use policy ids deduping policies during union

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

dns/nameserver.go

@@ -55,7 +55,7 @@ type NameServerGroup struct {
 	AccountID string `gorm:"index"`
 	// AccountSeqID is a per-account monotonically increasing identifier used as the
 	// compact wire id when sending NetworkMap components to capable peers.
-	AccountSeqID uint32 `json:"-" gorm:"index:idx_nameserver_groups_account_seq_id;not null;default:0"`
+	AccountSeqID int32 `json:"-" gorm:"not null;default:0"`
 	// Name group name
 	Name string
 	// Description group description

management/internals/shared/grpc/components_encoder.go

@@ -88,7 +88,7 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 	// policies + resource-only policies) so encodeResourcePoliciesMap can
 	// translate every *Policy pointer to a wire index.
 	allPolicies := unionPolicies(c.Policies, c.ResourcePoliciesMap)
-	policies, policyToIdxs := enc.encodePolicies(allPolicies)
+	policies := enc.encodePolicies(allPolicies)
 
 	// Phase 3: emit. Order of struct field expressions no longer matters:
 	// every encoder either reads from the dedup tables or works on
@@ -115,7 +115,7 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 		AccountZones:        encodeCustomZones(c.AccountZones),
 		NetworkResources:    enc.encodeNetworkResources(c.NetworkResources),
 		RoutersMap:          enc.encodeRoutersMap(c.RoutersMap),
-		ResourcePoliciesMap: enc.encodeResourcePoliciesMap(c.ResourcePoliciesMap, policyToIdxs),
+		ResourcePoliciesMap: enc.encodeResourcePoliciesMap(c.ResourcePoliciesMap),
 		GroupIdToUserIds:    enc.encodeGroupIDToUserIDs(c.GroupIDToUserIDs),
 		AllowedUserIds:      stringSetToSlice(c.AllowedUserIDs),
 		PostureFailedPeers:  enc.encodePostureFailedPeers(c.PostureFailedPeers),
@@ -170,32 +170,7 @@ func (e *componentEncoder) appendPeer(p *nbpeer.Peer) uint32 {
 	}
 	idx := uint32(len(e.peers))
 	e.peerOrder[p.ID] = idx
-	e.peers = append(e.peers, toPeerCompact(p, e.agentVersionIndex(p.Meta.WtVersion)))
-	return idx
-}
-
-func (e *componentEncoder) agentVersionIndex(v string) uint32 {
-	if idx, ok := e.agentVersionOrder[v]; ok {
-		return idx
-	}
-	// Lazy-initialise the table with "" at index 0 so the empty string
-	// stays interchangeable with proto3's default uint32=0 — peers without
-	// a WtVersion don't force the table to materialise.
-	if v == "" {
-		idx := uint32(len(e.agentVersions))
-		if idx == 0 {
-			e.agentVersions = append(e.agentVersions, "")
-		}
-		e.agentVersionOrder[""] = idx
-		return idx
-	}
-	if len(e.agentVersions) == 0 {
-		e.agentVersions = append(e.agentVersions, "")
-		e.agentVersionOrder[""] = 0
-	}
-	idx := uint32(len(e.agentVersions))
-	e.agentVersionOrder[v] = idx
-	e.agentVersions = append(e.agentVersions, v)
+	e.peers = append(e.peers, toPeerCompact(p))
 	return idx
 }
 
@@ -246,13 +221,12 @@ func (e *componentEncoder) encodeGroups() []*proto.GroupCompact {
 // list and a map from policy pointer to the indexes of its emitted rules in
 // that list — used by encodeResourcePoliciesMap to translate
 // ResourcePoliciesMap[resourceID][]*Policy into wire-side indexes.
-func (e *componentEncoder) encodePolicies(policies []*types.Policy) ([]*proto.PolicyCompact, map[*types.Policy][]uint32) {
+func (e *componentEncoder) encodePolicies(policies []*types.Policy) []*proto.PolicyCompact {
 	if len(policies) == 0 {
-		return nil, nil
+		return nil
 	}
 
 	out := make([]*proto.PolicyCompact, 0, len(policies))
-	idxByPolicy := make(map[*types.Policy][]uint32, len(policies))
 
 	for _, pol := range policies {
 		if !pol.HasSeqID() || !pol.Enabled {
@@ -262,11 +236,10 @@ func (e *componentEncoder) encodePolicies(policies []*types.Policy) ([]*proto.Po
 			if r == nil || !r.Enabled {
 				continue
 			}
-			idxByPolicy[pol] = append(idxByPolicy[pol], uint32(len(out)))
 			out = append(out, e.encodePolicyRule(pol, r))
 		}
 	}
-	return out, idxByPolicy
+	return out
 }
 
 // encodePolicyRule maps a single PolicyRule under pol to a PolicyCompact entry.
@@ -290,11 +263,11 @@ func (e *componentEncoder) encodePolicyRule(pol *types.Policy, r *types.PolicyRu
 
 // groupSeqIDs maps the xid group IDs in src to their per-account seq ids,
 // dropping any group that has no seq id assigned.
-func (e *componentEncoder) groupSeqIDs(src []string) []uint32 {
+func (e *componentEncoder) groupSeqIDs(src []string) []int32 {
 	if len(src) == 0 {
 		return nil
 	}
-	out := make([]uint32, 0, len(src))
+	out := make([]int32, 0, len(src))
 	for _, gid := range src {
 		if seq, ok := e.groupSeq(gid); ok {
 			out = append(out, seq)
@@ -315,16 +288,16 @@ func unionPolicies(policies []*types.Policy, resourcePolicies map[string][]*type
 	if len(resourcePolicies) == 0 {
 		return policies
 	}
-	seen := make(map[*types.Policy]struct{}, len(policies))
+	seen := make(map[string]struct{}, len(policies))
 	out := make([]*types.Policy, 0, len(policies))
 	for _, p := range policies {
 		if p == nil {
 			continue
 		}
-		if _, ok := seen[p]; ok {
+		if _, ok := seen[p.ID]; ok {
 			continue
 		}
-		seen[p] = struct{}{}
+		seen[p.ID] = struct{}{}
 		out = append(out, p)
 	}
 	for _, list := range resourcePolicies {
@@ -332,10 +305,10 @@ func unionPolicies(policies []*types.Policy, resourcePolicies map[string][]*type
 			if p == nil {
 				continue
 			}
-			if _, ok := seen[p]; ok {
+			if _, ok := seen[p.ID]; ok {
 				continue
 			}
-			seen[p] = struct{}{}
+			seen[p.ID] = struct{}{}
 			out = append(out, p)
 		}
 	}
@@ -346,11 +319,11 @@ func unionPolicies(policies []*types.Policy, resourcePolicies map[string][]*type
 // group xid → local-user names) to the wire form (map keyed by group
 // account_seq_id → UserNameList). Groups without a seq id are dropped —
 // matches how source/destination group references handle the same case.
-func (e *componentEncoder) encodeAuthorizedGroups(m map[string][]string) map[uint32]*proto.UserNameList {
+func (e *componentEncoder) encodeAuthorizedGroups(m map[string][]string) map[int32]*proto.UserNameList {
 	if len(m) == 0 {
 		return nil
 	}
-	out := make(map[uint32]*proto.UserNameList, len(m))
+	out := make(map[int32]*proto.UserNameList, len(m))
 	for groupID, names := range m {
 		seq, ok := e.groupSeq(groupID)
 		if !ok {
@@ -361,7 +334,7 @@ func (e *componentEncoder) encodeAuthorizedGroups(m map[string][]string) map[uin
 	return out
 }
 
-func (e *componentEncoder) groupSeq(groupID string) (uint32, bool) {
+func (e *componentEncoder) groupSeq(groupID string) (int32, bool) {
 	g, ok := e.components.Groups[groupID]
 	if !ok || !g.HasSeqID() {
 		return 0, false
@@ -392,11 +365,11 @@ func (e *componentEncoder) resourceToProto(r types.Resource) *proto.ResourceComp
 // per-account integer ids using the NetworkMapComponents.PostureCheckXIDToSeq
 // lookup. Unresolvable xids are silently dropped — matches how group/peer
 // references handle the same case.
-func (e *componentEncoder) postureCheckSeqs(xids []string) []uint32 {
+func (e *componentEncoder) postureCheckSeqs(xids []string) []int32 {
 	if len(xids) == 0 || len(e.components.PostureCheckXIDToSeq) == 0 {
 		return nil
 	}
-	out := make([]uint32, 0, len(xids))
+	out := make([]int32, 0, len(xids))
 	for _, xid := range xids {
 		if seq, ok := e.components.PostureCheckXIDToSeq[xid]; ok {
 			out = append(out, seq)
@@ -408,7 +381,7 @@ func (e *componentEncoder) postureCheckSeqs(xids []string) []uint32 {
 // networkSeq translates a Network xid to its per-account integer id using
 // the NetworkMapComponents.NetworkXIDToSeq lookup. Returns (0,false) when
 // the xid isn't known — callers decide whether to skip the parent record.
-func (e *componentEncoder) networkSeq(xid string) (uint32, bool) {
+func (e *componentEncoder) networkSeq(xid string) (int32, bool) {
 	if xid == "" {
 		return 0, false
 	}
@@ -424,7 +397,7 @@ func (e *componentEncoder) encodeDNSSettings(s *types.DNSSettings) *proto.DNSSet
 		return nil
 	}
 	out := &proto.DNSSettingsCompact{
-		DisabledManagementGroupIds: make([]uint32, 0, len(s.DisabledManagementGroups)),
+		DisabledManagementGroupIds: make([]int32, 0, len(s.DisabledManagementGroups)),
 	}
 	for _, gid := range s.DisabledManagementGroups {
 		if seq, ok := e.groupSeq(gid); ok {
@@ -472,11 +445,11 @@ func (e *componentEncoder) encodeRoutes(routes []*nbroute.Route) []*proto.RouteR
 	return out
 }
 
