Merge branch 'main' into worktree-dns-route-qtype-fallthrough

Co-authored-by: braginini <bangvalo@gmail.com>

.github/workflows/agent-network-e2e.yml

@@ -5,6 +5,13 @@ on:
   schedule:
     - cron: "0 3 * * *"
   workflow_dispatch:
+    inputs:
+      bedrock_model:
+        description: >-
+          Bedrock inference-profile id to drive the matrix with, exactly as
+          AWS issues it. Leave empty for the Sonnet 4.6 default.
+        required: false
+        default: ""
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -62,6 +69,8 @@ jobs:
           CLOUDFLARE_TOKEN: ${{ secrets.E2E_CLOUDFLARE_TOKEN }}
           AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.E2E_AWS_BEARER_TOKEN_BEDROCK }}
           AWS_REGION: ${{ secrets.E2E_AWS_REGION }}
+          # Bedrock model override: dispatch input wins, then the repo variable, else the test default.
+          AWS_BEDROCK_MODEL: ${{ inputs.bedrock_model || vars.E2E_AWS_BEDROCK_MODEL }}
           # Vertex (Anthropic-on-Vertex): SA + project required; region defaults
           # to "global", model to a pinned claude snapshot.
           GOOGLE_VERTEX_SA_BASE64: ${{ secrets.E2E_GOOGLE_VERTEX_SA_BASE64 }}

client/iface/iface_test.go

@@ -464,6 +464,8 @@ func Test_RemovePeer(t *testing.T) {
 }
 
 func Test_ConnectPeers(t *testing.T) {
+	t.Setenv("NB_DISABLE_EBPF_WG_PROXY", "true")
+
 	peer1ifaceName := fmt.Sprintf("utun%d", WgIntNumber+400)
 	peer1wgIP := netip.MustParsePrefix("10.99.99.17/30")
 	peer1Key, _ := wgtypes.GeneratePrivateKey()
@@ -505,12 +507,8 @@ func Test_ConnectPeers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	localIP, err := getLocalIP()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	peer1endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP, peer1wgPort))
+	localIP1 := "127.0.0.1"
+	peer1endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP1, peer1wgPort))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -546,7 +544,8 @@ func Test_ConnectPeers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	peer2endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP, peer2wgPort))
+	localIP2 := "127.0.0.1"
+	peer2endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP2, peer2wgPort))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -621,28 +620,3 @@ func getPeer(ifaceName, peerPubKey string) (wgtypes.Peer, error) {
 	}
 	return wgtypes.Peer{}, fmt.Errorf("peer not found")
 }
-
-func getLocalIP() (string, error) {
-	// Get all interfaces
-	addrs, err := net.InterfaceAddrs()
-	if err != nil {
-		return "", err
-	}
-
-	for _, addr := range addrs {
-		ipNet, ok := addr.(*net.IPNet)
-		if !ok {
-			continue
-		}
-		if ipNet.IP.IsLoopback() {
-			continue
-		}
-
-		if ipNet.IP.To4() == nil {
-			continue
-		}
-		return ipNet.IP.String(), nil
-	}
-
-	return "", fmt.Errorf("no local IP found")
-}

client/internal/dns/handler_chain.go

@@ -3,6 +3,7 @@ package dns
 import (
 	"context"
 	"fmt"
+	"maps"
 	"math"
 	"net"
 	"slices"
@@ -31,6 +32,26 @@ type SubdomainMatcher interface {
 	MatchSubdomains() bool
 }
 
+// responseMeta holds the annotations handlers attach to a request to explain the
+// response the chain ends up writing. It survives a deferral, so an answer that
+// did not come from the handler that owns the name still says who stepped aside
+// and why.
+type responseMeta map[resutil.MetaKey]string
+
+// format renders the annotations for the response log line. The order is stable
+// so the same event reads the same way every time; a map's own order is not.
+func (m responseMeta) format() string {
+	if len(m) == 0 {
+		return ""
+	}
+
+	var b strings.Builder
+	for _, k := range slices.Sorted(maps.Keys(m)) {
+		b.WriteString(" " + string(k) + "=" + m[k])
+	}
+	return b.String()
+}
+
 type HandlerEntry struct {
 	Handler         dns.Handler
 	Priority        int
@@ -52,8 +73,19 @@ type ResponseWriterChain struct {
 	origPattern    string
 	requestID      string
 	shouldContinue bool
-	response       *dns.Msg
-	meta           map[string]string
+	// softNegative suppresses a poisoning negative verdict for this request. A
+	// handler that owns the name but cannot answer this query type sets it
+	// before deferring, and it stays set for every handler that runs after.
+	softNegative bool
+	// clientHasEdns records whether the original query advertised EDNS0, taken
+	// before any handler ran: handlers add EDNS0 to the query they forward
+	// upstream, so the message itself no longer answers the question later.
+	clientHasEdns bool
+	response      *dns.Msg
+	// meta is handed to the next handler when this one defers, so the same map
+	// outlives the writer that created it. Handlers must only set metadata from
+	// within ServeDNS, never from a goroutine that outlives the call.
+	meta responseMeta
 }
 
 // RequestID returns the request ID for tracing
@@ -62,26 +94,64 @@ func (w *ResponseWriterChain) RequestID() string {
 }
 
 // SetMeta sets a metadata key-value pair for logging
-func (w *ResponseWriterChain) SetMeta(key, value string) {
+func (w *ResponseWriterChain) SetMeta(key resutil.MetaKey, value string) {
 	if w.meta == nil {
-		w.meta = make(map[string]string)
+		w.meta = make(responseMeta)
 	}
 	w.meta[key] = value
 }
 
+// RequestSoftNegative marks the request so a downstream NXDOMAIN is turned into
+// NODATA before it reaches the client. Set by a handler that defers a query for
+// a name it owns but a type it cannot resolve.
+func (w *ResponseWriterChain) RequestSoftNegative() {
+	w.softNegative = true
+}
+
 func (w *ResponseWriterChain) WriteMsg(m *dns.Msg) error {
 	// Check if this is a continue signal (NXDOMAIN with Zero bit set)
 	if m.Rcode == dns.RcodeNameError && m.MsgHdr.Zero {
 		w.shouldContinue = true
 		return nil
 	}
+	if w.softNegative && m.Rcode == dns.RcodeNameError {
+		m = softenNegative(m, w.clientHasEdns)
+		w.SetMeta(resutil.MetaKeySoftened, "nxdomain->nodata")
+	}
 	w.response = m
 	if m.MsgHdr.Truncated {
-		w.SetMeta("truncated", "true")
+		w.SetMeta(resutil.MetaKeyTruncated, "true")
 	}
 	return w.ResponseWriter.WriteMsg(m)
 }
 
+// softenNegative downgrades an NXDOMAIN to NODATA for a request a handler that
+// owns the name deferred. NXDOMAIN is cached for the name and every type below
+// it, so a resolver that has never heard of a routed name would take out the
+// record types the route does serve; NODATA is cached for this name and type
+// only. The authority section goes with it: the negative TTL of a zone we just
+// overruled does not apply, and RFC 2308 keeps a negative answer that carries no
+// SOA out of caches altogether, so the rewrite cannot outlive the route.
+//
+// The rewrite is ours, not the answering resolver's, so an EDNS0 client is told
+// as much: the reply we hand back travels a path no capture on this host sees,
+// and an empty answer is otherwise indistinguishable from a real one. Returns a
+// copy so the answering handler keeps whatever it may hold on to.
+func softenNegative(m *dns.Msg, clientHasEdns bool) *dns.Msg {
+	out := m.Copy()
+	out.Rcode = dns.RcodeSuccess
+	out.Ns = nil
+
+	if clientHasEdns {
+		resutil.AttachEDE(out, resutil.EDENetbirdSoftenedNegative,
+			"netbird: name is served locally, NXDOMAIN from the fallthrough resolver suppressed")
+	} else {
+		resutil.StripOPT(out)
+	}
+
+	return out
+}
+
 func NewHandlerChain() *HandlerChain {
 	return &HandlerChain{
 		handlers: make([]HandlerEntry, 0),
@@ -223,6 +293,19 @@ func (c *HandlerChain) dispatch(w dns.ResponseWriter, r *dns.Msg, maxPriority in
 	handlers := slices.Clone(c.handlers)
 	c.mu.RUnlock()
 
+	// Carried across deferrals: once a handler that owns the name defers, no
+	// handler after it may answer with a verdict that poisons the name. The
+	// metadata of a handler that stepped aside is carried too, so the response
+	// log line explains an answer that did not come from the handler that owns
+	// the name.
+	var softNegative bool
+	var carried responseMeta
+
+	// Taken before any handler runs: handlers advertise EDNS0 on the query they
+	// forward upstream, so afterwards the message no longer tells us whether the
+	// client did.
+	clientHasEdns := r.IsEdns0() != nil
+
 	// Try handlers in priority order
 	for _, entry := range handlers {
 		if entry.Priority > maxPriority {
@@ -245,11 +328,16 @@ func (c *HandlerChain) dispatch(w dns.ResponseWriter, r *dns.Msg, maxPriority in
 			ResponseWriter: w,
 			origPattern:    entry.OrigPattern,
 			requestID:      requestID,
+			softNegative:   softNegative,
+			clientHasEdns:  clientHasEdns,
+			meta:           carried,
 		}
 		entry.Handler.ServeDNS(chainWriter, r)
 
 		// If handler wants to continue, try next handler
 		if chainWriter.shouldContinue {
+			softNegative = softNegative || chainWriter.softNegative
+			carried = chainWriter.meta
 			if entry.Priority != PriorityMgmtCache {
 				logger.Tracef("handler requested continue for domain=%s", qname)
 			}
@@ -265,30 +353,59 @@ func (c *HandlerChain) dispatch(w dns.ResponseWriter, r *dns.Msg, maxPriority in
 		qname, dns.TypeToString[question.Qtype], dns.ClassToString[question.Qclass])
 	resp := &dns.Msg{}
 	resp.SetRcode(r, dns.RcodeRefused)
+	// A handler that owns the name deferred and nothing below it could answer
+	// (a client with no primary nameserver group). The name exists as far as
+	// this client is concerned, since the route serves its addresses, so REFUSED
+	// would contradict the route: a stub that takes it as "not served here" and
+	// retries another resolver can come back with an NXDOMAIN that takes the
+	// whole name down. Answer "no records of this type" instead, without an SOA,
+	// so RFC 2308 keeps it out of negative caches, and tell an EDNS0 client the
+	// empty answer is ours rather than a resolver's.
+	if softNegative {
+		resp.Rcode = dns.RcodeSuccess
+		if clientHasEdns {
+			resutil.AttachEDE(resp, resutil.EDENetbirdSoftenedNegative,
+				"netbird: name is served locally, no fallthrough resolver for this query type")
+		}
+		// logResponse never runs on this path, so the carried metadata is
+		// appended here or the reason for the deferral is lost in exactly the
+		// case that is hardest to diagnose.
+		logger.Tracef("no handler below the deferring one for domain=%s type=%s, answering NODATA%s",
+			qname, dns.TypeToString[question.Qtype], carried.format())
+	}
 	if err := w.WriteMsg(resp); err != nil {
 		logger.Errorf("failed to write DNS response: %v", err)
 	}
 }
 
 func (c *HandlerChain) logResponse(logger *log.Entry, cw *ResponseWriterChain, qname string, startTime time.Time) {
+	// Runs for every query, and the arguments below are not free: Len() packs
+	// the message to measure it, and formatting the answers and the metadata
+	// allocates. None of it is worth doing when the line is discarded.
+	if !log.IsLevelEnabled(log.TraceLevel) {
+		return
+	}
+
 	if cw.response == nil {
 		return
 	}
 
-	var meta string
-	for k, v := range cw.meta {
-		meta += " " + k + "=" + v
-	}
-
 	logger.Tracef("response: domain=%s rcode=%s answers=%s size=%dB%s took=%s",
 		qname, dns.RcodeToString[cw.response.Rcode], resutil.FormatAnswers(cw.response.Answer),
-		cw.response.Len(), meta, time.Since(startTime))
+		cw.response.Len(), cw.meta.format(), time.Since(startTime))
 }
 
 // ResolveInternal runs an in-process DNS query against the chain, skipping any
 // handler with priority > maxPriority. Used by internal callers (e.g. the mgmt
-// cache refresher) that must bypass themselves to avoid loops. Honors ctx
-// cancellation; on ctx.Done the dispatch goroutine is left to drain on its own
+// cache refresher) that must bypass themselves to avoid loops.
+//
+// "Nothing answered" is read off RcodeRefused, which a request soft-negatived by
+// a deferring handler never carries: it ends in an empty NOERROR instead, and
+// would look resolved. No caller can reach that today, since every handler that
+// defers sits above the maxPriority any caller passes. Lowering one below it
+// means this check needs the soft-negative case too.
+//
+// Honors ctx cancellation; on ctx.Done the dispatch goroutine is left to drain on its own
 // (bounded by the invoked handler's internal timeout).
 func (c *HandlerChain) ResolveInternal(ctx context.Context, r *dns.Msg, maxPriority int) (*dns.Msg, error) {
 	if len(r.Question) == 0 {

client/internal/dns/handler_chain_test.go

@@ -3,15 +3,19 @@ package dns_test
 import (
 	"context"
 	"net"
+	"strings"
 	"testing"
 	"time"
 
 	"github.com/miekg/dns"
+	log "github.com/sirupsen/logrus"
+	logtest "github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 
 	nbdns "github.com/netbirdio/netbird/client/internal/dns"
+	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 	"github.com/netbirdio/netbird/client/internal/dns/test"
 )
 
@@ -1238,6 +1242,276 @@ func TestHandlerChain_ResolveInternal_HonorsContextTimeout(t *testing.T) {
 	assert.Less(t, elapsed, 500*time.Millisecond, "ResolveInternal must return shortly after ctx deadline")
 }
 
+// requestSoftNegative asks the chain to soften a negative verdict produced by
+// the handlers that run after the caller defers, reporting whether the chain
+// supports the signal. Written as a type assertion so these tests compile
+// against a chain that does not support it yet.
+func requestSoftNegative(w dns.ResponseWriter) bool {
+	sn, ok := w.(interface{ RequestSoftNegative() })
+	if ok {
+		sn.RequestSoftNegative()
+	}
+	return ok
+}
+
+// deferringHandler defers to the next handler in the chain, optionally asking
+// for the negative verdict of whatever answers instead to be softened. This is
+// what a DNS route handler does for a record type its routing peer cannot
+// resolve.
+type deferringHandler struct {
+	softNegative bool
+	called       bool
+	supported    bool
+}
+
+func (h *deferringHandler) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
+	h.called = true
+	if h.softNegative {
+		h.supported = requestSoftNegative(w)
+		// The real handler records why it stepped aside, for the response log
+		// line of whichever handler answers instead.
+		resutil.SetMeta(w, resutil.MetaKeyDeferredBy, "test handler")
+	}
+	resp := new(dns.Msg)
+	resp.SetRcode(r, dns.RcodeNameError)
+	resp.MsgHdr.Zero = true
+	_ = w.WriteMsg(resp)
+}
+
+// nxdomainHandler answers an authoritative NXDOMAIN with an SOA in the
+// authority section, the way a public resolver answers for a name that only
+// exists inside the routed network.
+type nxdomainHandler struct{}
+
+func (h *nxdomainHandler) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
+	resp := new(dns.Msg)
+	resp.SetRcode(r, dns.RcodeNameError)
+	resp.Ns = []dns.RR{&dns.SOA{
+		Hdr:     dns.RR_Header{Name: "example.com.", Rrtype: dns.TypeSOA, Class: dns.ClassINET, Ttl: 3600},
+		Ns:      "ns1.example.com.",
+		Mbox:    "hostmaster.example.com.",
+		Minttl:  3600,
+		Expire:  604800,
+		Refresh: 7200,
+		Retry:   3600,
+	}}
+	_ = w.WriteMsg(resp)
+}
+
+// TestHandlerChain_SoftNegative_DowngradesDownstreamNXDOMAIN is the whole point
+// of the soft-negative signal: a route handler may only defer a query to the
+// public chain if the answer cannot poison the routed name. NXDOMAIN is cached
+// for the name and every type under it (RFC 2308, RFC 8020), so it has to be
+// rewritten to NODATA, which is cached per name and type only.
+func TestHandlerChain_SoftNegative_DowngradesDownstreamNXDOMAIN(t *testing.T) {
+	chain := nbdns.NewHandlerChain()
+
+	route := &deferringHandler{softNegative: true}
+	chain.AddHandler("*.example.com.", route, nbdns.PriorityDNSRoute)
+	chain.AddHandler(".", &nxdomainHandler{}, nbdns.PriorityDefault)
+
+	r := new(dns.Msg)
+	r.SetQuestion("_mongodb._tcp.db.example.com.", dns.TypeSRV)
+
+	mw := &test.MockResponseWriter{}
+	chain.ServeDNS(&nbdns.ResponseWriterChain{ResponseWriter: mw}, r)
+
+	resp := mw.GetLastResponse()
+	require.NotNil(t, resp, "a response must reach the client")
+	assert.True(t, route.called, "the route handler must run first")
+	require.True(t, route.supported, "the chain writer must accept a soft-negative request")
+	assert.Equal(t, dns.RcodeSuccess, resp.Rcode, "NXDOMAIN must be softened to NODATA")
+	assert.Empty(t, resp.Answer, "a softened negative carries no answer")
+	assert.Empty(t, resp.Ns, "the downstream zone's SOA must not set the negative TTL for a name we overrode")
+}
+
+// responseLineFor returns the chain's response log line for one query. Raising
+// the level to trace also unmutes whatever else is logging in this package, so
+// the line has to be picked by the name it was asked about rather than by being
+// the last one seen.
+func responseLineFor(hook *logtest.Hook, qname string) string {
+	for _, e := range hook.AllEntries() {
+		if strings.HasPrefix(e.Message, "response:") && strings.Contains(e.Message, qname) {
+			return e.Message
+		}
+	}
+	return ""
+}
+
+// TestHandlerChain_SoftNegative_IsVisibleToTheClient covers observability of the
+// rewrite. The reply we hand the application travels over loopback, which the
+// bundle capture does not see, so a softened verdict has to say so on the wire:
+// without it an empty answer is indistinguishable from a real "no such record"
+// in a dig output or a capture taken next to the application.
+func TestHandlerChain_SoftNegative_IsVisibleToTheClient(t *testing.T) {
+	// One hook for the whole test: logtest installs it on the standard logger
+	// and logrus has no way to take it off again, so a hook per subtest would
+	// leave several behind buffering every later line in the package.
+	hook := logtest.NewGlobal()
+	t.Cleanup(hook.Reset)
+
+	newChain := func() *nbdns.HandlerChain {
+		chain := nbdns.NewHandlerChain()
+		chain.AddHandler("*.example.com.", &deferringHandler{softNegative: true}, nbdns.PriorityDNSRoute)
+		chain.AddHandler(".", &nxdomainHandler{}, nbdns.PriorityDefault)
+		return chain
+	}
+
+	t.Run("EDNS0 client gets an extended error", func(t *testing.T) {
+		r := new(dns.Msg)
+		r.SetQuestion("_mongodb._tcp.db.example.com.", dns.TypeSRV)
+		r.SetEdns0(dns.DefaultMsgSize, false)
+
+		mw := &test.MockResponseWriter{}
+		newChain().ServeDNS(&nbdns.ResponseWriterChain{ResponseWriter: mw}, r)
+
+		resp := mw.GetLastResponse()
+		require.NotNil(t, resp)
+		require.Equal(t, dns.RcodeSuccess, resp.Rcode)
+
+		ede, ok := resutil.ExtractEDE(resp)
+		require.True(t, ok, "a softened verdict must carry an extended DNS error")
+		assert.Equal(t, resutil.EDENetbirdSoftenedNegative, ede.InfoCode)
+		assert.Contains(t, ede.ExtraText, "netbird", "the text must name us as the source of the rewrite")
+	})
+
+	t.Run("plain client gets no OPT", func(t *testing.T) {
+		r := new(dns.Msg)
+		r.SetQuestion("_mongodb._tcp.db.example.com.", dns.TypeSRV)
+
+		mw := &test.MockResponseWriter{}
+		newChain().ServeDNS(&nbdns.ResponseWriterChain{ResponseWriter: mw}, r)
+
+		resp := mw.GetLastResponse()
+		require.NotNil(t, resp)
+		assert.Nil(t, resp.IsEdns0(), "RFC 6891 forbids an OPT toward a client that did not advertise EDNS0")
+	})
+
+	// The response line is what support reads out of a debug bundle, and it now
+	// carries several annotations at once. Built from a map, their order would
+	// differ on every query, so the same event never looks the same twice.
+	t.Run("log fields keep a stable order", func(t *testing.T) {
+		const qname = "_mongodb._tcp.stable.example.com."
+
+		prev := log.GetLevel()
+		log.SetLevel(log.TraceLevel)
+		t.Cleanup(func() { log.SetLevel(prev) })
+
+		lineFor := func() string {
+			hook.Reset()
+
+			r := new(dns.Msg)
+			r.SetQuestion(qname, dns.TypeSRV)
+
+			mw := &test.MockResponseWriter{}
+			newChain().ServeDNS(&nbdns.ResponseWriterChain{ResponseWriter: mw}, r)
+
+			line := responseLineFor(hook, qname)
+			// The duration differs per query and is not what we compare.
+			line, _, _ = strings.Cut(line, " took=")
+			return line
+		}
+
+		first := lineFor()
+		require.NotEmpty(t, first, "the chain must log the response it wrote")
+		require.Contains(t, first, "deferred_by=", "the line must carry more than one annotation to be worth ordering")
+		require.Contains(t, first, "softened=")
+
+		for range 20 {
+			assert.Equal(t, first, lineFor(), "the same event must produce the same line")
+		}
+	})
+
+	t.Run("logged with the reason it was deferred", func(t *testing.T) {
+		const qname = "_mongodb._tcp.reason.example.com."
+
+		hook.Reset()
+
+		prev := log.GetLevel()
+		log.SetLevel(log.TraceLevel)
+		t.Cleanup(func() { log.SetLevel(prev) })
+
+		r := new(dns.Msg)
+		r.SetQuestion(qname, dns.TypeSRV)
+
+		mw := &test.MockResponseWriter{}
+		newChain().ServeDNS(&nbdns.ResponseWriterChain{ResponseWriter: mw}, r)
+
+		response := responseLineFor(hook, qname)
+		require.NotEmpty(t, response, "the chain must log the response it wrote")
+		assert.Contains(t, response, "softened=", "the log must show the verdict was rewritten")
+		assert.Contains(t, response, "deferred_by=", "the log must name the handler that deferred")
+	})
+}
+
+// TestHandlerChain_SoftNegative_NoHandlerBelow covers a client with no primary
+// nameserver group: the deferred query reaches the end of the chain unanswered.
+// REFUSED would say the name is not served here while the route serves its
+// addresses, and a stub that acts on that by asking elsewhere can bring back an
+// NXDOMAIN for the whole name. The answer must be an empty, uncacheable NODATA.
+func TestHandlerChain_SoftNegative_NoHandlerBelow(t *testing.T) {
+	chain := nbdns.NewHandlerChain()
+
+	route := &deferringHandler{softNegative: true}
+	chain.AddHandler("*.example.com.", route, nbdns.PriorityDNSRoute)
+
+	r := new(dns.Msg)
+	r.SetQuestion("db.example.com.", dns.TypeHTTPS)
+
+	mw := &test.MockResponseWriter{}
+	chain.ServeDNS(&nbdns.ResponseWriterChain{ResponseWriter: mw}, r)
+
+	resp := mw.GetLastResponse()
+	require.NotNil(t, resp, "a response must reach the client")
+	assert.Equal(t, dns.RcodeSuccess, resp.Rcode, "an unanswered soft-negative query must be NODATA, not REFUSED")
+	assert.Empty(t, resp.Answer)
+	assert.Empty(t, resp.Ns,
+		"no SOA, so RFC 2308 keeps the empty answer out of negative caches and it cannot outlive the route")
+}
+
+// TestHandlerChain_SoftNegative_KeepsRealAnswers guards the other direction:
+// softening applies to negative verdicts only. A real answer from a downstream
+// handler must reach the client untouched.
+func TestHandlerChain_SoftNegative_KeepsRealAnswers(t *testing.T) {
+	chain := nbdns.NewHandlerChain()
+
+	route := &deferringHandler{softNegative: true}
+	chain.AddHandler("*.example.com.", route, nbdns.PriorityDNSRoute)
+	chain.AddHandler(".", &answeringHandler{name: "public", ip: "203.0.113.10"}, nbdns.PriorityDefault)
+
+	r := new(dns.Msg)
+	r.SetQuestion("db.example.com.", dns.TypeA)
+
+	mw := &test.MockResponseWriter{}
+	chain.ServeDNS(&nbdns.ResponseWriterChain{ResponseWriter: mw}, r)
+
+	resp := mw.GetLastResponse()
+	require.NotNil(t, resp, "a response must reach the client")
+	assert.Equal(t, dns.RcodeSuccess, resp.Rcode)
+	require.Len(t, resp.Answer, 1, "the downstream answer must pass through")
+}
+
+// TestHandlerChain_NXDOMAINPreservedWithoutSoftNegative makes sure the
+// softening is opt-in: an ordinary chain continuation still yields NXDOMAIN, so
+// genuine non-existence keeps being reported.
+func TestHandlerChain_NXDOMAINPreservedWithoutSoftNegative(t *testing.T) {
+	chain := nbdns.NewHandlerChain()
+
+	route := &deferringHandler{}
+	chain.AddHandler("*.example.com.", route, nbdns.PriorityDNSRoute)
+	chain.AddHandler(".", &nxdomainHandler{}, nbdns.PriorityDefault)
+
+	r := new(dns.Msg)
+	r.SetQuestion("nope.example.com.", dns.TypeA)
+
+	mw := &test.MockResponseWriter{}
+	chain.ServeDNS(&nbdns.ResponseWriterChain{ResponseWriter: mw}, r)
+
+	resp := mw.GetLastResponse()
+	require.NotNil(t, resp, "a response must reach the client")
+	assert.Equal(t, dns.RcodeNameError, resp.Rcode, "without the signal a real NXDOMAIN must survive")
+}
+
 func TestHandlerChain_HasRootHandlerAtOrBelow(t *testing.T) {
 	chain := nbdns.NewHandlerChain()
 	h := &answeringHandler{name: "h", ip: "10.0.0.1"}

client/internal/dns/resutil/resolve.go

@@ -19,6 +19,34 @@ import (
 // uses when a resolved host has no addresses of the requested family.
 const errNoSuitableAddress = "no suitable address found"
 
+// Extended DNS Error info codes NetBird emits so a client can see why an answer
+// looks the way it does without reading this peer's logs. They live in the RFC
+// 8914 Private Use range (49152-65535) and are registered here, in one place,
+// because nothing else guarantees two NetBird components pick distinct codes.
+const (
+	// EDENetbirdUpstreamTimeout: a DNS forwarder's upstream did not answer.
+	EDENetbirdUpstreamTimeout uint16 = 49152
+	// EDENetbirdUpstreamFailure: a DNS forwarder's upstream failed.
+	EDENetbirdUpstreamFailure uint16 = 49153
+	// EDENetbirdSoftenedNegative: the empty answer is ours, not the answering
+	// resolver's. A handler that owns the name deferred this query type, and the
+	// negative verdict that came back was downgraded so it cannot poison the
+	// name.
+	EDENetbirdSoftenedNegative uint16 = 49154
+)
+
+// AttachEDE adds an Extended DNS Error (RFC 8914) option to a message, creating
+// the OPT pseudo-record if it has none. Callers must only use it toward a client
+// that advertised EDNS0: per RFC 6891 an OPT must not appear otherwise.
+func AttachEDE(msg *dns.Msg, code uint16, text string) {
+	opt := msg.IsEdns0()
+	if opt == nil {
+		msg.SetEdns0(dns.DefaultMsgSize, false)
+		opt = msg.IsEdns0()
+	}
+	opt.Option = append(opt.Option, &dns.EDNS0_EDE{InfoCode: code, ExtraText: text})
+}
+
 // GenerateRequestID creates a random 8-character hex string for request tracing.
 func GenerateRequestID() string {
 	bytes := make([]byte, 4)
@@ -78,10 +106,38 @@ type resolver interface {
 	LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)
 }
 
+// MetaKey names an annotation a handler attaches to a request to explain the
+// response the chain ends up writing. The set is closed and rendered onto a
+// single log line, so an unrecognized key is a typo inventing a field rather
+// than a new fact.
+type MetaKey string
+
+const (
+	// MetaKeyProtocol: the transport a query arrived on.
+	MetaKeyProtocol MetaKey = "protocol"
+	// MetaKeyUpstream: the upstream that answered.
+	MetaKeyUpstream MetaKey = "upstream"
+	// MetaKeyUpstreamProtocol: the transport used toward that upstream.
+	MetaKeyUpstreamProtocol MetaKey = "upstream_protocol"
+	// MetaKeyPeer: the routing peer whose forwarder answered.
+	MetaKeyPeer MetaKey = "peer"
+	// MetaKeyEDE: an Extended DNS Error carried by the answer.
+	MetaKeyEDE MetaKey = "ede"
+	// MetaKeyTruncated: the answer did not fit and was truncated.
+	MetaKeyTruncated MetaKey = "truncated"
+	// MetaKeySoftened: a negative verdict was rewritten so it cannot poison a
+	// name served locally.
+	MetaKeySoftened MetaKey = "softened"
+	// MetaKeyDeferredBy: the handler that owned the name and stepped aside.
+	MetaKeyDeferredBy MetaKey = "deferred_by"
+	// MetaKeyDeferredReason: why it stepped aside.
+	MetaKeyDeferredReason MetaKey = "deferred_reason"
+)
+
 // chainedWriter is implemented by ResponseWriters that carry request metadata
 type chainedWriter interface {
 	RequestID() string
-	SetMeta(key, value string)
+	SetMeta(key MetaKey, value string)
 }
 
 // GetRequestID extracts a request ID from the ResponseWriter if available,
@@ -96,12 +152,30 @@ func GetRequestID(w dns.ResponseWriter) string {
 }
 
 // SetMeta sets metadata on the ResponseWriter if it supports it.
-func SetMeta(w dns.ResponseWriter, key, value string) {
+func SetMeta(w dns.ResponseWriter, key MetaKey, value string) {
 	if cw, ok := w.(chainedWriter); ok {
 		cw.SetMeta(key, value)
 	}
 }
 
+// softNegativeRequester is implemented by chain writers that can soften the
+// negative verdict of the handlers a deferring handler falls through to.
+type softNegativeRequester interface {
+	RequestSoftNegative()
+}
+
+// RequestSoftNegative asks the handler chain to downgrade an NXDOMAIN from the
+// handlers that run after the caller defers. A handler that owns a name but
+// cannot answer one query type for it needs this: the resolvers it falls
+// through to cannot prove the name absent, and an NXDOMAIN from them is cached
+// for the name and every type under it (RFC 2308, RFC 8020), taking the
+// addresses the handler does serve down with it.
+func RequestSoftNegative(w dns.ResponseWriter) {
+	if sn, ok := w.(softNegativeRequester); ok {
+		sn.RequestSoftNegative()
+	}
+}
+
 // LookupResult contains the result of an external DNS lookup
 type LookupResult struct {
 	IPs   []netip.Addr
@@ -199,11 +273,27 @@ type RecordResolver interface {
 	LookupAddr(ctx context.Context, addr string) ([]string, error)
 }
 
+// SupportedRecordQtype reports whether LookupRecords can resolve qtype. The
+// set is bounded by the net.Resolver API, which exposes no way to query an
+// arbitrary record type, and going around it with a raw exchange would mean
+// picking nameservers ourselves instead of resolving the way the host does.
+//
+// Both ends read this: a DNS forwarder answers these types for the domains it
+// routes, and a client uses it to tell which types are worth forwarding to a
+// peer at all.
+func SupportedRecordQtype(qtype uint16) bool {
+	switch qtype {
+	case dns.TypeMX, dns.TypeTXT, dns.TypeNS, dns.TypeSRV, dns.TypeCNAME, dns.TypePTR:
+		return true
+	default:
+		return false
+	}
+}
+
 // LookupRecords resolves a non-address DNS record type through the host
-// resolver and returns the resource records and the DNS rcode. Types the host
-// resolver cannot answer (anything not covered by the net.Resolver Lookup*
-// methods) yield NODATA so that a routed name is never poisoned with NXDOMAIN
-// for an unsupported type.
+// resolver and returns the resource records and the DNS rcode. Types outside
+// SupportedRecordQtype yield NODATA so that a routed name is never poisoned
+// with NXDOMAIN for a type we cannot look up.
 func LookupRecords(ctx context.Context, r RecordResolver, name string, qtype uint16, ttl uint32) ([]dns.RR, int) {
 	fqdn := dns.Fqdn(name)
 

client/internal/dns/upstream.go

@@ -295,7 +295,7 @@ func (u *upstreamResolverBase) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 	if addr := w.RemoteAddr(); addr != nil {
 		network := addr.Network()
 		ctx = contextWithDNSProtocol(ctx, network)
-		resutil.SetMeta(w, "protocol", network)
+		resutil.SetMeta(w, resutil.MetaKeyProtocol, network)
 	}
 
 	ok, failures := u.tryUpstreamServers(ctx, w, r, logger)
@@ -331,7 +331,7 @@ func (u *upstreamResolverBase) tryOnlyRace(ctx context.Context, w dns.ResponseWr
 		return false, res.failures
 	}
 	if res.ede != "" {
-		resutil.SetMeta(w, "ede", res.ede)
+		resutil.SetMeta(w, resutil.MetaKeyEDE, res.ede)
 	}
 	u.writeSuccessResponse(w, res.msg, res.upstream, r.Question[0].Name, res.protocol, logger)
 	return true, res.failures
@@ -361,7 +361,7 @@ func (u *upstreamResolverBase) raceAll(ctx context.Context, w dns.ResponseWriter
 			failures = append(failures, res.failures...)
 			if res.msg != nil {
 				if res.ede != "" {
-					resutil.SetMeta(w, "ede", res.ede)
+					resutil.SetMeta(w, resutil.MetaKeyEDE, res.ede)
 				}
 				u.writeSuccessResponse(w, res.msg, res.upstream, r.Question[0].Name, res.protocol, logger)
 				return true, failures
@@ -550,9 +550,9 @@ func (u *upstreamResolverBase) debugUpstreamTimeout(upstream netip.AddrPort) str
 }
 
 func (u *upstreamResolverBase) writeSuccessResponse(w dns.ResponseWriter, rm *dns.Msg, upstream netip.AddrPort, domain string, proto string, logger *log.Entry) {
-	resutil.SetMeta(w, "upstream", upstream.String())
+	resutil.SetMeta(w, resutil.MetaKeyUpstream, upstream.String())
 	if proto != "" {
-		resutil.SetMeta(w, "upstream_protocol", proto)
+		resutil.SetMeta(w, resutil.MetaKeyUpstreamProtocol, proto)
 	}
 
 	// Clear Zero bit from external responses to prevent upstream servers from

client/internal/dnsfwd/forwarder.go

@@ -26,15 +26,6 @@ import (
 const errResolveFailed = "failed to resolve query for domain=%s: %v"
 const upstreamTimeout = 15 * time.Second
 
-// EDE info codes the forwarder emits on upstream failures so the querying
-// client can see the reason without inspecting this peer's logs. They live in
-// the RFC 8914 Private Use range (49152-65535); the Go resolver never exposes a
-// real upstream EDE here, so these cannot collide with a genuine code.
-const (
-	edeNetbirdUpstreamTimeout uint16 = 49152
-	edeNetbirdUpstreamFailure uint16 = 49153
-)
-
 type resolver interface {
 	LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)
 	LookupMX(ctx context.Context, name string) ([]*net.MX, error)
@@ -216,6 +207,9 @@ func (f *DNSForwarder) handleDNSQuery(logger *log.Entry, w dns.ResponseWriter, q
 		qname, dns.TypeToString[question.Qtype], dns.ClassToString[question.Qclass])
 
 	resp := query.SetReply(query)
+	// Every answer here comes from a recursive lookup on this peer. SetReply
+	// leaves RA unset, which reads to a client as a server that cannot recurse.
+	resp.RecursionAvailable = true
 
 	mostSpecificResId, matchingEntries := f.getMatchingEntries(strings.TrimSuffix(qname, "."))
 	if mostSpecificResId == "" {
@@ -229,20 +223,22 @@ func (f *DNSForwarder) handleDNSQuery(logger *log.Entry, w dns.ResponseWriter, q
 
 	reqHasEdns := query.IsEdns0() != nil
 
-	switch question.Qtype {
-	case dns.TypeA, dns.TypeAAAA:
+	switch {
+	case question.Qtype == dns.TypeA || question.Qtype == dns.TypeAAAA:
 		f.handleAddressQuery(ctx, logger, w, resp, mostSpecificResId, matchingEntries, reqHasEdns, startTime)
-	case dns.TypeMX, dns.TypeTXT, dns.TypeNS, dns.TypeSRV, dns.TypeCNAME, dns.TypePTR:
+	case resutil.SupportedRecordQtype(question.Qtype):
 		f.handleRecordQuery(ctx, logger, w, resp, startTime)
 	default:
 		// The domain is routed here, so any other type is answered NODATA
 		// (NOERROR, empty answer) rather than falling back to a resolver that
 		// would poison the name with NXDOMAIN. The Extended DNS Error lets a
 		// client tell this capability-driven NODATA apart from an
-		// authoritative one. The OPT pseudo-record must not appear unless the
-		// query advertised EDNS0.
+		// authoritative one; a current client knows the type is unsupported and
+		// resolves it through its own handler chain instead of asking at all.
+		// The OPT pseudo-record must not appear unless the query advertised
+		// EDNS0.
 		if reqHasEdns {
-			attachEDE(resp, dns.ExtendedErrorCodeNotSupported, "netbird forwarder: unsupported query type")
+			resutil.AttachEDE(resp, dns.ExtendedErrorCodeNotSupported, "netbird forwarder: unsupported query type")
 		}
 		f.writeResponse(logger, w, resp, qname, startTime)
 	}
@@ -441,7 +437,7 @@ func (f *DNSForwarder) handleDNSError(
 	}
 
 	if reqHasEdns {
-		attachEDE(resp, edeCodeFor(dnsErr), edeText(dnsErr))
+		resutil.AttachEDE(resp, edeCodeFor(dnsErr), edeText(dnsErr))
 	}
 
 	f.writeResponse(logger, w, resp, domain, startTime)
@@ -488,9 +484,9 @@ func (f *DNSForwarder) getMatchingEntries(domain string) (route.ResID, []*Forwar
 // edeCodeFor maps an upstream lookup error to the NetBird EDE info code.
 func edeCodeFor(dnsErr *net.DNSError) uint16 {
 	if dnsErr != nil && dnsErr.IsTimeout {
-		return edeNetbirdUpstreamTimeout
+		return resutil.EDENetbirdUpstreamTimeout
 	}
-	return edeNetbirdUpstreamFailure
+	return resutil.EDENetbirdUpstreamFailure
 }
 
 // edeText builds the EDE extra-text describing the class of upstream failure.
@@ -503,14 +499,3 @@ func edeText(dnsErr *net.DNSError) string {
 	}
 	return "netbird forwarder: upstream failure"
 }
-
-// attachEDE adds an Extended DNS Error (RFC 8914) option to the response,
-// creating the OPT pseudo-record if the response does not already carry one.
-func attachEDE(resp *dns.Msg, code uint16, text string) {
-	opt := resp.IsEdns0()
-	if opt == nil {
-		resp.SetEdns0(dns.DefaultMsgSize, false)
-		opt = resp.IsEdns0()
-	}
-	opt.Option = append(opt.Option, &dns.EDNS0_EDE{InfoCode: code, ExtraText: text})
-}

client/internal/dnsfwd/forwarder_test.go

@@ -649,6 +649,39 @@ func TestDNSForwarder_ResponseCodes(t *testing.T) {
 	}
 }
 
+// TestDNSForwarder_RecursionAvailable covers the RA bit. Every answer this
+// forwarder produces comes from a recursive lookup on the routing peer, but
+// dns.Msg.SetReply leaves RA unset, so clients report "recursion not available"
+// and some stub resolvers treat the server as unable to serve the query.
+func TestDNSForwarder_RecursionAvailable(t *testing.T) {
+	t.Run("record answer", func(t *testing.T) {
+		mockResolver := &MockResolver{}
+		forwarder := newRecordTestForwarder(t, mockResolver, "example.com")
+
+		mockResolver.On("LookupMX", mock.Anything, "example.com.").
+			Return([]*net.MX{{Host: "mail.example.com.", Pref: 10}}, nil).Once()
+
+		resp := runRecordQuery(t, forwarder, "example.com", dns.TypeMX)
+		assert.True(t, resp.RecursionAvailable, "the forwarder resolves recursively")
+	})
+
+	t.Run("unsupported type NODATA", func(t *testing.T) {
+		forwarder := newRecordTestForwarder(t, &MockResolver{}, "example.com")
+
+		resp := runRecordQuery(t, forwarder, "example.com", dns.TypeCAA)
+		require.Equal(t, dns.RcodeSuccess, resp.Rcode)
+		assert.True(t, resp.RecursionAvailable, "RA describes the server, not the query type")
+	})
+
+	t.Run("unauthorized domain", func(t *testing.T) {
+		forwarder := newRecordTestForwarder(t, &MockResolver{}, "example.com")
+
+		resp := runRecordQuery(t, forwarder, "other.com", dns.TypeMX)
+		require.Equal(t, dns.RcodeRefused, resp.Rcode)
+		assert.True(t, resp.RecursionAvailable, "RA describes the server, not the verdict")
+	})
+}
+
 func hasEDE(m *dns.Msg, code uint16) bool {
 	opt := m.IsEdns0()
 	if opt == nil {
@@ -859,7 +892,7 @@ func TestDNSForwarder_UpstreamFailureEDE(t *testing.T) {
 			lookupErr:   &net.DNSError{Err: "i/o timeout", Server: "10.0.0.53:53", IsTimeout: true},
 			reqEdns:     true,
 			wantEDE:     true,
-			wantCode:    edeNetbirdUpstreamTimeout,
+			wantCode:    resutil.EDENetbirdUpstreamTimeout,
 			wantTextHas: "netbird forwarder: upstream timeout",
 		},
 		{
@@ -867,7 +900,7 @@ func TestDNSForwarder_UpstreamFailureEDE(t *testing.T) {
 			lookupErr:   &net.DNSError{Err: "server misbehaving", Server: "10.0.0.53:53"},
 			reqEdns:     true,
 			wantEDE:     true,
-			wantCode:    edeNetbirdUpstreamFailure,
+			wantCode:    resutil.EDENetbirdUpstreamFailure,
 			wantTextHas: "netbird forwarder: upstream failure",
 		},
 		{

client/internal/routemanager/dnsinterceptor/handler.go

@@ -22,7 +22,6 @@ import (
 	nbdns "github.com/netbirdio/netbird/client/internal/dns"
 	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 	"github.com/netbirdio/netbird/client/internal/peer"
-	"github.com/netbirdio/netbird/client/internal/peerstore"
 	"github.com/netbirdio/netbird/client/internal/routemanager/common"
 	"github.com/netbirdio/netbird/client/internal/routemanager/fakeip"
 	iface "github.com/netbirdio/netbird/client/internal/routemanager/iface"
@@ -40,6 +39,61 @@ type internalDNATer interface {
 	AddInternalDNATMapping(netip.Addr, netip.Addr) error
 }
 
+// peerAllowedIPs reports the tunnel address a peer is reachable on.
+type peerAllowedIPs interface {
+	AllowedIP(pubKey string) (netip.Addr, bool)
+}
+
+// disposition says where a query for a given record type has to be answered.
+type disposition int
+
+const (
+	// dispositionPeer: the routing peer owns the answer. Address records are
+	// what a DNS route exists for, and their answer programs the routes,
+	// allowed IPs and firewall sets, so they are never resolved anywhere else.
+	dispositionPeer disposition = iota
+	// dispositionPeerFirst: the peer's forwarder resolves the type, and the
+	// records may only exist inside the routed network, so it has to be asked.
+	// A peer running a client that predates that support cannot answer, which
+	// only its reply reveals.
+	dispositionPeerFirst
+	// dispositionChain: no forwarder resolves the type, so asking would cost a
+	// tunnel round trip for a reply that says nothing. Public records for the
+	// name are still better than none, so the query goes to the rest of the
+	// chain.
+	dispositionChain
+)
+
+func dispositionFor(qtype uint16) disposition {
+	switch {
+	case qtype == dns.TypeA || qtype == dns.TypeAAAA:
+		return dispositionPeer
+	case resutil.SupportedRecordQtype(qtype):
+		return dispositionPeerFirst
+	default:
+		return dispositionChain
+	}
+}
+
+// peerCannotAnswer reports whether a forwarder reply means the peer is unable to
+// resolve this query type, as opposed to having resolved it and found nothing.
+// A forwarder older than the one that learned to resolve non-address types
+// answers NOTIMP to all of them, before it even looks at the domain; FORMERR
+// covers one that cannot parse the EDNS0 we add to the query.
+//
+// REFUSED is deliberately not here. It says the peer does not hold the name,
+// which happens while the client and the peer disagree about the route set, and
+// falling through then would hand the name of an internal-only domain to a
+// public resolver. No forwarder version reports a missing record type that way.
+func peerCannotAnswer(rcode int) bool {
+	switch rcode {
+	case dns.RcodeNotImplemented, dns.RcodeFormatError:
+		return true
+	default:
+		return false
+	}
+}
+
 type DnsInterceptor struct {
 	mu                   sync.RWMutex
 	route                *route.Route
@@ -50,7 +104,7 @@ type DnsInterceptor struct {
 	currentPeerKey       string
 	interceptedDomains   domainMap
 	wgInterface          iface.WGIface
-	peerStore            *peerstore.Store
+	peerStore            peerAllowedIPs
 	firewall             firewall.Manager
 	fakeIPManager        *fakeip.Manager
 	forwarderPort        *atomic.Uint32
@@ -226,11 +280,14 @@ func (d *DnsInterceptor) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 		return
 	}
 
-	// All query types for an intercepted domain are forwarded to the peer's
-	// DNS forwarder, which owns the name. Falling through to the system
-	// resolver would let it answer NXDOMAIN for a name it isn't authoritative
-	// for, poisoning the whole name (including the A/AAAA records the route
-	// does serve). The forwarder answers NODATA for types it cannot resolve.
+	qtype := r.Question[0].Qtype
+	dispose := dispositionFor(qtype)
+
+	if dispose == dispositionChain {
+		d.deferToChain(w, r, logger, "unsupported-qtype")
+		return
+	}
+
 	d.mu.RLock()
 	peerKey := d.currentPeerKey
 	d.mu.RUnlock()
@@ -246,35 +303,32 @@ func (d *DnsInterceptor) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 		return
 	}
 
-	if r.Extra == nil {
-		r.MsgHdr.AuthenticatedData = true
-	}
-
-	// Advertise EDNS0 to the forwarder so it may return an Extended DNS Error
-	// describing why a lookup failed. The OPT is stripped from the reply when
-	// the original client did not request EDNS0.
-	hadEdns := r.IsEdns0() != nil
-	if !hadEdns {
-		r.SetEdns0(dns.DefaultMsgSize, false)
-	}
+	query, hadEdns := peerQuery(r)
 
 	upstream := net.JoinHostPort(upstreamIP.String(), strconv.FormatUint(uint64(d.forwarderPort.Load()), 10))
 	ctx, cancel := context.WithTimeout(context.Background(), dnsTimeout)
 	defer cancel()
 
-	reply := d.queryUpstreamDNS(ctx, w, r, upstream, upstreamIP, peerKey, logger)
+	reply := d.queryUpstreamDNS(ctx, w, query, upstream, upstreamIP, peerKey, logger)
 	if reply == nil {
 		return
 	}
 
+	// The peer owns the name but its forwarder cannot resolve this type. No
+	// capability is announced anywhere, so the round trip above is the probe.
+	if dispose == dispositionPeerFirst && peerCannotAnswer(reply.Rcode) {
+		d.deferToChain(w, r, logger, "peer-rcode-"+dns.RcodeToString[reply.Rcode])
+		return
+	}
+
 	if ede, ok := resutil.ExtractEDE(reply); ok {
-		resutil.SetMeta(w, "ede", fmt.Sprintf("%d %s", ede.InfoCode, ede.ExtraText))
+		resutil.SetMeta(w, resutil.MetaKeyEDE, fmt.Sprintf("%d %s", ede.InfoCode, ede.ExtraText))
 	}
 	if !hadEdns {
 		resutil.StripOPT(reply)
 	}
 
-	resutil.SetMeta(w, "peer", peerKey)
+	resutil.SetMeta(w, resutil.MetaKeyPeer, peerKey)
 
 	reply.Id = r.Id
 	if err := d.writeMsg(w, reply, logger); err != nil {
@@ -282,6 +336,30 @@ func (d *DnsInterceptor) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 	}
 }
 
+// deferToChain hands the query to the next handler in the chain and asks the
+// chain to soften the negative verdict of whatever answers instead. The
+// resolvers below cannot prove a name inside the routed network absent, so their
+// NXDOMAIN must not reach the client: it would be cached for the name and every
+// type under it, taking the addresses this route does serve with it.
+func (d *DnsInterceptor) deferToChain(w dns.ResponseWriter, r *dns.Msg, logger *log.Entry, reason string) {
+	logger.Tracef("continuing to next handler for domain=%s type=%s reason=%s",
+		r.Question[0].Name, dns.TypeToString[r.Question[0].Qtype], reason)
+
+	resutil.RequestSoftNegative(w)
+	// Carried to the chain's response log line: without it the answer looks like
+	// it came from the fallthrough resolver on its own.
+	resutil.SetMeta(w, resutil.MetaKeyDeferredBy, "dns-route")
+	resutil.SetMeta(w, resutil.MetaKeyDeferredReason, reason)
+
+	resp := new(dns.Msg)
+	resp.SetRcode(r, dns.RcodeNameError)
+	// Set Zero bit to signal handler chain to continue
+	resp.MsgHdr.Zero = true
+	if err := w.WriteMsg(resp); err != nil {
+		logger.Errorf("failed writing DNS continue response: %v", err)
+	}
+}
+
 func (d *DnsInterceptor) writeDNSError(w dns.ResponseWriter, r *dns.Msg, logger *log.Entry, reason string) {
 	logger.Warnf("failed to query upstream for domain=%s: %s", r.Question[0].Name, reason)
 
@@ -621,3 +699,26 @@ func (d *DnsInterceptor) debugPeerTimeout(peerIP netip.Addr, peerKey string) str
 
 	return fmt.Sprintf(" (peer %s)", nbdns.FormatPeerStatus(&peerState))
 }
+
+// peerQuery builds the query sent to a peer's DNS forwarder and reports whether
+// the client itself advertised EDNS0. EDNS0 is added so the forwarder can return
+// an Extended DNS Error describing an upstream failure, and the OPT is stripped
+// from the reply again when the client did not ask for it. The client's message
+// is left untouched: it may still be handed to the next handler in the chain,
+// and neither the OPT nor the AD bit is ours to put on the wire on its behalf.
+func peerQuery(r *dns.Msg) (query *dns.Msg, hadEdns bool) {
+	query = r.Copy()
+	hadEdns = query.IsEdns0() != nil
+
+	// AD tells the forwarder we understand authenticated data. Only set when the
+	// client sent no additional section of its own, so we never overrule what it
+	// asked for.
+	if len(query.Extra) == 0 {
+		query.MsgHdr.AuthenticatedData = true
+	}
+	if !hadEdns {
+		query.SetEdns0(dns.DefaultMsgSize, false)
+	}
+
+	return query, hadEdns
+}

