@cobaltcore-dev/aurora 1.0.0 → 1.2.0

package/dist/server/index.js

@@ -7,11 +7,7 @@ var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __commonJS = (cb, mod) => function __require() {
-  try {
-    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-  } catch (e) {
-    throw mod = 0, e;
-  }
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -260,7 +256,7 @@ var require_error = __commonJS({
       }
     };
     exports2.SignalOpenstackError = SignalOpenstackError4;
-    var SignalOpenstackApiError = class SignalOpenstackApiError extends Error {
+    var SignalOpenstackApiError2 = class SignalOpenstackApiError extends Error {
       static {
         __name(this, "SignalOpenstackApiError");
       }
@@ -271,7 +267,7 @@ var require_error = __commonJS({
         this.statusCode = statusCode;
       }
     };
-    exports2.SignalOpenstackApiError = SignalOpenstackApiError;
+    exports2.SignalOpenstackApiError = SignalOpenstackApiError2;
   }
 });
 
@@ -27310,7 +27306,7 @@ var require_pathHelpers = __commonJS({
     });
     exports2.encodeOpenstackPathSegment = encodeOpenstackPathSegment2;
     exports2.encodeOpenstackPath = encodeOpenstackPath;
-    exports2.validateAndEncodeResourceId = validateAndEncodeResourceId7;
+    exports2.validateAndEncodeResourceId = validateAndEncodeResourceId6;
     var error_1 = require_error();
     function encodeOpenstackPathSegment2(segment, label = "Path segment") {
       if (!segment || typeof segment !== "string") {
@@ -27332,10 +27328,10 @@ var require_pathHelpers = __commonJS({
       return segments.map((seg, idx) => encodeOpenstackPathSegment2(seg, `Path segment ${idx}`)).join("/");
     }
     __name(encodeOpenstackPath, "encodeOpenstackPath");
-    function validateAndEncodeResourceId7(id, resourceType = "Resource") {
+    function validateAndEncodeResourceId6(id, resourceType = "Resource") {
       return encodeOpenstackPathSegment2(id, `${resourceType} ID`);
     }
-    __name(validateAndEncodeResourceId7, "validateAndEncodeResourceId");
+    __name(validateAndEncodeResourceId6, "validateAndEncodeResourceId");
   }
 });
 
@@ -27346,7 +27342,7 @@ var require_esm = __commonJS({
     Object.defineProperty(exports2, "__esModule", {
       value: true
     });
-    exports2.validateAndEncodeResourceId = exports2.encodeOpenstackPath = exports2.encodeOpenstackPathSegment = exports2.redactSensitiveData = exports2.loggerConfig = exports2.logger = exports2.SignalOpenstackError = exports2.SignalOpenstackSession = void 0;
+    exports2.validateAndEncodeResourceId = exports2.encodeOpenstackPath = exports2.encodeOpenstackPathSegment = exports2.redactSensitiveData = exports2.loggerConfig = exports2.logger = exports2.SignalOpenstackApiError = exports2.SignalOpenstackError = exports2.SignalOpenstackSession = void 0;
     var session_1 = require_session();
     Object.defineProperty(exports2, "SignalOpenstackSession", {
       enumerable: true,
@@ -27361,6 +27357,12 @@ var require_esm = __commonJS({
         return error_1.SignalOpenstackError;
       }, "get")
     });
+    Object.defineProperty(exports2, "SignalOpenstackApiError", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return error_1.SignalOpenstackApiError;
+      }, "get")
+    });
     var logger_1 = require_logger();
     Object.defineProperty(exports2, "logger", {
       enumerable: true,
@@ -28569,10 +28571,12 @@ __export(server_exports, {
   createServer: () => createServer,
   domainScopedInputSchema: () => domainScopedInputSchema,
   domainScopedProcedure: () => domainScopedProcedure,
+  parseOrThrow: () => parseOrThrow,
   projectScopedInputSchema: () => projectScopedInputSchema,
   projectScopedProcedure: () => projectScopedProcedure,
   protectedProcedure: () => protectedProcedure,
-  publicProcedure: () => publicProcedure
+  publicProcedure: () => publicProcedure,
+  validateOpenstackService: () => validateOpenstackService
 });
 module.exports = __toCommonJS(server_exports);
 
@@ -28591,11 +28595,69 @@ var import_zod2 = require("zod");
 // src/server/trpc.ts
 var import_server = require("@trpc/server");
 var import_zod = require("zod");
+var import_signal_openstack = __toESM(require_esm());
 var t = import_server.initTRPC.context().create();
+var openstackErrorMiddleware = t.middleware(async ({ next }) => {
+  const result = await next();
+  if (!result.ok) {
+    const cause = result.error.cause;
+    if (cause instanceof import_signal_openstack.SignalOpenstackApiError) {
+      if (cause.statusCode === 401) {
+        return {
+          ...result,
+          error: new import_server.TRPCError({
+            code: "UNAUTHORIZED",
+            message: "Session expired or invalid. Please log in again.",
+            cause
+          })
+        };
+      }
+      if (cause.statusCode === 400) {
+        return {
+          ...result,
+          error: new import_server.TRPCError({
+            code: "BAD_REQUEST",
+            message: "The OpenStack request was invalid.",
+            cause
+          })
+        };
+      }
+      if (cause.statusCode === 404) {
+        return {
+          ...result,
+          error: new import_server.TRPCError({
+            code: "NOT_FOUND",
+            message: "Resource not found or not accessible. This can happen if you switched domains in another tab.",
+            cause
+          })
+        };
+      }
+      if (cause.statusCode === 403) {
+        return {
+          ...result,
+          error: new import_server.TRPCError({
+            code: "FORBIDDEN",
+            message: "Access denied. You may not have the required role assignment.",
+            cause
+          })
+        };
+      }
+      return {
+        ...result,
+        error: new import_server.TRPCError({
+          code: "INTERNAL_SERVER_ERROR",
+          message: "An unexpected OpenStack error occurred",
+          cause
+        })
+      };
+    }
+  }
+  return result;
+});
 var router = t.router;
 var auroraRouter = t.router;
 var mergeRouters = t.mergeRouters;
-var publicProcedure = t.procedure;
+var publicProcedure = t.procedure.use(openstackErrorMiddleware);
 var createCallerFactory = t.createCallerFactory;
 var protectedProcedure = publicProcedure.use(/* @__PURE__ */ __name(async function isAuthenticated(opts) {
   if (opts.ctx.validateSession() === false) {
@@ -28688,11 +28750,20 @@ var discriminatedSchema = import_zod2.z.discriminatedUnion("type", [
 var sessionRouter = {
   getCurrentUserSession: publicProcedure.query(async ({ ctx }) => {
     const token = ctx.openstack?.getToken();
-    return token?.tokenData || null;
-  }),
-  getAuthToken: protectedProcedure.query(async ({ ctx }) => {
-    const token = ctx.openstack?.getToken();
-    return token?.authToken || null;
+    if (!token) return null;
+    return {
+      user: token.tokenData.user,
+      ...token.tokenData.expires_at && {
+        expires_at: token.tokenData.expires_at
+      },
+      ...token.tokenData.issued_at && {
+        issued_at: token.tokenData.issued_at
+      },
+      roles: token.tokenData.roles,
+      project: token.tokenData.project,
+      domain: token.tokenData.domain,
+      catalog: token.tokenData.catalog
+    };
   }),
   getCurrentScope: publicProcedure.query(async ({ ctx }) => {
     const token = ctx.openstack?.getToken();
@@ -28706,6 +28777,7 @@ var sessionRouter = {
       domain
     };
   }),
+  // Errors from rescopeSession are handled by openstackErrorMiddleware
   setCurrentScope: protectedProcedure.input(discriminatedSchema).mutation(async ({ input, ctx }) => {
     switch (input.type) {
       case "domain": {
@@ -28713,9 +28785,15 @@ var sessionRouter = {
           domainId: input.domainId
         });
         const token = session?.getToken();
+        if (!token?.tokenData.domain) {
+          throw new import_server2.TRPCError({
+            code: "NOT_FOUND",
+            message: "Failed to rescope to the requested domain."
+          });
+        }
         return {
           project: null,
-          domain: token?.tokenData.domain
+          domain: token.tokenData.domain
         };
       }
       case "project": {
@@ -28723,9 +28801,15 @@ var sessionRouter = {
           projectId: input.projectId
         });
         const token = session?.getToken();
+        if (!token?.tokenData.project) {
+          throw new import_server2.TRPCError({
+            code: "NOT_FOUND",
+            message: "Failed to rescope to the requested project."
+          });
+        }
         return {
-          project: token?.tokenData.project,
-          domain: token?.tokenData.project?.domain
+          project: token.tokenData.project,
+          domain: token.tokenData.project.domain
         };
       }
       case "unscoped": {
@@ -29848,7 +29932,8 @@ var imagesPaginatedResponseSchema = import_zod4.z.object({
   images: import_zod4.z.array(imageSchema),
   first: import_zod4.z.string().optional(),
   next: import_zod4.z.string().optional(),
-  schema: import_zod4.z.string().optional()
+  schema: import_zod4.z.string().optional(),
+  totalCount: import_zod4.z.number().optional()
 });
 