-func (e *componentEncoder) groupIDsToSeq(groupIDs []string) []uint32 {
+func (e *componentEncoder) groupIDsToSeq(groupIDs []string) []int32 {
 	if len(groupIDs) == 0 {
 		return nil
 	}
-	out := make([]uint32, 0, len(groupIDs))
+	out := make([]int32, 0, len(groupIDs))
 	for _, gid := range groupIDs {
 		if seq, ok := e.groupSeq(gid); ok {
 			out = append(out, seq)
@@ -587,11 +560,11 @@ func (e *componentEncoder) encodeNetworkResources(resources []*resourceTypes.Net
 	return out
 }
 
-func (e *componentEncoder) encodeRoutersMap(routersMap map[string]map[string]*routerTypes.NetworkRouter) map[uint32]*proto.NetworkRouterList {
+func (e *componentEncoder) encodeRoutersMap(routersMap map[string]map[string]*routerTypes.NetworkRouter) map[int32]*proto.NetworkRouterList {
 	if len(routersMap) == 0 {
 		return nil
 	}
-	out := make(map[uint32]*proto.NetworkRouterList, len(routersMap))
+	out := make(map[int32]*proto.NetworkRouterList, len(routersMap))
 	for networkXID, routers := range routersMap {
 		if len(routers) == 0 {
 			continue
@@ -623,42 +596,42 @@ func (e *componentEncoder) encodeRoutersMap(routersMap map[string]map[string]*ro
 	return out
 }
 
-func (e *componentEncoder) encodeResourcePoliciesMap(rpm map[string][]*types.Policy, policyToIdxs map[*types.Policy][]uint32) map[uint32]*proto.PolicyIndexes {
+func (e *componentEncoder) encodeResourcePoliciesMap(rpm map[string][]*types.Policy) map[int32]*proto.PolicyIds {
 	if len(rpm) == 0 {
 		return nil
 	}
 	// resourceXIDToSeq is local to one encode — built from components.NetworkResources
 	// (small slice). Network resources without seq id are dropped, matching how
 	// other components-without-seq are silently filtered.
-	resourceXIDToSeq := make(map[string]uint32, len(e.components.NetworkResources))
+	resourceXIDToSeq := make(map[string]int32, len(e.components.NetworkResources))
 	for _, r := range e.components.NetworkResources {
 		if r != nil && r.AccountSeqID != 0 {
 			resourceXIDToSeq[r.ID] = r.AccountSeqID
 		}
 	}
-	out := make(map[uint32]*proto.PolicyIndexes, len(rpm))
+	out := make(map[int32]*proto.PolicyIds, len(rpm))
 	for resourceXID, policies := range rpm {
 		seq, ok := resourceXIDToSeq[resourceXID]
 		if !ok {
 			continue
 		}
-		idxs := make([]uint32, 0, len(policies)*2)
+		ids := make([]int32, 0, len(policies))
 		for _, pol := range policies {
-			idxs = append(idxs, policyToIdxs[pol]...)
+			ids = append(ids, pol.AccountSeqID)
 		}
-		if len(idxs) == 0 {
+		if len(ids) == 0 {
 			continue
 		}
-		out[seq] = &proto.PolicyIndexes{Indexes: idxs}
+		out[seq] = &proto.PolicyIds{Ids: ids}
 	}
 	return out
 }
 
-func (e *componentEncoder) encodeGroupIDToUserIDs(m map[string][]string) map[uint32]*proto.UserIDList {
+func (e *componentEncoder) encodeGroupIDToUserIDs(m map[string][]string) map[int32]*proto.UserIDList {
 	if len(m) == 0 {
 		return nil
 	}
-	out := make(map[uint32]*proto.UserIDList, len(m))
+	out := make(map[int32]*proto.UserIDList, len(m))
 	for groupID, userIDs := range m {
 		seq, ok := e.groupSeq(groupID)
 		if !ok || len(userIDs) == 0 {
@@ -680,11 +653,11 @@ func stringSetToSlice(s map[string]struct{}) []string {
 	return out
 }
 
-func (e *componentEncoder) encodePostureFailedPeers(m map[string]map[string]struct{}) map[uint32]*proto.PeerIndexSet {
+func (e *componentEncoder) encodePostureFailedPeers(m map[string]map[string]struct{}) map[int32]*proto.PeerIndexSet {
 	if len(m) == 0 {
 		return nil
 	}
-	out := make(map[uint32]*proto.PeerIndexSet, len(m))
+	out := make(map[int32]*proto.PeerIndexSet, len(m))
 	for checkXID, failedPeerIDs := range m {
 		seq, ok := e.components.PostureCheckXIDToSeq[checkXID]
 		if !ok || seq == 0 {
@@ -736,12 +709,12 @@ func toAccountNetwork(n *types.Network) *proto.AccountNetwork {
 	return out
 }
 
-func toPeerCompact(p *nbpeer.Peer, agentVersionIdx uint32) *proto.PeerCompact {
+func toPeerCompact(p *nbpeer.Peer) *proto.PeerCompact {
 	pc := &proto.PeerCompact{
 		WgPubKey:               decodeWgKey(p.Key),
 		SshPubKey:              []byte(p.SSHKey),
 		DnsLabel:               p.DNSLabel,
-		AgentVersionIdx:        agentVersionIdx,
+		AgentVersion:           p.Meta.WtVersion,
 		AddedWithSsoLogin:      p.UserID != "",
 		LoginExpirationEnabled: p.LoginExpirationEnabled,
 		SshEnabled:             p.SSHEnabled,

management/internals/shared/grpc/components_encoder_test.go

@@ -41,48 +41,6 @@ func canonicalize(full *proto.NetworkMapComponentsFull) {
 		return
 	}
 
-	// Canonicalize agent_versions first: sort the slice and rewrite each
-	// peer's AgentVersionIdx accordingly. The empty placeholder stays at
-	// index 0 by convention.
-	avRemap := make(map[uint32]uint32, len(full.AgentVersions))
-	if len(full.AgentVersions) > 0 {
-		// Pair version → original index, sort, rebuild.
-		type avEntry struct {
-			version string
-			oldIdx  uint32
-		}
-		entries := make([]avEntry, len(full.AgentVersions))
-		for i, v := range full.AgentVersions {
-			entries[i] = avEntry{version: v, oldIdx: uint32(i)}
-		}
-		// Empty stays at 0; sort the rest by string. Tiebreaker on oldIdx
-		// keeps the canonicalize output stable when two entries compare
-		// equal (the encoder dedups, but defending against future inputs).
-		slices.SortFunc(entries, func(a, b avEntry) int {
-			if a.version == "" && b.version != "" {
-				return -1
-			}
-			if b.version == "" && a.version != "" {
-				return 1
-			}
-			if c := cmp.Compare(a.version, b.version); c != 0 {
-				return c
-			}
-			return cmp.Compare(a.oldIdx, b.oldIdx)
-		})
-		newVersions := make([]string, len(entries))
-		for newIdx, e := range entries {
-			avRemap[e.oldIdx] = uint32(newIdx)
-			newVersions[newIdx] = e.version
-		}
-		full.AgentVersions = newVersions
-	}
-	for _, p := range full.Peers {
-		if newIdx, ok := avRemap[p.AgentVersionIdx]; ok {
-			p.AgentVersionIdx = newIdx
-		}
-	}
-
 	type peerEntry struct {
 		peer   *proto.PeerCompact
 		oldIdx uint32
@@ -168,7 +126,7 @@ func canonicalize(full *proto.NetworkMapComponentsFull) {
 		policyRemap[policyOldOrder[p]] = uint32(newIdx)
 	}
 	for _, idxs := range full.ResourcePoliciesMap {
-		idxs.Indexes = remapAndSort(idxs.Indexes, policyRemap)
+		slices.Sort(idxs.Ids)
 	}
 	for _, list := range full.GroupIdToUserIds {
 		slices.Sort(list.UserIds)
@@ -340,12 +298,12 @@ func TestEncodeNetworkMapEnvelope_GroupsByAccountSeqID(t *testing.T) {
 
 	require.Len(t, full.Groups, 2)
 