client/internal/routemanager/dnsinterceptor/handler_test.go

@@ -0,0 +1,399 @@
+package dnsinterceptor
+
+import (
+	"net"
+	"net/netip"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/miekg/dns"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/tun/netstack"
+
+	"github.com/netbirdio/netbird/client/iface/device"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/internal/dns/resutil"
+	"github.com/netbirdio/netbird/client/internal/dns/test"
+	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/route"
+)
+
+// softNegativeWriter records what the handler told the chain: whether to soften
+// a negative verdict from the handlers it defers to, and the metadata that ends
+// up on the chain's response log line.
+type softNegativeWriter struct {
+	test.MockResponseWriter
+	softNegative bool
+	meta         map[resutil.MetaKey]string
+}
+
+func (w *softNegativeWriter) RequestSoftNegative() { w.softNegative = true }
+
+func (w *softNegativeWriter) RequestID() string { return "test" }
+
+func (w *softNegativeWriter) SetMeta(key resutil.MetaKey, value string) {
+	if w.meta == nil {
+		w.meta = make(map[resutil.MetaKey]string)
+	}
+	w.meta[key] = value
+}
+
+// TestServeDNS_QtypeTheForwarderCannotResolve covers the record types no DNS
+// forwarder can answer, because the host resolver exposes no API for them.
+// Asking the peer only burns a tunnel round trip, so the query goes straight to
+// the rest of the chain. No peer key is configured, proving no round trip is
+// attempted.
+func TestServeDNS_QtypeTheForwarderCannotResolve(t *testing.T) {
+	qtypes := []uint16{
+		dns.TypeHTTPS,
+		dns.TypeSVCB,
+		dns.TypeCAA,
+		dns.TypeNAPTR,
+		dns.TypeTLSA,
+		dns.TypeSOA,
+	}
+
+	for _, qtype := range qtypes {
+		t.Run(dns.TypeToString[qtype], func(t *testing.T) {
+			d := &DnsInterceptor{}
+			w := &softNegativeWriter{}
+
+			r := new(dns.Msg)
+			r.SetQuestion("db.example.com.", qtype)
+
+			d.ServeDNS(w, r)
+
+			resp := w.GetLastResponse()
+			require.NotNil(t, resp, "a response must be written")
+			assert.Equal(t, dns.RcodeNameError, resp.Rcode, "chain continuation is signalled as NXDOMAIN")
+			assert.True(t, resp.MsgHdr.Zero, "Zero bit must be set so the chain continues")
+			assert.True(t, w.softNegative,
+				"a downstream NXDOMAIN must be softened, or the fallthrough poisons the routed name")
+			assert.Equal(t, "dns-route", w.meta[resutil.MetaKeyDeferredBy],
+				"the chain's response log line must name us as the handler that stepped aside")
+			assert.Equal(t, "unsupported-qtype", w.meta[resutil.MetaKeyDeferredReason],
+				"the reason must survive to the log line, or the fallthrough is invisible")
+		})
+	}
+}
+
+// TestServeDNS_AddressQtypeNeverFallsThrough locks in the opposite case: A and
+// AAAA are what the route exists for, and the peer is authoritative for them.
+// A missing peer is an error the client must see, never a fallthrough to a
+// resolver that knows nothing about the routed name.
+func TestServeDNS_AddressQtypeNeverFallsThrough(t *testing.T) {
+	for _, qtype := range []uint16{dns.TypeA, dns.TypeAAAA} {
+		t.Run(dns.TypeToString[qtype], func(t *testing.T) {
+			d := &DnsInterceptor{}
+			w := &softNegativeWriter{}
+
+			r := new(dns.Msg)
+			r.SetQuestion("db.example.com.", qtype)
+
+			d.ServeDNS(w, r)
+
+			resp := w.GetLastResponse()
+			require.NotNil(t, resp, "a response must be written")
+			assert.Equal(t, dns.RcodeServerFailure, resp.Rcode, "an unusable route must fail, not fall through")
+			assert.False(t, resp.MsgHdr.Zero, "the chain must not continue for address queries")
+			assert.False(t, w.softNegative, "no fallthrough means nothing to soften")
+		})
+	}
+}
+
+// TestDispositionFor pins the query-type policy, and ties the types we ask a
+// peer about to the types a forwarder can actually resolve, so the two ends
+// cannot drift apart.
+func TestDispositionFor(t *testing.T) {
+	tests := []struct {
+		qtype uint16
+		want  disposition
+	}{
+		{dns.TypeA, dispositionPeer},
+		{dns.TypeAAAA, dispositionPeer},
+		{dns.TypeMX, dispositionPeerFirst},
+		{dns.TypeTXT, dispositionPeerFirst},
+		{dns.TypeNS, dispositionPeerFirst},
+		{dns.TypeSRV, dispositionPeerFirst},
+		{dns.TypeCNAME, dispositionPeerFirst},
+		{dns.TypePTR, dispositionPeerFirst},
+		{dns.TypeHTTPS, dispositionChain},
+		{dns.TypeSVCB, dispositionChain},
+		{dns.TypeCAA, dispositionChain},
+		{dns.TypeNAPTR, dispositionChain},
+		{dns.TypeTLSA, dispositionChain},
+		{dns.TypeDS, dispositionChain},
+		{dns.TypeDNSKEY, dispositionChain},
+		{dns.TypeSOA, dispositionChain},
+		{dns.TypeANY, dispositionChain},
+	}
+
+	for _, tt := range tests {
+		t.Run(dns.TypeToString[tt.qtype], func(t *testing.T) {
+			assert.Equal(t, tt.want, dispositionFor(tt.qtype), "disposition for %s", dns.TypeToString[tt.qtype])
+
+			// Address types are resolved by the forwarder's address path, not by
+			// its record path, so they are deliberately outside
+			// SupportedRecordQtype and their disposition does not depend on it.
+			if tt.want == dispositionPeer {
+				assert.False(t, resutil.SupportedRecordQtype(tt.qtype),
+					"address types take the forwarder's address path")
+				return
+			}
+
+			assert.Equal(t, tt.want == dispositionPeerFirst, resutil.SupportedRecordQtype(tt.qtype),
+				"only types a forwarder resolves may be sent to a peer")
+		})
+	}
+}
+
+// TestPeerCannotAnswer separates a peer that cannot resolve a type from one that
+// resolved it and found nothing. Only the former may be retried elsewhere:
+// treating NODATA or NXDOMAIN as a capability failure would send the client to a
+// public resolver behind the peer's back and prefer a public record over the
+// private one the route exists to reach.
+func TestPeerCannotAnswer(t *testing.T) {
+	cannot := []int{dns.RcodeNotImplemented, dns.RcodeFormatError}
+	for _, rcode := range cannot {
+		assert.True(t, peerCannotAnswer(rcode), "%s means the peer cannot answer", dns.RcodeToString[rcode])
+	}
+
+	// REFUSED belongs here, not above: it says the peer does not hold the name,
+	// so retrying elsewhere would leak the name of an internal-only domain to a
+	// public resolver. No forwarder version reports a missing record type this
+	// way, so nothing is lost by keeping it out.
+	can := []int{
+		dns.RcodeSuccess,
+		dns.RcodeNameError,
+		dns.RcodeServerFailure,
+		dns.RcodeNotAuth,
+		dns.RcodeRefused,
+	}
+	for _, rcode := range can {
+		assert.False(t, peerCannotAnswer(rcode), "%s is the peer's answer, not a capability failure", dns.RcodeToString[rcode])
+	}
+}
+
+// fakeWGIface is the minimum an interceptor needs to reach a peer's DNS
+// forwarder over a plain socket. A nil netstack keeps the exchange on the host
+// stack so the test can point it at a loopback listener.
+type fakeWGIface struct{}
+
+func (fakeWGIface) AddAllowedIP(string, netip.Prefix) error    { return nil }
+func (fakeWGIface) RemoveAllowedIP(string, netip.Prefix) error { return nil }
+func (fakeWGIface) Name() string                               { return "wt0" }
+func (fakeWGIface) Address() wgaddr.Address                    { return wgaddr.Address{} }
+func (fakeWGIface) ToInterface() *net.Interface                { return nil }
+func (fakeWGIface) IsUserspaceBind() bool                      { return false }
+func (fakeWGIface) GetFilter() device.PacketFilter             { return nil }
+func (fakeWGIface) GetDevice() *device.FilteredDevice          { return nil }
+func (fakeWGIface) GetNet() *netstack.Net                      { return nil }
+
+// fakePeerIPs resolves every peer key to the loopback address the test's
+// forwarder stub listens on.
+type fakePeerIPs struct {
+	addr netip.Addr
+}
+
+func (p fakePeerIPs) AllowedIP(string) (netip.Addr, bool) { return p.addr, p.addr.IsValid() }
+
+// forwarderStub stands in for the DNS forwarder of a routing peer, recording
+// what it was asked and answering with a canned reply.
+type forwarderStub struct {
+	mu       sync.Mutex
+	queries  []*dns.Msg
+	reply    func(q *dns.Msg) *dns.Msg
+	port     uint16
+	shutdown func()
+}
+
+func (s *forwarderStub) received() []*dns.Msg {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return append([]*dns.Msg(nil), s.queries...)
+}
+
+func newForwarderStub(t *testing.T, reply func(q *dns.Msg) *dns.Msg) *forwarderStub {
+	t.Helper()
+
+	conn, err := net.ListenUDP("udp", net.UDPAddrFromAddrPort(netip.MustParseAddrPort("127.0.0.1:0")))
+	require.NoError(t, err, "listen for the forwarder stub")
+
+	stub := &forwarderStub{reply: reply}
+	stub.port = uint16(conn.LocalAddr().(*net.UDPAddr).Port)
+
+	mux := dns.NewServeMux()
+	mux.HandleFunc(".", func(w dns.ResponseWriter, q *dns.Msg) {
+		stub.mu.Lock()
+		stub.queries = append(stub.queries, q.Copy())
+		stub.mu.Unlock()
+		_ = w.WriteMsg(stub.reply(q))
+	})
+
+	srv := &dns.Server{PacketConn: conn, Handler: mux}
+	started := make(chan struct{})
+	srv.NotifyStartedFunc = func() { close(started) }
+	go func() {
+		_ = srv.ActivateAndServe()
+	}()
+	select {
+	case <-started:
+	case <-time.After(5 * time.Second):
+		t.Fatal("forwarder stub did not start")
+	}
+
+	stub.shutdown = func() { _ = srv.Shutdown() }
+	t.Cleanup(stub.shutdown)
+
+	return stub
+}
+
+func newTestInterceptor(t *testing.T, stub *forwarderStub) *DnsInterceptor {
+	t.Helper()
+
+	port := new(atomic.Uint32)
+	port.Store(uint32(stub.port))
+
+	return &DnsInterceptor{
+		route:              &route.Route{Domains: nil},
+		statusRecorder:     peer.NewRecorder("https://mgm"),
+		currentPeerKey:     "peer-key",
+		interceptedDomains: make(domainMap),
+		wgInterface:        fakeWGIface{},
+		peerStore:          fakePeerIPs{addr: netip.MustParseAddr("127.0.0.1")},
+		forwarderPort:      port,
+	}
+}
+
+// TestServeDNS_PeerCannotResolveQtype is the reported regression: a routing peer
+// running a client older than the one that taught the forwarder about non-address
+// record types answers NOTIMP for every SRV query, and the interceptor used to
+// hand that straight to the application, breaking SRV-based service discovery.
+// The client cannot know the peer's capability up front, so it must try the peer
+// and fall back to the chain when the peer says it cannot answer.
+func TestServeDNS_PeerCannotResolveQtype(t *testing.T) {
+	for _, rcode := range []int{dns.RcodeNotImplemented, dns.RcodeFormatError} {
+		t.Run(dns.RcodeToString[rcode], func(t *testing.T) {
+			stub := newForwarderStub(t, func(q *dns.Msg) *dns.Msg {
+				resp := new(dns.Msg)
+				resp.SetRcode(q, rcode)
+				return resp
+			})
+			d := newTestInterceptor(t, stub)
+			w := &softNegativeWriter{}
+
+			r := new(dns.Msg)
+			r.SetQuestion("_mongodb._tcp.db.example.com.", dns.TypeSRV)
+
+			d.ServeDNS(w, r)
+
+			require.Len(t, stub.received(), 1, "the peer must be asked before giving up on it")
+
+			resp := w.GetLastResponse()
+			require.NotNil(t, resp, "a response must be written")
+			assert.Equal(t, dns.RcodeNameError, resp.Rcode, "chain continuation is signalled as NXDOMAIN")
+			assert.True(t, resp.MsgHdr.Zero, "Zero bit must be set so the chain continues")
+			assert.True(t, w.softNegative, "the fallthrough must not be allowed to poison the routed name")
+			assert.Equal(t, "dns-route", w.meta[resutil.MetaKeyDeferredBy])
+			assert.Equal(t, "peer-rcode-"+dns.RcodeToString[rcode], w.meta[resutil.MetaKeyDeferredReason],
+				"the peer's verdict must be visible in the log, it is the only trace of the probe")
+		})
+	}
+}
+
+// TestServeDNS_PeerVerdictPassesThrough covers the replies that are the peer's
+// answer rather than a statement about its capability. The peer is authoritative
+// for a name routed to it, so its verdict reaches the client as it is: retrying
+// these elsewhere would send the name of an internal-only domain to a public
+// resolver and prefer whatever that resolver says over the route.
+func TestServeDNS_PeerVerdictPassesThrough(t *testing.T) {
+	// REFUSED means the peer does not consider the name routed to it, which
+	// happens while the client and the peer disagree about the route set. It is
+	// never how a peer reports a record type it cannot resolve: a forwarder too
+	// old for non-address types answers NOTIMP before it looks at the domain.
+	for _, rcode := range []int{dns.RcodeRefused, dns.RcodeNameError, dns.RcodeSuccess} {
+		t.Run(dns.RcodeToString[rcode], func(t *testing.T) {
+			stub := newForwarderStub(t, func(q *dns.Msg) *dns.Msg {
+				resp := new(dns.Msg)
+				resp.SetRcode(q, rcode)
+				return resp
+			})
+			d := newTestInterceptor(t, stub)
+			w := &softNegativeWriter{}
+
+			r := new(dns.Msg)
+			r.SetQuestion("_mongodb._tcp.db.example.com.", dns.TypeSRV)
+
+			d.ServeDNS(w, r)
+
+			require.Len(t, stub.received(), 1, "the peer must be asked exactly once")
+
+			resp := w.GetLastResponse()
+			require.NotNil(t, resp, "a response must be written")
+			assert.Equal(t, rcode, resp.Rcode, "the peer's verdict must reach the client unchanged")
+			assert.False(t, resp.MsgHdr.Zero, "the chain must not continue past an answered query")
+			assert.False(t, w.softNegative, "nothing was deferred, so nothing may be softened")
+		})
+	}
+}
+
+// TestServeDNS_PeerResolvesQtype guards the common case: a peer that can answer
+// the type stays authoritative, and its records reach the client unchanged.
+func TestServeDNS_PeerResolvesQtype(t *testing.T) {
+	stub := newForwarderStub(t, func(q *dns.Msg) *dns.Msg {
+		resp := new(dns.Msg)
+		resp.SetReply(q)
+		resp.Answer = []dns.RR{&dns.SRV{
+			Hdr:    dns.RR_Header{Name: q.Question[0].Name, Rrtype: dns.TypeSRV, Class: dns.ClassINET, Ttl: 60},
+			Target: "shard-00.db.example.com.",
+			Port:   27017,
+		}}
+		return resp
+	})
+	d := newTestInterceptor(t, stub)
+	w := &softNegativeWriter{}
+
+	r := new(dns.Msg)
+	r.SetQuestion("_mongodb._tcp.db.example.com.", dns.TypeSRV)
+
+	d.ServeDNS(w, r)
+
+	resp := w.GetLastResponse()
+	require.NotNil(t, resp, "a response must be written")
+	assert.Equal(t, dns.RcodeSuccess, resp.Rcode)
+	require.Len(t, resp.Answer, 1, "the peer's records must pass through")
+	assert.False(t, resp.MsgHdr.Zero, "an answered query must not continue the chain")
+	assert.False(t, w.softNegative)
+}
+
+// TestServeDNS_DeferredQueryIsPristine covers what the fallthrough hands to the
+// next handler. The interceptor advertises EDNS0 to the peer so the forwarder can
+// return an Extended DNS Error, and sets AD, but neither belongs to the client's
+// query: on the deferred path they would travel to the public resolver and the
+// reply could come back carrying an OPT the client never advertised, which
+// RFC 6891 forbids us from passing on.
+func TestServeDNS_DeferredQueryIsPristine(t *testing.T) {
+	stub := newForwarderStub(t, func(q *dns.Msg) *dns.Msg {
+		resp := new(dns.Msg)
+		resp.SetRcode(q, dns.RcodeNotImplemented)
+		return resp
+	})
+	d := newTestInterceptor(t, stub)
+	w := &softNegativeWriter{}
+
+	r := new(dns.Msg)
+	r.SetQuestion("_mongodb._tcp.db.example.com.", dns.TypeSRV)
+
+	d.ServeDNS(w, r)
+
+	sent := stub.received()
+	require.Len(t, sent, 1)
+	assert.NotNil(t, sent[0].IsEdns0(), "the peer must be asked with EDNS0 so it can return an EDE")
+
+	assert.Nil(t, r.IsEdns0(), "the deferred query must not carry an OPT the client never sent")
+	assert.False(t, r.AuthenticatedData, "the deferred query must not carry an AD bit the client never set")
+	assert.Empty(t, r.Extra, "the deferred query must reach the next handler as the client sent it")
+}

client/internal/routemanager/dnsinterceptor/handler_windows_test.go

@@ -0,0 +1,7 @@
+//go:build windows
+
+package dnsinterceptor
+
+// GetInterfaceGUIDString completes iface.WGIface on Windows, which requires the
+// interface GUID for DNS registration.
+func (fakeWGIface) GetInterfaceGUIDString() (string, error) { return "", nil }

e2e/agentnetwork/chat_test.go

@@ -9,12 +9,220 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
 
 	"github.com/netbirdio/netbird/e2e/harness"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 )
 
+// per1k is a model's published USD rates per 1k tokens. read is the prompt-cache read rate
+// (OpenAI: the cached-input discount rate); write is the cache-creation rate where one exists.
+type per1k struct{ in, out, read, write float64 }
+
+// publishedPer1k hardcodes the vendors' PUBLISHED rates for the models the live matrix can drive,
+// keyed by the normalized model id the proxy stamps. Deliberately independent of the proxy's
+// pricing table so a wrong embedded rate or a broken normalization fails the run.
+var publishedPer1k = map[string]per1k{
+	"gpt-4o-mini":                 {0.00015, 0.0006, 0.000075, 0},
+	"gpt-4o":                      {0.0025, 0.01, 0.00125, 0},
+	"claude-haiku-4-5":            {0.001, 0.005, 0.0001, 0.00125},
+	"claude-sonnet-4-5":           {0.003, 0.015, 0.0003, 0.00375},
+	"claude-sonnet-4-6":           {0.003, 0.015, 0.0003, 0.00375},
+	"kimi-k3":                     {0.003, 0.015, 0.0003, 0.003}, // no published write rate: bills at the input rate
+	"anthropic.claude-haiku-4-5":  {0.001, 0.005, 0.0001, 0.00125},
+	"anthropic.claude-sonnet-4-5": {0.003, 0.015, 0.0003, 0.00375},
+	"anthropic.claude-sonnet-4-6": {0.003, 0.015, 0.0003, 0.00375},
+}
+
+// rawCostVerificationSQL is the operator-facing double-check, run straight against the management
+// sqlite store: recompute each usage row's expected total and cache cost from its own persisted
+// token buckets and hardcoded published rates. OpenAI counts cached tokens as a subset of input;
+// Anthropic-shape providers count cache buckets additively.
+const rawCostVerificationSQL = `
+WITH rates(model, in_rate, out_rate, read_rate, write_rate) AS (
+  VALUES
+    ('gpt-4o-mini',                 0.00015, 0.0006, 0.000075, 0.0),
+    ('gpt-4o',                      0.0025,  0.01,   0.00125,  0.0),
+    ('claude-haiku-4-5',            0.001,   0.005,  0.0001,   0.00125),
+    ('claude-sonnet-4-5',           0.003,   0.015,  0.0003,   0.00375),
+    ('claude-sonnet-4-6',           0.003,   0.015,  0.0003,   0.00375),
+    ('kimi-k3',                     0.003,   0.015,  0.0003,   0.003),
+    ('anthropic.claude-haiku-4-5',  0.001,   0.005,  0.0001,   0.00125),
+    ('anthropic.claude-sonnet-4-5', 0.003,   0.015,  0.0003,   0.00375),
+    ('anthropic.claude-sonnet-4-6', 0.003,   0.015,  0.0003,   0.00375)
+)
+SELECT
+  u.provider,
+  u.model,
+  u.input_tokens,
+  u.output_tokens,
+  u.cached_input_tokens,
+  u.cache_creation_tokens,
+  u.input_cost_usd,
+  u.cached_input_cost_usd,
+  u.cache_creation_cost_usd,
+  u.output_cost_usd,
+  -- No cost_usd / cache_cost_usd columns are stored: both are derived from the
+  -- four per-bucket columns above, exactly as the API renders them.
+  (u.input_cost_usd + u.cached_input_cost_usd + u.cache_creation_cost_usd + u.output_cost_usd) AS cost_usd,
+  (u.cached_input_cost_usd + u.cache_creation_cost_usd) AS cache_cost_usd,
+  CASE WHEN u.provider = 'openai' THEN
+    (u.input_tokens - MIN(u.cached_input_tokens, u.input_tokens))*r.in_rate/1000.0
+  ELSE
+    u.input_tokens*r.in_rate/1000.0
+  END AS expected_input,
+  CASE WHEN u.provider = 'openai' THEN
+    MIN(u.cached_input_tokens, u.input_tokens)*r.read_rate/1000.0
+  ELSE
+    u.cached_input_tokens*r.read_rate/1000.0
+  END AS expected_cached_input,
+  CASE WHEN u.provider = 'openai' THEN
+    0.0
+  ELSE
+    u.cache_creation_tokens*r.write_rate/1000.0
+  END AS expected_cache_creation,
+  u.output_tokens*r.out_rate/1000.0 AS expected_output,
+  CASE WHEN u.provider = 'openai' THEN
+    (u.input_tokens - MIN(u.cached_input_tokens, u.input_tokens))*r.in_rate/1000.0
+      + MIN(u.cached_input_tokens, u.input_tokens)*r.read_rate/1000.0
+      + u.output_tokens*r.out_rate/1000.0
+  ELSE
+    u.input_tokens*r.in_rate/1000.0 + u.cached_input_tokens*r.read_rate/1000.0
+      + u.cache_creation_tokens*r.write_rate/1000.0 + u.output_tokens*r.out_rate/1000.0
+  END AS expected_total,
+  CASE WHEN u.provider = 'openai' THEN
+    MIN(u.cached_input_tokens, u.input_tokens)*r.read_rate/1000.0
+  ELSE
+    u.cached_input_tokens*r.read_rate/1000.0 + u.cache_creation_tokens*r.write_rate/1000.0
+  END AS expected_cache
+FROM agent_network_request_usage u
+JOIN rates r ON r.model = u.model
+ORDER BY u.timestamp`
+
+// verifyUsageRowsSQL re-checks every persisted usage row directly in the management sqlite store,
+// bypassing the API path — the same audit an operator can run on a production store.db.
+func verifyUsageRowsSQL(t *testing.T, srv *harness.Combined) {
+	t.Helper()
+
+	dbPath, err := srv.SnapshotStoreDB(t.TempDir())
+	require.NoError(t, err, "snapshot management sqlite store")
+
+	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{})
+	require.NoError(t, err, "open store snapshot")
+	sqlDB, err := db.DB()
+	require.NoError(t, err)
+	defer func() { _ = sqlDB.Close() }()
+
+	rows, err := db.Raw(rawCostVerificationSQL).Rows()
+	require.NoError(t, err, "run raw cost verification query")
+	defer func() { _ = rows.Close() }()
+
+	verified := 0
+	for rows.Next() {
+		var provider, model string
+		var inTok, outTok, readTok, writeTok int64
+		var inCost, cachedInCost, cacheCreateCost, outCost, cost, cacheCost float64
+		var wantInput, wantCachedInput, wantCacheCreation, wantOutput, wantTotal, wantCache float64
+		require.NoError(t, rows.Scan(&provider, &model, &inTok, &outTok, &readTok, &writeTok,
+			&inCost, &cachedInCost, &cacheCreateCost, &outCost, &cost, &cacheCost,
+			&wantInput, &wantCachedInput, &wantCacheCreation, &wantOutput, &wantTotal, &wantCache), "scan usage row")
+		t.Logf("[sql] %s/%s: in=%d out=%d cache_read=%d cache_write=%d stored in/cached/create/out=$%.6f/$%.6f/$%.6f/$%.6f total=$%.6f cache=$%.6f expected total=$%.6f cache=$%.6f",
+			provider, model, inTok, outTok, readTok, writeTok,
+			inCost, cachedInCost, cacheCreateCost, outCost, cost, cacheCost, wantTotal, wantCache)
+		assert.InDeltaf(t, wantInput, inCost, 1e-6, "stored input_cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, wantCachedInput, cachedInCost, 1e-6, "stored cached_input_cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, wantCacheCreation, cacheCreateCost, 1e-6, "stored cache_creation_cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, wantOutput, outCost, 1e-6, "stored output_cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, wantTotal, cost, 1e-6, "derived cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, wantCache, cacheCost, 1e-6, "derived cache_cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, inCost+cachedInCost+cacheCreateCost+outCost, cost, 1e-9,
+			"stored buckets must sum to the derived cost_usd for %s/%s", provider, model)
+		verified++
+	}
+	require.NoError(t, rows.Err(), "iterate usage rows")
+	require.Positive(t, verified, "raw SQL check must cover at least one usage row")
+	t.Logf("[sql] verified %d usage rows in store.db against published rates", verified)
+
+	gwRows, err := db.Raw(`SELECT model,
+	  (input_cost_usd + cached_input_cost_usd + cache_creation_cost_usd + output_cost_usd) AS cost_usd
+	  FROM agent_network_request_usage WHERE model LIKE '%/%'`).Rows()
+	require.NoError(t, err, "query gateway-prefixed usage rows")
+	defer func() { _ = gwRows.Close() }()
+	for gwRows.Next() {
+		var model string
+		var cost float64
+		require.NoError(t, gwRows.Scan(&model, &cost), "scan gateway usage row")
+		t.Logf("[sql] gateway %s: stored=$%.6f (must be 0 — deliberately unpriced)", model, cost)
+		assert.Zerof(t, cost, "gateway-prefixed model %q must store cost 0, never a guessed rate", model)
+	}
+	require.NoError(t, gwRows.Err(), "iterate gateway usage rows")
+}
+
+// validateAccessLogCost recomputes a live access-log row's expected total and cache cost from the
+// published per-1k rates and the row's persisted token buckets, and asserts both stored values.
+// Gateway-prefixed model ids the proxy deliberately does not price must store cost 0.
+func validateAccessLogCost(t *testing.T, pc providerCase, row api.AgentNetworkAccessLog) {
+	t.Helper()
+	model := catalogModel(pc)
+	provider := ""
+	if row.Provider != nil {
+		provider = *row.Provider
+	}
+	t.Logf("[cost] %s: provider=%s model=%s in=%d out=%d total=%d cache_read=%d cache_write=%d cost=$%.6f cache_cost=$%.6f",
+		pc.name, provider, model, row.InputTokens, row.OutputTokens, row.TotalTokens,
+		row.CachedInputTokens, row.CacheCreationTokens, row.CostUsd, row.CacheCostUsd)
+
+	rates, known := publishedPer1k[model]
+	if !known {
+		if strings.Contains(model, "/") {
+			assert.Zerof(t, row.CostUsd, "gateway-prefixed model %q is not priced so the cost meter must skip (cost 0)", model)
+			return
+		}
+		t.Logf("[cost] %s: no published rate on file for model %q (env-overridden?); skipping cost validation", pc.name, model)
+		return
+	}
+
+	// input_tokens may legitimately be 0: Moonshot/Kimi reports fully cached prompts under the cache
+	// buckets only. Output and total must always be present on a priced row.
+	require.Positive(t, row.OutputTokens, "priced row must carry output tokens")
+	require.Positive(t, row.TotalTokens, "priced row must carry total tokens")
+
+	var wantInput, wantCachedInput, wantCacheCreation float64
+	if provider == "openai" {
+		cached := min(row.CachedInputTokens, row.InputTokens) // cached is a subset of input
+		wantInput = float64(row.InputTokens-cached) / 1000 * rates.in
+		wantCachedInput = float64(cached) / 1000 * rates.read
+		// OpenAI has no cache-write bucket; wantCacheCreation stays 0.
+	} else {
+		// Anthropic / Bedrock shape: cache buckets are additive to input_tokens.
+		wantInput = float64(row.InputTokens) / 1000 * rates.in
+		wantCachedInput = float64(row.CachedInputTokens) / 1000 * rates.read
+		wantCacheCreation = float64(row.CacheCreationTokens) / 1000 * rates.write
+	}
+	wantOutput := float64(row.OutputTokens) / 1000 * rates.out
+	wantCache := wantCachedInput + wantCacheCreation
+	wantTotal := wantInput + wantCache + wantOutput
+
+	t.Logf("[cost] %s: expecting input=$%.6f cached_input=$%.6f cache_creation=$%.6f output=$%.6f total=$%.6f cache=$%.6f from published rates",
+		pc.name, wantInput, wantCachedInput, wantCacheCreation, wantOutput, wantTotal, wantCache)
+	assert.InDeltaf(t, wantInput, row.InputCostUsd, 1e-6, "stored input_cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, wantCachedInput, row.CachedInputCostUsd, 1e-6, "stored cached_input_cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, wantCacheCreation, row.CacheCreationCostUsd, 1e-6, "stored cache_creation_cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, wantOutput, row.OutputCostUsd, 1e-6, "stored output_cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, wantTotal, row.CostUsd, 1e-6, "derived cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, wantCache, row.CacheCostUsd, 1e-6, "derived cache_cost_usd for %s (%s)", pc.name, model)
+
+	// The aggregates must be exactly the sum of the stored components, not an
+	// independently-computed figure that could drift from the breakdown.
+	assert.InDeltaf(t, row.InputCostUsd+row.CachedInputCostUsd+row.CacheCreationCostUsd+row.OutputCostUsd,
+		row.CostUsd, 1e-9, "stored buckets must sum to the derived cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, row.CachedInputCostUsd+row.CacheCreationCostUsd,
+		row.CacheCostUsd, 1e-9, "stored cache buckets must sum to the derived cache_cost_usd for %s (%s)", pc.name, model)
+}
+
 // providerCase is one entry in the live provider matrix. The same scenario runs
 // for every available provider; availability is keyed off env vars so the suite
 // covers whatever credentials are present (source ~/.llm-keys locally / set the
@@ -116,12 +324,12 @@ func availableProviders() []providerCase {
 		if region == "" {
 			region = "eu-central-1"
 		}
-		// A valid Bedrock inference-profile id (region prefix + date + version),
-		// overridable per account. `global.` profiles can be invoked from any
-		// region; set AWS_BEDROCK_MODEL to match the enabled profile for the token.
+		// A valid Bedrock inference-profile id, overridable per account (AWS_BEDROCK_MODEL, also the
+		// workflow's bedrock_model dispatch input). `global.` profiles work from any region. Defaults to
+		// Sonnet 4.6, whose id convention dropped the -YYYYMMDD-v1:0 suffix that Haiku 4.5 still carries.
 		model := os.Getenv("AWS_BEDROCK_MODEL")
 		if model == "" {
-			model = "global.anthropic.claude-haiku-4-5-20251001-v1:0"
+			model = "global.anthropic.claude-sonnet-4-6"
 		}
 		ps = append(ps, providerCase{name: "bedrock", catalogID: "bedrock_api", upstream: "https://bedrock-runtime." + region + ".amazonaws.com", apiKey: k, model: model, kind: harness.WireBedrock})
 	}
@@ -257,6 +465,10 @@ func TestProvidersMatrix(t *testing.T) {
 			// session id and confirm the marker propagated end-to-end.
 			sessionID := "e2e-session-" + pc.name
 
+			// A long-form prompt so completions carry realistic token counts for cost validation;
+			// max_tokens in the harness bodies (2048) lets the full answer through.
+			const matrixPrompt = "explain GitHub workflow in 1000 words"
+
 			// Retry briefly to absorb tunnel/DNS jitter on the first call.
 			var code int
 			var body string
@@ -267,11 +479,11 @@ func TestProvidersMatrix(t *testing.T) {
 				var cerr error
 				switch pc.kind {
 				case harness.WireVertex:
-					c, b, cerr = cl.Vertex(ctx, settings.Endpoint, proxyIP, pc.project, pc.region, pc.model, "Reply with exactly: pong", sessionID)
+					c, b, cerr = cl.Vertex(ctx, settings.Endpoint, proxyIP, pc.project, pc.region, pc.model, matrixPrompt, sessionID)
 				case harness.WireBedrock:
-					c, b, cerr = cl.Bedrock(ctx, settings.Endpoint, proxyIP, pc.model, "Reply with exactly: pong", sessionID)
+					c, b, cerr = cl.Bedrock(ctx, settings.Endpoint, proxyIP, pc.model, matrixPrompt, sessionID)
 				default:
-					c, b, cerr = cl.ChatPrefixed(ctx, settings.Endpoint, proxyIP, pc.pathPrefix, pc.kind, pc.model, "Reply with exactly: pong", sessionID)
+					c, b, cerr = cl.ChatPrefixed(ctx, settings.Endpoint, proxyIP, pc.pathPrefix, pc.kind, pc.model, matrixPrompt, sessionID)
 				}
 				if cerr == nil {
 					code, body = c, b
@@ -290,6 +502,7 @@ func TestProvidersMatrix(t *testing.T) {
 
 			// The session id sent as x-session-id must round-trip into the
 			// access-log row for this provider.
+			var row api.AgentNetworkAccessLog
 			require.Eventually(t, func() bool {
 				logs, lerr := srv.ListAccessLogs(ctx)
 				if lerr != nil {
@@ -297,11 +510,15 @@ func TestProvidersMatrix(t *testing.T) {
 				}
 				for _, r := range logs.Data {
 					if r.SessionId != nil && *r.SessionId == sessionID {
+						row = r
 						return true
 					}
 				}
 				return false
 			}, 30*time.Second, 2*time.Second, "session id %q must be recorded in an access-log row for %s", sessionID, pc.name)
+
+			// Stored total and cache cost must match the published rates applied to the row's buckets.
+			validateAccessLogCost(t, pc, row)
 		})
 	}
 
@@ -322,4 +539,7 @@ func TestProvidersMatrix(t *testing.T) {
 		}
 		return false
 	}, 60*time.Second, 3*time.Second, "consumption must be recorded with positive token counts after live traffic")
+
+	// Final raw-SQL audit: bypass the API and re-verify every persisted usage row in the store.
+	verifyUsageRowsSQL(t, srv)
 }

e2e/harness/client.go

@@ -256,7 +256,7 @@ func (cl *Client) ChatPrefixed(ctx context.Context, endpoint, proxyIP, pathPrefi
 	case WireMessages:
 		path = "/v1/messages"
 		headers = []string{"anthropic-version: 2023-06-01"}
-		body = fmt.Sprintf(`{"model":%q,"max_tokens":64,"messages":[{"role":"user","content":%q}]}`, model, prompt)
+		body = fmt.Sprintf(`{"model":%q,"max_tokens":2048,"messages":[{"role":"user","content":%q}]}`, model, prompt)
 	default:
 		path = "/v1/chat/completions"
 		body = fmt.Sprintf(`{"model":%q,"messages":[{"role":"user","content":%q}]}`, model, prompt)
@@ -271,7 +271,7 @@ func (cl *Client) ChatPrefixed(ctx context.Context, endpoint, proxyIP, pathPrefi
 // is sent as the universal x-session-id header the proxy records.
 func (cl *Client) Vertex(ctx context.Context, endpoint, proxyIP, project, region, model, prompt, sessionID string) (int, string, error) {
 	path := fmt.Sprintf("/v1/projects/%s/locations/%s/publishers/anthropic/models/%s:rawPredict", project, region, model)
-	body := fmt.Sprintf(`{"anthropic_version":"vertex-2023-10-16","max_tokens":64,"messages":[{"role":"user","content":%q}]}`, prompt)
+	body := fmt.Sprintf(`{"anthropic_version":"vertex-2023-10-16","max_tokens":2048,"messages":[{"role":"user","content":%q}]}`, prompt)
 	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(nil, sessionID))
 }
 
@@ -282,7 +282,7 @@ func (cl *Client) Vertex(ctx context.Context, endpoint, proxyIP, project, region
 // header the proxy records.
 func (cl *Client) Bedrock(ctx context.Context, endpoint, proxyIP, model, prompt, sessionID string) (int, string, error) {
 	path := "/model/" + model + "/invoke"
-	body := fmt.Sprintf(`{"anthropic_version":"bedrock-2023-05-31","max_tokens":64,"messages":[{"role":"user","content":%q}]}`, prompt)
+	body := fmt.Sprintf(`{"anthropic_version":"bedrock-2023-05-31","max_tokens":2048,"messages":[{"role":"user","content":%q}]}`, prompt)
 	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(nil, sessionID))
 }
 
@@ -341,7 +341,7 @@ func (cl *Client) Terminate(ctx context.Context) error {
 	return cl.container.Terminate(ctx)
 }
 
-// containerLogs reads up to 256 KiB of a container's logs for diagnostics.
+// containerLogs reads up to 4 MiB of a container's logs for diagnostics — enough for a whole provider-matrix run.
 func containerLogs(ctx context.Context, c testcontainers.Container) string {
 	if c == nil {
 		return ""
@@ -351,6 +351,6 @@ func containerLogs(ctx context.Context, c testcontainers.Container) string {
 		return fmt.Sprintf("<logs error: %v>", err)
 	}
 	defer r.Close()
-	b, _ := io.ReadAll(io.LimitReader(r, 256<<10))
+	b, _ := io.ReadAll(io.LimitReader(r, 4<<20))
 	return string(b)
 }

e2e/harness/combined.go

@@ -221,6 +221,29 @@ func (c *Combined) CreateProxyTokenCLI(ctx context.Context, name string) (string
 	return "", fmt.Errorf("token not found in CLI output: %s", string(out))
 }
 
+// SnapshotStoreDB copies the management sqlite store (with WAL/SHM sidecars) out of the bind-mounted
+// data dir into dstDir and returns the copy's path; reading a copy avoids locking against live writes.
+func (c *Combined) SnapshotStoreDB(dstDir string) (string, error) {
+	src := filepath.Join(c.workDir, "data", "store.db")
+	if _, err := os.Stat(src); err != nil {
+		return "", fmt.Errorf("management store not found at %s: %w", src, err)
+	}
+	dst := filepath.Join(dstDir, "store.db")
+	for _, suffix := range []string{"", "-wal", "-shm"} {
+		data, err := os.ReadFile(src + suffix)
+		if err != nil {
+			if os.IsNotExist(err) && suffix != "" {
+				continue // sidecar only exists in WAL mode
+			}
+			return "", fmt.Errorf("read %s: %w", src+suffix, err)
+		}
+		if err := os.WriteFile(dst+suffix, data, 0o600); err != nil {
+			return "", fmt.Errorf("write %s: %w", dst+suffix, err)
+		}
+	}
+	return dst, nil
+}
+
 // Logs returns the combined server container logs, for diagnostics.
 func (c *Combined) Logs(ctx context.Context) string {
 	return containerLogs(ctx, c.container)

management/internals/controllers/network_map/controller/controller.go

@@ -641,7 +641,7 @@ func (c *Controller) GetValidatedPeerWithComponents(ctx context.Context, isRequi
 		if err != nil {
 			return nil, nil, nil, nil, 0, err
 		}
-		return peer, &types.NetworkMapComponents{Network: types.TwinNetwork(network)}, nil, nil, 0, nil
+		return peer, &types.NetworkMapComponents{Network: network.Copy()}, nil, nil, 0, nil
 	}
 
 	account, err := c.requestBuffer.GetAccountWithBackpressure(ctx, accountID)
@@ -794,7 +794,7 @@ func (c *Controller) GetValidatedPeerWithMap(ctx context.Context, isRequiresAppr
 		}
 
 		emptyMap := &types.NetworkMap{
-			Network: types.TwinNetwork(network),
+			Network: network.Copy(),
 		}
 		return emptyMap, nil, 0, nil
 	}

management/internals/modules/agentnetwork/accesslog_ingest.go

@@ -18,21 +18,26 @@ import (
 // contract between the proxy and management; management flattens them into
 // queryable columns. Keep in sync with the proxy side.
 const (
-	metaKeyProvider           = "llm.provider"
-	metaKeyModel              = "llm.model"
-	metaKeyResolvedProviderID = "llm.resolved_provider_id"
-	metaKeySelectedPolicyID   = "llm.selected_policy_id"
-	metaKeyPolicyDecision     = "llm_policy.decision"
-	metaKeyPolicyReason       = "llm_policy.reason"
-	metaKeyInputTokens        = "llm.input_tokens"  //nolint:gosec // metadata key name, not a credential
-	metaKeyOutputTokens       = "llm.output_tokens" //nolint:gosec // metadata key name, not a credential
-	metaKeyTotalTokens        = "llm.total_tokens"  //nolint:gosec // metadata key name, not a credential
-	metaKeyCostUSDTotal       = "cost.usd_total"
-	metaKeyStream             = "llm.stream"
-	metaKeySessionID          = "llm.session_id"
-	metaKeyAuthorisingGroups  = "llm.authorising_groups"
-	metaKeyRequestPrompt      = "llm.request_prompt"
-	metaKeyResponseCompletion = "llm.response_completion"
+	metaKeyProvider            = "llm.provider"
+	metaKeyModel               = "llm.model"
+	metaKeyResolvedProviderID  = "llm.resolved_provider_id"
+	metaKeySelectedPolicyID    = "llm.selected_policy_id"
+	metaKeyPolicyDecision      = "llm_policy.decision"
+	metaKeyPolicyReason        = "llm_policy.reason"
+	metaKeyInputTokens         = "llm.input_tokens"          //nolint:gosec // metadata key name, not a credential
+	metaKeyOutputTokens        = "llm.output_tokens"         //nolint:gosec // metadata key name, not a credential
+	metaKeyTotalTokens         = "llm.total_tokens"          //nolint:gosec // metadata key name, not a credential
+	metaKeyCachedInputTokens   = "llm.cached_input_tokens"   //nolint:gosec // metadata key name, not a credential
+	metaKeyCacheCreationTokens = "llm.cache_creation_tokens" //nolint:gosec // metadata key name, not a credential
+	metaKeyCostUSDInput        = "cost.usd_input"
+	metaKeyCostUSDCachedInput  = "cost.usd_cached_input"
+	metaKeyCostUSDCacheCreate  = "cost.usd_cache_creation"
+	metaKeyCostUSDOutput       = "cost.usd_output"
+	metaKeyStream              = "llm.stream"
+	metaKeySessionID           = "llm.session_id"
+	metaKeyAuthorisingGroups   = "llm.authorising_groups"
+	metaKeyRequestPrompt       = "llm.request_prompt"
+	metaKeyResponseCompletion  = "llm.response_completion"
 )
 
 // IngestAccessLog flattens the metadata-bearing reverse-proxy access-log entry
@@ -108,20 +113,25 @@ func flattenAccessLog(e *accesslogs.AccessLogEntry) (*types.AgentNetworkAccessLo
 		BytesUpload:   e.BytesUpload,
 		BytesDownload: e.BytesDownload,
 
-		Provider:           meta[metaKeyProvider],
-		Model:              meta[metaKeyModel],
-		SessionID:          meta[metaKeySessionID],
-		ResolvedProviderID: meta[metaKeyResolvedProviderID],
-		SelectedPolicyID:   meta[metaKeySelectedPolicyID],
-		Decision:           meta[metaKeyPolicyDecision],
-		DenyReason:         meta[metaKeyPolicyReason],
-		InputTokens:        parseMetaInt(meta, metaKeyInputTokens),
-		OutputTokens:       parseMetaInt(meta, metaKeyOutputTokens),
-		TotalTokens:        parseMetaInt(meta, metaKeyTotalTokens),
-		CostUSD:            parseMetaFloat(meta, metaKeyCostUSDTotal),
-		Stream:             parseMetaBool(meta, metaKeyStream),
-		RequestPrompt:      meta[metaKeyRequestPrompt],
-		ResponseCompletion: meta[metaKeyResponseCompletion],
+		Provider:             meta[metaKeyProvider],
+		Model:                meta[metaKeyModel],
+		SessionID:            meta[metaKeySessionID],
+		ResolvedProviderID:   meta[metaKeyResolvedProviderID],
+		SelectedPolicyID:     meta[metaKeySelectedPolicyID],
+		Decision:             meta[metaKeyPolicyDecision],
+		DenyReason:           meta[metaKeyPolicyReason],
+		InputTokens:          parseMetaInt(meta, metaKeyInputTokens),
+		OutputTokens:         parseMetaInt(meta, metaKeyOutputTokens),
+		TotalTokens:          parseMetaInt(meta, metaKeyTotalTokens),
+		CachedInputTokens:    parseMetaInt(meta, metaKeyCachedInputTokens),
+		CacheCreationTokens:  parseMetaInt(meta, metaKeyCacheCreationTokens),
+		InputCostUSD:         parseMetaFloat(meta, metaKeyCostUSDInput),
+		CachedInputCostUSD:   parseMetaFloat(meta, metaKeyCostUSDCachedInput),
+		CacheCreationCostUSD: parseMetaFloat(meta, metaKeyCostUSDCacheCreate),
+		OutputCostUSD:        parseMetaFloat(meta, metaKeyCostUSDOutput),
+		Stream:               parseMetaBool(meta, metaKeyStream),
+		RequestPrompt:        meta[metaKeyRequestPrompt],
+		ResponseCompletion:   meta[metaKeyResponseCompletion],
 	}
 
 	var groups []types.AgentNetworkAccessLogGroup
@@ -140,18 +150,23 @@ func flattenAccessLog(e *accesslogs.AccessLogEntry) (*types.AgentNetworkAccessLo
 // log's ID so the two correlate.
 func usageFromFlattenedLog(e *types.AgentNetworkAccessLog, groups []types.AgentNetworkAccessLogGroup) (*types.AgentNetworkUsage, []types.AgentNetworkUsageGroup) {
 	usage := &types.AgentNetworkUsage{
-		ID:                 e.ID,
-		AccountID:          e.AccountID,
-		Timestamp:          e.Timestamp,
-		UserID:             e.UserID,
-		ResolvedProviderID: e.ResolvedProviderID,
-		Provider:           e.Provider,
-		Model:              e.Model,
-		SessionID:          e.SessionID,
-		InputTokens:        e.InputTokens,
-		OutputTokens:       e.OutputTokens,
-		TotalTokens:        e.TotalTokens,
-		CostUSD:            e.CostUSD,
+		ID:                   e.ID,
+		AccountID:            e.AccountID,
+		Timestamp:            e.Timestamp,
+		UserID:               e.UserID,
+		ResolvedProviderID:   e.ResolvedProviderID,
+		Provider:             e.Provider,
+		Model:                e.Model,
+		SessionID:            e.SessionID,
+		InputTokens:          e.InputTokens,
+		OutputTokens:         e.OutputTokens,
+		TotalTokens:          e.TotalTokens,
+		CachedInputTokens:    e.CachedInputTokens,
+		CacheCreationTokens:  e.CacheCreationTokens,
+		InputCostUSD:         e.InputCostUSD,
+		CachedInputCostUSD:   e.CachedInputCostUSD,
+		CacheCreationCostUSD: e.CacheCreationCostUSD,
+		OutputCostUSD:        e.OutputCostUSD,
 	}
 
 	usageGroups := make([]types.AgentNetworkUsageGroup, 0, len(groups))

management/internals/modules/agentnetwork/accesslog_ingest_realstore_test.go

@@ -28,17 +28,22 @@ func newIngestTestEntry() *accesslogs.AccessLogEntry {
 		UserId:       "user-1",
 		AgentNetwork: true,
 		Metadata: map[string]string{
-			metaKeyProvider:           "openai",
-			metaKeyModel:              "gpt-5.4",
-			metaKeyResolvedProviderID: "prov-1",
-			metaKeySessionID:          "sess-1",
-			metaKeyInputTokens:        "100",
-			metaKeyOutputTokens:       "50",
-			metaKeyTotalTokens:        "150",
-			metaKeyCostUSDTotal:       "0.0123",
-			metaKeyStream:             "true",
-			metaKeyRequestPrompt:      "hello",
-			metaKeyResponseCompletion: "world",
+			metaKeyProvider:            "openai",
+			metaKeyModel:               "gpt-5.4",
+			metaKeyResolvedProviderID:  "prov-1",
+			metaKeySessionID:           "sess-1",
+			metaKeyInputTokens:         "100",
+			metaKeyOutputTokens:        "50",
+			metaKeyTotalTokens:         "1174",
+			metaKeyCachedInputTokens:   "256",
+			metaKeyCacheCreationTokens: "768",
+			metaKeyCostUSDInput:        "0.0071",
+			metaKeyCostUSDCachedInput:  "0.0009",
+			metaKeyCostUSDCacheCreate:  "0.0020",
+			metaKeyCostUSDOutput:       "0.0023",
+			metaKeyStream:              "true",
+			metaKeyRequestPrompt:       "hello",
+			metaKeyResponseCompletion:  "world",
 			// repeated id must be de-duplicated before the group rows insert.
 			metaKeyAuthorisingGroups: "grp-eng,grp-eng,grp-ops",
 		},
@@ -65,7 +70,19 @@ func TestIngestAccessLog_RealStore_LogCollectionOff(t *testing.T) {
 	require.Len(t, usage, 1, "usage row must be written even with log collection off")
 	assert.Equal(t, int64(100), usage[0].InputTokens, "input tokens must round-trip from metadata")
 	assert.Equal(t, int64(50), usage[0].OutputTokens, "output tokens must round-trip from metadata")
-	assert.InDelta(t, 0.0123, usage[0].CostUSD, 1e-9, "cost must round-trip from metadata")
+	assert.Equal(t, int64(256), usage[0].CachedInputTokens, "cache-read tokens must round-trip from metadata")
+	assert.Equal(t, int64(768), usage[0].CacheCreationTokens, "cache-write tokens must round-trip from metadata")
+	// The per-bucket breakdown is the only cost state stored, and must survive
+	// the write/read cycle as real columns — usage rows are the only cost
+	// record for accounts with log collection off, so a dropped column here
+	// loses the split permanently.
+	assert.InDelta(t, 0.0071, usage[0].InputCostUSD, 1e-9, "input cost must round-trip from metadata")
+	assert.InDelta(t, 0.0009, usage[0].CachedInputCostUSD, 1e-9, "cache-read cost must round-trip from metadata")
+	assert.InDelta(t, 0.0020, usage[0].CacheCreationCostUSD, 1e-9, "cache-write cost must round-trip from metadata")
+	assert.InDelta(t, 0.0023, usage[0].OutputCostUSD, 1e-9, "output cost must round-trip from metadata")
+	// Aggregates are derived from the stored columns, never stored themselves.
+	assert.InDelta(t, 0.0123, usage[0].TotalCostUSD(), 1e-9, "total is derived from the stored buckets")
+	assert.InDelta(t, 0.0029, usage[0].CacheCostUSD(), 1e-9, "cache cost is derived from the two cache buckets")
 
 	logs, _, err := s.GetAgentNetworkAccessLogs(ctx, store.LockingStrengthNone, testAccountID, types.AgentNetworkAccessLogFilter{})
 	require.NoError(t, err)
@@ -96,6 +113,14 @@ func TestIngestAccessLog_RealStore_LogCollectionOn(t *testing.T) {
 	require.Equal(t, int64(1), total, "exactly one access-log row expected")
 	require.Len(t, logs, 1, "full access-log row must be written when log collection is on")
 	assert.Equal(t, "gpt-5.4", logs[0].Model, "model must flatten from metadata")
+	assert.Equal(t, int64(256), logs[0].CachedInputTokens, "cache-read tokens must flatten from metadata")
+	assert.Equal(t, int64(768), logs[0].CacheCreationTokens, "cache-write tokens must flatten from metadata")
+	assert.InDelta(t, 0.0029, logs[0].CacheCostUSD(), 1e-9, "cache cost is derived from the two cache buckets")
+	assert.InDelta(t, 0.0123, logs[0].TotalCostUSD(), 1e-9, "total is derived from the stored buckets")
+	assert.InDelta(t, 0.0071, logs[0].InputCostUSD, 1e-9, "input cost must flatten from metadata")
+	assert.InDelta(t, 0.0009, logs[0].CachedInputCostUSD, 1e-9, "cache-read cost must flatten from metadata")
+	assert.InDelta(t, 0.0020, logs[0].CacheCreationCostUSD, 1e-9, "cache-write cost must flatten from metadata")
+	assert.InDelta(t, 0.0023, logs[0].OutputCostUSD, 1e-9, "output cost must flatten from metadata")
 	assert.Equal(t, "hello", logs[0].RequestPrompt, "prompt must be retained when log collection is on")
 	assert.Equal(t, "world", logs[0].ResponseCompletion, "completion must be retained when log collection is on")
 	assert.True(t, logs[0].Stream, "stream flag must flatten from metadata")

management/internals/modules/agentnetwork/accesslog_sessions_realstore_test.go

@@ -38,7 +38,7 @@ func accessLogRow(id, sessionID string, ts time.Time, opts ...func(*types.AgentN
 		InputTokens:        100,
 		OutputTokens:       50,
 		TotalTokens:        150,
-		CostUSD:            0.01,
+		InputCostUSD:       0.01,
 	}
 	for _, o := range opts {
 		o(e)
@@ -74,7 +74,7 @@ func withTokens(in, out, total int64, cost float64) func(*types.AgentNetworkAcce
 		e.InputTokens = in
 		e.OutputTokens = out
 		e.TotalTokens = total
-		e.CostUSD = cost
+		e.InputCostUSD = cost
 	}
 }
 
@@ -155,7 +155,7 @@ func TestAccessLogSessions_FoldAndAggregate(t *testing.T) {
 	assert.Equal(t, int64(310), a.InputTokens, "input tokens summed")
 	assert.Equal(t, int64(135), a.OutputTokens, "output tokens summed")
 	assert.Equal(t, int64(445), a.TotalTokens, "total tokens summed")
-	assert.InDelta(t, 0.031, a.CostUSD, 1e-9, "cost summed")
+	assert.InDelta(t, 0.031, a.TotalCostUSD(), 1e-9, "cost summed")
 	assert.Equal(t, "deny", a.Decision, "any deny makes the session a deny")
 	assert.ElementsMatch(t, []string{"openai", "anthropic"}, a.Providers, "distinct providers")
 	assert.ElementsMatch(t, []string{"gpt-5.4", "claude-haiku-4-5"}, a.Models, "distinct models")

management/internals/modules/agentnetwork/types/accesslog.go

@@ -41,8 +41,24 @@ type AgentNetworkAccessLog struct {
 	InputTokens        int64
 	OutputTokens       int64
 	TotalTokens        int64
-	CostUSD            float64
-	Stream             bool
+	// Prompt-cache buckets: read + write token counts.
+	CachedInputTokens   int64
+	CacheCreationTokens int64
+	// Per-bucket cost breakdown — one column per token bucket the provider
+	// bills separately. These four are the only cost state stored: the total
+	// and the cache portion are derived on read (TotalCostUSD / CacheCostUSD)
+	// rather than stored alongside, so a stored aggregate can never drift out
+	// of step with the components it summarises.
+	//
+	// default:0 matters on upgrade: these columns are ALTER TABLE ADD COLUMN
+	// on an existing table, and without it every historical row holds NULL —
+	// which a raw SUM()/scan into float64 can't read. The default backfills
+	// them as 0, so pre-upgrade rows report an unknown split, not an error.
+	InputCostUSD         float64 `gorm:"not null;default:0"`
+	CachedInputCostUSD   float64 `gorm:"not null;default:0"`
+	CacheCreationCostUSD float64 `gorm:"not null;default:0"`
+	OutputCostUSD        float64 `gorm:"not null;default:0"`
+	Stream               bool
 
 	// Prompt capture. Only populated when prompt collection is enabled
 	// (account master switch AND policy guardrail). Heavy free text.
@@ -60,19 +76,44 @@ type AgentNetworkAccessLog struct {
 // the reverse-proxy AccessLogEntry table.
 func (AgentNetworkAccessLog) TableName() string { return "agent_network_access_log" }
 
+// CostUSDSQLExpr is the SQL sum of the per-bucket cost columns — the total cost
+// of a row. Used wherever a query has to sort or aggregate on total cost now
+// that no cost_usd column is stored. Plain arithmetic over NOT NULL columns, so
+// it stays portable across SQLite and Postgres.
+const CostUSDSQLExpr = "(input_cost_usd + cached_input_cost_usd + cache_creation_cost_usd + output_cost_usd)"
+
+// TotalCostUSD is the request's total cost: the sum of the four per-bucket
+// costs. Derived rather than stored so it cannot disagree with the breakdown.
+func (a *AgentNetworkAccessLog) TotalCostUSD() float64 {
+	return a.InputCostUSD + a.CachedInputCostUSD + a.CacheCreationCostUSD + a.OutputCostUSD
+}
+
+// CacheCostUSD is the portion of the total billed for prompt-cache buckets:
+// cache reads plus cache writes.
+func (a *AgentNetworkAccessLog) CacheCostUSD() float64 {
+	return a.CachedInputCostUSD + a.CacheCreationCostUSD
+}
+
 // ToAPIResponse renders the flattened entry as the API representation.
 func (a *AgentNetworkAccessLog) ToAPIResponse() api.AgentNetworkAccessLog {
 	out := api.AgentNetworkAccessLog{
-		Id:           a.ID,
-		ServiceId:    a.ServiceID,
-		Timestamp:    a.Timestamp,
-		StatusCode:   a.StatusCode,
-		DurationMs:   int(a.Duration.Milliseconds()),
-		InputTokens:  a.InputTokens,
-		OutputTokens: a.OutputTokens,
-		TotalTokens:  a.TotalTokens,
-		CostUsd:      a.CostUSD,
-		Stream:       &a.Stream,
+		Id:                   a.ID,
+		ServiceId:            a.ServiceID,
+		Timestamp:            a.Timestamp,
+		StatusCode:           a.StatusCode,
+		DurationMs:           int(a.Duration.Milliseconds()),
+		InputTokens:          a.InputTokens,
+		OutputTokens:         a.OutputTokens,
+		TotalTokens:          a.TotalTokens,
+		CachedInputTokens:    a.CachedInputTokens,
+		CacheCreationTokens:  a.CacheCreationTokens,
+		InputCostUsd:         a.InputCostUSD,
+		CachedInputCostUsd:   a.CachedInputCostUSD,
+		CacheCreationCostUsd: a.CacheCreationCostUSD,
+		OutputCostUsd:        a.OutputCostUSD,
+		CostUsd:              a.TotalCostUSD(),
+		CacheCostUsd:         a.CacheCostUSD(),
+		Stream:               &a.Stream,
 	}
 
 	out.UserId = strPtr(a.UserID)
@@ -112,20 +153,36 @@ func strPtr(s string) *string {
 // summary plus its ordered entries. Assembled in Go from a page of entries — it
 // is not a stored table.
 type AgentNetworkAccessLogSession struct {
-	SessionID    string // empty for a session-less (singleton) request
-	UserID       string
-	GroupIDs     []string // union of the entries' authorising groups
-	StartedAt    time.Time
-	EndedAt      time.Time
-	RequestCount int
-	InputTokens  int64
-	OutputTokens int64
-	TotalTokens  int64
-	CostUSD      float64
-	Providers    []string // distinct vendors seen in the session
-	Models       []string // distinct models seen in the session
-	Decision     string   // "deny" if any entry was denied, else "allow"
-	Entries      []*AgentNetworkAccessLog
+	SessionID            string // empty for a session-less (singleton) request
+	UserID               string
+	GroupIDs             []string // union of the entries' authorising groups
+	StartedAt            time.Time
+	EndedAt              time.Time
+	RequestCount         int
+	InputTokens          int64
+	OutputTokens         int64
+	TotalTokens          int64
+	CachedInputTokens    int64
+	CacheCreationTokens  int64
+	InputCostUSD         float64
+	CachedInputCostUSD   float64
+	CacheCreationCostUSD float64
+	OutputCostUSD        float64
+	Providers            []string // distinct vendors seen in the session
+	Models               []string // distinct models seen in the session
+	Decision             string   // "deny" if any entry was denied, else "allow"
+	Entries              []*AgentNetworkAccessLog
+}
+
+// TotalCostUSD is the session's total cost: the sum of the four per-bucket
+// costs accumulated across its entries.
+func (sess *AgentNetworkAccessLogSession) TotalCostUSD() float64 {
+	return sess.InputCostUSD + sess.CachedInputCostUSD + sess.CacheCreationCostUSD + sess.OutputCostUSD
+}
+
+// CacheCostUSD is the session's prompt-cache spend: cache reads plus writes.
+func (sess *AgentNetworkAccessLogSession) CacheCostUSD() float64 {
+	return sess.CachedInputCostUSD + sess.CacheCreationCostUSD
 }
 
 // sessionKey is the grouping key for an entry: its session id, or — when the
@@ -205,7 +262,12 @@ func (sess *AgentNetworkAccessLogSession) foldEntry(sk *sessionSeen, e *AgentNet
 	sess.InputTokens += e.InputTokens
 	sess.OutputTokens += e.OutputTokens
 	sess.TotalTokens += e.TotalTokens
-	sess.CostUSD += e.CostUSD
+	sess.CachedInputTokens += e.CachedInputTokens
+	sess.CacheCreationTokens += e.CacheCreationTokens
+	sess.InputCostUSD += e.InputCostUSD
+	sess.CachedInputCostUSD += e.CachedInputCostUSD
+	sess.CacheCreationCostUSD += e.CacheCreationCostUSD
+	sess.OutputCostUSD += e.OutputCostUSD
 	if e.Timestamp.Before(sess.StartedAt) {
 		sess.StartedAt = e.Timestamp
 	}
@@ -248,15 +310,22 @@ func (sess *AgentNetworkAccessLogSession) ToAPIResponse() api.AgentNetworkAccess
 	}
 
 	out := api.AgentNetworkAccessLogSession{
-		StartedAt:    sess.StartedAt,
-		EndedAt:      sess.EndedAt,
-		RequestCount: sess.RequestCount,
-		InputTokens:  sess.InputTokens,
-		OutputTokens: sess.OutputTokens,
-		TotalTokens:  sess.TotalTokens,
-		CostUsd:      sess.CostUSD,
-		Decision:     sess.Decision,
-		Entries:      entries,
+		StartedAt:            sess.StartedAt,
+		EndedAt:              sess.EndedAt,
+		RequestCount:         sess.RequestCount,
+		InputTokens:          sess.InputTokens,
+		OutputTokens:         sess.OutputTokens,
+		TotalTokens:          sess.TotalTokens,
+		CachedInputTokens:    sess.CachedInputTokens,
+		CacheCreationTokens:  sess.CacheCreationTokens,
+		InputCostUsd:         sess.InputCostUSD,
+		CachedInputCostUsd:   sess.CachedInputCostUSD,
+		CacheCreationCostUsd: sess.CacheCreationCostUSD,
+		OutputCostUsd:        sess.OutputCostUSD,
+		CostUsd:              sess.TotalCostUSD(),
+		CacheCostUsd:         sess.CacheCostUSD(),
+		Decision:             sess.Decision,
+		Entries:              entries,
 	}
 	out.SessionId = strPtr(sess.SessionID)
 	out.UserId = strPtr(sess.UserID)

management/internals/modules/agentnetwork/types/accesslogfilter.go

@@ -54,7 +54,7 @@ var accessLogSortFields = map[string]string{
 	"provider":     "provider",
 	"status_code":  "status_code",
 	"duration":     "duration",
-	"cost_usd":     "cost_usd",
+	"cost_usd":     CostUSDSQLExpr,
 	"total_tokens": "total_tokens",
 	"user_id":      "user_id",
 	"decision":     "decision",
@@ -70,7 +70,7 @@ var accessLogSortFields = map[string]string{
 var sessionSortExprs = map[string]string{ //nolint:gosec // G101 false positive: "total_tokens" sort key, not a credential
 	"timestamp":     "MAX(timestamp)",
 	"started_at":    "MIN(timestamp)",
-	"cost_usd":      "SUM(cost_usd)",
+	"cost_usd":      "SUM" + CostUSDSQLExpr,
 	"total_tokens":  "SUM(total_tokens)",
 	"duration":      "SUM(duration)",
 	"request_count": "COUNT(*)",

management/internals/modules/agentnetwork/types/cost_test.go

@@ -0,0 +1,124 @@
+package types
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// costRow builds an access-log entry carrying only a cost breakdown — the rest
+// of the row is irrelevant to the summation identities under test.
+func costRow(id, session string, ts time.Time, in, cachedIn, cacheCreate, out float64) *AgentNetworkAccessLog {
+	return &AgentNetworkAccessLog{
+		ID:                   id,
+		SessionID:            session,
+		Timestamp:            ts,
+		InputCostUSD:         in,
+		CachedInputCostUSD:   cachedIn,
+		CacheCreationCostUSD: cacheCreate,
+		OutputCostUSD:        out,
+	}
+}
+
+// TestAPIResponse_CostComponentsSumToAggregates is the contract a client adding
+// up an API response depends on: within a single rendered object, the four
+// per-bucket fields sum to cost_usd, and the two cache fields sum to
+// cache_cost_usd. Uses rates that are not exactly representable in binary
+// floating point, so the identity is checked against real arithmetic rather
+// than round numbers.
+func TestAPIResponse_CostComponentsSumToAggregates(t *testing.T) {
+	row := costRow("r1", "s1", time.Now(), 0.000768, 0.0002304, 0.00192, 0.003)
+
+	api := row.ToAPIResponse()
+	assert.InDelta(t, api.InputCostUsd+api.CachedInputCostUsd+api.CacheCreationCostUsd+api.OutputCostUsd,
+		api.CostUsd, 1e-12, "rendered buckets must sum to the rendered cost_usd")
+	assert.InDelta(t, api.CachedInputCostUsd+api.CacheCreationCostUsd, api.CacheCostUsd, 1e-12,
+		"rendered cache buckets must sum to the rendered cache_cost_usd")
+	assert.InDelta(t, 0.0059184, api.CostUsd, 1e-12, "total is the exact sum, not a separately rounded figure")
+	assert.InDelta(t, 0.0021504, api.CacheCostUsd, 1e-12, "cache cost is the exact sum of the two cache buckets")
+}
+
+// TestSessionSummary_SumsMatchSummedEntries proves a session summary equals the
+// sum of the entries it renders: a client that adds up the entries itself must
+// land on the same number the summary reports, per bucket and in total.
+func TestSessionSummary_SumsMatchSummedEntries(t *testing.T) {
+	base := time.Date(2026, 5, 5, 10, 0, 0, 0, time.UTC)
+	entries := []*AgentNetworkAccessLog{
+		costRow("r1", "s1", base, 0.000768, 0.0002304, 0.00192, 0.003),
+		costRow("r2", "s1", base.Add(time.Minute), 0.000625, 0.0009375, 0, 0.005),
+		costRow("r3", "s1", base.Add(2*time.Minute), 0.0000016, 0, 0, 0.0000032),
+	}
+
+	sessions := FoldAccessLogSessions([]string{"s1"}, entries)
+	require.Len(t, sessions, 1)
+	sess := sessions[0].ToAPIResponse()
+
+	var wantInput, wantCachedInput, wantCacheCreation, wantOutput float64
+	for _, e := range entries {
+		wantInput += e.InputCostUSD
+		wantCachedInput += e.CachedInputCostUSD
+		wantCacheCreation += e.CacheCreationCostUSD
+		wantOutput += e.OutputCostUSD
+	}
+
+	assert.InDelta(t, wantInput, sess.InputCostUsd, 1e-12, "session input cost is the sum of its entries")
+	assert.InDelta(t, wantCachedInput, sess.CachedInputCostUsd, 1e-12, "session cache-read cost is the sum of its entries")
+	assert.InDelta(t, wantCacheCreation, sess.CacheCreationCostUsd, 1e-12, "session cache-write cost is the sum of its entries")
+	assert.InDelta(t, wantOutput, sess.OutputCostUsd, 1e-12, "session output cost is the sum of its entries")
+	assert.InDelta(t, wantInput+wantCachedInput+wantCacheCreation+wantOutput, sess.CostUsd, 1e-12,
+		"session total equals the summed entry buckets")
+
+	// Summing the rendered entries must give the same answer as reading the
+	// summary — the property a UI relies on when it totals a table itself.
+	var fromEntries float64
+	for _, e := range sess.Entries {
+		fromEntries += e.CostUsd
+	}
+	assert.InDelta(t, sess.CostUsd, fromEntries, 1e-12, "summary total must match the summed rendered entries")
+
+	// The sub-microdollar row must still contribute; it would vanish under
+	// 6-decimal quantisation.
+	assert.Greater(t, sess.InputCostUsd, 0.001393, "small-cost rows must not be quantised away")
+}
+
+// TestUsageBuckets_SumsMatchSummedRows proves the same identity one level up:
+// a usage bucket equals the sum of the ledger rows folded into it, and the
+// buckets together equal the whole range.
+func TestUsageBuckets_SumsMatchSummedRows(t *testing.T) {
+	day1 := time.Date(2026, 5, 5, 9, 0, 0, 0, time.UTC)
+	day2 := time.Date(2026, 5, 6, 9, 0, 0, 0, time.UTC)
+	rows := []*AgentNetworkUsage{
+		{ID: "u1", Timestamp: day1, InputCostUSD: 0.000768, CachedInputCostUSD: 0.0002304, CacheCreationCostUSD: 0.00192, OutputCostUSD: 0.003},
+		{ID: "u2", Timestamp: day1.Add(time.Hour), InputCostUSD: 0.000625, CachedInputCostUSD: 0.0009375, OutputCostUSD: 0.005},
+		{ID: "u3", Timestamp: day2, InputCostUSD: 0.0000016, OutputCostUSD: 0.0000032},
+	}
+
+	buckets := AggregateUsageByGranularity(rows, UsageGranularityDay)
+	require.Len(t, buckets, 2, "two distinct days expected")
+
+	var total, cache float64
+	for _, b := range buckets {
+		api := b.ToAPIResponse()
+		assert.InDelta(t, api.InputCostUsd+api.CachedInputCostUsd+api.CacheCreationCostUsd+api.OutputCostUsd,
+			api.CostUsd, 1e-12, "each bucket's components must sum to its cost_usd")
+		total += api.CostUsd
+		cache += api.CacheCostUsd
+	}
+
+	var wantTotal, wantCache float64
+	for _, r := range rows {
+		wantTotal += r.TotalCostUSD()
+		wantCache += r.CacheCostUSD()
+	}
+	assert.InDelta(t, wantTotal, total, 1e-12, "buckets must sum to the total across all ledger rows")
+	assert.InDelta(t, wantCache, cache, 1e-12, "buckets must sum to the cache spend across all ledger rows")
+
+	// A month bucket over the same rows must total identically — regrouping
+	// changes the partition, never the sum.
+	monthly := AggregateUsageByGranularity(rows, UsageGranularityMonth)
+	require.Len(t, monthly, 1)
+	assert.InDelta(t, wantTotal, monthly[0].ToAPIResponse().CostUsd, 1e-12,
+		"re-bucketing at a different granularity must preserve the total")
+}

management/internals/modules/agentnetwork/types/usage.go

@@ -25,8 +25,19 @@ type AgentNetworkUsage struct {
 	InputTokens        int64
 	OutputTokens       int64
 	TotalTokens        int64
-	CostUSD            float64
-	CreatedAt          time.Time
+	// Prompt-cache buckets: read + write token counts.
+	CachedInputTokens   int64
+	CacheCreationTokens int64
+	// Per-bucket cost breakdown, mirroring AgentNetworkAccessLog — the only
+	// cost state stored; total and cache portion are derived on read. Kept on
+	// the usage ledger too so spend can be attributed per bucket even for
+	// accounts with log collection turned off. See AgentNetworkAccessLog for
+	// why the columns carry a zero default.
+	InputCostUSD         float64 `gorm:"not null;default:0"`
+	CachedInputCostUSD   float64 `gorm:"not null;default:0"`
+	CacheCreationCostUSD float64 `gorm:"not null;default:0"`
+	OutputCostUSD        float64 `gorm:"not null;default:0"`
+	CreatedAt            time.Time
 }
 
