSync(peerID string) (b
 
 func (c *NetworkMapComponents) processResourcePolicies(
 	peerID string,
-	resource *ComponentResource,
-	networkRoutingPeers map[string]*ComponentRouter,
+	resource *resourceTypes.NetworkResource,
+	networkRoutingPeers map[string]*routerTypes.NetworkRouter,
 	addSourcePeers bool,
 	allSourcePeers map[string]struct{},
 ) []*route.Route {
@@ -830,7 +833,7 @@ func (c *NetworkMapComponents) getResourcePolicyPeers(policy *Policy) []string {
 	return c.getUniquePeerIDsFromGroupsIDs(policy.SourceGroups())
 }
 
-func (c *NetworkMapComponents) getNetworkResourcesRoutes(resource *ComponentResource, peerID string, router *ComponentRouter) []*route.Route {
+func (c *NetworkMapComponents) getNetworkResourcesRoutes(resource *resourceTypes.NetworkResource, peerID string, router *routerTypes.NetworkRouter) []*route.Route {
 	resourceAppliedPolicies := c.ResourcePoliciesMap[resource.ID]
 
 	var routes []*route.Route
@@ -844,7 +847,7 @@ func (c *NetworkMapComponents) getNetworkResourcesRoutes(resource *ComponentReso
 	return routes
 }
 
-func (c *NetworkMapComponents) networkResourceToRoute(resource *ComponentResource, peer *ComponentPeer, router *ComponentRouter) *route.Route {
+func (c *NetworkMapComponents) networkResourceToRoute(resource *resourceTypes.NetworkResource, peer *nbpeer.Peer, router *routerTypes.NetworkRouter) *route.Route {
 	r := &route.Route{
 		ID:          route.ID(resource.ID + ":" + peer.ID),
 		AccountID:   resource.AccountID,
@@ -858,7 +861,7 @@ func (c *NetworkMapComponents) networkResourceToRoute(resource *ComponentResourc
 		Description: resource.Description,
 	}
 
-	if resource.Type == ComponentResourceHost || resource.Type == ComponentResourceSubnet {
+	if resource.Type == resourceTypes.Host || resource.Type == resourceTypes.Subnet {
 		r.Network = resource.Prefix
 
 		r.NetworkType = route.IPv4Network
@@ -867,7 +870,7 @@ func (c *NetworkMapComponents) networkResourceToRoute(resource *ComponentResourc
 		}
 	}
 
-	if resource.Type == ComponentResourceDomain {
+	if resource.Type == resourceTypes.Domain {
 		domainList, err := domain.FromStringList([]string{resource.Domain})
 		if err == nil {
 			r.Domains = domainList
@@ -945,11 +948,11 @@ func (c *NetworkMapComponents) getPoliciesSourcePeers(policies []*Policy) map[st
 func (c *NetworkMapComponents) addNetworksRoutingPeers(
 	networkResourcesRoutes []*route.Route,
 	peerID string,
-	peersToConnect []*ComponentPeer,
-	expiredPeers []*ComponentPeer,
+	peersToConnect []*nbpeer.Peer,
+	expiredPeers []*nbpeer.Peer,
 	isRouter bool,
 	sourcePeers map[string]struct{},
-) []*ComponentPeer {
+) []*nbpeer.Peer {
 
 	networkRoutesPeers := make(map[string]struct{}, len(networkResourcesRoutes))
 	for _, r := range networkResourcesRoutes {
@@ -999,8 +1002,8 @@ type FirewallRuleContext struct {
 	PortsJoined string
 }
 
-func AppendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *ComponentPeer, rule *PolicyRule, rc FirewallRuleContext) []*FirewallRule {
-	if !peer.IPv6.IsValid() || !targetPeer.SupportsIPv6 || !targetPeer.IPv6.IsValid() {
+func AppendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *nbpeer.Peer, rule *PolicyRule, rc FirewallRuleContext) []*FirewallRule {
+	if !peer.IPv6.IsValid() || !targetPeer.SupportsIPv6() || !targetPeer.IPv6.IsValid() {
 		return rules
 	}
 

shared/management/types/networkmap_components_compact.go

@@ -2,6 +2,9 @@ package types
 
 import (
 	nbdns "github.com/netbirdio/netbird/dns"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
+	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/route"
 )
 
@@ -18,7 +21,7 @@ type NetworkMapComponentsCompact struct {
 	DNSSettings      *DNSSettings
 	CustomZoneDomain string
 
-	AllPeers          []*ComponentPeer
+	AllPeers          []*nbpeer.Peer
 	PeerIndexes       []int
 	RouterPeerIndexes []int
 
@@ -31,8 +34,8 @@ type NetworkMapComponentsCompact struct {
 	AllDNSRecords       []nbdns.SimpleRecord
 	AccountZones        []nbdns.CustomZone
 
-	RoutersMap       map[string]map[string]*ComponentRouter
-	NetworkResources []*ComponentResource
+	RoutersMap       map[string]map[string]*routerTypes.NetworkRouter
+	NetworkResources []*resourceTypes.NetworkResource
 