-	groupByID := map[uint32]*proto.GroupCompact{}
+	groupByID := map[int32]*proto.GroupCompact{}
 	for _, g := range full.Groups {
 		groupByID[g.Id] = g
 	}
-	require.Contains(t, groupByID, uint32(1))
-	require.Contains(t, groupByID, uint32(2))
+	require.Contains(t, groupByID, int32(1))
+	require.Contains(t, groupByID, int32(2))
 	assert.Equal(t, "Src", groupByID[1].Name)
 	assert.Equal(t, "Dst", groupByID[2].Name)
 	assert.Len(t, groupByID[1].PeerIndexes, 1)
@@ -367,8 +325,8 @@ func TestEncodeNetworkMapEnvelope_PolicyExpansion(t *testing.T) {
 	require.Len(t, pc.PortRanges, 1)
 	assert.EqualValues(t, 8000, pc.PortRanges[0].Start)
 	assert.EqualValues(t, 8100, pc.PortRanges[0].End)
-	assert.Equal(t, []uint32{1}, pc.SourceGroupIds)
-	assert.Equal(t, []uint32{2}, pc.DestinationGroupIds)
+	assert.Equal(t, []int32{1}, pc.SourceGroupIds)
+	assert.Equal(t, []int32{2}, pc.DestinationGroupIds)
 }
 
 func TestEncodeNetworkMapEnvelope_RouterIndexes(t *testing.T) {
@@ -382,24 +340,6 @@ func TestEncodeNetworkMapEnvelope_RouterIndexes(t *testing.T) {
 	assert.Equal(t, "peerc", full.Peers[idx].DnsLabel)
 }
 
-func TestEncodeNetworkMapEnvelope_AgentVersionDedup(t *testing.T) {
-	c := newTestComponents()
-
-	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
-
-	require.Len(t, full.AgentVersions, 3, "empty placeholder + 2 distinct versions")
-	assert.Equal(t, "", full.AgentVersions[0], "index 0 reserved for empty version")
-	assert.ElementsMatch(t, []string{"0.40.0", "0.25.0"}, full.AgentVersions[1:],
-		"two distinct versions, order depends on map iteration")
-
-	idxByLabel := map[string]uint32{}
-	for _, p := range full.Peers {
-		idxByLabel[p.DnsLabel] = p.AgentVersionIdx
-	}
-	assert.Equal(t, idxByLabel["peera"], idxByLabel["peerc"], "peers with the same agent version share an index")
-	assert.NotEqual(t, idxByLabel["peera"], idxByLabel["peerb"])
-}
-
 func TestEncodeNetworkMapEnvelope_DisabledPolicySkipped(t *testing.T) {
 	c := newTestComponents()
 	c.Policies[0].Enabled = false
@@ -421,7 +361,7 @@ func TestEncodeNetworkMapEnvelope_GroupZeroSeqIDSkipped(t *testing.T) {
 	require.Len(t, full.Policies, 1)
 	pc := full.Policies[0]
 	assert.Empty(t, pc.SourceGroupIds, "rule references a group that was filtered out → no group id on wire")
-	assert.Equal(t, []uint32{2}, pc.DestinationGroupIds)
+	assert.Equal(t, []int32{2}, pc.DestinationGroupIds)
 }
 
 func TestEncodeNetworkMapEnvelope_TwoPeersSameMalformedKey(t *testing.T) {
@@ -594,14 +534,14 @@ func TestEncodeNetworkMapEnvelope_RoutesRoundTrip(t *testing.T) {
 	assert.True(t, r1.PeerIndexSet, "route with peer must set peer_index_set")
 	require.Less(t, int(r1.PeerIndex), len(full.Peers))
 	assert.Equal(t, "peerc", full.Peers[r1.PeerIndex].DnsLabel)
-	assert.Equal(t, []uint32{1}, r1.GroupIds, "group-src has AccountSeqID 1")
-	assert.Equal(t, []uint32{2}, r1.AccessControlGroupIds, "group-dst has AccountSeqID 2")
+	assert.Equal(t, []int32{1}, r1.GroupIds, "group-src has AccountSeqID 1")
+	assert.Equal(t, []int32{2}, r1.AccessControlGroupIds, "group-dst has AccountSeqID 2")
 	assert.Empty(t, r1.PeerGroupIds)
 
 	r2 := byNetID["net-B"]
 	require.NotNil(t, r2)
 	assert.False(t, r2.PeerIndexSet, "route with peer_groups must NOT set peer_index_set")
-	assert.ElementsMatch(t, []uint32{1, 2}, r2.PeerGroupIds)
+	assert.ElementsMatch(t, []int32{1, 2}, r2.PeerGroupIds)
 }
 
 func TestEncodeNetworkMapEnvelope_RouteWithMissingPeerLeavesIndexUnset(t *testing.T) {
@@ -648,19 +588,19 @@ func TestEncodeNetworkMapEnvelope_ResourceOnlyPolicyShippedAndIndexed(t *testing
 
 	require.Len(t, full.Policies, 2, "encoded policies must include both peer-traffic and resource-only")
 
-	policyByID := map[uint32]*proto.PolicyCompact{}
-	policyIdxByID := map[uint32]uint32{}
-	for i, p := range full.Policies {
+	policyByID := map[int32]*proto.PolicyCompact{}
+	policyIds := make([]int32, 0)
+	for _, p := range full.Policies {
 		policyByID[p.Id] = p
-		policyIdxByID[p.Id] = uint32(i)
+		policyIds = append(policyIds, p.Id)
 	}
-	require.Contains(t, policyByID, uint32(10), "original peer-traffic policy id 10")
-	require.Contains(t, policyByID, uint32(99), "resource-only policy id 99")
+	require.Contains(t, policyByID, int32(10), "original peer-traffic policy id 10")
+	require.Contains(t, policyByID, int32(99), "resource-only policy id 99")
 
-	require.Contains(t, full.ResourcePoliciesMap, uint32(77))
-	idxs := full.ResourcePoliciesMap[77].Indexes
-	require.Len(t, idxs, 2)
-	assert.ElementsMatch(t, []uint32{policyIdxByID[10], policyIdxByID[99]}, idxs,
+	require.Contains(t, full.ResourcePoliciesMap, int32(77))
+	ids := full.ResourcePoliciesMap[77].Ids
+	require.Len(t, ids, 2)
+	assert.ElementsMatch(t, policyIds, ids,
 		"resource policies map must reference both wire policy indexes")
 }
 
@@ -686,12 +626,12 @@ func TestEncodeNetworkMapEnvelope_NameServerGroups(t *testing.T) {
 	assert.True(t, nsg.Primary)
 	require.Len(t, nsg.Nameservers, 1)
 	assert.Equal(t, "8.8.8.8", nsg.Nameservers[0].IP)
-	assert.Equal(t, []uint32{1}, nsg.GroupIds, "group-not-persisted is filtered out (AccountSeqID=0)")
+	assert.Equal(t, []int32{1}, nsg.GroupIds, "group-not-persisted is filtered out (AccountSeqID=0)")
 }
 
 func TestEncodeNetworkMapEnvelope_PostureFailedPeers(t *testing.T) {
 	c := newTestComponents()
-	c.PostureCheckXIDToSeq = map[string]uint32{"check-1": 33}
+	c.PostureCheckXIDToSeq = map[string]int32{"check-1": 33}
 	c.PostureFailedPeers = map[string]map[string]struct{}{
 		"check-1": {
 			"peer-a":              {},
@@ -702,14 +642,14 @@ func TestEncodeNetworkMapEnvelope_PostureFailedPeers(t *testing.T) {
 
 	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
 
-	require.Contains(t, full.PostureFailedPeers, uint32(33))
+	require.Contains(t, full.PostureFailedPeers, int32(33))
 	idxs := full.PostureFailedPeers[33].PeerIndexes
 	assert.Len(t, idxs, 2, "missing peer is silently dropped (filterPostureFailedPeers guarantees presence in real data)")
 }
 
 func TestEncodeNetworkMapEnvelope_RoutersMap(t *testing.T) {
 	c := newTestComponents()
-	c.NetworkXIDToSeq = map[string]uint32{"net-1": 5}
+	c.NetworkXIDToSeq = map[string]int32{"net-1": 5}
 	c.RoutersMap = map[string]map[string]*routerTypes.NetworkRouter{
 		"net-1": {
 			"peer-c": {
@@ -721,7 +661,7 @@ func TestEncodeNetworkMapEnvelope_RoutersMap(t *testing.T) {
 
 	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
 
-	require.Contains(t, full.RoutersMap, uint32(5))
+	require.Contains(t, full.RoutersMap, int32(5))
 	entries := full.RoutersMap[5].Entries
 	require.Len(t, entries, 1)
 	e := entries[0]
@@ -745,14 +685,14 @@ func TestEncodeNetworkMapEnvelope_RouterPeerNotInComponentsPeers(t *testing.T) {
 		DNSLabel: "peerc", Meta: nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
 	}
 	c.RouterPeers = map[string]*nbpeer.Peer{"peer-c": routerPeer}
-	c.NetworkXIDToSeq = map[string]uint32{"net-1": 5}
+	c.NetworkXIDToSeq = map[string]int32{"net-1": 5}
 	c.RoutersMap = map[string]map[string]*routerTypes.NetworkRouter{
 		"net-1": {"peer-c": {ID: "r-1", AccountSeqID: 1, Peer: "peer-c", Enabled: true}},
 	}
 