 // TableName keeps usage records in their own stripped table. Named
@@ -34,6 +45,17 @@ type AgentNetworkUsage struct {
 // agent_network_usage table in a shared database.
 func (AgentNetworkUsage) TableName() string { return "agent_network_request_usage" }
 
+// TotalCostUSD is the request's total cost: the sum of the four per-bucket
+// costs. Derived rather than stored so it cannot disagree with the breakdown.
+func (u *AgentNetworkUsage) TotalCostUSD() float64 {
+	return u.InputCostUSD + u.CachedInputCostUSD + u.CacheCreationCostUSD + u.OutputCostUSD
+}
+
+// CacheCostUSD is the portion of the total billed for prompt-cache buckets.
+func (u *AgentNetworkUsage) CacheCostUSD() float64 {
+	return u.CachedInputCostUSD + u.CacheCreationCostUSD
+}
+
 // AgentNetworkUsageGroup is the normalised many-to-many row linking a usage
 // record to one authorising group, mirroring AgentNetworkAccessLogGroup so the
 // usage overview can filter by group with a `group_id IN (...)` join.

management/internals/modules/agentnetwork/types/usageoverview.go

@@ -33,21 +33,45 @@ func ParseUsageGranularity(s string) UsageGranularity {
 // AgentNetworkUsageBucket is one aggregated usage time bucket. PeriodStart is
 // the UTC start of the bucket as YYYY-MM-DD.
 type AgentNetworkUsageBucket struct {
-	PeriodStart  string
-	InputTokens  int64
-	OutputTokens int64
-	TotalTokens  int64
-	CostUSD      float64
+	PeriodStart          string
+	InputTokens          int64
+	OutputTokens         int64
+	TotalTokens          int64
+	CachedInputTokens    int64
+	CacheCreationTokens  int64
+	InputCostUSD         float64
+	CachedInputCostUSD   float64
+	CacheCreationCostUSD float64
+	OutputCostUSD        float64
+}
+
+// TotalCostUSD is the bucket's total spend: the sum of the four per-bucket
+// costs. Derived rather than accumulated separately so it cannot disagree with
+// the components.
+func (b *AgentNetworkUsageBucket) TotalCostUSD() float64 {
+	return b.InputCostUSD + b.CachedInputCostUSD + b.CacheCreationCostUSD + b.OutputCostUSD
+}
+
+// CacheCostUSD is the bucket's prompt-cache spend: cache reads plus writes.
+func (b *AgentNetworkUsageBucket) CacheCostUSD() float64 {
+	return b.CachedInputCostUSD + b.CacheCreationCostUSD
 }
 
 // ToAPIResponse renders the bucket as the API representation.
 func (b *AgentNetworkUsageBucket) ToAPIResponse() api.AgentNetworkUsageBucket {
 	return api.AgentNetworkUsageBucket{
-		PeriodStart:  b.PeriodStart,
-		InputTokens:  b.InputTokens,
-		OutputTokens: b.OutputTokens,
-		TotalTokens:  b.TotalTokens,
-		CostUsd:      b.CostUSD,
+		PeriodStart:          b.PeriodStart,
+		InputTokens:          b.InputTokens,
+		OutputTokens:         b.OutputTokens,
+		TotalTokens:          b.TotalTokens,
+		CachedInputTokens:    b.CachedInputTokens,
+		CacheCreationTokens:  b.CacheCreationTokens,
+		InputCostUsd:         b.InputCostUSD,
+		CachedInputCostUsd:   b.CachedInputCostUSD,
+		CacheCreationCostUsd: b.CacheCreationCostUSD,
+		OutputCostUsd:        b.OutputCostUSD,
+		CostUsd:              b.TotalCostUSD(),
+		CacheCostUsd:         b.CacheCostUSD(),
 	}
 }
 
@@ -84,7 +108,12 @@ func AggregateUsageByGranularity(rows []*AgentNetworkUsage, g UsageGranularity)
 		b.InputTokens += r.InputTokens
 		b.OutputTokens += r.OutputTokens
 		b.TotalTokens += r.TotalTokens
-		b.CostUSD += r.CostUSD
+		b.CachedInputTokens += r.CachedInputTokens
+		b.CacheCreationTokens += r.CacheCreationTokens
+		b.InputCostUSD += r.InputCostUSD
+		b.CachedInputCostUSD += r.CachedInputCostUSD
+		b.CacheCreationCostUSD += r.CacheCreationCostUSD
+		b.OutputCostUSD += r.OutputCostUSD
 	}
 
 	out := make([]*AgentNetworkUsageBucket, 0, len(byPeriod))

management/internals/shared/grpc/components_encoder.go

@@ -4,9 +4,10 @@ import (
 	"encoding/base64"
 	"strconv"
 
+	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/server/types"
+	nbroute "github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/networkmap"
-	nmdata "github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
@@ -81,7 +82,6 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 	enc := newComponentEncoder(c)
 	enc.indexAllPeers()
 	routerIdxs := enc.indexRouterPeers(c.RouterPeers)
-	enc.indexAllNetworkResources()
 
 	// Phase 2: gather every policy that any consumer references (peer-pair
 	// policies + resource-only policies) so encodeResourcePoliciesMap can
@@ -103,6 +103,7 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 		DnsSettings:         enc.encodeDNSSettings(c.DNSSettings),
 		DnsDomain:           in.DNSDomain,
 		CustomZoneDomain:    c.CustomZoneDomain,
+		AgentVersions:       enc.agentVersions,
 		Peers:               enc.peers,
 		RouterPeerIndexes:   routerIdxs,
 		Policies:            policies,
@@ -127,7 +128,7 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 // networkSerial returns c.Network.CurrentSerial() with a nil guard. The
 // production path always populates c.Network, but the encoder is exported
 // and a hand-built components struct may omit it.
-func networkSerial(n *nmdata.Network) uint64 {
+func networkSerial(n *types.Network) uint64 {
 	if n == nil {
 		return 0
 	}
@@ -140,15 +141,16 @@ type componentEncoder struct {
 	peerOrder map[string]uint32
 	peers     []*proto.PeerCompact
 
-	networkIdToPublicId map[string]string
+	agentVersionOrder map[string]uint32
+	agentVersions     []string
 }
 
 func newComponentEncoder(c *types.NetworkMapComponents) *componentEncoder {
 	return &componentEncoder{
-		components:          c,
-		peerOrder:           make(map[string]uint32, len(c.Peers)),
-		peers:               make([]*proto.PeerCompact, 0, len(c.Peers)),
-		networkIdToPublicId: make(map[string]string),
+		components:        c,
+		peerOrder:         make(map[string]uint32, len(c.Peers)),
+		peers:             make([]*proto.PeerCompact, 0, len(c.Peers)),
+		agentVersionOrder: make(map[string]uint32),
 	}
 }
 
@@ -161,7 +163,7 @@ func (e *componentEncoder) indexAllPeers() {
 	}
 }
 
-func (e *componentEncoder) appendPeer(p *nmdata.Peer) uint32 {
+func (e *componentEncoder) appendPeer(p *types.ComponentPeer) uint32 {
 	if idx, ok := e.peerOrder[p.ID]; ok {
 		return idx
 	}
@@ -175,7 +177,7 @@ func (e *componentEncoder) appendPeer(p *nmdata.Peer) uint32 {
 // (c.RouterPeers may contain peers not in c.Peers when validation rules drop
 // them) and returns their wire indexes for the RouterPeerIndexes field. Must
 // run before any encoder that resolves peer ids via e.peerOrder.
-func (e *componentEncoder) indexRouterPeers(routers map[string]*nmdata.Peer) []uint32 {
+func (e *componentEncoder) indexRouterPeers(routers map[string]*types.ComponentPeer) []uint32 {
 	if len(routers) == 0 {
 		return nil
 	}
@@ -189,15 +191,6 @@ func (e *componentEncoder) indexRouterPeers(routers map[string]*nmdata.Peer) []u
 	return out
 }
 
-func (e *componentEncoder) indexAllNetworkResources() {
-	for _, r := range e.components.NetworkResources {
-		if !r.Enabled {
-			continue
-		}
-		e.networkIdToPublicId[r.ID] = r.PublicID
-	}
-}
-
 func (e *componentEncoder) encodeGroups() []*proto.GroupCompact {
 	if len(e.components.Groups) == 0 {
 		return nil
@@ -211,20 +204,10 @@ func (e *componentEncoder) encodeGroups() []*proto.GroupCompact {
 				peerIdxs = append(peerIdxs, idx)
 			}
 		}
-
-		groupCompactResources := func() []*proto.ResourceCompact {
-			var toret []*proto.ResourceCompact
-			for _, r := range g.Resources {
-				toret = append(toret, e.resourceToProto(r))
-			}
-			return toret
-		}
-
 		out = append(out, &proto.GroupCompact{
 			Id:          g.PublicID,
 			PeerIndexes: peerIdxs,
 			IsAll:       g.IsGroupAll(),
-			Resources:   groupCompactResources(),
 		})
 	}
 	return out
@@ -234,7 +217,7 @@ func (e *componentEncoder) encodeGroups() []*proto.GroupCompact {
 // list and a map from policy pointer to the indexes of its emitted rules in
 // that list — used by encodeResourcePoliciesMap to translate
 // ResourcePoliciesMap[resourceID][]*Policy into wire-side indexes.
-func (e *componentEncoder) encodePolicies(policies []*nmdata.Policy) []*proto.PolicyCompact {
+func (e *componentEncoder) encodePolicies(policies []*types.Policy) []*proto.PolicyCompact {
 	if len(policies) == 0 {
 		return nil
 	}
@@ -256,7 +239,7 @@ func (e *componentEncoder) encodePolicies(policies []*nmdata.Policy) []*proto.Po
 }
 
 // encodePolicyRule maps a single PolicyRule under pol to a PolicyCompact entry.
-func (e *componentEncoder) encodePolicyRule(pol *nmdata.Policy, r *nmdata.PolicyRule) *proto.PolicyCompact {
+func (e *componentEncoder) encodePolicyRule(pol *types.Policy, r *types.PolicyRule) *proto.PolicyCompact {
 	return &proto.PolicyCompact{
 		Id:                    pol.PublicID,
 		Action:                networkmap.GetProtoAction(string(r.Action)),
@@ -295,14 +278,14 @@ func (e *componentEncoder) groupPublicXids(src []string) []string {
 // only live in ResourcePoliciesMap; without this union step they'd be lost
 // from the wire and the client's resource-policy lookup would come back
 // empty.
-func unionPolicies(policies []*nmdata.Policy, resourcePolicies map[string][]*nmdata.Policy) []*nmdata.Policy {
+func unionPolicies(policies []*types.Policy, resourcePolicies map[string][]*types.Policy) []*types.Policy {
 	// Fast path: non-router peers have no resource-only policies, so the
 	// "union" is identical to `policies`. Skip the dedup map allocation.
 	if len(resourcePolicies) == 0 {
 		return policies
 	}
 	seen := make(map[string]struct{}, len(policies))
-	out := make([]*nmdata.Policy, 0, len(policies))
+	out := make([]*types.Policy, 0, len(policies))
 	for _, p := range policies {
 		if p == nil {
 			continue
@@ -360,31 +343,18 @@ func (e *componentEncoder) groupPublicXid(groupID string) (string, bool) {
 // peers array. For other resource types only the type string is shipped
 // today (Calculate's resource-typed rule path consults SourceResource only
 // for "peer" — other types fall through to group-based lookup).
-func (e *componentEncoder) resourceToProto(r nmdata.Resource) *proto.ResourceCompact {
-	t, ok := proto.ResourceCompactType_value[string(r.Type)]
-	if !ok || t == 0 || r.ID == "" {
+func (e *componentEncoder) resourceToProto(r types.Resource) *proto.ResourceCompact {
+	if r.ID == "" && r.Type == "" {
 		return nil
 	}
-	if t == int32(proto.ResourceCompactType_peer) {
-		idx, ok := e.peerOrder[r.ID]
-		if !ok {
-			return nil
-		}
-		return &proto.ResourceCompact{
-			Type:       proto.ResourceCompactType_peer,
-			ResourceId: &proto.ResourceCompact_PeerIndex{PeerIndex: idx},
+	out := &proto.ResourceCompact{Type: string(r.Type)}
+	if r.Type == types.ResourceTypePeer && r.ID != "" {
+		if idx, ok := e.peerOrder[r.ID]; ok {
+			out.PeerIndexSet = true
+			out.PeerIndex = idx
 		}
 	}
-
-	publicID, ok := e.networkIdToPublicId[r.ID]
-	if !ok {
-		return nil
-	}
-
-	return &proto.ResourceCompact{
-		Type:       proto.ResourceCompactType(t),
-		ResourceId: &proto.ResourceCompact_Id{Id: publicID},
-	}
+	return out
 }
 
 // postureCheckSeqs translates a slice of posture-check xids to their
@@ -417,7 +387,7 @@ func (e *componentEncoder) networkPublicId(xid string) (string, bool) {
 	return id, true
 }
 
-func (e *componentEncoder) encodeDNSSettings(s *nmdata.DNSSettings) *proto.DNSSettingsCompact {
+func (e *componentEncoder) encodeDNSSettings(s *types.DNSSettings) *proto.DNSSettingsCompact {
 	if s == nil || len(s.DisabledManagementGroups) == 0 {
 		return nil
 	}
@@ -432,7 +402,7 @@ func (e *componentEncoder) encodeDNSSettings(s *nmdata.DNSSettings) *proto.DNSSe
 	return out
 }
 
-func (e *componentEncoder) encodeRoutes(routes []*nmdata.Route) []*proto.RouteRaw {
+func (e *componentEncoder) encodeRoutes(routes []*nbroute.Route) []*proto.RouteRaw {
 	if len(routes) == 0 {
 		return nil
 	}
@@ -470,7 +440,7 @@ func (e *componentEncoder) encodeRoutes(routes []*nmdata.Route) []*proto.RouteRa
 	return out
 }
 
-func (e *componentEncoder) encodeNameServerGroups(nsgs []*nmdata.NameServerGroup) []*proto.NameServerGroupRaw {
+func (e *componentEncoder) encodeNameServerGroups(nsgs []*nbdns.NameServerGroup) []*proto.NameServerGroupRaw {
 	if len(nsgs) == 0 {
 		return nil
 	}
@@ -493,7 +463,7 @@ func (e *componentEncoder) encodeNameServerGroups(nsgs []*nmdata.NameServerGroup
 	return out
 }
 
-func encodeNameServers(servers []nmdata.NameServer) []*proto.NameServer {
+func encodeNameServers(servers []nbdns.NameServer) []*proto.NameServer {
 	if len(servers) == 0 {
 		return nil
 	}
@@ -508,7 +478,7 @@ func encodeNameServers(servers []nmdata.NameServer) []*proto.NameServer {
 	return out
 }
 
-func encodeSimpleRecords(records []nmdata.SimpleRecord) []*proto.SimpleRecord {
+func encodeSimpleRecords(records []nbdns.SimpleRecord) []*proto.SimpleRecord {
 	if len(records) == 0 {
 		return nil
 	}
@@ -525,7 +495,7 @@ func encodeSimpleRecords(records []nmdata.SimpleRecord) []*proto.SimpleRecord {
 	return out
 }
 
-func encodeCustomZones(zones []nmdata.CustomZone) []*proto.CustomZone {
+func encodeCustomZones(zones []nbdns.CustomZone) []*proto.CustomZone {
 	if len(zones) == 0 {
 		return nil
 	}
@@ -541,7 +511,7 @@ func encodeCustomZones(zones []nmdata.CustomZone) []*proto.CustomZone {
 	return out
 }
 
-func (e *componentEncoder) encodeNetworkResources(resources []*nmdata.NetworkResource) []*proto.NetworkResourceRaw {
+func (e *componentEncoder) encodeNetworkResources(resources []*types.ComponentResource) []*proto.NetworkResourceRaw {
 	if len(resources) == 0 {
 		return nil
 	}
@@ -570,7 +540,7 @@ func (e *componentEncoder) encodeNetworkResources(resources []*nmdata.NetworkRes
 	return out
 }
 
-func (e *componentEncoder) encodeRoutersMap(routersMap map[string]map[string]*nmdata.NetworkRouter) map[string]*proto.NetworkRouterList {
+func (e *componentEncoder) encodeRoutersMap(routersMap map[string]map[string]*types.ComponentRouter) map[string]*proto.NetworkRouterList {
 	if len(routersMap) == 0 {
 		return nil
 	}
@@ -606,7 +576,7 @@ func (e *componentEncoder) encodeRoutersMap(routersMap map[string]map[string]*nm
 	return out
 }
 
-func (e *componentEncoder) encodeResourcePoliciesMap(rpm map[string][]*nmdata.Policy) map[string]*proto.PolicyIds {
+func (e *componentEncoder) encodeResourcePoliciesMap(rpm map[string][]*types.Policy) map[string]*proto.PolicyIds {
 	if len(rpm) == 0 {
 		return nil
 	}
@@ -693,7 +663,7 @@ func (e *componentEncoder) encodePostureFailedPeers(m map[string]map[string]stru
 // (which shouldn't happen in production but the encoder is exported)
 // degrades to login_expiration_enabled = false, which makes
 // LoginExpired() return false for every peer.
-func toAccountSettingsCompact(s *nmdata.AccountSettingsInfo) *proto.AccountSettingsCompact {
+func toAccountSettingsCompact(s *types.AccountSettingsInfo) *proto.AccountSettingsCompact {
 	if s == nil {
 		return &proto.AccountSettingsCompact{}
 	}
@@ -703,7 +673,7 @@ func toAccountSettingsCompact(s *nmdata.AccountSettingsInfo) *proto.AccountSetti
 	}
 }
 
-func toAccountNetwork(n *nmdata.Network) *proto.AccountNetwork {
+func toAccountNetwork(n *types.Network) *proto.AccountNetwork {
 	if n == nil {
 		return nil
 	}
@@ -719,20 +689,20 @@ func toAccountNetwork(n *nmdata.Network) *proto.AccountNetwork {
 	return out
 }
 
-func toPeerCompact(p *nmdata.Peer) *proto.PeerCompact {
+func toPeerCompact(p *types.ComponentPeer) *proto.PeerCompact {
 	pc := &proto.PeerCompact{
 		WgPubKey:               decodeWgKey(p.Key),
 		SshPubKey:              []byte(p.SSHKey),
 		DnsLabel:               p.DNSLabel,
-		AgentVersion:           p.Meta.WtVersion,
-		AddedWithSsoLogin:      p.UserID != "",
+		AgentVersion:           p.AgentVersion,
+		AddedWithSsoLogin:      p.AddedWithSSOLogin,
 		LoginExpirationEnabled: p.LoginExpirationEnabled,
 		SshEnabled:             p.SSHEnabled,
-		SupportsIpv6:           p.SupportsIPv6(),
-		SupportsSourcePrefixes: p.SupportsSourcePrefixes(),
-		ServerSshAllowed:       p.Meta.Flags.ServerSSHAllowed,
+		SupportsIpv6:           p.SupportsIPv6,
+		SupportsSourcePrefixes: p.SupportsSourcePrefixes,
+		ServerSshAllowed:       p.ServerSSHAllowed,
 	}
-	if p.LastLogin != nil {
+	if !p.LastLogin.IsZero() {
 		pc.LastLoginUnixNano = p.LastLogin.UnixNano()
 	}
 	switch {
@@ -781,7 +751,7 @@ func portsToUint32(ports []string) []uint32 {
 	return out
 }
 
-func portRangesToProto(ranges []nmdata.RulePortRange) []*proto.PortInfo_Range {
+func portRangesToProto(ranges []types.RulePortRange) []*proto.PortInfo_Range {
 	if len(ranges) == 0 {
 		return nil
 	}

management/internals/shared/grpc/components_encoder_test.go

@@ -16,7 +16,7 @@ import (
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	nbroute "github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
@@ -152,66 +152,66 @@ func envelopesEquivalent(a, b *proto.NetworkMapEnvelope) bool {
 }
 
 func newTestComponents() *types.NetworkMapComponents {
-	peerA := &nmdata.Peer{
-		ID:       "peer-a",
-		Key:      testWgKeyA,
-		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 1}),
-		DNSLabel: "peera",
-		SSHKey:   "ssh-a",
-		Meta:     nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+	peerA := &types.ComponentPeer{
+		ID:           "peer-a",
+		Key:          testWgKeyA,
+		IP:           netip.AddrFrom4([4]byte{100, 64, 0, 1}),
+		DNSLabel:     "peera",
+		SSHKey:       "ssh-a",
+		AgentVersion: "0.40.0",
 	}
-	peerB := &nmdata.Peer{
-		ID:       "peer-b",
-		Key:      testWgKeyB,
-		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 2}),
-		IPv6:     netip.AddrFrom16([16]byte{0xfd, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2}),
-		DNSLabel: "peerb",
-		Meta:     nmdata.PeerSystemMeta{WtVersion: "0.25.0"},
+	peerB := &types.ComponentPeer{
+		ID:           "peer-b",
+		Key:          testWgKeyB,
+		IP:           netip.AddrFrom4([4]byte{100, 64, 0, 2}),
+		IPv6:         netip.AddrFrom16([16]byte{0xfd, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2}),
+		DNSLabel:     "peerb",
+		AgentVersion: "0.25.0",
 	}
-	peerC := &nmdata.Peer{
-		ID:       "peer-c",
-		Key:      testWgKeyC,
-		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 3}),
-		DNSLabel: "peerc",
-		Meta:     nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+	peerC := &types.ComponentPeer{
+		ID:           "peer-c",
+		Key:          testWgKeyC,
+		IP:           netip.AddrFrom4([4]byte{100, 64, 0, 3}),
+		DNSLabel:     "peerc",
+		AgentVersion: "0.40.0",
 	}
 
 	return &types.NetworkMapComponents{
 		PeerID: "peer-a",
-		Network: &nmdata.Network{
+		Network: &types.Network{
 			Identifier: "net-test",
 			Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
 			Serial:     7,
 		},
-		AccountSettings: &nmdata.AccountSettingsInfo{
+		AccountSettings: &types.AccountSettingsInfo{
 			PeerLoginExpirationEnabled: true,
 			PeerLoginExpiration:        2 * time.Hour,
 		},
-		Peers: map[string]*nmdata.Peer{
+		Peers: map[string]*types.ComponentPeer{
 			"peer-a": peerA,
 			"peer-b": peerB,
 			"peer-c": peerC,
 		},
-		Groups: map[string]*nmdata.Group{
-			"group-src": {PublicID: "1", Name: "Src", Peers: []string{"peer-a"}},
-			"group-dst": {PublicID: "2", Name: "Dst", Peers: []string{"peer-b", "peer-c"}},
+		Groups: map[string]*types.ComponentGroup{
+			"group-src": {ID: "group-src", PublicID: "1", Name: "Src", Peers: []string{"peer-a"}},
+			"group-dst": {ID: "group-dst", PublicID: "2", Name: "Dst", Peers: []string{"peer-b", "peer-c"}},
 		},
-		Policies: []*nmdata.Policy{
+		Policies: []*types.Policy{
 			{
 				ID:       "pol-1",
 				PublicID: "10",
 				Enabled:  true,
-				Rules: []*nmdata.PolicyRule{{
-					ID: "rule-1", Enabled: true, Action: string(types.PolicyTrafficActionAccept),
-					Protocol: string(types.PolicyRuleProtocolTCP), Bidirectional: true,
+				Rules: []*types.PolicyRule{{
+					ID: "rule-1", Enabled: true, Action: types.PolicyTrafficActionAccept,
+					Protocol: types.PolicyRuleProtocolTCP, Bidirectional: true,
 					Ports:        []string{"22", "80"},
-					PortRanges:   []nmdata.RulePortRange{{Start: 8000, End: 8100}},
+					PortRanges:   []types.RulePortRange{{Start: 8000, End: 8100}},
 					Sources:      []string{"group-src"},
 					Destinations: []string{"group-dst"},
 				}},
 			},
 		},
-		RouterPeers: map[string]*nmdata.Peer{"peer-c": peerC},
+		RouterPeers: map[string]*types.ComponentPeer{"peer-c": peerC},
 	}
 }
 
@@ -304,31 +304,6 @@ func TestEncodeNetworkMapEnvelope_GroupsByAccountPublicId(t *testing.T) {
 	assert.Len(t, groupByID["2"].PeerIndexes, 2)
 }
 
-func TestEncodePolicy(t *testing.T) {
-	encoder := componentEncoder{peerOrder: map[string]uint32{"peerId": uint32(1234)}, networkIdToPublicId: map[string]string{"domain": "publicDomain", "host": "publicHost", "subnet": "publicSubnet"}}
-	assert.Equal(t,
-		encoder.resourceToProto(nmdata.Resource{Type: "peer", ID: "peerId"}),
-		&proto.ResourceCompact{Type: proto.ResourceCompactType_peer, ResourceId: &proto.ResourceCompact_PeerIndex{PeerIndex: uint32(1234)}})
-	// verify invalid peer id results in nil
-	assert.Nil(t,
-		encoder.resourceToProto(nmdata.Resource{Type: "peer", ID: "boom"}))
-	assert.Equal(t,
-		encoder.resourceToProto(nmdata.Resource{Type: "domain", ID: "domain"}),
-		&proto.ResourceCompact{Type: proto.ResourceCompactType_domain, ResourceId: &proto.ResourceCompact_Id{Id: "publicDomain"}})
-	assert.Equal(t,
-		encoder.resourceToProto(nmdata.Resource{Type: "host", ID: "host"}),
-		&proto.ResourceCompact{Type: proto.ResourceCompactType_host, ResourceId: &proto.ResourceCompact_Id{Id: "publicHost"}})
-	assert.Equal(t,
-		encoder.resourceToProto(nmdata.Resource{Type: "subnet", ID: "subnet"}),
-		&proto.ResourceCompact{Type: proto.ResourceCompactType_subnet, ResourceId: &proto.ResourceCompact_Id{Id: "publicSubnet"}})
-	// verify invalid resource type results in nil
-	assert.Nil(t,
-		encoder.resourceToProto(nmdata.Resource{Type: "boom", ID: "boom"}))
-	// verify invalid networkresource id results in nil
-	assert.Nil(t,
-		encoder.resourceToProto(nmdata.Resource{Type: "host", ID: "boom"}))
-}
-
 func TestEncodeNetworkMapEnvelope_PolicyExpansion(t *testing.T) {
 	c := newTestComponents()
 
@@ -402,12 +377,12 @@ func TestEncodeNetworkMapEnvelope_MalformedWgKey(t *testing.T) {
 
 func TestEncodeNetworkMapEnvelope_IPv6OnlyPeer(t *testing.T) {
 	c := newTestComponents()
-	v6Only := &nmdata.Peer{
-		ID:       "peer-v6",
-		Key:      testWgKeyA,
-		IPv6:     netip.AddrFrom16([16]byte{0xfd, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 9}),
-		DNSLabel: "peerv6",
-		Meta:     nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+	v6Only := &types.ComponentPeer{
+		ID:           "peer-v6",
+		Key:          testWgKeyA,
+		IPv6:         netip.AddrFrom16([16]byte{0xfd, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 9}),
+		DNSLabel:     "peerv6",
+		AgentVersion: "0.40.0",
 	}
 	c.Peers["peer-v6"] = v6Only
 
@@ -426,11 +401,11 @@ func TestEncodeNetworkMapEnvelope_IPv6OnlyPeer(t *testing.T) {
 
 func TestEncodeNetworkMapEnvelope_PeerWithoutIP(t *testing.T) {
 	c := newTestComponents()
-	c.Peers["peer-noip"] = &nmdata.Peer{
-		ID:       "peer-noip",
-		Key:      testWgKeyA,
-		DNSLabel: "peernoip",
-		Meta:     nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+	c.Peers["peer-noip"] = &types.ComponentPeer{
+		ID:           "peer-noip",
+		Key:          testWgKeyA,
+		DNSLabel:     "peernoip",
+		AgentVersion: "0.40.0",
 	}
 
 	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
@@ -448,7 +423,7 @@ func TestEncodeNetworkMapEnvelope_PeerWithoutIP(t *testing.T) {
 
 func TestEncodeNetworkMapEnvelope_EmptyInput(t *testing.T) {
 	c := &types.NetworkMapComponents{
-		Network: &nmdata.Network{Identifier: "x", Net: net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)}},
+		Network: &types.Network{Identifier: "x", Net: net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)}},
 	}
 
 	env := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c})
@@ -465,9 +440,9 @@ func TestEncodeNetworkMapEnvelope_EmptyInput(t *testing.T) {
 func TestEncodeNetworkMapEnvelope_PeerLoginExpirationFields(t *testing.T) {
 	c := newTestComponents()
 	now := time.Date(2024, 1, 2, 3, 4, 5, 0, time.UTC)
-	c.Peers["peer-a"].UserID = "user-1"
+	c.Peers["peer-a"].AddedWithSSOLogin = true
 	c.Peers["peer-a"].LoginExpirationEnabled = true
-	c.Peers["peer-a"].LastLogin = &now
+	c.Peers["peer-a"].LastLogin = now
 
 	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
 
@@ -497,7 +472,7 @@ func TestEncodeNetworkMapEnvelope_PeerLoginExpirationFields(t *testing.T) {
 
 func TestEncodeNetworkMapEnvelope_RoutesRoundTrip(t *testing.T) {
 	c := newTestComponents()
-	c.Routes = []*nmdata.Route{
+	c.Routes = []*nbroute.Route{
 		{
 			ID:                  "route-peer",
 			PublicID:            "100",
@@ -544,7 +519,7 @@ func TestEncodeNetworkMapEnvelope_RoutesRoundTrip(t *testing.T) {
 
 func TestEncodeNetworkMapEnvelope_RouteWithMissingPeerLeavesIndexUnset(t *testing.T) {
 	c := newTestComponents()
-	c.Routes = []*nmdata.Route{{
+	c.Routes = []*nbroute.Route{{
 		ID:       "route-x",
 		PublicID: "100",
 		Peer:     "peer-not-in-components",
@@ -564,21 +539,21 @@ func TestEncodeNetworkMapEnvelope_ResourceOnlyPolicyShippedAndIndexed(t *testing
 	// Policy that exists ONLY in ResourcePoliciesMap, not in c.Policies. This
 	// is the I1 case — without unionPolicies the encoder would silently
 	// drop it from the wire.
-	resourceOnlyPolicy := &nmdata.Policy{
+	resourceOnlyPolicy := &types.Policy{
 		ID: "pol-resource", PublicID: "99", Enabled: true,
-		Rules: []*nmdata.PolicyRule{{
-			ID: "rule-r", Enabled: true, Action: string(types.PolicyTrafficActionAccept),
-			Protocol:     string(types.PolicyRuleProtocolTCP),
+		Rules: []*types.PolicyRule{{
+			ID: "rule-r", Enabled: true, Action: types.PolicyTrafficActionAccept,
+			Protocol:     types.PolicyRuleProtocolTCP,
 			Sources:      []string{"group-src"},
 			Destinations: []string{"group-dst"},
 		}},
 	}
-	c.ResourcePoliciesMap = map[string][]*nmdata.Policy{
+	c.ResourcePoliciesMap = map[string][]*types.Policy{
 		"resource-x": {c.Policies[0], resourceOnlyPolicy}, // shared + resource-only
 	}
 	// Resource must appear in components.NetworkResources with a seq id —
 	// encoder uses that to translate the xid map key to uint32.
-	c.NetworkResources = []*nmdata.NetworkResource{
+	c.NetworkResources = []*types.ComponentResource{
 		{ID: "resource-x", PublicID: "77", Name: "res-x", Enabled: true},
 	}
 
@@ -587,16 +562,27 @@ func TestEncodeNetworkMapEnvelope_ResourceOnlyPolicyShippedAndIndexed(t *testing
 	require.Len(t, full.Policies, 2, "encoded policies must include both peer-traffic and resource-only")
 
 	policyByID := map[string]*proto.PolicyCompact{}
+	policyIds := make([]string, 0)
+	for _, p := range full.Policies {
+		policyByID[p.Id] = p
+		policyIds = append(policyIds, p.Id)
+	}
 	require.Contains(t, policyByID, "10", "original peer-traffic policy id 10")
 	require.Contains(t, policyByID, "99", "resource-only policy id 99")
+
+	require.Contains(t, full.ResourcePoliciesMap, "77")
+	ids := full.ResourcePoliciesMap["77"].Ids
+	require.Len(t, ids, 2)
+	assert.ElementsMatch(t, policyIds, ids,
+		"resource policies map must reference both wire policy indexes")
 }
 
 func TestEncodeNetworkMapEnvelope_NameServerGroups(t *testing.T) {
 	c := newTestComponents()
-	c.NameServerGroups = []*nmdata.NameServerGroup{{
+	c.NameServerGroups = []*nbdns.NameServerGroup{{
 		ID: "nsg-1", PublicID: "50", Name: "Main", Description: "primary",
-		NameServers: []nmdata.NameServer{{
-			IP: netip.MustParseAddr("8.8.8.8"), NSType: int(nbdns.UDPNameServerType), Port: 53,
+		NameServers: []nbdns.NameServer{{
+			IP: netip.MustParseAddr("8.8.8.8"), NSType: nbdns.UDPNameServerType, Port: 53,
 		}},
 		Groups:  []string{"group-src", "group-not-persisted"},
 		Primary: true, Enabled: true,
@@ -635,11 +621,11 @@ func TestEncodeNetworkMapEnvelope_PostureFailedPeers(t *testing.T) {
 func TestEncodeNetworkMapEnvelope_RoutersMap(t *testing.T) {
 	c := newTestComponents()
 	c.NetworkXIDToPublicID = map[string]string{"net-1": "5"}
-	c.RoutersMap = map[string]map[string]*nmdata.NetworkRouter{
+	c.RoutersMap = map[string]map[string]*types.ComponentRouter{
 		"net-1": {
 			"peer-c": {
-				PublicID:   "200",
-				Masquerade: true, Metric: 10, Enabled: true,
+				PublicID: "200",
+				Peer:     "peer-c", Masquerade: true, Metric: 10, Enabled: true,
 			},
 		},
 	}
@@ -665,14 +651,14 @@ func TestEncodeNetworkMapEnvelope_RouterPeerNotInComponentsPeers(t *testing.T) {
 	// peer_index reference must still resolve.
 	c := newTestComponents()
 	delete(c.Peers, "peer-c")
-	routerPeer := &nmdata.Peer{
+	routerPeer := &types.ComponentPeer{
 		ID: "peer-c", Key: testWgKeyC, IP: netip.AddrFrom4([4]byte{100, 64, 0, 3}),
-		DNSLabel: "peerc", Meta: nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+		DNSLabel: "peerc", AgentVersion: "0.40.0",
 	}
-	c.RouterPeers = map[string]*nmdata.Peer{"peer-c": routerPeer}
+	c.RouterPeers = map[string]*types.ComponentPeer{"peer-c": routerPeer}
 	c.NetworkXIDToPublicID = map[string]string{"net-1": "5"}
-	c.RoutersMap = map[string]map[string]*nmdata.NetworkRouter{
-		"net-1": {"peer-c": {PublicID: "1", Enabled: true}},
+	c.RoutersMap = map[string]map[string]*types.ComponentRouter{
+		"net-1": {"peer-c": {PublicID: "1", Peer: "peer-c", Enabled: true}},
 	}
 
 	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
@@ -705,9 +691,9 @@ func TestToProxyPatch_EmptyInputReturnsNil(t *testing.T) {
 
 func TestToProxyPatch_PopulatesAllFields(t *testing.T) {
 	nm := &types.NetworkMap{
-		Peers: []*nmdata.Peer{{
+		Peers: []*types.ComponentPeer{{
 			ID: "ext-peer", Key: testWgKeyA, IP: netip.AddrFrom4([4]byte{100, 64, 0, 9}),
-			DNSLabel: "extpeer", Meta: nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+			DNSLabel: "extpeer", AgentVersion: "0.40.0",
 		}},
 		FirewallRules: []*types.FirewallRule{{
 			PeerIP: "100.64.0.9", Action: "accept", Direction: 0, Protocol: "tcp",
@@ -776,7 +762,7 @@ func TestEncodeNetworkMapEnvelope_NilComponentsGracefulDegrade(t *testing.T) {
 
 func TestEncodeNetworkMapEnvelope_AccountSettingsAlwaysEmitted(t *testing.T) {
 	c := &types.NetworkMapComponents{
-		Network: &nmdata.Network{Identifier: "x", Net: net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)}},
+		Network: &types.Network{Identifier: "x", Net: net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)}},
 		// AccountSettings deliberately nil
 	}
 
@@ -790,6 +776,6 @@ func TestEncodeNetworkMapEnvelope_AccountSettingsAlwaysEmitted(t *testing.T) {
 func emptyNetworkMapComponents() *types.NetworkMapComponents {
 	return types.EmptyNetworkMapComponents(
 		&types.NetworkMapComponents{
-			PeerID: "peer-id", Peers: map[string]*nmdata.Peer{"peer-id": {}}},
+			PeerID: "peer-id", Peers: map[string]*types.ComponentPeer{"peer-id": {}}},
 	)
 }

management/internals/shared/grpc/components_envelope_response.go

@@ -12,7 +12,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/types"
 	sharedgrpc "github.com/netbirdio/netbird/shared/management/grpc"
 	"github.com/netbirdio/netbird/shared/management/networkmap"
-	nmdata "github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
@@ -171,25 +170,25 @@ func computeSSHEnabledForPeer(c *types.NetworkMapComponents, peer *nbpeer.Peer)
 // ruleEnablesSSHForPeer returns true when rule is active, targets peer, and
 // either explicitly authorises SSH or covers the legacy TCP/22 path while the
 // peer itself has SSH enabled locally.
-func ruleEnablesSSHForPeer(c *types.NetworkMapComponents, rule *nmdata.PolicyRule, peer *nbpeer.Peer) bool {
+func ruleEnablesSSHForPeer(c *types.NetworkMapComponents, rule *types.PolicyRule, peer *nbpeer.Peer) bool {
 	if rule == nil || !rule.Enabled {
 		return false
 	}
 	if !peerInDestinations(c, rule, peer.ID) {
 		return false
 	}
-	if rule.Protocol == string(types.PolicyRuleProtocolNetbirdSSH) {
+	if rule.Protocol == types.PolicyRuleProtocolNetbirdSSH {
 		return true
 	}
-	return peer.SSHEnabled && nmdata.PolicyRuleImpliesLegacySSH(rule)
+	return peer.SSHEnabled && types.PolicyRuleImpliesLegacySSH(rule)
 }
 
 // peerInDestinations reports whether peerID is in any of rule.Destinations'
 // groups (or matches DestinationResource if it's a peer-typed resource —
 // for non-peer types Calculate falls through to group lookup, so we mirror
 // that exactly to avoid silent divergence).
-func peerInDestinations(c *types.NetworkMapComponents, rule *nmdata.PolicyRule, peerID string) bool {
-	if rule.DestinationResource.Type == string(types.ResourceTypePeer) && rule.DestinationResource.ID != "" {
+func peerInDestinations(c *types.NetworkMapComponents, rule *types.PolicyRule, peerID string) bool {
+	if rule.DestinationResource.Type == types.ResourceTypePeer && rule.DestinationResource.ID != "" {
 		return rule.DestinationResource.ID == peerID
 	}
 	for _, groupID := range rule.Destinations {

management/internals/shared/grpc/components_envelope_response_test.go

@@ -7,7 +7,6 @@ import (
 
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 // TestComputeSSHEnabledForPeer covers both Calculate-mirroring branches:
@@ -18,15 +17,16 @@ func TestComputeSSHEnabledForPeer(t *testing.T) {
 	const targetPeerID = "target"
 	const targetGroupID = "g_dst"
 
-	mkComponents := func(rule *nmdata.PolicyRule, sshEnabled bool) (*types.NetworkMapComponents, *nbpeer.Peer) {
+	mkComponents := func(rule *types.PolicyRule, sshEnabled bool) (*types.NetworkMapComponents, *nbpeer.Peer) {
 		peer := &nbpeer.Peer{ID: targetPeerID, SSHEnabled: sshEnabled}
+		group := &types.ComponentGroup{ID: targetGroupID, Name: "dst", Peers: []string{targetPeerID}}
 		return &types.NetworkMapComponents{
-			Peers:  map[string]*nmdata.Peer{targetPeerID: types.TwinPeer(peer)},
-			Groups: map[string]*nmdata.Group{targetGroupID: {Name: "dst", Peers: []string{targetPeerID}}},
-			Policies: []*nmdata.Policy{{
+			Peers:  map[string]*types.ComponentPeer{targetPeerID: peer.ToComponent()},
+			Groups: map[string]*types.ComponentGroup{targetGroupID: group},
+			Policies: []*types.Policy{{
 				ID:      "p",
 				Enabled: true,
-				Rules:   []*nmdata.PolicyRule{rule},
+				Rules:   []*types.PolicyRule{rule},
 			}},
 		}, peer
 	}
@@ -34,14 +34,14 @@ func TestComputeSSHEnabledForPeer(t *testing.T) {
 	cases := []struct {
 		name        string
 		peerSSH     bool
-		rule        nmdata.PolicyRule
+		rule        types.PolicyRule
 		wantEnabled bool
 	}{
 		{
 			name:    "explicit-netbird-ssh-activates-regardless-of-peer-ssh",
 			peerSSH: false,
-			rule: nmdata.PolicyRule{
-				Enabled: true, Protocol: string(types.PolicyRuleProtocolNetbirdSSH),
+			rule: types.PolicyRule{
+				Enabled: true, Protocol: types.PolicyRuleProtocolNetbirdSSH,
 				Destinations: []string{targetGroupID},
 			},
 			wantEnabled: true,
@@ -49,8 +49,8 @@ func TestComputeSSHEnabledForPeer(t *testing.T) {
 		{
 			name:    "implicit-tcp-22-with-peer-ssh",
 			peerSSH: true,
-			rule: nmdata.PolicyRule{
-				Enabled: true, Protocol: string(types.PolicyRuleProtocolTCP), Ports: []string{"22"},
+			rule: types.PolicyRule{
+				Enabled: true, Protocol: types.PolicyRuleProtocolTCP, Ports: []string{"22"},
 				Destinations: []string{targetGroupID},
 			},
 			wantEnabled: true,
@@ -58,8 +58,8 @@ func TestComputeSSHEnabledForPeer(t *testing.T) {
 		{
 			name:    "implicit-tcp-22-without-peer-ssh-disabled",
 			peerSSH: false,
-			rule: nmdata.PolicyRule{
-				Enabled: true, Protocol: string(types.PolicyRuleProtocolTCP), Ports: []string{"22"},
+			rule: types.PolicyRule{
+				Enabled: true, Protocol: types.PolicyRuleProtocolTCP, Ports: []string{"22"},
 				Destinations: []string{targetGroupID},
 			},
 			wantEnabled: false,
@@ -67,8 +67,8 @@ func TestComputeSSHEnabledForPeer(t *testing.T) {
 		{
 			name:    "implicit-tcp-22022-with-peer-ssh",
 			peerSSH: true,
-			rule: nmdata.PolicyRule{
-				Enabled: true, Protocol: string(types.PolicyRuleProtocolTCP), Ports: []string{"22022"},
+			rule: types.PolicyRule{
+				Enabled: true, Protocol: types.PolicyRuleProtocolTCP, Ports: []string{"22022"},
 				Destinations: []string{targetGroupID},
 			},
 			wantEnabled: true,
@@ -76,8 +76,8 @@ func TestComputeSSHEnabledForPeer(t *testing.T) {
 		{
 			name:    "implicit-all-protocol-with-peer-ssh",
 			peerSSH: true,
-			rule: nmdata.PolicyRule{
-				Enabled: true, Protocol: string(types.PolicyRuleProtocolALL),
+			rule: types.PolicyRule{
+				Enabled: true, Protocol: types.PolicyRuleProtocolALL,
 				Destinations: []string{targetGroupID},
 			},
 			wantEnabled: true,
@@ -85,10 +85,10 @@ func TestComputeSSHEnabledForPeer(t *testing.T) {
 		{
 			name:    "implicit-port-range-covers-22",
 			peerSSH: true,
-			rule: nmdata.PolicyRule{
+			rule: types.PolicyRule{
 				Enabled:      true,
-				Protocol:     string(types.PolicyRuleProtocolTCP),
-				PortRanges:   []nmdata.RulePortRange{{Start: 20, End: 30}},
+				Protocol:     types.PolicyRuleProtocolTCP,
+				PortRanges:   []types.RulePortRange{{Start: 20, End: 30}},
 				Destinations: []string{targetGroupID},
 			},
 			wantEnabled: true,
@@ -96,8 +96,8 @@ func TestComputeSSHEnabledForPeer(t *testing.T) {
 		{
 			name:    "tcp-80-no-ssh",
 			peerSSH: true,
-			rule: nmdata.PolicyRule{
-				Enabled: true, Protocol: string(types.PolicyRuleProtocolTCP), Ports: []string{"80"},
+			rule: types.PolicyRule{
+				Enabled: true, Protocol: types.PolicyRuleProtocolTCP, Ports: []string{"80"},
 				Destinations: []string{targetGroupID},
 			},
 			wantEnabled: false,
@@ -105,8 +105,8 @@ func TestComputeSSHEnabledForPeer(t *testing.T) {
 		{
 			name:    "disabled-rule-skipped",
 			peerSSH: true,
-			rule: nmdata.PolicyRule{
-				Enabled: false, Protocol: string(types.PolicyRuleProtocolNetbirdSSH),
+			rule: types.PolicyRule{
+				Enabled: false, Protocol: types.PolicyRuleProtocolNetbirdSSH,
 				Destinations: []string{targetGroupID},
 			},
 			wantEnabled: false,
@@ -114,8 +114,8 @@ func TestComputeSSHEnabledForPeer(t *testing.T) {
 		{
 			name:    "peer-not-in-destinations",
 			peerSSH: true,
-			rule: nmdata.PolicyRule{
-				Enabled: true, Protocol: string(types.PolicyRuleProtocolNetbirdSSH),
+			rule: types.PolicyRule{
+				Enabled: true, Protocol: types.PolicyRuleProtocolNetbirdSSH,
 				Destinations: []string{"g_other"}, // target not in this group
 			},
 			wantEnabled: false,
@@ -123,21 +123,21 @@ func TestComputeSSHEnabledForPeer(t *testing.T) {
 		{
 			name:    "peer-typed-destination-resource-matches",
 			peerSSH: false,
-			rule: nmdata.PolicyRule{
+			rule: types.PolicyRule{
 				Enabled:             true,
-				Protocol:            string(types.PolicyRuleProtocolNetbirdSSH),
-				DestinationResource: nmdata.Resource{ID: targetPeerID, Type: string(types.ResourceTypePeer)},
+				Protocol:            types.PolicyRuleProtocolNetbirdSSH,
+				DestinationResource: types.Resource{ID: targetPeerID, Type: types.ResourceTypePeer},
 			},
 			wantEnabled: true,
 		},
 		{
 			name:    "non-peer-destination-resource-falls-through-to-groups",
 			peerSSH: false,
-			rule: nmdata.PolicyRule{
+			rule: types.PolicyRule{
 				Enabled:             true,
-				Protocol:            string(types.PolicyRuleProtocolNetbirdSSH),
-				DestinationResource: nmdata.Resource{ID: targetPeerID, Type: "host"}, // wrong type
-				Destinations:        []string{targetGroupID},                         // saved by group fallback
+				Protocol:            types.PolicyRuleProtocolNetbirdSSH,
+				DestinationResource: types.Resource{ID: targetPeerID, Type: "host"}, // wrong type
+				Destinations:        []string{targetGroupID},                        // saved by group fallback
 			},
 			wantEnabled: true,
 		},
@@ -158,14 +158,14 @@ func TestComputeSSHEnabledForPeer(t *testing.T) {
 func TestComputeSSHEnabledForPeer_TargetMissingFromComponents(t *testing.T) {
 	peer := &nbpeer.Peer{ID: "missing", SSHEnabled: true}
 	c := &types.NetworkMapComponents{
-		Peers: map[string]*nmdata.Peer{}, // target peer NOT present
-		Groups: map[string]*nmdata.Group{
-			"g": {Peers: []string{"missing"}},
+		Peers: map[string]*types.ComponentPeer{}, // target peer NOT present
+		Groups: map[string]*types.ComponentGroup{
+			"g": {ID: "g", Peers: []string{"missing"}},
 		},
-		Policies: []*nmdata.Policy{{
+		Policies: []*types.Policy{{
 			ID: "p", Enabled: true,
-			Rules: []*nmdata.PolicyRule{{
-				Enabled: true, Protocol: string(types.PolicyRuleProtocolNetbirdSSH),
+			Rules: []*types.PolicyRule{{
+				Enabled: true, Protocol: types.PolicyRuleProtocolNetbirdSSH,
 				Destinations: []string{"g"},
 			}},
 		}},

management/internals/shared/grpc/conversion.go

@@ -22,7 +22,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/shared/management/networkmap"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/netiputil"
 )
@@ -120,7 +119,7 @@ func toNetbirdConfig(config *nbconfig.Config, turnCredentials *Token, relayToken
 	return nbConfig
 }
 
-func toPeerConfig(peer *nbpeer.Peer, network *nmdata.Network, dnsName string, settings *types.Settings, httpConfig *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow, enableSSH bool) *proto.PeerConfig {
+func toPeerConfig(peer *nbpeer.Peer, network *types.Network, dnsName string, settings *types.Settings, httpConfig *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow, enableSSH bool) *proto.PeerConfig {
 	netmask, _ := network.Net.Mask.Size()
 	fqdn := peer.FQDN(dnsName)
 

management/internals/shared/grpc/server.go

@@ -921,7 +921,7 @@ func (s *Server) prepareLoginResponse(ctx context.Context, peer *nbpeer.Peer, ne
 	// if peer has reached this point then it has logged in
 	loginResp := &proto.LoginResponse{
 		NetbirdConfig: toNetbirdConfig(s.config, nil, relayToken, nil, settings),
-		PeerConfig:    toPeerConfig(peer, types.TwinNetwork(network), s.networkMapController.GetDNSDomain(settings), settings, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, enableSSH),
+		PeerConfig:    toPeerConfig(peer, network, s.networkMapController.GetDNSDomain(settings), settings, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, enableSSH),
 		Checks:        toProtocolChecks(ctx, postureChecks),
 	}
 

management/server/groups/manager.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
@@ -30,6 +31,10 @@ type managerImpl struct {
 	accountManager     account.Manager
 }
 
+func eventMetaResource(group *types.Group, resource *resourceTypes.NetworkResource) map[string]any {
+	return map[string]any{"name": group.Name, "id": group.ID, "resource_name": resource.Name, "resource_id": resource.ID, "resource_type": resource.Type}
+}
+
 type mockManager struct {
 }
 
@@ -109,7 +114,7 @@ func (m *managerImpl) AddResourceToGroupInTransaction(ctx context.Context, trans
 	}
 
 	event := func() {
-		m.accountManager.StoreEvent(ctx, userID, groupID, accountID, activity.ResourceAddedToGroup, group.EventMetaResource(networkResource))
+		m.accountManager.StoreEvent(ctx, userID, groupID, accountID, activity.ResourceAddedToGroup, eventMetaResource(group, networkResource))
 	}
 
 	return event, nil
@@ -133,7 +138,7 @@ func (m *managerImpl) RemoveResourceFromGroupInTransaction(ctx context.Context,
 	}
 
 	event := func() {
-		m.accountManager.StoreEvent(ctx, userID, groupID, accountID, activity.ResourceRemovedFromGroup, group.EventMetaResource(networkResource))
+		m.accountManager.StoreEvent(ctx, userID, groupID, accountID, activity.ResourceRemovedFromGroup, eventMetaResource(group, networkResource))
 	}
 
 	return event, nil

management/server/http/handlers/peers/peers_handler.go

@@ -446,7 +446,7 @@ func (h *Handler) GetAccessiblePeers(w http.ResponseWriter, r *http.Request) {
 
 	netMap := account.GetPeerNetworkMapFromComponents(ctx, peerID, dns.CustomZone{}, nil, validPeers, account.GetResourcePoliciesMap(), account.GetResourceRoutersMap(), nil, account.GetActiveGroupUsers())
 
-	util.WriteJSONObject(ctx, w, toAccessiblePeers(account.Peers, netMap, dnsDomain))
+	util.WriteJSONObject(ctx, w, toAccessiblePeers(netMap, account.Peers, dnsDomain))
 }
 
 func (h *Handler) CreateTemporaryAccess(w http.ResponseWriter, r *http.Request) {
@@ -534,22 +534,20 @@ func (h *Handler) CreateTemporaryAccess(w http.ResponseWriter, r *http.Request)
 	util.WriteJSONObject(r.Context(), w, resp)
 }
 