 	GroupIDToUserIDs   map[string][]string
 	AllowedUserIDs     map[string]struct{}
@@ -41,7 +44,7 @@ type NetworkMapComponentsCompact struct {
 
 func (c *NetworkMapComponents) ToCompact() *NetworkMapComponentsCompact {
 	peerToIndex := make(map[string]int)
-	var allPeers []*ComponentPeer
+	var allPeers []*nbpeer.Peer
 
 	for id, peer := range c.Peers {
 		if _, exists := peerToIndex[id]; !exists {
@@ -147,7 +150,7 @@ func (c *NetworkMapComponents) ToCompact() *NetworkMapComponentsCompact {
 }
 
 func (c *NetworkMapComponentsCompact) ToFull() *NetworkMapComponents {
-	peers := make(map[string]*ComponentPeer, len(c.PeerIndexes))
+	peers := make(map[string]*nbpeer.Peer, len(c.PeerIndexes))
 	for _, idx := range c.PeerIndexes {
 		if idx >= 0 && idx < len(c.AllPeers) {
 			peer := c.AllPeers[idx]
@@ -155,7 +158,7 @@ func (c *NetworkMapComponentsCompact) ToFull() *NetworkMapComponents {
 		}
 	}
 
-	routerPeers := make(map[string]*ComponentPeer, len(c.RouterPeerIndexes))
+	routerPeers := make(map[string]*nbpeer.Peer, len(c.RouterPeerIndexes))
 	for _, idx := range c.RouterPeerIndexes {
 		if idx >= 0 && idx < len(c.AllPeers) {
 			peer := c.AllPeers[idx]
@@ -163,7 +166,7 @@ func (c *NetworkMapComponentsCompact) ToFull() *NetworkMapComponents {
 		}
 	}
 
-	groups := make(map[string]*ComponentGroup, len(c.Groups))
+	groups := make(map[string]*Group, len(c.Groups))
 	for id, gc := range c.Groups {
 		peerIDs := make([]string, 0, len(gc.PeerIndexes))
 		for _, idx := range gc.PeerIndexes {
@@ -171,7 +174,7 @@ func (c *NetworkMapComponentsCompact) ToFull() *NetworkMapComponents {
 				peerIDs = append(peerIDs, c.AllPeers[idx].ID)
 			}
 		}
-		groups[id] = &ComponentGroup{
+		groups[id] = &Group{
 			ID:    id,
 			Name:  gc.Name,
 			Peers: peerIDs,

sharedsock/sock_linux.go

@@ -24,7 +24,7 @@ import (
 )
 
 // ErrSharedSockStopped indicates that shared socket has been stopped
-var ErrSharedSockStopped = fmt.Errorf("shared socket stopped")
+var ErrSharedSockStopped = fmt.Errorf("shared socked stopped")
 
 // SharedSocket is a net.PacketConn that initiates two raw sockets (ipv4 and ipv6) and listens to UDP packets filtered
 // by BPF instructions (e.g., IncomingSTUNFilter that checks and sends only STUN packets to the listeners (ReadFrom)).

version/version.go

@@ -71,30 +71,6 @@ func NetbirdCommit() string {
 	return revision
 }
 
-// sanitizeVersion removes anything after the pre-release tag (e.g., "-dev", "-alpha", etc.)
-func sanitizeVersion(version string) string {
-	parts := strings.Split(version, "-")
-	return parts[0]
-}
-
-// MeetsMinVersion checks if the peer's version meets or exceeds the minimum required version
-func MeetsMinVersion(minVer, peerVer string) (bool, error) {
-	peerVer = sanitizeVersion(peerVer)
-	minVer = sanitizeVersion(minVer)
-
-	peerNBVer, err := v.NewVersion(peerVer)
-	if err != nil {
-		return false, err
-	}
-
-	constraints, err := v.NewConstraint(">= " + minVer)
-	if err != nil {
-		return false, err
-	}
-
-	return constraints.Check(peerNBVer), nil
-}
-
 // IsDevelopmentVersion reports whether the given version string identifies
 // a non-release / development build. It is the single source of truth for
 // "is this a dev build" checks across the codebase; use it instead of

version/version_test.go

@@ -1,10 +1,6 @@
 package version
 
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
+import "testing"
 
 func TestIsDevelopmentVersion(t *testing.T) {
 	tests := []struct {
@@ -30,68 +26,3 @@ func TestIsDevelopmentVersion(t *testing.T) {
 		})
 	}
 }
-
-func TestMeetsMinVersion(t *testing.T) {
-	tests := []struct {
-		name    string
-		minVer  string
-		peerVer string
-		want    bool
-		wantErr bool
-	}{
-		{
-			name:    "Peer version greater than min version",
-			minVer:  "0.26.0",
-			peerVer: "0.60.1",
-			want:    true,
-			wantErr: false,
-		},
-		{
-			name:    "Peer version equals min version",
-			minVer:  "1.0.0",
-			peerVer: "1.0.0",
-			want:    true,
-			wantErr: false,
-		},
-		{
-			name:    "Peer version less than min version",
-			minVer:  "1.0.0",
-			peerVer: "0.9.9",
-			want:    false,
-			wantErr: false,
-		},
-		{
-			name:    "Peer version with pre-release tag greater than min version",
-			minVer:  "1.0.0",
-			peerVer: "1.0.1-alpha",
-			want:    true,
-			wantErr: false,
-		},
-		{
-			name:    "Invalid peer version format",
-			minVer:  "1.0.0",
-			peerVer: "dev",
-			want:    false,
-			wantErr: true,
-		},
-		{
-			name:    "Invalid min version format",
-			minVer:  "invalid.version",
-			peerVer: "1.0.0",
-			want:    false,
-			wantErr: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := MeetsMinVersion(tt.minVer, tt.peerVer)
-			if tt.wantErr {
-				assert.Error(t, err)
-			} else {
-				assert.NoError(t, err)
-			}
-			assert.Equal(t, tt.want, got)
-		})
-	}
-}