 	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
 
-	require.Contains(t, full.RoutersMap, uint32(5))
+	require.Contains(t, full.RoutersMap, int32(5))
 	require.Len(t, full.RoutersMap[5].Entries, 1)
 	e := full.RoutersMap[5].Entries[0]
 	assert.True(t, e.PeerIndexSet, "router peer must be indexed even when not in c.Peers")
@@ -768,7 +708,7 @@ func TestEncodeNetworkMapEnvelope_DNSSettingsFiltersUnpersistedGroups(t *testing
 	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
 
 	require.NotNil(t, full.DnsSettings)
-	assert.Equal(t, []uint32{1}, full.DnsSettings.DisabledManagementGroupIds,
+	assert.Equal(t, []int32{1}, full.DnsSettings.DisabledManagementGroupIds,
 		"only group-src (AccountSeqID=1) survives — missing and unpersisted are dropped")
 }
 
@@ -784,7 +724,7 @@ func TestEncodeNetworkMapEnvelope_GroupIDToUserIDs(t *testing.T) {
 	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
 
 	require.Len(t, full.GroupIdToUserIds, 1, "only persisted+present groups survive")
-	require.Contains(t, full.GroupIdToUserIds, uint32(1))
+	require.Contains(t, full.GroupIdToUserIds, int32(1))
 	assert.ElementsMatch(t, []string{"user-1", "user-2"}, full.GroupIdToUserIds[1].UserIds)
 }
 

management/server/networks/resources/types/resource.go

@@ -29,20 +29,20 @@ func (p NetworkResourceType) String() string {
 }
 
 type NetworkResource struct {
-	ID          string `gorm:"primaryKey"`
-	NetworkID   string `gorm:"index"`
-	AccountID   string `gorm:"index"`
+	ID        string `gorm:"primaryKey"`
+	NetworkID string `gorm:"index"`
+	AccountID string `gorm:"index"`
 	// AccountSeqID is a per-account monotonically increasing identifier used as the
 	// compact wire id when sending NetworkMap components to capable peers.
-	AccountSeqID uint32 `json:"-" gorm:"index:idx_network_resources_account_seq_id;not null;default:0"`
-	Name        string
-	Description string
-	Type        NetworkResourceType
-	Address     string   `gorm:"-"`
-	GroupIDs    []string `gorm:"-"`
-	Domain      string
-	Prefix      netip.Prefix `gorm:"serializer:json"`
-	Enabled     bool
+	AccountSeqID int32 `json:"-" gorm:"not null;default:0"`
+	Name         string
+	Description  string
+	Type         NetworkResourceType
+	Address      string   `gorm:"-"`
+	GroupIDs     []string `gorm:"-"`
+	Domain       string
+	Prefix       netip.Prefix `gorm:"serializer:json"`
+	Enabled      bool
 }
 
 func NewNetworkResource(accountID, networkID, name, description, address string, groupIDs []string, enabled bool) (*NetworkResource, error) {

management/server/networks/routers/types/router.go

@@ -10,17 +10,17 @@ import (
 )
 
 type NetworkRouter struct {
-	ID         string `gorm:"primaryKey"`
-	NetworkID  string `gorm:"index"`
-	AccountID  string `gorm:"index"`
+	ID        string `gorm:"primaryKey"`
+	NetworkID string `gorm:"index"`
+	AccountID string `gorm:"index"`
 	// AccountSeqID is a per-account monotonically increasing identifier used as the
 	// compact wire id when sending NetworkMap components to capable peers.
-	AccountSeqID uint32 `json:"-" gorm:"index:idx_network_routers_account_seq_id;not null;default:0"`
-	Peer       string
-	PeerGroups []string `gorm:"serializer:json"`
-	Masquerade bool
-	Metric     int
-	Enabled    bool
+	AccountSeqID int32 `json:"-" gorm:"not null;default:0"`
+	Peer         string
+	PeerGroups   []string `gorm:"serializer:json"`
+	Masquerade   bool
+	Metric       int
+	Enabled      bool
 }
 
 func NewNetworkRouter(accountID string, networkID string, peer string, peerGroups []string, masquerade bool, metric int, enabled bool) (*NetworkRouter, error) {

management/server/networks/types/network.go

@@ -12,7 +12,7 @@ type Network struct {
 
 	// AccountSeqID is a per-account monotonically increasing identifier used as the
 	// compact wire id when sending NetworkMap components to capable peers.
-	AccountSeqID uint32 `json:"-" gorm:"index:idx_networks_account_seq_id;not null;default:0"`
+	AccountSeqID int32 `json:"-" gorm:"not null;default:0"`
 
 	Name        string
 	Description string

management/server/posture/checks.go

@@ -51,7 +51,7 @@ type Checks struct {
 
 	// AccountSeqID is a per-account monotonically increasing identifier used as the
 	// compact wire id when sending NetworkMap components to capable peers.
-	AccountSeqID uint32 `json:"-" gorm:"index:idx_posture_checks_account_seq_id;not null;default:0"`
+	AccountSeqID int32 `json:"-" gorm:"not null;default:0"`
 
 	// Checks is a set of objects that perform the actual checks
 	Checks ChecksDefinition `gorm:"serializer:json"`

management/server/store/sql_store.go

@@ -3637,11 +3637,11 @@ func (s *SqlStore) withTx(tx *gorm.DB) Store {
 // AllocateAccountSeqID returns the next per-account integer id for the given
 // component kind. Must be called inside ExecuteInTransaction so the increment
 // is serialized with the component insert.
-func (s *SqlStore) AllocateAccountSeqID(ctx context.Context, accountID string, entity types.AccountSeqEntity) (uint32, error) {
+func (s *SqlStore) AllocateAccountSeqID(ctx context.Context, accountID string, entity types.AccountSeqEntity) (int32, error) {
 	return allocateAccountSeqID(ctx, s.db, s.storeEngine, accountID, entity)
 }
 
-func allocateAccountSeqID(_ context.Context, db *gorm.DB, engine types.Engine, accountID string, entity types.AccountSeqEntity) (uint32, error) {
+func allocateAccountSeqID(_ context.Context, db *gorm.DB, engine types.Engine, accountID string, entity types.AccountSeqEntity) (int32, error) {
 	switch engine {
 	case types.PostgresStoreEngine, types.SqliteStoreEngine:
 		return allocateAccountSeqIDReturning(db, accountID, entity)
@@ -3657,7 +3657,7 @@ func allocateAccountSeqID(_ context.Context, db *gorm.DB, engine types.Engine, a
 // SELECT FOR UPDATE. Two concurrent allocations for the same (account, entity)
 // produce two distinct ids: one wins the INSERT, the other wins the UPDATE
 // branch and returns next_id+1.
-func allocateAccountSeqIDReturning(db *gorm.DB, accountID string, entity types.AccountSeqEntity) (uint32, error) {
+func allocateAccountSeqIDReturning(db *gorm.DB, accountID string, entity types.AccountSeqEntity) (int32, error) {
 	const sqlStr = `
 		INSERT INTO account_seq_counters (account_id, entity, next_id)
 		VALUES (?, ?, 2)
@@ -3665,7 +3665,7 @@ func allocateAccountSeqIDReturning(db *gorm.DB, accountID string, entity types.A
 			SET next_id = account_seq_counters.next_id + 1
 		RETURNING (next_id - 1)
 	`
-	var allocated uint32
+	var allocated int32
 	if err := db.Raw(sqlStr, accountID, string(entity)).Scan(&allocated).Error; err != nil {
 		return 0, fmt.Errorf("upsert account seq counter: %w", err)
 	}
@@ -3682,7 +3682,7 @@ func allocateAccountSeqIDReturning(db *gorm.DB, accountID string, entity types.A
 // no-conflict path also surfaces the new next_id, keeping the read-back uniform.
 // LAST_INSERT_ID is per-connection; GORM transactions pin a single connection,
 // so the follow-up SELECT sees the same value.
-func allocateAccountSeqIDMysql(db *gorm.DB, accountID string, entity types.AccountSeqEntity) (uint32, error) {
+func allocateAccountSeqIDMysql(db *gorm.DB, accountID string, entity types.AccountSeqEntity) (int32, error) {
 	const upsertSQL = `
 		INSERT INTO account_seq_counters (account_id, entity, next_id)
 		VALUES (?, ?, LAST_INSERT_ID(2))
@@ -3698,7 +3698,7 @@ func allocateAccountSeqIDMysql(db *gorm.DB, accountID string, entity types.Accou
 	if newNext == 0 {
 		return 0, fmt.Errorf("LAST_INSERT_ID returned 0; account_seq_counters misconfigured")
 	}
-	return uint32(newNext - 1), nil
+	return int32(newNext - 1), nil
 }
 