-// toAccessiblePeers resolves the twin peers in netMap back to the full account
-// peers (by ID) so the API response keeps Status/Name/OS/GeoNameID, which the
-// slim netmap twins intentionally don't carry.
-func toAccessiblePeers(accountPeers map[string]*nbpeer.Peer, netMap *types.NetworkMap, dnsDomain string) []api.AccessiblePeer {
+// toAccessiblePeers rehydrates the calculated map's component peers into the
+// account's full peer objects, which carry the location/status/meta fields
+// the API response needs.
+func toAccessiblePeers(netMap *types.NetworkMap, accountPeers map[string]*nbpeer.Peer, dnsDomain string) []api.AccessiblePeer {
 	accessiblePeers := make([]api.AccessiblePeer, 0, len(netMap.Peers)+len(netMap.OfflinePeers))
-	appendByID := func(id string) {
-		if p, ok := accountPeers[id]; ok && p != nil {
-			accessiblePeers = append(accessiblePeers, peerToAccessiblePeer(p, dnsDomain))
+	add := func(peers []*types.ComponentPeer) {
+		for _, p := range peers {
+			if peer := accountPeers[p.ID]; peer != nil {
+				accessiblePeers = append(accessiblePeers, peerToAccessiblePeer(peer, dnsDomain))
+			}
 		}
 	}
-	for _, p := range netMap.Peers {
-		appendByID(p.ID)
-	}
-	for _, p := range netMap.OfflinePeers {
-		appendByID(p.ID)
-	}
+	add(netMap.Peers)
+	add(netMap.OfflinePeers)
 
 	return accessiblePeers
 }

management/server/migration/migration.go

@@ -683,3 +683,81 @@ func BackfillPublicIDs[T any](ctx context.Context, db *gorm.DB) error {
 	log.WithContext(ctx).Infof("Backfill of empty public_id in table %s completed", tableName)
 	return nil
 }
+
+// FoldCostAggregatesIntoBuckets migrates a per-request cost table from the old
+// "stored aggregate" shape (cost_usd + cache_cost_usd columns) to the per-bucket
+// breakdown, where the total and cache portion are derived on read instead.
+//
+// The fold preserves both aggregates exactly for historical rows: the cache
+// total moves into cached_input_cost_usd and the remainder into
+// input_cost_usd, so a row's derived total and cache cost still match what it
+// reported before the upgrade. The finer split is genuinely unknown for those
+// rows — the old schema never recorded a read/write or input/output division —
+// so it is lumped rather than guessed; only rows written after the upgrade
+// carry a true four-way split.
+//
+// Dropping the columns before folding would zero every historical row's cost,
+// so the update runs first and the drop only happens once it succeeds. A table
+// with no cost_usd column has already been migrated (or was created fresh) and
+// is skipped.
+func FoldCostAggregatesIntoBuckets[T any](ctx context.Context, db *gorm.DB) error {
+	var model T
+
+	if !db.Migrator().HasTable(&model) {
+		log.WithContext(ctx).Debugf("table for %T does not exist, no cost-bucket migration needed", model)
+		return nil
+	}
+	if !db.Migrator().HasColumn(&model, "cost_usd") {
+		log.WithContext(ctx).Debugf("table for %T has no cost_usd column, cost buckets already migrated", model)
+		return nil
+	}
+
+	stmt := &gorm.Statement{DB: db}
+	if err := stmt.Parse(&model); err != nil {
+		return fmt.Errorf("parse model schema: %w", err)
+	}
+	tableName := stmt.Schema.Table
+
+	// COALESCE guards rows whose new columns were added as NULL by an earlier
+	// AutoMigrate run that predates the NOT NULL default.
+	hasCacheColumn := db.Migrator().HasColumn(&model, "cache_cost_usd")
+	cacheExpr := "0"
+	if hasCacheColumn {
+		cacheExpr = "COALESCE(cache_cost_usd, 0)"
+	}
+
+	if err := db.Transaction(func(tx *gorm.DB) error {
+		// Only touch rows that carry a legacy total and no breakdown yet, so
+		// the migration is idempotent and never overwrites a true split.
+		update := fmt.Sprintf(`UPDATE %s
+			SET input_cost_usd = COALESCE(cost_usd, 0) - %s,
+			    cached_input_cost_usd = %s,
+			    cache_creation_cost_usd = 0,
+			    output_cost_usd = 0
+			WHERE COALESCE(cost_usd, 0) <> 0
+			  AND COALESCE(input_cost_usd, 0) = 0
+			  AND COALESCE(cached_input_cost_usd, 0) = 0
+			  AND COALESCE(cache_creation_cost_usd, 0) = 0
+			  AND COALESCE(output_cost_usd, 0) = 0`, tableName, cacheExpr, cacheExpr)
+		res := tx.Exec(update)
+		if res.Error != nil {
+			return fmt.Errorf("fold legacy cost aggregates in %s: %w", tableName, res.Error)
+		}
+		log.WithContext(ctx).Infof("folded legacy cost aggregates into per-bucket columns for %d rows in table %s", res.RowsAffected, tableName)
+
+		if err := tx.Migrator().DropColumn(&model, "cost_usd"); err != nil {
+			return fmt.Errorf("drop cost_usd from %s: %w", tableName, err)
+		}
+		if hasCacheColumn {
+			if err := tx.Migrator().DropColumn(&model, "cache_cost_usd"); err != nil {
+				return fmt.Errorf("drop cache_cost_usd from %s: %w", tableName, err)
+			}
+		}
+		return nil
+	}); err != nil {
+		return err
+	}
+
+	log.WithContext(ctx).Infof("migration of stored cost aggregates to per-bucket columns in table %s completed", tableName)
+	return nil
+}

management/server/migration/migration_test.go

@@ -16,6 +16,7 @@ import (
 	"gorm.io/driver/sqlite"
 	"gorm.io/gorm"
 
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	"github.com/netbirdio/netbird/management/server/migration"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/testutil"
@@ -639,3 +640,99 @@ func TestCleanupOrphanedResources_SkipsWhenForeignKeyExists(t *testing.T) {
 	db.Model(&testChildWithFK{}).Count(&count)
 	assert.Equal(t, int64(2), count, "Both rows should survive — migration must skip when FK constraint exists")
 }
+
+// legacyCostRow is the pre-breakdown shape of the usage table: cost was stored
+// as a total plus a cache portion, with no per-bucket columns. Used to build a
+// realistic pre-upgrade table for the fold migration to run against.
+type legacyCostRow struct {
+	ID           string `gorm:"primaryKey"`
+	AccountID    string
+	Model        string
+	CostUSD      float64
+	CacheCostUSD float64
+}
+
+func (legacyCostRow) TableName() string { return "agent_network_request_usage" }
+
+// TestFoldCostAggregatesIntoBuckets_PreservesHistoricalCost covers the upgrade
+// path: a table written under the old schema must come out with its per-row
+// total and cache cost unchanged, because dropping cost_usd without folding it
+// forward would silently zero every historical row's spend.
+func TestFoldCostAggregatesIntoBuckets_PreservesHistoricalCost(t *testing.T) {
+	ctx := context.Background()
+	db := setupDatabase(t)
+	// setupDatabase hands back a process-shared database, so start from a clean
+	// table rather than inheriting rows from another test.
+	require.NoError(t, db.Migrator().DropTable(&agentNetworkTypes.AgentNetworkUsage{}))
+
+	require.NoError(t, db.AutoMigrate(&legacyCostRow{}), "legacy table must be created")
+	require.NoError(t, db.Create(&legacyCostRow{
+		ID: "u1", AccountID: "acct-1", Model: "claude-sonnet-4-6", CostUSD: 0.0123, CacheCostUSD: 0.0029,
+	}).Error)
+	require.NoError(t, db.Create(&legacyCostRow{
+		ID: "u2", AccountID: "acct-1", Model: "gpt-4o", CostUSD: 0.5, CacheCostUSD: 0,
+	}).Error)
+	// A zero-cost row (denied / unpriced request) must stay zero, not be touched.
+	require.NoError(t, db.Create(&legacyCostRow{ID: "u3", AccountID: "acct-1", Model: "gw/unpriced"}).Error)
+
+	// AutoMigrate adds the per-bucket columns alongside the legacy ones, exactly
+	// as a real upgrade does before the post-auto migrations run.
+	require.NoError(t, db.AutoMigrate(&agentNetworkTypes.AgentNetworkUsage{}), "new columns must be added")
+
+	require.NoError(t, migration.FoldCostAggregatesIntoBuckets[agentNetworkTypes.AgentNetworkUsage](ctx, db))
+
+	assert.False(t, db.Migrator().HasColumn(&agentNetworkTypes.AgentNetworkUsage{}, "cost_usd"),
+		"legacy cost_usd column must be dropped once folded")
+	assert.False(t, db.Migrator().HasColumn(&agentNetworkTypes.AgentNetworkUsage{}, "cache_cost_usd"),
+		"legacy cache_cost_usd column must be dropped once folded")
+
+	var rows []*agentNetworkTypes.AgentNetworkUsage
+	require.NoError(t, db.Order("id").Find(&rows).Error)
+	require.Len(t, rows, 3)
+
+	// u1: total and cache portion both preserved; the read/write and
+	// input/output splits are unknowable for a legacy row, so the cache total
+	// lands on cached_input and the remainder on input.
+	assert.InDelta(t, 0.0123, rows[0].TotalCostUSD(), 1e-9, "historical total must survive the fold")
+	assert.InDelta(t, 0.0029, rows[0].CacheCostUSD(), 1e-9, "historical cache cost must survive the fold")
+	assert.InDelta(t, 0.0094, rows[0].InputCostUSD, 1e-9, "non-cache remainder lands on input")
+	assert.InDelta(t, 0.0029, rows[0].CachedInputCostUSD, 1e-9, "legacy cache total lands on cached input")
+	assert.Zero(t, rows[0].CacheCreationCostUSD, "legacy rows carry no read/write split to recover")
+	assert.Zero(t, rows[0].OutputCostUSD, "legacy rows carry no input/output split to recover")
+
+	// u2: no cache spend — the whole total is the non-cache remainder.
+	assert.InDelta(t, 0.5, rows[1].TotalCostUSD(), 1e-9, "cache-free historical total must survive")
+	assert.Zero(t, rows[1].CacheCostUSD(), "a cache-free row must stay cache-free")
+
+	// u3: zero stays zero rather than being rewritten.
+	assert.Zero(t, rows[2].TotalCostUSD(), "an unpriced row must remain unpriced")
+}
+
+// TestFoldCostAggregatesIntoBuckets_SkipsAlreadyMigrated proves the migration is
+// safe to re-run: with no legacy column present it is a no-op that leaves a
+// true four-way split untouched.
+func TestFoldCostAggregatesIntoBuckets_SkipsAlreadyMigrated(t *testing.T) {
+	ctx := context.Background()
+	db := setupDatabase(t)
+	require.NoError(t, db.Migrator().DropTable(&agentNetworkTypes.AgentNetworkUsage{}))
+
+	require.NoError(t, db.AutoMigrate(&agentNetworkTypes.AgentNetworkUsage{}))
+	// Timestamp must be set explicitly: a zero time.Time serialises as
+	// '0000-00-00 00:00:00', which MySQL rejects under strict mode.
+	require.NoError(t, db.Create(&agentNetworkTypes.AgentNetworkUsage{
+		ID: "u1", AccountID: "acct-1", Model: "claude-sonnet-4-6",
+		Timestamp:    time.Date(2026, 5, 5, 9, 0, 0, 0, time.UTC),
+		InputCostUSD: 0.001, CachedInputCostUSD: 0.002, CacheCreationCostUSD: 0.003, OutputCostUSD: 0.004,
+	}).Error)
+
+	require.NoError(t, migration.FoldCostAggregatesIntoBuckets[agentNetworkTypes.AgentNetworkUsage](ctx, db),
+		"running against an already-migrated table must be a no-op, not an error")
+
+	var row agentNetworkTypes.AgentNetworkUsage
+	require.NoError(t, db.First(&row, "id = ?", "u1").Error)
+	assert.InDelta(t, 0.001, row.InputCostUSD, 1e-9, "a true split must not be rewritten")
+	assert.InDelta(t, 0.002, row.CachedInputCostUSD, 1e-9)
+	assert.InDelta(t, 0.003, row.CacheCreationCostUSD, 1e-9)
+	assert.InDelta(t, 0.004, row.OutputCostUSD, 1e-9)
+	assert.InDelta(t, 0.01, row.TotalCostUSD(), 1e-9, "derived total sums the four buckets")
+}

management/server/networks/resources/types/resource.go

@@ -14,6 +14,7 @@ import (
 	nbDomain "github.com/netbirdio/netbird/shared/management/domain"
 
 	"github.com/netbirdio/netbird/shared/management/http/api"
+	sharedTypes "github.com/netbirdio/netbird/shared/management/types"
 )
 
 type NetworkResourceType string
@@ -64,6 +65,27 @@ func NewNetworkResource(accountID, networkID, name, description, address string,
 	}, nil
 }
 
+// ToComponent converts the resource to its self-contained components
+// representation. Returns nil for a nil resource.
+func (n *NetworkResource) ToComponent() *sharedTypes.ComponentResource {
+	if n == nil {
+		return nil
+	}
+	return &sharedTypes.ComponentResource{
+		ID:          n.ID,
+		PublicID:    n.PublicID,
+		NetworkID:   n.NetworkID,
+		AccountID:   n.AccountID,
+		Name:        n.Name,
+		Description: n.Description,
+		Type:        sharedTypes.ComponentResourceType(n.Type),
+		Address:     n.Address,
+		Domain:      n.Domain,
+		Prefix:      n.Prefix,
+		Enabled:     n.Enabled,
+	}
+}
+
 func (n *NetworkResource) ToAPIResponse(groups []api.GroupMinimum) *api.NetworkResource {
 	addr := n.Prefix.String()
 	if n.Type == Domain {

management/server/networks/routers/types/router.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/networks/types"
 	"github.com/netbirdio/netbird/shared/management/http/api"
+	sharedTypes "github.com/netbirdio/netbird/shared/management/types"
 )
 
 type NetworkRouter struct {
@@ -21,6 +22,36 @@ type NetworkRouter struct {
 	Enabled    bool
 }
 
+// ToComponent converts the router to its self-contained components
+// representation. Returns nil for a nil router.
+func (n *NetworkRouter) ToComponent() *sharedTypes.ComponentRouter {
+	if n == nil {
+		return nil
+	}
+	return &sharedTypes.ComponentRouter{
+		NetworkID:  n.NetworkID,
+		PublicID:   n.PublicID,
+		Peer:       n.Peer,
+		PeerGroups: n.PeerGroups,
+		Masquerade: n.Masquerade,
+		Metric:     n.Metric,
+		Enabled:    n.Enabled,
+	}
+}
+
+// ToComponentMap converts a peer-keyed router map to its components
+// representation.
+func ToComponentMap(routers map[string]*NetworkRouter) map[string]*sharedTypes.ComponentRouter {
+	if routers == nil {
+		return nil
+	}
+	out := make(map[string]*sharedTypes.ComponentRouter, len(routers))
+	for id, r := range routers {
+		out[id] = r.ToComponent()
+	}
+	return out
+}
+
 func NewNetworkRouter(accountID string, networkID string, peer string, peerGroups []string, masquerade bool, metric int, enabled bool) (*NetworkRouter, error) {
 	r := &NetworkRouter{
 		ID:         xid.New().String(),

management/server/peer.go

@@ -21,7 +21,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
 	"github.com/netbirdio/netbird/shared/management/domain"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 
 	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/store"
@@ -406,7 +405,7 @@ func (am *DefaultAccountManager) CreatePeerJob(ctx context.Context, accountID, p
 		return status.NewPeerNotPartOfAccountError()
 	}
 
-	meetMinVer, err := posture.MeetsMinVersion(remoteJobsMinVer, p.Meta.WtVersion)
+	meetMinVer, err := version.MeetsMinVersion(remoteJobsMinVer, p.Meta.WtVersion)
 	if !version.IsDevelopmentVersion(p.Meta.WtVersion) && (!meetMinVer || err != nil) {
 		return status.Errorf(status.PreconditionFailed, "peer version %s does not meet the minimum required version %s for remote jobs", p.Meta.WtVersion, remoteJobsMinVer)
 	}
@@ -1589,7 +1588,7 @@ func affectedPeerIDsFromNetworkMap(nmap *types.NetworkMap, selfPeerID string) []
 	}
 	seen := make(map[string]struct{}, len(nmap.Peers)+len(nmap.OfflinePeers))
 	ids := make([]string, 0, len(nmap.Peers)+len(nmap.OfflinePeers))
-	add := func(peers []*nmdata.Peer) {
+	add := func(peers []*types.ComponentPeer) {
 		for _, p := range peers {
 			if p == nil || p.ID == "" || p.ID == selfPeerID {
 				continue

management/server/peer/peer.go

@@ -13,6 +13,7 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/util"
 	"github.com/netbirdio/netbird/shared/management/http/api"
+	sharedTypes "github.com/netbirdio/netbird/shared/management/types"
 )
 
 // Peer capability constants mirror the proto enum values.
@@ -205,6 +206,35 @@ func (p *Peer) AddedWithSSOLogin() bool {
 	return p.UserID != ""
 }
 
+// ToComponent converts the peer to its self-contained components
+// representation, carrying exactly the subset of peer data that crosses the
+// components wire format. Returns nil for a nil peer so callers can convert
+// possibly-missing peers without guarding.
+func (p *Peer) ToComponent() *sharedTypes.ComponentPeer {
+	if p == nil {
+		return nil
+	}
+	cp := &sharedTypes.ComponentPeer{
+		ID:                     p.ID,
+		Key:                    p.Key,
+		IP:                     p.IP,
+		IPv6:                   p.IPv6,
+		DNSLabel:               p.DNSLabel,
+		SSHKey:                 p.SSHKey,
+		SSHEnabled:             p.SSHEnabled,
+		ServerSSHAllowed:       p.Meta.Flags.ServerSSHAllowed,
+		AgentVersion:           p.Meta.WtVersion,
+		SupportsSourcePrefixes: p.SupportsSourcePrefixes(),
+		SupportsIPv6:           p.SupportsIPv6(),
+		LoginExpirationEnabled: p.LoginExpirationEnabled,
+		AddedWithSSOLogin:      p.AddedWithSSOLogin(),
+	}
+	if p.LastLogin != nil {
+		cp.LastLogin = *p.LastLogin
+	}
+	return cp
+}
+
 // HasCapability reports whether the peer has the given capability.
 func (p *Peer) HasCapability(capability int32) bool {
 	return slices.Contains(p.Meta.Capabilities, capability)

management/server/peer_test.go

@@ -57,7 +57,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/types"
 	nbroute "github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
@@ -1092,22 +1091,22 @@ func TestToSyncResponse(t *testing.T) {
 		Signature: "turn-pass",
 	}
 	networkMap := &types.NetworkMap{
-		Network: &nmdata.Network{Net: *ipnet, Serial: 1000},
-		Peers: []*nmdata.Peer{{
+		Network: &types.Network{Net: *ipnet, Serial: 1000},
+		Peers: []*types.ComponentPeer{{
 			IP:         netip.MustParseAddr("192.168.1.2"),
 			IPv6:       netip.MustParseAddr("fd00::2"),
 			Key:        "peer2-key",
 			DNSLabel:   "peer2",
 			SSHEnabled: true,
 			SSHKey:     "peer2-ssh-key"}},
-		OfflinePeers: []*nmdata.Peer{{
+		OfflinePeers: []*types.ComponentPeer{{
 			IP:         netip.MustParseAddr("192.168.1.3"),
 			IPv6:       netip.MustParseAddr("fd00::3"),
 			Key:        "peer3-key",
 			DNSLabel:   "peer3",
 			SSHEnabled: true,
 			SSHKey:     "peer3-ssh-key"}},
-		Routes: []*nmdata.Route{
+		Routes: []*nbroute.Route{
 			{
 				ID:          "route1",
 				Network:     netip.MustParsePrefix("10.0.0.0/24"),

management/server/posture/nb_version.go

@@ -3,11 +3,9 @@ package posture
 import (
 	"context"
 	"fmt"
-	"strings"
-
-	"github.com/hashicorp/go-version"
 
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	nbversion "github.com/netbirdio/netbird/version"
 )
 
 type NBVersionCheck struct {
@@ -16,14 +14,8 @@ type NBVersionCheck struct {
 
 var _ Check = (*NBVersionCheck)(nil)
 
-// sanitizeVersion removes anything after the pre-release tag (e.g., "-dev", "-alpha", etc.)
-func sanitizeVersion(version string) string {
-	parts := strings.Split(version, "-")
-	return parts[0]
-}
-
 func (n *NBVersionCheck) Check(ctx context.Context, peer nbpeer.Peer) (bool, error) {
-	meetsMin, err := MeetsMinVersion(n.MinVersion, peer.Meta.WtVersion)
+	meetsMin, err := nbversion.MeetsMinVersion(n.MinVersion, peer.Meta.WtVersion)
 	if err != nil {
 		return false, err
 	}
@@ -48,21 +40,3 @@ func (n *NBVersionCheck) Validate() error {
 	}
 	return nil
 }
-
-// MeetsMinVersion checks if the peer's version meets or exceeds the minimum required version
-func MeetsMinVersion(minVer, peerVer string) (bool, error) {
-	peerVer = sanitizeVersion(peerVer)
-	minVer = sanitizeVersion(minVer)
-
-	peerNBVer, err := version.NewVersion(peerVer)
-	if err != nil {
-		return false, err
-	}
-
-	constraints, err := version.NewConstraint(">= " + minVer)
-	if err != nil {
-		return false, err
-	}
-
-	return constraints.Check(peerNBVer), nil
-}

management/server/posture/nb_version_test.go

@@ -139,68 +139,3 @@ func TestNBVersionCheck_Validate(t *testing.T) {
 		})
 	}
 }
-
-func TestMeetsMinVersion(t *testing.T) {
-	tests := []struct {
-		name    string
-		minVer  string
-		peerVer string
-		want    bool
-		wantErr bool
-	}{
-		{
-			name:    "Peer version greater than min version",
-			minVer:  "0.26.0",
-			peerVer: "0.60.1",
-			want:    true,
-			wantErr: false,
-		},
-		{
-			name:    "Peer version equals min version",
-			minVer:  "1.0.0",
-			peerVer: "1.0.0",
-			want:    true,
-			wantErr: false,
-		},
-		{
-			name:    "Peer version less than min version",
-			minVer:  "1.0.0",
-			peerVer: "0.9.9",
-			want:    false,
-			wantErr: false,
-		},
-		{
-			name:    "Peer version with pre-release tag greater than min version",
-			minVer:  "1.0.0",
-			peerVer: "1.0.1-alpha",
-			want:    true,
-			wantErr: false,
-		},
-		{
-			name:    "Invalid peer version format",
-			minVer:  "1.0.0",
-			peerVer: "dev",
-			want:    false,
-			wantErr: true,
-		},
-		{
-			name:    "Invalid min version format",
-			minVer:  "invalid.version",
-			peerVer: "1.0.0",
-			want:    false,
-			wantErr: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := MeetsMinVersion(tt.minVer, tt.peerVer)
-			if tt.wantErr {
-				assert.Error(t, err)
-			} else {
-				assert.NoError(t, err)
-			}
-			assert.Equal(t, tt.want, got)
-		})
-	}
-}

management/server/route_test.go

@@ -1201,7 +1201,7 @@ func TestGetNetworkMap_RouteSync(t *testing.T) {
 	peer1Routes, err := am.GetNetworkMap(context.Background(), peer1ID)
 	require.NoError(t, err)
 	require.Len(t, peer1Routes.Routes, 1, "we should receive one route for peer1")
-	require.True(t, types.TwinRoute(expectedRoute).Equal(peer1Routes.Routes[0]), "received route should be equal")
+	require.True(t, expectedRoute.Equal(peer1Routes.Routes[0]), "received route should be equal")
 
 	peer2Routes, err := am.GetNetworkMap(context.Background(), peer2ID)
 	require.NoError(t, err)

management/server/store/sql_store_agentnetwork.go

@@ -71,7 +71,7 @@ func (s *SqlStore) GetAgentNetworkMetrics(ctx context.Context) (AgentNetworkMetr
 	usageRow := db.Model(&agentNetworkTypes.AgentNetworkUsage{}).
 		Select("COALESCE(SUM(input_tokens), 0) AS input_tokens, " +
 			"COALESCE(SUM(output_tokens), 0) AS output_tokens, " +
-			"COALESCE(SUM(cost_usd), 0) AS cost_usd").Row()
+			"COALESCE(SUM" + agentNetworkTypes.CostUSDSQLExpr + ", 0) AS cost_usd").Row()
 	if err := usageRow.Scan(&m.InputTokens, &m.OutputTokens, &m.CostUSD); err != nil {
 		return AgentNetworkMetrics{}, fmt.Errorf("scan agent network usage metrics: %w", err)
 	}

management/server/store/sql_store_agentnetwork_accesslog_test.go

@@ -37,7 +37,7 @@ func TestAgentNetworkUsage_RealStore_RoundTrip(t *testing.T) {
 		InputTokens:        1200,
 		OutputTokens:       640,
 		TotalTokens:        1840,
-		CostUSD:            0.0231,
+		InputCostUSD:       0.0231,
 	}
 	usageGroups := []agentNetworkTypes.AgentNetworkUsageGroup{
 		{UsageID: usage.ID, GroupID: "grp-eng", AccountID: accountID},
@@ -71,7 +71,7 @@ func TestAgentNetworkUsage_RealStore_RoundTrip(t *testing.T) {
 		InputTokens:  1200,
 		OutputTokens: 640,
 		TotalTokens:  1840,
-		CostUSD:      0.0231,
+		InputCostUSD: 0.0231,
 	}
 	entryGroups := []agentNetworkTypes.AgentNetworkAccessLogGroup{
 		{LogID: entry.ID, GroupID: "grp-eng", AccountID: accountID},
@@ -127,7 +127,7 @@ func TestAgentNetworkUsageOverview_DailyAggregation(t *testing.T) {
 	mk := func(id string, ts time.Time, model string, in, out int64, cost float64) *agentNetworkTypes.AgentNetworkUsage {
 		return &agentNetworkTypes.AgentNetworkUsage{
 			ID: id, AccountID: accountID, Timestamp: ts, Model: model,
-			InputTokens: in, OutputTokens: out, TotalTokens: in + out, CostUSD: cost,
+			InputTokens: in, OutputTokens: out, TotalTokens: in + out, InputCostUSD: cost,
 		}
 	}
 	require.NoError(t, s.CreateAgentNetworkUsage(ctx, mk("u1", day1, "gpt-4o", 100, 50, 0.10), nil))
@@ -143,7 +143,7 @@ func TestAgentNetworkUsageOverview_DailyAggregation(t *testing.T) {
 	assert.Equal(t, "2026-05-05", buckets[0].PeriodStart, "oldest-first ordering")
 	assert.Equal(t, int64(300), buckets[0].InputTokens, "same-day input tokens summed")
 	assert.Equal(t, int64(130), buckets[0].OutputTokens)
-	assert.InDelta(t, 0.30, buckets[0].CostUSD, 1e-9, "same-day cost summed")
+	assert.InDelta(t, 0.30, buckets[0].TotalCostUSD(), 1e-9, "same-day cost summed")
 	assert.Equal(t, "2026-05-06", buckets[1].PeriodStart)
 	assert.Equal(t, int64(15), buckets[1].TotalTokens)
 
@@ -174,7 +174,7 @@ func TestAgentNetworkAccessLogSessions_RealStore(t *testing.T) {
 			ID: id, AccountID: accountID, ServiceID: "svc", Timestamp: ts,
 			UserID: user, StatusCode: 200, Provider: provider, Model: model,
 			SessionID: session, Decision: decision,
-			InputTokens: 100, OutputTokens: 50, TotalTokens: 150, CostUSD: cost,
+			InputTokens: 100, OutputTokens: 50, TotalTokens: 150, InputCostUSD: cost,
 		}
 	}
 
@@ -207,7 +207,7 @@ func TestAgentNetworkAccessLogSessions_RealStore(t *testing.T) {
 	s1 := sessions[2]
 	assert.Equal(t, 2, s1.RequestCount, "s1 has two requests")
 	assert.Equal(t, int64(300), s1.TotalTokens, "tokens summed across the session")
-	assert.InDelta(t, 0.30, s1.CostUSD, 1e-9, "cost summed across the session")
+	assert.InDelta(t, 0.30, s1.TotalCostUSD(), 1e-9, "cost summed across the session")
 	assert.Equal(t, "alice", s1.UserID)
 	assert.Equal(t, "allow", s1.Decision)
 	// SQLite hands times back in time.Local; normalise to UTC so the instant is

management/server/store/store.go

@@ -650,6 +650,14 @@ func getMigrationsPostAuto(ctx context.Context) []migrationFunc {
 		func(db *gorm.DB) error {
 			return migration.DropIndex[proxy.Proxy](ctx, db, "idx_proxy_account_id_unique")
 		},
+		// Post-auto so the per-bucket cost columns already exist when the legacy
+		// aggregates are folded into them and dropped.
+		func(db *gorm.DB) error {
+			return migration.FoldCostAggregatesIntoBuckets[agentNetworkTypes.AgentNetworkAccessLog](ctx, db)
+		},
+		func(db *gorm.DB) error {
+			return migration.FoldCostAggregatesIntoBuckets[agentNetworkTypes.AgentNetworkUsage](ctx, db)
+		},
 	}
 }
 

management/server/types/account.go

@@ -18,6 +18,8 @@ import (
 	nbdns "github.com/netbirdio/netbird/dns"
 	proxydomain "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/internals/modules/zones"
+	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -1080,6 +1082,7 @@ func (a *Account) connResourcesGenerator(ctx context.Context, targetPeer *nbpeer
 	peersExists := make(map[string]struct{})
 	rules := make([]*FirewallRule, 0)
 	peers := make([]*nbpeer.Peer, 0)
+	targetComponent := targetPeer.ToComponent()
 
 	return func(rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int) {
 			for _, peer := range groupPeers {
@@ -1115,10 +1118,10 @@ func (a *Account) connResourcesGenerator(ctx context.Context, targetPeer *nbpeer
 				if len(rule.Ports) == 0 && len(rule.PortRanges) == 0 {
 					rules = append(rules, &fr)
 				} else {
-					rules = append(rules, ExpandPortsAndRanges(fr, rule, targetPeer)...)
+					rules = append(rules, ExpandPortsAndRanges(fr, rule, targetComponent)...)
 				}
 
-				rules = AppendIPv6FirewallRule(rules, rulesExists, peer, targetPeer, rule, FirewallRuleContext{
+				rules = AppendIPv6FirewallRule(rules, rulesExists, peer.ToComponent(), targetComponent, rule, FirewallRuleContext{
 					Direction:   direction,
 					DirStr:      strconv.Itoa(direction),
 					ProtocolStr: string(protocol),
@@ -1278,7 +1281,7 @@ func (a *Account) getRouteFirewallRules(ctx context.Context, peerID string, poli
 	return fwRules
 }
 
-func (a *Account) getRulePeers(rule *PolicyRule, postureChecks []string, peerID string, distributionPeers map[string]struct{}, validatedPeersMap map[string]struct{}) []*nbpeer.Peer {
+func (a *Account) getRulePeers(rule *PolicyRule, postureChecks []string, peerID string, distributionPeers map[string]struct{}, validatedPeersMap map[string]struct{}) []*ComponentPeer {
 	distPeersWithPolicy := make(map[string]struct{})
 	for _, id := range rule.Sources {
 		group := a.Groups[id]
@@ -1305,13 +1308,13 @@ func (a *Account) getRulePeers(rule *PolicyRule, postureChecks []string, peerID
 		}
 	}
 
-	distributionGroupPeers := make([]*nbpeer.Peer, 0, len(distPeersWithPolicy))
+	distributionGroupPeers := make([]*ComponentPeer, 0, len(distPeersWithPolicy))
 	for pID := range distPeersWithPolicy {
 		peer := a.Peers[pID]
 		if peer == nil {
 			continue
 		}
-		distributionGroupPeers = append(distributionGroupPeers, peer)
+		distributionGroupPeers = append(distributionGroupPeers, peer.ToComponent())
 	}
 	return distributionGroupPeers
 }
@@ -1796,3 +1799,66 @@ func filterZoneRecordsForPeers(peer *nbpeer.Peer, customZone nbdns.CustomZone, p
 
 	return filteredRecords
 }
+
+// filterPeerAppliedZones filters account zones based on the peer's group membership
+func filterPeerAppliedZones(ctx context.Context, accountZones []*zones.Zone, peerGroups LookupMap) []nbdns.CustomZone {
+	var customZones []nbdns.CustomZone
+
+	if len(peerGroups) == 0 {
+		return customZones
+	}
+
+	for _, zone := range accountZones {
+		if !zone.Enabled || len(zone.Records) == 0 {
+			continue
+		}
+
+		hasAccess := false
+		for _, distGroupID := range zone.DistributionGroups {
+			if _, found := peerGroups[distGroupID]; found {
+				hasAccess = true
+				break
+			}
+		}
+
+		if !hasAccess {
+			continue
+		}
+
+		simpleRecords := make([]nbdns.SimpleRecord, 0, len(zone.Records))
+		for _, record := range zone.Records {
+			var recordType int
+			rData := record.Content
+
+			switch record.Type {
+			case records.RecordTypeA:
+				recordType = int(dns.TypeA)
+			case records.RecordTypeAAAA:
+				recordType = int(dns.TypeAAAA)
+			case records.RecordTypeCNAME:
+				recordType = int(dns.TypeCNAME)
+				rData = dns.Fqdn(record.Content)
+			default:
+				log.WithContext(ctx).Warnf("unknown DNS record type %s for record %s", record.Type, record.ID)
+				continue
+			}
+
+			simpleRecords = append(simpleRecords, nbdns.SimpleRecord{
+				Name:  dns.Fqdn(record.Name),
+				Type:  recordType,
+				Class: nbdns.DefaultClass,
+				TTL:   record.TTL,
+				RData: rData,
+			})
+		}
+
+		customZones = append(customZones, nbdns.CustomZone{
+			Domain:               dns.Fqdn(zone.Domain),
+			Records:              simpleRecords,
+			SearchDomainDisabled: !zone.EnableSearchDomain,
+			NonAuthoritative:     true,
+		})
+	}
+
+	return customZones
+}

management/server/types/account_components.go

@@ -2,6 +2,7 @@ package types
 
 import (
 	"context"
+	"slices"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -10,6 +11,7 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	"github.com/netbirdio/netbird/management/server/telemetry"
+	"github.com/netbirdio/netbird/route"
 )
 
 // GetPeerNetworkMapResult dispatches to either the legacy-NetworkMap path or
@@ -90,9 +92,6 @@ func (a *Account) GetPeerNetworkMapFromComponents(
 	return nm
 }
 
-// GetPeerNetworkMapComponents builds the account's slim twin store and computes
-// the peer's components on it. The calculation itself lives on
-// networkmap.NetworkMapData and never touches the Account.
 func (a *Account) GetPeerNetworkMapComponents(
 	ctx context.Context,
 	peerID string,
@@ -103,6 +102,623 @@ func (a *Account) GetPeerNetworkMapComponents(
 	routers map[string]map[string]*routerTypes.NetworkRouter,
 	groupIDToUserIDs map[string][]string,
 ) *NetworkMapComponents {
-	nmd := a.toNetworkMapData(accountZones, validatedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
-	return nmd.GetPeerNetworkMapComponents(peerID, toTwinCustomZone(peersCustomZone))
+	peer := a.Peers[peerID]
+	// this can never happen, things are very wrong if it did
+	// TODO (dmitri) maybe consider using invariants?
+	if peer == nil {
+		log.WithField("peer id", peerID).Error("NetworkMapComponents are computed for a peer missing from the account")
+		return EmptyNetworkMapComponents(&NetworkMapComponents{
+			PeerID:  peerID,
+			Network: a.Network.Copy(),
+			// must include the target peer as it's required on the client
+			Peers: map[string]*ComponentPeer{peerID: peer.ToComponent()},
+		})
+	}
+
+	if _, ok := validatedPeersMap[peerID]; !ok {
+		// Mirror legacy graceful-degrade: GetPeerNetworkMapFromComponents
+		// returns &NetworkMap{Network: a.Network.Copy()} when components is
+		// nil. Match that floor so the receiving client always sees the
+		// account Network identifier, not a fully-empty envelope.
+		return EmptyNetworkMapComponents(&NetworkMapComponents{
+			PeerID:  peerID,
+			Network: a.Network.Copy(),
+			// must include the target peer as it's required on the client
+			Peers: map[string]*ComponentPeer{peerID: peer.ToComponent()},
+		})
+	}
+
+	components := &NetworkMapComponents{
+		PeerID:                    peerID,
+		Network:                   a.Network.Copy(),
+		NameServerGroups:          make([]*nbdns.NameServerGroup, 0),
+		CustomZoneDomain:          peersCustomZone.Domain,
+		ResourcePoliciesMap:       make(map[string][]*Policy),
+		RoutersMap:                make(map[string]map[string]*ComponentRouter),
+		NetworkResources:          make([]*ComponentResource, 0),
+		PostureFailedPeers:        make(map[string]map[string]struct{}, len(a.PostureChecks)),
+		RouterPeers:               make(map[string]*ComponentPeer),
+		NetworkXIDToPublicID:      make(map[string]string, len(a.Networks)),
+		PostureCheckXIDToPublicID: make(map[string]string, len(a.PostureChecks)),
+	}
+	for _, n := range a.Networks {
+		if n != nil {
+			components.NetworkXIDToPublicID[n.ID] = n.PublicID
+		}
+	}
+	for _, pc := range a.PostureChecks {
+		if pc != nil {
+			components.PostureCheckXIDToPublicID[pc.ID] = pc.PublicID
+		}
+	}
+
+	components.AccountSettings = &AccountSettingsInfo{
+		PeerLoginExpirationEnabled:      a.Settings.PeerLoginExpirationEnabled,
+		PeerLoginExpiration:             a.Settings.PeerLoginExpiration,
+		PeerInactivityExpirationEnabled: a.Settings.PeerInactivityExpirationEnabled,
+		PeerInactivityExpiration:        a.Settings.PeerInactivityExpiration,
+	}
+
+	components.DNSSettings = &a.DNSSettings
+
+	// relevantPeers always contains the target peer (peerID)
+	relevantPeers, relevantGroups, relevantPolicies, relevantRoutes, sshReqs := a.getPeersGroupsPoliciesRoutes(ctx, peerID, peer.SSHEnabled, validatedPeersMap, &components.PostureFailedPeers)
+
+	if len(sshReqs.neededGroupIDs) > 0 {
+		components.GroupIDToUserIDs = filterGroupIDToUserIDs(groupIDToUserIDs, sshReqs.neededGroupIDs)
+	}
+	if sshReqs.needAllowedUserIDs {
+		components.AllowedUserIDs = a.getAllowedUserIDs()
+	}
+
+	components.Peers = relevantPeers
+	components.Groups = GroupsToComponent(relevantGroups)
+	components.Policies = relevantPolicies
+	components.Routes = relevantRoutes
+	components.AllDNSRecords = filterDNSRecordsByPeers(peersCustomZone.Records, relevantPeers, peer.SupportsIPv6() && peer.IPv6.IsValid())
+
+	peerGroups := a.GetPeerGroups(peerID)
+	components.AccountZones = filterPeerAppliedZones(ctx, accountZones, peerGroups)
+	components.AccountZones = append(components.AccountZones, a.SynthesizePrivateServiceZones(peerID)...)
+
+	for _, nsGroup := range a.NameServerGroups {
+		if nsGroup.Enabled {
+			for _, gID := range nsGroup.Groups {
+				if _, found := relevantGroups[gID]; found {
+					components.NameServerGroups = append(components.NameServerGroups, nsGroup)
+					break
+				}
+			}
+		}
+	}
+
+	for _, resource := range a.NetworkResources {
+		if !resource.Enabled {
+			continue
+		}
+
+		policies, exists := resourcePolicies[resource.ID]
+		if !exists {
+			continue
+		}
+
+		addSourcePeers := false
+
+		networkRoutingPeers, routerExists := routers[resource.NetworkID]
+		if routerExists {
+			if _, ok := networkRoutingPeers[peerID]; ok {
+				addSourcePeers = true
+			}
+		}
+
+		for _, policy := range policies {
+			if addSourcePeers {
+				var peers []string
+				if policy.Rules[0].SourceResource.Type == ResourceTypePeer && policy.Rules[0].SourceResource.ID != "" {
+					peers = []string{policy.Rules[0].SourceResource.ID}
+				} else {
+					peers = a.getUniquePeerIDsFromGroupsIDs(ctx, policy.SourceGroups())
+				}
+				for _, pID := range a.getPostureValidPeersSaveFailed(peers, policy.SourcePostureChecks, validatedPeersMap, &components.PostureFailedPeers) {
+					if _, exists := components.Peers[pID]; !exists {
+						components.Peers[pID] = a.GetPeer(pID).ToComponent()
+					}
+				}
+			} else {
+				peerInSources := false
+				if policy.Rules[0].SourceResource.Type == ResourceTypePeer && policy.Rules[0].SourceResource.ID != "" {
+					peerInSources = policy.Rules[0].SourceResource.ID == peerID
+				} else {
+					for _, groupID := range policy.SourceGroups() {
+						if group := a.GetGroup(groupID); group != nil && slices.Contains(group.Peers, peerID) {
+							peerInSources = true
+							break
+						}
+					}
+				}
+				if !peerInSources {
+					continue
+				}
+				isValid, pname := a.validatePostureChecksOnPeerGetFailed(ctx, policy.SourcePostureChecks, peerID)
+				if !isValid && len(pname) > 0 {
+					if _, ok := components.PostureFailedPeers[pname]; !ok {
+						components.PostureFailedPeers[pname] = make(map[string]struct{})
+					}
+					components.PostureFailedPeers[pname][peer.ID] = struct{}{}
+					continue
+				}
+				addSourcePeers = true
+			}
+
+			for _, rule := range policy.Rules {
+				for _, srcGroupID := range rule.Sources {
+					if g := a.Groups[srcGroupID]; g != nil {
+						if _, exists := components.Groups[srcGroupID]; !exists {
+							components.Groups[srcGroupID] = g.ToComponent()
+						}
+					}
+				}
+				for _, dstGroupID := range rule.Destinations {
+					if g := a.Groups[dstGroupID]; g != nil {
+						if _, exists := components.Groups[dstGroupID]; !exists {
+							components.Groups[dstGroupID] = g.ToComponent()
+						}
+					}
+				}
+			}
+			components.ResourcePoliciesMap[resource.ID] = policies
+		}
+
+		// Only expose router peers and the per-network routers_map when this
+		// target peer actually has access to the resource (either as a router
+		// itself or via a policy that includes it as a source). Without this
+		// gate, every peer's envelope was leaking router peers of every
+		// network in the account — accounts with many tenants/networks
+		// shipped tens of unrelated peers in `peers[]` and `routers_map`.
+		if addSourcePeers {
+			components.RoutersMap[resource.NetworkID] = routerTypes.ToComponentMap(networkRoutingPeers)
+			for peerIDKey := range networkRoutingPeers {
+				if p := a.Peers[peerIDKey]; p != nil {
+					cp := components.RouterPeers[peerIDKey]
+					if cp == nil {
+						cp = p.ToComponent()
+						components.RouterPeers[peerIDKey] = cp
+					}
+					if _, exists := components.Peers[peerIDKey]; !exists {
+						if _, validated := validatedPeersMap[peerIDKey]; validated {
+							components.Peers[peerIDKey] = cp
+						}
+					}
+				}
+			}
+			components.NetworkResources = append(components.NetworkResources, resource.ToComponent())
+		}
+	}
+
+	filterGroupPeers(&components.Groups, components.Peers)
+	filterPostureFailedPeers(&components.PostureFailedPeers, components.Policies, components.ResourcePoliciesMap, components.Peers)
+
+	return components
+}
+
+type sshRequirements struct {
+	neededGroupIDs     map[string]struct{}
+	needAllowedUserIDs bool
+}
+
+func (a *Account) getPeersGroupsPoliciesRoutes(
+	ctx context.Context,
+	peerID string,
+	peerSSHEnabled bool,
+	validatedPeersMap map[string]struct{},
+	postureFailedPeers *map[string]map[string]struct{},
+) (map[string]*ComponentPeer, map[string]*Group, []*Policy, []*route.Route, sshRequirements) {
+	relevantPeerIDs := make(map[string]*ComponentPeer, len(a.Peers)/4)
+	relevantGroupIDs := make(map[string]*Group, len(a.Groups)/4)
+	relevantPolicies := make([]*Policy, 0, len(a.Policies))
+	relevantRoutes := make([]*route.Route, 0, len(a.Routes))
+	sshReqs := sshRequirements{neededGroupIDs: make(map[string]struct{})}
+
+	relevantPeerIDs[peerID] = a.GetPeer(peerID).ToComponent()
+
+	peerGroupSet := make(map[string]struct{}, 8)
+	for groupID, group := range a.Groups {
+		if slices.Contains(group.Peers, peerID) {
+			relevantGroupIDs[groupID] = a.GetGroup(groupID)
+			peerGroupSet[groupID] = struct{}{}
+		}
+	}
+
+	routeAccessControlGroups := make(map[string]struct{})
+	for _, r := range a.Routes {
+		if r == nil {
+			continue
+		}
+		relevant := r.Peer == peerID
+		if !relevant {
+			for _, groupID := range r.PeerGroups {
+				if _, ok := peerGroupSet[groupID]; ok {
+					relevant = true
+					break
+				}
+			}
+		}
+		if !relevant && r.Enabled {
+			for _, groupID := range r.Groups {
+				if _, ok := peerGroupSet[groupID]; ok {
+					relevant = true
+					break
+				}
+			}
+		}
+		if !relevant {
+			continue
+		}
+
+		for _, groupID := range r.PeerGroups {
+			relevantGroupIDs[groupID] = a.GetGroup(groupID)
+		}
+		for _, groupID := range r.Groups {
+			relevantGroupIDs[groupID] = a.GetGroup(groupID)
+		}
+		if r.Enabled {
+			for _, groupID := range r.AccessControlGroups {
+				relevantGroupIDs[groupID] = a.GetGroup(groupID)
+				routeAccessControlGroups[groupID] = struct{}{}
+			}
+		}
+
+		// Include route advertisers in relevantPeerIDs. The envelope
+		// encoder writes route.peer_index by looking up r.Peer in the
+		// shipped peers list; if the advertiser is policy-isolated from
+		// the target peer (no rule edge between them), it would otherwise
+		// be omitted and the decoder would fail to resolve r.Peer, leaving
+		// the client without a WG tunnel target for this route. Legacy
+		// NetworkMap.Routes shipped the WG public key inline, so the
+		// equivalence path doesn't surface this — but the dependency is
+		// real once a client actually tries to use the route.
+		// Gate by validatedPeersMap so non-validated advertisers stay out
+		// (matches the network-resource router behaviour at the bottom of
+		// this loop, and the legacy invariant that only validated peers
+		// reach a client's view).
+		if r.Peer != "" {
+			if _, ok := validatedPeersMap[r.Peer]; ok {
+				if p := a.GetPeer(r.Peer); p != nil {
+					relevantPeerIDs[r.Peer] = p.ToComponent()
+				}
+			}
+		}
+		for _, groupID := range r.PeerGroups {
+			g := a.GetGroup(groupID)
+			if g == nil {
+				continue
+			}
+			for _, pid := range g.Peers {
+				if _, exists := relevantPeerIDs[pid]; exists {
+					continue
+				}
+				if _, ok := validatedPeersMap[pid]; !ok {
+					continue
+				}
+				if p := a.GetPeer(pid); p != nil {
+					relevantPeerIDs[pid] = p.ToComponent()
+				}
+			}
+		}
+		relevantRoutes = append(relevantRoutes, r)
+	}
+
+	for _, policy := range a.Policies {
+		if !policy.Enabled {
+			continue
+		}
+
+		policyRelevant := false
+		for _, rule := range policy.Rules {
+			if !rule.Enabled {
+				continue
+			}
+
+			if len(routeAccessControlGroups) > 0 {
+				for _, destGroupID := range rule.Destinations {
+					if _, needed := routeAccessControlGroups[destGroupID]; needed {
+						policyRelevant = true
+						for _, srcGroupID := range rule.Sources {
+							relevantGroupIDs[srcGroupID] = a.GetGroup(srcGroupID)
+						}
+						for _, dstGroupID := range rule.Destinations {
+							relevantGroupIDs[dstGroupID] = a.GetGroup(dstGroupID)
+						}
+						break
+					}
+				}
+			}
+
+			var sourcePeers, destinationPeers []string
+			var peerInSources, peerInDestinations bool
+
+			if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID != "" {
+				sourcePeers = []string{rule.SourceResource.ID}
+				if rule.SourceResource.ID == peerID {
+					peerInSources = true
+				}
+			} else {
+				sourcePeers, peerInSources = a.getPeersFromGroups(ctx, rule.Sources, peerID, policy.SourcePostureChecks, validatedPeersMap, postureFailedPeers)
+			}
+
+			if rule.DestinationResource.Type == ResourceTypePeer && rule.DestinationResource.ID != "" {
+				destinationPeers = []string{rule.DestinationResource.ID}
+				if rule.DestinationResource.ID == peerID {
+					peerInDestinations = true
+				}
+			} else {
+				destinationPeers, peerInDestinations = a.getPeersFromGroups(ctx, rule.Destinations, peerID, nil, validatedPeersMap, postureFailedPeers)
+			}
+
+			if peerInSources {
+				policyRelevant = true
+				for _, pid := range destinationPeers {
+					if _, exists := relevantPeerIDs[pid]; !exists {
+						relevantPeerIDs[pid] = a.GetPeer(pid).ToComponent()
+					}
+				}
+				for _, dstGroupID := range rule.Destinations {
+					relevantGroupIDs[dstGroupID] = a.GetGroup(dstGroupID)
+				}
+			}
+
+			if peerInDestinations {
+				policyRelevant = true
+				for _, pid := range sourcePeers {
+					if _, exists := relevantPeerIDs[pid]; !exists {
+						relevantPeerIDs[pid] = a.GetPeer(pid).ToComponent()
+					}
+				}
+				for _, srcGroupID := range rule.Sources {
+					relevantGroupIDs[srcGroupID] = a.GetGroup(srcGroupID)
+				}
+
+				if rule.Protocol == PolicyRuleProtocolNetbirdSSH {
+					switch {
+					case len(rule.AuthorizedGroups) > 0:
+						for groupID := range rule.AuthorizedGroups {
+							sshReqs.neededGroupIDs[groupID] = struct{}{}
+						}
+					case rule.AuthorizedUser != "":
+					default:
+						sshReqs.needAllowedUserIDs = true
+					}
+				} else if PolicyRuleImpliesLegacySSH(rule) && peerSSHEnabled {
+					sshReqs.needAllowedUserIDs = true
+				}
+			}
+		}
+		if policyRelevant {
+			relevantPolicies = append(relevantPolicies, policy)
+		}
+	}
+
+	return relevantPeerIDs, relevantGroupIDs, relevantPolicies, relevantRoutes, sshReqs
+}
+
+func (a *Account) getPeersFromGroups(ctx context.Context, groups []string, peerID string, sourcePostureChecksIDs []string,
+	validatedPeersMap map[string]struct{}, postureFailedPeers *map[string]map[string]struct{}) ([]string, bool) {
+	peerInGroups := false
+	filteredPeerIDs := make([]string, 0, len(groups))
+	seenPeerIds := make(map[string]struct{}, len(groups))
+
+	for _, gid := range groups {
+		group := a.GetGroup(gid)
+		if group == nil {
+			continue
+		}
+
+		if group.IsGroupAll() || len(groups) == 1 {
+			filteredPeerIDs = make([]string, 0, len(group.Peers))
+			peerInGroups = false
+			for _, pid := range group.Peers {
+				peer, ok := a.Peers[pid]
+				if !ok || peer == nil {
+					continue
+				}
+
+				if _, ok := validatedPeersMap[peer.ID]; !ok {
+					continue
+				}
+
+				isValid, pname := a.validatePostureChecksOnPeerGetFailed(ctx, sourcePostureChecksIDs, peer.ID)
+				if !isValid && len(pname) > 0 {
+					if _, ok := (*postureFailedPeers)[pname]; !ok {
+						(*postureFailedPeers)[pname] = make(map[string]struct{})
+					}
+					(*postureFailedPeers)[pname][peer.ID] = struct{}{}
+					continue
+				}
+
+				if peer.ID == peerID {
+					peerInGroups = true
+					continue
+				}
+
+				filteredPeerIDs = append(filteredPeerIDs, peer.ID)
+			}
+			return filteredPeerIDs, peerInGroups
+		}
+
+		for _, pid := range group.Peers {
+			if _, seen := seenPeerIds[pid]; seen {
+				continue
+			}
+			seenPeerIds[pid] = struct{}{}
+			peer, ok := a.Peers[pid]
+			if !ok || peer == nil {
+				continue
+			}
+
+			if _, ok := validatedPeersMap[peer.ID]; !ok {
+				continue
+			}
+
+			isValid, pname := a.validatePostureChecksOnPeerGetFailed(ctx, sourcePostureChecksIDs, peer.ID)
+			if !isValid && len(pname) > 0 {
+				if _, ok := (*postureFailedPeers)[pname]; !ok {
+					(*postureFailedPeers)[pname] = make(map[string]struct{})
+				}
+				(*postureFailedPeers)[pname][peer.ID] = struct{}{}
+				continue
+			}
+
+			if peer.ID == peerID {
+				peerInGroups = true
+				continue
+			}
+
+			filteredPeerIDs = append(filteredPeerIDs, peer.ID)
+		}
+	}
+
+	return filteredPeerIDs, peerInGroups
+}
+
+func (a *Account) validatePostureChecksOnPeerGetFailed(ctx context.Context, sourcePostureChecksID []string, peerID string) (bool, string) {
+	peer, ok := a.Peers[peerID]
+	if !ok || peer == nil {
+		return false, ""
+	}
+
+	for _, postureChecksID := range sourcePostureChecksID {
+		postureChecks := a.GetPostureChecks(postureChecksID)
+		if postureChecks == nil {
+			continue
+		}
+
+		for _, check := range postureChecks.GetChecks() {
+			isValid, _ := check.Check(ctx, *peer)
+			if !isValid {
+				return false, postureChecksID
+			}
+		}
+	}
+	return true, ""
+}
+
+func (a *Account) getPostureValidPeersSaveFailed(inputPeers []string, postureChecksIDs []string, validatedPeersMap map[string]struct{}, postureFailedPeers *map[string]map[string]struct{}) []string {
+	var dest []string
+	for _, peerID := range inputPeers {
+		if _, validated := validatedPeersMap[peerID]; !validated {
+			continue
+		}
+		valid, pname := a.validatePostureChecksOnPeerGetFailed(context.Background(), postureChecksIDs, peerID)
+		if valid {
+			dest = append(dest, peerID)
+			continue
+		}
+		if _, ok := (*postureFailedPeers)[pname]; !ok {
+			(*postureFailedPeers)[pname] = make(map[string]struct{})
+		}
+		(*postureFailedPeers)[pname][peerID] = struct{}{}
+	}
+	return dest
+}
+
+// filterGroupPeers trims each group's Peers slice to only those peers that
+// also appear in `peers`. Groups whose filtered list is empty are NOT
+// deleted from the map — they're kept so the components wire encoder can
+// still resolve seq references from routes/policies/access-control groups
+// that name them. Calculate() tolerates groups with empty Peers (the inner
+// loops simply iterate zero times), so retaining them is behaviourally a
+// no-op for the legacy path that consumes the same NetworkMapComponents.
+func filterGroupPeers(groups *map[string]*ComponentGroup, peers map[string]*ComponentPeer) {
+	for groupID, groupInfo := range *groups {
+		filteredPeers := make([]string, 0, len(groupInfo.Peers))
+		for _, pid := range groupInfo.Peers {
+			if _, exists := peers[pid]; exists {
+				filteredPeers = append(filteredPeers, pid)
+			}
+		}
+
+		if len(filteredPeers) != len(groupInfo.Peers) {
+			ng := *groupInfo
+			ng.Peers = filteredPeers
+			(*groups)[groupID] = &ng
+		}
+	}
+}
+
+func filterPostureFailedPeers(postureFailedPeers *map[string]map[string]struct{}, policies []*Policy, resourcePoliciesMap map[string][]*Policy, peers map[string]*ComponentPeer) {
+	if len(*postureFailedPeers) == 0 {
+		return
+	}
+
+	referencedPostureChecks := make(map[string]struct{})
+	for _, policy := range policies {
+		for _, checkID := range policy.SourcePostureChecks {
+			referencedPostureChecks[checkID] = struct{}{}
+		}
+	}
+	for _, resPolicies := range resourcePoliciesMap {
+		for _, policy := range resPolicies {
+			for _, checkID := range policy.SourcePostureChecks {
+				referencedPostureChecks[checkID] = struct{}{}
+			}
+		}
+	}
+
+	for checkID, failedPeers := range *postureFailedPeers {
+		if _, referenced := referencedPostureChecks[checkID]; !referenced {
+			delete(*postureFailedPeers, checkID)
+			continue
+		}
+		for peerID := range failedPeers {
+			if _, exists := peers[peerID]; !exists {
+				delete(failedPeers, peerID)
+			}
+		}
+		if len(failedPeers) == 0 {
+			delete(*postureFailedPeers, checkID)
+		}
+	}
+}
+
+func filterDNSRecordsByPeers(records []nbdns.SimpleRecord, peers map[string]*ComponentPeer, includeIPv6 bool) []nbdns.SimpleRecord {
+	if len(records) == 0 || len(peers) == 0 {
+		return nil
+	}
+
+	// Include both v4 and v6 addresses so AAAA records (whose RData is an IPv6
+	// address) are not filtered out when peers have IPv6 assigned. When the
+	// requesting peer doesn't have IPv6, omit v6 IPs so AAAA records get dropped.
+	peerIPs := make(map[string]struct{}, len(peers)*2)
+	for _, peer := range peers {
+		if peer == nil {
+			continue
+		}
+		peerIPs[peer.IP.String()] = struct{}{}
+		if includeIPv6 && peer.IPv6.IsValid() {
+			peerIPs[peer.IPv6.String()] = struct{}{}
+		}
+	}
+
+	filteredRecords := make([]nbdns.SimpleRecord, 0, len(records))
+	for _, record := range records {
+		if _, exists := peerIPs[record.RData]; exists {
+			filteredRecords = append(filteredRecords, record)
+		}
+	}
+
+	return filteredRecords
+}
+
+func filterGroupIDToUserIDs(fullMap map[string][]string, neededGroupIDs map[string]struct{}) map[string][]string {
+	if len(neededGroupIDs) == 0 {
+		return nil
+	}
+
+	filtered := make(map[string][]string, len(neededGroupIDs))
+	for groupID := range neededGroupIDs {
+		if users, ok := fullMap[groupID]; ok {
+			filtered[groupID] = users
+		}
+	}
+	return filtered
 }