 // src/server/Compute/routers/imageRouter.ts
@@ -29863,22 +29948,26 @@ var imageRouter = {
       validateGlanceService(glance);
       const FRONTEND_PAGE_SIZE = 50;
       const OPENSTACK_PAGE_SIZE = 100;
-      const MIN_RESULTS_WHEN_SEARCHING = 50;
       const MAX_PAGES_TO_SEARCH = 1e3;
       const allImages = [];
       const hasSearchTerm = queryInput.name && queryInput.name.trim();
       const queryParams = new URLSearchParams();
-      const minimalQuery = {
+      const apiQuery = {
         sort_key: queryInput.sort_key,
         sort_dir: queryInput.sort_dir,
         sort: queryInput.sort,
         limit: OPENSTACK_PAGE_SIZE,
-        marker
+        // Only pass single-value filters to API (multi-value filters start with "in:")
+        status: queryInput.status?.startsWith("in:") ? void 0 : queryInput.status,
+        visibility: queryInput.visibility === "all" ? void 0 : queryInput.visibility,
+        disk_format: queryInput.disk_format?.startsWith("in:") ? void 0 : queryInput.disk_format,
+        container_format: queryInput.container_format?.startsWith("in:") ? void 0 : queryInput.container_format,
+        protected: queryInput.protected,
+        owner: queryInput.owner
       };
-      applyImageQueryParams(queryParams, minimalQuery);
+      applyImageQueryParams(queryParams, apiQuery);
       let currentUrl = `v2/images?${queryParams.toString()}`;
       let pageCount = 0;
-      let nextMarker;
       while (currentUrl && pageCount < MAX_PAGES_TO_SEARCH) {
         const response = await glance.get(currentUrl).catch((error) => {
           throw mapErrorResponseToTRPCError(error, {
@@ -29891,41 +29980,7 @@ var imageRouter = {
         }
         allImages.push(...parsedData.data.images);
         pageCount++;
-        if (hasSearchTerm) {
-          let filteredSoFar = filterBySearchParams(allImages, queryInput.name, [
-            "name"
-          ]);
-          if (queryInput.visibility && queryInput.visibility !== "all") {
-            filteredSoFar = filteredSoFar.filter((img) => img.visibility === queryInput.visibility);
-          }
-          if (queryInput.status) {
-            const values = parseMultiValue(queryInput.status);
-            filteredSoFar = filteredSoFar.filter((img) => values.includes(img.status ?? ""));
-          }
-          if (queryInput.disk_format) {
-            const values = parseMultiValue(queryInput.disk_format);
-            filteredSoFar = filteredSoFar.filter((img) => values.includes(img.disk_format ?? ""));
-          }
-          if (queryInput.container_format) {
-            const values = parseMultiValue(queryInput.container_format);
-            filteredSoFar = filteredSoFar.filter((img) => values.includes(img.container_format ?? ""));
-          }
-          if (queryInput.protected !== void 0 && queryInput.protected !== null) {
-            const wantProtected = queryInput.protected === "true";
-            filteredSoFar = filteredSoFar.filter((img) => !!img.protected === wantProtected);
-          }
-          if (queryInput.owner) {
-            filteredSoFar = filteredSoFar.filter((img) => img.owner === queryInput.owner);
-          }
-          if (filteredSoFar.length >= MIN_RESULTS_WHEN_SEARCHING) {
-            nextMarker = parsedData.data.next;
-            break;
-          }
-        }
-        if (!hasSearchTerm) {
-          nextMarker = parsedData.data.next;
-          break;
-        }
+        validateRelativeUrl(parsedData.data.next, "pagination URL");
         currentUrl = parsedData.data.next;
       }
       let filteredImages = allImages;
@@ -29956,16 +30011,21 @@ var imageRouter = {
       if (queryInput.owner) {
         filteredImages = filteredImages.filter((img) => img.owner === queryInput.owner);
       }
-      const startIndex = 0;
-      const endIndex = FRONTEND_PAGE_SIZE;
+      let startIndex = 0;
+      if (marker) {
+        const markerIndex = filteredImages.findIndex((img) => img.id === marker);
+        startIndex = markerIndex >= 0 ? markerIndex + 1 : 0;
+      }
+      const endIndex = startIndex + FRONTEND_PAGE_SIZE;
       const paginatedImages = filteredImages.slice(startIndex, endIndex);
-      const hasMore = filteredImages.length > FRONTEND_PAGE_SIZE || !!nextMarker;
-      const nextPageMarker = filteredImages.length > FRONTEND_PAGE_SIZE ? filteredImages[FRONTEND_PAGE_SIZE - 1]?.id : nextMarker;
+      const hasMore = endIndex < filteredImages.length;
+      const nextPageMarker = hasMore ? filteredImages[endIndex - 1]?.id : void 0;
       return {
         images: paginatedImages,
         first: void 0,
         next: hasMore ? nextPageMarker : void 0,
-        schema: "/v2/schemas/images"
+        schema: "/v2/schemas/images",
+        totalCount: filteredImages.length
       };
     }, "list images");
   }),
@@ -30101,16 +30161,25 @@ var imageRouter = {
       validateGlanceService(glance);
       const fileStream = import_node_stream.Readable.fromWeb(input);
       const { validatedImageId, validatedFileSize, validatedFile } = validateUploadInput(imageId, fileSize, fileStream);
-      uploadProgress.set(validatedImageId, {
+      const token = openstackSession.getToken();
+      const tokenProjectId = token?.tokenData.project?.id;
+      if (!tokenProjectId) {
+        throw new import_server6.TRPCError({
+          code: "UNAUTHORIZED",
+          message: "Project scope required for upload progress tracking"
+        });
+      }
+      const scopedUploadId = `${tokenProjectId}:${validatedImageId}`;
+      uploadProgress.set(scopedUploadId, {
         uploaded: 0,
         total: validatedFileSize
       });
       try {
-        const progress = uploadProgress.get(validatedImageId);
+        const progress = uploadProgress.get(scopedUploadId);
         const progressTracker = new import_node_stream.Transform({
           transform(chunk, _encoding, callback) {
             progress.uploaded += chunk.length;
-            uploadProgressEmitter.emit(`progress:${validatedImageId}`, {
+            uploadProgressEmitter.emit(`progress:${scopedUploadId}`, {
               uploaded: progress.uploaded,
               total: progress.total,
               percent: progress.total > 0 ? Math.round(progress.uploaded / progress.total * 100) : 0
@@ -30144,24 +30213,39 @@ var imageRouter = {
           progressTracker.destroy();
           throw ImageErrorHandlers.upload(uploadResponse, validatedImageId, "application/octet-stream");
         }
-        uploadProgressEmitter.emit(`progress:${validatedImageId}:complete`);
+        uploadProgressEmitter.emit(`progress:${scopedUploadId}:complete`);
         return {
           success: true,
           imageId: validatedImageId
         };
       } catch (error) {
-        uploadProgressEmitter.emit(`progress:${validatedImageId}:error`, error);
+        uploadProgressEmitter.emit(`progress:${scopedUploadId}:error`, error);
         throw ImageErrorHandlers.upload(error, validatedImageId, "application/octet-stream");
       } finally {
-        uploadProgress.delete(validatedImageId);
+        uploadProgress.delete(scopedUploadId);
       }
     }, "upload image");
   }),
   watchUploadProgress: projectScopedProcedure.input(import_zod5.z.object({
     uploadId: import_zod5.z.string()
-  })).subscription(async function* ({ input }) {
+  })).subscription(async function* ({ input, ctx }) {
     const uploadId = input.uploadId;
-    const current = uploadProgress.get(uploadId);
+    if (uploadId.includes(":")) {
+      throw new import_server6.TRPCError({
+        code: "BAD_REQUEST",
+        message: "Invalid uploadId format"
+      });
+    }
+    const token = ctx.openstack?.getToken();
+    const projectId = token?.tokenData.project?.id;
+    if (!projectId) {
+      throw new import_server6.TRPCError({
+        code: "UNAUTHORIZED",
+        message: "Project scope required for upload progress tracking"
+      });
+    }
+    const scopedUploadId = `${projectId}:${uploadId}`;
+    const current = uploadProgress.get(scopedUploadId);
     if (current) {
       yield {
         ...current,
@@ -30189,9 +30273,9 @@ var imageRouter = {
       waitResolver?.();
       waitResolver = null;
     }, "onError");
-    uploadProgressEmitter.on(`progress:${uploadId}`, onProgress);
-    uploadProgressEmitter.on(`progress:${uploadId}:complete`, onComplete);
-    uploadProgressEmitter.on(`progress:${uploadId}:error`, onError);
+    uploadProgressEmitter.on(`progress:${scopedUploadId}`, onProgress);
+    uploadProgressEmitter.on(`progress:${scopedUploadId}:complete`, onComplete);
+    uploadProgressEmitter.on(`progress:${scopedUploadId}:error`, onError);
     try {
       while (!isComplete && !isError) {
         while (queue.length > 0) {
@@ -30218,9 +30302,9 @@ var imageRouter = {
         throw error;
       }
     } finally {
-      uploadProgressEmitter.off(`progress:${uploadId}`, onProgress);
-      uploadProgressEmitter.off(`progress:${uploadId}:complete`, onComplete);
-      uploadProgressEmitter.off(`progress:${uploadId}:error`, onError);
+      uploadProgressEmitter.off(`progress:${scopedUploadId}`, onProgress);
+      uploadProgressEmitter.off(`progress:${scopedUploadId}:complete`, onComplete);
+      uploadProgressEmitter.off(`progress:${scopedUploadId}:error`, onError);
     }
   }),
   updateImage: projectScopedProcedure.input(updateImageInputSchema).mutation(async ({ input, ctx }) => {
@@ -30761,7 +30845,7 @@ var ERROR_CODES = {
 };
 
 // src/server/Compute/helpers/flavorHelpers.ts
-var import_signal_openstack = __toESM(require_esm());
+var import_signal_openstack2 = __toESM(require_esm());
 function isErrorWithStatus(error) {
   return typeof error === "object" && error !== null && ("statusCode" in error || "status" in error);
 }
@@ -31116,9 +31200,9 @@ async function getFlavorById(compute, flavorId) {
   }
   let encodedId;
   try {
-    encodedId = (0, import_signal_openstack.validateAndEncodeResourceId)(flavorId, "Flavor");
+    encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
   } catch (error) {
-    if (error instanceof import_signal_openstack.SignalOpenstackError) {
+    if (error instanceof import_signal_openstack2.SignalOpenstackError) {
       throw new import_server7.TRPCError({
         code: "BAD_REQUEST",
         message: ERROR_CODES.GET_FLAVOR_DETAILS_INVALID_ID,
@@ -31232,9 +31316,9 @@ async function deleteFlavor(compute, flavorId) {
   }
   let encodedId;
   try {
-    encodedId = (0, import_signal_openstack.validateAndEncodeResourceId)(flavorId, "Flavor");
+    encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
   } catch (error) {
-    if (error instanceof import_signal_openstack.SignalOpenstackError) {
+    if (error instanceof import_signal_openstack2.SignalOpenstackError) {
       throw new import_server7.TRPCError({
         code: "BAD_REQUEST",
         message: ERROR_CODES.DELETE_FLAVOR_INVALID_ID,
@@ -31263,9 +31347,9 @@ __name(deleteFlavor, "deleteFlavor");
 async function createExtraSpecs(compute, flavorId, extra_specs) {
   let encodedId;
   try {
-    encodedId = (0, import_signal_openstack.validateAndEncodeResourceId)(flavorId, "Flavor");
+    encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
   } catch (error) {
-    if (error instanceof import_signal_openstack.SignalOpenstackError) {
+    if (error instanceof import_signal_openstack2.SignalOpenstackError) {
       throw new import_server7.TRPCError({
         code: "BAD_REQUEST",
         message: ERROR_CODES.CREATE_EXTRA_SPECS_FAILED,
@@ -31303,9 +31387,9 @@ __name(createExtraSpecs, "createExtraSpecs");
 async function getExtraSpecs(compute, flavorId) {
   let encodedId;
   try {
-    encodedId = (0, import_signal_openstack.validateAndEncodeResourceId)(flavorId, "Flavor");
+    encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
   } catch (error) {
-    if (error instanceof import_signal_openstack.SignalOpenstackError) {
+    if (error instanceof import_signal_openstack2.SignalOpenstackError) {
       throw new import_server7.TRPCError({
         code: "BAD_REQUEST",
         message: ERROR_CODES.GET_EXTRA_SPECS_FAILED,
@@ -31341,10 +31425,10 @@ __name(getExtraSpecs, "getExtraSpecs");
 async function deleteExtraSpec(compute, flavorId, key) {
   let encodedId, encodedKey;
   try {
-    encodedId = (0, import_signal_openstack.validateAndEncodeResourceId)(flavorId, "Flavor");
-    encodedKey = (0, import_signal_openstack.encodeOpenstackPathSegment)(key, "Extra spec key");
+    encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
+    encodedKey = (0, import_signal_openstack2.encodeOpenstackPathSegment)(key, "Extra spec key");
   } catch (error) {
-    if (error instanceof import_signal_openstack.SignalOpenstackError) {
+    if (error instanceof import_signal_openstack2.SignalOpenstackError) {
       throw new import_server7.TRPCError({
         code: "BAD_REQUEST",
         message: ERROR_CODES.DELETE_EXTRA_SPEC_FAILED,
@@ -31369,9 +31453,9 @@ __name(deleteExtraSpec, "deleteExtraSpec");
 async function getFlavorAccess(compute, flavorId) {
   let encodedId;
   try {
-    encodedId = (0, import_signal_openstack.validateAndEncodeResourceId)(flavorId, "Flavor");
+    encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
   } catch (error) {
-    if (error instanceof import_signal_openstack.SignalOpenstackError) {
+    if (error instanceof import_signal_openstack2.SignalOpenstackError) {
       throw new import_server7.TRPCError({
         code: "BAD_REQUEST",
         message: ERROR_CODES.GET_FLAVOR_ACCESS_FAILED,
@@ -31407,9 +31491,9 @@ __name(getFlavorAccess, "getFlavorAccess");
 async function addTenantAccess(compute, flavorId, tenantId) {
   let encodedId;
   try {
-    encodedId = (0, import_signal_openstack.validateAndEncodeResourceId)(flavorId, "Flavor");
+    encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
   } catch (error) {
-    if (error instanceof import_signal_openstack.SignalOpenstackError) {
+    if (error instanceof import_signal_openstack2.SignalOpenstackError) {
       throw new import_server7.TRPCError({
         code: "BAD_REQUEST",
         message: ERROR_CODES.ADD_TENANT_ACCESS_FAILED,
@@ -31450,9 +31534,9 @@ __name(addTenantAccess, "addTenantAccess");
 async function removeTenantAccess(compute, flavorId, tenantId) {
   let encodedId;
   try {
-    encodedId = (0, import_signal_openstack.validateAndEncodeResourceId)(flavorId, "Flavor");
+    encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
   } catch (error) {
-    if (error instanceof import_signal_openstack.SignalOpenstackError) {
+    if (error instanceof import_signal_openstack2.SignalOpenstackError) {
       throw new import_server7.TRPCError({
         code: "BAD_REQUEST",
         message: ERROR_CODES.REMOVE_TENANT_ACCESS_FAILED,
@@ -31493,7 +31577,7 @@ __name(removeTenantAccess, "removeTenantAccess");
 