 // assignAccountSeqIDs allocates a per-account integer id for any component on
@@ -3709,8 +3709,8 @@ func allocateAccountSeqIDMysql(db *gorm.DB, accountID string, entity types.Accou
 // per-entity counter is bumped so subsequent AllocateAccountSeqID calls don't
 // hand out a colliding id.
 func (s *SqlStore) assignAccountSeqIDs(ctx context.Context, tx *gorm.DB, account *types.Account) error {
-	maxByEntity := make(map[types.AccountSeqEntity]uint32, 8)
-	bump := func(entity types.AccountSeqEntity, seq uint32) {
+	maxByEntity := make(map[types.AccountSeqEntity]int32, 8)
+	bump := func(entity types.AccountSeqEntity, seq int32) {
 		if seq > maxByEntity[entity] {
 			maxByEntity[entity] = seq
 		}
@@ -3856,7 +3856,7 @@ func (s *SqlStore) assignAccountSeqIDs(ctx context.Context, tx *gorm.DB, account
 // AccountSeqIDs (e.g. test bulk-load from sqlite to postgres, or migrations
 // running before component data lands) so that the next AllocateAccountSeqID
 // call returns a fresh id beyond what was just written.
-func ensureAccountSeqCounter(db *gorm.DB, engine types.Engine, accountID string, entity types.AccountSeqEntity, target uint32) error {
+func ensureAccountSeqCounter(db *gorm.DB, engine types.Engine, accountID string, entity types.AccountSeqEntity, target int32) error {
 	switch engine {
 	case types.PostgresStoreEngine, types.SqliteStoreEngine:
 		const sqlStr = `

management/server/store/store.go

@@ -226,7 +226,7 @@ type Store interface {
 	// AllocateAccountSeqID returns the next per-account integer id for the given
 	// component kind. Must run inside a transaction so the increment is serialized
 	// with the component insert.
-	AllocateAccountSeqID(ctx context.Context, accountID string, entity types.AccountSeqEntity) (uint32, error)
+	AllocateAccountSeqID(ctx context.Context, accountID string, entity types.AccountSeqEntity) (int32, error)
 
 	GetAccountNetworks(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*networkTypes.Network, error)
 	GetNetworkByID(ctx context.Context, lockStrength LockingStrength, accountID, networkID string) (*networkTypes.Network, error)