management/server/types/account_networkmapdata.go

@@ -1,515 +0,0 @@
-package types
-
-import (
-	"github.com/miekg/dns"
-
-	nbdns "github.com/netbirdio/netbird/dns"
-	"github.com/netbirdio/netbird/management/internals/modules/zones"
-	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
-	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
-	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/posture"
-	nbroute "github.com/netbirdio/netbird/route"
-	"github.com/netbirdio/netbird/shared/management/networkmap"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-)
-
-// toNetworkMapData builds the slim twin store from the account once per
-// account. The per-peer components calculation then runs on the twin.
-func (a *Account) toNetworkMapData(
-	accountZones []*zones.Zone,
-	validatedPeersMap map[string]struct{},
-	resourcePolicies map[string][]*Policy,
-	routers map[string]map[string]*routerTypes.NetworkRouter,
-	groupIDToUserIDs map[string][]string,
-) *networkmap.NetworkMapData {
-	nmd := &networkmap.NetworkMapData{
-		Peers:                     make(map[string]*nmdata.Peer, len(a.Peers)),
-		Groups:                    make(map[string]*nmdata.Group, len(a.Groups)),
-		Policies:                  make([]*nmdata.Policy, 0, len(a.Policies)),
-		Routes:                    make([]*nmdata.Route, 0, len(a.Routes)),
-		NameServerGroups:          make([]*nmdata.NameServerGroup, 0, len(a.NameServerGroups)),
-		NetworkResources:          make([]*nmdata.NetworkResource, 0, len(a.NetworkResources)),
-		PostureChecks:             make(map[string]*nmdata.PostureChecks, len(a.PostureChecks)),
-		ResourcePolicies:          make(map[string][]*nmdata.Policy, len(resourcePolicies)),
-		Routers:                   make(map[string]map[string]*nmdata.NetworkRouter, len(routers)),
-		ValidatedPeers:            validatedPeersMap,
-		GroupIDToUserIDs:          groupIDToUserIDs,
-		AllowedUserIDs:            a.getAllowedUserIDs(),
-		NetworkXIDToPublicID:      make(map[string]string, len(a.Networks)),
-		PostureCheckXIDToPublicID: make(map[string]string, len(a.PostureChecks)),
-	}
-
-	if a.Network != nil {
-		nmd.Network = TwinNetwork(a.Network)
-	}
-	nmd.DNSSettings = &nmdata.DNSSettings{DisabledManagementGroups: a.DNSSettings.DisabledManagementGroups}
-	if a.Settings != nil {
-		nmd.AccountSettings = &nmdata.AccountSettingsInfo{
-			PeerLoginExpirationEnabled:      a.Settings.PeerLoginExpirationEnabled,
-			PeerLoginExpiration:             a.Settings.PeerLoginExpiration,
-			PeerInactivityExpirationEnabled: a.Settings.PeerInactivityExpirationEnabled,
-			PeerInactivityExpiration:        a.Settings.PeerInactivityExpiration,
-		}
-	}
-
-	for id, p := range a.Peers {
-		nmd.Peers[id] = twinPeer(p)
-	}
-	for id, g := range a.Groups {
-		nmd.Groups[id] = twinGroup(g)
-	}
-
-	policyCache := make(map[string]*nmdata.Policy, len(a.Policies))
-	twinPol := func(p *Policy) *nmdata.Policy {
-		if p == nil {
-			return nil
-		}
-		if tp, ok := policyCache[p.ID]; ok {
-			return tp
-		}
-		tp := twinPolicy(p)
-		policyCache[p.ID] = tp
-		return tp
-	}
-	for _, p := range a.Policies {
-		nmd.Policies = append(nmd.Policies, twinPol(p))
-	}
-	for resID, pols := range resourcePolicies {
-		twinPols := make([]*nmdata.Policy, 0, len(pols))
-		for _, p := range pols {
-			twinPols = append(twinPols, twinPol(p))
-		}
-		nmd.ResourcePolicies[resID] = twinPols
-	}
-
-	for _, r := range a.Routes {
-		if r == nil {
-			continue
-		}
-		nmd.Routes = append(nmd.Routes, twinRoute(r))
-	}
-	for _, nsg := range a.NameServerGroups {
-		nmd.NameServerGroups = append(nmd.NameServerGroups, twinNSG(nsg))
-	}
-	for _, res := range a.NetworkResources {
-		nmd.NetworkResources = append(nmd.NetworkResources, twinNetworkResource(res))
-	}
-	for _, pc := range a.PostureChecks {
-		if pc != nil {
-			nmd.PostureChecks[pc.ID] = twinPostureChecks(pc)
-			nmd.PostureCheckXIDToPublicID[pc.ID] = pc.PublicID
-		}
-	}
-	for _, n := range a.Networks {
-		if n != nil {
-			nmd.NetworkXIDToPublicID[n.ID] = n.PublicID
-		}
-	}
-	for networkID, inner := range routers {
-		twinInner := make(map[string]*nmdata.NetworkRouter, len(inner))
-		for peerID, router := range inner {
-			twinInner[peerID] = twinRouter(router)
-		}
-		nmd.Routers[networkID] = twinInner
-	}
-
-	nmd.AppliedZoneCandidates = buildAppliedZoneCandidates(accountZones)
-	nmd.PrivateServiceCandidates = a.buildPrivateServiceCandidates()
-
-	return nmd
-}
-
-func twinPeer(p *nbpeer.Peer) *nmdata.Peer {
-	if p == nil {
-		return nil
-	}
-	networkAddresses := make([]nmdata.NetworkAddress, 0, len(p.Meta.NetworkAddresses))
-	for _, na := range p.Meta.NetworkAddresses {
-		networkAddresses = append(networkAddresses, nmdata.NetworkAddress{NetIP: na.NetIP})
-	}
-	files := make([]nmdata.File, 0, len(p.Meta.Files))
-	for _, f := range p.Meta.Files {
-		files = append(files, nmdata.File{Path: f.Path, ProcessIsRunning: f.ProcessIsRunning})
-	}
-	return &nmdata.Peer{
-		ID:                     p.ID,
-		Key:                    p.Key,
-		SSHKey:                 p.SSHKey,
-		DNSLabel:               p.DNSLabel,
-		UserID:                 p.UserID,
-		SSHEnabled:             p.SSHEnabled,
-		LoginExpirationEnabled: p.LoginExpirationEnabled,
-		LastLogin:              p.LastLogin,
-		IP:                     p.IP,
-		IPv6:                   p.IPv6,
-		Meta: nmdata.PeerSystemMeta{
-			WtVersion:        p.Meta.WtVersion,
-			GoOS:             p.Meta.GoOS,
-			OSVersion:        p.Meta.OSVersion,
-			KernelVersion:    p.Meta.KernelVersion,
-			NetworkAddresses: networkAddresses,
-			Files:            files,
-			Capabilities:     p.Meta.Capabilities,
-			Flags: nmdata.Flags{
-				ServerSSHAllowed: p.Meta.Flags.ServerSSHAllowed,
-				DisableIPv6:      p.Meta.Flags.DisableIPv6,
-			},
-		},
-		Location: nmdata.PeerLocation{
-			CountryCode:  p.Location.CountryCode,
-			CityName:     p.Location.CityName,
-			ConnectionIP: p.Location.ConnectionIP,
-		},
-	}
-}
-
-// TwinPeer converts a real peer to its slim nmdata twin. Exported for the
-// port-forwarding integration, which builds proxy NetworkMaps holding twins.
-func TwinPeer(p *nbpeer.Peer) *nmdata.Peer {
-	return twinPeer(p)
-}
-
-func twinPeers(peers []*nbpeer.Peer) []*nmdata.Peer {
-	out := make([]*nmdata.Peer, len(peers))
-	for i, p := range peers {
-		out[i] = twinPeer(p)
-	}
-	return out
-}
-
-func twinGroup(g *Group) *nmdata.Group {
-	if g == nil {
-		return nil
-	}
-	return &nmdata.Group{
-		Name:     g.Name,
-		PublicID: g.PublicID,
-		Peers:    g.Peers,
-	}
-}
-
-func twinPolicy(p *Policy) *nmdata.Policy {
-	if p == nil {
-		return nil
-	}
-	rules := make([]*nmdata.PolicyRule, 0, len(p.Rules))
-	for _, r := range p.Rules {
-		rules = append(rules, twinRule(r))
-	}
-	return &nmdata.Policy{
-		ID:                  p.ID,
-		PublicID:            p.PublicID,
-		Enabled:             p.Enabled,
-		SourcePostureChecks: p.SourcePostureChecks,
-		Rules:               rules,
-	}
-}
-
-func twinRule(r *PolicyRule) *nmdata.PolicyRule {
-	if r == nil {
-		return nil
-	}
-	var portRanges []nmdata.RulePortRange
-	if r.PortRanges != nil {
-		portRanges = make([]nmdata.RulePortRange, len(r.PortRanges))
-		for i, pr := range r.PortRanges {
-			portRanges[i] = nmdata.RulePortRange{Start: pr.Start, End: pr.End}
-		}
-	}
-	return &nmdata.PolicyRule{
-		ID:                  r.ID,
-		PolicyID:            r.PolicyID,
-		Enabled:             r.Enabled,
-		Action:              string(r.Action),
-		Protocol:            string(r.Protocol),
-		Bidirectional:       r.Bidirectional,
-		Sources:             r.Sources,
-		Destinations:        r.Destinations,
-		SourceResource:      nmdata.Resource{ID: r.SourceResource.ID, Type: string(r.SourceResource.Type)},
-		DestinationResource: nmdata.Resource{ID: r.DestinationResource.ID, Type: string(r.DestinationResource.Type)},
-		Ports:               r.Ports,
-		PortRanges:          portRanges,
-		AuthorizedGroups:    r.AuthorizedGroups,
-		AuthorizedUser:      r.AuthorizedUser,
-	}
-}
-
-func twinRoute(r *nbroute.Route) *nmdata.Route {
-	return &nmdata.Route{
-		ID:                  string(r.ID),
-		AccountID:           r.AccountID,
-		PublicID:            r.PublicID,
-		Network:             r.Network,
-		Domains:             r.Domains,
-		KeepRoute:           r.KeepRoute,
-		NetID:               string(r.NetID),
-		Description:         r.Description,
-		Peer:                r.Peer,
-		PeerID:              r.PeerID,
-		PeerGroups:          r.PeerGroups,
-		NetworkType:         int(r.NetworkType),
-		Masquerade:          r.Masquerade,
-		Metric:              r.Metric,
-		Enabled:             r.Enabled,
-		Groups:              r.Groups,
-		AccessControlGroups: r.AccessControlGroups,
-		SkipAutoApply:       r.SkipAutoApply,
-	}
-}
-
-// TwinRoute converts a real *route.Route to its slim nmdata twin. Exported for
-// tests that assert against twin routes returned in a NetworkMap.
-func TwinRoute(r *nbroute.Route) *nmdata.Route {
-	return twinRoute(r)
-}
-
-func twinNetworkResource(r *resourceTypes.NetworkResource) *nmdata.NetworkResource {
-	if r == nil {
-		return nil
-	}
-	return &nmdata.NetworkResource{
-		ID:          r.ID,
-		NetworkID:   r.NetworkID,
-		AccountID:   r.AccountID,
-		PublicID:    r.PublicID,
-		Name:        r.Name,
-		Description: r.Description,
-		Type:        string(r.Type),
-		Address:     r.Address,
-		Domain:      r.Domain,
-		Prefix:      r.Prefix,
-		Enabled:     r.Enabled,
-	}
-}
-
-func twinRouter(r *routerTypes.NetworkRouter) *nmdata.NetworkRouter {
-	if r == nil {
-		return nil
-	}
-	return &nmdata.NetworkRouter{
-		PublicID:   r.PublicID,
-		PeerGroups: r.PeerGroups,
-		Masquerade: r.Masquerade,
-		Metric:     r.Metric,
-		Enabled:    r.Enabled,
-	}
-}
-
-func twinNSG(n *nbdns.NameServerGroup) *nmdata.NameServerGroup {
-	if n == nil {
-		return nil
-	}
-	nameServers := make([]nmdata.NameServer, 0, len(n.NameServers))
-	for _, ns := range n.NameServers {
-		nameServers = append(nameServers, nmdata.NameServer{
-			IP:     ns.IP,
-			NSType: int(ns.NSType),
-			Port:   ns.Port,
-		})
-	}
-	return &nmdata.NameServerGroup{
-		ID:                   n.ID,
-		PublicID:             n.PublicID,
-		Name:                 n.Name,
-		Description:          n.Description,
-		NameServers:          nameServers,
-		Groups:               n.Groups,
-		Primary:              n.Primary,
-		Domains:              n.Domains,
-		Enabled:              n.Enabled,
-		SearchDomainsEnabled: n.SearchDomainsEnabled,
-	}
-}
-
-// TwinNetwork converts a real *Network to its slim twin. Exported for the
-// graceful-degrade path that builds a minimal NetworkMapComponents directly.
-func TwinNetwork(n *Network) *nmdata.Network {
-	nc := n.Copy()
-	return &nmdata.Network{
-		Identifier: nc.Identifier,
-		Net:        nc.Net,
-		NetV6:      nc.NetV6,
-		Dns:        nc.Dns,
-		Serial:     nc.Serial,
-	}
-}
-
-func twinPostureChecks(pc *posture.Checks) *nmdata.PostureChecks {
-	if pc == nil {
-		return nil
-	}
-	out := &nmdata.PostureChecks{ID: pc.ID}
-	def := pc.Checks
-	if def.NBVersionCheck != nil {
-		out.Checks.NBVersionCheck = &nmdata.NBVersionCheck{MinVersion: def.NBVersionCheck.MinVersion}
-	}
-	if def.OSVersionCheck != nil {
-		oc := &nmdata.OSVersionCheck{}
-		if def.OSVersionCheck.Android != nil {
-			oc.Android = &nmdata.MinVersionCheck{MinVersion: def.OSVersionCheck.Android.MinVersion}
-		}
-		if def.OSVersionCheck.Darwin != nil {
-			oc.Darwin = &nmdata.MinVersionCheck{MinVersion: def.OSVersionCheck.Darwin.MinVersion}
-		}
-		if def.OSVersionCheck.Ios != nil {
-			oc.Ios = &nmdata.MinVersionCheck{MinVersion: def.OSVersionCheck.Ios.MinVersion}
-		}
-		if def.OSVersionCheck.Linux != nil {
-			oc.Linux = &nmdata.MinKernelVersionCheck{MinKernelVersion: def.OSVersionCheck.Linux.MinKernelVersion}
-		}
-		if def.OSVersionCheck.Windows != nil {
-			oc.Windows = &nmdata.MinKernelVersionCheck{MinKernelVersion: def.OSVersionCheck.Windows.MinKernelVersion}
-		}
-		out.Checks.OSVersionCheck = oc
-	}
-	if def.GeoLocationCheck != nil {
-		gc := &nmdata.GeoLocationCheck{Action: def.GeoLocationCheck.Action}
-		for _, loc := range def.GeoLocationCheck.Locations {
-			gc.Locations = append(gc.Locations, nmdata.GeoLocation{CountryCode: loc.CountryCode, CityName: loc.CityName})
-		}
-		out.Checks.GeoLocationCheck = gc
-	}
-	if def.PeerNetworkRangeCheck != nil {
-		out.Checks.PeerNetworkRangeCheck = &nmdata.PeerNetworkRangeCheck{
-			Action: def.PeerNetworkRangeCheck.Action,
-			Ranges: def.PeerNetworkRangeCheck.Ranges,
-		}
-	}
-	if def.ProcessCheck != nil {
-		procs := make([]nmdata.Process, 0, len(def.ProcessCheck.Processes))
-		for _, p := range def.ProcessCheck.Processes {
-			procs = append(procs, nmdata.Process{LinuxPath: p.LinuxPath, MacPath: p.MacPath, WindowsPath: p.WindowsPath})
-		}
-		out.Checks.ProcessCheck = &nmdata.ProcessCheck{Processes: procs}
-	}
-	return out
-}
-
-// buildAppliedZoneCandidates precomputes the account-level custom DNS zones
-// (record conversion) once; the per-peer distribution-group gate runs in the
-// components calc. Mirrors the account-level half of filterPeerAppliedZones.
-func buildAppliedZoneCandidates(accountZones []*zones.Zone) []networkmap.AppliedZoneCandidate {
-	var out []networkmap.AppliedZoneCandidate
-	for _, zone := range accountZones {
-		if !zone.Enabled || len(zone.Records) == 0 {
-			continue
-		}
-		simpleRecords := make([]nmdata.SimpleRecord, 0, len(zone.Records))
-		for _, record := range zone.Records {
-			var recordType int
-			rData := record.Content
-			switch record.Type {
-			case records.RecordTypeA:
-				recordType = int(dns.TypeA)
-			case records.RecordTypeAAAA:
-				recordType = int(dns.TypeAAAA)
-			case records.RecordTypeCNAME:
-				recordType = int(dns.TypeCNAME)
-				rData = dns.Fqdn(record.Content)
-			default:
-				continue
-			}
-			simpleRecords = append(simpleRecords, nmdata.SimpleRecord{
-				Name:  dns.Fqdn(record.Name),
-				Type:  recordType,
-				Class: nbdns.DefaultClass,
-				TTL:   record.TTL,
-				RData: rData,
-			})
-		}
-		out = append(out, networkmap.AppliedZoneCandidate{
-			DistributionGroups: zone.DistributionGroups,
-			Zone: nmdata.CustomZone{
-				Domain:               dns.Fqdn(zone.Domain),
-				Records:              simpleRecords,
-				SearchDomainDisabled: !zone.EnableSearchDomain,
-				NonAuthoritative:     true,
-			},
-		})
-	}
-	return out
-}
-
-// buildPrivateServiceCandidates precomputes the connected-proxy A records per
-// private service (account-level); the per-peer access-group gate + apex merge
-// run in the components calc. Mirrors the account-level half of
-// SynthesizePrivateServiceZones.
-func (a *Account) buildPrivateServiceCandidates() []networkmap.PrivateServiceCandidate {
-	if len(a.Services) == 0 {
-		return nil
-	}
-	proxyPeersByCluster := a.GetProxyPeers()
-	if len(proxyPeersByCluster) == 0 {
-		return nil
-	}
-
-	var out []networkmap.PrivateServiceCandidate
-	for _, svc := range a.Services {
-		if svc == nil || !svc.Enabled || !svc.Private {
-			continue
-		}
-		if len(svc.AccessGroups) == 0 {
-			continue
-		}
-		proxyPeers := proxyPeersByCluster[svc.ProxyCluster]
-		if len(proxyPeers) == 0 {
-			continue
-		}
-		apex := a.privateServiceDomainZone(svc)
-		if apex == "" {
-			continue
-		}
-
-		var recs []nmdata.SimpleRecord
-		for _, p := range proxyPeers {
-			if p == nil || !p.IP.IsValid() {
-				continue
-			}
-			if p.Status == nil || !p.Status.Connected {
-				continue
-			}
-			recs = append(recs, nmdata.SimpleRecord{
-				Name:  dns.Fqdn(svc.Domain),
-				Type:  int(dns.TypeA),
-				Class: nbdns.DefaultClass,
-				TTL:   privateServiceDNSRecordTTL,
-				RData: p.IP.String(),
-			})
-		}
-		if len(recs) == 0 {
-			continue
-		}
-
-		out = append(out, networkmap.PrivateServiceCandidate{
-			AccessGroups: svc.AccessGroups,
-			Zone: nmdata.CustomZone{
-				Domain:               dns.Fqdn(apex),
-				Records:              recs,
-				NonAuthoritative:     true,
-				SearchDomainDisabled: true,
-			},
-		})
-	}
-	return out
-}
-
-func toTwinCustomZone(z nbdns.CustomZone) nmdata.CustomZone {
-	records := make([]nmdata.SimpleRecord, 0, len(z.Records))
-	for _, r := range z.Records {
-		records = append(records, nmdata.SimpleRecord{
-			Name:  r.Name,
-			Type:  r.Type,
-			Class: r.Class,
-			TTL:   r.TTL,
-			RData: r.RData,
-		})
-	}
-	return nmdata.CustomZone{
-		Domain:               z.Domain,
-		Records:              records,
-		SearchDomainDisabled: z.SearchDomainDisabled,
-		NonAuthoritative:     z.NonAuthoritative,
-	}
-}

management/server/types/account_private_netmap_test.go

@@ -9,7 +9,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	nbdns "github.com/netbirdio/netbird/dns"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 func TestPrivateService_NetworkMap_UserPeer_AndProxyPeer(t *testing.T) {
@@ -49,7 +48,7 @@ func TestPrivateService_NetworkMap_UserPeer_AndProxyPeer(t *testing.T) {
 	})
 }
 
-func netmapPeerIDs(peers []*nmdata.Peer) []string {
+func netmapPeerIDs(peers []*ComponentPeer) []string {
 	ids := make([]string, 0, len(peers))
 	for _, p := range peers {
 		if p == nil {

management/server/types/account_test.go

@@ -13,6 +13,8 @@ import (
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/internals/modules/zones"
+	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -664,7 +666,7 @@ func Test_ExpandPortsAndRanges_SSHRuleExpansion(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result := ExpandPortsAndRanges(tt.base, tt.rule, tt.peer)
+			result := ExpandPortsAndRanges(tt.base, tt.rule, tt.peer.ToComponent())
 
 			var ports []string
 			for _, fr := range result {
@@ -1038,6 +1040,518 @@ func Test_FilterZoneRecordsForPeers(t *testing.T) {
 	}
 }
 
+func Test_filterPeerAppliedZones(t *testing.T) {
+	ctx := context.Background()
+
+	tests := []struct {
+		name         string
+		accountZones []*zones.Zone
+		peerGroups   LookupMap
+		expected     []nbdns.CustomZone
+	}{
+		{
+			name:         "empty peer groups returns empty custom zones",
+			accountZones: []*zones.Zone{},
+			peerGroups:   LookupMap{},
+			expected:     []nbdns.CustomZone{},
+		},
+		{
+			name: "peer has access to zone with A record",
+			accountZones: []*zones.Zone{
+				{
+					ID:                 "zone1",
+					Domain:             "example.com",
+					Enabled:            true,
+					EnableSearchDomain: false,
+					DistributionGroups: []string{"group1"},
+					Records: []*records.Record{
+						{
+							ID:      "record1",
+							Name:    "www.example.com",
+							Type:    records.RecordTypeA,
+							Content: "192.168.1.1",
+							TTL:     300,
+						},
+					},
+				},
+			},
+			peerGroups: LookupMap{"group1": struct{}{}},
+			expected: []nbdns.CustomZone{
+				{
+					Domain: "example.com.",
+					Records: []nbdns.SimpleRecord{
+						{
+							Name:  "www.example.com.",
+							Type:  int(dns.TypeA),
+							Class: nbdns.DefaultClass,
+							TTL:   300,
+							RData: "192.168.1.1",
+						},
+					},
+					SearchDomainDisabled: true,
+				},
+			},
+		},
+		{
+			name: "peer has access to zone with search domain enabled",
+			accountZones: []*zones.Zone{
+				{
+					ID:                 "zone1",
+					Domain:             "internal.local",
+					Enabled:            true,
+					EnableSearchDomain: true,
+					DistributionGroups: []string{"group1"},
+					Records: []*records.Record{
+						{
+							ID:      "record1",
+							Name:    "api.internal.local",
+							Type:    records.RecordTypeA,
+							Content: "10.0.0.1",
+							TTL:     600,
+						},
+					},
+				},
+			},
+			peerGroups: LookupMap{"group1": struct{}{}},
+			expected: []nbdns.CustomZone{
+				{
+					Domain: "internal.local.",
+					Records: []nbdns.SimpleRecord{
+						{
+							Name:  "api.internal.local.",
+							Type:  int(dns.TypeA),
+							Class: nbdns.DefaultClass,
+							TTL:   600,
+							RData: "10.0.0.1",
+						},
+					},
+					SearchDomainDisabled: false,
+				},
+			},
+		},
+		{
+			name: "peer has no access to zone",
+			accountZones: []*zones.Zone{
+				{
+					ID:                 "zone1",
+					Domain:             "private.com",
+					Enabled:            true,
+					EnableSearchDomain: false,
+					DistributionGroups: []string{"group2"},
+					Records: []*records.Record{
+						{
+							ID:      "record1",
+							Name:    "secret.private.com",
+							Type:    records.RecordTypeA,
+							Content: "192.168.1.1",
+							TTL:     300,
+						},
+					},
+				},
+			},
+			peerGroups: LookupMap{"group1": struct{}{}},
+			expected:   []nbdns.CustomZone{},
+		},
+		{
+			name: "disabled zone is filtered out",
+			accountZones: []*zones.Zone{
+				{
+					ID:                 "zone1",
+					Domain:             "disabled.com",
+					Enabled:            false,
+					EnableSearchDomain: false,
+					DistributionGroups: []string{"group1"},
+					Records: []*records.Record{
+						{
+							ID:      "record1",
+							Name:    "www.disabled.com",
+							Type:    records.RecordTypeA,
+							Content: "192.168.1.1",
+							TTL:     300,
+						},
+					},
+				},
+			},
+			peerGroups: LookupMap{"group1": struct{}{}},
+			expected:   []nbdns.CustomZone{},
+		},
+		{
+			name: "zone with no records is filtered out",
+			accountZones: []*zones.Zone{
+				{
+					ID:                 "zone1",
+					Domain:             "empty.com",
+					Enabled:            true,
+					EnableSearchDomain: false,
+					DistributionGroups: []string{"group1"},
+					Records:            []*records.Record{},
+				},
+			},
+			peerGroups: LookupMap{"group1": struct{}{}},
+			expected:   []nbdns.CustomZone{},
+		},
+		{
+			name: "peer has access via multiple groups",
+			accountZones: []*zones.Zone{
+				{
+					ID:                 "zone1",
+					Domain:             "multi.com",
+					Enabled:            true,
+					EnableSearchDomain: false,
+					DistributionGroups: []string{"group1", "group2", "group3"},
+					Records: []*records.Record{
+						{
+							ID:      "record1",
+							Name:    "www.multi.com",
+							Type:    records.RecordTypeA,
+							Content: "192.168.1.1",
+							TTL:     300,
+						},
+					},
+				},
+			},
+			peerGroups: LookupMap{"group2": struct{}{}},
+			expected: []nbdns.CustomZone{
+				{
+					Domain: "multi.com.",
+					Records: []nbdns.SimpleRecord{
+						{
+							Name:  "www.multi.com.",
+							Type:  int(dns.TypeA),
+							Class: nbdns.DefaultClass,
+							TTL:   300,
+							RData: "192.168.1.1",
+						},
+					},
+					SearchDomainDisabled: true,
+				},
+			},
+		},
+		{
+			name: "multiple zones with mixed access",
+			accountZones: []*zones.Zone{
+				{
+					ID:                 "zone1",
+					Domain:             "allowed.com",
+					Enabled:            true,
+					EnableSearchDomain: false,
+					DistributionGroups: []string{"group1"},
+					Records: []*records.Record{
+						{
+							ID:      "record1",
+							Name:    "www.allowed.com",
+							Type:    records.RecordTypeA,
+							Content: "192.168.1.1",
+							TTL:     300,
+						},
+					},
+				},
+				{
+					ID:                 "zone2",
+					Domain:             "denied.com",
+					Enabled:            true,
+					EnableSearchDomain: false,
+					DistributionGroups: []string{"group2"},
+					Records: []*records.Record{
+						{
+							ID:      "record2",
+							Name:    "www.denied.com",
+							Type:    records.RecordTypeA,
+							Content: "192.168.1.2",
+							TTL:     300,
+						},
+					},
+				},
+			},
+			peerGroups: LookupMap{"group1": struct{}{}},
+			expected: []nbdns.CustomZone{
+				{
+					Domain: "allowed.com.",
+					Records: []nbdns.SimpleRecord{
+						{
+							Name:  "www.allowed.com.",
+							Type:  int(dns.TypeA),
+							Class: nbdns.DefaultClass,
+							TTL:   300,
+							RData: "192.168.1.1",
+						},
+					},
+					SearchDomainDisabled: true,
+				},
+			},
+		},
+		{
+			name: "zone with multiple record types",
+			accountZones: []*zones.Zone{
+				{
+					ID:                 "zone1",
+					Domain:             "mixed.com",
+					Enabled:            true,
+					EnableSearchDomain: false,
+					DistributionGroups: []string{"group1"},
+					Records: []*records.Record{
+						{
+							ID:      "record1",
+							Name:    "www.mixed.com",
+							Type:    records.RecordTypeA,
+							Content: "192.168.1.1",
+							TTL:     300,
+						},
+						{
+							ID:      "record2",
+							Name:    "ipv6.mixed.com",
+							Type:    records.RecordTypeAAAA,
+							Content: "2001:db8::1",
+							TTL:     600,
+						},
+						{
+							ID:      "record3",
+							Name:    "alias.mixed.com",
+							Type:    records.RecordTypeCNAME,
+							Content: "www.mixed.com",
+							TTL:     900,
+						},
+					},
+				},
+			},
+			peerGroups: LookupMap{"group1": struct{}{}},
+			expected: []nbdns.CustomZone{
+				{
+					Domain: "mixed.com.",
+					Records: []nbdns.SimpleRecord{
+						{
+							Name:  "www.mixed.com.",
+							Type:  int(dns.TypeA),
+							Class: nbdns.DefaultClass,
+							TTL:   300,
+							RData: "192.168.1.1",
+						},
+						{
+							Name:  "ipv6.mixed.com.",
+							Type:  int(dns.TypeAAAA),
+							Class: nbdns.DefaultClass,
+							TTL:   600,
+							RData: "2001:db8::1",
+						},
+						{
+							Name:  "alias.mixed.com.",
+							Type:  int(dns.TypeCNAME),
+							Class: nbdns.DefaultClass,
+							TTL:   900,
+							RData: "www.mixed.com.",
+						},
+					},
+					SearchDomainDisabled: true,
+				},
+			},
+		},
+		{
+			name: "multiple zones both accessible",
+			accountZones: []*zones.Zone{
+				{
+					ID:                 "zone1",
+					Domain:             "first.com",
+					Enabled:            true,
+					EnableSearchDomain: true,
+					DistributionGroups: []string{"group1"},
+					Records: []*records.Record{
+						{
+							ID:      "record1",
+							Name:    "www.first.com",
+							Type:    records.RecordTypeA,
+							Content: "192.168.1.1",
+							TTL:     300,
+						},
+					},
+				},
+				{
+					ID:                 "zone2",
+					Domain:             "second.com",
+					Enabled:            true,
+					EnableSearchDomain: false,
+					DistributionGroups: []string{"group1"},
+					Records: []*records.Record{
+						{
+							ID:      "record2",
+							Name:    "www.second.com",
+							Type:    records.RecordTypeA,
+							Content: "192.168.1.2",
+							TTL:     600,
+						},
+					},
+				},
+			},
+			peerGroups: LookupMap{"group1": struct{}{}},
+			expected: []nbdns.CustomZone{
+				{
+					Domain: "first.com.",
+					Records: []nbdns.SimpleRecord{
+						{
+							Name:  "www.first.com.",
+							Type:  int(dns.TypeA),
+							Class: nbdns.DefaultClass,
+							TTL:   300,
+							RData: "192.168.1.1",
+						},
+					},
+					SearchDomainDisabled: false,
+				},
+				{
+					Domain: "second.com.",
+					Records: []nbdns.SimpleRecord{
+						{
+							Name:  "www.second.com.",
+							Type:  int(dns.TypeA),
+							Class: nbdns.DefaultClass,
+							TTL:   600,
+							RData: "192.168.1.2",
+						},
+					},
+					SearchDomainDisabled: true,
+				},
+			},
+		},
+		{
+			name: "zone with multiple records of same type",
+			accountZones: []*zones.Zone{
+				{
+					ID:                 "zone1",
+					Domain:             "multi-a.com",
+					Enabled:            true,
+					EnableSearchDomain: false,
+					DistributionGroups: []string{"group1"},
+					Records: []*records.Record{
+						{
+							ID:      "record1",
+							Name:    "www.multi-a.com",
+							Type:    records.RecordTypeA,
+							Content: "192.168.1.1",
+							TTL:     300,
+						},
+						{
+							ID:      "record2",
+							Name:    "www.multi-a.com",
+							Type:    records.RecordTypeA,
+							Content: "192.168.1.2",
+							TTL:     300,
+						},
+					},
+				},
+			},
+			peerGroups: LookupMap{"group1": struct{}{}},
+			expected: []nbdns.CustomZone{
+				{
+					Domain: "multi-a.com.",
+					Records: []nbdns.SimpleRecord{
+						{
+							Name:  "www.multi-a.com.",
+							Type:  int(dns.TypeA),
+							Class: nbdns.DefaultClass,
+							TTL:   300,
+							RData: "192.168.1.1",
+						},
+						{
+							Name:  "www.multi-a.com.",
+							Type:  int(dns.TypeA),
+							Class: nbdns.DefaultClass,
+							TTL:   300,
+							RData: "192.168.1.2",
+						},
+					},
+					SearchDomainDisabled: true,
+				},
+			},
+		},
+		{
+			name: "peer in multiple groups accessing different zones",
+			accountZones: []*zones.Zone{
+				{
+					ID:                 "zone1",
+					Domain:             "zone1.com",
+					Enabled:            true,
+					EnableSearchDomain: false,
+					DistributionGroups: []string{"group1"},
+					Records: []*records.Record{
+						{
+							ID:      "record1",
+							Name:    "www.zone1.com",
+							Type:    records.RecordTypeA,
+							Content: "192.168.1.1",
+							TTL:     300,
+						},
+					},
+				},
+				{
+					ID:                 "zone2",
+					Domain:             "zone2.com",
+					Enabled:            true,
+					EnableSearchDomain: false,
+					DistributionGroups: []string{"group2"},
+					Records: []*records.Record{
+						{
+							ID:      "record2",
+							Name:    "www.zone2.com",
+							Type:    records.RecordTypeA,
+							Content: "192.168.1.2",
+							TTL:     300,
+						},
+					},
+				},
+			},
+			peerGroups: LookupMap{"group1": struct{}{}, "group2": struct{}{}},
+			expected: []nbdns.CustomZone{
+				{
+					Domain: "zone1.com.",
+					Records: []nbdns.SimpleRecord{
+						{
+							Name:  "www.zone1.com.",
+							Type:  int(dns.TypeA),
+							Class: nbdns.DefaultClass,
+							TTL:   300,
+							RData: "192.168.1.1",
+						},
+					},
+					SearchDomainDisabled: true,
+				},
+				{
+					Domain: "zone2.com.",
+					Records: []nbdns.SimpleRecord{
+						{
+							Name:  "www.zone2.com.",
+							Type:  int(dns.TypeA),
+							Class: nbdns.DefaultClass,
+							TTL:   300,
+							RData: "192.168.1.2",
+						},
+					},
+					SearchDomainDisabled: true,
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := filterPeerAppliedZones(ctx, tt.accountZones, tt.peerGroups)
+			require.Equal(t, len(tt.expected), len(result), "number of custom zones should match")
+
+			for i, expectedZone := range tt.expected {
+				assert.Equal(t, expectedZone.Domain, result[i].Domain, "domain should match")
+				assert.Equal(t, expectedZone.SearchDomainDisabled, result[i].SearchDomainDisabled, "search domain disabled flag should match")
+				assert.Equal(t, len(expectedZone.Records), len(result[i].Records), "number of records should match")
+
+				for j, expectedRecord := range expectedZone.Records {
+					assert.Equal(t, expectedRecord.Name, result[i].Records[j].Name, "record name should match")
+					assert.Equal(t, expectedRecord.Type, result[i].Records[j].Type, "record type should match")
+					assert.Equal(t, expectedRecord.Class, result[i].Records[j].Class, "record class should match")
+					assert.Equal(t, expectedRecord.TTL, result[i].Records[j].TTL, "record TTL should match")
+					assert.Equal(t, expectedRecord.RData, result[i].Records[j].RData, "record RData should match")
+				}
+			}
+		})
+	}
+}
+
 func TestInjectPrivateServicePolicies_ProxyPeerGetsInboundRule(t *testing.T) {
 	ctx := context.Background()
 

management/server/types/aliases.go

@@ -6,7 +6,6 @@ import (
 	"net"
 	"net/netip"
 
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	nbroute "github.com/netbirdio/netbird/route"
 	sharedtypes "github.com/netbirdio/netbird/shared/management/types"
 )
@@ -18,9 +17,6 @@ type DNSSettings = sharedtypes.DNSSettings
 
 type FirewallRule = sharedtypes.FirewallRule
 
-type Group = sharedtypes.Group
-type GroupPeer = sharedtypes.GroupPeer
-
 type Network = sharedtypes.Network
 type NetworkMap = sharedtypes.NetworkMap
 type ForwardingRule = sharedtypes.ForwardingRule
@@ -42,6 +38,18 @@ type RouteFirewallRule = sharedtypes.RouteFirewallRule
 
 type NetworkMapComponents = sharedtypes.NetworkMapComponents
 
+type ComponentPeer = sharedtypes.ComponentPeer
+type ComponentGroup = sharedtypes.ComponentGroup
+type ComponentRouter = sharedtypes.ComponentRouter
+type ComponentResource = sharedtypes.ComponentResource
+type ComponentResourceType = sharedtypes.ComponentResourceType
+
+const (
+	ComponentResourceHost   = sharedtypes.ComponentResourceHost
+	ComponentResourceSubnet = sharedtypes.ComponentResourceSubnet
+	ComponentResourceDomain = sharedtypes.ComponentResourceDomain
+)
+
 var EmptyNetworkMapComponents = sharedtypes.EmptyNetworkMapComponents
 
 type AccountSettingsInfo = sharedtypes.AccountSettingsInfo
@@ -52,12 +60,7 @@ type NetworkMapComponentsCompact = sharedtypes.NetworkMapComponentsCompact
 type LookupMap = sharedtypes.LookupMap
 type FirewallRuleContext = sharedtypes.FirewallRuleContext
 
-const (
-	GroupIssuedAPI         = sharedtypes.GroupIssuedAPI
-	GroupIssuedJWT         = sharedtypes.GroupIssuedJWT
-	GroupIssuedIntegration = sharedtypes.GroupIssuedIntegration
-	GroupAllName           = sharedtypes.GroupAllName
-)
+const GroupAllName = sharedtypes.GroupAllName
 
 // Function forwarders preserve types.X(...) call sites that previously
 // resolved to package-local funcs. Plain forwarders (not var aliases) keep
@@ -67,24 +70,20 @@ func PolicyRuleImpliesLegacySSH(rule *PolicyRule) bool {
 	return sharedtypes.PolicyRuleImpliesLegacySSH(rule)
 }
 
-// ExpandPortsAndRanges / AppendIPv6FirewallRule / GenerateRouteFirewallRules
-// forward to the shared twin-typed helpers, converting the real types the
-// legacy Account calc still uses to nmdata twins at this boundary.
-
-func ExpandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *nbpeer.Peer) []*FirewallRule {
-	return sharedtypes.ExpandPortsAndRanges(base, twinRule(rule), twinPeer(peer))
+func ExpandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *ComponentPeer) []*FirewallRule {
+	return sharedtypes.ExpandPortsAndRanges(base, rule, peer)
 }
 
-func AppendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *nbpeer.Peer, rule *PolicyRule, rc FirewallRuleContext) []*FirewallRule {
-	return sharedtypes.AppendIPv6FirewallRule(rules, rulesExists, twinPeer(peer), twinPeer(targetPeer), twinRule(rule), rc)
+func AppendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *ComponentPeer, rule *PolicyRule, rc FirewallRuleContext) []*FirewallRule {
+	return sharedtypes.AppendIPv6FirewallRule(rules, rulesExists, peer, targetPeer, rule, rc)
 }
 
 func CalculateNetworkMapFromComponents(ctx context.Context, components *NetworkMapComponents) *NetworkMap {
 	return sharedtypes.CalculateNetworkMapFromComponents(ctx, components)
 }
 
-func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int, includeIPv6 bool) []*RouteFirewallRule {
-	return sharedtypes.GenerateRouteFirewallRules(ctx, twinRoute(route), twinRule(rule), twinPeers(groupPeers), direction, includeIPv6)
+func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*ComponentPeer, direction int, includeIPv6 bool) []*RouteFirewallRule {
+	return sharedtypes.GenerateRouteFirewallRules(ctx, route, rule, groupPeers, direction, includeIPv6)
 }
 
 func AllocateIPv6Subnet(r *rand.Rand) net.IPNet {

management/server/types/group.go

@@ -2,7 +2,6 @@ package types
 
 import (
 	"github.com/netbirdio/netbird/management/server/integration_reference"
-	"github.com/netbirdio/netbird/management/server/networks/resources/types"
 )
 
 const (
@@ -68,10 +67,6 @@ func (g *Group) EventMeta() map[string]any {
 	return map[string]any{"name": g.Name}
 }
 
-func (g *Group) EventMetaResource(resource *types.NetworkResource) map[string]any {
-	return map[string]any{"name": g.Name, "id": g.ID, "resource_name": resource.Name, "resource_id": resource.ID, "resource_type": resource.Type}
-}
-
 func (g *Group) Copy() *Group {
 	group := &Group{
 		ID:                   g.ID,
@@ -95,14 +90,39 @@ func (g *Group) HasPeers() bool {
 	return len(g.Peers) > 0
 }
 
-// GroupAllName is the reserved name of the default group that contains every peer in an account.
-const GroupAllName = "All"
-
 // IsGroupAll checks if the group is a default "All" group.
 func (g *Group) IsGroupAll() bool {
 	return g.Name == GroupAllName
 }
 
+// ToComponent converts the group to its self-contained components
+// representation. The Peers slice is shared, not copied — components are
+// treated as immutable snapshots. Returns nil for a nil group.
+func (g *Group) ToComponent() *ComponentGroup {
+	if g == nil {
+		return nil
+	}
+	return &ComponentGroup{
+		ID:       g.ID,
+		PublicID: g.PublicID,
+		Name:     g.Name,
+		Peers:    g.Peers,
+	}
+}
+
+// GroupsToComponent converts an id-keyed group map to its components
+// representation, preserving nil entries.
+func GroupsToComponent(groups map[string]*Group) map[string]*ComponentGroup {
+	if groups == nil {
+		return nil
+	}
+	out := make(map[string]*ComponentGroup, len(groups))
+	for id, g := range groups {
+		out[id] = g.ToComponent()
+	}
+	return out
+}
+
 // AddPeer adds peerID to Peers if not present, returning true if added.
 func (g *Group) AddPeer(peerID string) bool {
 	if peerID == "" {

management/server/types/ipv6_endtoend_test.go

@@ -9,7 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/management/server/types"
 )
 
 func TestNetworkMapComponents_IPv6EndToEnd(t *testing.T) {
@@ -105,7 +105,7 @@ func TestNetworkMapComponents_RemotePeerWithoutCapability(t *testing.T) {
 	require.NotNil(t, nm)
 
 	t.Run("AllowedIPs include remote v6", func(t *testing.T) {
-		var dst *nmdata.Peer
+		var dst *types.ComponentPeer
 		for _, p := range nm.Peers {
 			if p.ID == "peer-dst-1" {
 				dst = p

management/server/types/networkmap_components_test.go

@@ -18,7 +18,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/route"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 func networkMapFromComponents(t *testing.T, account *types.Account, peerID string, validatedPeers map[string]struct{}) *types.NetworkMap {
@@ -50,7 +49,7 @@ func allPeersValidated(account *types.Account, excludePeerIDs ...string) map[str
 	return validated
 }
 
-func peerIDs(peers []*nmdata.Peer) []string {
+func peerIDs(peers []*types.ComponentPeer) []string {
 	ids := make([]string, len(peers))
 	for i, p := range peers {
 		ids[i] = p.ID
@@ -626,7 +625,7 @@ func TestNetworkMapComponents_DomainNetworkResource(t *testing.T) {
 
 	var hasDomainRoute bool
 	for _, r := range nm.Routes {
-		if r.NetworkType == int(route.DomainNetwork) && len(r.Domains) > 0 && r.Domains[0].SafeString() == "api.example.com" {
+		if r.NetworkType == route.DomainNetwork && len(r.Domains) > 0 && r.Domains[0].SafeString() == "api.example.com" {
 			hasDomainRoute = true
 		}
 	}

management/server/util/util.go

@@ -19,34 +19,3 @@ func Difference(a, b []string) []string {
 func ToPtr[T any](value T) *T {
 	return &value
 }
-
-type comparableObject[T any] interface {
-	Equal(other T) bool
-}
-
-func MergeUnique[T comparableObject[T]](arr1, arr2 []T) []T {
-	var result []T
-
-	for _, item := range arr1 {
-		if !contains(result, item) {
-			result = append(result, item)
-		}
-	}
-
-	for _, item := range arr2 {
-		if !contains(result, item) {
-			result = append(result, item)
-		}
-	}
-
-	return result
-}
-
-func contains[T comparableObject[T]](slice []T, element T) bool {
-	for _, item := range slice {
-		if item.Equal(element) {
-			return true
-		}
-	}
-	return false
-}

proxy/internal/accesslog/logger.go

@@ -221,14 +221,21 @@ func (l *Logger) allowDenyLog(serviceID types.ServiceID, reason string) bool {
 // proxy/internal/middleware/keys.go — only the dimensions management needs to
 // record a usage row (provider / model / tokens / cost / groups).
 var usageMetadataKeys = map[string]struct{}{
-	"llm.provider":             {},
-	"llm.model":                {},
-	"llm.resolved_provider_id": {},
-	"llm.input_tokens":         {},
-	"llm.output_tokens":        {},
-	"llm.total_tokens":         {},
-	"cost.usd_total":           {},
-	"llm.authorising_groups":   {},
+	"llm.provider":              {},
+	"llm.model":                 {},
+	"llm.resolved_provider_id":  {},
+	"llm.input_tokens":          {},
+	"llm.output_tokens":         {},
+	"llm.total_tokens":          {},
+	"llm.cached_input_tokens":   {},
+	"llm.cache_creation_tokens": {},
+	"cost.usd_input":            {},
+	"cost.usd_cached_input":     {},
+	"cost.usd_cache_creation":   {},
+	"cost.usd_output":           {},
+	"cost.usd_total":            {},
+	"cost.usd_cache":            {},
+	"llm.authorising_groups":    {},
 }
 
 // stripAgentNetworkEntryForUsage returns the entry reduced to what's needed to

proxy/internal/llm/bedrock.go

@@ -56,10 +56,12 @@ type bedrockResponse struct {
 		OutputTokens             int64 `json:"output_tokens"`
 		CacheReadInputTokens     int64 `json:"cache_read_input_tokens"`
 		CacheCreationInputTokens int64 `json:"cache_creation_input_tokens"`
-		// Converse — camelCase.
-		InputTokensCamel  int64 `json:"inputTokens"`
-		OutputTokensCamel int64 `json:"outputTokens"`
-		TotalTokensCamel  int64 `json:"totalTokens"`
+		// Converse — camelCase; cache buckets are additive to inputTokens (AWS names the write bucket cacheWriteInputTokens).
+		InputTokensCamel      int64 `json:"inputTokens"`
+		OutputTokensCamel     int64 `json:"outputTokens"`
+		TotalTokensCamel      int64 `json:"totalTokens"`
+		CacheReadTokensCamel  int64 `json:"cacheReadInputTokens"`
+		CacheWriteTokensCamel int64 `json:"cacheWriteInputTokens"`
 	} `json:"usage"`
 }
 
@@ -83,16 +85,18 @@ func (BedrockParser) ParseResponse(status int, contentType string, body []byte)
 	}
 	inTok := firstNonZero(resp.Usage.InputTokens, resp.Usage.InputTokensCamel)
 	outTok := firstNonZero(resp.Usage.OutputTokens, resp.Usage.OutputTokensCamel)
+	cacheRead := firstNonZero(resp.Usage.CacheReadInputTokens, resp.Usage.CacheReadTokensCamel)
+	cacheWrite := firstNonZero(resp.Usage.CacheCreationInputTokens, resp.Usage.CacheWriteTokensCamel)
 	total := resp.Usage.TotalTokensCamel
 	if total == 0 {
-		total = inTok + outTok + resp.Usage.CacheReadInputTokens + resp.Usage.CacheCreationInputTokens
+		total = inTok + outTok + cacheRead + cacheWrite
 	}
 	return Usage{
 		InputTokens:         inTok,
 		OutputTokens:        outTok,
 		TotalTokens:         total,
-		CachedInputTokens:   resp.Usage.CacheReadInputTokens,
-		CacheCreationTokens: resp.Usage.CacheCreationInputTokens,
+		CachedInputTokens:   cacheRead,
+		CacheCreationTokens: cacheWrite,
 	}, nil
 }
 

proxy/internal/llm/bedrock_test.go

@@ -26,6 +26,18 @@ func TestBedrockParser_ParseResponse_Converse(t *testing.T) {
 	require.Equal(t, int64(14), u.TotalTokens, "converse uses provider total")
 }
 
+// Converse camelCase cache fields must land in the billed Usage buckets, same as the InvokeModel snake_case fields.
+func TestBedrockParser_ParseResponse_ConverseCacheBuckets(t *testing.T) {
+	body := []byte(`{"usage":{"inputTokens":11,"outputTokens":3,"cacheReadInputTokens":7,"cacheWriteInputTokens":9}}`)
+	u, err := BedrockParser{}.ParseResponse(200, "application/json", body)
+	require.NoError(t, err)
+	require.Equal(t, int64(11), u.InputTokens, "converse input tokens")
+	require.Equal(t, int64(3), u.OutputTokens, "converse output tokens")
+	require.Equal(t, int64(7), u.CachedInputTokens, "converse cache-read tokens")
+	require.Equal(t, int64(9), u.CacheCreationTokens, "converse cache-write tokens")
+	require.Equal(t, int64(11+3+7+9), u.TotalTokens, "total backfill is additive when the provider omits totalTokens")
+}
+
 func TestBedrockParser_ParseResponse_StreamingUnsupported(t *testing.T) {
 	_, err := BedrockParser{}.ParseResponse(200, "application/vnd.amazon.eventstream", []byte("binary"))
 	require.ErrorIs(t, err, ErrStreamingUnsupported, "event-stream must route to the streaming accumulator")

proxy/internal/llm/pricing/pricing.go

@@ -128,6 +128,46 @@ type Table struct {
 //   - Other providers: cached and cacheCreation are ignored; cost is
 //     inTokens*InputPer1K + outTokens*OutputPer1K.
 func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (float64, bool) {
+	c, ok := t.Costs(provider, model, inTokens, outTokens, cachedInput, cacheCreation)
+	return c.TotalUSD, ok
+}
+
+// Costs is a per-request cost split. The four per-bucket fields are the base
+// of the breakdown — one per token bucket the provider bills separately — and
+// the two aggregates are derived from them:
+//
+//	TotalUSD = InputUSD + CachedInputUSD + CacheCreationUSD + OutputUSD
+//	CacheUSD = CachedInputUSD + CacheCreationUSD
+//
+// InputUSD is always the cost of the *non-cached* input bucket, for both
+// provider shapes: on OpenAI the cached subset is carved out of inTokens and
+// billed as CachedInputUSD, so the two never double-count. Buckets a provider
+// doesn't bill are zero, which keeps the identities above true everywhere.
+type Costs struct {
+	InputUSD         float64
+	CachedInputUSD   float64
+	CacheCreationUSD float64
+	OutputUSD        float64
+	TotalUSD         float64
+	CacheUSD         float64
+}
+
+// newCosts assembles a split from its per-bucket parts, deriving the two
+// aggregates so TotalUSD and CacheUSD can never drift from the breakdown.
+func newCosts(input, cachedInput, cacheCreation, output float64) Costs {
+	return Costs{
+		InputUSD:         input,
+		CachedInputUSD:   cachedInput,
+		CacheCreationUSD: cacheCreation,
+		OutputUSD:        output,
+		TotalUSD:         input + cachedInput + cacheCreation + output,
+		CacheUSD:         cachedInput + cacheCreation,
+	}
+}
+
+// Costs returns the estimated USD cost split for the given token counts, with
+// the same semantics as Cost.
+func (t *Table) Costs(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (Costs, bool) {
 	// Clamp negatives to zero before any pricing math so a malformed
 	// upstream count can never produce a negative cost.
 	if inTokens < 0 {
@@ -143,15 +183,15 @@ func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, c
 		cacheCreation = 0
 	}
 	if t == nil {
-		return 0, false
+		return Costs{}, false
 	}
 	byModel, ok := t.entries[provider]
 	if !ok {
-		return 0, false
+		return Costs{}, false
 	}
 	entry, ok := byModel[model]
 	if !ok {
-		return 0, false
+		return Costs{}, false
 	}
 	output := (float64(outTokens) / 1000.0) * entry.OutputPer1K
 	switch provider {
@@ -168,7 +208,7 @@ func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, c
 		}
 		nonCached := float64(inTokens-clamped) / 1000.0 * entry.InputPer1K
 		cached := float64(clamped) / 1000.0 * cachedRate
-		return nonCached + cached + output, true
+		return newCosts(nonCached, cached, 0, output), true
 	case "anthropic", "bedrock":
 		// Bedrock-Anthropic returns the same additive cache buckets as
 		// first-party Anthropic; non-Anthropic Bedrock models simply report
@@ -184,10 +224,10 @@ func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, c
 		input := float64(inTokens) / 1000.0 * entry.InputPer1K
 		read := float64(cachedInput) / 1000.0 * readRate
 		create := float64(cacheCreation) / 1000.0 * createRate
-		return input + read + create + output, true
+		return newCosts(input, read, create, output), true
 	default:
 		input := float64(inTokens) / 1000.0 * entry.InputPer1K
-		return input + output, true
+		return newCosts(input, 0, 0, output), true
 	}
 }
 