 // src/server/Compute/routers/flavorRouter.ts
 var import_server8 = require("@trpc/server");
-var import_signal_openstack2 = __toESM(require_esm());
+var import_signal_openstack3 = __toESM(require_esm());
 var flavorRouter = {
   getFlavorById: projectScopedProcedure.input(import_zod9.z.object({
     project_id: import_zod9.z.string(),
@@ -31738,9 +31822,9 @@ var flavorRouter = {
       }
       let encodedId;
       try {
-        encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
+        encodedId = (0, import_signal_openstack3.validateAndEncodeResourceId)(flavorId, "Flavor");
       } catch (error) {
-        if (error instanceof import_signal_openstack2.SignalOpenstackError) {
+        if (error instanceof import_signal_openstack3.SignalOpenstackError) {
           throw new import_server8.TRPCError({
             code: "BAD_REQUEST",
             message: ERROR_CODES.GET_FLAVOR_ACCESS_FAILED,
@@ -34410,7 +34494,7 @@ var cephUploadProcedure = protectedProcedure.use(/* @__PURE__ */ __name(async fu
 
 // src/server/Storage/helpers/s3ErrorMapper.ts
 var import_server13 = require("@trpc/server");
-var import_signal_openstack3 = __toESM(require_esm());
+var import_signal_openstack4 = __toESM(require_esm());
 var S3_ERROR_MAP = {
   NoSuchBucket: "NOT_FOUND",
   NoSuchKey: "NOT_FOUND",
@@ -34418,6 +34502,7 @@ var S3_ERROR_MAP = {
   NoSuchVersion: "NOT_FOUND",
   NoSuchBucketPolicy: "NOT_FOUND",
   NoSuchCORSConfiguration: "NOT_FOUND",
+  NoSuchLifecycleConfiguration: "NOT_FOUND",
   BucketAlreadyExists: "CONFLICT",
   BucketAlreadyOwnedByYou: "CONFLICT",
   BucketNotEmpty: "PRECONDITION_FAILED",
@@ -34447,7 +34532,7 @@ function mapS3ErrorToTRPCError(error, context) {
   const errorCode = s3Error.Code ?? s3Error.name ?? "";
   const trpcCode = S3_ERROR_MAP[errorCode] ?? "INTERNAL_SERVER_ERROR";
   if (!S3_ERROR_MAP[errorCode] && errorCode) {
-    import_signal_openstack3.logger.warn("Unmapped S3 error code", {
+    import_signal_openstack4.logger.warn("Unmapped S3 error code", {
       errorCode,
       operation: context.operation,
       errorName: s3Error.name
@@ -34873,6 +34958,187 @@ var setCorsInputSchema = projectScopedInputSchema.extend({
 var deleteCorsInputSchema = projectScopedInputSchema.extend({
   bucketName: existingBucketNameSchema
 });
+var lifecycleRuleStatusSchema = import_zod13.z.enum([
+  "Enabled",
+  "Disabled"
+]);
+var lifecycleExpirationSchema = import_zod13.z.object({
+  Days: import_zod13.z.number().int().min(1).max(3650).optional(),
+  Date: import_zod13.z.string().datetime({
+    offset: true
+  }).optional(),
+  ExpiredObjectDeleteMarker: import_zod13.z.boolean().optional()
+}).refine((val) => {
+  return val.Days !== void 0 || val.Date !== void 0 || val.ExpiredObjectDeleteMarker !== void 0;
+}, "Expiration must specify either Days, Date, or ExpiredObjectDeleteMarker").refine((val) => {
+  return !(val.Days !== void 0 && val.Date !== void 0);
+}, "Expiration cannot specify both Days and Date").refine((val) => !(val.ExpiredObjectDeleteMarker !== void 0 && (val.Days !== void 0 || val.Date !== void 0)), "ExpiredObjectDeleteMarker cannot be combined with Days or Date");
+var lifecycleTransitionSchema = import_zod13.z.object({
+  Days: import_zod13.z.number().int().min(1).optional(),
+  Date: import_zod13.z.string().datetime({
+    offset: true
+  }).optional(),
+  StorageClass: import_zod13.z.string().min(1)
+}).refine((val) => {
+  return val.Days !== void 0 !== (val.Date !== void 0);
+}, "Transition must specify exactly one of Days or Date");
+var lifecycleNoncurrentVersionExpirationSchema = import_zod13.z.object({
+  NoncurrentDays: import_zod13.z.number().int().min(1),
+  NewerNoncurrentVersions: import_zod13.z.number().int().min(1).optional()
+});
+var lifecycleNoncurrentVersionTransitionSchema = import_zod13.z.object({
+  NoncurrentDays: import_zod13.z.number().int().min(1),
+  StorageClass: import_zod13.z.string().min(1),
+  NewerNoncurrentVersions: import_zod13.z.number().int().min(1).optional()
+});
+var lifecycleAbortIncompleteMultipartUploadSchema = import_zod13.z.object({
+  DaysAfterInitiation: import_zod13.z.number().int().min(1)
+});
+var lifecycleTagSchema = import_zod13.z.object({
+  Key: import_zod13.z.string().min(1).max(128),
+  Value: import_zod13.z.string().max(256)
+});
+var lifecycleFilterAndSchema = import_zod13.z.object({
+  Prefix: import_zod13.z.string().optional(),
+  Tags: import_zod13.z.array(lifecycleTagSchema).optional(),
+  ObjectSizeGreaterThan: import_zod13.z.number().int().min(0).optional(),
+  ObjectSizeLessThan: import_zod13.z.number().int().min(0).optional()
+}).refine((val) => {
+  const predicateCount = (val.Prefix !== void 0 && val.Prefix !== "" ? 1 : 0) + (val.Tags?.length ?? 0) + (val.ObjectSizeGreaterThan !== void 0 ? 1 : 0) + (val.ObjectSizeLessThan !== void 0 ? 1 : 0);
+  return predicateCount >= 2;
+}, {
+  message: "And filter must contain at least 2 predicates"
+});
+var lifecycleFilterSchema = import_zod13.z.object({
+  Prefix: import_zod13.z.string().optional(),
+  Tag: lifecycleTagSchema.optional(),
+  ObjectSizeGreaterThan: import_zod13.z.number().int().min(0).optional(),
+  ObjectSizeLessThan: import_zod13.z.number().int().min(0).optional(),
+  And: lifecycleFilterAndSchema.optional()
+}).refine((val) => {
+  const topLevelConditions = [
+    val.Prefix !== void 0,
+    val.Tag !== void 0,
+    val.ObjectSizeGreaterThan !== void 0,
+    val.ObjectSizeLessThan !== void 0
+  ].filter(Boolean).length;
+  if (topLevelConditions > 1) {
+    return false;
+  }
+  if (val.And && topLevelConditions > 0) {
+    return false;
+  }
+  return true;
+}, {
+  message: "Multiple filter conditions (Prefix, Tag, ObjectSize) must be wrapped in an And clause"
+});
+var lifecycleRuleSchema = import_zod13.z.object({
+  ID: import_zod13.z.string().max(255, "Rule ID must be at most 255 characters").optional(),
+  Status: lifecycleRuleStatusSchema,
+  Prefix: import_zod13.z.string().optional(),
+  Filter: lifecycleFilterSchema.optional(),
+  Expiration: lifecycleExpirationSchema.optional(),
+  Transitions: import_zod13.z.array(lifecycleTransitionSchema).optional(),
+  NoncurrentVersionExpiration: lifecycleNoncurrentVersionExpirationSchema.optional(),
+  NoncurrentVersionTransitions: import_zod13.z.array(lifecycleNoncurrentVersionTransitionSchema).optional(),
+  AbortIncompleteMultipartUpload: lifecycleAbortIncompleteMultipartUploadSchema.optional()
+}).refine((val) => {
+  return val.Expiration !== void 0 || val.Transitions !== void 0 && val.Transitions.length > 0 || val.NoncurrentVersionExpiration !== void 0 || val.NoncurrentVersionTransitions !== void 0 && val.NoncurrentVersionTransitions.length > 0 || val.AbortIncompleteMultipartUpload !== void 0;
+}, {
+  message: "Rule must have at least one action (Expiration, Transition, NoncurrentVersion, or AbortIncompleteMultipartUpload)"
+}).refine((val) => {
+  return !(val.Filter !== void 0 && val.Prefix !== void 0);
+}, {
+  message: "Rule cannot have both Filter and legacy Prefix field set (use Filter.Prefix instead)"
+}).refine((val) => {
+  if (val.Expiration?.ExpiredObjectDeleteMarker !== true) {
+    return true;
+  }
+  const hasTagFilter = val.Filter?.Tag !== void 0 || val.Filter?.And?.Tags !== void 0 && val.Filter.And.Tags.length > 0;
+  return !hasTagFilter;
+}, {
+  message: "ExpiredObjectDeleteMarker cannot be combined with tag-based filters"
+}).refine((val) => {
+  if (val.AbortIncompleteMultipartUpload === void 0) return true;
+  const hasTagFilter = val.Filter?.Tag !== void 0 || val.Filter?.And?.Tags !== void 0 && val.Filter.And.Tags.length > 0;
+  return !hasTagFilter;
+}, {
+  message: "AbortIncompleteMultipartUpload cannot be combined with tag-based filters"
+});
+var lifecycleRuleReadSchema = import_zod13.z.object({
+  ID: import_zod13.z.string().optional(),
+  Status: import_zod13.z.string(),
+  Prefix: import_zod13.z.string().optional(),
+  Filter: import_zod13.z.object({
+    Prefix: import_zod13.z.string().optional(),
+    Tag: import_zod13.z.object({
+      Key: import_zod13.z.string(),
+      Value: import_zod13.z.string()
+    }).optional(),
+    ObjectSizeGreaterThan: import_zod13.z.number().optional(),
+    ObjectSizeLessThan: import_zod13.z.number().optional(),
+    And: import_zod13.z.object({
+      Prefix: import_zod13.z.string().optional(),
+      Tags: import_zod13.z.array(import_zod13.z.object({
+        Key: import_zod13.z.string(),
+        Value: import_zod13.z.string()
+      })).optional(),
+      ObjectSizeGreaterThan: import_zod13.z.number().optional(),
+      ObjectSizeLessThan: import_zod13.z.number().optional()
+    }).optional()
+  }).passthrough().optional(),
+  Expiration: import_zod13.z.object({
+    Days: import_zod13.z.number().optional(),
+    Date: import_zod13.z.union([
+      import_zod13.z.string(),
+      import_zod13.z.date()
+    ]).optional(),
+    ExpiredObjectDeleteMarker: import_zod13.z.boolean().optional()
+  }).passthrough().optional(),
+  Transitions: import_zod13.z.array(import_zod13.z.object({
+    Days: import_zod13.z.number().optional(),
+    Date: import_zod13.z.union([
+      import_zod13.z.string(),
+      import_zod13.z.date()
+    ]).optional(),
+    StorageClass: import_zod13.z.string()
+  }).passthrough()).optional(),
+  NoncurrentVersionExpiration: import_zod13.z.object({
+    NoncurrentDays: import_zod13.z.number().optional(),
+    NewerNoncurrentVersions: import_zod13.z.number().optional()
+  }).passthrough().optional(),
+  NoncurrentVersionTransitions: import_zod13.z.array(import_zod13.z.object({
+    NoncurrentDays: import_zod13.z.number().optional(),
+    StorageClass: import_zod13.z.string(),
+    NewerNoncurrentVersions: import_zod13.z.number().optional()
+  }).passthrough()).optional(),
+  AbortIncompleteMultipartUpload: import_zod13.z.object({
+    DaysAfterInitiation: import_zod13.z.number().optional()
+  }).passthrough().optional()
+});
+var lifecycleConfigurationSchema = import_zod13.z.object({
+  Rules: import_zod13.z.array(lifecycleRuleSchema).min(1, "At least one lifecycle rule is required").max(100, "Maximum 100 lifecycle rules per bucket")
+}).refine((val) => {
+  const ids = val.Rules.map((r) => r.ID).filter((id) => id !== void 0 && id !== "");
+  const uniqueIds = new Set(ids);
+  return ids.length === uniqueIds.size;
+}, {
+  message: "Rule IDs must be unique within a lifecycle configuration"
+});
+var getLifecycleInputSchema = projectScopedInputSchema.extend({
+  bucketName: existingBucketNameSchema
+});
+var getLifecycleOutputSchema = import_zod13.z.object({
+  rules: import_zod13.z.array(lifecycleRuleReadSchema).nullable(),
+  skippedRuleCount: import_zod13.z.number().int().min(0)
+});
+var setLifecycleInputSchema = projectScopedInputSchema.extend({
+  bucketName: existingBucketNameSchema,
+  lifecycleConfiguration: lifecycleConfigurationSchema
+});
+var deleteLifecycleInputSchema = projectScopedInputSchema.extend({
+  bucketName: existingBucketNameSchema
+});
 