management/server/store/store_mock_agentnetwork.go

@@ -1,495 +0,0 @@
-package store
-
-import (
-	context "context"
-	reflect "reflect"
-	time "time"
-
-	gomock "github.com/golang/mock/gomock"
-
-	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-)
-
-// GetAllAgentNetworkProviders mocks base method.
-func (m *MockStore) GetAllAgentNetworkProviders(ctx context.Context, lockStrength LockingStrength) ([]*agentNetworkTypes.Provider, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAllAgentNetworkProviders", ctx, lockStrength)
-	ret0, _ := ret[0].([]*agentNetworkTypes.Provider)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAllAgentNetworkProviders indicates an expected call of GetAllAgentNetworkProviders.
-func (mr *MockStoreMockRecorder) GetAllAgentNetworkProviders(ctx, lockStrength interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllAgentNetworkProviders", reflect.TypeOf((*MockStore)(nil).GetAllAgentNetworkProviders), ctx, lockStrength)
-}
-
-// GetAgentNetworkMetrics mocks base method.
-func (m *MockStore) GetAgentNetworkMetrics(ctx context.Context) (AgentNetworkMetrics, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkMetrics", ctx)
-	ret0, _ := ret[0].(AgentNetworkMetrics)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkMetrics indicates an expected call of GetAgentNetworkMetrics.
-func (mr *MockStoreMockRecorder) GetAgentNetworkMetrics(ctx interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkMetrics", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkMetrics), ctx)
-}
-
-// GetAccountAgentNetworkProviders mocks base method.
-func (m *MockStore) GetAccountAgentNetworkProviders(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Provider, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountAgentNetworkProviders", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*agentNetworkTypes.Provider)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAccountAgentNetworkProviders indicates an expected call of GetAccountAgentNetworkProviders.
-func (mr *MockStoreMockRecorder) GetAccountAgentNetworkProviders(ctx, lockStrength, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkProviders", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkProviders), ctx, lockStrength, accountID)
-}
-
-// GetAgentNetworkProviderByID mocks base method.
-func (m *MockStore) GetAgentNetworkProviderByID(ctx context.Context, lockStrength LockingStrength, accountID, providerID string) (*agentNetworkTypes.Provider, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkProviderByID", ctx, lockStrength, accountID, providerID)
-	ret0, _ := ret[0].(*agentNetworkTypes.Provider)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkProviderByID indicates an expected call of GetAgentNetworkProviderByID.
-func (mr *MockStoreMockRecorder) GetAgentNetworkProviderByID(ctx, lockStrength, accountID, providerID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkProviderByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkProviderByID), ctx, lockStrength, accountID, providerID)
-}
-
-// SaveAgentNetworkProvider mocks base method.
-func (m *MockStore) SaveAgentNetworkProvider(ctx context.Context, provider *agentNetworkTypes.Provider) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SaveAgentNetworkProvider", ctx, provider)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// SaveAgentNetworkProvider indicates an expected call of SaveAgentNetworkProvider.
-func (mr *MockStoreMockRecorder) SaveAgentNetworkProvider(ctx, provider interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkProvider", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkProvider), ctx, provider)
-}
-
-// DeleteAgentNetworkProvider mocks base method.
-func (m *MockStore) DeleteAgentNetworkProvider(ctx context.Context, accountID, providerID string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteAgentNetworkProvider", ctx, accountID, providerID)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// DeleteAgentNetworkProvider indicates an expected call of DeleteAgentNetworkProvider.
-func (mr *MockStoreMockRecorder) DeleteAgentNetworkProvider(ctx, accountID, providerID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkProvider", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkProvider), ctx, accountID, providerID)
-}
-
-// GetAccountAgentNetworkPolicies mocks base method.
-func (m *MockStore) GetAccountAgentNetworkPolicies(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Policy, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountAgentNetworkPolicies", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*agentNetworkTypes.Policy)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAccountAgentNetworkPolicies indicates an expected call of GetAccountAgentNetworkPolicies.
-func (mr *MockStoreMockRecorder) GetAccountAgentNetworkPolicies(ctx, lockStrength, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkPolicies", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkPolicies), ctx, lockStrength, accountID)
-}
-
-// GetAgentNetworkPolicyByID mocks base method.
-func (m *MockStore) GetAgentNetworkPolicyByID(ctx context.Context, lockStrength LockingStrength, accountID, policyID string) (*agentNetworkTypes.Policy, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkPolicyByID", ctx, lockStrength, accountID, policyID)
-	ret0, _ := ret[0].(*agentNetworkTypes.Policy)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkPolicyByID indicates an expected call of GetAgentNetworkPolicyByID.
-func (mr *MockStoreMockRecorder) GetAgentNetworkPolicyByID(ctx, lockStrength, accountID, policyID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkPolicyByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkPolicyByID), ctx, lockStrength, accountID, policyID)
-}
-
-// SaveAgentNetworkPolicy mocks base method.
-func (m *MockStore) SaveAgentNetworkPolicy(ctx context.Context, policy *agentNetworkTypes.Policy) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SaveAgentNetworkPolicy", ctx, policy)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// SaveAgentNetworkPolicy indicates an expected call of SaveAgentNetworkPolicy.
-func (mr *MockStoreMockRecorder) SaveAgentNetworkPolicy(ctx, policy interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkPolicy", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkPolicy), ctx, policy)
-}
-
-// DeleteAgentNetworkPolicy mocks base method.
-func (m *MockStore) DeleteAgentNetworkPolicy(ctx context.Context, accountID, policyID string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteAgentNetworkPolicy", ctx, accountID, policyID)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// DeleteAgentNetworkPolicy indicates an expected call of DeleteAgentNetworkPolicy.
-func (mr *MockStoreMockRecorder) DeleteAgentNetworkPolicy(ctx, accountID, policyID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkPolicy", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkPolicy), ctx, accountID, policyID)
-}
-
-// GetAccountAgentNetworkGuardrails mocks base method.
-func (m *MockStore) GetAccountAgentNetworkGuardrails(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Guardrail, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountAgentNetworkGuardrails", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*agentNetworkTypes.Guardrail)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAccountAgentNetworkGuardrails indicates an expected call of GetAccountAgentNetworkGuardrails.
-func (mr *MockStoreMockRecorder) GetAccountAgentNetworkGuardrails(ctx, lockStrength, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkGuardrails", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkGuardrails), ctx, lockStrength, accountID)
-}
-
-// GetAgentNetworkGuardrailByID mocks base method.
-func (m *MockStore) GetAgentNetworkGuardrailByID(ctx context.Context, lockStrength LockingStrength, accountID, guardrailID string) (*agentNetworkTypes.Guardrail, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkGuardrailByID", ctx, lockStrength, accountID, guardrailID)
-	ret0, _ := ret[0].(*agentNetworkTypes.Guardrail)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkGuardrailByID indicates an expected call of GetAgentNetworkGuardrailByID.
-func (mr *MockStoreMockRecorder) GetAgentNetworkGuardrailByID(ctx, lockStrength, accountID, guardrailID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkGuardrailByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkGuardrailByID), ctx, lockStrength, accountID, guardrailID)
-}
-
-// SaveAgentNetworkGuardrail mocks base method.
-func (m *MockStore) SaveAgentNetworkGuardrail(ctx context.Context, guardrail *agentNetworkTypes.Guardrail) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SaveAgentNetworkGuardrail", ctx, guardrail)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// SaveAgentNetworkGuardrail indicates an expected call of SaveAgentNetworkGuardrail.
-func (mr *MockStoreMockRecorder) SaveAgentNetworkGuardrail(ctx, guardrail interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkGuardrail", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkGuardrail), ctx, guardrail)
-}
-
-// DeleteAgentNetworkGuardrail mocks base method.
-func (m *MockStore) DeleteAgentNetworkGuardrail(ctx context.Context, accountID, guardrailID string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteAgentNetworkGuardrail", ctx, accountID, guardrailID)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// DeleteAgentNetworkGuardrail indicates an expected call of DeleteAgentNetworkGuardrail.
-func (mr *MockStoreMockRecorder) DeleteAgentNetworkGuardrail(ctx, accountID, guardrailID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkGuardrail", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkGuardrail), ctx, accountID, guardrailID)
-}
-
-// GetAgentNetworkSettings mocks base method.
-func (m *MockStore) GetAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*agentNetworkTypes.Settings, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkSettings", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].(*agentNetworkTypes.Settings)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkSettings indicates an expected call of GetAgentNetworkSettings.
-func (mr *MockStoreMockRecorder) GetAgentNetworkSettings(ctx, lockStrength, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettings), ctx, lockStrength, accountID)
-}
-
-// GetAgentNetworkSettingsByCluster mocks base method.
-func (m *MockStore) GetAgentNetworkSettingsByCluster(ctx context.Context, lockStrength LockingStrength, cluster string) ([]*agentNetworkTypes.Settings, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkSettingsByCluster", ctx, lockStrength, cluster)
-	ret0, _ := ret[0].([]*agentNetworkTypes.Settings)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkSettingsByCluster indicates an expected call of GetAgentNetworkSettingsByCluster.
-func (mr *MockStoreMockRecorder) GetAgentNetworkSettingsByCluster(ctx, lockStrength, cluster interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettingsByCluster", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettingsByCluster), ctx, lockStrength, cluster)
-}
-
-// SaveAgentNetworkSettings mocks base method.
-func (m *MockStore) SaveAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SaveAgentNetworkSettings", ctx, settings)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// SaveAgentNetworkSettings indicates an expected call of SaveAgentNetworkSettings.
-func (mr *MockStoreMockRecorder) SaveAgentNetworkSettings(ctx, settings interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkSettings), ctx, settings)
-}
-
-// IncrementAgentNetworkConsumption mocks base method.
-func (m *MockStore) IncrementAgentNetworkConsumption(ctx context.Context, accountID string, kind agentNetworkTypes.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time, tokensIn, tokensOut int64, costUSD float64) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "IncrementAgentNetworkConsumption", ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// IncrementAgentNetworkConsumption indicates an expected call of IncrementAgentNetworkConsumption.
-func (mr *MockStoreMockRecorder) IncrementAgentNetworkConsumption(ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IncrementAgentNetworkConsumption", reflect.TypeOf((*MockStore)(nil).IncrementAgentNetworkConsumption), ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD)
-}
-
-// GetAgentNetworkConsumption mocks base method.
-func (m *MockStore) GetAgentNetworkConsumption(ctx context.Context, lockStrength LockingStrength, accountID string, kind agentNetworkTypes.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time) (*agentNetworkTypes.Consumption, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkConsumption", ctx, lockStrength, accountID, kind, dimID, windowSeconds, windowStart)
-	ret0, _ := ret[0].(*agentNetworkTypes.Consumption)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkConsumption indicates an expected call of GetAgentNetworkConsumption.
-func (mr *MockStoreMockRecorder) GetAgentNetworkConsumption(ctx, lockStrength, accountID, kind, dimID, windowSeconds, windowStart interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkConsumption", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkConsumption), ctx, lockStrength, accountID, kind, dimID, windowSeconds, windowStart)
-}
-
-// GetAgentNetworkConsumptionBatch mocks base method.
-func (m *MockStore) GetAgentNetworkConsumptionBatch(ctx context.Context, lockStrength LockingStrength, accountID string, keys []agentNetworkTypes.ConsumptionKey) (map[agentNetworkTypes.ConsumptionKey]*agentNetworkTypes.Consumption, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkConsumptionBatch", ctx, lockStrength, accountID, keys)
-	ret0, _ := ret[0].(map[agentNetworkTypes.ConsumptionKey]*agentNetworkTypes.Consumption)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkConsumptionBatch indicates an expected call of GetAgentNetworkConsumptionBatch.
-func (mr *MockStoreMockRecorder) GetAgentNetworkConsumptionBatch(ctx, lockStrength, accountID, keys interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkConsumptionBatch", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkConsumptionBatch), ctx, lockStrength, accountID, keys)
-}
-
-// IncrementAgentNetworkConsumptionBatch mocks base method.
-func (m *MockStore) IncrementAgentNetworkConsumptionBatch(ctx context.Context, accountID string, keys []agentNetworkTypes.ConsumptionKey, tokensIn, tokensOut int64, costUSD float64) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "IncrementAgentNetworkConsumptionBatch", ctx, accountID, keys, tokensIn, tokensOut, costUSD)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// IncrementAgentNetworkConsumptionBatch indicates an expected call of IncrementAgentNetworkConsumptionBatch.
-func (mr *MockStoreMockRecorder) IncrementAgentNetworkConsumptionBatch(ctx, accountID, keys, tokensIn, tokensOut, costUSD interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IncrementAgentNetworkConsumptionBatch", reflect.TypeOf((*MockStore)(nil).IncrementAgentNetworkConsumptionBatch), ctx, accountID, keys, tokensIn, tokensOut, costUSD)
-}
-
-// ListAgentNetworkConsumption mocks base method.
-func (m *MockStore) ListAgentNetworkConsumption(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Consumption, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ListAgentNetworkConsumption", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*agentNetworkTypes.Consumption)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// ListAgentNetworkConsumption indicates an expected call of ListAgentNetworkConsumption.
-func (mr *MockStoreMockRecorder) ListAgentNetworkConsumption(ctx, lockStrength, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListAgentNetworkConsumption", reflect.TypeOf((*MockStore)(nil).ListAgentNetworkConsumption), ctx, lockStrength, accountID)
-}
-
-// GetAccountAgentNetworkBudgetRules mocks base method.
-func (m *MockStore) GetAccountAgentNetworkBudgetRules(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.AccountBudgetRule, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountAgentNetworkBudgetRules", ctx, lockStrength, accountID)
-	ret0, _ := ret[0].([]*agentNetworkTypes.AccountBudgetRule)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAccountAgentNetworkBudgetRules indicates an expected call of GetAccountAgentNetworkBudgetRules.
-func (mr *MockStoreMockRecorder) GetAccountAgentNetworkBudgetRules(ctx, lockStrength, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkBudgetRules", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkBudgetRules), ctx, lockStrength, accountID)
-}
-
-// GetAgentNetworkBudgetRuleByID mocks base method.
-func (m *MockStore) GetAgentNetworkBudgetRuleByID(ctx context.Context, lockStrength LockingStrength, accountID, ruleID string) (*agentNetworkTypes.AccountBudgetRule, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkBudgetRuleByID", ctx, lockStrength, accountID, ruleID)
-	ret0, _ := ret[0].(*agentNetworkTypes.AccountBudgetRule)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkBudgetRuleByID indicates an expected call of GetAgentNetworkBudgetRuleByID.
-func (mr *MockStoreMockRecorder) GetAgentNetworkBudgetRuleByID(ctx, lockStrength, accountID, ruleID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkBudgetRuleByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkBudgetRuleByID), ctx, lockStrength, accountID, ruleID)
-}
-
-// SaveAgentNetworkBudgetRule mocks base method.
-func (m *MockStore) SaveAgentNetworkBudgetRule(ctx context.Context, rule *agentNetworkTypes.AccountBudgetRule) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SaveAgentNetworkBudgetRule", ctx, rule)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// SaveAgentNetworkBudgetRule indicates an expected call of SaveAgentNetworkBudgetRule.
-func (mr *MockStoreMockRecorder) SaveAgentNetworkBudgetRule(ctx, rule interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkBudgetRule", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkBudgetRule), ctx, rule)
-}
-
-// DeleteAgentNetworkBudgetRule mocks base method.
-func (m *MockStore) DeleteAgentNetworkBudgetRule(ctx context.Context, accountID, ruleID string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteAgentNetworkBudgetRule", ctx, accountID, ruleID)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// DeleteAgentNetworkBudgetRule indicates an expected call of DeleteAgentNetworkBudgetRule.
-func (mr *MockStoreMockRecorder) DeleteAgentNetworkBudgetRule(ctx, accountID, ruleID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkBudgetRule", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkBudgetRule), ctx, accountID, ruleID)
-}
-
-// CreateAgentNetworkAccessLog mocks base method.
-func (m *MockStore) CreateAgentNetworkAccessLog(ctx context.Context, entry *agentNetworkTypes.AgentNetworkAccessLog, groups []agentNetworkTypes.AgentNetworkAccessLogGroup) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CreateAgentNetworkAccessLog", ctx, entry, groups)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// CreateAgentNetworkAccessLog indicates an expected call of CreateAgentNetworkAccessLog.
-func (mr *MockStoreMockRecorder) CreateAgentNetworkAccessLog(ctx, entry, groups interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAgentNetworkAccessLog", reflect.TypeOf((*MockStore)(nil).CreateAgentNetworkAccessLog), ctx, entry, groups)
-}
-
-// CreateAgentNetworkUsage mocks base method.
-func (m *MockStore) CreateAgentNetworkUsage(ctx context.Context, usage *agentNetworkTypes.AgentNetworkUsage, groups []agentNetworkTypes.AgentNetworkUsageGroup) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CreateAgentNetworkUsage", ctx, usage, groups)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// CreateAgentNetworkUsage indicates an expected call of CreateAgentNetworkUsage.
-func (mr *MockStoreMockRecorder) CreateAgentNetworkUsage(ctx, usage, groups interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAgentNetworkUsage", reflect.TypeOf((*MockStore)(nil).CreateAgentNetworkUsage), ctx, usage, groups)
-}
-
-// GetAgentNetworkAccessLogs mocks base method.
-func (m *MockStore) GetAgentNetworkAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLog, int64, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkAccessLogs", ctx, lockStrength, accountID, filter)
-	ret0, _ := ret[0].([]*agentNetworkTypes.AgentNetworkAccessLog)
-	ret1, _ := ret[1].(int64)
-	ret2, _ := ret[2].(error)
-	return ret0, ret1, ret2
-}
-
-// GetAgentNetworkAccessLogs indicates an expected call of GetAgentNetworkAccessLogs.
-func (mr *MockStoreMockRecorder) GetAgentNetworkAccessLogs(ctx, lockStrength, accountID, filter interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkAccessLogs", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkAccessLogs), ctx, lockStrength, accountID, filter)
-}
-
-// GetAgentNetworkAccessLogSessions mocks base method.
-func (m *MockStore) GetAgentNetworkAccessLogSessions(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLogSession, int64, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkAccessLogSessions", ctx, lockStrength, accountID, filter)
-	ret0, _ := ret[0].([]*agentNetworkTypes.AgentNetworkAccessLogSession)
-	ret1, _ := ret[1].(int64)
-	ret2, _ := ret[2].(error)
-	return ret0, ret1, ret2
-}
-
-// GetAgentNetworkAccessLogSessions indicates an expected call of GetAgentNetworkAccessLogSessions.
-func (mr *MockStoreMockRecorder) GetAgentNetworkAccessLogSessions(ctx, lockStrength, accountID, filter interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkAccessLogSessions", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkAccessLogSessions), ctx, lockStrength, accountID, filter)
-}
-
-// GetAgentNetworkUsageRows mocks base method.
-func (m *MockStore) GetAgentNetworkUsageRows(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkUsage, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkUsageRows", ctx, lockStrength, accountID, filter)
-	ret0, _ := ret[0].([]*agentNetworkTypes.AgentNetworkUsage)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkUsageRows indicates an expected call of GetAgentNetworkUsageRows.
-func (mr *MockStoreMockRecorder) GetAgentNetworkUsageRows(ctx, lockStrength, accountID, filter interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkUsageRows", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkUsageRows), ctx, lockStrength, accountID, filter)
-}
-
-// DeleteOldAgentNetworkAccessLogs mocks base method.
-func (m *MockStore) DeleteOldAgentNetworkAccessLogs(ctx context.Context, accountID string, olderThan time.Time) (int64, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteOldAgentNetworkAccessLogs", ctx, accountID, olderThan)
-	ret0, _ := ret[0].(int64)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// DeleteOldAgentNetworkAccessLogs indicates an expected call of DeleteOldAgentNetworkAccessLogs.
-func (mr *MockStoreMockRecorder) DeleteOldAgentNetworkAccessLogs(ctx, accountID, olderThan interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteOldAgentNetworkAccessLogs", reflect.TypeOf((*MockStore)(nil).DeleteOldAgentNetworkAccessLogs), ctx, accountID, olderThan)
-}
-
-// GetAllAgentNetworkSettings mocks base method.
-func (m *MockStore) GetAllAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength) ([]*agentNetworkTypes.Settings, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAllAgentNetworkSettings", ctx, lockStrength)
-	ret0, _ := ret[0].([]*agentNetworkTypes.Settings)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAllAgentNetworkSettings indicates an expected call of GetAllAgentNetworkSettings.
-func (mr *MockStoreMockRecorder) GetAllAgentNetworkSettings(ctx, lockStrength interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).GetAllAgentNetworkSettings), ctx, lockStrength)
-}