proxy/internal/middleware/builtin/cost_calculation_matrix_test.go

@@ -0,0 +1,329 @@
+package builtin_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"strconv"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/cost_meter"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_request_parser"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_response_parser"
+)
+
+// Drives the real pipeline (llm_request_parser → llm_response_parser → cost_meter) on the embedded default pricing
+// table and asserts exact USD amounts hardcoded from the vendors' published prices, including the cache split.
+func TestCostCalculation_ProviderMatrix(t *testing.T) {
+	// Empty data dir → embedded defaults, like a proxy with no pricing override.
+	builtin.Configure(context.Background(), t.TempDir(), nil, nil, nil)
+
+	reqMW, err := llm_request_parser.Factory{}.New(nil)
+	require.NoError(t, err, "build llm_request_parser")
+	respMW, err := llm_response_parser.Factory{}.New(nil)
+	require.NoError(t, err, "build llm_response_parser")
+	costMW, err := cost_meter.Factory{}.New(nil)
+	require.NoError(t, err, "build cost_meter")
+	t.Cleanup(func() { _ = costMW.Close() })
+
+	const jsonCT = "application/json"
+	const sseCT = "text/event-stream"
+	const awsCT = "application/vnd.amazon.eventstream"
+
+	cases := []struct {
+		name     string
+		url      string
+		reqBody  []byte
+		respCT   string
+		respBody []byte
+
+		wantProvider  string
+		wantModel     string
+		wantCost      float64 // exact expected USD; ignored when wantSkip is set
+		wantCacheCost float64 // expected cost.usd_cache portion of wantCost
+		wantSkip      string  // expected cost.skipped reason, "" when priced
+	}{
+		{
+			// gpt-4o-mini $0.15/$0.60 per MTok: 1000×0.15/1M + 500×0.60/1M.
+			name:         "openai chat completions",
+			url:          "https://api.openai.com/v1/chat/completions",
+			reqBody:      []byte(`{"model":"gpt-4o-mini","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"choices":[{"message":{"content":"pong"}}],"usage":{"prompt_tokens":1000,"completion_tokens":500,"total_tokens":1500}}`),
+			wantProvider: "openai",
+			wantModel:    "gpt-4o-mini",
+			wantCost:     0.00045,
+		},
+		{
+			// OpenAI cached tokens are a SUBSET of prompt_tokens at a discount; gpt-4o $2.50/$10 per MTok, cached $1.25/M:
+			// 250×2.5/1M + 750×1.25/1M + 500×10/1M.
+			name:          "openai cached subset discount",
+			url:           "https://api.openai.com/v1/chat/completions",
+			reqBody:       []byte(`{"model":"gpt-4o","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:        jsonCT,
+			respBody:      []byte(`{"usage":{"prompt_tokens":1000,"completion_tokens":500,"prompt_tokens_details":{"cached_tokens":750}}}`),
+			wantProvider:  "openai",
+			wantModel:     "gpt-4o",
+			wantCost:      0.0065625,
+			wantCacheCost: 0.0009375,
+		},
+		{
+			// OpenAI streaming: usage rides the final SSE frame.
+			name:         "openai chat SSE stream",
+			url:          "https://api.openai.com/v1/chat/completions",
+			reqBody:      []byte(`{"model":"gpt-4o-mini","stream":true,"messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       sseCT,
+			respBody:     sseBody(`{"choices":[{"delta":{"content":"po"}}]}`, `{"choices":[{"delta":{"content":"ng"}}]}`, `{"choices":[],"usage":{"prompt_tokens":1000,"completion_tokens":500}}`, "[DONE]"),
+			wantProvider: "openai",
+			wantModel:    "gpt-4o-mini",
+			wantCost:     0.00045,
+		},
+		{
+			// Mistral speaks the OpenAI shape: mistral-large-latest $0.50/$1.50 per MTok.
+			name:         "mistral via openai shape",
+			url:          "https://api.mistral.ai/v1/chat/completions",
+			reqBody:      []byte(`{"model":"mistral-large-latest","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"usage":{"prompt_tokens":1000,"completion_tokens":1000}}`),
+			wantProvider: "openai",
+			wantModel:    "mistral-large-latest",
+			wantCost:     0.002,
+		},
+		{
+			// The field report, minus caching: Bedrock Sonnet 4.6 $3/$15 per MTok, 3×3/1M + 1514×15/1M = $0.022719.
+			// Also covers inference-profile normalization of the region-prefixed versioned id in the URL.
+			name:         "bedrock invoke — reported scenario, no cache",
+			url:          "https://bedrock-runtime.eu-central-1.amazonaws.com/model/global.anthropic.claude-sonnet-4-6-20260115-v1:0/invoke",
+			reqBody:      []byte(`{"messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"content":[{"type":"text","text":"pong"}],"usage":{"input_tokens":3,"output_tokens":1514}}`),
+			wantProvider: "bedrock",
+			wantModel:    "anthropic.claude-sonnet-4-6",
+			wantCost:     0.022719,
+		},
+		{
+			// The field report as observed: the FIRST call of a session also wrote a 30,528-token prompt cache at
+			// 1.25× input ($3.75/M): 0.022719 + 30528×3.75/1M = $0.137199 — the reported $0.1372.
+			name:          "bedrock invoke — reported scenario with cache write",
+			url:           "https://bedrock-runtime.eu-central-1.amazonaws.com/model/global.anthropic.claude-sonnet-4-6-20260115-v1:0/invoke",
+			reqBody:       []byte(`{"messages":[{"role":"user","content":"hi"}]}`),
+			respCT:        jsonCT,
+			respBody:      []byte(`{"usage":{"input_tokens":3,"output_tokens":1514,"cache_creation_input_tokens":30528,"cache_read_input_tokens":0}}`),
+			wantProvider:  "bedrock",
+			wantModel:     "anthropic.claude-sonnet-4-6",
+			wantCost:      0.137199,
+			wantCacheCost: 0.11448,
+		},
+		{
+			// Same numbers over the InvokeModel event-stream: message_start carries input + cache, message_delta the output.
+			name:          "bedrock invoke stream with cache write",
+			url:           "https://bedrock-runtime.eu-central-1.amazonaws.com/model/global.anthropic.claude-sonnet-4-6-20260115-v1:0/invoke-with-response-stream",
+			reqBody:       []byte(`{"messages":[{"role":"user","content":"hi"}]}`),
+			respCT:        awsCT,
+			respBody:      bedrockInvokeStream(t, `{"type":"message_start","message":{"usage":{"input_tokens":3,"output_tokens":1,"cache_creation_input_tokens":30528}}}`, `{"type":"content_block_delta","delta":{"type":"text_delta","text":"pong"}}`, `{"type":"message_delta","usage":{"output_tokens":1514}}`),
+			wantProvider:  "bedrock",
+			wantModel:     "anthropic.claude-sonnet-4-6",
+			wantCost:      0.137199,
+			wantCacheCost: 0.11448,
+		},
+		{
+			// Converse camelCase usage incl. cache buckets. Haiku 4.5 $1/$5 per MTok, read $0.10/M, write $1.25/M:
+			// 50×1/1M + 100×5/1M + 2000×0.1/1M + 1000×1.25/1M = $0.002.
+			name:          "bedrock converse with cache buckets",
+			url:           "https://bedrock-runtime.eu-central-1.amazonaws.com/model/eu.anthropic.claude-haiku-4-5-20251001-v1:0/converse",
+			reqBody:       []byte(`{"messages":[{"role":"user","content":[{"text":"hi"}]}]}`),
+			respCT:        jsonCT,
+			respBody:      []byte(`{"output":{"message":{"content":[{"text":"pong"}]}},"usage":{"inputTokens":50,"outputTokens":100,"totalTokens":3150,"cacheReadInputTokens":2000,"cacheWriteInputTokens":1000}}`),
+			wantProvider:  "bedrock",
+			wantModel:     "anthropic.claude-haiku-4-5",
+			wantCost:      0.002,
+			wantCacheCost: 0.00145,
+		},
+		{
+			// Same numbers over converse-stream: usage rides the trailing metadata frame.
+			name:    "bedrock converse stream with cache buckets",
+			url:     "https://bedrock-runtime.eu-central-1.amazonaws.com/model/eu.anthropic.claude-haiku-4-5-20251001-v1:0/converse-stream",
+			reqBody: []byte(`{"messages":[{"role":"user","content":[{"text":"hi"}]}]}`),
+			respCT:  awsCT,
+			respBody: bedrockConverseStream(t,
+				`{"delta":{"text":"pong"}}`,
+				`{"usage":{"inputTokens":50,"outputTokens":100,"totalTokens":3150,"cacheReadInputTokens":2000,"cacheWriteInputTokens":1000}}`,
+			),
+			wantProvider:  "bedrock",
+			wantModel:     "anthropic.claude-haiku-4-5",
+			wantCost:      0.002,
+			wantCacheCost: 0.00145,
+		},
+		{
+			// First-party Anthropic, additive cache buckets. Sonnet 4.6:
+			// 256×3/1M + 200×15/1M + 768×0.3/1M + 512×3.75/1M.
+			name:          "anthropic messages with cache buckets",
+			url:           "https://api.anthropic.com/v1/messages",
+			reqBody:       []byte(`{"model":"claude-sonnet-4-6","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:        jsonCT,
+			respBody:      []byte(`{"content":[{"type":"text","text":"pong"}],"usage":{"input_tokens":256,"output_tokens":200,"cache_read_input_tokens":768,"cache_creation_input_tokens":512}}`),
+			wantProvider:  "anthropic",
+			wantModel:     "claude-sonnet-4-6",
+			wantCost:      0.0059184,
+			wantCacheCost: 0.0021504,
+		},
+		{
+			// Anthropic SSE: input from message_start, output from message_delta. Haiku 4.5: 1000×1/1M + 2000×5/1M.
+			name:         "anthropic SSE stream",
+			url:          "https://api.anthropic.com/v1/messages",
+			reqBody:      []byte(`{"model":"claude-haiku-4-5","stream":true,"messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       sseCT,
+			respBody:     sseBody(`{"type":"message_start","message":{"usage":{"input_tokens":1000,"output_tokens":2}}}`, `{"type":"content_block_delta","delta":{"type":"text_delta","text":"pong"}}`, `{"type":"message_delta","usage":{"output_tokens":2000}}`, `{"type":"message_stop"}`),
+			wantProvider: "anthropic",
+			wantModel:    "claude-haiku-4-5",
+			wantCost:     0.011,
+		},
+		{
+			// Kimi's Anthropic-compatible endpoint: kimi-k3 $3/$15 per MTok under the anthropic table.
+			name:         "kimi anthropic shape",
+			url:          "https://api.moonshot.ai/anthropic/v1/messages",
+			reqBody:      []byte(`{"model":"kimi-k3","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"usage":{"input_tokens":1000,"output_tokens":1000}}`),
+			wantProvider: "anthropic",
+			wantModel:    "kimi-k3",
+			wantCost:     0.018,
+		},
+		{
+			// Vertex path-routed model with "@version" stripped; Anthropic-on-Vertex priced under the anthropic table.
+			name:         "vertex anthropic path-routed",
+			url:          "https://aiplatform.googleapis.com/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-4-6@20260115:rawPredict",
+			reqBody:      []byte(`{"anthropic_version":"vertex-2023-10-16","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"usage":{"input_tokens":200,"output_tokens":100}}`),
+			wantProvider: "anthropic",
+			wantModel:    "claude-sonnet-4-6",
+			wantCost:     0.0021,
+		},
+		{
+			// Gateway-prefixed model ids are not in the pricing table: the meter must SKIP, never guess a rate.
+			name:         "gateway-prefixed model skips pricing",
+			url:          "https://gateway.example.com/v1/chat/completions",
+			reqBody:      []byte(`{"model":"openai/gpt-4o-mini","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"usage":{"prompt_tokens":1000,"completion_tokens":500}}`),
+			wantProvider: "openai",
+			wantModel:    "openai/gpt-4o-mini",
+			wantSkip:     "unknown_model",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			in := &middleware.Input{
+				Method:  "POST",
+				URL:     tc.url,
+				Headers: []middleware.KV{{Key: "Content-Type", Value: "application/json"}},
+				Body:    tc.reqBody,
+			}
+
+			reqOut, err := reqMW.Invoke(context.Background(), in)
+			require.NoError(t, err, "request parser")
+			in.Metadata = append(in.Metadata, reqOut.Metadata...)
+
+			require.Equal(t, tc.wantProvider, metaKV(in.Metadata, middleware.KeyLLMProvider), "detected provider")
+			require.Equal(t, tc.wantModel, metaKV(in.Metadata, middleware.KeyLLMModel), "detected (normalized) model")
+
+			in.Status = 200
+			in.RespHeaders = []middleware.KV{{Key: "Content-Type", Value: tc.respCT}}
+			in.RespBody = tc.respBody
+
+			respOut, err := respMW.Invoke(context.Background(), in)
+			require.NoError(t, err, "response parser")
+			in.Metadata = append(in.Metadata, respOut.Metadata...)
+
+			costOut, err := costMW.Invoke(context.Background(), in)
+			require.NoError(t, err, "cost meter")
+
+			if tc.wantSkip != "" {
+				assert.Equal(t, tc.wantSkip, metaKV(costOut.Metadata, middleware.KeyCostSkipped), "expected cost skip reason")
+				assert.Empty(t, metaKV(costOut.Metadata, middleware.KeyCostUSDTotal), "no cost may be emitted on skip")
+				return
+			}
+
+			raw := metaKV(costOut.Metadata, middleware.KeyCostUSDTotal)
+			require.NotEmpty(t, raw, "cost.usd_total must be emitted; skip=%q", metaKV(costOut.Metadata, middleware.KeyCostSkipped))
+			got, err := strconv.ParseFloat(raw, 64)
+			require.NoError(t, err, "cost must be a float")
+			// cost.usd_total is rendered with %.6f: allow half of the last printed digit on top of float error.
+			assert.InDelta(t, tc.wantCost, got, 5.1e-7, "USD cost for %s", tc.name)
+
+			rawCache := metaKV(costOut.Metadata, middleware.KeyCostUSDCache)
+			require.NotEmpty(t, rawCache, "cost.usd_cache must be emitted next to cost.usd_total")
+			gotCache, err := strconv.ParseFloat(rawCache, 64)
+			require.NoError(t, err, "cache cost must be a float")
+			assert.InDelta(t, tc.wantCacheCost, gotCache, 5.1e-7, "cache USD cost for %s", tc.name)
+		})
+	}
+}
+
+// metaKV returns the value for key in kvs, or "" when absent.
+func metaKV(kvs []middleware.KV, key string) string {
+	for _, kv := range kvs {
+		if kv.Key == key {
+			return kv.Value
+		}
+	}
+	return ""
+}
+
+// sseBody renders data frames as a text/event-stream body.
+func sseBody(frames ...string) []byte {
+	var b bytes.Buffer
+	for _, f := range frames {
+		b.WriteString("data: ")
+		b.WriteString(f)
+		b.WriteString("\n\n")
+	}
+	return b.Bytes()
+}
+
+// awsFrame encodes one AWS event-stream frame with the given :event-type.
+func awsFrame(t *testing.T, eventType string, payload []byte) []byte {
+	t.Helper()
+	var buf bytes.Buffer
+	enc := eventstream.NewEncoder()
+	require.NoError(t, enc.Encode(&buf, eventstream.Message{
+		Headers: eventstream.Headers{{Name: ":event-type", Value: eventstream.StringValue(eventType)}},
+		Payload: payload,
+	}), "encode event-stream frame")
+	return buf.Bytes()
+}
+
+// bedrockInvokeStream builds an invoke-with-response-stream body: each "chunk" frame wraps a base64 Anthropic event.
+func bedrockInvokeStream(t *testing.T, events ...string) []byte {
+	t.Helper()
+	var body bytes.Buffer
+	for _, ev := range events {
+		wrap, err := json.Marshal(map[string]string{"bytes": base64.StdEncoding.EncodeToString([]byte(ev))})
+		require.NoError(t, err)
+		body.Write(awsFrame(t, "chunk", wrap))
+	}
+	return body.Bytes()
+}
+
+// bedrockConverseStream builds a converse-stream body: contentBlockDelta frames plus a trailing metadata usage frame.
+func bedrockConverseStream(t *testing.T, deltas ...string) []byte {
+	t.Helper()
+	var body bytes.Buffer
+	for i, ev := range deltas {
+		eventType := "contentBlockDelta"
+		if i == len(deltas)-1 {
+			eventType = "metadata"
+		}
+		body.Write(awsFrame(t, eventType, []byte(ev)))
+	}
+	return body.Bytes()
+}

proxy/internal/middleware/builtin/cost_meter/middleware.go

@@ -32,7 +32,12 @@ const (
 )
 
 var metadataKeys = []string{
+	middleware.KeyCostUSDInput,
+	middleware.KeyCostUSDCachedInput,
+	middleware.KeyCostUSDCacheCreation,
+	middleware.KeyCostUSDOutput,
 	middleware.KeyCostUSDTotal,
+	middleware.KeyCostUSDCache,
 	middleware.KeyCostSkipped,
 }
 
@@ -140,18 +145,38 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 	}
 
 	table := m.loader.Get()
-	cost, ok := table.Cost(provider, model, inTokens, outTokens, cachedTokens, cacheCreationTokens)
+	costs, ok := table.Costs(provider, model, inTokens, outTokens, cachedTokens, cacheCreationTokens)
 	if !ok {
 		out.Metadata = skip(skipUnknownModel)
 		return out, nil
 	}
 
+	// Per-bucket costs first: they're the base of the breakdown, and the two
+	// aggregates that follow are derived from exactly these four values.
 	out.Metadata = []middleware.KV{
-		{Key: middleware.KeyCostUSDTotal, Value: fmt.Sprintf("%.6f", cost)},
+		{Key: middleware.KeyCostUSDInput, Value: usd(costs.InputUSD)},
+		{Key: middleware.KeyCostUSDCachedInput, Value: usd(costs.CachedInputUSD)},
+		{Key: middleware.KeyCostUSDCacheCreation, Value: usd(costs.CacheCreationUSD)},
+		{Key: middleware.KeyCostUSDOutput, Value: usd(costs.OutputUSD)},
+		{Key: middleware.KeyCostUSDTotal, Value: usd(costs.TotalUSD)},
+		{Key: middleware.KeyCostUSDCache, Value: usd(costs.CacheUSD)},
 	}
 	return out, nil
 }
 
+// usd renders a cost as the fixed-precision string every cost.usd_* key
+// carries, so the per-bucket values and the aggregates round identically.
+//
+// 9 decimals, not 6: these values are summed downstream — per request, per
+// session, and per usage bucket — so the rounding step is applied once per
+// bucket per row and then accumulated. At 6 decimals a single row loses up to
+// 2e-6 across its four buckets (enough to break a 1e-6 reconciliation against
+// published rates), and a bucket smaller than half a microdollar quantises to
+// zero outright: 16 cache-read tokens on a cheap model is 1.6e-9, so summing
+// 10k such rows reports 0.02 instead of 0.016. Nano-dollar precision keeps the
+// per-row error ~1000x below the smallest realistic bucket.
+func usd(v float64) string { return fmt.Sprintf("%.9f", v) }
+
 // skip returns a single-entry metadata slice carrying the given skip
 // reason under KeyCostSkipped.
 func skip(reason string) []middleware.KV {

proxy/internal/middleware/builtin/cost_meter/middleware_test.go

@@ -67,7 +67,15 @@ func TestMiddleware_StaticSurface(t *testing.T) {
 	assert.NoError(t, mw.Close(), "Close on stateless middleware is a no-op")
 
 	keys := mw.MetadataKeys()
-	expected := []string{middleware.KeyCostUSDTotal, middleware.KeyCostSkipped}
+	expected := []string{
+		middleware.KeyCostUSDInput,
+		middleware.KeyCostUSDCachedInput,
+		middleware.KeyCostUSDCacheCreation,
+		middleware.KeyCostUSDOutput,
+		middleware.KeyCostUSDTotal,
+		middleware.KeyCostUSDCache,
+		middleware.KeyCostSkipped,
+	}
 	assert.Equal(t, expected, keys, "metadata key allowlist must match the spec")
 }
 
@@ -105,7 +113,7 @@ func TestFactory_DefaultPricingPathLoadsFixture(t *testing.T) {
 
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "cost.usd_total must be emitted for known model")
-	assert.Equal(t, "0.000750", value, "0.00015 + 0.0006 per 1k tokens, 6-decimal format")
+	assert.Equal(t, "0.000750000", value, "0.00015 + 0.0006 per 1k tokens, 9-decimal format")
 }
 
 func TestFactory_PricingPathOverride(t *testing.T) {
@@ -129,7 +137,7 @@ func TestFactory_PricingPathOverride(t *testing.T) {
 
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "cost.usd_total must be emitted with custom pricing path")
-	assert.Equal(t, "0.015000", value, "2*0.0025 + 1*0.01 = 0.015 with 6-decimal format")
+	assert.Equal(t, "0.015000000", value, "2*0.0025 + 1*0.01 = 0.015 with 9-decimal format")
 }
 
 func TestInvoke_ComputesCostForKnownModel(t *testing.T) {
@@ -148,7 +156,7 @@ func TestInvoke_ComputesCostForKnownModel(t *testing.T) {
 
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "cost.usd_total must be emitted")
-	assert.Equal(t, "0.018000", value, "0.003 + 0.015 = 0.018 with 6-decimal format")
+	assert.Equal(t, "0.018000000", value, "0.003 + 0.015 = 0.018 with 9-decimal format")
 	_, skipped := metaValue(t, out.Metadata, middleware.KeyCostSkipped)
 	assert.False(t, skipped, "cost.skipped must not be set when cost is computed")
 }
@@ -357,8 +365,25 @@ func TestInvoke_OpenAICachedSubsetDiscount(t *testing.T) {
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "cached subset path must produce a cost — never a skip")
 	// 250 non-cached at 0.0025/1k + 750 cached at 0.00125/1k + 500 output at 0.01/1k.
-	assert.Equal(t, "0.006563", value,
+	assert.Equal(t, "0.006562500", value,
 		"cached subset must be billed at the discount rate, non-cached at the full rate; never double-billed")
+
+	cache, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDCache)
+	require.True(t, ok, "cost.usd_cache must be emitted alongside cost.usd_total")
+	// 750 cached at 0.00125/1k = 0.0009375.
+	assert.Equal(t, "0.000937500", cache, "cache cost is the discounted cost of the cached subset")
+
+	// Per-bucket breakdown. On OpenAI the cached subset is carved out of the
+	// input bucket, so input covers only the 250 non-cached tokens — the two
+	// must never double-count the same 750 tokens.
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDInput, "0.000625000",
+		"input bucket bills only the non-cached remainder")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDCachedInput, "0.000937500",
+		"cached-input bucket bills the discounted subset")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDCacheCreation, "0.000000000",
+		"OpenAI has no cache-write bucket")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDOutput, "0.005000000",
+		"output bucket bills 500 tokens at 0.01/1k")
 }
 
 // TestInvoke_AnthropicCacheBucketsAdditive proves the Anthropic
@@ -384,9 +409,33 @@ func TestInvoke_AnthropicCacheBucketsAdditive(t *testing.T) {
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok)
 	// 256 input * 0.003 + 768 cache_read * 0.0003 + 512 cache_creation * 0.00375 + 200 output * 0.015
-	// = 0.000768 + 0.0002304 + 0.00192 + 0.003 = 0.0059184 → "0.005918" with 6-decimal format.
-	assert.Equal(t, "0.005918", value,
+	// = 0.000768 + 0.0002304 + 0.00192 + 0.003 = 0.0059184.
+	assert.Equal(t, "0.005918400", value,
 		"each Anthropic input bucket must bill at its own rate — cache_read cheap, cache_creation expensive, regular input mid")
+
+	cache, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDCache)
+	require.True(t, ok, "cost.usd_cache must be emitted alongside cost.usd_total")
+	// 768 cache_read * 0.0003 + 512 cache_creation * 0.00375 = 0.0021504.
+	assert.Equal(t, "0.002150400", cache, "cache cost sums the read and creation buckets")
+
+	// Per-bucket breakdown: four separately-billed buckets, each at its own rate.
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDInput, "0.000768000",
+		"input bucket bills 256 tokens at 0.003/1k")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDCachedInput, "0.000230400",
+		"cache-read bucket bills 768 tokens at the cheap 0.0003/1k")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDCacheCreation, "0.001920000",
+		"cache-write bucket bills 512 tokens at the expensive 0.00375/1k")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDOutput, "0.003000000",
+		"output bucket bills 200 tokens at 0.015/1k")
+}
+
+// assertBucket asserts one per-bucket cost key carries the expected
+// 6-decimal value.
+func assertBucket(t *testing.T, md []middleware.KV, key, want, msg string) {
+	t.Helper()
+	got, ok := metaValue(t, md, key)
+	require.Truef(t, ok, "%s must be emitted", key)
+	assert.Equal(t, want, got, msg)
 }
 
 // TestInvoke_CachedTokensAbsentFallsBackToBaseFormula covers the
@@ -411,7 +460,7 @@ func TestInvoke_CachedTokensAbsentFallsBackToBaseFormula(t *testing.T) {
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok)
 	// 1000 input * 0.0025 + 500 output * 0.01 = 0.0025 + 0.005 = 0.0075
-	assert.Equal(t, "0.007500", value, "no cached metadata = same cost as before the feature landed")
+	assert.Equal(t, "0.007500000", value, "no cached metadata = same cost as before the feature landed")
 }
 
 // TestInvoke_UnparseableCachedTokensSkippedSilently proves the
@@ -435,7 +484,7 @@ func TestInvoke_UnparseableCachedTokensSkippedSilently(t *testing.T) {
 	require.NoError(t, err)
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "garbage cache metadata must NOT switch the response from a cost to a skip — fall back to 0 cached")
-	assert.Equal(t, "0.007500", value, "same as the no-cached-metadata path")
+	assert.Equal(t, "0.007500000", value, "same as the no-cached-metadata path")
 }
 
 // TestMiddleware_CloseCancelsReloader proves Close stops the per-instance

proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock.go

@@ -69,15 +69,18 @@ func applyBedrockInvokeChunk(payload []byte, usage *llm.Usage, completion *strin
 }
 
 // converseStreamEvent captures the Converse stream frames carrying completion
-// text (contentBlockDelta) and the final token usage (metadata).
+// text (contentBlockDelta) and the final token usage (metadata). Cache buckets
+// are additive to inputTokens (AWS write bucket: cacheWriteInputTokens).
 type converseStreamEvent struct {
 	Delta *struct {
 		Text string `json:"text"`
 	} `json:"delta"`
 	Usage *struct {
-		InputTokens  int64 `json:"inputTokens"`
-		OutputTokens int64 `json:"outputTokens"`
-		TotalTokens  int64 `json:"totalTokens"`
+		InputTokens      int64 `json:"inputTokens"`
+		OutputTokens     int64 `json:"outputTokens"`
+		TotalTokens      int64 `json:"totalTokens"`
+		CacheReadTokens  int64 `json:"cacheReadInputTokens"`
+		CacheWriteTokens int64 `json:"cacheWriteInputTokens"`
 	} `json:"usage"`
 }
 
@@ -105,6 +108,12 @@ func applyConverseStreamEvent(eventType string, payload []byte, usage *llm.Usage
 			if ev.Usage.TotalTokens > 0 {
 				usage.TotalTokens = ev.Usage.TotalTokens
 			}
+			if ev.Usage.CacheReadTokens > 0 {
+				usage.CachedInputTokens = ev.Usage.CacheReadTokens
+			}
+			if ev.Usage.CacheWriteTokens > 0 {
+				usage.CacheCreationTokens = ev.Usage.CacheWriteTokens
+			}
 		}
 	}
 }

proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock_test.go

@@ -66,6 +66,24 @@ func TestAccumulateBedrockStream_Converse(t *testing.T) {
 	require.Equal(t, "pong", completion, "converse text deltas concatenated")
 }
 
+// The converse-stream metadata frame's camelCase cache fields must reach the billed cache buckets.
+func TestAccumulateBedrockStream_ConverseCacheBuckets(t *testing.T) {
+	var body bytes.Buffer
+	body.Write(bedrockFrame(t, "contentBlockDelta", mustJSON(t, map[string]any{"delta": map[string]any{"text": "pong"}})))
+	body.Write(bedrockFrame(t, "metadata", mustJSON(t, map[string]any{"usage": map[string]any{
+		"inputTokens": 11, "outputTokens": 3, "totalTokens": 30,
+		"cacheReadInputTokens": 7, "cacheWriteInputTokens": 9,
+	}})))
+
+	usage, completion := accumulateBedrockStream(body.Bytes())
+	require.Equal(t, int64(11), usage.InputTokens, "input tokens from metadata frame")
+	require.Equal(t, int64(3), usage.OutputTokens, "output tokens from metadata frame")
+	require.Equal(t, int64(7), usage.CachedInputTokens, "cache-read tokens from metadata frame")
+	require.Equal(t, int64(9), usage.CacheCreationTokens, "cache-write tokens from metadata frame")
+	require.Equal(t, int64(30), usage.TotalTokens, "provider-reported total wins")
+	require.Equal(t, "pong", completion)
+}
+
 func TestAccumulateBedrockStream_Truncated(t *testing.T) {
 	// A body cut mid-frame must not panic; partial usage is returned.
 	full := bedrockFrame(t, "metadata", mustJSON(t, map[string]any{"usage": map[string]any{"inputTokens": 11, "outputTokens": 3}}))

proxy/internal/middleware/keys.go

@@ -75,8 +75,19 @@ const (
 	KeyLLMAttributionGroupID = "llm.attribution_group_id"
 	KeyLLMAttributionWindowS = "llm.attribution_window_seconds"
 
-	// Cost metering (emitted by cost_meter).
-	KeyCostUSDTotal = "cost.usd_total"
+	// Cost metering (emitted by cost_meter). The four per-bucket keys are the
+	// base of the breakdown — one per token bucket the provider bills
+	// separately — and the two aggregates below are derived from them:
+	// usd_total is their sum, usd_cache is cached_input + cache_creation.
+	KeyCostUSDInput = "cost.usd_input"
+	// KeyCostUSDCachedInput is the cost of the cache-read bucket (Anthropic cache_read; OpenAI's discounted cached subset of input).
+	KeyCostUSDCachedInput = "cost.usd_cached_input"
+	// KeyCostUSDCacheCreation is the cost of the cache-write bucket. Zero for providers without one.
+	KeyCostUSDCacheCreation = "cost.usd_cache_creation"
+	KeyCostUSDOutput        = "cost.usd_output"
+	KeyCostUSDTotal         = "cost.usd_total"
+	// KeyCostUSDCache is the portion of cost.usd_total billed for prompt-cache buckets (cache read/creation, or OpenAI's cached input subset).
+	KeyCostUSDCache = "cost.usd_cache"
 	KeyCostSkipped  = "cost.skipped"
 
 	// Framework-emitted error markers. Use the mw.<id>.* prefix to

shared/management/http/api/openapi.yml

@@ -5822,13 +5822,48 @@ components:
         total_tokens:
           type: integer
           format: int64
-          description: Total tokens consumed.
+          description: Total tokens consumed, including prompt-cache tokens.
           example: 1840
+        cached_input_tokens:
+          type: integer
+          format: int64
+          description: Input tokens read from the provider's prompt cache. Additive to input_tokens for Anthropic-shape providers; a subset of input_tokens for OpenAI.
+          example: 0
+        cache_creation_tokens:
+          type: integer
+          format: int64
+          description: Input tokens written to the provider's prompt cache. Zero for providers without a cache-write bucket.
+          example: 30528
         cost_usd:
           type: number
           format: double
           description: Estimated USD cost of the request.
           example: 0.0231
+        input_cost_usd:
+          type: number
+          format: double
+          description: Cost of the non-cached input tokens. Base component of cost_usd.
+          example: 0.0048
+        cached_input_cost_usd:
+          type: number
+          format: double
+          description: Cost of the prompt-cache read tokens. Base component of cost_usd, and part of cache_cost_usd.
+          example: 0.0015
+        cache_creation_cost_usd:
+          type: number
+          format: double
+          description: Cost of the prompt-cache write tokens. Base component of cost_usd, and part of cache_cost_usd.
+          example: 0.1130
+        output_cost_usd:
+          type: number
+          format: double
+          description: Cost of the output tokens. Base component of cost_usd.
+          example: 0.0038
+        cache_cost_usd:
+          type: number
+          format: double
+          description: Portion of cost_usd billed for prompt-cache usage.
+          example: 0.1145
         stream:
           type: boolean
           description: Whether the request was a streaming completion.
@@ -5852,7 +5887,14 @@ components:
         - input_tokens
         - output_tokens
         - total_tokens
+        - cached_input_tokens
+        - cache_creation_tokens
+        - input_cost_usd
+        - cached_input_cost_usd
+        - cache_creation_cost_usd
+        - output_cost_usd
         - cost_usd
+        - cache_cost_usd
     AgentNetworkAccessLogsResponse:
       type: object
       properties:
@@ -5926,13 +5968,48 @@ components:
         total_tokens:
           type: integer
           format: int64
-          description: Total tokens across the session.
+          description: Total tokens across the session, including prompt-cache tokens.
           example: 12880
+        cached_input_tokens:
+          type: integer
+          format: int64
+          description: Total prompt-cache read tokens across the session.
+          example: 0
+        cache_creation_tokens:
+          type: integer
+          format: int64
+          description: Total prompt-cache write tokens across the session.
+          example: 30528
         cost_usd:
           type: number
           format: double
           description: Total estimated USD cost across the session.
           example: 0.1617
+        input_cost_usd:
+          type: number
+          format: double
+          description: Total cost of non-cached input tokens across the session.
+          example: 0.0210
+        cached_input_cost_usd:
+          type: number
+          format: double
+          description: Total cost of prompt-cache read tokens across the session.
+          example: 0.0015
+        cache_creation_cost_usd:
+          type: number
+          format: double
+          description: Total cost of prompt-cache write tokens across the session.
+          example: 0.1130
+        output_cost_usd:
+          type: number
+          format: double
+          description: Total cost of output tokens across the session.
+          example: 0.0262
+        cache_cost_usd:
+          type: number
+          format: double
+          description: Portion of cost_usd billed for prompt-cache usage across the session.
+          example: 0.1145
         providers:
           type: array
           items:
@@ -5959,7 +6036,14 @@ components:
         - input_tokens
         - output_tokens
         - total_tokens
+        - cached_input_tokens
+        - cache_creation_tokens
+        - input_cost_usd
+        - cached_input_cost_usd
+        - cache_creation_cost_usd
+        - output_cost_usd
         - cost_usd
+        - cache_cost_usd
         - decision
         - entries
     AgentNetworkAccessLogSessionsResponse:
@@ -6013,19 +6097,61 @@ components:
         total_tokens:
           type: integer
           format: int64
-          description: Total tokens in the bucket.
+          description: Total tokens in the bucket, including prompt-cache tokens.
           example: 184000
+        cached_input_tokens:
+          type: integer
+          format: int64
+          description: Total prompt-cache read tokens in the bucket.
+          example: 20000
+        cache_creation_tokens:
+          type: integer
+          format: int64
+          description: Total prompt-cache write tokens in the bucket.
+          example: 45000
+        input_cost_usd:
+          type: number
+          format: double
+          description: Total cost of non-cached input tokens in the bucket.
+          example: 1.12
+        cached_input_cost_usd:
+          type: number
+          format: double
+          description: Total cost of prompt-cache read tokens in the bucket.
+          example: 0.06
+        cache_creation_cost_usd:
+          type: number
+          format: double
+          description: Total cost of prompt-cache write tokens in the bucket.
+          example: 0.36
+        output_cost_usd:
+          type: number
+          format: double
+          description: Total cost of output tokens in the bucket.
+          example: 0.77
         cost_usd:
           type: number
           format: double
           description: Total estimated USD spend in the bucket.
           example: 2.31
+        cache_cost_usd:
+          type: number
+          format: double
+          description: Portion of cost_usd billed for prompt-cache usage in the bucket.
+          example: 0.42
       required:
         - period_start
         - input_tokens
         - output_tokens
         - total_tokens
+        - cached_input_tokens
+        - cache_creation_tokens
+        - input_cost_usd
+        - cached_input_cost_usd
+        - cache_creation_cost_usd
+        - output_cost_usd
         - cost_usd
+        - cache_cost_usd
     AgentNetworkSettings:
       type: object
       description: Per-account Agent Network gateway settings. One row per account; cluster and subdomain are auto-assigned on first provider create and immutable thereafter.

shared/management/http/api/types.gen.go

@@ -1732,6 +1732,21 @@ type AccountSettings struct {
 
 // AgentNetworkAccessLog One per-request agent-network (LLM) access log entry with flattened, queryable LLM dimensions.
 type AgentNetworkAccessLog struct {
+	// CacheCostUsd Portion of cost_usd billed for prompt-cache usage.
+	CacheCostUsd float64 `json:"cache_cost_usd"`
+
+	// CacheCreationCostUsd Cost of the prompt-cache write tokens. Base component of cost_usd, and part of cache_cost_usd.
+	CacheCreationCostUsd float64 `json:"cache_creation_cost_usd"`
+
+	// CacheCreationTokens Input tokens written to the provider's prompt cache. Zero for providers without a cache-write bucket.
+	CacheCreationTokens int64 `json:"cache_creation_tokens"`
+
+	// CachedInputCostUsd Cost of the prompt-cache read tokens. Base component of cost_usd, and part of cache_cost_usd.
+	CachedInputCostUsd float64 `json:"cached_input_cost_usd"`
+
+	// CachedInputTokens Input tokens read from the provider's prompt cache. Additive to input_tokens for Anthropic-shape providers; a subset of input_tokens for OpenAI.
+	CachedInputTokens int64 `json:"cached_input_tokens"`
+
 	// CostUsd Estimated USD cost of the request.
 	CostUsd float64 `json:"cost_usd"`
 
@@ -1753,6 +1768,9 @@ type AgentNetworkAccessLog struct {
 	// Id Unique identifier for the access log entry.
 	Id string `json:"id"`
 
+	// InputCostUsd Cost of the non-cached input tokens. Base component of cost_usd.
+	InputCostUsd float64 `json:"input_cost_usd"`
+
 	// InputTokens Input (prompt) tokens consumed.
 	InputTokens int64 `json:"input_tokens"`
 
@@ -1762,6 +1780,9 @@ type AgentNetworkAccessLog struct {
 	// Model Requested LLM model.
 	Model *string `json:"model,omitempty"`
 
+	// OutputCostUsd Cost of the output tokens. Base component of cost_usd.
+	OutputCostUsd float64 `json:"output_cost_usd"`
+
 	// OutputTokens Output (completion) tokens produced.
 	OutputTokens int64 `json:"output_tokens"`
 
@@ -1801,7 +1822,7 @@ type AgentNetworkAccessLog struct {
 	// Timestamp Timestamp when the request was made.
 	Timestamp time.Time `json:"timestamp"`
 
-	// TotalTokens Total tokens consumed.
+	// TotalTokens Total tokens consumed, including prompt-cache tokens.
 	TotalTokens int64 `json:"total_tokens"`
 
 	// UserId NetBird user id of the authenticated caller, if applicable.
@@ -1810,6 +1831,21 @@ type AgentNetworkAccessLog struct {
 
 // AgentNetworkAccessLogSession A session-grouped view of agent-network access logs — all requests sharing a session id (or a single session-less request) folded into one summary plus its ordered entries.
 type AgentNetworkAccessLogSession struct {
+	// CacheCostUsd Portion of cost_usd billed for prompt-cache usage across the session.
+	CacheCostUsd float64 `json:"cache_cost_usd"`
+
+	// CacheCreationCostUsd Total cost of prompt-cache write tokens across the session.
+	CacheCreationCostUsd float64 `json:"cache_creation_cost_usd"`
+
+	// CacheCreationTokens Total prompt-cache write tokens across the session.
+	CacheCreationTokens int64 `json:"cache_creation_tokens"`
+
+	// CachedInputCostUsd Total cost of prompt-cache read tokens across the session.
+	CachedInputCostUsd float64 `json:"cached_input_cost_usd"`
+
+	// CachedInputTokens Total prompt-cache read tokens across the session.
+	CachedInputTokens int64 `json:"cached_input_tokens"`
+
 	// CostUsd Total estimated USD cost across the session.
 	CostUsd float64 `json:"cost_usd"`
 
@@ -1825,12 +1861,18 @@ type AgentNetworkAccessLogSession struct {
 	// GroupIds Union of the authorising group ids across the session's entries.
 	GroupIds *[]string `json:"group_ids,omitempty"`
 
+	// InputCostUsd Total cost of non-cached input tokens across the session.
+	InputCostUsd float64 `json:"input_cost_usd"`
+
 	// InputTokens Total input (prompt) tokens across the session.
 	InputTokens int64 `json:"input_tokens"`
 
 	// Models Distinct models seen in the session.
 	Models *[]string `json:"models,omitempty"`
 
+	// OutputCostUsd Total cost of output tokens across the session.
+	OutputCostUsd float64 `json:"output_cost_usd"`
+
 	// OutputTokens Total output (completion) tokens across the session.
 	OutputTokens int64 `json:"output_tokens"`
 
@@ -1846,7 +1888,7 @@ type AgentNetworkAccessLogSession struct {
 	// StartedAt Timestamp of the session's earliest request.
 	StartedAt time.Time `json:"started_at"`
 
-	// TotalTokens Total tokens across the session.
+	// TotalTokens Total tokens across the session, including prompt-cache tokens.
 	TotalTokens int64 `json:"total_tokens"`
 
 	// UserId NetBird user id of the session's caller.
@@ -2347,19 +2389,40 @@ type AgentNetworkSettingsRequest struct {
 
 // AgentNetworkUsageBucket One aggregated agent-network usage time bucket (UTC). The bucket width is set by the request's granularity.
 type AgentNetworkUsageBucket struct {
+	// CacheCostUsd Portion of cost_usd billed for prompt-cache usage in the bucket.
+	CacheCostUsd float64 `json:"cache_cost_usd"`
+
+	// CacheCreationCostUsd Total cost of prompt-cache write tokens in the bucket.
+	CacheCreationCostUsd float64 `json:"cache_creation_cost_usd"`
+
+	// CacheCreationTokens Total prompt-cache write tokens in the bucket.
+	CacheCreationTokens int64 `json:"cache_creation_tokens"`
+
+	// CachedInputCostUsd Total cost of prompt-cache read tokens in the bucket.
+	CachedInputCostUsd float64 `json:"cached_input_cost_usd"`
+
+	// CachedInputTokens Total prompt-cache read tokens in the bucket.
+	CachedInputTokens int64 `json:"cached_input_tokens"`
+
 	// CostUsd Total estimated USD spend in the bucket.
 	CostUsd float64 `json:"cost_usd"`
 
+	// InputCostUsd Total cost of non-cached input tokens in the bucket.
+	InputCostUsd float64 `json:"input_cost_usd"`
+
 	// InputTokens Total input (prompt) tokens in the bucket.
 	InputTokens int64 `json:"input_tokens"`
 
+	// OutputCostUsd Total cost of output tokens in the bucket.
+	OutputCostUsd float64 `json:"output_cost_usd"`
+
 	// OutputTokens Total output (completion) tokens in the bucket.
 	OutputTokens int64 `json:"output_tokens"`
 
 	// PeriodStart Start of the bucket in YYYY-MM-DD (UTC) — the day, the week start (Monday), or the month start, depending on granularity.
 	PeriodStart string `json:"period_start"`
 
-	// TotalTokens Total tokens in the bucket.
+	// TotalTokens Total tokens in the bucket, including prompt-cache tokens.
 	TotalTokens int64 `json:"total_tokens"`
 }
 

shared/management/networkmap/decode.go

@@ -5,15 +5,14 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
-	"slices"
 	"strconv"
 	"time"
 
 	log "github.com/sirupsen/logrus"
 
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	nbdns "github.com/netbirdio/netbird/dns"
+	nbroute "github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
-	nmdata "github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/types"
 )
@@ -36,28 +35,28 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 		Network:             decodeAccountNetwork(full.Network),
 		AccountSettings:     decodeAccountSettings(full.AccountSettings),
 		CustomZoneDomain:    full.CustomZoneDomain,
-		Peers:               make(map[string]*nmdata.Peer, len(full.Peers)),
-		Groups:              make(map[string]*nmdata.Group, len(full.Groups)),
-		Policies:            make([]*nmdata.Policy, 0, len(full.Policies)),
-		Routes:              make([]*nmdata.Route, 0, len(full.Routes)),
-		NameServerGroups:    make([]*nmdata.NameServerGroup, 0, len(full.NameserverGroups)),
+		Peers:               make(map[string]*types.ComponentPeer, len(full.Peers)),
+		Groups:              make(map[string]*types.ComponentGroup, len(full.Groups)),
+		Policies:            make([]*types.Policy, 0, len(full.Policies)),
+		Routes:              make([]*nbroute.Route, 0, len(full.Routes)),
+		NameServerGroups:    make([]*nbdns.NameServerGroup, 0, len(full.NameserverGroups)),
 		AllDNSRecords:       decodeSimpleRecords(full.AllDnsRecords),
 		AccountZones:        decodeCustomZones(full.AccountZones),
-		ResourcePoliciesMap: make(map[string][]*nmdata.Policy),
-		RoutersMap:          make(map[string]map[string]*nmdata.NetworkRouter),
-		NetworkResources:    make([]*nmdata.NetworkResource, 0, len(full.NetworkResources)),
-		RouterPeers:         make(map[string]*nmdata.Peer),
+		ResourcePoliciesMap: make(map[string][]*types.Policy),
+		RoutersMap:          make(map[string]map[string]*types.ComponentRouter),
+		NetworkResources:    make([]*types.ComponentResource, 0, len(full.NetworkResources)),
+		RouterPeers:         make(map[string]*types.ComponentPeer),
 		AllowedUserIDs:      stringSliceToSet(full.AllowedUserIds),
 		PostureFailedPeers:  make(map[string]map[string]struct{}, len(full.PostureFailedPeers)),
 		GroupIDToUserIDs:    make(map[string][]string, len(full.GroupIdToUserIds)),
 	}
 
 	if full.DnsSettings != nil {
-		c.DNSSettings = &nmdata.DNSSettings{
+		c.DNSSettings = &types.DNSSettings{
 			DisabledManagementGroups: full.DnsSettings.DisabledManagementGroupIds,
 		}
 	} else {
-		c.DNSSettings = &nmdata.DNSSettings{}
+		c.DNSSettings = &types.DNSSettings{}
 	}
 
 	// Phase 1: peers. The envelope's peers slice is index-addressed on the
@@ -99,21 +98,10 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 				log.WithField("peer idx", idx).Error("unrecognized peer idx during decoding")
 			}
 		}
-
-		fromCompactResources := func() []nmdata.Resource {
-			var toret []nmdata.Resource
-
-			for _, r := range gc.Resources {
-				toret = append(toret, resourceFromProto(r, peerIDByIndex))
-			}
-
-			return toret
-		}
-
-		group := &nmdata.Group{
-			PublicID:  gc.Id,
-			Peers:     peerIDs,
-			Resources: fromCompactResources(),
+		group := &types.ComponentGroup{
+			ID:       groupID,
+			PublicID: gc.Id,
+			Peers:    peerIDs,
 		}
 		if gc.IsAll {
 			group.Name = types.GroupAllName
@@ -123,7 +111,7 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 
 	// Phase 3: policies (PolicyCompact = one rule per entry; current data
 	// model is 1 rule per policy).
-	policyByID := make(map[string]*nmdata.Policy, len(full.Policies))
+	policyByID := make(map[string]*types.Policy, len(full.Policies))
 	for i, pc := range full.Policies {
 		if pc == nil {
 			return nil, fmt.Errorf("invalid envelope: policies[%d] is nil", i)
@@ -160,7 +148,7 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 	// Phase 7: routers_map (outer key = network seq id, inner key = peer-id
 	// reconstructed from peer_index). Synthesized network id is "net_<seq>".
 	for networkID, list := range full.RoutersMap {
-		inner := make(map[string]*nmdata.NetworkRouter, len(list.Entries))
+		inner := make(map[string]*types.ComponentRouter, len(list.Entries))
 		for _, entry := range list.Entries {
 			if !entry.PeerIndexSet {
 				continue
@@ -170,8 +158,10 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 				continue
 			}
 			peerID := peerIDByIndex[entry.PeerIndex]
-			inner[peerID] = &nmdata.NetworkRouter{
+			inner[peerID] = &types.ComponentRouter{
+				NetworkID:  networkID,
 				PublicID:   entry.Id,
+				Peer:       peerID,
 				PeerGroups: entry.PeerGroupIds,
 				Masquerade: entry.Masquerade,
 				Metric:     int(entry.Metric),
@@ -190,7 +180,7 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 		if len(ids.Ids) == 0 {
 			continue
 		}
-		policies := make([]*nmdata.Policy, 0, len(ids.Ids))
+		policies := make([]*types.Policy, 0, len(ids.Ids))
 		for _, id := range ids.Ids {
 			if p, ok := policyByID[id]; ok {
 				policies = append(policies, p)
@@ -203,15 +193,6 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 		}
 	}
 
-	// Phase 8: rebuild resource_policies_map
-	for _, r := range c.NetworkResources {
-		policies := policiesForNetworkResource(r.ID, c.Policies, c.Groups)
-		if len(policies) == 0 {
-			continue
-		}
-		c.ResourcePoliciesMap[r.ID] = policies
-	}
-
 	// Phase 9: group_id_to_user_ids — wire keys are seq ids, synth to strings.
 	for groupId, list := range full.GroupIdToUserIds {
 		c.GroupIDToUserIDs[groupId] = append([]string(nil), list.UserIds...)
@@ -247,48 +228,11 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 	return c, nil
 }
 
-func networkResourceGroups(resourceId string, groups map[string]*nmdata.Group) []string {
-	var toret []string
-	for _, group := range groups {
-		for _, resource := range group.Resources {
-			if resource.ID == resourceId {
-				toret = append(toret, group.PublicID)
-			}
-		}
-	}
-	return toret
-}
-
-func policiesForNetworkResource(resourceId string, allPolicies []*nmdata.Policy, groups map[string]*nmdata.Group) []*nmdata.Policy {
-	var toret []*nmdata.Policy
-
-	networkResourceGroups := networkResourceGroups(resourceId, groups)
-	for _, p := range allPolicies {
-		if p == nil || !p.Enabled {
-			continue
-		}
-
-		// there's always only one rule in each policy
-		if p.Rules[0].DestinationResource.ID == resourceId {
-			toret = append(toret, p)
-			continue
-		}
-		for _, groupId := range networkResourceGroups {
-			if slices.Contains(p.Rules[0].Destinations, groupId) {
-				toret = append(toret, p)
-				break
-			}
-		}
-	}
-
-	return toret
-}
-
-func decodeAccountNetwork(an *proto.AccountNetwork) *nmdata.Network {
+func decodeAccountNetwork(an *proto.AccountNetwork) *types.Network {
 	if an == nil {
 		return nil
 	}
-	n := &nmdata.Network{
+	n := &types.Network{
 		Identifier: an.Identifier,
 		Dns:        an.Dns,
 		Serial:     an.Serial,
@@ -306,50 +250,32 @@ func decodeAccountNetwork(an *proto.AccountNetwork) *nmdata.Network {
 	return n
 }
 
-func decodeAccountSettings(as *proto.AccountSettingsCompact) *nmdata.AccountSettingsInfo {
+func decodeAccountSettings(as *proto.AccountSettingsCompact) *types.AccountSettingsInfo {
 	if as == nil {
-		return &nmdata.AccountSettingsInfo{}
+		return &types.AccountSettingsInfo{}
 	}
-	return &nmdata.AccountSettingsInfo{
+	return &types.AccountSettingsInfo{
 		PeerLoginExpirationEnabled: as.PeerLoginExpirationEnabled,
 		PeerLoginExpiration:        time.Duration(as.PeerLoginExpirationNs),
 	}
 }
 
-func decodePeerCompact(pc *proto.PeerCompact, peerID string) *nmdata.Peer {
-	var caps []int32
-	if pc.SupportsSourcePrefixes {
-		caps = append(caps, nbpeer.PeerCapabilitySourcePrefixes)
-	}
-	if pc.SupportsIpv6 {
-		caps = append(caps, nbpeer.PeerCapabilityIPv6Overlay)
-	}
-	peer := &nmdata.Peer{
+func decodePeerCompact(pc *proto.PeerCompact, peerID string) *types.ComponentPeer {
+	peer := &types.ComponentPeer{
 		ID:                     peerID,
 		Key:                    peerID,
 		SSHKey:                 string(pc.SshPubKey),
 		SSHEnabled:             pc.SshEnabled,
 		DNSLabel:               pc.DnsLabel,
 		LoginExpirationEnabled: pc.LoginExpirationEnabled,
-		Meta: nmdata.PeerSystemMeta{
-			WtVersion:    pc.AgentVersion,
-			Capabilities: caps,
-			Flags: nmdata.Flags{
-				ServerSSHAllowed: pc.ServerSshAllowed,
-			},
-		},
-	}
-	if pc.AddedWithSsoLogin {
-		// Set a non-empty UserID so (*Peer).AddedWithSSOLogin() returns true.
-		// The original UserID isn't on the wire; the value is intentionally
-		// visibly synthetic so any future consumer that mistakes UserID for a
-		// real account user xid won't silently match (or worse, write the
-		// sentinel into a downstream record).
-		peer.UserID = "<env-sso>"
+		AgentVersion:           pc.AgentVersion,
+		SupportsSourcePrefixes: pc.SupportsSourcePrefixes,
+		SupportsIPv6:           pc.SupportsIpv6,
+		ServerSSHAllowed:       pc.ServerSshAllowed,
+		AddedWithSSOLogin:      pc.AddedWithSsoLogin,
 	}
 	if pc.LastLoginUnixNano != 0 {
-		t := time.Unix(0, pc.LastLoginUnixNano)
-		peer.LastLogin = &t
+		peer.LastLogin = time.Unix(0, pc.LastLoginUnixNano)
 	}
 	switch len(pc.Ip) {
 	case 4:
@@ -367,13 +293,13 @@ func decodePeerCompact(pc *proto.PeerCompact, peerID string) *nmdata.Peer {
 	return peer
 }
 
-func decodePolicyCompact(pc *proto.PolicyCompact, policyID string, peerIDByIndex []string) *nmdata.Policy {
-	rule := &nmdata.PolicyRule{
+func decodePolicyCompact(pc *proto.PolicyCompact, policyID string, peerIDByIndex []string) *types.Policy {
+	rule := &types.PolicyRule{
 		ID:                  policyID, // 1 rule per policy → reuse synthesized id
 		PolicyID:            policyID,
 		Enabled:             true,
-		Action:              string(actionFromProto(pc.Action)),
-		Protocol:            string(protocolFromProto(pc.Protocol)),
+		Action:              actionFromProto(pc.Action),
+		Protocol:            protocolFromProto(pc.Protocol),
 		Bidirectional:       pc.Bidirectional,
 		Ports:               uint32SliceToStrings(pc.Ports),
 		PortRanges:          portRangesFromProto(pc.PortRanges),
@@ -384,11 +310,11 @@ func decodePolicyCompact(pc *proto.PolicyCompact, policyID string, peerIDByIndex
 		SourceResource:      resourceFromProto(pc.SourceResource, peerIDByIndex),
 		DestinationResource: resourceFromProto(pc.DestinationResource, peerIDByIndex),
 	}
-	return &nmdata.Policy{
+	return &types.Policy{
 		ID:                  policyID,
 		PublicID:            pc.Id,
 		Enabled:             true,
-		Rules:               []*nmdata.PolicyRule{rule},
+		Rules:               []*types.PolicyRule{rule},
 		SourcePostureChecks: pc.SourcePostureCheckIds,
 	}
 }
@@ -396,31 +322,15 @@ func decodePolicyCompact(pc *proto.PolicyCompact, policyID string, peerIDByIndex
 // resourceFromProto rebuilds types.Resource. For peer-typed resources the
 // peer reference is reconstructed from the envelope's peer index — wire
 // format ships no xid for peers, so we use the synthesized peer id.
-func resourceFromProto(r *proto.ResourceCompact, peerIDByIndex []string) nmdata.Resource {
+func resourceFromProto(r *proto.ResourceCompact, peerIDByIndex []string) types.Resource {
 	if r == nil {
-		return nmdata.Resource{}
+		return types.Resource{}
 	}
-
-	t, ok := proto.ResourceCompactType_name[int32(r.Type)]
-	if !ok || r.Type == proto.ResourceCompactType_unknown_type {
-		return nmdata.Resource{}
-	}
-
-	if r.Type == proto.ResourceCompactType_peer && int(r.GetPeerIndex()) >= len(peerIDByIndex) {
-		return nmdata.Resource{}
-	}
-
-	if r.Type == proto.ResourceCompactType_peer && int(r.GetPeerIndex()) < len(peerIDByIndex) {
-		return nmdata.Resource{
-			Type: "peer",
-			ID:   peerIDByIndex[int(r.GetPeerIndex())],
-		}
-	}
-
-	return nmdata.Resource{
-		Type: t,
-		ID:   r.GetId(),
+	out := types.Resource{Type: types.ResourceType(r.Type)}
+	if r.PeerIndexSet && int(r.PeerIndex) < len(peerIDByIndex) {
+		out.ID = peerIDByIndex[r.PeerIndex]
 	}
+	return out
 }
 
 // authorizedGroupsFromProto inverts encodeAuthorizedGroups: the wire form
@@ -441,15 +351,15 @@ func authorizedGroupsFromProto(m map[string]*proto.UserNameList) map[string][]st
 	return out
 }
 
-func decodeRouteRaw(rr *proto.RouteRaw, peerIDByIndex []string) *nmdata.Route {
-	r := &nmdata.Route{
-		ID:                  rr.Id,
+func decodeRouteRaw(rr *proto.RouteRaw, peerIDByIndex []string) *nbroute.Route {
+	r := &nbroute.Route{
+		ID:                  nbroute.ID(rr.Id),
 		PublicID:            rr.Id,
-		NetID:               rr.NetId,
+		NetID:               nbroute.NetID(rr.NetId),
 		Description:         rr.Description,
 		Domains:             domainsFromPunycode(rr.Domains),
 		KeepRoute:           rr.KeepRoute,
-		NetworkType:         int(rr.NetworkType),
+		NetworkType:         nbroute.NetworkType(rr.NetworkType),
 		Masquerade:          rr.Masquerade,
 		Metric:              int(rr.Metric),
 		Enabled:             rr.Enabled,
@@ -469,8 +379,8 @@ func decodeRouteRaw(rr *proto.RouteRaw, peerIDByIndex []string) *nmdata.Route {
 	return r
 }
 
-func decodeNameServerGroupRaw(nsg *proto.NameServerGroupRaw) *nmdata.NameServerGroup {
-	out := &nmdata.NameServerGroup{
+func decodeNameServerGroupRaw(nsg *proto.NameServerGroupRaw) *nbdns.NameServerGroup {
+	out := &nbdns.NameServerGroup{
 		ID:                   nsg.Id,
 		PublicID:             nsg.Id,
 		Groups:               nsg.GroupIds,
@@ -478,13 +388,13 @@ func decodeNameServerGroupRaw(nsg *proto.NameServerGroupRaw) *nmdata.NameServerG
 		Domains:              nsg.Domains,
 		Enabled:              nsg.Enabled,
 		SearchDomainsEnabled: nsg.SearchDomainsEnabled,
-		NameServers:          make([]nmdata.NameServer, 0, len(nsg.Nameservers)),
+		NameServers:          make([]nbdns.NameServer, 0, len(nsg.Nameservers)),
 	}
 	for _, ns := range nsg.Nameservers {
 		if addr, err := netip.ParseAddr(ns.IP); err == nil {
-			out.NameServers = append(out.NameServers, nmdata.NameServer{
+			out.NameServers = append(out.NameServers, nbdns.NameServer{
 				IP:     addr,
-				NSType: int(ns.NSType),
+				NSType: nbdns.NameServerType(ns.NSType),
 				Port:   int(ns.Port),
 			})
 		}
@@ -492,14 +402,14 @@ func decodeNameServerGroupRaw(nsg *proto.NameServerGroupRaw) *nmdata.NameServerG
 	return out
 }
 
-func decodeNetworkResource(nr *proto.NetworkResourceRaw) *nmdata.NetworkResource {
-	out := &nmdata.NetworkResource{
+func decodeNetworkResource(nr *proto.NetworkResourceRaw) *types.ComponentResource {
+	out := &types.ComponentResource{
 		ID:          nr.Id,
 		PublicID:    nr.Id,
 		NetworkID:   nr.NetworkSeq,
 		Name:        nr.Name,
 		Description: nr.Description,
-		Type:        nr.Type,
+		Type:        types.ComponentResourceType(nr.Type),
 		Address:     nr.Address,
 		Domain:      nr.DomainValue,
 		Enabled:     nr.Enabled,
@@ -512,10 +422,10 @@ func decodeNetworkResource(nr *proto.NetworkResourceRaw) *nmdata.NetworkResource
 	return out
 }
 
-func decodeSimpleRecords(records []*proto.SimpleRecord) []nmdata.SimpleRecord {
-	out := make([]nmdata.SimpleRecord, 0, len(records))
+func decodeSimpleRecords(records []*proto.SimpleRecord) []nbdns.SimpleRecord {
+	out := make([]nbdns.SimpleRecord, 0, len(records))
 	for _, r := range records {
-		out = append(out, nmdata.SimpleRecord{
+		out = append(out, nbdns.SimpleRecord{
 			Name:  r.Name,
 			Type:  int(r.Type),
 			Class: r.Class,
@@ -526,10 +436,10 @@ func decodeSimpleRecords(records []*proto.SimpleRecord) []nmdata.SimpleRecord {
 	return out
 }
 
-func decodeCustomZones(zones []*proto.CustomZone) []nmdata.CustomZone {
-	out := make([]nmdata.CustomZone, 0, len(zones))
+func decodeCustomZones(zones []*proto.CustomZone) []nbdns.CustomZone {
+	out := make([]nbdns.CustomZone, 0, len(zones))
 	for _, z := range zones {
-		out = append(out, nmdata.CustomZone{
+		out = append(out, nbdns.CustomZone{
 			Domain:               z.Domain,
 			Records:              decodeSimpleRecords(z.Records),
 			SearchDomainDisabled: z.SearchDomainDisabled,
@@ -550,16 +460,16 @@ func uint32SliceToStrings(ports []uint32) []string {
 	return out
 }
 
-func portRangesFromProto(ranges []*proto.PortInfo_Range) []nmdata.RulePortRange {
+func portRangesFromProto(ranges []*proto.PortInfo_Range) []types.RulePortRange {
 	if len(ranges) == 0 {
 		return nil
 	}
-	out := make([]nmdata.RulePortRange, 0, len(ranges))
+	out := make([]types.RulePortRange, 0, len(ranges))
 	for _, r := range ranges {
 		if r == nil || r.Start > 65535 || r.End > 65535 {
 			continue
 		}
-		out = append(out, nmdata.RulePortRange{
+		out = append(out, types.RulePortRange{
 			Start: uint16(r.Start),
 			End:   uint16(r.End),
 		})

shared/management/networkmap/decode_test.go

@@ -1,40 +0,0 @@
-package networkmap
-
-import (
-	"testing"
-
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/netbirdio/netbird/shared/management/proto"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestDecodePolicy(t *testing.T) {
-	assert.Equal(t,
-		resourceFromProto(
-			&proto.ResourceCompact{Type: proto.ResourceCompactType_peer, ResourceId: &proto.ResourceCompact_PeerIndex{PeerIndex: uint32(1)}},
-			[]string{"invalid-id-0", "valid-id", "invalid-id-2"}),
-		nmdata.Resource{Type: "peer", ID: "valid-id"})
-	// check invalid peer index returns an empty resource
-	assert.Equal(t,
-		resourceFromProto(
-			&proto.ResourceCompact{Type: proto.ResourceCompactType_peer, ResourceId: &proto.ResourceCompact_PeerIndex{PeerIndex: uint32(100)}},
-			[]string{"invalid-id-0", "valid-id", "invalid-id-2"}),
-		nmdata.Resource{})
-	assert.Equal(t,
-		resourceFromProto(
-			&proto.ResourceCompact{Type: proto.ResourceCompactType_domain, ResourceId: &proto.ResourceCompact_Id{Id: "domain"}}, []string{}),
-		nmdata.Resource{Type: "domain", ID: "domain"})
-	assert.Equal(t,
-		resourceFromProto(
-			&proto.ResourceCompact{Type: proto.ResourceCompactType_host, ResourceId: &proto.ResourceCompact_Id{Id: "host"}}, []string{}),
-		nmdata.Resource{Type: "host", ID: "host"})
-	assert.Equal(t,
-		resourceFromProto(
-			&proto.ResourceCompact{Type: proto.ResourceCompactType_subnet, ResourceId: &proto.ResourceCompact_Id{Id: "subnet"}}, []string{}),
-		nmdata.Resource{Type: "subnet", ID: "subnet"})
-	// an unknown resource type return an empty resource
-	assert.Equal(t,
-		resourceFromProto(
-			&proto.ResourceCompact{Type: proto.ResourceCompactType_unknown_type, ResourceId: &proto.ResourceCompact_Id{Id: "boom"}}, []string{}),
-		nmdata.Resource{})
-}

shared/management/networkmap/encode.go

@@ -20,7 +20,7 @@ import (
 	nbdns "github.com/netbirdio/netbird/dns"
 	"net/netip"
 
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	nbroute "github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/types"
 	"github.com/netbirdio/netbird/shared/netiputil"
@@ -28,7 +28,7 @@ import (
 )
 
 // ToProtocolRoutes converts a slice of typed routes to their proto form.
-func ToProtocolRoutes(routes []*nmdata.Route) []*proto.Route {
+func ToProtocolRoutes(routes []*nbroute.Route) []*proto.Route {
 	protoRoutes := make([]*proto.Route, 0, len(routes))
 	for _, r := range routes {
 		protoRoutes = append(protoRoutes, ToProtocolRoute(r))
@@ -37,7 +37,7 @@ func ToProtocolRoutes(routes []*nmdata.Route) []*proto.Route {
 }
 
 // ToProtocolRoute converts one typed route to its proto form.
-func ToProtocolRoute(route *nmdata.Route) *proto.Route {
+func ToProtocolRoute(route *nbroute.Route) *proto.Route {
 	return &proto.Route{
 		ID:            string(route.ID),
 		NetID:         string(route.NetID),
@@ -273,7 +273,7 @@ func ToProtocolDNSConfig(update nbdns.Config, cache DNSConfigCache, forwardPort
 