 // src/server/Storage/routers/ceph/containerRouter.ts
 var containerRouter = {
@@ -36297,20 +36563,60 @@ var ec2CredentialRouter = {
   }),
   /**
   * Deletes an EC2 credential by ID.
+  * Verifies ownership before deletion to prevent IDOR attacks.
   */
   delete: projectScopedProcedure.input(projectScopedInputSchema.extend({
     credentialId: import_zod15.z.string().min(1)
   })).mutation(async ({ ctx, input }) => {
     const userId = ctx.openstack.getToken()?.tokenData.user?.id;
+    const projectId = ctx.openstack.getToken()?.tokenData.project?.id;
     if (!userId) {
       throw new import_server15.TRPCError({
         code: "UNAUTHORIZED",
         message: "User ID not found in token"
       });
     }
+    if (!projectId) {
+      throw new import_server15.TRPCError({
+        code: "UNAUTHORIZED",
+        message: "Project ID not found in token"
+      });
+    }
     const identityService = ctx.openstack.service("identity");
-    const response = await identityService.del(`credentials/${input.credentialId}`);
-    if (!response.ok && response.status !== 404) {
+    const getResponse = await identityService.get(`credentials/${input.credentialId}`);
+    if (!getResponse.ok) {
+      if (getResponse.status === 404) {
+        return {
+          success: true
+        };
+      }
+      if (getResponse.status === 401) {
+        throw new import_server15.TRPCError({
+          code: "UNAUTHORIZED",
+          message: "Authentication failed"
+        });
+      }
+      if (getResponse.status === 403) {
+        throw new import_server15.TRPCError({
+          code: "FORBIDDEN",
+          message: "Access denied"
+        });
+      }
+      throw new import_server15.TRPCError({
+        code: "INTERNAL_SERVER_ERROR",
+        message: "Failed to fetch credential for verification"
+      });
+    }
+    const credentialData = await getResponse.json();
+    const credential = credentialData.credential;
+    if (credential.user_id !== userId || credential.project_id !== projectId) {
+      throw new import_server15.TRPCError({
+        code: "NOT_FOUND",
+        message: "Credential not found"
+      });
+    }
+    const deleteResponse = await identityService.del(`credentials/${input.credentialId}`);
+    if (!deleteResponse.ok && deleteResponse.status !== 404) {
       throw new import_server15.TRPCError({
         code: "INTERNAL_SERVER_ERROR",
         message: "Failed to delete EC2 credential"
@@ -36745,17 +37051,18 @@ function checkPolicySetRateLimit(bucketName, projectId) {
   const key = `${projectId}:${bucketName}`;
   const now = Date.now();
   const windowMs = 5 * 60 * 1e3;
-  for (const [k, v] of policySetRateLimits.entries()) {
-    if (now > v.resetAt) {
-      policySetRateLimits.delete(k);
-    }
-  }
   const limit = policySetRateLimits.get(key);
   if (!limit || now > limit.resetAt) {
     policySetRateLimits.set(key, {
       count: 1,
       resetAt: now + windowMs
     });
+    setTimeout(() => {
+      const current = policySetRateLimits.get(key);
+      if (current && current.resetAt <= Date.now()) {
+        policySetRateLimits.delete(key);
+      }
+    }, windowMs).unref();
     return;
   }
   if (limit.count >= 10) {
@@ -36973,17 +37280,18 @@ function checkCorsSetRateLimit(bucketName, projectId) {
   const key = `${projectId}:${bucketName}`;
   const now = Date.now();
   const windowMs = 60 * 1e3;
-  for (const [k, v] of corsSetRateLimits.entries()) {
-    if (now > v.resetAt) {
-      corsSetRateLimits.delete(k);
-    }
-  }
   const limit = corsSetRateLimits.get(key);
   if (!limit || now > limit.resetAt) {
     corsSetRateLimits.set(key, {
       count: 1,
       resetAt: now + windowMs
     });
+    setTimeout(() => {
+      const current = corsSetRateLimits.get(key);
+      if (current && current.resetAt <= Date.now()) {
+        corsSetRateLimits.delete(key);
+      }
+    }, windowMs).unref();
     return;
   }
   if (limit.count >= 10) {
@@ -37102,6 +37410,274 @@ var corsRouter = {
   })
 };
 
+// src/server/Storage/routers/ceph/lifecycleRouter.ts
+var import_client_s37 = require("@aws-sdk/client-s3");
+var import_server18 = require("@trpc/server");
+
+// src/server/Storage/helpers/lifecycleMapper.ts
+function toMidnightUTC(date) {
+  return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate()));
+}
+__name(toMidnightUTC, "toMidnightUTC");
+function toSdkLifecycleRules(wireRules) {
+  return wireRules.map((rule) => {
+    const result = {
+      Status: rule.Status,
+      ID: rule.ID,
+      Prefix: rule.Prefix,
+      Filter: rule.Filter
+    };
+    if (rule.Expiration) {
+      result.Expiration = {
+        Days: rule.Expiration.Days,
+        ExpiredObjectDeleteMarker: rule.Expiration.ExpiredObjectDeleteMarker,
+        // Only normalize Expiration.Date to midnight UTC (AWS requirement)
+        Date: rule.Expiration.Date !== void 0 ? typeof rule.Expiration.Date === "string" ? toMidnightUTC(new Date(rule.Expiration.Date)) : toMidnightUTC(rule.Expiration.Date) : void 0
+      };
+    }
+    if (rule.Transitions) {
+      result.Transitions = rule.Transitions.map((t2) => ({
+        Days: t2.Days,
+        StorageClass: t2.StorageClass,
+        Date: t2.Date !== void 0 ? typeof t2.Date === "string" ? new Date(t2.Date) : t2.Date : void 0
+      }));
+    }
+    if (rule.NoncurrentVersionExpiration) {
+      result.NoncurrentVersionExpiration = {
+        NoncurrentDays: rule.NoncurrentVersionExpiration.NoncurrentDays,
+        NewerNoncurrentVersions: rule.NoncurrentVersionExpiration.NewerNoncurrentVersions
+      };
+    }
+    if (rule.NoncurrentVersionTransitions) {
+      result.NoncurrentVersionTransitions = rule.NoncurrentVersionTransitions.map((t2) => ({
+        NoncurrentDays: t2.NoncurrentDays,
+        StorageClass: t2.StorageClass,
+        NewerNoncurrentVersions: t2.NewerNoncurrentVersions
+      }));
+    }
+    if (rule.AbortIncompleteMultipartUpload) {
+      result.AbortIncompleteMultipartUpload = {
+        DaysAfterInitiation: rule.AbortIncompleteMultipartUpload.DaysAfterInitiation
+      };
+    }
+    return result;
+  });
+}
+__name(toSdkLifecycleRules, "toSdkLifecycleRules");
+var toIso = /* @__PURE__ */ __name((d) => d === void 0 ? void 0 : d instanceof Date ? d.toISOString() : String(d), "toIso");
+function toWireLifecycleRule(rule) {
+  const result = {
+    Status: rule.Status ?? "Enabled"
+  };
+  if (rule.ID !== void 0) result.ID = rule.ID;
+  if (rule.Prefix !== void 0) result.Prefix = rule.Prefix;
+  if (rule.Filter !== void 0) result.Filter = rule.Filter;
+  if (rule.Expiration) {
+    result.Expiration = {
+      Days: rule.Expiration.Days,
+      ExpiredObjectDeleteMarker: rule.Expiration.ExpiredObjectDeleteMarker,
+      Date: toIso(rule.Expiration.Date)
+    };
+  }
+  if (rule.Transitions) {
+    result.Transitions = rule.Transitions.map((t2) => ({
+      Days: t2.Days,
+      StorageClass: t2.StorageClass,
+      Date: toIso(t2.Date)
+    }));
+  }
+  if (rule.NoncurrentVersionExpiration) {
+    result.NoncurrentVersionExpiration = {
+      NoncurrentDays: rule.NoncurrentVersionExpiration.NoncurrentDays,
+      NewerNoncurrentVersions: rule.NoncurrentVersionExpiration.NewerNoncurrentVersions
+    };
+  }
+  if (rule.NoncurrentVersionTransitions) {
+    result.NoncurrentVersionTransitions = rule.NoncurrentVersionTransitions.map((t2) => ({
+      NoncurrentDays: t2.NoncurrentDays,
+      StorageClass: t2.StorageClass,
+      NewerNoncurrentVersions: t2.NewerNoncurrentVersions
+    }));
+  }
+  if (rule.AbortIncompleteMultipartUpload) {
+    result.AbortIncompleteMultipartUpload = {
+      DaysAfterInitiation: rule.AbortIncompleteMultipartUpload.DaysAfterInitiation
+    };
+  }
+  return result;
+}
+__name(toWireLifecycleRule, "toWireLifecycleRule");
+
+// src/server/Storage/routers/ceph/lifecycleRouter.ts
+var lifecycleSetRateLimits = /* @__PURE__ */ new Map();
+function checkLifecycleSetRateLimit(bucketName, projectId) {
+  const key = `${projectId}:${bucketName}`;
+  const now = Date.now();
+  const windowMs = 60 * 1e3;
+  const limit = lifecycleSetRateLimits.get(key);
+  if (!limit || now >= limit.resetAt) {
+    lifecycleSetRateLimits.set(key, {
+      count: 1,
+      resetAt: now + windowMs
+    });
+    setTimeout(() => {
+      const current = lifecycleSetRateLimits.get(key);
+      if (current && current.resetAt <= Date.now()) {
+        lifecycleSetRateLimits.delete(key);
+      }
+    }, windowMs).unref();
+    return;
+  }
+  if (limit.count >= 10) {
+    throw new import_server18.TRPCError({
+      code: "TOO_MANY_REQUESTS",
+      message: "Lifecycle modification rate limit exceeded. Maximum 10 lifecycle changes per minute per bucket."
+    });
+  }
+  limit.count++;
+}
+__name(checkLifecycleSetRateLimit, "checkLifecycleSetRateLimit");
+var lifecycleRouter = {
+  /**
+  * Get the current lifecycle configuration for a bucket.
+  *
+  * Returns an array of lifecycle rules, or null if no lifecycle configuration is set.
+  * Not having a lifecycle configuration is a normal state (not an error).
+  *
+  * Rules are mapped and validated individually  a rule that fails the lenient read schema
+  * (e.g. authored outside Aurora) is skipped rather than failing the whole response;
+  * `skippedRuleCount` reports how many were skipped so the client can warn and disable mutations.
+  *
+  * @returns { rules: LifecycleRule[] | null; skippedRuleCount: number }
+  * @throws TRPCError NOT_FOUND - bucket does not exist
+  * @throws TRPCError FORBIDDEN - no credentials or access denied
+  */
+  get: cephProtectedProcedure.input(getLifecycleInputSchema).query(async ({ ctx, input }) => {
+    const s3 = ctx.getCephClient();
+    const { bucketName } = input;
+    try {
+      const response = await s3.send(new import_client_s37.GetBucketLifecycleConfigurationCommand({
+        Bucket: bucketName
+      }));
+      const rawRules = response.Rules ?? null;
+      if (!rawRules) {
+        return {
+          rules: null,
+          skippedRuleCount: 0
+        };
+      }
+      const rules = [];
+      let skippedRuleCount = 0;
+      for (const rawRule of rawRules) {
+        try {
+          const parsed = lifecycleRuleReadSchema.safeParse(toWireLifecycleRule(rawRule));
+          if (parsed.success) {
+            rules.push(parsed.data);
+            continue;
+          }
+          skippedRuleCount++;
+        } catch {
+          skippedRuleCount++;
+        }
+      }
+      return {
+        rules,
+        skippedRuleCount
+      };
+    } catch (error) {
+      const s3Error = error;
+      if (s3Error.name === "NoSuchLifecycleConfiguration" || s3Error.Code === "NoSuchLifecycleConfiguration") {
+        return {
+          rules: null,
+          skippedRuleCount: 0
+        };
+      }
+      throw mapS3ErrorToTRPCError(error, {
+        operation: "get lifecycle configuration",
+        bucket: bucketName
+      });
+    }
+  }),
+  /**
+  * Set (create or replace) a lifecycle configuration for a bucket.
+  *
+  * Accepts a lifecycle configuration with an array of rules. Validates structure
+  * before sending to S3. Replaces any existing lifecycle configuration completely.
+  *
+  * Rules are validated for:
+  * - At least one action (Expiration, Transition, NoncurrentVersion, or AbortIncompleteMultipartUpload)
+  * - ID: max 255 characters (optional)
+  * - Filter: proper structure for Prefix, Tag, ObjectSize conditions
+  * - Total rules: 1-100 per bucket
+  *
+  * @returns boolean - true on success
+  * @throws TRPCError BAD_REQUEST - invalid lifecycle configuration structure
+  * @throws TRPCError NOT_FOUND - bucket does not exist
+  * @throws TRPCError FORBIDDEN - no credentials or access denied
+  * @throws TRPCError TOO_MANY_REQUESTS - rate limit exceeded (10 changes per minute per bucket)
+  */
+  set: cephProtectedProcedure.input(setLifecycleInputSchema).mutation(async ({ ctx, input }) => {
+    const s3 = ctx.getCephClient();
+    const { bucketName, lifecycleConfiguration, project_id } = input;
+    checkLifecycleSetRateLimit(bucketName, project_id);
+    const transformedRules = toSdkLifecycleRules(lifecycleConfiguration.Rules).map((rule) => {
+      const transformed = {
+        ...rule
+      };
+      if (transformed.Prefix !== void 0 && transformed.Filter === void 0) {
+        transformed.Filter = {
+          Prefix: transformed.Prefix
+        };
+      }
+      delete transformed.Prefix;
+      return transformed;
+    });
+    try {
+      await s3.send(new import_client_s37.PutBucketLifecycleConfigurationCommand({
+        Bucket: bucketName,
+        LifecycleConfiguration: {
+          Rules: transformedRules
+        }
+      }));
+      return true;
+    } catch (error) {
+      throw mapS3ErrorToTRPCError(error, {
+        operation: "set lifecycle configuration",
+        bucket: bucketName
+      });
+    }
+  }),
+  /**
+  * Delete (remove) a lifecycle configuration from a bucket.
+  *
+  * Removes all lifecycle rules from the bucket. The bucket reverts to having no lifecycle config.
+  * Not an error if no lifecycle configuration was set (idempotent).
+  *
+  * @returns boolean - true on success
+  * @throws TRPCError NOT_FOUND - bucket does not exist
+  * @throws TRPCError FORBIDDEN - no credentials or access denied
+  */
+  delete: cephProtectedProcedure.input(deleteLifecycleInputSchema).mutation(async ({ ctx, input }) => {
+    const s3 = ctx.getCephClient();
+    const { bucketName } = input;
+    try {
+      await s3.send(new import_client_s37.DeleteBucketLifecycleCommand({
+        Bucket: bucketName
+      }));
+      return true;
+    } catch (error) {
+      const s3Error = error;
+      if (s3Error.name === "NoSuchLifecycleConfiguration" || s3Error.Code === "NoSuchLifecycleConfiguration") {
+        return true;
+      }
+      throw mapS3ErrorToTRPCError(error, {
+        operation: "delete lifecycle configuration",
+        bucket: bucketName
+      });
+    }
+  })
+};
+
 // src/server/Storage/routers/permissionRouter.ts
 var STORAGE_MAPPINGS = {
   // Container Operations (works for both Swift containers and Ceph buckets)
@@ -37141,6 +37717,10 @@ var STORAGE_MAPPINGS = {
     engine: "storage",
     rule: "storage:container_update_access_control"
   },
+  "storage:containers:update_versioning": {
+    engine: "storage",
+    rule: "storage:container_versioning_update"
+  },
   // Object Operations
   "storage:objects:read": {
     engine: "storage",
@@ -37174,6 +37754,10 @@ var STORAGE_MAPPINGS = {
     engine: "storage",
     rule: "storage:object_move"
   },
+  "storage:objects:share": {
+    engine: "storage",
+    rule: "storage:object_share"
+  },
   // Folder Operations
   "storage:folders:create_object": {
     engine: "storage",
@@ -37186,6 +37770,47 @@ var STORAGE_MAPPINGS = {
   "storage:folders:delete": {
     engine: "storage",
     rule: "storage:folder_delete"
+  },
+  // Object Version Operations
+  "storage:object_versions:delete": {
+    engine: "storage",
+    rule: "storage:object_version_delete"
+  },
+  "storage:object_versions:restore": {
+    engine: "storage",
+    rule: "storage:object_version_restore"
+  },
+  // Container Policy Operations
+  "storage:container_policies:update": {
+    engine: "storage",
+    rule: "storage:container_policy_update"
+  },
+  "storage:container_policies:delete": {
+    engine: "storage",
+    rule: "storage:container_policy_delete"
+  },
+  // CORS Operations
+  "storage:container_cors_rules:update": {
+    engine: "storage",
+    rule: "storage:container_cors_update"
+  },
+  "storage:container_cors_rules:delete": {
+    engine: "storage",
+    rule: "storage:container_cors_delete"
+  },
+  // Lifecycle Operations
+  "storage:container_lifecycle_rules:update": {
+    engine: "storage",
+    rule: "storage:container_lifecycle_update"
+  },
+  "storage:container_lifecycle_rules:delete": {
+    engine: "storage",
+    rule: "storage:container_lifecycle_delete"
+  },
+  // Credential Operations
+  "storage:credentials:create": {
+    engine: "storage",
+    rule: "storage:credential_create"
   }
 };
 var buildStoragePermissionRouter = /* @__PURE__ */ __name((policyDir) => createPermissionRouter({
@@ -37222,6 +37847,9 @@ var buildObjectStorageRouters = /* @__PURE__ */ __name((policyDir) => ({
       }),
       cors: auroraRouter({
         ...corsRouter
+      }),
+      lifecycle: auroraRouter({
+        ...lifecycleRouter
       })
     }),
     ...buildStoragePermissionRouter(policyDir)
@@ -37230,7 +37858,7 @@ var buildObjectStorageRouters = /* @__PURE__ */ __name((policyDir) => ({
 