management/server/types/account_components.go

@@ -134,8 +134,8 @@ func (a *Account) GetPeerNetworkMapComponents(
 		NetworkResources:     make([]*resourceTypes.NetworkResource, 0),
 		PostureFailedPeers:   make(map[string]map[string]struct{}, len(a.PostureChecks)),
 		RouterPeers:          make(map[string]*nbpeer.Peer),
-		NetworkXIDToSeq:      make(map[string]uint32, len(a.Networks)),
-		PostureCheckXIDToSeq: make(map[string]uint32, len(a.PostureChecks)),
+		NetworkXIDToSeq:      make(map[string]int32, len(a.Networks)),
+		PostureCheckXIDToSeq: make(map[string]int32, len(a.PostureChecks)),
 	}
 	for _, n := range a.Networks {
 		if n != nil && n.HasSeqID() {

route/route.go

@@ -97,7 +97,7 @@ type Route struct {
 	AccountID string `gorm:"index"`
 	// AccountSeqID is a per-account monotonically increasing identifier used as the
 	// compact wire id when sending NetworkMap components to capable peers.
-	AccountSeqID uint32 `json:"-" gorm:"index:idx_routes_account_seq_id;not null;default:0"`
+	AccountSeqID int32 `json:"-" gorm:"not null;default:0"`
 	// Network and Domains are mutually exclusive
 	Network             netip.Prefix `gorm:"serializer:json"`
 	Domains             domain.List  `gorm:"serializer:json"`

shared/management/networkmap/envelope.go

@@ -5,8 +5,8 @@ import (
 	"encoding/base64"
 	"fmt"
 
-	"github.com/netbirdio/netbird/shared/management/types"
 	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/shared/management/types"
 )
 
 // EnvelopeResult is what the client engine consumes after receiving a
@@ -187,4 +187,3 @@ func canonicalizeWgKey(s string) string {
 	}
 	return base64.StdEncoding.EncodeToString(raw)
 }
-

shared/management/proto/management.proto

@@ -864,16 +864,16 @@ message NetworkMapComponentsFull {
   // entry because capability=3 has never been released — every cap=3
   // producer and consumer carries the same regenerated descriptor. Do NOT
   // reuse this pattern for any further wire change once cap=3 ships.
-  map<uint32, NetworkRouterList> routers_map = 18;
+  map<int32, NetworkRouterList> routers_map = 18;
 
   // For each NetworkResource account_seq_id, the indexes into policies[]
   // that apply to it.
   //
   // INCOMPATIBLE WIRE CHANGE: see routers_map note above.
-  map<uint32, PolicyIndexes> resource_policies_map = 19;
+  map<int32, PolicyIds> resource_policies_map = 19;
 
   // Group-id (account_seq_id) → user ids authorized for SSH on members.
-  map<uint32, UserIDList> group_id_to_user_ids = 20;
+  map<int32, UserIDList> group_id_to_user_ids = 20;
 
   // Account-level allowed user ids (used by Calculate() when assembling SSH
   // authorized users for the receiving peer).
@@ -883,7 +883,7 @@ message NetworkMapComponentsFull {
   // the check. Server-side evaluation result; clients do not re-evaluate.
   //
   // INCOMPATIBLE WIRE CHANGE: see routers_map note above.
-  map<uint32, PeerIndexSet> posture_failed_peers = 22;
+  map<int32, PeerIndexSet> posture_failed_peers = 22;
 
   // Account-level DNS forwarder port (mirrors the legacy
   // proto.DNSConfig.ForwarderPort). Computed by the controller from peer
@@ -978,8 +978,7 @@ message PeerCompact {
   // dns_label + "." + NetworkMapComponentsFull.dns_domain.
   string dns_label = 5;
 
-  // Index into NetworkMapComponentsFull.agent_versions.
-  uint32 agent_version_idx = 6;
+  string agent_version = 6;
 
   // True iff the peer was added via SSO login (i.e., types.Peer.UserID is
   // non-empty). Combined with login_expiration_enabled and
@@ -1003,25 +1002,23 @@ message PeerCompact {
   // peer when this bit is set, even without an explicit NetbirdSSH rule.
   bool ssh_enabled = 10;
 
-  reserved 11; // was: id (string xid)
-
   // Mirror of types.Peer.SupportsIPv6() — !Meta.Flags.DisableIPv6 &&
   // HasCapability(PeerCapabilityIPv6Overlay). Used by the local peer's
   // Calculate() when deciding whether to emit IPv6 firewall rules
   // (appendIPv6FirewallRule) against this peer's IPv6 address.
-  bool supports_ipv6 = 12;
+  bool supports_ipv6 = 11;
 
   // Mirror of types.Peer.SupportsSourcePrefixes() —
   // HasCapability(PeerCapabilitySourcePrefixes). Determines whether the
   // local peer's Calculate() emits SourcePrefixes alongside legacy PeerIP
   // fields in proto.FirewallRule.
-  bool supports_source_prefixes = 13;
+  bool supports_source_prefixes = 12;
 