 // AppendRemotePeerConfig appends typed peers as proto.RemotePeerConfig
 // entries to dst and returns the result.
-func AppendRemotePeerConfig(dst []*proto.RemotePeerConfig, peers []*nmdata.Peer, dnsName string, includeIPv6 bool) []*proto.RemotePeerConfig {
+func AppendRemotePeerConfig(dst []*proto.RemotePeerConfig, peers []*types.ComponentPeer, dnsName string, includeIPv6 bool) []*proto.RemotePeerConfig {
 	for _, rPeer := range peers {
 		allowedIPs := []string{rPeer.IP.String() + "/32"}
 		if includeIPv6 && rPeer.IPv6.IsValid() {
@@ -284,7 +284,7 @@ func AppendRemotePeerConfig(dst []*proto.RemotePeerConfig, peers []*nmdata.Peer,
 			AllowedIps:   allowedIPs,
 			SshConfig:    &proto.SSHConfig{SshPubKey: []byte(rPeer.SSHKey)},
 			Fqdn:         rPeer.FQDN(dnsName),
-			AgentVersion: rPeer.Meta.WtVersion,
+			AgentVersion: rPeer.AgentVersion,
 		})
 	}
 	return dst

shared/management/networkmap/envelope.go

@@ -54,8 +54,8 @@ func EnvelopeToNetworkMap(ctx context.Context, env *proto.NetworkMapEnvelope, lo
 	}
 	components.PeerID = canonicalKey
 
-	includeIPv6 := localPeer.SupportsIPv6() && localPeer.IPv6.IsValid()
-	useSourcePrefixes := localPeer.SupportsSourcePrefixes()
+	includeIPv6 := localPeer.SupportsIPv6 && localPeer.IPv6.IsValid()
+	useSourcePrefixes := localPeer.SupportsSourcePrefixes
 
 	typedNM := components.Calculate(ctx)
 

shared/management/networkmap/envelope_test.go

@@ -15,7 +15,6 @@ import (
 	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/types"
 	nbnetworkmap "github.com/netbirdio/netbird/shared/management/networkmap"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
@@ -56,13 +55,13 @@ func TestEnvelopeToNetworkMap_RoundTrip(t *testing.T) {
 func TestCalculate_FirewallRuleProtocol_NeverNetbirdSSH(t *testing.T) {
 	c, localPeerKey := buildSmokeComponents(t)
 	// Replace the smoke policy with a NetbirdSSH-protocol allow.
-	c.Policies = []*nmdata.Policy{{
+	c.Policies = []*types.Policy{{
 		ID: "pol-ssh", PublicID: "2", Enabled: true,
-		Rules: []*nmdata.PolicyRule{{
+		Rules: []*types.PolicyRule{{
 			ID:            "rule-ssh",
 			Enabled:       true,
-			Action:        string(types.PolicyTrafficActionAccept),
-			Protocol:      string(types.PolicyRuleProtocolNetbirdSSH),
+			Action:        types.PolicyTrafficActionAccept,
+			Protocol:      types.PolicyRuleProtocolNetbirdSSH,
 			Bidirectional: true,
 			Sources:       []string{"group-all"},
 			Destinations:  []string{"group-all"},
@@ -144,39 +143,39 @@ func TestDecodeEnvelope_MalformedWgKeyPeerSkipped(t *testing.T) {
 func TestEnvelopeRoundTrip_AllGroupShortCircuitParity(t *testing.T) {
 	ctx := context.Background()
 
-	peers := map[string]*nmdata.Peer{}
+	peers := map[string]*types.ComponentPeer{}
 	for i, id := range []string{"peer-T", "peer-S", "peer-ALL", "peer-O"} {
-		peers[id] = &nmdata.Peer{
-			ID:       id,
-			Key:      randomWgKey(t),
-			IP:       netip.AddrFrom4([4]byte{100, 64, 0, byte(i + 1)}),
-			DNSLabel: id,
-			Meta:     nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+		peers[id] = &types.ComponentPeer{
+			ID:           id,
+			Key:          randomWgKey(t),
+			IP:           netip.AddrFrom4([4]byte{100, 64, 0, byte(i + 1)}),
+			DNSLabel:     id,
+			AgentVersion: "0.40.0",
 		}
 	}
 
 	c := &types.NetworkMapComponents{
 		PeerID: "peer-T",
-		Network: &nmdata.Network{
+		Network: &types.Network{
 			Identifier: "net-all-groups",
 			Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
 			Serial:     1,
 		},
-		AccountSettings: &nmdata.AccountSettingsInfo{},
-		DNSSettings:     &nmdata.DNSSettings{},
+		AccountSettings: &types.AccountSettingsInfo{},
+		DNSSettings:     &types.DNSSettings{},
 		Peers:           peers,
-		Groups: map[string]*nmdata.Group{
-			"g-src": {PublicID: "1", Name: "staff", Peers: []string{"peer-T", "peer-S"}},
-			"g-all": {PublicID: "2", Name: "All", Peers: []string{"peer-ALL"}},
-			"g-two": {PublicID: "3", Name: "second", Peers: []string{"peer-T", "peer-O"}},
+		Groups: map[string]*types.ComponentGroup{
+			"g-src": {ID: "g-src", PublicID: "1", Name: "staff", Peers: []string{"peer-T", "peer-S"}},
+			"g-all": {ID: "g-all", PublicID: "2", Name: "All", Peers: []string{"peer-ALL"}},
+			"g-two": {ID: "g-two", PublicID: "3", Name: "second", Peers: []string{"peer-T", "peer-O"}},
 		},
-		Policies: []*nmdata.Policy{{
+		Policies: []*types.Policy{{
 			ID: "pol-multi-dest", PublicID: "10", Enabled: true,
-			Rules: []*nmdata.PolicyRule{{
+			Rules: []*types.PolicyRule{{
 				ID:           "rule-multi-dest",
 				Enabled:      true,
-				Action:       string(types.PolicyTrafficActionAccept),
-				Protocol:     string(types.PolicyRuleProtocolALL),
+				Action:       types.PolicyTrafficActionAccept,
+				Protocol:     types.PolicyRuleProtocolALL,
 				Sources:      []string{"g-src"},
 				Destinations: []string{"g-all", "g-two"},
 			}},
@@ -232,33 +231,33 @@ func buildSmokeComponents(t *testing.T) (*types.NetworkMapComponents, string) {
 	peerAKey := randomWgKey(t)
 	peerBKey := randomWgKey(t)
 
-	peerA := &nmdata.Peer{
-		ID:       "peer-A",
-		Key:      peerAKey,
-		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 1}),
-		DNSLabel: "peerA",
-		Meta:     nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+	peerA := &types.ComponentPeer{
+		ID:           "peer-A",
+		Key:          peerAKey,
+		IP:           netip.AddrFrom4([4]byte{100, 64, 0, 1}),
+		DNSLabel:     "peerA",
+		AgentVersion: "0.40.0",
 	}
-	peerB := &nmdata.Peer{
-		ID:       "peer-B",
-		Key:      peerBKey,
-		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 2}),
-		DNSLabel: "peerB",
-		Meta:     nmdata.PeerSystemMeta{WtVersion: "0.40.0"},
+	peerB := &types.ComponentPeer{
+		ID:           "peer-B",
+		Key:          peerBKey,
+		IP:           netip.AddrFrom4([4]byte{100, 64, 0, 2}),
+		DNSLabel:     "peerB",
+		AgentVersion: "0.40.0",
 	}
 
-	group := &nmdata.Group{
-		PublicID: "1", Name: "All",
+	group := &types.ComponentGroup{
+		ID: "group-all", PublicID: "1", Name: "All",
 		Peers: []string{"peer-A", "peer-B"},
 	}
 
-	policy := &nmdata.Policy{
+	policy := &types.Policy{
 		ID: "pol-allow", PublicID: "1", Enabled: true,
-		Rules: []*nmdata.PolicyRule{{
+		Rules: []*types.PolicyRule{{
 			ID:            "rule-allow",
 			Enabled:       true,
-			Action:        string(types.PolicyTrafficActionAccept),
-			Protocol:      string(types.PolicyRuleProtocolALL),
+			Action:        types.PolicyTrafficActionAccept,
+			Protocol:      types.PolicyRuleProtocolALL,
 			Bidirectional: true,
 			Sources:       []string{"group-all"},
 			Destinations:  []string{"group-all"},
@@ -267,21 +266,21 @@ func buildSmokeComponents(t *testing.T) (*types.NetworkMapComponents, string) {
 
 	c := &types.NetworkMapComponents{
 		PeerID: "peer-A",
-		Network: &nmdata.Network{
+		Network: &types.Network{
 			Identifier: "net-smoke",
 			Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
 			Serial:     1,
 		},
-		AccountSettings: &nmdata.AccountSettingsInfo{},
-		DNSSettings:     &nmdata.DNSSettings{},
-		Peers: map[string]*nmdata.Peer{
+		AccountSettings: &types.AccountSettingsInfo{},
+		DNSSettings:     &types.DNSSettings{},
+		Peers: map[string]*types.ComponentPeer{
 			"peer-A": peerA,
 			"peer-B": peerB,
 		},
-		Groups: map[string]*nmdata.Group{
+		Groups: map[string]*types.ComponentGroup{
 			"group-all": group,
 		},
-		Policies: []*nmdata.Policy{policy},
+		Policies: []*types.Policy{policy},
 	}
 	return c, peerAKey
 }

shared/management/networkmap/networkmapcompute.go

@@ -1,659 +0,0 @@
-package networkmap
-
-import (
-	"slices"
-
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-	"github.com/netbirdio/netbird/shared/management/types"
-)
-
-type sshRequirements struct {
-	neededGroupIDs     map[string]struct{}
-	needAllowedUserIDs bool
-}
-
-// GetPeerNetworkMapComponents computes the peer's NetworkMapComponents from the
-// slim twin store. It mirrors the former Account.GetPeerNetworkMapComponents
-// exactly, operating on nmdata twins throughout — no Account reference and no
-// twin↔real conversion, since the produced components hold twins.
-func (nmd *NetworkMapData) GetPeerNetworkMapComponents(peerID string, peersCustomZone nmdata.CustomZone) *types.NetworkMapComponents {
-	peer := nmd.Peers[peerID]
-	if peer == nil {
-		return types.EmptyNetworkMapComponents(&types.NetworkMapComponents{
-			PeerID:  peerID,
-			Network: nmd.Network,
-			Peers:   map[string]*nmdata.Peer{peerID: peer},
-		})
-	}
-
-	if _, ok := nmd.ValidatedPeers[peerID]; !ok {
-		return types.EmptyNetworkMapComponents(&types.NetworkMapComponents{
-			PeerID:  peerID,
-			Network: nmd.Network,
-			Peers:   map[string]*nmdata.Peer{peerID: peer},
-		})
-	}
-
-	components := &types.NetworkMapComponents{
-		PeerID:                    peerID,
-		Network:                   nmd.Network,
-		AccountSettings:           nmd.AccountSettings,
-		DNSSettings:               nmd.DNSSettings,
-		CustomZoneDomain:          peersCustomZone.Domain,
-		NameServerGroups:          make([]*nmdata.NameServerGroup, 0),
-		ResourcePoliciesMap:       make(map[string][]*nmdata.Policy),
-		RoutersMap:                make(map[string]map[string]*nmdata.NetworkRouter),
-		NetworkResources:          make([]*nmdata.NetworkResource, 0),
-		PostureFailedPeers:        make(map[string]map[string]struct{}, len(nmd.PostureChecks)),
-		RouterPeers:               make(map[string]*nmdata.Peer),
-		NetworkXIDToPublicID:      nmd.NetworkXIDToPublicID,
-		PostureCheckXIDToPublicID: nmd.PostureCheckXIDToPublicID,
-	}
-
-	relevantPeers, relevantGroups, relevantPolicies, relevantRoutes, sshReqs := nmd.getPeersGroupsPoliciesRoutes(peerID, peer.SSHEnabled, &components.PostureFailedPeers)
-
-	if len(sshReqs.neededGroupIDs) > 0 {
-		components.GroupIDToUserIDs = filterGroupIDToUserIDs(nmd.GroupIDToUserIDs, sshReqs.neededGroupIDs)
-	}
-	if sshReqs.needAllowedUserIDs {
-		components.AllowedUserIDs = nmd.getAllowedUserIDs()
-	}
-
-	components.Peers = relevantPeers
-	components.Groups = relevantGroups
-	components.Policies = relevantPolicies
-	components.Routes = relevantRoutes
-	components.AllDNSRecords = filterDNSRecordsByPeers(peersCustomZone.Records, relevantPeers, peer.SupportsIPv6() && peer.IPv6.IsValid())
-
-	peerGroups := nmd.getPeerGroups(peerID)
-	components.AccountZones = nmd.appliedZones(peerGroups)
-	components.AccountZones = append(components.AccountZones, nmd.privateServiceZones(peerGroups)...)
-
-	for _, nsGroup := range nmd.NameServerGroups {
-		if nsGroup.Enabled {
-			for _, gID := range nsGroup.Groups {
-				if _, found := relevantGroups[gID]; found {
-					components.NameServerGroups = append(components.NameServerGroups, nsGroup)
-					break
-				}
-			}
-		}
-	}
-
-	for _, resource := range nmd.NetworkResources {
-		if !resource.Enabled {
-			continue
-		}
-
-		policies, exists := nmd.ResourcePolicies[resource.ID]
-		if !exists {
-			continue
-		}
-
-		addSourcePeers := false
-
-		networkRoutingPeers, routerExists := nmd.Routers[resource.NetworkID]
-		if routerExists {
-			if _, ok := networkRoutingPeers[peerID]; ok {
-				addSourcePeers = true
-			}
-		}
-
-		for _, policy := range policies {
-			if addSourcePeers {
-				var peers []string
-				if policy.Rules[0].SourceResource.Type == string(types.ResourceTypePeer) && policy.Rules[0].SourceResource.ID != "" {
-					peers = []string{policy.Rules[0].SourceResource.ID}
-				} else {
-					peers = nmd.getUniquePeerIDsFromGroupsIDs(policy.SourceGroups())
-				}
-				for _, pID := range nmd.getPostureValidPeersSaveFailed(peers, policy.SourcePostureChecks, &components.PostureFailedPeers) {
-					if _, exists := components.Peers[pID]; !exists {
-						components.Peers[pID] = nmd.Peers[pID]
-					}
-				}
-			} else {
-				peerInSources := false
-				if policy.Rules[0].SourceResource.Type == string(types.ResourceTypePeer) && policy.Rules[0].SourceResource.ID != "" {
-					peerInSources = policy.Rules[0].SourceResource.ID == peerID
-				} else {
-					for _, groupID := range policy.SourceGroups() {
-						if group := nmd.Groups[groupID]; group != nil && slices.Contains(group.Peers, peerID) {
-							peerInSources = true
-							break
-						}
-					}
-				}
-				if !peerInSources {
-					continue
-				}
-				isValid, pname := nmd.validatePostureChecksOnPeerGetFailed(policy.SourcePostureChecks, peerID)
-				if !isValid && len(pname) > 0 {
-					if _, ok := components.PostureFailedPeers[pname]; !ok {
-						components.PostureFailedPeers[pname] = make(map[string]struct{})
-					}
-					components.PostureFailedPeers[pname][peer.ID] = struct{}{}
-					continue
-				}
-				addSourcePeers = true
-			}
-
-			for _, rule := range policy.Rules {
-				for _, srcGroupID := range rule.Sources {
-					if g := nmd.Groups[srcGroupID]; g != nil {
-						if _, exists := components.Groups[srcGroupID]; !exists {
-							components.Groups[srcGroupID] = g
-						}
-					}
-				}
-				for _, dstGroupID := range rule.Destinations {
-					if g := nmd.Groups[dstGroupID]; g != nil {
-						if _, exists := components.Groups[dstGroupID]; !exists {
-							components.Groups[dstGroupID] = g
-						}
-					}
-				}
-			}
-			components.ResourcePoliciesMap[resource.ID] = policies
-		}
-
-		if addSourcePeers {
-			components.RoutersMap[resource.NetworkID] = networkRoutingPeers
-			for peerIDKey := range networkRoutingPeers {
-				if p := nmd.Peers[peerIDKey]; p != nil {
-					if _, exists := components.RouterPeers[peerIDKey]; !exists {
-						components.RouterPeers[peerIDKey] = p
-					}
-					if _, exists := components.Peers[peerIDKey]; !exists {
-						if _, validated := nmd.ValidatedPeers[peerIDKey]; validated {
-							components.Peers[peerIDKey] = p
-						}
-					}
-				}
-			}
-			components.NetworkResources = append(components.NetworkResources, resource)
-		}
-	}
-
-	filterGroupPeers(&components.Groups, components.Peers)
-	filterPostureFailedPeers(&components.PostureFailedPeers, components.Policies, components.ResourcePoliciesMap, components.Peers)
-
-	return components
-}
-
-func (nmd *NetworkMapData) getPeersGroupsPoliciesRoutes(
-	peerID string,
-	peerSSHEnabled bool,
-	postureFailedPeers *map[string]map[string]struct{},
-) (map[string]*nmdata.Peer, map[string]*nmdata.Group, []*nmdata.Policy, []*nmdata.Route, sshRequirements) {
-	relevantPeerIDs := make(map[string]*nmdata.Peer, len(nmd.Peers)/4)
-	relevantGroupIDs := make(map[string]*nmdata.Group, len(nmd.Groups)/4)
-	relevantPolicies := make([]*nmdata.Policy, 0, len(nmd.Policies))
-	relevantRoutes := make([]*nmdata.Route, 0, len(nmd.Routes))
-	sshReqs := sshRequirements{neededGroupIDs: make(map[string]struct{})}
-
-	relevantPeerIDs[peerID] = nmd.Peers[peerID]
-
-	peerGroupSet := make(map[string]struct{}, 8)
-	for groupID, group := range nmd.Groups {
-		if slices.Contains(group.Peers, peerID) {
-			relevantGroupIDs[groupID] = group
-			peerGroupSet[groupID] = struct{}{}
-		}
-	}
-
-	routeAccessControlGroups := make(map[string]struct{})
-	for _, r := range nmd.Routes {
-		if r == nil {
-			continue
-		}
-		relevant := r.Peer == peerID
-		if !relevant {
-			for _, groupID := range r.PeerGroups {
-				if _, ok := peerGroupSet[groupID]; ok {
-					relevant = true
-					break
-				}
-			}
-		}
-		if !relevant && r.Enabled {
-			for _, groupID := range r.Groups {
-				if _, ok := peerGroupSet[groupID]; ok {
-					relevant = true
-					break
-				}
-			}
-		}
-		if !relevant {
-			continue
-		}
-
-		for _, groupID := range r.PeerGroups {
-			relevantGroupIDs[groupID] = nmd.Groups[groupID]
-		}
-		for _, groupID := range r.Groups {
-			relevantGroupIDs[groupID] = nmd.Groups[groupID]
-		}
-		if r.Enabled {
-			for _, groupID := range r.AccessControlGroups {
-				relevantGroupIDs[groupID] = nmd.Groups[groupID]
-				routeAccessControlGroups[groupID] = struct{}{}
-			}
-		}
-
-		if r.Peer != "" {
-			if _, ok := nmd.ValidatedPeers[r.Peer]; ok {
-				if p := nmd.Peers[r.Peer]; p != nil {
-					relevantPeerIDs[r.Peer] = p
-				}
-			}
-		}
-		for _, groupID := range r.PeerGroups {
-			g := nmd.Groups[groupID]
-			if g == nil {
-				continue
-			}
-			for _, pid := range g.Peers {
-				if _, exists := relevantPeerIDs[pid]; exists {
-					continue
-				}
-				if _, ok := nmd.ValidatedPeers[pid]; !ok {
-					continue
-				}
-				if p := nmd.Peers[pid]; p != nil {
-					relevantPeerIDs[pid] = p
-				}
-			}
-		}
-		relevantRoutes = append(relevantRoutes, r)
-	}
-
-	for _, policy := range nmd.Policies {
-		if !policy.Enabled {
-			continue
-		}
-
-		policyRelevant := false
-		for _, rule := range policy.Rules {
-			if !rule.Enabled {
-				continue
-			}
-
-			if len(routeAccessControlGroups) > 0 {
-				for _, destGroupID := range rule.Destinations {
-					if _, needed := routeAccessControlGroups[destGroupID]; needed {
-						policyRelevant = true
-						for _, srcGroupID := range rule.Sources {
-							relevantGroupIDs[srcGroupID] = nmd.Groups[srcGroupID]
-						}
-						for _, dstGroupID := range rule.Destinations {
-							relevantGroupIDs[dstGroupID] = nmd.Groups[dstGroupID]
-						}
-						break
-					}
-				}
-			}
-
-			var sourcePeers, destinationPeers []string
-			var peerInSources, peerInDestinations bool
-
-			if rule.SourceResource.Type == string(types.ResourceTypePeer) && rule.SourceResource.ID != "" {
-				sourcePeers = []string{rule.SourceResource.ID}
-				if rule.SourceResource.ID == peerID {
-					peerInSources = true
-				}
-			} else {
-				sourcePeers, peerInSources = nmd.getPeersFromGroups(rule.Sources, peerID, policy.SourcePostureChecks, postureFailedPeers)
-			}
-
-			if rule.DestinationResource.Type == string(types.ResourceTypePeer) && rule.DestinationResource.ID != "" {
-				destinationPeers = []string{rule.DestinationResource.ID}
-				if rule.DestinationResource.ID == peerID {
-					peerInDestinations = true
-				}
-			} else {
-				destinationPeers, peerInDestinations = nmd.getPeersFromGroups(rule.Destinations, peerID, nil, postureFailedPeers)
-			}
-
-			if peerInSources {
-				policyRelevant = true
-				for _, pid := range destinationPeers {
-					relevantPeerIDs[pid] = nmd.Peers[pid]
-				}
-				for _, dstGroupID := range rule.Destinations {
-					relevantGroupIDs[dstGroupID] = nmd.Groups[dstGroupID]
-				}
-			}
-
-			if peerInDestinations {
-				policyRelevant = true
-				for _, pid := range sourcePeers {
-					relevantPeerIDs[pid] = nmd.Peers[pid]
-				}
-				for _, srcGroupID := range rule.Sources {
-					relevantGroupIDs[srcGroupID] = nmd.Groups[srcGroupID]
-				}
-
-				if rule.Protocol == string(types.PolicyRuleProtocolNetbirdSSH) {
-					switch {
-					case len(rule.AuthorizedGroups) > 0:
-						for groupID := range rule.AuthorizedGroups {
-							sshReqs.neededGroupIDs[groupID] = struct{}{}
-						}
-					case rule.AuthorizedUser != "":
-					default:
-						sshReqs.needAllowedUserIDs = true
-					}
-				} else if nmdata.PolicyRuleImpliesLegacySSH(rule) && peerSSHEnabled {
-					sshReqs.needAllowedUserIDs = true
-				}
-			}
-		}
-		if policyRelevant {
-			relevantPolicies = append(relevantPolicies, policy)
-		}
-	}
-
-	return relevantPeerIDs, relevantGroupIDs, relevantPolicies, relevantRoutes, sshReqs
-}
-
-func (nmd *NetworkMapData) getPeersFromGroups(groups []string, peerID string, sourcePostureChecksIDs []string,
-	postureFailedPeers *map[string]map[string]struct{}) ([]string, bool) {
-	peerInGroups := false
-	filteredPeerIDs := make([]string, 0, len(groups))
-	seenPeerIds := make(map[string]struct{}, len(groups))
-
-	for _, gid := range groups {
-		group := nmd.Groups[gid]
-		if group == nil {
-			continue
-		}
-
-		if group.IsGroupAll() || len(groups) == 1 {
-			filteredPeerIDs = make([]string, 0, len(group.Peers))
-			peerInGroups = false
-			for _, pid := range group.Peers {
-				peer, ok := nmd.Peers[pid]
-				if !ok || peer == nil {
-					continue
-				}
-
-				if _, ok := nmd.ValidatedPeers[peer.ID]; !ok {
-					continue
-				}
-
-				isValid, pname := nmd.validatePostureChecksOnPeerGetFailed(sourcePostureChecksIDs, peer.ID)
-				if !isValid && len(pname) > 0 {
-					if _, ok := (*postureFailedPeers)[pname]; !ok {
-						(*postureFailedPeers)[pname] = make(map[string]struct{})
-					}
-					(*postureFailedPeers)[pname][peer.ID] = struct{}{}
-					continue
-				}
-
-				if peer.ID == peerID {
-					peerInGroups = true
-					continue
-				}
-
-				filteredPeerIDs = append(filteredPeerIDs, peer.ID)
-			}
-			return filteredPeerIDs, peerInGroups
-		}
-
-		for _, pid := range group.Peers {
-			if _, seen := seenPeerIds[pid]; seen {
-				continue
-			}
-			seenPeerIds[pid] = struct{}{}
-			peer, ok := nmd.Peers[pid]
-			if !ok || peer == nil {
-				continue
-			}
-
-			if _, ok := nmd.ValidatedPeers[peer.ID]; !ok {
-				continue
-			}
-
-			isValid, pname := nmd.validatePostureChecksOnPeerGetFailed(sourcePostureChecksIDs, peer.ID)
-			if !isValid && len(pname) > 0 {
-				if _, ok := (*postureFailedPeers)[pname]; !ok {
-					(*postureFailedPeers)[pname] = make(map[string]struct{})
-				}
-				(*postureFailedPeers)[pname][peer.ID] = struct{}{}
-				continue
-			}
-
-			if peer.ID == peerID {
-				peerInGroups = true
-				continue
-			}
-
-			filteredPeerIDs = append(filteredPeerIDs, peer.ID)
-		}
-	}
-
-	return filteredPeerIDs, peerInGroups
-}
-
-func (nmd *NetworkMapData) validatePostureChecksOnPeerGetFailed(sourcePostureChecksID []string, peerID string) (bool, string) {
-	peer, ok := nmd.Peers[peerID]
-	if !ok || peer == nil {
-		return false, ""
-	}
-
-	for _, postureChecksID := range sourcePostureChecksID {
-		postureChecks := nmd.PostureChecks[postureChecksID]
-		if postureChecks == nil {
-			continue
-		}
-		if !postureChecks.Passes(peer) {
-			return false, postureChecksID
-		}
-	}
-	return true, ""
-}
-
-func (nmd *NetworkMapData) getPostureValidPeersSaveFailed(inputPeers []string, postureChecksIDs []string, postureFailedPeers *map[string]map[string]struct{}) []string {
-	var dest []string
-	for _, peerID := range inputPeers {
-		if _, validated := nmd.ValidatedPeers[peerID]; !validated {
-			continue
-		}
-		valid, pname := nmd.validatePostureChecksOnPeerGetFailed(postureChecksIDs, peerID)
-		if valid {
-			dest = append(dest, peerID)
-			continue
-		}
-		if _, ok := (*postureFailedPeers)[pname]; !ok {
-			(*postureFailedPeers)[pname] = make(map[string]struct{})
-		}
-		(*postureFailedPeers)[pname][peerID] = struct{}{}
-	}
-	return dest
-}
-
-func (nmd *NetworkMapData) getPeerGroups(peerID string) map[string]struct{} {
-	groups := make(map[string]struct{})
-	for groupID, group := range nmd.Groups {
-		if slices.Contains(group.Peers, peerID) {
-			groups[groupID] = struct{}{}
-		}
-	}
-	return groups
-}
-
-func (nmd *NetworkMapData) getUniquePeerIDsFromGroupsIDs(groups []string) []string {
-	peerIDs := make(map[string]struct{}, len(groups))
-	for _, groupID := range groups {
-		group := nmd.Groups[groupID]
-		if group == nil {
-			continue
-		}
-
-		if group.IsGroupAll() || len(groups) == 1 {
-			return group.Peers
-		}
-
-		for _, peerID := range group.Peers {
-			peerIDs[peerID] = struct{}{}
-		}
-	}
-
-	ids := make([]string, 0, len(peerIDs))
-	for peerID := range peerIDs {
-		ids = append(ids, peerID)
-	}
-
-	return ids
-}
-
-func (nmd *NetworkMapData) getAllowedUserIDs() map[string]struct{} {
-	return nmd.AllowedUserIDs
-}
-
-func (nmd *NetworkMapData) appliedZones(peerGroups map[string]struct{}) []nmdata.CustomZone {
-	if len(peerGroups) == 0 {
-		return nil
-	}
-	var out []nmdata.CustomZone
-	for _, cand := range nmd.AppliedZoneCandidates {
-		if peerInDistributionGroups(peerGroups, cand.DistributionGroups) {
-			out = append(out, cand.Zone)
-		}
-	}
-	return out
-}
-
-func (nmd *NetworkMapData) privateServiceZones(peerGroups map[string]struct{}) []nmdata.CustomZone {
-	byApex := make(map[string]*nmdata.CustomZone)
-	var order []string
-	for _, cand := range nmd.PrivateServiceCandidates {
-		if !peerInDistributionGroups(peerGroups, cand.AccessGroups) {
-			continue
-		}
-		zone, exists := byApex[cand.Zone.Domain]
-		if !exists {
-			nz := nmdata.CustomZone{
-				Domain:               cand.Zone.Domain,
-				SearchDomainDisabled: cand.Zone.SearchDomainDisabled,
-				NonAuthoritative:     cand.Zone.NonAuthoritative,
-			}
-			byApex[cand.Zone.Domain] = &nz
-			zone = &nz
-			order = append(order, cand.Zone.Domain)
-		}
-		zone.Records = append(zone.Records, cand.Zone.Records...)
-	}
-
-	var out []nmdata.CustomZone
-	for _, apex := range order {
-		zone := byApex[apex]
-		if len(zone.Records) == 0 {
-			continue
-		}
-		out = append(out, *zone)
-	}
-	return out
-}
-
-func peerInDistributionGroups(peerGroups map[string]struct{}, groups []string) bool {
-	for _, g := range groups {
-		if _, ok := peerGroups[g]; ok {
-			return true
-		}
-	}
-	return false
-}
-
-func filterGroupPeers(groups *map[string]*nmdata.Group, peers map[string]*nmdata.Peer) {
-	for groupID, groupInfo := range *groups {
-		filteredPeers := make([]string, 0, len(groupInfo.Peers))
-		for _, pid := range groupInfo.Peers {
-			if _, exists := peers[pid]; exists {
-				filteredPeers = append(filteredPeers, pid)
-			}
-		}
-
-		if len(filteredPeers) != len(groupInfo.Peers) {
-			ng := groupInfo.Copy()
-			ng.Peers = filteredPeers
-			(*groups)[groupID] = ng
-		}
-	}
-}
-
-func filterPostureFailedPeers(postureFailedPeers *map[string]map[string]struct{}, policies []*nmdata.Policy, resourcePoliciesMap map[string][]*nmdata.Policy, peers map[string]*nmdata.Peer) {
-	if len(*postureFailedPeers) == 0 {
-		return
-	}
-
-	referencedPostureChecks := make(map[string]struct{})
-	for _, policy := range policies {
-		for _, checkID := range policy.SourcePostureChecks {
-			referencedPostureChecks[checkID] = struct{}{}
-		}
-	}
-	for _, resPolicies := range resourcePoliciesMap {
-		for _, policy := range resPolicies {
-			for _, checkID := range policy.SourcePostureChecks {
-				referencedPostureChecks[checkID] = struct{}{}
-			}
-		}
-	}
-
-	for checkID, failedPeers := range *postureFailedPeers {
-		if _, referenced := referencedPostureChecks[checkID]; !referenced {
-			delete(*postureFailedPeers, checkID)
-			continue
-		}
-		for peerID := range failedPeers {
-			if _, exists := peers[peerID]; !exists {
-				delete(failedPeers, peerID)
-			}
-		}
-		if len(failedPeers) == 0 {
-			delete(*postureFailedPeers, checkID)
-		}
-	}
-}
-
-func filterDNSRecordsByPeers(records []nmdata.SimpleRecord, peers map[string]*nmdata.Peer, includeIPv6 bool) []nmdata.SimpleRecord {
-	if len(records) == 0 || len(peers) == 0 {
-		return nil
-	}
-
-	peerIPs := make(map[string]struct{}, len(peers)*2)
-	for _, peer := range peers {
-		if peer == nil {
-			continue
-		}
-		peerIPs[peer.IP.String()] = struct{}{}
-		if includeIPv6 && peer.IPv6.IsValid() {
-			peerIPs[peer.IPv6.String()] = struct{}{}
-		}
-	}
-
-	filteredRecords := make([]nmdata.SimpleRecord, 0, len(records))
-	for _, record := range records {
-		if _, exists := peerIPs[record.RData]; exists {
-			filteredRecords = append(filteredRecords, record)
-		}
-	}
-
-	return filteredRecords
-}
-
-func filterGroupIDToUserIDs(fullMap map[string][]string, neededGroupIDs map[string]struct{}) map[string][]string {
-	if len(neededGroupIDs) == 0 {
-		return nil
-	}
-
-	filtered := make(map[string][]string, len(neededGroupIDs))
-	for groupID := range neededGroupIDs {
-		if users, ok := fullMap[groupID]; ok {
-			filtered[groupID] = users
-		}
-	}
-	return filtered
-}

shared/management/networkmap/networkmapdata.go

@@ -1,55 +0,0 @@
-package networkmap
-
-import (
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
-)
-
-// NetworkMapData is a dependency-light, slim twin of the server Account. It
-// carries only the state GetPeerNetworkMapComponents needs, expressed in the
-// fresh nmdata twin types. A builder converts an Account into a NetworkMapData
-// once per account; the per-peer components calculation then runs on this twin
-// with no reference back to the Account.
-type NetworkMapData struct {
-	Peers            map[string]*nmdata.Peer
-	Groups           map[string]*nmdata.Group
-	Policies         []*nmdata.Policy
-	Routes           []*nmdata.Route
-	NameServerGroups []*nmdata.NameServerGroup
-	NetworkResources []*nmdata.NetworkResource
-
-	Network         *nmdata.Network
-	DNSSettings     *nmdata.DNSSettings
-	AccountSettings *nmdata.AccountSettingsInfo
-
-	PostureChecks map[string]*nmdata.PostureChecks
-
-	AllowedUserIDs            map[string]struct{}
-	NetworkXIDToPublicID      map[string]string
-	PostureCheckXIDToPublicID map[string]string
-	ValidatedPeers            map[string]struct{}
-	ResourcePolicies          map[string][]*nmdata.Policy
-	Routers                   map[string]map[string]*nmdata.NetworkRouter
-	GroupIDToUserIDs          map[string][]string
-	DNSDomain                 string
-
-	AppliedZoneCandidates    []AppliedZoneCandidate
-	PrivateServiceCandidates []PrivateServiceCandidate
-}
-
-// AppliedZoneCandidate is an account-level custom DNS zone reduced to the
-// per-peer decision the components calc still makes: include the zone only when
-// the peer belongs to one of its distribution groups. Record conversion is done
-// once at build time.
-type AppliedZoneCandidate struct {
-	DistributionGroups []string
-	Zone               nmdata.CustomZone
-}
-
-// PrivateServiceCandidate is a single private service's synthesized records,
-// carried per apex zone. The builder resolves proxy-cluster connectivity and
-// domain-suffix matching once; the calc merges the candidates whose AccessGroups
-// the peer belongs to, grouped by Zone.Domain.
-type PrivateServiceCandidate struct {
-	AccessGroups []string
-	Zone         nmdata.CustomZone
-}

shared/management/networkmap/nmdata/account_settings.go

@@ -1,11 +0,0 @@
-package nmdata
-
-import "time"
-
-// AccountSettingsInfo is the slim twin of types.AccountSettingsInfo.
-type AccountSettingsInfo struct {
-	PeerLoginExpirationEnabled      bool
-	PeerLoginExpiration             time.Duration
-	PeerInactivityExpirationEnabled bool
-	PeerInactivityExpiration        time.Duration
-}

shared/management/networkmap/nmdata/dns.go

@@ -1,18 +0,0 @@
-package nmdata
-
-// SimpleRecord is the slim twin of dns.SimpleRecord.
-type SimpleRecord struct {
-	Name  string
-	Type  int
-	Class string
-	TTL   int
-	RData string
-}
-
-// CustomZone is the slim twin of dns.CustomZone.
-type CustomZone struct {
-	Domain               string
-	Records              []SimpleRecord
-	SearchDomainDisabled bool
-	NonAuthoritative     bool
-}

shared/management/networkmap/nmdata/dns_settings.go

@@ -1,6 +0,0 @@
-package nmdata
-
-// DNSSettings is the slim twin of types.DNSSettings.
-type DNSSettings struct {
-	DisabledManagementGroups []string
-}

shared/management/networkmap/nmdata/group.go

@@ -1,25 +0,0 @@
-package nmdata
-
-import "slices"
-
-const groupAllName = "All"
-
-// Group is the slim twin of types.Group.
-type Group struct {
-	Name      string
-	PublicID  string
-	Peers     []string
-	Resources []Resource
-}
-
-func (g *Group) IsGroupAll() bool {
-	return g.Name == groupAllName
-}
-
-func (g *Group) Copy() *Group {
-	return &Group{
-		Name:     g.Name,
-		PublicID: g.PublicID,
-		Peers:    slices.Clone(g.Peers),
-	}
-}

shared/management/networkmap/nmdata/nameserver.go

@@ -1,24 +0,0 @@
-package nmdata
-
-import "net/netip"
-
-// NameServerGroup is the slim twin of dns.NameServerGroup.
-type NameServerGroup struct {
-	ID                   string
-	PublicID             string
-	Name                 string
-	Description          string
-	NameServers          []NameServer
-	Groups               []string
-	Primary              bool
-	Domains              []string
-	Enabled              bool
-	SearchDomainsEnabled bool
-}
-
-// NameServer is the slim twin of dns.NameServer.
-type NameServer struct {
-	IP     netip.Addr
-	NSType int
-	Port   int
-}

shared/management/networkmap/nmdata/network.go

@@ -1,16 +0,0 @@
-package nmdata
-
-import "net"
-
-// Network is the slim twin of types.Network.
-type Network struct {
-	Identifier string
-	Net        net.IPNet
-	NetV6      net.IPNet
-	Dns        string
-	Serial     uint64
-}
-
-func (n *Network) CurrentSerial() uint64 {
-	return n.Serial
-}

shared/management/networkmap/nmdata/network_resource.go

@@ -1,18 +0,0 @@
-package nmdata
-
-import "net/netip"
-
-// NetworkResource is the slim twin of resources/types.NetworkResource.
-type NetworkResource struct {
-	ID          string
-	NetworkID   string
-	AccountID   string
-	PublicID    string
-	Name        string
-	Description string
-	Type        string
-	Address     string
-	Domain      string
-	Prefix      netip.Prefix
-	Enabled     bool
-}

shared/management/networkmap/nmdata/network_router.go

@@ -1,10 +0,0 @@
-package nmdata
-
-// NetworkRouter is the slim twin of routers/types.NetworkRouter.
-type NetworkRouter struct {
-	PublicID   string
-	PeerGroups []string
-	Masquerade bool
-	Metric     int
-	Enabled    bool
-}

shared/management/networkmap/nmdata/peer.go

@@ -1,105 +0,0 @@
-package nmdata
-
-import (
-	"net"
-	"net/netip"
-	"slices"
-	"time"
-)
-
-const (
-	peerCapabilitySourcePrefixes int32 = 1
-	peerCapabilityIPv6Overlay    int32 = 2
-)
-
-// Peer is the slim twin of peer.Peer.
-type Peer struct {
-	ID                     string
-	Key                    string
-	SSHKey                 string
-	DNSLabel               string
-	UserID                 string
-	SSHEnabled             bool
-	LoginExpirationEnabled bool
-	LastLogin              *time.Time
-	IP                     netip.Addr
-	IPv6                   netip.Addr
-	Meta                   PeerSystemMeta
-	Location               PeerLocation
-}
-
-// PeerSystemMeta is the slim twin of peer.PeerSystemMeta.
-type PeerSystemMeta struct {
-	WtVersion        string
-	GoOS             string
-	OSVersion        string
-	KernelVersion    string
-	NetworkAddresses []NetworkAddress
-	Files            []File
-	Capabilities     []int32
-	Flags            Flags
-}
-
-// Flags is the slim twin of peer.Flags.
-type Flags struct {
-	ServerSSHAllowed bool
-	DisableIPv6      bool
-}
-
-// NetworkAddress is the slim twin of peer.NetworkAddress.
-type NetworkAddress struct {
-	NetIP netip.Prefix
-}
-
-// File is the slim twin of peer.File.
-type File struct {
-	Path             string
-	ProcessIsRunning bool
-}
-
-// PeerLocation is the slim twin of peer.Location.
-type PeerLocation struct {
-	CountryCode  string
-	CityName     string
-	ConnectionIP net.IP
-}
-
-func (p *Peer) HasCapability(capability int32) bool {
-	return slices.Contains(p.Meta.Capabilities, capability)
-}
-
-func (p *Peer) SupportsIPv6() bool {
-	return !p.Meta.Flags.DisableIPv6 && p.HasCapability(peerCapabilityIPv6Overlay)
-}
-
-func (p *Peer) SupportsSourcePrefixes() bool {
-	return p.HasCapability(peerCapabilitySourcePrefixes)
-}
-
-func (p *Peer) AddedWithSSOLogin() bool {
-	return p.UserID != ""
-}
-
-func (p *Peer) FQDN(dnsDomain string) string {
-	if dnsDomain == "" {
-		return ""
-	}
-	return p.DNSLabel + "." + dnsDomain
-}
-
-func (p *Peer) GetLastLogin() time.Time {
-	if p.LastLogin != nil {
-		return *p.LastLogin
-	}
-	return time.Time{}
-}
-
-func (p *Peer) LoginExpired(expiresIn time.Duration) (bool, time.Duration) {
-	if !p.AddedWithSSOLogin() || !p.LoginExpirationEnabled {
-		return false, 0
-	}
-	expiresAt := p.GetLastLogin().Add(expiresIn)
-	now := time.Now()
-	timeLeft := expiresAt.Sub(now)
-	return timeLeft <= 0, timeLeft
-}

shared/management/networkmap/nmdata/policy.go

@@ -1,93 +0,0 @@
-package nmdata
-
-const (
-	policyRuleProtocolALL = "all"
-	policyRuleProtocolTCP = "tcp"
-
-	defaultSSHPortString        = "22"
-	nativeSSHPortString         = "22022"
-	defaultSSHPortNumber uint16 = 22
-	nativeSSHPortNumber  uint16 = 22022
-)
-
-// Policy is the slim twin of types.Policy.
-type Policy struct {
-	ID                  string
-	PublicID            string
-	Enabled             bool
-	SourcePostureChecks []string
-	Rules               []*PolicyRule
-}
-
-// PolicyRule is the slim twin of types.PolicyRule.
-type PolicyRule struct {
-	ID                  string
-	PolicyID            string
-	Enabled             bool
-	Action              string
-	Protocol            string
-	Bidirectional       bool
-	Sources             []string
-	Destinations        []string
-	SourceResource      Resource
-	DestinationResource Resource
-	Ports               []string
-	PortRanges          []RulePortRange
-	AuthorizedGroups    map[string][]string
-	AuthorizedUser      string
-}
-
-// RulePortRange is the slim twin of types.RulePortRange.
-type RulePortRange struct {
-	Start uint16
-	End   uint16
-}
-
-// Resource is the slim twin of types.Resource.
-type Resource struct {
-	ID   string
-	Type string
-}
-
-func (p *Policy) SourceGroups() []string {
-	if len(p.Rules) == 1 {
-		return p.Rules[0].Sources
-	}
-	groups := make(map[string]struct{}, len(p.Rules))
-	for _, rule := range p.Rules {
-		for _, source := range rule.Sources {
-			groups[source] = struct{}{}
-		}
-	}
-
-	groupIDs := make([]string, 0, len(groups))
-	for groupID := range groups {
-		groupIDs = append(groupIDs, groupID)
-	}
-
-	return groupIDs
-}
-
-// PolicyRuleImpliesLegacySSH is the twin-typed sibling of types.PolicyRuleImpliesLegacySSH.
-func PolicyRuleImpliesLegacySSH(rule *PolicyRule) bool {
-	return rule.Protocol == policyRuleProtocolALL ||
-		(rule.Protocol == policyRuleProtocolTCP && (portsIncludesSSH(rule.Ports) || portRangeIncludesSSH(rule.PortRanges)))
-}
-
-func portRangeIncludesSSH(portRanges []RulePortRange) bool {
-	for _, pr := range portRanges {
-		if (pr.Start <= defaultSSHPortNumber && pr.End >= defaultSSHPortNumber) || (pr.Start <= nativeSSHPortNumber && pr.End >= nativeSSHPortNumber) {
-			return true
-		}
-	}
-	return false
-}
-
-func portsIncludesSSH(ports []string) bool {
-	for _, port := range ports {
-		if port == defaultSSHPortString || port == nativeSSHPortString {
-			return true
-		}
-	}
-	return false
-}

shared/management/networkmap/nmdata/posture.go

@@ -1,59 +0,0 @@
-package nmdata
-
-const (
-	checkActionAllow = "allow"
-	checkActionDeny  = "deny"
-)
-
-// PostureChecks is the slim twin of posture.Checks.
-type PostureChecks struct {
-	ID     string
-	Checks ChecksDefinition
-}
-
-// ChecksDefinition is the slim twin of posture.ChecksDefinition.
-type ChecksDefinition struct {
-	NBVersionCheck        *NBVersionCheck
-	OSVersionCheck        *OSVersionCheck
-	GeoLocationCheck      *GeoLocationCheck
-	PeerNetworkRangeCheck *PeerNetworkRangeCheck
-	ProcessCheck          *ProcessCheck
-}
-
-type postureCheck interface {
-	check(peer *Peer) (bool, error)
-}
-
-// Passes reports whether the peer satisfies every check in this bundle. It
-// mirrors the server posture path: a check returning (false, _) — including on
-// an evaluation error — fails the bundle.
-func (pc *PostureChecks) Passes(peer *Peer) bool {
-	for _, c := range pc.GetChecks() {
-		valid, _ := c.check(peer)
-		if !valid {
-			return false
-		}
-	}
-	return true
-}
-
-// GetChecks returns the initialized checks in the same order as posture.Checks.GetChecks.
-func (pc *PostureChecks) GetChecks() []postureCheck {
-	var checks []postureCheck
-	if pc.Checks.NBVersionCheck != nil {
-		checks = append(checks, pc.Checks.NBVersionCheck)
-	}
-	if pc.Checks.OSVersionCheck != nil {
-		checks = append(checks, pc.Checks.OSVersionCheck)
-	}
-	if pc.Checks.GeoLocationCheck != nil {
-		checks = append(checks, pc.Checks.GeoLocationCheck)
-	}
-	if pc.Checks.PeerNetworkRangeCheck != nil {
-		checks = append(checks, pc.Checks.PeerNetworkRangeCheck)
-	}
-	if pc.Checks.ProcessCheck != nil {
-		checks = append(checks, pc.Checks.ProcessCheck)
-	}
-	return checks
-}

shared/management/networkmap/nmdata/posture_geo_location.go

@@ -1,45 +0,0 @@
-package nmdata
-
-import "fmt"
-
-// GeoLocation is the slim twin of posture.Location.
-type GeoLocation struct {
-	CountryCode string
-	CityName    string
-}
-
-// GeoLocationCheck is the slim twin of posture.GeoLocationCheck.
-type GeoLocationCheck struct {
-	Locations []GeoLocation
-	Action    string
-}
-
-func (g *GeoLocationCheck) check(peer *Peer) (bool, error) {
-	if peer.Location.CountryCode == "" && peer.Location.CityName == "" {
-		return false, fmt.Errorf("peer's location is not set")
-	}
-
-	for _, loc := range g.Locations {
-		if loc.CountryCode == peer.Location.CountryCode {
-			if loc.CityName == "" || loc.CityName == peer.Location.CityName {
-				switch g.Action {
-				case checkActionDeny:
-					return false, nil
-				case checkActionAllow:
-					return true, nil
-				default:
-					return false, fmt.Errorf("invalid geo location action: %s", g.Action)
-				}
-			}
-		}
-	}
-
-	if g.Action == checkActionDeny {
-		return true, nil
-	}
-	if g.Action == checkActionAllow {
-		return false, nil
-	}
-
-	return false, fmt.Errorf("invalid geo location action: %s", g.Action)
-}

shared/management/networkmap/nmdata/posture_nb_version.go

@@ -1,38 +0,0 @@
-package nmdata
-
-import (
-	"strings"
-
-	"github.com/hashicorp/go-version"
-)
-
-// NBVersionCheck is the slim twin of posture.NBVersionCheck.
-type NBVersionCheck struct {
-	MinVersion string
-}
-
-func (n *NBVersionCheck) check(peer *Peer) (bool, error) {
-	return meetsMinVersion(n.MinVersion, peer.Meta.WtVersion)
-}
-
-func meetsMinVersion(minVer, peerVer string) (bool, error) {
-	peerVer = sanitizeVersion(peerVer)
-	minVer = sanitizeVersion(minVer)
-
-	peerNBVer, err := version.NewVersion(peerVer)
-	if err != nil {
-		return false, err
-	}
-
-	constraints, err := version.NewConstraint(">= " + minVer)
-	if err != nil {
-		return false, err
-	}
-
-	return constraints.Check(peerNBVer), nil
-}
-
-func sanitizeVersion(v string) string {
-	parts := strings.Split(v, "-")
-	return parts[0]
-}

shared/management/networkmap/nmdata/posture_network.go

@@ -1,62 +0,0 @@
-package nmdata
-
-import (
-	"fmt"
-	"net/netip"
-)
-
-// PeerNetworkRangeCheck is the slim twin of posture.PeerNetworkRangeCheck.
-type PeerNetworkRangeCheck struct {
-	Action string
-	Ranges []netip.Prefix
-}
-
-func (p *PeerNetworkRangeCheck) check(peer *Peer) (bool, error) {
-	peerPrefixes := make([]netip.Prefix, 0, len(peer.Meta.NetworkAddresses)+1)
-	for _, peerNetAddr := range peer.Meta.NetworkAddresses {
-		peerPrefixes = append(peerPrefixes, peerNetAddr.NetIP)
-	}
-	if connIP := peer.Location.ConnectionIP; len(connIP) > 0 {
-		if addr, ok := netip.AddrFromSlice(connIP); ok {
-			addr = addr.Unmap()
-			peerPrefixes = append(peerPrefixes, netip.PrefixFrom(addr, addr.BitLen()))
-		}
-	}
-
-	if len(peerPrefixes) == 0 {
-		return false, fmt.Errorf("peer's does not contain peer network range addresses")
-	}
-
-	for _, peerPrefix := range peerPrefixes {
-		for _, rangePrefix := range p.Ranges {
-			if !prefixContains(rangePrefix, peerPrefix) {
-				continue
-			}
-			switch p.Action {
-			case checkActionDeny:
-				return false, nil
-			case checkActionAllow:
-				return true, nil
-			default:
-				return false, fmt.Errorf("invalid peer network range check action: %s", p.Action)
-			}
-		}
-	}
-
-	if p.Action == checkActionDeny {
-		return true, nil
-	}
-	if p.Action == checkActionAllow {
-		return false, nil
-	}
-
-	return false, fmt.Errorf("invalid peer network range check action: %s", p.Action)
-}
-
-func prefixContains(outer, inner netip.Prefix) bool {
-	outer = outer.Masked()
-	inner = inner.Masked()
-	return outer.Bits() <= inner.Bits() &&
-		outer.Addr().BitLen() == inner.Addr().BitLen() &&
-		outer.Contains(inner.Addr())
-}

shared/management/networkmap/nmdata/posture_os_version.go

@@ -1,79 +0,0 @@
-package nmdata
-
-import (
-	"strings"
-
-	"github.com/hashicorp/go-version"
-)
-
-// MinVersionCheck is the slim twin of posture.MinVersionCheck.
-type MinVersionCheck struct {
-	MinVersion string
-}
-
-// MinKernelVersionCheck is the slim twin of posture.MinKernelVersionCheck.
-type MinKernelVersionCheck struct {
-	MinKernelVersion string
-}
-
-// OSVersionCheck is the slim twin of posture.OSVersionCheck.
-type OSVersionCheck struct {
-	Android *MinVersionCheck
-	Darwin  *MinVersionCheck
-	Ios     *MinVersionCheck
-	Linux   *MinKernelVersionCheck
-	Windows *MinKernelVersionCheck
-}
-
-func (c *OSVersionCheck) check(peer *Peer) (bool, error) {
-	switch peer.Meta.GoOS {
-	case "android":
-		return checkMinVersion(peer.Meta.OSVersion, c.Android)
-	case "darwin":
-		return checkMinVersion(peer.Meta.OSVersion, c.Darwin)
-	case "ios":
-		return checkMinVersion(peer.Meta.OSVersion, c.Ios)
-	case "linux":
-		kernelVersion := strings.Split(peer.Meta.KernelVersion, "-")[0]
-		return checkMinKernelVersion(kernelVersion, c.Linux)
-	case "windows":
-		return checkMinKernelVersion(peer.Meta.KernelVersion, c.Windows)
-	}
-	return true, nil
-}
-
-func checkMinVersion(peerVersion string, check *MinVersionCheck) (bool, error) {
-	if check == nil {
-		return false, nil
-	}
-
-	peerNBVersion, err := version.NewVersion(peerVersion)
-	if err != nil {
-		return false, err
-	}
-
-	constraints, err := version.NewConstraint(">= " + check.MinVersion)
-	if err != nil {
-		return false, err
-	}
-
-	return constraints.Check(peerNBVersion), nil
-}
-
-func checkMinKernelVersion(peerVersion string, check *MinKernelVersionCheck) (bool, error) {
-	if check == nil {
-		return false, nil
-	}
-
-	peerNBVersion, err := version.NewVersion(peerVersion)
-	if err != nil {
-		return false, err
-	}
-
-	constraints, err := version.NewConstraint(">= " + check.MinKernelVersion)
-	if err != nil {
-		return false, err
-	}
-
-	return constraints.Check(peerNBVersion), nil
-}

shared/management/networkmap/nmdata/posture_process.go

@@ -1,56 +0,0 @@
-package nmdata
-
-import (
-	"fmt"
-	"slices"
-)
-
-// Process is the slim twin of posture.Process.
-type Process struct {
-	LinuxPath   string
-	MacPath     string
-	WindowsPath string
-}
-
-// ProcessCheck is the slim twin of posture.ProcessCheck.
-type ProcessCheck struct {
-	Processes []Process
-}
-
-func (p *ProcessCheck) check(peer *Peer) (bool, error) {
-	peerActiveProcesses := extractPeerActiveProcesses(peer.Meta.Files)
-
-	var pathSelector func(Process) string
-	switch peer.Meta.GoOS {
-	case "linux":
-		pathSelector = func(process Process) string { return process.LinuxPath }
-	case "darwin":
-		pathSelector = func(process Process) string { return process.MacPath }
-	case "windows":
-		pathSelector = func(process Process) string { return process.WindowsPath }
-	default:
-		return false, fmt.Errorf("unsupported peer's operating system: %s", peer.Meta.GoOS)
-	}
-
-	return p.areAllProcessesRunning(peerActiveProcesses, pathSelector), nil
-}
-
-func (p *ProcessCheck) areAllProcessesRunning(activeProcesses []string, pathSelector func(Process) string) bool {
-	for _, process := range p.Processes {
-		path := pathSelector(process)
-		if path == "" || !slices.Contains(activeProcesses, path) {
-			return false
-		}
-	}
-	return true
-}
-
-func extractPeerActiveProcesses(files []File) []string {
-	activeProcesses := make([]string, 0, len(files))
-	for _, file := range files {
-		if file.ProcessIsRunning {
-			activeProcesses = append(activeProcesses, file.Path)
-		}
-	}
-	return activeProcesses
-}

shared/management/networkmap/nmdata/route.go

@@ -1,108 +0,0 @@
-package nmdata
-
-import (
-	"net/netip"
-	"slices"
-	"strings"
-
-	"github.com/netbirdio/netbird/shared/management/domain"
-)
-
-// NetworkType mirrors route.NetworkType iota values.
-const (
-	NetworkTypeInvalid = 0
-	NetworkTypeIPv4    = 1
-	NetworkTypeIPv6    = 2
-	NetworkTypeDomain  = 3
-
-	haSeparator = "|"
-)
-
-// Route is the slim twin of route.Route.
-type Route struct {
-	ID                  string
-	AccountID           string
-	PublicID            string
-	Network             netip.Prefix
-	Domains             domain.List
-	KeepRoute           bool
-	NetID               string
-	Description         string
-	Peer                string
-	PeerID              string
-	PeerGroups          []string
-	NetworkType         int
-	Masquerade          bool
-	Metric              int
-	Enabled             bool
-	Groups              []string
-	AccessControlGroups []string
-	SkipAutoApply       bool
-}
-
-func (r *Route) Equal(other *Route) bool {
-	if r == nil && other == nil {
-		return true
-	} else if r == nil || other == nil {
-		return false
-	}
-
-	return other.ID == r.ID &&
-		other.Description == r.Description &&
-		other.NetID == r.NetID &&
-		other.Network == r.Network &&
-		slices.Equal(r.Domains, other.Domains) &&
-		other.KeepRoute == r.KeepRoute &&
-		other.NetworkType == r.NetworkType &&
-		other.Peer == r.Peer &&
-		other.PeerID == r.PeerID &&
-		other.Metric == r.Metric &&
-		other.Masquerade == r.Masquerade &&
-		other.Enabled == r.Enabled &&
-		slices.Equal(r.Groups, other.Groups) &&
-		slices.Equal(r.PeerGroups, other.PeerGroups) &&
-		slices.Equal(r.AccessControlGroups, other.AccessControlGroups) &&
-		other.SkipAutoApply == r.SkipAutoApply
-}
-
-func (r *Route) IsDynamic() bool {
-	return r.NetworkType == NetworkTypeDomain
-}
-
-func (r *Route) NetString() string {
-	if r.IsDynamic() && r.Domains != nil {
-		return r.Domains.SafeString()
-	}
-	return r.Network.String()
-}
-
-func (r *Route) GetHAUniqueID() string {
-	return r.NetID + haSeparator + r.NetString()
-}
-
-func (r *Route) GetResourceID() string {
-	return strings.Split(r.ID, ":")[0]
-}
-
-func (r *Route) Copy() *Route {
-	return &Route{
-		ID:                  r.ID,
-		AccountID:           r.AccountID,
-		PublicID:            r.PublicID,
-		Network:             r.Network,
-		Domains:             slices.Clone(r.Domains),
-		KeepRoute:           r.KeepRoute,
-		NetID:               r.NetID,
-		Description:         r.Description,
-		Peer:                r.Peer,
-		PeerID:              r.PeerID,
-		PeerGroups:          slices.Clone(r.PeerGroups),
-		NetworkType:         r.NetworkType,
-		Masquerade:          r.Masquerade,
-		Metric:              r.Metric,
-		Enabled:             r.Enabled,
-		Groups:              slices.Clone(r.Groups),
-		AccessControlGroups: slices.Clone(r.AccessControlGroups),
-		SkipAutoApply:       r.SkipAutoApply,
-	}
-}

shared/management/proto/management.proto

@@ -1066,23 +1066,16 @@ message PolicyCompact {
   repeated string source_posture_check_ids = 13;
 }
 