 // src/server/Project/routers/projectRouter.ts
 var import_zod20 = require("zod");
-var import_server18 = require("@trpc/server");
+var import_server19 = require("@trpc/server");
 
 // src/server/Project/types/models.ts
 var import_zod19 = require("zod");
@@ -37267,10 +37895,10 @@ var projectsResponseSchema = import_zod19.z.object({
 });
 
 // src/server/Project/routers/projectRouter.ts
-var import_signal_openstack4 = __toESM(require_esm());
+var import_signal_openstack5 = __toESM(require_esm());
 async function callIdentityAPI(identityEndpoint, authToken, path3) {
   if (!identityEndpoint) {
-    throw new import_server18.TRPCError({
+    throw new import_server19.TRPCError({
       code: "INTERNAL_SERVER_ERROR",
       message: "Identity endpoint not configured"
     });
@@ -37286,7 +37914,7 @@ async function callIdentityAPI(identityEndpoint, authToken, path3) {
     }
   });
   if (!response.ok) {
-    throw new import_server18.TRPCError({
+    throw new import_server19.TRPCError({
       code: "INTERNAL_SERVER_ERROR",
       message: `Identity API call failed: ${response.status} ${response.statusText}`
     });
@@ -37326,14 +37954,14 @@ var projectRouter = {
   */
   getAuthProjects: protectedProcedure.query(async ({ ctx }) => {
     if (!ctx.openstack) {
-      throw new import_server18.TRPCError({
+      throw new import_server19.TRPCError({
         code: "UNAUTHORIZED",
         message: "No authenticated session"
       });
     }
     const token = ctx.openstack.getToken();
     if (!token?.authToken) {
-      throw new import_server18.TRPCError({
+      throw new import_server19.TRPCError({
         code: "UNAUTHORIZED",
         message: "No auth token available"
       });
@@ -37376,14 +38004,14 @@ var projectRouter = {
     search: import_zod20.z.string().optional()
   }).optional()).query(async ({ ctx, input }) => {
     if (!ctx.openstack) {
-      throw new import_server18.TRPCError({
+      throw new import_server19.TRPCError({
         code: "UNAUTHORIZED",
         message: "No authenticated session"
       });
     }
     const token = ctx.openstack.getToken();
     if (!token?.authToken) {
-      throw new import_server18.TRPCError({
+      throw new import_server19.TRPCError({
         code: "UNAUTHORIZED",
         message: "No auth token available"
       });
@@ -37407,21 +38035,21 @@ var projectRouter = {
     projectId: import_zod20.z.string()
   })).query(async ({ ctx, input }) => {
     if (!ctx.openstack) {
-      throw new import_server18.TRPCError({
+      throw new import_server19.TRPCError({
         code: "UNAUTHORIZED",
         message: "No authenticated session"
       });
     }
     const token = ctx.openstack.getToken();
     if (!token?.authToken) {
-      throw new import_server18.TRPCError({
+      throw new import_server19.TRPCError({
         code: "UNAUTHORIZED",
         message: "No auth token available"
       });
     }
     let encodedId;
     try {
-      encodedId = (0, import_signal_openstack4.validateAndEncodeResourceId)(input.projectId, "Project");
+      encodedId = (0, import_signal_openstack5.validateAndEncodeResourceId)(input.projectId, "Project");
     } catch {
       return null;
     }
@@ -37440,22 +38068,25 @@ var projectRouters = {
   })
 };
 
+// src/server/Network/routers/floatingIpRouter.ts
+var import_server24 = require("@trpc/server");
+
 // src/server/helpers/errorHandling.ts
-var import_server19 = require("@trpc/server");
-var import_signal_openstack5 = __toESM(require_esm());
+var import_server20 = require("@trpc/server");
+var import_signal_openstack6 = __toESM(require_esm());
 function wrapError3(error, operation) {
-  if (error instanceof import_server19.TRPCError) {
+  if (error instanceof import_server20.TRPCError) {
     return error;
   }
-  if (error instanceof import_signal_openstack5.SignalOpenstackError) {
-    return new import_server19.TRPCError({
+  if (error instanceof import_signal_openstack6.SignalOpenstackError) {
+    return new import_server20.TRPCError({
       code: "BAD_REQUEST",
       message: error.message,
       cause: error
     });
   }
   const baseErrorMessage = `Error during ${operation}`;
-  return new import_server19.TRPCError({
+  return new import_server20.TRPCError({
     code: "INTERNAL_SERVER_ERROR",
     message: typeof error !== "string" && error.message ? `${baseErrorMessage}: ${error.message}` : baseErrorMessage,
     cause: error
@@ -37495,11 +38126,11 @@ function appendQueryParamsFromObject(source, options) {
 __name(appendQueryParamsFromObject, "appendQueryParamsFromObject");
 
 // src/server/helpers/validateOpenstackService.ts
-var import_server20 = require("@trpc/server");
+var import_server21 = require("@trpc/server");
 var capitalize = /* @__PURE__ */ __name((str) => str.charAt(0).toUpperCase() + str.slice(1), "capitalize");
 function validateOpenstackService(service, serviceName) {
   if (!service) {
-    throw new import_server20.TRPCError({
+    throw new import_server21.TRPCError({
       code: "INTERNAL_SERVER_ERROR",
       message: `${capitalize(serviceName)} service is not available`
     });
@@ -37508,7 +38139,7 @@ function validateOpenstackService(service, serviceName) {
 __name(validateOpenstackService, "validateOpenstackService");
 
 // src/server/Network/routers/floatingIpRouter.ts
-var import_signal_openstack6 = __toESM(require_esm());
+var import_signal_openstack7 = __toESM(require_esm());
 