   // Mirror of types.Peer.Meta.Flags.ServerSSHAllowed. Read by Calculate()
   // when expanding TCP port-22 firewall rules — the native SSH companion
   // (port 22022) is only added when this flag is set and the peer agent
   // version supports it.
-  bool server_ssh_allowed = 14;
+  bool server_ssh_allowed = 13;
 }
 
 // PolicyCompact is the compact form of a policy rule. Group references use
@@ -1033,7 +1030,7 @@ message PolicyCompact {
   // Per-account integer id (matches policies.account_seq_id). Used as a
   // stable reference for ResourcePoliciesMap.indexes and future delta
   // updates.
-  uint32 id = 1;
+  int32 id = 1;
 
   RuleAction action = 2;
   RuleProtocol protocol = 3;
@@ -1046,10 +1043,8 @@ message PolicyCompact {
   repeated PortInfo.Range port_ranges = 6;
 
   // Group ids (account_seq_id) of source / destination groups.
-  repeated uint32 source_group_ids = 7;
-  repeated uint32 destination_group_ids = 8;
-
-  reserved 9; // was: xid (string)
+  repeated int32 source_group_ids = 7;
+  repeated int32 destination_group_ids = 8;
 
   // SSH authorization fields. PolicyRule.AuthorizedGroups maps the rule's
   // applicable group ids (account_seq_id) to a list of local-user names —
@@ -1059,8 +1054,8 @@ message PolicyCompact {
   //
   // Both fields are only consumed by Calculate() when the rule's protocol
   // is NetbirdSSH (or the legacy implicit-SSH heuristic).
-  map<uint32, UserNameList> authorized_groups = 10;
-  string authorized_user = 11;
+  map<int32, UserNameList> authorized_groups = 9;
+  string authorized_user = 10;
 
   // Resource-typed rule sources/destinations. When a rule targets a specific
   // peer (rather than groups), Calculate() reads SourceResource /
@@ -1069,16 +1064,14 @@ message PolicyCompact {
   // NetworkMapComponentsFull.peers; type is the raw ResourceType string
   // ("peer", "host", "subnet", "domain"). Only "peer" is meaningful for
   // Calculate's resource-typed rule path today.
-  ResourceCompact source_resource = 12;
-  ResourceCompact destination_resource = 13;
+  ResourceCompact source_resource = 11;
+  ResourceCompact destination_resource = 12;
 
   // Posture-check seq ids gating this policy's source peers. Calculate()
   // reads them when filtering rule peers (peers that fail any listed check
   // are dropped from sourcePeers). Match keys in
   // NetworkMapComponentsFull.posture_failed_peers.
-  repeated uint32 source_posture_check_seq_ids = 15;
-
-  reserved 14; // was: source_posture_check_ids (repeated string xid)
+  repeated int32 source_posture_check_seq_ids = 13;
 }
 
 // ResourceCompact mirrors types.Resource. Used by PolicyCompact to carry
@@ -1104,7 +1097,7 @@ message UserNameList {
 message GroupCompact {
   // Per-account integer id (matches groups.account_seq_id). Used by
   // PolicyCompact.source_group_ids / destination_group_ids.
-  uint32 id = 1;
+  int32 id = 1;
 
   // Group name; only sent when non-empty (clients use it for diagnostics).
   string name = 2;
@@ -1116,7 +1109,7 @@ message GroupCompact {
 // DNSSettingsCompact mirrors types.DNSSettings.
 message DNSSettingsCompact {
   // Group ids (account_seq_id) whose DNS management is disabled.
-  repeated uint32 disabled_management_group_ids = 1;
+  repeated int32 disabled_management_group_ids = 1;
 }
 
 // RouteRaw mirrors *route.Route (the domain type), trimmed to fields that
@@ -1125,7 +1118,7 @@ message DNSSettingsCompact {
 // NetworkMapComponentsFull.peers.
 message RouteRaw {
   // Per-account integer id (matches routes.account_seq_id).
-  uint32 id = 1;
+  int32 id = 1;
   string net_id = 2;
   string description = 3;
 
@@ -1146,30 +1139,28 @@ message RouteRaw {
   // path will substitute the WG key downstream.
   bool peer_index_set = 7;
   uint32 peer_index = 8;
-  repeated uint32 peer_group_ids = 9;
+  repeated int32 peer_group_ids = 9;
 
   int32 network_type = 10;
   bool masquerade = 11;
   int32 metric = 12;
   bool enabled = 13;
-  repeated uint32 group_ids = 14;
-  repeated uint32 access_control_group_ids = 15;
+  repeated int32 group_ids = 14;
+  repeated int32 access_control_group_ids = 15;
   bool skip_auto_apply = 16;
-
-  reserved 17; // was: xid (string)
 }
 
 // NameServerGroupRaw mirrors *nbdns.NameServerGroup. Distinct from the
 // legacy NameServerGroup (which is the wire-trimmed shape consumed by
 // proto.DNSConfig and lacks the Name/Description/Groups/Enabled fields).
 message NameServerGroupRaw {
-  uint32 id = 1;            // nameserver_groups.account_seq_id
+  int32 id = 1;            // nameserver_groups.account_seq_id
   string name = 2;
   string description = 3;
   // Reuses the legacy NameServer wire shape (IP as string).
   repeated NameServer nameservers = 4;
   // Group ids (account_seq_id) the NSG distributes nameservers to.
-  repeated uint32 group_ids = 5;
+  repeated int32 group_ids = 5;
   bool primary = 6;
   repeated string domains = 7;
   bool enabled = 8;
@@ -1184,8 +1175,8 @@ message NameServerGroupRaw {
 // carries the same regenerated descriptor. Do NOT reuse this pattern once
 // cap=3 ships.
 message NetworkResourceRaw {
-  uint32 id = 1;            // network_resources.account_seq_id
-  uint32 network_seq = 2;   // networks.account_seq_id (replaces xid)
+  int32 id = 1;            // network_resources.account_seq_id
+  int32 network_seq = 2;   // networks.account_seq_id (replaces xid)
   string name = 3;
   string description = 4;
   // Resource type: "host" / "subnet" / "domain".
@@ -1194,7 +1185,6 @@ message NetworkResourceRaw {
   string domain_value = 7;  // resource.Domain
   string prefix_cidr = 8;
   bool enabled = 9;
-  reserved 10; // was: xid (string)
 }
 
 // NetworkRouterList carries the routers backing one network.
@@ -1206,18 +1196,17 @@ message NetworkRouterList {
 // NetworkRouterEntry mirrors a single *routerTypes.NetworkRouter; the routing
 // peer is referenced by index into NetworkMapComponentsFull.peers.
 message NetworkRouterEntry {
-  uint32 id = 1;            // network_routers.account_seq_id
+  int32 id = 1;            // network_routers.account_seq_id
   uint32 peer_index = 2;
   bool peer_index_set = 3;
-  repeated uint32 peer_group_ids = 4;
+  repeated int32 peer_group_ids = 4;
   bool masquerade = 5;
   int32 metric = 6;
   bool enabled = 7;
 }
 
-// PolicyIndexes is a list of indexes into NetworkMapComponentsFull.policies.
-message PolicyIndexes {
-  repeated uint32 indexes = 1;
+message PolicyIds {
+  repeated int32 ids = 1;
 }
 
 // UserIDList is a list of user ids — used as the value type in

shared/management/types/group.go

@@ -21,7 +21,7 @@ type Group struct {
 
 	// AccountSeqID is a per-account monotonically increasing identifier used as the
 	// compact wire id when sending NetworkMap components to capable peers.
-	AccountSeqID uint32 `json:"-" gorm:"index:idx_groups_account_seq_id;not null;default:0"`
+	AccountSeqID int32 `json:"-" gorm:"not null;default:0"`
 
 	// Name visible in the UI
 	Name string

shared/management/types/networkmap_components.go

@@ -47,12 +47,12 @@ type NetworkMapComponents struct {
 	// account-side component builder; consumed by the envelope encoder to
 	// translate RoutersMap keys and NetworkResource.NetworkID references
 	// to compact uint32 ids. Legacy Calculate() doesn't consult it.
-	NetworkXIDToSeq map[string]uint32
+	NetworkXIDToSeq map[string]int32
 
 	// PostureCheckXIDToSeq maps posture.Checks.ID (xid) → AccountSeqID.
 	// Same role as NetworkXIDToSeq, used for PostureFailedPeers keys and
 	// policy SourcePostureChecks references.
-	PostureCheckXIDToSeq map[string]uint32
+	PostureCheckXIDToSeq map[string]int32
 }
 
 type AccountSettingsInfo struct {

shared/management/types/policy.go

@@ -61,7 +61,7 @@ type Policy struct {
 
 	// AccountSeqID is a per-account monotonically increasing identifier used as the
 	// compact wire id when sending NetworkMap components to capable peers.
-	AccountSeqID uint32 `json:"-" gorm:"index:idx_policies_account_seq_id;not null;default:0"`
+	AccountSeqID int32 `json:"-" gorm:"not null;default:0"`
 
 	// Name of the Policy
 	Name string