-enum ResourceCompactType {
-  unknown_type = 0; //placeholder
-  peer = 1;
-	domain = 2;
-	host = 3;
-	subnet = 4;
-}
-
 // ResourceCompact mirrors types.Resource. Used by PolicyCompact to carry
 // rule.SourceResource / rule.DestinationResource when the rule targets a
 // specific resource (typically a peer) rather than groups.
+// peer_index_set tells whether peer_index is valid (proto3 uint32 cannot
+// disambiguate "0" from "unset"); set only when type == "peer".
 message ResourceCompact {
-  ResourceCompactType type = 1;
-  oneof resource_id {
-    string id = 2; // for domain/host/subnet resources
-    uint32 peer_index = 3; // for peers
-  }
+  string type = 1;
+  bool peer_index_set = 2;
+  uint32 peer_index = 3;
+  reserved 4; // future: host/subnet/domain references when needed
 }
 
 // UserNameList is a list of local-user names — used as the value type in
@@ -1106,8 +1099,6 @@ message GroupCompact {
   // groups lose that property and the two sides expand policy
   // destinations differently.
   bool is_all = 3;
-
-  repeated ResourceCompact resources = 4;
 }
 
 // DNSSettingsCompact mirrors types.DNSSettings.

shared/management/types/component_types.go

@@ -0,0 +1,103 @@
+package types
+
+import (
+	"net/netip"
+	"time"
+)
+
+// ComponentPeer is the self-contained peer representation used by
+// NetworkMapComponents and the calculated NetworkMap. It carries exactly the
+// subset of peer data that crosses the components wire format, so the shared
+// calculation layer stays independent of the management server's domain
+// types.
+type ComponentPeer struct {
+	ID                     string
+	Key                    string
+	IP                     netip.Addr
+	IPv6                   netip.Addr
+	DNSLabel               string
+	SSHKey                 string
+	SSHEnabled             bool
+	ServerSSHAllowed       bool
+	AgentVersion           string
+	SupportsSourcePrefixes bool
+	SupportsIPv6           bool
+	LoginExpirationEnabled bool
+	AddedWithSSOLogin      bool
+	LastLogin              time.Time
+}
+
+// FQDN returns the peer's FQDN combined of the peer's DNS label and the system's DNS domain.
+func (p *ComponentPeer) FQDN(dnsDomain string) string {
+	if dnsDomain == "" {
+		return ""
+	}
+	return p.DNSLabel + "." + dnsDomain
+}
+
+// LoginExpired indicates whether the peer's login has expired, mirroring the
+// server-side peer semantics: only SSO-added peers with login expiration
+// enabled can expire.
+func (p *ComponentPeer) LoginExpired(expiresIn time.Duration) (bool, time.Duration) {
+	if !p.AddedWithSSOLogin || !p.LoginExpirationEnabled {
+		return false, 0
+	}
+	timeLeft := time.Until(p.LastLogin.Add(expiresIn))
+	return timeLeft <= 0, timeLeft
+}
+
+// GroupAllName is the reserved name of the default group that contains every peer in an account.
+const GroupAllName = "All"
+
+// ComponentGroup is the self-contained group representation used by
+// NetworkMapComponents: just the membership view the network-map calculation
+// needs, without the server's storage fields.
+type ComponentGroup struct {
+	ID       string
+	PublicID string
+	Name     string
+	Peers    []string
+}
+
+// IsGroupAll checks if the group is a default "All" group.
+func (g *ComponentGroup) IsGroupAll() bool {
+	return g.Name == GroupAllName
+}
+
+// ComponentRouter is the self-contained network-router representation used by
+// NetworkMapComponents.
+type ComponentRouter struct {
+	NetworkID  string
+	PublicID   string
+	Peer       string
+	PeerGroups []string
+	Masquerade bool
+	Metric     int
+	Enabled    bool
+}
+
+// ComponentResourceType mirrors the network-resource type enum on the
+// components wire format.
+type ComponentResourceType string
+
+const (
+	ComponentResourceHost   ComponentResourceType = "host"
+	ComponentResourceSubnet ComponentResourceType = "subnet"
+	ComponentResourceDomain ComponentResourceType = "domain"
+)
+
+// ComponentResource is the self-contained network-resource representation
+// used by NetworkMapComponents.
+type ComponentResource struct {
+	ID          string
+	PublicID    string
+	NetworkID   string
+	AccountID   string
+	Name        string
+	Description string
+	Type        ComponentResourceType
+	Address     string
+	Domain      string
+	Prefix      netip.Prefix
+	Enabled     bool
+}

shared/management/types/firewall_helpers.go

@@ -3,8 +3,6 @@ package types
 import (
 	"strconv"
 
-	"github.com/netbirdio/netbird/management/server/posture"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/version"
 )
 
@@ -48,8 +46,8 @@ func portsIncludesSSH(ports []string) bool {
 }
 
 // ExpandPortsAndRanges expands Ports and PortRanges of a rule into individual firewall rules.
-func ExpandPortsAndRanges(base FirewallRule, rule *nmdata.PolicyRule, peer *nmdata.Peer) []*FirewallRule {
-	features := peerSupportedFirewallFeatures(peer.Meta.WtVersion)
+func ExpandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *ComponentPeer) []*FirewallRule {
+	features := peerSupportedFirewallFeatures(peer.AgentVersion)
 
 	var expanded []*FirewallRule
 
@@ -66,7 +64,7 @@ func ExpandPortsAndRanges(base FirewallRule, rule *nmdata.PolicyRule, peer *nmda
 		fr := base
 
 		if features.portRanges {
-			fr.PortRange = RulePortRange{Start: portRange.Start, End: portRange.End}
+			fr.PortRange = portRange
 		} else {
 			if portRange.Start != portRange.End {
 				continue
@@ -76,7 +74,7 @@ func ExpandPortsAndRanges(base FirewallRule, rule *nmdata.PolicyRule, peer *nmda
 		expanded = append(expanded, &fr)
 	}
 
-	if shouldCheckRulesForNativeSSH(features.nativeSSH, rule, peer) || rule.Protocol == string(PolicyRuleProtocolNetbirdSSH) {
+	if shouldCheckRulesForNativeSSH(features.nativeSSH, rule, peer) || rule.Protocol == PolicyRuleProtocolNetbirdSSH {
 		expanded = addNativeSSHRule(base, expanded)
 	}
 
@@ -106,8 +104,8 @@ func isPortInRule(portString string, portInt uint16, rule *FirewallRule) bool {
 	return rule.Port == portString || (rule.PortRange.Start <= portInt && portInt <= rule.PortRange.End)
 }
 
-func shouldCheckRulesForNativeSSH(supportsNative bool, rule *nmdata.PolicyRule, peer *nmdata.Peer) bool {
-	return supportsNative && peer.SSHEnabled && peer.Meta.Flags.ServerSSHAllowed && rule.Protocol == string(PolicyRuleProtocolTCP)
+func shouldCheckRulesForNativeSSH(supportsNative bool, rule *PolicyRule, peer *ComponentPeer) bool {
+	return supportsNative && peer.SSHEnabled && peer.ServerSSHAllowed && rule.Protocol == PolicyRuleProtocolTCP
 }
 
 func peerSupportedFirewallFeatures(peerVer string) supportedFeatures {
@@ -117,13 +115,13 @@ func peerSupportedFirewallFeatures(peerVer string) supportedFeatures {
 
 	var features supportedFeatures
 
-	meetMinVer, err := posture.MeetsMinVersion(firewallRuleMinNativeSSHVer, peerVer)
+	meetMinVer, err := version.MeetsMinVersion(firewallRuleMinNativeSSHVer, peerVer)
 	features.nativeSSH = err == nil && meetMinVer
 
 	if features.nativeSSH {
 		features.portRanges = true
 	} else {
-		meetMinVer, err = posture.MeetsMinVersion(firewallRuleMinPortRangesVer, peerVer)
+		meetMinVer, err = version.MeetsMinVersion(firewallRuleMinPortRangesVer, peerVer)
 		features.portRanges = err == nil && meetMinVer
 	}
 

shared/management/types/firewall_rule.go

@@ -10,7 +10,6 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	nbroute "github.com/netbirdio/netbird/route"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 const (
@@ -51,7 +50,7 @@ func (r *FirewallRule) Equal(other *FirewallRule) bool {
 // For static routes, source ranges match the destination family (v4 or v6).
 // For dynamic routes (domain-based), separate v4 and v6 rules are generated
 // so the routing peer's forwarding chain allows both address families.
-func GenerateRouteFirewallRules(ctx context.Context, route *nmdata.Route, rule *nmdata.PolicyRule, groupPeers []*nmdata.Peer, direction int, includeIPv6 bool) []*RouteFirewallRule {
+func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*ComponentPeer, direction int, includeIPv6 bool) []*RouteFirewallRule {
 	rulesExists := make(map[string]struct{})
 	rules := make([]*RouteFirewallRule, 0)
 
@@ -72,11 +71,11 @@ func GenerateRouteFirewallRules(ctx context.Context, route *nmdata.Route, rule *
 
 	baseRule := RouteFirewallRule{
 		PolicyID:     rule.PolicyID,
-		RouteID:      nbroute.ID(route.ID),
+		RouteID:      route.ID,
 		SourceRanges: sourceRanges,
-		Action:       rule.Action,
+		Action:       string(rule.Action),
 		Destination:  route.Network.String(),
-		Protocol:     rule.Protocol,
+		Protocol:     string(rule.Protocol),
 		Domains:      route.Domains,
 		IsDynamic:    route.IsDynamic(),
 	}
@@ -94,7 +93,7 @@ func GenerateRouteFirewallRules(ctx context.Context, route *nmdata.Route, rule *
 		v6Rule.SourceRanges = v6Sources
 		if isDefaultV4 {
 			v6Rule.Destination = "::/0"
-			v6Rule.RouteID = nbroute.ID(route.ID + "-v6-default")
+			v6Rule.RouteID = route.ID + "-v6-default"
 		}
 		if len(rule.Ports) == 0 {
 			rules = append(rules, generateRulesWithPortRanges(v6Rule, rule, rulesExists)...)
@@ -107,7 +106,7 @@ func GenerateRouteFirewallRules(ctx context.Context, route *nmdata.Route, rule *
 }
 
 // splitPeerSourcesByFamily separates peer IPs into v4 (/32) and v6 (/128) source ranges.
-func splitPeerSourcesByFamily(groupPeers []*nmdata.Peer) (v4, v6 []string) {
+func splitPeerSourcesByFamily(groupPeers []*ComponentPeer) (v4, v6 []string) {
 	v4 = make([]string, 0, len(groupPeers))
 	v6 = make([]string, 0, len(groupPeers))
 	for _, peer := range groupPeers {
@@ -123,7 +122,7 @@ func splitPeerSourcesByFamily(groupPeers []*nmdata.Peer) (v4, v6 []string) {
 }
 
 // generateRulesForPeer generates rules for a given peer based on ports and port ranges.
-func generateRulesWithPortRanges(baseRule RouteFirewallRule, rule *nmdata.PolicyRule, rulesExists map[string]struct{}) []*RouteFirewallRule {
+func generateRulesWithPortRanges(baseRule RouteFirewallRule, rule *PolicyRule, rulesExists map[string]struct{}) []*RouteFirewallRule {
 	rules := make([]*RouteFirewallRule, 0)
 
 	ruleIDBase := generateRuleIDBase(rule, baseRule)
@@ -139,7 +138,7 @@ func generateRulesWithPortRanges(baseRule RouteFirewallRule, rule *nmdata.Policy
 				if _, ok := rulesExists[ruleID]; !ok {
 					rulesExists[ruleID] = struct{}{}
 					pr := baseRule
-					pr.PortRange = RulePortRange{Start: portRange.Start, End: portRange.End}
+					pr.PortRange = portRange
 					rules = append(rules, &pr)
 				}
 			}
@@ -151,7 +150,7 @@ func generateRulesWithPortRanges(baseRule RouteFirewallRule, rule *nmdata.Policy
 }
 
 // generateRulesWithPorts generates rules when specific ports are provided.
-func generateRulesWithPorts(ctx context.Context, baseRule RouteFirewallRule, rule *nmdata.PolicyRule, rulesExists map[string]struct{}) []*RouteFirewallRule {
+func generateRulesWithPorts(ctx context.Context, baseRule RouteFirewallRule, rule *PolicyRule, rulesExists map[string]struct{}) []*RouteFirewallRule {
 	rules := make([]*RouteFirewallRule, 0)
 	ruleIDBase := generateRuleIDBase(rule, baseRule)
 
@@ -177,6 +176,6 @@ func generateRulesWithPorts(ctx context.Context, baseRule RouteFirewallRule, rul
 }
 
 // generateRuleIDBase generates the base rule ID for checking duplicates.
-func generateRuleIDBase(rule *nmdata.PolicyRule, baseRule RouteFirewallRule) string {
+func generateRuleIDBase(rule *PolicyRule, baseRule RouteFirewallRule) string {
 	return rule.ID + strings.Join(baseRule.SourceRanges, ",") + strconv.Itoa(FirewallRuleDirectionIN) + baseRule.Protocol + baseRule.Action
 }

shared/management/types/firewall_rule_test.go

@@ -8,12 +8,12 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 func TestSplitPeerSourcesByFamily(t *testing.T) {
-	peers := []*nmdata.Peer{
+	peers := []*ComponentPeer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -35,7 +35,7 @@ func TestSplitPeerSourcesByFamily(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_V4Route(t *testing.T) {
-	peers := []*nmdata.Peer{
+	peers := []*ComponentPeer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -45,15 +45,15 @@ func TestGenerateRouteFirewallRules_V4Route(t *testing.T) {
 		},
 	}
 
-	r := &nmdata.Route{
+	r := &route.Route{
 		ID:      "route1",
 		Network: netip.MustParsePrefix("10.0.0.0/24"),
 	}
-	rule := &nmdata.PolicyRule{
+	rule := &PolicyRule{
 		PolicyID: "policy1",
 		ID:       "rule1",
-		Action:   string(PolicyTrafficActionAccept),
-		Protocol: string(PolicyRuleProtocolALL),
+		Action:   PolicyTrafficActionAccept,
+		Protocol: PolicyRuleProtocolALL,
 	}
 
 	rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
@@ -64,7 +64,7 @@ func TestGenerateRouteFirewallRules_V4Route(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_V6Route(t *testing.T) {
-	peers := []*nmdata.Peer{
+	peers := []*ComponentPeer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -74,15 +74,15 @@ func TestGenerateRouteFirewallRules_V6Route(t *testing.T) {
 		},
 	}
 
-	r := &nmdata.Route{
+	r := &route.Route{
 		ID:      "route1",
 		Network: netip.MustParsePrefix("2001:db8::/32"),
 	}
-	rule := &nmdata.PolicyRule{
+	rule := &PolicyRule{
 		PolicyID: "policy1",
 		ID:       "rule1",
-		Action:   string(PolicyTrafficActionAccept),
-		Protocol: string(PolicyRuleProtocolALL),
+		Action:   PolicyTrafficActionAccept,
+		Protocol: PolicyRuleProtocolALL,
 	}
 
 	rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
@@ -92,7 +92,7 @@ func TestGenerateRouteFirewallRules_V6Route(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_DynamicRoute_DualStack(t *testing.T) {
-	peers := []*nmdata.Peer{
+	peers := []*ComponentPeer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -102,16 +102,16 @@ func TestGenerateRouteFirewallRules_DynamicRoute_DualStack(t *testing.T) {
 		},
 	}
 
-	r := &nmdata.Route{
+	r := &route.Route{
 		ID:          "route1",
-		NetworkType: nmdata.NetworkTypeDomain,
+		NetworkType: route.DomainNetwork,
 		Domains:     domain.List{"example.com"},
 	}
-	rule := &nmdata.PolicyRule{
+	rule := &PolicyRule{
 		PolicyID: "policy1",
 		ID:       "rule1",
-		Action:   string(PolicyTrafficActionAccept),
-		Protocol: string(PolicyRuleProtocolALL),
+		Action:   PolicyTrafficActionAccept,
+		Protocol: PolicyRuleProtocolALL,
 	}
 
 	rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
@@ -125,21 +125,21 @@ func TestGenerateRouteFirewallRules_DynamicRoute_DualStack(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_DynamicRoute_NoV6Peers(t *testing.T) {
-	peers := []*nmdata.Peer{
+	peers := []*ComponentPeer{
 		{IP: netip.MustParseAddr("100.64.0.1")},
 		{IP: netip.MustParseAddr("100.64.0.2")},
 	}
 
-	r := &nmdata.Route{
+	r := &route.Route{
 		ID:          "route1",
-		NetworkType: nmdata.NetworkTypeDomain,
+		NetworkType: route.DomainNetwork,
 		Domains:     domain.List{"example.com"},
 	}
-	rule := &nmdata.PolicyRule{
+	rule := &PolicyRule{
 		PolicyID: "policy1",
 		ID:       "rule1",
-		Action:   string(PolicyTrafficActionAccept),
-		Protocol: string(PolicyRuleProtocolALL),
+		Action:   PolicyTrafficActionAccept,
+		Protocol: PolicyRuleProtocolALL,
 	}
 
 	rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, true)
@@ -149,7 +149,7 @@ func TestGenerateRouteFirewallRules_DynamicRoute_NoV6Peers(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_IncludeIPv6False(t *testing.T) {
-	peers := []*nmdata.Peer{
+	peers := []*ComponentPeer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -161,15 +161,15 @@ func TestGenerateRouteFirewallRules_IncludeIPv6False(t *testing.T) {
 	}
 
 	t.Run("v6 route excluded", func(t *testing.T) {
-		r := &nmdata.Route{
+		r := &route.Route{
 			ID:      "route1",
 			Network: netip.MustParsePrefix("2001:db8::/32"),
 		}
-		rule := &nmdata.PolicyRule{
+		rule := &PolicyRule{
 			PolicyID: "policy1",
 			ID:       "rule1",
-			Action:   string(PolicyTrafficActionAccept),
-			Protocol: string(PolicyRuleProtocolALL),
+			Action:   PolicyTrafficActionAccept,
+			Protocol: PolicyRuleProtocolALL,
 		}
 
 		rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, false)
@@ -177,16 +177,16 @@ func TestGenerateRouteFirewallRules_IncludeIPv6False(t *testing.T) {
 	})
 
 	t.Run("dynamic route only v4", func(t *testing.T) {
-		r := &nmdata.Route{
+		r := &route.Route{
 			ID:          "route1",
-			NetworkType: nmdata.NetworkTypeDomain,
+			NetworkType: route.DomainNetwork,
 			Domains:     domain.List{"example.com"},
 		}
-		rule := &nmdata.PolicyRule{
+		rule := &PolicyRule{
 			PolicyID: "policy1",
 			ID:       "rule1",
-			Action:   string(PolicyTrafficActionAccept),
-			Protocol: string(PolicyRuleProtocolALL),
+			Action:   PolicyTrafficActionAccept,
+			Protocol: PolicyRuleProtocolALL,
 		}
 
 		rules := GenerateRouteFirewallRules(context.Background(), r, rule, peers, FirewallRuleDirectionIN, false)

shared/management/types/network.go

@@ -15,8 +15,7 @@ import (
 	"golang.org/x/exp/maps"
 
 	nbdns "github.com/netbirdio/netbird/dns"
-	"github.com/netbirdio/netbird/management/server/util"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
@@ -38,11 +37,11 @@ const (
 )
 
 type NetworkMap struct {
-	Peers               []*nmdata.Peer
-	Network             *nmdata.Network
-	Routes              []*nmdata.Route
+	Peers               []*ComponentPeer
+	Network             *Network
+	Routes              []*route.Route
 	DNSConfig           nbdns.Config
-	OfflinePeers        []*nmdata.Peer
+	OfflinePeers        []*ComponentPeer
 	FirewallRules       []*FirewallRule
 	RoutesFirewallRules []*RouteFirewallRule
 	ForwardingRules     []*ForwardingRule
@@ -52,15 +51,46 @@ type NetworkMap struct {
 
 func (nm *NetworkMap) Merge(other *NetworkMap) {
 	nm.Peers = mergeUniquePeersByID(nm.Peers, other.Peers)
-	nm.Routes = util.MergeUnique(nm.Routes, other.Routes)
+	nm.Routes = mergeUnique(nm.Routes, other.Routes)
 	nm.OfflinePeers = mergeUniquePeersByID(nm.OfflinePeers, other.OfflinePeers)
-	nm.FirewallRules = util.MergeUnique(nm.FirewallRules, other.FirewallRules)
-	nm.RoutesFirewallRules = util.MergeUnique(nm.RoutesFirewallRules, other.RoutesFirewallRules)
-	nm.ForwardingRules = util.MergeUnique(nm.ForwardingRules, other.ForwardingRules)
+	nm.FirewallRules = mergeUnique(nm.FirewallRules, other.FirewallRules)
+	nm.RoutesFirewallRules = mergeUnique(nm.RoutesFirewallRules, other.RoutesFirewallRules)
+	nm.ForwardingRules = mergeUnique(nm.ForwardingRules, other.ForwardingRules)
 }
 
-func mergeUniquePeersByID(peers1, peers2 []*nmdata.Peer) []*nmdata.Peer {
-	result := make(map[string]*nmdata.Peer)
+type comparableObject[T any] interface {
+	Equal(other T) bool
+}
+
+func mergeUnique[T comparableObject[T]](arr1, arr2 []T) []T {
+	var result []T
+
+	for _, item := range arr1 {
+		if !containsEqual(result, item) {
+			result = append(result, item)
+		}
+	}
+
+	for _, item := range arr2 {
+		if !containsEqual(result, item) {
+			result = append(result, item)
+		}
+	}
+
+	return result
+}
+
+func containsEqual[T comparableObject[T]](slice []T, element T) bool {
+	for _, item := range slice {
+		if item.Equal(element) {
+			return true
+		}
+	}
+	return false
+}
+
+func mergeUniquePeersByID(peers1, peers2 []*ComponentPeer) []*ComponentPeer {
+	result := make(map[string]*ComponentPeer)
 	for _, peer := range peers1 {
 		result[peer.ID] = peer
 	}

shared/management/types/network_merge_test.go

@@ -1,4 +1,4 @@
-package util
+package types
 
 import (
 	"testing"
@@ -17,7 +17,7 @@ func (t testObject) Equal(other testObject) bool {
 func Test_MergeUniqueArraysWithoutDuplicates(t *testing.T) {
 	arr1 := []testObject{{value: 1}, {value: 2}}
 	arr2 := []testObject{{value: 2}, {value: 3}}
-	result := MergeUnique(arr1, arr2)
+	result := mergeUnique(arr1, arr2)
 	assert.Len(t, result, 3)
 	assert.Contains(t, result, testObject{value: 1})
 	assert.Contains(t, result, testObject{value: 2})
@@ -27,14 +27,14 @@ func Test_MergeUniqueArraysWithoutDuplicates(t *testing.T) {
 func Test_MergeUniqueHandlesEmptyArrays(t *testing.T) {
 	arr1 := []testObject{}
 	arr2 := []testObject{}
-	result := MergeUnique(arr1, arr2)
+	result := mergeUnique(arr1, arr2)
 	assert.Empty(t, result)
 }
 
 func Test_MergeUniqueHandlesOneEmptyArray(t *testing.T) {
 	arr1 := []testObject{{value: 1}, {value: 2}}
 	arr2 := []testObject{}
-	result := MergeUnique(arr1, arr2)
+	result := mergeUnique(arr1, arr2)
 	assert.Len(t, result, 2)
 	assert.Contains(t, result, testObject{value: 1})
 	assert.Contains(t, result, testObject{value: 2})

shared/management/types/networkmap_components.go

@@ -12,36 +12,34 @@ import (
 
 	"github.com/netbirdio/netbird/client/ssh/auth"
 	nbdns "github.com/netbirdio/netbird/dns"
-	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
-	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 )
 
 type NetworkMapComponents struct {
 	PeerID string
 
-	Network          *nmdata.Network
-	AccountSettings  *nmdata.AccountSettingsInfo
-	DNSSettings      *nmdata.DNSSettings
+	Network          *Network
+	AccountSettings  *AccountSettingsInfo
+	DNSSettings      *DNSSettings
 	CustomZoneDomain string
 
-	Peers               map[string]*nmdata.Peer
-	Groups              map[string]*nmdata.Group
-	Policies            []*nmdata.Policy
-	Routes              []*nmdata.Route
-	NameServerGroups    []*nmdata.NameServerGroup
-	AllDNSRecords       []nmdata.SimpleRecord
-	AccountZones        []nmdata.CustomZone
-	ResourcePoliciesMap map[string][]*nmdata.Policy
-	RoutersMap          map[string]map[string]*nmdata.NetworkRouter
-	NetworkResources    []*nmdata.NetworkResource
+	Peers               map[string]*ComponentPeer
+	Groups              map[string]*ComponentGroup
+	Policies            []*Policy
+	Routes              []*route.Route
+	NameServerGroups    []*nbdns.NameServerGroup
+	AllDNSRecords       []nbdns.SimpleRecord
+	AccountZones        []nbdns.CustomZone
+	ResourcePoliciesMap map[string][]*Policy
+	RoutersMap          map[string]map[string]*ComponentRouter
+	NetworkResources    []*ComponentResource
 
 	GroupIDToUserIDs   map[string][]string
 	AllowedUserIDs     map[string]struct{}
 	PostureFailedPeers map[string]map[string]struct{}
 
-	RouterPeers map[string]*nmdata.Peer
+	RouterPeers map[string]*ComponentPeer
 
 	// NetworkXIDToPublicID maps Network.ID (xid) → PublicID.
 	// Consumed by the envelope encoder to
@@ -61,7 +59,7 @@ type NetworkMapComponents struct {
 }
 
 type routeIndexEntry struct {
-	route    *nmdata.Route
+	route    *route.Route
 	viaGroup bool
 }
 
@@ -77,15 +75,15 @@ func EmptyNetworkMapComponents(nm *NetworkMapComponents) *NetworkMapComponents {
 	return nm
 }
 
-func (c *NetworkMapComponents) GetPeerInfo(peerID string) *nmdata.Peer {
+func (c *NetworkMapComponents) GetPeerInfo(peerID string) *ComponentPeer {
 	return c.Peers[peerID]
 }
 
-func (c *NetworkMapComponents) GetRouterPeerInfo(peerID string) *nmdata.Peer {
+func (c *NetworkMapComponents) GetRouterPeerInfo(peerID string) *ComponentPeer {
 	return c.RouterPeers[peerID]
 }
 
-func (c *NetworkMapComponents) GetGroupInfo(groupID string) *nmdata.Group {
+func (c *NetworkMapComponents) GetGroupInfo(groupID string) *ComponentGroup {
 	return c.Groups[groupID]
 }
 
@@ -140,8 +138,8 @@ func (c *NetworkMapComponents) Calculate(ctx context.Context) *NetworkMap {
 	peersToConnect, expiredPeers := c.filterPeersByLoginExpiration(aclPeers)
 
 	includeIPv6 := false
-	if p := c.GetPeerInfo(targetPeerID); p != nil {
-		includeIPv6 = p.SupportsIPv6() && p.IPv6.IsValid()
+	if p := c.Peers[targetPeerID]; p != nil {
+		includeIPv6 = p.SupportsIPv6 && p.IPv6.IsValid()
 	}
 	routesUpdate := filterAndExpandRoutes(c.getRoutesToSync(targetPeerID, peersToConnect, peerGroups), includeIPv6)
 	routesFirewallRules := c.getPeerRoutesFirewallRules(ctx, targetPeerID, includeIPv6)
@@ -172,11 +170,11 @@ func (c *NetworkMapComponents) Calculate(ctx context.Context) *NetworkMap {
 		if c.CustomZoneDomain != "" && len(c.AllDNSRecords) > 0 {
 			customZones = append(customZones, nbdns.CustomZone{
 				Domain:  c.CustomZoneDomain,
-				Records: toRealRecords(c.AllDNSRecords),
+				Records: c.AllDNSRecords,
 			})
 		}
 
-		customZones = append(customZones, toRealZones(c.AccountZones)...)
+		customZones = append(customZones, c.AccountZones...)
 
 		dnsUpdate.CustomZones = customZones
 		dnsUpdate.NameServerGroups = c.getPeerNSGroupsFromGroups(targetPeerID, peerGroups)
@@ -184,7 +182,7 @@ func (c *NetworkMapComponents) Calculate(ctx context.Context) *NetworkMap {
 
 	return &NetworkMap{
 		Peers:               peersToConnectIncludingRouters,
-		Network:             c.Network,
+		Network:             c.Network.Copy(),
 		Routes:              append(filterAndExpandRoutes(networkResourcesRoutes, includeIPv6), routesUpdate...),
 		DNSConfig:           dnsUpdate,
 		OfflinePeers:        expiredPeers,
@@ -199,7 +197,7 @@ func (c *NetworkMapComponents) IsEmpty() bool {
 	return c.empty
 }
 
-func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) ([]*nmdata.Peer, []*FirewallRule, map[string]map[string]struct{}, bool) {
+func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) ([]*ComponentPeer, []*FirewallRule, map[string]map[string]struct{}, bool) {
 	targetPeer := c.GetPeerInfo(targetPeerID)
 	if targetPeer == nil {
 		return nil, nil, nil, false
@@ -219,16 +217,16 @@ func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) (
 				continue
 			}
 
-			var sourcePeers, destinationPeers []*nmdata.Peer
+			var sourcePeers, destinationPeers []*ComponentPeer
 			var peerInSources, peerInDestinations bool
 
-			if rule.SourceResource.Type == string(ResourceTypePeer) && rule.SourceResource.ID != "" {
+			if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID != "" {
 				sourcePeers, peerInSources = c.getPeerFromResource(rule.SourceResource, targetPeerID)
 			} else {
 				sourcePeers, peerInSources = c.getAllPeersFromGroups(rule.Sources, targetPeerID, policy.SourcePostureChecks)
 			}
 
-			if rule.DestinationResource.Type == string(ResourceTypePeer) && rule.DestinationResource.ID != "" {
+			if rule.DestinationResource.Type == ResourceTypePeer && rule.DestinationResource.ID != "" {
 				destinationPeers, peerInDestinations = c.getPeerFromResource(rule.DestinationResource, targetPeerID)
 			} else {
 				destinationPeers, peerInDestinations = c.getAllPeersFromGroups(rule.Destinations, targetPeerID, nil)
@@ -251,7 +249,7 @@ func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) (
 				generateResources(rule, sourcePeers, FirewallRuleDirectionIN)
 			}
 
-			if peerInDestinations && rule.Protocol == string(PolicyRuleProtocolNetbirdSSH) {
+			if peerInDestinations && rule.Protocol == PolicyRuleProtocolNetbirdSSH {
 				sshEnabled = true
 				switch {
 				case len(rule.AuthorizedGroups) > 0:
@@ -282,7 +280,7 @@ func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) (
 				default:
 					authorizedUsers[auth.Wildcard] = c.getAllowedUserIDs()
 				}
-			} else if peerInDestinations && nmdata.PolicyRuleImpliesLegacySSH(rule) && targetPeer.SSHEnabled {
+			} else if peerInDestinations && PolicyRuleImpliesLegacySSH(rule) && targetPeer.SSHEnabled {
 				sshEnabled = true
 				authorizedUsers[auth.Wildcard] = c.getAllowedUserIDs()
 			}
@@ -302,19 +300,19 @@ func (c *NetworkMapComponents) getAllowedUserIDs() map[string]struct{} {
 	return make(map[string]struct{})
 }
 
-func (c *NetworkMapComponents) connResourcesGenerator(targetPeer *nmdata.Peer) (func(*nmdata.PolicyRule, []*nmdata.Peer, int), func() ([]*nmdata.Peer, []*FirewallRule)) {
+func (c *NetworkMapComponents) connResourcesGenerator(targetPeer *ComponentPeer) (func(*PolicyRule, []*ComponentPeer, int), func() ([]*ComponentPeer, []*FirewallRule)) {
 	rulesExists := make(map[string]struct{})
 	peersExists := make(map[string]struct{})
 	rules := make([]*FirewallRule, 0)
-	peers := make([]*nmdata.Peer, 0)
+	peers := make([]*ComponentPeer, 0)
 
-	return func(rule *nmdata.PolicyRule, groupPeers []*nmdata.Peer, direction int) {
+	return func(rule *PolicyRule, groupPeers []*ComponentPeer, direction int) {
 			protocol := rule.Protocol
-			if protocol == string(PolicyRuleProtocolNetbirdSSH) {
-				protocol = string(PolicyRuleProtocolTCP)
+			if protocol == PolicyRuleProtocolNetbirdSSH {
+				protocol = PolicyRuleProtocolTCP
 			}
 
-			protocolStr := protocol
+			protocolStr := string(protocol)
 			actionStr := string(rule.Action)
 			dirStr := strconv.Itoa(direction)
 			portsJoined := strings.Join(rule.Ports, ",")
@@ -360,15 +358,15 @@ func (c *NetworkMapComponents) connResourcesGenerator(targetPeer *nmdata.Peer) (
 					PortsJoined: portsJoined,
 				})
 			}
-		}, func() ([]*nmdata.Peer, []*FirewallRule) {
+		}, func() ([]*ComponentPeer, []*FirewallRule) {
 			return peers, rules
 		}
 }
 
-func (c *NetworkMapComponents) getAllPeersFromGroups(groups []string, peerID string, sourcePostureChecksIDs []string) ([]*nmdata.Peer, bool) {
+func (c *NetworkMapComponents) getAllPeersFromGroups(groups []string, peerID string, sourcePostureChecksIDs []string) ([]*ComponentPeer, bool) {
 	peerInGroups := false
 	uniquePeerIDs := c.getUniquePeerIDsFromGroupsIDs(groups)
-	filteredPeers := make([]*nmdata.Peer, 0, len(uniquePeerIDs))
+	filteredPeers := make([]*ComponentPeer, 0, len(uniquePeerIDs))
 
 	for _, p := range uniquePeerIDs {
 		peerInfo := c.GetPeerInfo(p)
@@ -420,22 +418,22 @@ func (c *NetworkMapComponents) getUniquePeerIDsFromGroupsIDs(groups []string) []
 	return ids
 }
 
-func (c *NetworkMapComponents) getPeerFromResource(resource nmdata.Resource, peerID string) ([]*nmdata.Peer, bool) {
+func (c *NetworkMapComponents) getPeerFromResource(resource Resource, peerID string) ([]*ComponentPeer, bool) {
 	if resource.ID == peerID {
-		return []*nmdata.Peer{}, true
+		return []*ComponentPeer{}, true
 	}
 
 	peerInfo := c.GetPeerInfo(resource.ID)
 	if peerInfo == nil {
-		return []*nmdata.Peer{}, false
+		return []*ComponentPeer{}, false
 	}
 
-	return []*nmdata.Peer{peerInfo}, false
+	return []*ComponentPeer{peerInfo}, false
 }
 
-func (c *NetworkMapComponents) filterPeersByLoginExpiration(aclPeers []*nmdata.Peer) ([]*nmdata.Peer, []*nmdata.Peer) {
-	peersToConnect := make([]*nmdata.Peer, 0, len(aclPeers))
-	var expiredPeers []*nmdata.Peer
+func (c *NetworkMapComponents) filterPeersByLoginExpiration(aclPeers []*ComponentPeer) ([]*ComponentPeer, []*ComponentPeer) {
+	peersToConnect := make([]*ComponentPeer, 0, len(aclPeers))
+	var expiredPeers []*ComponentPeer
 
 	for _, p := range aclPeers {
 		expired, _ := p.LoginExpired(c.AccountSettings.PeerLoginExpiration)
@@ -475,7 +473,7 @@ func (c *NetworkMapComponents) getPeerNSGroupsFromGroups(peerID string, groupLis
 		for _, gID := range nsGroup.Groups {
 			if _, found := groupList[gID]; found {
 				if !c.peerIsNameserver(peerIPStr, nsGroup) {
-					peerNSGroups = append(peerNSGroups, toRealNSGroup(nsGroup))
+					peerNSGroups = append(peerNSGroups, nsGroup.Copy())
 				}
 				break
 			}
@@ -485,7 +483,7 @@ func (c *NetworkMapComponents) getPeerNSGroupsFromGroups(peerID string, groupLis
 	return peerNSGroups
 }
 
-func (c *NetworkMapComponents) peerIsNameserver(peerIPStr string, nsGroup *nmdata.NameServerGroup) bool {
+func (c *NetworkMapComponents) peerIsNameserver(peerIPStr string, nsGroup *nbdns.NameServerGroup) bool {
 	for _, ns := range nsGroup.NameServers {
 		if peerIPStr == ns.IP.String() {
 			return true
@@ -497,8 +495,8 @@ func (c *NetworkMapComponents) peerIsNameserver(peerIPStr string, nsGroup *nmdat
 // filterAndExpandRoutes drops v6 routes for non-capable peers and duplicates
 // the default v4 route (0.0.0.0/0) as ::/0 for v6-capable peers.
 // TODO: the "-v6" suffix on IDs could collide with user-supplied route IDs.
-func filterAndExpandRoutes(routes []*nmdata.Route, includeIPv6 bool) []*nmdata.Route {
-	filtered := make([]*nmdata.Route, 0, len(routes))
+func filterAndExpandRoutes(routes []*route.Route, includeIPv6 bool) []*route.Route {
+	filtered := make([]*route.Route, 0, len(routes))
 	for _, r := range routes {
 		if !includeIPv6 && r.Network.Addr().Is6() {
 			continue
@@ -510,14 +508,14 @@ func filterAndExpandRoutes(routes []*nmdata.Route, includeIPv6 bool) []*nmdata.R
 			v6.ID = r.ID + "-v6-default"
 			v6.NetID = r.NetID + "-v6"
 			v6.Network = netip.MustParsePrefix("::/0")
-			v6.NetworkType = nmdata.NetworkTypeIPv6
+			v6.NetworkType = route.IPv6Network
 			filtered = append(filtered, v6)
 		}
 	}
 	return filtered
 }
 
-func (c *NetworkMapComponents) getRoutesToSync(peerID string, aclPeers []*nmdata.Peer, peerGroups LookupMap) []*nmdata.Route {
+func (c *NetworkMapComponents) getRoutesToSync(peerID string, aclPeers []*ComponentPeer, peerGroups LookupMap) []*route.Route {
 	routes, peerDisabledRoutes := c.getRoutingPeerRoutes(peerID)
 	peerRoutesMembership := make(LookupMap)
 	for _, r := range append(routes, peerDisabledRoutes...) {
@@ -534,7 +532,7 @@ func (c *NetworkMapComponents) getRoutesToSync(peerID string, aclPeers []*nmdata
 	return routes
 }
 
-func (c *NetworkMapComponents) getRoutingPeerRoutes(peerID string) (enabledRoutes []*nmdata.Route, disabledRoutes []*nmdata.Route) {
+func (c *NetworkMapComponents) getRoutingPeerRoutes(peerID string) (enabledRoutes []*route.Route, disabledRoutes []*route.Route) {
 	peerInfo := c.GetPeerInfo(peerID)
 	if peerInfo == nil {
 		peerInfo = c.GetRouterPeerInfo(peerID)
@@ -543,9 +541,9 @@ func (c *NetworkMapComponents) getRoutingPeerRoutes(peerID string) (enabledRoute
 		return enabledRoutes, disabledRoutes
 	}
 
-	seenRoute := make(map[string]struct{})
+	seenRoute := make(map[route.ID]struct{})
 
-	takeRoute := func(r *nmdata.Route) {
+	takeRoute := func(r *route.Route) {
 		if _, ok := seenRoute[r.ID]; ok {
 			return
 		}
@@ -564,7 +562,7 @@ func (c *NetworkMapComponents) getRoutingPeerRoutes(peerID string) (enabledRoute
 		if entry.viaGroup {
 			newPeerRoute := entry.route.Copy()
 			newPeerRoute.PeerGroups = nil
-			newPeerRoute.ID = entry.route.ID + ":" + peerID
+			newPeerRoute.ID = route.ID(string(entry.route.ID) + ":" + peerID)
 			takeRoute(newPeerRoute)
 			continue
 		}
@@ -597,8 +595,8 @@ func (c *NetworkMapComponents) routesByPeer() map[string][]routeIndexEntry {
 	return c.routesByPeerIdx
 }
 
-func (c *NetworkMapComponents) filterRoutesByGroups(routes []*nmdata.Route, groupListMap LookupMap) []*nmdata.Route {
-	var filteredRoutes []*nmdata.Route
+func (c *NetworkMapComponents) filterRoutesByGroups(routes []*route.Route, groupListMap LookupMap) []*route.Route {
+	var filteredRoutes []*route.Route
 	for _, r := range routes {
 		for _, groupID := range r.Groups {
 			_, found := groupListMap[groupID]
@@ -611,8 +609,8 @@ func (c *NetworkMapComponents) filterRoutesByGroups(routes []*nmdata.Route, grou
 	return filteredRoutes
 }
 
-func (c *NetworkMapComponents) filterRoutesFromPeersOfSameHAGroup(routes []*nmdata.Route, peerMemberships LookupMap) []*nmdata.Route {
-	var filteredRoutes []*nmdata.Route
+func (c *NetworkMapComponents) filterRoutesFromPeersOfSameHAGroup(routes []*route.Route, peerMemberships LookupMap) []*route.Route {
+	var filteredRoutes []*route.Route
 	for _, r := range routes {
 		_, found := peerMemberships[string(r.GetHAUniqueID())]
 		if !found {
@@ -645,7 +643,7 @@ func (c *NetworkMapComponents) getPeerRoutesFirewallRules(ctx context.Context, p
 	return routesFirewallRules
 }
 
-func (c *NetworkMapComponents) getDefaultPermit(r *nmdata.Route, includeIPv6 bool) []*RouteFirewallRule {
+func (c *NetworkMapComponents) getDefaultPermit(r *route.Route, includeIPv6 bool) []*RouteFirewallRule {
 	if r.Network.Addr().Is6() && !includeIPv6 {
 		return nil
 	}
@@ -662,7 +660,7 @@ func (c *NetworkMapComponents) getDefaultPermit(r *nmdata.Route, includeIPv6 boo
 		Protocol:     string(PolicyRuleProtocolALL),
 		Domains:      r.Domains,
 		IsDynamic:    r.IsDynamic(),
-		RouteID:      route.ID(r.ID),
+		RouteID:      r.ID,
 	}
 
 	rules := []*RouteFirewallRule{&rule}
@@ -673,7 +671,7 @@ func (c *NetworkMapComponents) getDefaultPermit(r *nmdata.Route, includeIPv6 boo
 		ruleV6.SourceRanges = []string{"::/0"}
 		if isDefaultV4 {
 			ruleV6.Destination = "::/0"
-			ruleV6.RouteID = route.ID(r.ID + "-v6-default")
+			ruleV6.RouteID = r.ID + "-v6-default"
 		}
 		rules = append(rules, &ruleV6)
 	}
@@ -681,7 +679,7 @@ func (c *NetworkMapComponents) getDefaultPermit(r *nmdata.Route, includeIPv6 boo
 	return rules
 }
 
-func (c *NetworkMapComponents) getDistributionGroupsPeers(r *nmdata.Route) map[string]struct{} {
+func (c *NetworkMapComponents) getDistributionGroupsPeers(r *route.Route) map[string]struct{} {
 	distPeers := make(map[string]struct{})
 	for _, id := range r.Groups {
 		group := c.GetGroupInfo(id)
@@ -696,8 +694,8 @@ func (c *NetworkMapComponents) getDistributionGroupsPeers(r *nmdata.Route) map[s
 	return distPeers
 }
 
-func (c *NetworkMapComponents) getAllRoutePoliciesFromGroups(accessControlGroups []string) []*nmdata.Policy {
-	routePolicies := make([]*nmdata.Policy, 0)
+func (c *NetworkMapComponents) getAllRoutePoliciesFromGroups(accessControlGroups []string) []*Policy {
+	routePolicies := make([]*Policy, 0)
 	for _, groupID := range accessControlGroups {
 		for _, policy := range c.Policies {
 			for _, rule := range policy.Rules {
@@ -711,7 +709,7 @@ func (c *NetworkMapComponents) getAllRoutePoliciesFromGroups(accessControlGroups
 	return routePolicies
 }
 
-func (c *NetworkMapComponents) getRouteFirewallRules(ctx context.Context, peerID string, policies []*nmdata.Policy, route *nmdata.Route, distributionPeers map[string]struct{}, includeIPv6 bool) []*RouteFirewallRule {
+func (c *NetworkMapComponents) getRouteFirewallRules(ctx context.Context, peerID string, policies []*Policy, route *route.Route, distributionPeers map[string]struct{}, includeIPv6 bool) []*RouteFirewallRule {
 	var fwRules []*RouteFirewallRule
 	for _, policy := range policies {
 		if !policy.Enabled {
@@ -731,7 +729,7 @@ func (c *NetworkMapComponents) getRouteFirewallRules(ctx context.Context, peerID
 	return fwRules
 }
 
-func (c *NetworkMapComponents) getRulePeers(rule *nmdata.PolicyRule, postureChecks []string, peerID string, distributionPeers map[string]struct{}) []*nmdata.Peer {
+func (c *NetworkMapComponents) getRulePeers(rule *PolicyRule, postureChecks []string, peerID string, distributionPeers map[string]struct{}) []*ComponentPeer {
 	distPeersWithPolicy := make(map[string]struct{})
 	for _, id := range rule.Sources {
 		group := c.GetGroupInfo(id)
@@ -750,7 +748,7 @@ func (c *NetworkMapComponents) getRulePeers(rule *nmdata.PolicyRule, postureChec
 			}
 		}
 	}
-	if rule.SourceResource.Type == string(ResourceTypePeer) && rule.SourceResource.ID != "" {
+	if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID != "" {
 		_, distPeer := distributionPeers[rule.SourceResource.ID]
 		_, valid := c.Peers[rule.SourceResource.ID]
 		if distPeer && valid && c.ValidatePostureChecksOnPeer(rule.SourceResource.ID, postureChecks) {
@@ -758,7 +756,7 @@ func (c *NetworkMapComponents) getRulePeers(rule *nmdata.PolicyRule, postureChec
 		}
 	}
 
-	distributionGroupPeers := make([]*nmdata.Peer, 0, len(distPeersWithPolicy))
+	distributionGroupPeers := make([]*ComponentPeer, 0, len(distPeersWithPolicy))
 	for pID := range distPeersWithPolicy {
 		peerInfo := c.GetPeerInfo(pID)
 		if peerInfo == nil {
@@ -769,9 +767,9 @@ func (c *NetworkMapComponents) getRulePeers(rule *nmdata.PolicyRule, postureChec
 	return distributionGroupPeers
 }
 
-func (c *NetworkMapComponents) getNetworkResourcesRoutesToSync(peerID string) (bool, []*nmdata.Route, map[string]struct{}) {
+func (c *NetworkMapComponents) getNetworkResourcesRoutesToSync(peerID string) (bool, []*route.Route, map[string]struct{}) {
 	var isRoutingPeer bool
-	var routes []*nmdata.Route
+	var routes []*route.Route
 	allSourcePeers := make(map[string]struct{})
 
 	for _, resource := range c.NetworkResources {
@@ -798,12 +796,12 @@ func (c *NetworkMapComponents) getNetworkResourcesRoutesToSync(peerID string) (b
 
 func (c *NetworkMapComponents) processResourcePolicies(
 	peerID string,
-	resource *nmdata.NetworkResource,
-	networkRoutingPeers map[string]*nmdata.NetworkRouter,
+	resource *ComponentResource,
+	networkRoutingPeers map[string]*ComponentRouter,
 	addSourcePeers bool,
 	allSourcePeers map[string]struct{},
-) []*nmdata.Route {
-	var routes []*nmdata.Route
+) []*route.Route {
+	var routes []*route.Route
 
 	for _, policy := range c.ResourcePoliciesMap[resource.ID] {
 		peers := c.getResourcePolicyPeers(policy)
@@ -825,17 +823,17 @@ func (c *NetworkMapComponents) processResourcePolicies(
 	return routes
 }
 
-func (c *NetworkMapComponents) getResourcePolicyPeers(policy *nmdata.Policy) []string {
-	if policy.Rules[0].SourceResource.Type == string(ResourceTypePeer) && policy.Rules[0].SourceResource.ID != "" {
+func (c *NetworkMapComponents) getResourcePolicyPeers(policy *Policy) []string {
+	if policy.Rules[0].SourceResource.Type == ResourceTypePeer && policy.Rules[0].SourceResource.ID != "" {
 		return []string{policy.Rules[0].SourceResource.ID}
 	}
 	return c.getUniquePeerIDsFromGroupsIDs(policy.SourceGroups())
 }
 
-func (c *NetworkMapComponents) getNetworkResourcesRoutes(resource *nmdata.NetworkResource, peerID string, router *nmdata.NetworkRouter) []*nmdata.Route {
+func (c *NetworkMapComponents) getNetworkResourcesRoutes(resource *ComponentResource, peerID string, router *ComponentRouter) []*route.Route {
 	resourceAppliedPolicies := c.ResourcePoliciesMap[resource.ID]
 
-	var routes []*nmdata.Route
+	var routes []*route.Route
 	if len(resourceAppliedPolicies) > 0 {
 		peerInfo := c.GetPeerInfo(peerID)
 		if peerInfo != nil {
@@ -846,9 +844,9 @@ func (c *NetworkMapComponents) getNetworkResourcesRoutes(resource *nmdata.Networ
 	return routes
 }
 
-func (c *NetworkMapComponents) networkResourceToRoute(resource *nmdata.NetworkResource, peer *nmdata.Peer, router *nmdata.NetworkRouter) *nmdata.Route {
-	r := &nmdata.Route{
-		ID:          resource.ID + ":" + peer.ID,
+func (c *NetworkMapComponents) networkResourceToRoute(resource *ComponentResource, peer *ComponentPeer, router *ComponentRouter) *route.Route {
+	r := &route.Route{
+		ID:          route.ID(resource.ID + ":" + peer.ID),
 		AccountID:   resource.AccountID,
 		Peer:        peer.Key,
 		PeerID:      peer.ID,
@@ -856,24 +854,24 @@ func (c *NetworkMapComponents) networkResourceToRoute(resource *nmdata.NetworkRe
 		Masquerade:  router.Masquerade,
 		Enabled:     resource.Enabled,
 		KeepRoute:   true,
-		NetID:       resource.Name,
+		NetID:       route.NetID(resource.Name),
 		Description: resource.Description,
 	}
 
-	if resource.Type == string(resourceTypes.Host) || resource.Type == string(resourceTypes.Subnet) {
+	if resource.Type == ComponentResourceHost || resource.Type == ComponentResourceSubnet {
 		r.Network = resource.Prefix
 
-		r.NetworkType = nmdata.NetworkTypeIPv4
+		r.NetworkType = route.IPv4Network
 		if resource.Prefix.Addr().Is6() {
-			r.NetworkType = nmdata.NetworkTypeIPv6
+			r.NetworkType = route.IPv6Network
 		}
 	}
 
-	if resource.Type == string(resourceTypes.Domain) {
+	if resource.Type == ComponentResourceDomain {
 		domainList, err := domain.FromStringList([]string{resource.Domain})
 		if err == nil {
 			r.Domains = domainList
-			r.NetworkType = nmdata.NetworkTypeDomain
+			r.NetworkType = route.DomainNetwork
 			r.Network = netip.PrefixFrom(netip.AddrFrom4([4]byte{192, 0, 2, 0}), 32)
 		}
 	}
@@ -891,7 +889,7 @@ func (c *NetworkMapComponents) getPostureValidPeers(inputPeers []string, posture
 	return dest
 }
 
-func (c *NetworkMapComponents) getPeerNetworkResourceFirewallRules(ctx context.Context, peerID string, routes []*nmdata.Route, includeIPv6 bool) []*RouteFirewallRule {
+func (c *NetworkMapComponents) getPeerNetworkResourceFirewallRules(ctx context.Context, peerID string, routes []*route.Route, includeIPv6 bool) []*RouteFirewallRule {
 	routesFirewallRules := make([]*RouteFirewallRule, 0)
 
 	peerInfo := c.GetPeerInfo(peerID)
@@ -919,7 +917,7 @@ func (c *NetworkMapComponents) getPeerNetworkResourceFirewallRules(ctx context.C
 	return routesFirewallRules
 }
 
-func (c *NetworkMapComponents) getPoliciesSourcePeers(policies []*nmdata.Policy) map[string]struct{} {
+func (c *NetworkMapComponents) getPoliciesSourcePeers(policies []*Policy) map[string]struct{} {
 	sourcePeers := make(map[string]struct{})
 
 	for _, policy := range policies {
@@ -935,7 +933,7 @@ func (c *NetworkMapComponents) getPoliciesSourcePeers(policies []*nmdata.Policy)
 				}
 			}
 
-			if rule.SourceResource.Type == string(ResourceTypePeer) && rule.SourceResource.ID != "" {
+			if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID != "" {
 				sourcePeers[rule.SourceResource.ID] = struct{}{}
 			}
 		}
@@ -945,13 +943,13 @@ func (c *NetworkMapComponents) getPoliciesSourcePeers(policies []*nmdata.Policy)
 }
 
 func (c *NetworkMapComponents) addNetworksRoutingPeers(
-	networkResourcesRoutes []*nmdata.Route,
+	networkResourcesRoutes []*route.Route,
 	peerID string,
-	peersToConnect []*nmdata.Peer,
-	expiredPeers []*nmdata.Peer,
+	peersToConnect []*ComponentPeer,
+	expiredPeers []*ComponentPeer,
 	isRouter bool,
 	sourcePeers map[string]struct{},
-) []*nmdata.Peer {
+) []*ComponentPeer {
 
 	networkRoutesPeers := make(map[string]struct{}, len(networkResourcesRoutes))
 	for _, r := range networkResourcesRoutes {
@@ -1001,8 +999,8 @@ type FirewallRuleContext struct {
 	PortsJoined string
 }
 
-func AppendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *nmdata.Peer, rule *nmdata.PolicyRule, rc FirewallRuleContext) []*FirewallRule {
-	if !peer.IPv6.IsValid() || !targetPeer.SupportsIPv6() || !targetPeer.IPv6.IsValid() {
+func AppendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *ComponentPeer, rule *PolicyRule, rc FirewallRuleContext) []*FirewallRule {
+	if !peer.IPv6.IsValid() || !targetPeer.SupportsIPv6 || !targetPeer.IPv6.IsValid() {
 		return rules
 	}
 

shared/management/types/networkmap_components_compact.go

@@ -1,7 +1,8 @@
 package types
 
 import (
-	nmdata "github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
+	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/route"
 )
 
 type GroupCompact struct {
@@ -12,26 +13,26 @@ type GroupCompact struct {
 type NetworkMapComponentsCompact struct {
 	PeerID string
 
-	Network          *nmdata.Network
-	AccountSettings  *nmdata.AccountSettingsInfo
-	DNSSettings      *nmdata.DNSSettings
+	Network          *Network
+	AccountSettings  *AccountSettingsInfo
+	DNSSettings      *DNSSettings
 	CustomZoneDomain string
 
-	AllPeers          []*nmdata.Peer
+	AllPeers          []*ComponentPeer
 	PeerIndexes       []int
 	RouterPeerIndexes []int
 
 	Groups              map[string]*GroupCompact
-	AllPolicies         []*nmdata.Policy
+	AllPolicies         []*Policy
 	PolicyIndexes       []int
 	ResourcePoliciesMap map[string][]int
-	Routes              []*nmdata.Route
-	NameServerGroups    []*nmdata.NameServerGroup
-	AllDNSRecords       []nmdata.SimpleRecord
-	AccountZones        []nmdata.CustomZone
+	Routes              []*route.Route
+	NameServerGroups    []*nbdns.NameServerGroup
+	AllDNSRecords       []nbdns.SimpleRecord
+	AccountZones        []nbdns.CustomZone
 
-	RoutersMap       map[string]map[string]*nmdata.NetworkRouter
-	NetworkResources []*nmdata.NetworkResource
+	RoutersMap       map[string]map[string]*ComponentRouter
+	NetworkResources []*ComponentResource
 
 	GroupIDToUserIDs   map[string][]string
 	AllowedUserIDs     map[string]struct{}
@@ -40,7 +41,7 @@ type NetworkMapComponentsCompact struct {
 
 func (c *NetworkMapComponents) ToCompact() *NetworkMapComponentsCompact {
 	peerToIndex := make(map[string]int)
-	var allPeers []*nmdata.Peer
+	var allPeers []*ComponentPeer
 
 	for id, peer := range c.Peers {
 		if _, exists := peerToIndex[id]; !exists {
@@ -80,8 +81,8 @@ func (c *NetworkMapComponents) ToCompact() *NetworkMapComponentsCompact {
 		}
 	}
 
-	policyToIndex := make(map[*nmdata.Policy]int)
-	var allPolicies []*nmdata.Policy
+	policyToIndex := make(map[*Policy]int)
+	var allPolicies []*Policy
 
 	for _, policy := range c.Policies {
 		if _, exists := policyToIndex[policy]; !exists {
@@ -146,7 +147,7 @@ func (c *NetworkMapComponents) ToCompact() *NetworkMapComponentsCompact {
 }
 
 func (c *NetworkMapComponentsCompact) ToFull() *NetworkMapComponents {
-	peers := make(map[string]*nmdata.Peer, len(c.PeerIndexes))
+	peers := make(map[string]*ComponentPeer, len(c.PeerIndexes))
 	for _, idx := range c.PeerIndexes {
 		if idx >= 0 && idx < len(c.AllPeers) {
 			peer := c.AllPeers[idx]
@@ -154,7 +155,7 @@ func (c *NetworkMapComponentsCompact) ToFull() *NetworkMapComponents {
 		}
 	}
 
-	routerPeers := make(map[string]*nmdata.Peer, len(c.RouterPeerIndexes))
+	routerPeers := make(map[string]*ComponentPeer, len(c.RouterPeerIndexes))
 	for _, idx := range c.RouterPeerIndexes {
 		if idx >= 0 && idx < len(c.AllPeers) {
 			peer := c.AllPeers[idx]
@@ -162,7 +163,7 @@ func (c *NetworkMapComponentsCompact) ToFull() *NetworkMapComponents {
 		}
 	}
 
-	groups := make(map[string]*nmdata.Group, len(c.Groups))
+	groups := make(map[string]*ComponentGroup, len(c.Groups))
 	for id, gc := range c.Groups {
 		peerIDs := make([]string, 0, len(gc.PeerIndexes))
 		for _, idx := range gc.PeerIndexes {
@@ -170,24 +171,25 @@ func (c *NetworkMapComponentsCompact) ToFull() *NetworkMapComponents {
 				peerIDs = append(peerIDs, c.AllPeers[idx].ID)
 			}
 		}
-		groups[id] = &nmdata.Group{
+		groups[id] = &ComponentGroup{
+			ID:    id,
 			Name:  gc.Name,
 			Peers: peerIDs,
 		}
 	}
 
-	policies := make([]*nmdata.Policy, len(c.PolicyIndexes))
+	policies := make([]*Policy, len(c.PolicyIndexes))
 	for i, idx := range c.PolicyIndexes {
 		if idx >= 0 && idx < len(c.AllPolicies) {
 			policies[i] = c.AllPolicies[idx]
 		}
 	}
 
-	var resourcePoliciesMap map[string][]*nmdata.Policy
+	var resourcePoliciesMap map[string][]*Policy
 	if len(c.ResourcePoliciesMap) > 0 {
-		resourcePoliciesMap = make(map[string][]*nmdata.Policy, len(c.ResourcePoliciesMap))
+		resourcePoliciesMap = make(map[string][]*Policy, len(c.ResourcePoliciesMap))
 		for resID, indexes := range c.ResourcePoliciesMap {
-			pols := make([]*nmdata.Policy, 0, len(indexes))
+			pols := make([]*Policy, 0, len(indexes))
 			for _, idx := range indexes {
 				if idx >= 0 && idx < len(c.AllPolicies) {
 					pols = append(pols, c.AllPolicies[idx])