 // src/server/Network/types/floatingIp.ts
 var import_zod22 = require("zod");
@@ -37621,8 +38252,7 @@ var FloatingIpIdInputSchema = import_zod22.z.object({
   floatingip_id: import_zod22.z.string()
 });
 var FloatingIpCreateRequestSchema = import_zod22.z.object({
-  tenant_id: import_zod22.z.string(),
-  project_id: import_zod22.z.string(),
+  project_id: import_zod22.z.string().trim().min(1, "project_id must be a non-empty string"),
   floating_network_id: import_zod22.z.string(),
   fixed_ip_address: import_zod22.z.string().optional(),
   floating_ip_address: import_zod22.z.string().optional(),
@@ -37756,10 +38386,10 @@ var AvailablePortsResponseSchema = import_zod22.z.object({
 });
 
 // src/server/Network/helpers/errorHandling.ts
-var import_server22 = require("@trpc/server");
+var import_server23 = require("@trpc/server");
 
 // src/server/Network/helpers/index.ts
-var import_server21 = require("@trpc/server");
+var import_server22 = require("@trpc/server");
 var HTTP_STATUS_ERROR_MAP = {
   400: "BAD_REQUEST",
   401: "UNAUTHORIZED",
@@ -37779,7 +38409,7 @@ var parseOrThrow = /* @__PURE__ */ __name((schema, data, context) => {
   const parsed = schema.safeParse(data);
   if (!parsed.success) {
     console.error(`Zod Parsing Error in ${context}:`, parsed.error.issues);
-    throw new import_server21.TRPCError({
+    throw new import_server22.TRPCError({
       code: "PARSE_ERROR",
       message: `Failed to parse response in ${context}`
     });
@@ -37789,27 +38419,27 @@ var parseOrThrow = /* @__PURE__ */ __name((schema, data, context) => {
 
 // src/server/Network/helpers/errorHandling.ts
 var DEFAULT_HANDLERS = {
-  400: (response, resourceLabel) => new import_server22.TRPCError({
+  400: (response, resourceLabel) => new import_server23.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[400],
     message: `Invalid request data for ${resourceLabel}: ${response.statusText || "Unknown error"}`
   }),
-  401: (response, resourceLabel) => new import_server22.TRPCError({
+  401: (response, resourceLabel) => new import_server23.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[401],
     message: `Unauthorized access to ${resourceLabel}: ${response.statusText || "Unknown error"}`
   }),
-  403: (response, resourceLabel) => new import_server22.TRPCError({
+  403: (response, resourceLabel) => new import_server23.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[403],
     message: `Access forbidden to ${resourceLabel}: ${response.statusText || "Unknown error"}`
   }),
-  404: (response, resourceLabel) => new import_server22.TRPCError({
+  404: (response, resourceLabel) => new import_server23.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[404],
     message: `${resourceLabel} not found: ${response.statusText || "Unknown error"}`
   }),
-  409: (response, resourceLabel) => new import_server22.TRPCError({
+  409: (response, resourceLabel) => new import_server23.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[409],
     message: `Conflict - ${resourceLabel} is in use: ${response.statusText || "Unknown error"}`
   }),
-  412: (response, resourceLabel) => new import_server22.TRPCError({
+  412: (response, resourceLabel) => new import_server23.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[412],
     message: `Precondition failed - revision number mismatch in ${resourceLabel}: ${response.statusText || "Unknown error"}`
   })
@@ -37824,7 +38454,7 @@ var ErrorHandler = /* @__PURE__ */ __name((resourceName, customHandlers) => {
     if (response.status && handlers[response.status]) {
       return handlers[response.status](response, resourceLabel);
     }
-    return new import_server22.TRPCError({
+    return new import_server23.TRPCError({
       code: DEFAULT_ERROR_NAME,
       message: `Failed to process ${resourceLabel}: ${response.statusText || "Unknown error"}`
     });
@@ -37870,10 +38500,18 @@ var floatingIpRouter = {
   create: projectScopedProcedure.input(FloatingIpCreateRequestSchema).mutation(async ({ input, ctx }) => {
     return withErrorHandling3(async () => {
       const network = getNetworkService(ctx);
+      const token = ctx.openstack?.getToken();
+      const projectId = token?.tokenData.project?.id;
+      if (!projectId) {
+        throw new import_server24.TRPCError({
+          code: "UNAUTHORIZED",
+          message: "No project scope in session"
+        });
+      }
       const requestBody = {
         floatingip: {
-          tenant_id: input.tenant_id,
-          project_id: input.project_id,
+          tenant_id: projectId,
+          project_id: projectId,
           floating_network_id: input.floating_network_id,
           ...input.fixed_ip_address !== void 0 && {
             fixed_ip_address: input.fixed_ip_address
@@ -37916,7 +38554,7 @@ var floatingIpRouter = {
     return withErrorHandling3(async () => {
       const { floatingip_id } = input;
       const network = getNetworkService(ctx);
-      const encodedId = (0, import_signal_openstack6.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
+      const encodedId = (0, import_signal_openstack7.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
       const response = await network.get(`${FLOATING_IPS_BASE_URL}/${encodedId}`);
       if (!response.ok) {
         throw FloatingIpErrorHandlers.get(response, floatingip_id);
@@ -37943,7 +38581,7 @@ var floatingIpRouter = {
           }
         }
       };
-      const encodedId = (0, import_signal_openstack6.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
+      const encodedId = (0, import_signal_openstack7.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
       const response = await network.put(`${FLOATING_IPS_BASE_URL}/${encodedId}`, requestBody);
       if (!response.ok) {
         throw FloatingIpErrorHandlers.update(response, floatingip_id);
@@ -37956,7 +38594,7 @@ var floatingIpRouter = {
     return withErrorHandling3(async () => {
       const { floatingip_id } = input;
       const network = getNetworkService(ctx);
-      const encodedId = (0, import_signal_openstack6.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
+      const encodedId = (0, import_signal_openstack7.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
       const response = await network.del(`${FLOATING_IPS_BASE_URL}/${encodedId}`);
       if (!response.ok) {
         throw FloatingIpErrorHandlers.delete(response, floatingip_id);
@@ -38112,7 +38750,7 @@ var createSecurityGroupRuleInputSchema = projectScopedInputSchema.extend({
 });
 
 // src/server/Network/helpers/securityGroupHelpers.ts
-var import_server23 = require("@trpc/server");
+var import_server25 = require("@trpc/server");
 var SecurityGroupErrorHandlers = {
   /**
   * Handles errors specific to security group list operations
@@ -38122,17 +38760,17 @@ var SecurityGroupErrorHandlers = {
   list: /* @__PURE__ */ __name((response) => {
     switch (response.status) {
       case 401:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${response.statusText || "Unknown error"}`
         });
       default:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to list security groups: ${response.statusText || "Unknown error"}`
         });
@@ -38147,22 +38785,22 @@ var SecurityGroupErrorHandlers = {
   getById: /* @__PURE__ */ __name((response, securityGroupId) => {
     switch (response.status) {
       case 401:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${response.statusText || "Unknown error"}`
         });
       case 404:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: `Security group not found: ${securityGroupId}`
         });
       default:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to fetch security group: ${response.statusText || "Unknown error"}`
         });
@@ -38176,32 +38814,32 @@ var SecurityGroupErrorHandlers = {
   create: /* @__PURE__ */ __name((response) => {
     switch (response.status) {
       case 401:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${response.statusText || "Unknown error"}`
         });
       case 409:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[409],
           message: `Conflict: ${response.statusText || "Security group already exists"}`
         });
       case 413:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "BAD_REQUEST",
           message: `Quota exceeded for security groups. Please delete an existing security group or contact your administrator to increase your quota.`
         });
       case 400:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "BAD_REQUEST",
           message: `Invalid request: ${response.statusText || "Unknown error"}`
         });
       default:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "INTERNAL_SERVER_ERROR",
           message: `Failed to create security group: ${response.statusText || "Unknown error"}`
         });
@@ -38216,22 +38854,22 @@ var SecurityGroupErrorHandlers = {
   delete: /* @__PURE__ */ __name((response, securityGroupId) => {
     switch (response.status) {
       case 401:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 404:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: `Security group not found: ${securityGroupId}`
         });
       case 409:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[409],
           message: "Cannot delete security group because it is in use by one or more ports. Please remove all associations before deleting."
         });
       default:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to delete security group: ${response.statusText || "Unknown error"}`
         });
@@ -38246,39 +38884,39 @@ var SecurityGroupErrorHandlers = {
   update: /* @__PURE__ */ __name((response, securityGroupId) => {
     const errorMessage = response.statusText || "";
     if (errorMessage.toLowerCase().includes("stateful") && errorMessage.toLowerCase().includes("in use")) {
-      return new import_server23.TRPCError({
+      return new import_server25.TRPCError({
         code: "CONFLICT",
         message: "Cannot update the 'stateful' attribute because this security group is in use by one or more ports."
       });
     }
     switch (response.status) {
       case 401:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${errorMessage || "Unknown error"}`
         });
       case 404:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: `Security group not found: ${securityGroupId}`
         });
       case 409:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[409],
           message: `Conflict: ${errorMessage || "Security group conflict"}`
         });
       case 400:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[400],
           message: `Invalid request: ${errorMessage || "Unknown error"}`
         });
       default:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to update security group: ${errorMessage || "Unknown error"}`
         });
@@ -38296,48 +38934,48 @@ var SecurityGroupRuleErrorHandlers = {
     switch (response.status) {
       case 400:
         if (statusText.toLowerCase().includes("cidr")) {
-          return new import_server23.TRPCError({
+          return new import_server25.TRPCError({
             code: "BAD_REQUEST",
             message: "Invalid CIDR format. Please provide a valid IP address block (e.g., 0.0.0.0/0)"
           });
         }
         if (statusText.toLowerCase().includes("port")) {
-          return new import_server23.TRPCError({
+          return new import_server25.TRPCError({
             code: "BAD_REQUEST",
             message: "Invalid port range. Ports must be between 1 and 65535, and min must be <= max"
           });
         }
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "BAD_REQUEST",
           message: `Invalid request: ${statusText}`
         });
       case 401:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "UNAUTHORIZED",
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "FORBIDDEN",
           message: `Access forbidden: ${statusText}`
         });
       case 404:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "NOT_FOUND",
           message: "Security group not found"
         });
       case 409:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "CONFLICT",
           message: "A rule with these parameters already exists in this security group"
         });
       case 413:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "BAD_REQUEST",
           message: "Quota exceeded for security group rules. Please delete existing rules or contact your administrator."
         });
       default:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "INTERNAL_SERVER_ERROR",
           message: `Failed to create security group rule: ${statusText}`
         });
@@ -38356,22 +38994,22 @@ var SecurityGroupRuleErrorHandlers = {
   delete: /* @__PURE__ */ __name((response, ruleId) => {
     switch (response.status) {
       case 401:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "UNAUTHORIZED",
           message: "Unauthorized access"
         });
       case 404:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "NOT_FOUND",
           message: `Security group rule not found: ${ruleId}`
         });
       case 412:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "PRECONDITION_FAILED",
           message: `Cannot delete security group rule: precondition failed`
         });
       default:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "INTERNAL_SERVER_ERROR",
           message: `Failed to delete security group rule: ${response.statusText || "Unknown error"}`
         });
@@ -38382,7 +39020,7 @@ var parseOpenStackResponse = /* @__PURE__ */ __name((data, schema, operation, er
   const parsed = schema.safeParse(data);
   if (!parsed.success) {
     console.error(`Zod Parsing Error in ${operation}:`, parsed.error.format());
-    throw new import_server23.TRPCError({
+    throw new import_server25.TRPCError({
       code: "INTERNAL_SERVER_ERROR",
       message: errorMessage
     });
@@ -38437,7 +39075,7 @@ var sortSecurityGroups = /* @__PURE__ */ __name((items, sortKey, sortDir = "asc"
 }, "sortSecurityGroups");
 
 // src/server/Network/routers/securityGroupRouter.ts
-var import_signal_openstack7 = __toESM(require_esm());
+var import_signal_openstack8 = __toESM(require_esm());
 var SECURITY_GROUPS_BASE_URL = "v2.0/security-groups";
 var LIST_SECURITY_GROUPS_QUERY_KEY_MAP = {
   tags_any: "tags-any",
@@ -38504,7 +39142,7 @@ var securityGroupRouter = {
     return withErrorHandling3(async () => {
       const { securityGroupId } = input;
       const network = getNetworkService(ctx);
-      const encodedId = (0, import_signal_openstack7.validateAndEncodeResourceId)(securityGroupId, "Security group");
+      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(securityGroupId, "Security group");
       const response = await network.get(`${SECURITY_GROUPS_BASE_URL}/${encodedId}`);
       if (!response.ok) {
         throw SecurityGroupErrorHandlers.getById(response, securityGroupId);
@@ -38540,7 +39178,7 @@ var securityGroupRouter = {
     return withErrorHandling3(async () => {
       const { securityGroupId } = input;
       const network = getNetworkService(ctx);
-      const encodedId = (0, import_signal_openstack7.validateAndEncodeResourceId)(securityGroupId, "Security group");
+      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(securityGroupId, "Security group");
       const response = await network.del(`${SECURITY_GROUPS_BASE_URL}/${encodedId}`);
       if (!response?.ok) {
         throw SecurityGroupErrorHandlers.delete(response, securityGroupId);
@@ -38564,7 +39202,7 @@ var securityGroupRouter = {
           }
         }
       };
-      const encodedId = (0, import_signal_openstack7.validateAndEncodeResourceId)(securityGroupId, "Security group");
+      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(securityGroupId, "Security group");
       const response = await network.put(`${SECURITY_GROUPS_BASE_URL}/${encodedId}`, requestBody);
       if (!response.ok) {
         throw SecurityGroupErrorHandlers.update(response, securityGroupId);
@@ -38669,7 +39307,7 @@ var deleteRBACPolicyInputSchema = projectScopedInputSchema.extend({
 });
 
 // src/server/Network/helpers/rbacPolicyHelpers.ts
-var import_server24 = require("@trpc/server");
+var import_server26 = require("@trpc/server");
 var RBACPolicyErrorHandlers = {
   /**
   * Handles errors specific to RBAC policy list operations
@@ -38679,17 +39317,17 @@ var RBACPolicyErrorHandlers = {
   list: /* @__PURE__ */ __name((response) => {
     switch (response.status) {
       case 401:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${response.statusText || "Unknown error"}`
         });
       default:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to list RBAC policies: ${response.statusText || "Unknown error"}`
         });
@@ -38703,32 +39341,32 @@ var RBACPolicyErrorHandlers = {
   create: /* @__PURE__ */ __name((response) => {
     switch (response.status) {
       case 400:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[400],
           message: `Invalid request: ${response.statusText || "Unknown error"}`
         });
       case 401:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: "You don't have permission to share this security group"
         });
       case 404:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: "Security group not found or target project does not exist"
         });
       case 409:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[409],
           message: "This security group is already shared with the specified project"
         });
       default:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: "INTERNAL_SERVER_ERROR",
           message: `Failed to create RBAC policy: ${response.statusText || "Unknown error"}`
         });
@@ -38743,27 +39381,27 @@ var RBACPolicyErrorHandlers = {
   update: /* @__PURE__ */ __name((response, policyId) => {
     switch (response.status) {
       case 400:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[400],
           message: `Invalid request: ${response.statusText || "Unknown error"}`
         });
       case 401:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${response.statusText || "Unknown error"}`
         });
       case 404:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: `RBAC policy not found: ${policyId}`
         });
       default:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: "INTERNAL_SERVER_ERROR",
           message: `Failed to update RBAC policy: ${response.statusText || "Unknown error"}`
         });
@@ -38778,22 +39416,22 @@ var RBACPolicyErrorHandlers = {
   delete: /* @__PURE__ */ __name((response, policyId) => {
     switch (response.status) {
       case 401:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 404:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: `RBAC policy not found: ${policyId}`
         });
       case 409:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[409],
           message: "Cannot delete RBAC policy because it is in use"
         });
       default:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to delete RBAC policy: ${response.statusText || "Unknown error"}`
         });
@@ -38804,7 +39442,7 @@ var parseOpenStackResponse2 = /* @__PURE__ */ __name((data, schema, operation, e
   const parsed = schema.safeParse(data);
   if (!parsed.success) {
     console.error(`Zod Parsing Error in ${operation}:`, parsed.error.format());
-    throw new import_server24.TRPCError({
+    throw new import_server26.TRPCError({
       code: "INTERNAL_SERVER_ERROR",
       message: errorMessage
     });
@@ -39120,266 +39758,8 @@ var buildNetworkRouters = /* @__PURE__ */ __name((policyDir) => ({
   })
 }), "buildNetworkRouters");
 
-// src/server/Services/routers/pcaRouter.ts
-var import_signal_openstack8 = __toESM(require_esm());
-
-// src/server/Services/types/pca.ts
-var import_zod25 = require("zod");
-var CertificateValiditySchema = import_zod25.z.object({
-  not_after: import_zod25.z.number().int(),
-  not_before: import_zod25.z.number().int().optional()
-});
-var CertificateAuthorityCertificateSchema = import_zod25.z.object({
-  /** PEM encoded certificate data. */
-  pem: import_zod25.z.string(),
-  validity: CertificateValiditySchema
-});
-var CertificateAuthorityCertificateChainSchema = import_zod25.z.object({
-  certificates: import_zod25.z.array(import_zod25.z.object({
-    pem: import_zod25.z.string()
-  })),
-  /** Concatenated PEM certificates of the chain. */
-  pem: import_zod25.z.string()
-});
-var CertificateAuthorityAdditionalAttributeSchema = import_zod25.z.object({
-  /** ASN.1 Object Identifier of the attribute */
-  key: import_zod25.z.array(import_zod25.z.number().int()),
-  value: import_zod25.z.string()
-});
-var stringOrStringArray = import_zod25.z.union([
-  import_zod25.z.array(import_zod25.z.string()),
-  import_zod25.z.string().transform((s) => [
-    s
-  ])
-]);
-var CertificateAuthoritySubjectSchema = import_zod25.z.object({
-  additional_attribute: import_zod25.z.array(CertificateAuthorityAdditionalAttributeSchema).optional(),
-  named_attributes: import_zod25.z.object({
-    cn: import_zod25.z.string(),
-    /** Country codes (ISO 3166-1 alpha-2). */
-    c: stringOrStringArray.optional(),
-    /** Locality/city names. */
-    l: stringOrStringArray.optional(),
-    /** Organization names. */
-    o: stringOrStringArray.optional(),
-    /** Organizational unit names. */
-    ou: stringOrStringArray.optional(),
-    /** Postal/ZIP codes. */
-    postal_code: stringOrStringArray.optional(),
-    /** State or province names. */
-    st: stringOrStringArray.optional(),
-    serial_number: import_zod25.z.string().optional(),
-    street: stringOrStringArray.optional()
-  })
-});
-var CertificateAuthorityStateSchema = import_zod25.z.enum([
-  "CREATING",
-  "AWAITING_CERTIFICATE",
-  "READY",
-  "FAILED"
-]);
-var CertificateAuthoritySchema = import_zod25.z.object({
-  certificate: CertificateAuthorityCertificateSchema.optional(),
-  /** Details of Certificate Authority certificate's issuers chain. */
-  certificate_chain: CertificateAuthorityCertificateChainSchema.optional(),
-  configuration: import_zod25.z.object({
-    /** X.509 subject of Certificate Authority. Required on create operation. */
-    subject: CertificateAuthoritySubjectSchema
-  }).optional(),
-  csr: import_zod25.z.string().optional(),
-  /** Human-readable subject string, e.g. "CN=demo-ca.test.sci". */
-  display_subject: import_zod25.z.string().optional(),
-  id: import_zod25.z.string(),
-  /**
-  * Required on import certificate operation.
-  * Certificate Authority certificate chain, in PEM format. Consists of concatenated string
-  * of Certificate Authority certificate, followed by its intermediate issuing CAs certificates
-  * and root issuing CA certificate last.
-  */
-  imported_certificate_chain: import_zod25.z.string().optional(),
-  /** Identifier of OpenStack project that Certificate Authority belongs. */
-  project_id: import_zod25.z.string(),
-  /** Current operational state of Certificate Authority. */
-  state: CertificateAuthorityStateSchema
-});
-var LinkSchema = import_zod25.z.object({
-  href: import_zod25.z.string(),
-  rel: import_zod25.z.string()
-});
-var CertificateAuthoritiesListSchema = import_zod25.z.object({
-  certificate_authorities: import_zod25.z.array(CertificateAuthoritySchema),
-  links: import_zod25.z.array(LinkSchema),
-  next_page_marker: import_zod25.z.string().optional()
-});
-var CertificateAuthoritiesListInputSchema = projectScopedInputSchema.extend({
-  limit: import_zod25.z.number().int().min(1).max(1e3).optional(),
-  next_page_marker: import_zod25.z.string().trim().min(1).optional()
-});
-var CertificateAuthorityCreateSchema = import_zod25.z.object({
-  configuration: import_zod25.z.object({
-    subject: import_zod25.z.object({
-      named_attributes: import_zod25.z.object({
-        cn: import_zod25.z.string().trim().min(1)
-      })
-    })
-  })
-});
-var CertificateAuthorityIdInputSchema = projectScopedInputSchema.extend({
-  certificate_authority_id: import_zod25.z.string().min(1)
-});
-var CertificateAuthorityCertificatesListInputSchema = CertificateAuthorityIdInputSchema.extend({
-  limit: import_zod25.z.number().int().min(1).max(1e3).optional(),
-  next_page_marker: import_zod25.z.string().trim().min(1).optional()
-});
-var CertificateAuthorityImportInputSchema = CertificateAuthorityIdInputSchema.extend({
-  imported_certificate_chain: import_zod25.z.string().min(1)
-});
-var CertificateIdInputSchema = CertificateAuthorityIdInputSchema.extend({
-  certificate_id: import_zod25.z.string().min(1)
-});
-var CertificateConfigurationSchema = import_zod25.z.object({
-  validity: CertificateValiditySchema
-});
-var CreateCertificateInputSchema = projectScopedInputSchema.extend({
-  certificate_authority_id: import_zod25.z.string().min(1),
-  csr: import_zod25.z.string().min(1),
-  configuration: CertificateConfigurationSchema
-});
-var CertificateSchema = import_zod25.z.object({
-  certificate: CertificateAuthorityCertificateSchema.optional(),
-  certificate_authority_id: import_zod25.z.string(),
-  certificate_chain: CertificateAuthorityCertificateChainSchema.optional(),
-  configuration: CertificateConfigurationSchema.optional(),
-  csr: import_zod25.z.string().optional(),
-  id: import_zod25.z.string(),
-  project_id: import_zod25.z.string()
-});
-var CertificatesListSchema = import_zod25.z.object({
-  certificates: import_zod25.z.array(CertificateSchema),
-  links: import_zod25.z.array(LinkSchema),
-  next_page_marker: import_zod25.z.string().optional()
-});
-
-// src/server/Services/routers/pcaRouter.ts
-var PCA_BASE_URL = "v1/certificate-authorities";
-var pcaRouter = {
-  list: projectScopedProcedure.input(CertificateAuthoritiesListInputSchema).query(async ({ input, ctx }) => {
-    return withErrorHandling3(async () => {
-      const pca = ctx.openstack?.service("pca");
-      validateOpenstackService(pca, "pca");
-      const queryParams = new URLSearchParams();
-      if (input.limit !== void 0) queryParams.set("limit", String(input.limit));
-      if (input.next_page_marker !== void 0) queryParams.set("next_page_marker", input.next_page_marker);
-      const queryString = queryParams.toString();
-      const url = queryString ? `${PCA_BASE_URL}?${queryString}` : PCA_BASE_URL;
-      const response = await pca.get(url);
-      const data = await response.json();
-      return parseOrThrow(CertificateAuthoritiesListSchema, data, "pcaRouter.list");
-    }, "list certificate authorities");
-  }),
-  /**
-  * Creates a new Certificate Authority (CA).
-  * The CA is created in CREATING state and transitions to AWAITING_CERTIFICATE state once its CSR has been generated.
-  * CA in AWAITING_CERTIFICATE can't issue end-entity certificates, and needs to have its certificate imported - see the respective importCertificate endpoint.
-  */
-  create: projectScopedProcedure.input(CertificateAuthorityCreateSchema).mutation(async ({ input, ctx }) => {
-    return withErrorHandling3(async () => {
-      const pca = ctx.openstack?.service("pca");
-      validateOpenstackService(pca, "pca");
-      const response = await pca.post(PCA_BASE_URL, omit(input, "project_id"));
-      const data = await response.json();
-      return parseOrThrow(CertificateAuthoritySchema, data, "pcaRouter.create");
-    }, "create certificate authority");
-  }),
-  getById: projectScopedProcedure.input(CertificateAuthorityIdInputSchema).query(async ({ input, ctx }) => {
-    return withErrorHandling3(async () => {
-      const pca = ctx.openstack?.service("pca");
-      validateOpenstackService(pca, "pca");
-      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(input.certificate_authority_id, "Certificate authority");
-      const url = `${PCA_BASE_URL}/${encodedId}`;
-      const response = await pca.get(url);
-      const data = await response.json();
-      return parseOrThrow(CertificateAuthoritySchema, data, "pcaRouter.getById");
-    }, "get certificate authority details");
-  }),
-  // Permanently deletes a Certificate Authority. This operation is irreversible.
-  delete: projectScopedProcedure.input(CertificateAuthorityIdInputSchema).mutation(async ({ input, ctx }) => {
-    return withErrorHandling3(async () => {
-      const pca = ctx.openstack?.service("pca");
-      validateOpenstackService(pca, "pca");
-      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(input.certificate_authority_id, "Certificate authority");
-      const url = `${PCA_BASE_URL}/${encodedId}`;
-      await pca.del(url);
-    }, "delete certificate authority");
-  }),
-  /**
-  * Imports Certificate Authority certificate
-  * Transitioning the CA from AWAITING_CERTIFICATE to READY state
-  * after which the CA becomes fully operational and can issue certificates to end entities
-  */
-  import: projectScopedProcedure.input(CertificateAuthorityImportInputSchema).mutation(async ({ input, ctx }) => {
-    return withErrorHandling3(async () => {
-      const pca = ctx.openstack?.service("pca");
-      validateOpenstackService(pca, "pca");
-      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(input.certificate_authority_id, "Certificate authority");
-      const url = `${PCA_BASE_URL}/${encodedId}:importCertificate`;
-      const response = await pca.post(url, {
-        imported_certificate_chain: input.imported_certificate_chain
-      });
-      const data = await response.json();
-      return parseOrThrow(CertificateAuthoritySchema, data, "pcaRouter.import");
-    }, "import certificate of certificate authority");
-  }),
-  listCertificates: projectScopedProcedure.input(CertificateAuthorityCertificatesListInputSchema).query(async ({ input, ctx }) => {
-    return withErrorHandling3(async () => {
-      const pca = ctx.openstack?.service("pca");
-      validateOpenstackService(pca, "pca");
-      const queryParams = new URLSearchParams();
-      if (input.limit !== void 0) queryParams.set("limit", String(input.limit));
-      if (input.next_page_marker !== void 0) queryParams.set("next_page_marker", input.next_page_marker);
-      const queryString = queryParams.toString();
-      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(input.certificate_authority_id, "Certificate authority");
-      const baseUrl = `${PCA_BASE_URL}/${encodedId}/certificates`;
-      const url = queryString ? `${baseUrl}?${queryString}` : baseUrl;
-      const response = await pca.get(url);
-      const data = await response.json();
-      return parseOrThrow(CertificatesListSchema, data, "pcaRouter.listCertificates");
-    }, "list certificates for certificate authority");
-  }),
-  createCertificate: projectScopedProcedure.input(CreateCertificateInputSchema).mutation(async ({ input, ctx }) => {
-    return withErrorHandling3(async () => {
-      const pca = ctx.openstack?.service("pca");
-      validateOpenstackService(pca, "pca");
-      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(input.certificate_authority_id, "Certificate authority");
-      const url = `${PCA_BASE_URL}/${encodedId}/certificates`;
-      const response = await pca.post(url, omit(input, "project_id", "certificate_authority_id"));
-      const data = await response.json();
-      return parseOrThrow(CertificateSchema, data, "pcaRouter.createCertificate");
-    }, "create certificate for certificate authority");
-  }),
-  getByIdCertificate: projectScopedProcedure.input(CertificateIdInputSchema).query(async ({ input, ctx }) => {
-    return withErrorHandling3(async () => {
-      const pca = ctx.openstack?.service("pca");
-      validateOpenstackService(pca, "pca");
-      const encodedAuthorityId = (0, import_signal_openstack8.validateAndEncodeResourceId)(input.certificate_authority_id, "Certificate authority");
-      const encodedCertId = (0, import_signal_openstack8.validateAndEncodeResourceId)(input.certificate_id, "Certificate");
-      const url = `${PCA_BASE_URL}/${encodedAuthorityId}/certificates/${encodedCertId}`;
-      const response = await pca.get(url);
-      const data = await response.json();
-      return parseOrThrow(CertificateSchema, data, "pcaRouter.getByIdCertificate");
-    }, "get certificate details");
-  })
-};
-
-// src/server/Services/routers/index.ts
-var serviceRouters = {
-  services: auroraRouter({
-    pca: pcaRouter
-  })
-};
-
 // src/server/routers.ts
-var buildBaseRouter = /* @__PURE__ */ __name((policyDir) => mergeRouters(auroraRouter(authRouters), auroraRouter(buildComputeRouters(policyDir)), auroraRouter(buildObjectStorageRouters(policyDir)), auroraRouter(projectRouters), auroraRouter(buildNetworkRouters(policyDir)), auroraRouter(serviceRouters)), "buildBaseRouter");
+var buildBaseRouter = /* @__PURE__ */ __name((policyDir) => mergeRouters(auroraRouter(authRouters), auroraRouter(buildComputeRouters(policyDir)), auroraRouter(buildObjectStorageRouters(policyDir)), auroraRouter(projectRouters), auroraRouter(buildNetworkRouters(policyDir))), "buildBaseRouter");
 var buildAppRouter = /* @__PURE__ */ __name((policyDir, extraRouters = []) => {
   if (extraRouters.length === 0) return buildBaseRouter(policyDir);
   return mergeRouters(buildBaseRouter(policyDir), ...extraRouters);
@@ -39597,53 +39977,51 @@ async function createContext(opts, config) {
       return openstackSession;
     }
     const rescopeTokenPromise = (async () => {
-      try {
-        const newScope = newScopeProjectId ? {
-          project: {
-            id: newScopeProjectId
-          }
-        } : newScopeDomainId ? {
-          domain: {
-            id: newScopeDomainId
-          }
-        } : "unscoped";
-        await openstackSession.rescope(newScope);
-        const newToken = openstackSession.getToken();
-        const newAuthToken2 = newToken?.authToken;
-        if (newAuthToken2 && newAuthToken2 !== sessionToken) {
-          const oldPendingRescopes = sessionRescopes.get(sessionToken);
-          if (oldPendingRescopes) {
-            const existingRescopes = sessionRescopes.get(newAuthToken2);
-            if (existingRescopes) {
-              for (const [key, value] of oldPendingRescopes.entries()) {
-                if (!existingRescopes.has(key)) {
-                  existingRescopes.set(key, value);
-                }
+      const newScope = newScopeProjectId ? {
+        project: {
+          id: newScopeProjectId
+        }
+      } : newScopeDomainId ? {
+        domain: {
+          id: newScopeDomainId
+        }
+      } : "unscoped";
+      await openstackSession.rescope(newScope);
+      const newToken = openstackSession.getToken();
+      const newAuthToken2 = newToken?.authToken;
+      if (newAuthToken2 && newAuthToken2 !== sessionToken) {
+        const oldPendingRescopes = sessionRescopes.get(sessionToken);
+        if (oldPendingRescopes) {
+          const existingRescopes = sessionRescopes.get(newAuthToken2);
+          if (existingRescopes) {
+            for (const [key, value] of oldPendingRescopes.entries()) {
+              if (!existingRescopes.has(key)) {
+                existingRescopes.set(key, value);
               }
-            } else {
-              sessionRescopes.set(newAuthToken2, oldPendingRescopes);
             }
-            sessionRescopes.delete(sessionToken);
+          } else {
+            sessionRescopes.set(newAuthToken2, oldPendingRescopes);
           }
-        }
-        cachedUserId = void 0;
-        cachedUserInfo = void 0;
-        return newAuthToken2 || null;
-      } catch (err) {
-        console.error("Rescope error:", err);
-        return null;
-      } finally {
-        pendingRescopes.delete(scopeKey);
-        if (pendingRescopes.size === 0) {
           sessionRescopes.delete(sessionToken);
-          const currentToken = openstackSession?.getToken()?.authToken;
-          if (currentToken && currentToken !== sessionToken && sessionRescopes.get(currentToken)?.size === 0) {
-            sessionRescopes.delete(currentToken);
-          }
         }
       }
+      cachedUserId = void 0;
+      cachedUserInfo = void 0;
+      return newAuthToken2 || null;
     })();
+    const cleanupPromise = rescopeTokenPromise.finally(() => {
+      pendingRescopes.delete(scopeKey);
+      if (pendingRescopes.size === 0) {
+        sessionRescopes.delete(sessionToken);
+        const currentToken = openstackSession?.getToken()?.authToken;
+        if (currentToken && currentToken !== sessionToken && sessionRescopes.get(currentToken)?.size === 0) {
+          sessionRescopes.delete(currentToken);
+        }
+      }
+    });
     pendingRescopes.set(scopeKey, rescopeTokenPromise);
+    cleanupPromise.catch(() => {
+    });
     const newAuthToken = await rescopeTokenPromise;
     if (!newAuthToken) {
       return null;
@@ -39683,7 +40061,7 @@ __name(createContext, "createContext");
 // src/server/server.ts
 var import_path2 = __toESM(require("path"));
 var import_node_stream4 = require("stream");
-var import_zod26 = require("zod");
+var import_zod25 = require("zod");
 
 // src/server/aurora-fastify-plugins/csrfProtection.ts
 var import_csrf_protection = __toESM(require("@fastify/csrf-protection"));
@@ -39793,6 +40171,19 @@ async function createServer(config) {
   }, (_req, payload, done) => {
     done(null, payload);
   });
+  server.register(csrfProtection_default, {
+    tokenRoute: "/csrf-token",
+    cookieKey: "aurora-csrf-protection",
+    tokenHeader: "x-csrf-token",
+    excludePaths: [
+      "/extensions"
+    ],
+    protectionMethods: [
+      "POST",
+      "PUT",
+      "DELETE"
+    ]
+  });
   server.post(`${bffEndpoint}/upload-image-direct`, {
     config: {
       rawBody: false
@@ -39859,19 +40250,6 @@ async function createServer(config) {
       });
     }
   });
-  server.register(csrfProtection_default, {
-    tokenRoute: "/csrf-token",
-    cookieKey: "aurora-csrf-protection",
-    tokenHeader: "x-csrf-token",
-    excludePaths: [
-      "/extensions"
-    ],
-    protectionMethods: [
-      "POST",
-      "PUT",
-      "DELETE"
-    ]
-  });
   server.addHook("onRequest", (request, _reply, done) => {
     if (request.url.includes("/compute.uploadImage")) {
       request.raw.setTimeout(0);
@@ -39884,7 +40262,7 @@ async function createServer(config) {
       router: appRouter,
       createContext: /* @__PURE__ */ __name((opts) => createContext(opts, contextConfig), "createContext"),
       onError: /* @__PURE__ */ __name((err) => {
-        if (err.error.cause instanceof import_zod26.ZodError) err.error.message = err.error.cause.issues.map((e) => e.message).join(",");
+        if (err.error.cause instanceof import_zod25.ZodError) err.error.message = err.error.cause.issues.map((e) => e.message).join(",");
       }, "onError")
     }
   });
@@ -39949,10 +40327,12 @@ __name(createServer, "createServer");
   createServer,
   domainScopedInputSchema,
   domainScopedProcedure,
+  parseOrThrow,
   projectScopedInputSchema,
   projectScopedProcedure,
   protectedProcedure,
-  publicProcedure
+  publicProcedure,
+  validateOpenstackService
 });
 /*! Bundled license information: