@cobaltcore-dev/aurora 1.3.0 → 2.1.0

package/dist/server/index.js

@@ -7,7 +7,11 @@ var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -27306,7 +27310,7 @@ var require_pathHelpers = __commonJS({
     });
     exports2.encodeOpenstackPathSegment = encodeOpenstackPathSegment2;
     exports2.encodeOpenstackPath = encodeOpenstackPath;
-    exports2.validateAndEncodeResourceId = validateAndEncodeResourceId6;
+    exports2.validateAndEncodeResourceId = validateAndEncodeResourceId8;
     var error_1 = require_error();
     function encodeOpenstackPathSegment2(segment, label = "Path segment") {
       if (!segment || typeof segment !== "string") {
@@ -27328,10 +27332,10 @@ var require_pathHelpers = __commonJS({
       return segments.map((seg, idx) => encodeOpenstackPathSegment2(seg, `Path segment ${idx}`)).join("/");
     }
     __name(encodeOpenstackPath, "encodeOpenstackPath");
-    function validateAndEncodeResourceId6(id, resourceType = "Resource") {
+    function validateAndEncodeResourceId8(id, resourceType = "Resource") {
       return encodeOpenstackPathSegment2(id, `${resourceType} ID`);
     }
-    __name(validateAndEncodeResourceId6, "validateAndEncodeResourceId");
+    __name(validateAndEncodeResourceId8, "validateAndEncodeResourceId");
   }
 });
 
@@ -28654,6 +28658,22 @@ var openstackErrorMiddleware = t.middleware(async ({ next }) => {
   }
   return result;
 });
+function mapScopeError(error, ctx, opts) {
+  if (error instanceof import_signal_openstack.SignalOpenstackApiError && error.statusCode === 401) {
+    if (ctx.validateSession() === true) {
+      return new import_server.TRPCError({
+        code: "NOT_FOUND",
+        message: opts.notFoundMessage
+      });
+    }
+    return new import_server.TRPCError({
+      code: "UNAUTHORIZED",
+      message: "Your session is no longer valid. Please sign in again."
+    });
+  }
+  return error;
+}
+__name(mapScopeError, "mapScopeError");
 var router = t.router;
 var auroraRouter = t.router;
 var mergeRouters = t.mergeRouters;
@@ -28679,13 +28699,26 @@ var domainScopedInputSchema = import_zod.z.object({
 var projectScopedProcedure = protectedProcedure.input(projectScopedInputSchema).use(/* @__PURE__ */ __name(async function rescopeToProject(opts) {
   const { ctx, next, input } = opts;
   const { project_id } = input;
-  const openstackSession = await ctx.rescopeSession({
-    projectId: project_id
-  });
+  let openstackSession;
+  try {
+    openstackSession = await ctx.rescopeSession({
+      projectId: project_id
+    });
+  } catch (error) {
+    throw mapScopeError(error, ctx, {
+      notFoundMessage: "Project not found or not accessible with your current session."
+    });
+  }
   if (!openstackSession) {
+    if (ctx.validateSession() === false) {
+      throw new import_server.TRPCError({
+        code: "UNAUTHORIZED",
+        message: "Your session is no longer valid. Please log in again."
+      });
+    }
     throw new import_server.TRPCError({
-      code: "UNAUTHORIZED",
-      message: "Failed to scope session to project. User may not have access to this project."
+      code: "NOT_FOUND",
+      message: "Project not found or not accessible with your current session."
     });
   }
   return next({
@@ -28713,13 +28746,26 @@ var domainScopedProcedure = protectedProcedure.input(domainScopedInputSchema).us
       message: `Access denied. User does not have access to domain ${domain_id}`
     });
   }
-  const openstackSession = await ctx.rescopeSession({
-    domainId: domain_id
-  });
+  let openstackSession;
+  try {
+    openstackSession = await ctx.rescopeSession({
+      domainId: domain_id
+    });
+  } catch (error) {
+    throw mapScopeError(error, ctx, {
+      notFoundMessage: "Domain not found or not accessible with your current session."
+    });
+  }
   if (!openstackSession) {
+    if (ctx.validateSession() === false) {
+      throw new import_server.TRPCError({
+        code: "UNAUTHORIZED",
+        message: "Your session is no longer valid. Please log in again."
+      });
+    }
     throw new import_server.TRPCError({
-      code: "UNAUTHORIZED",
-      message: "Failed to scope session to domain. Please try again or contact support."
+      code: "NOT_FOUND",
+      message: "Domain not found or not accessible with your current session."
     });
   }
   return next({
@@ -28781,9 +28827,16 @@ var sessionRouter = {
   setCurrentScope: protectedProcedure.input(discriminatedSchema).mutation(async ({ input, ctx }) => {
     switch (input.type) {
       case "domain": {
-        const session = await ctx.rescopeSession({
-          domainId: input.domainId
-        });
+        let session;
+        try {
+          session = await ctx.rescopeSession({
+            domainId: input.domainId
+          });
+        } catch (error) {
+          throw mapScopeError(error, ctx, {
+            notFoundMessage: "This domain doesn't exist or is not accessible with your current session. Select an available domain."
+          });
+        }
         const token = session?.getToken();
         if (!token?.tokenData.domain) {
           throw new import_server2.TRPCError({
@@ -28797,9 +28850,16 @@ var sessionRouter = {
         };
       }
       case "project": {
-        const session = await ctx.rescopeSession({
-          projectId: input.projectId
-        });
+        let session;
+        try {
+          session = await ctx.rescopeSession({
+            projectId: input.projectId
+          });
+        } catch (error) {
+          throw mapScopeError(error, ctx, {
+            notFoundMessage: "This project doesn't exist or is not accessible from your current domain. Please select a project from your current domain."
+          });
+        }
         const token = session?.getToken();
         if (!token?.tokenData.project) {
           throw new import_server2.TRPCError({
@@ -29033,7 +29093,13 @@ function filterBySearchParams(items, searchTerm, searchFields) {
   const searchLower = searchTerm.toLowerCase().trim();
   return items.filter((item) => searchFields.some((field) => {
     const value = item[field];
-    return typeof value === "string" && value.toLowerCase().includes(searchLower);
+    if (typeof value === "string") {
+      return value.toLowerCase().includes(searchLower);
+    }
+    if (typeof value === "number") {
+      return value.toString().includes(searchLower);
+    }
+    return false;
   }));
 }
 __name(filterBySearchParams, "filterBySearchParams");
@@ -29986,7 +30052,10 @@ var imageRouter = {
       let filteredImages = allImages;
       if (hasSearchTerm) {
         filteredImages = filterBySearchParams(filteredImages, queryInput.name, [
-          "name"
+          "id",
+          "name",
+          "owner",
+          "size"
         ]);
       }
       if (queryInput.visibility && queryInput.visibility !== "all") {
@@ -30066,7 +30135,10 @@ var imageRouter = {
       let filteredImages = allImages;
       if (queryInput.name && queryInput.name.trim()) {
         filteredImages = filterBySearchParams(filteredImages, queryInput.name, [
-          "name"
+          "id",
+          "name",
+          "owner",
+          "size"
         ]);
       }
       if (queryInput.visibility && queryInput.visibility !== "all") {
@@ -30605,6 +30677,7 @@ var imageRouter = {
       });
       if (name) {
         filteredImages = filterBySearchParams(filteredImages, name, [
+          "id",
           "name"
         ]);
       }
@@ -31168,9 +31241,18 @@ function includesSearchTerm(flavor, searchTerm) {
   const searchableValues = [
     flavor.id,
     flavor.name,
-    flavor.description
+    flavor.description,
+    flavor.vcpus,
+    flavor.ram,
+    flavor.disk,
+    flavor.swap
   ];
-  return searchableValues.some((value) => value != null && typeof value === "string" && regex.test(value));
+  return searchableValues.some((value) => {
+    if (value == null) return false;
+    if (typeof value === "string") return regex.test(value);
+    if (typeof value === "number") return regex.test(value.toString());
+    return false;
+  });
 }
 __name(includesSearchTerm, "includesSearchTerm");
 function filterAndSortFlavors(flavors, searchTerm, sortBy, sortDirection) {
@@ -31191,6 +31273,26 @@ function filterAndSortFlavors(flavors, searchTerm, sortBy, sortDirection) {
   return result;
 }
 __name(filterAndSortFlavors, "filterAndSortFlavors");
+function supportsDescriptionField(microversion) {
+  const [major, minor] = microversion.split(".").map(Number);
+  return major > 2 || major === 2 && minor >= 55;
+}
+__name(supportsDescriptionField, "supportsDescriptionField");
+async function getMaxMicroversion(compute) {
+  try {
+    const response = await compute.get("");
+    const data = await response.json();
+    if (data.version) {
+      return data.version.version || "2.1";
+    } else if (data.versions) {
+      const currentVersion = data.versions.find((v) => v.status === "CURRENT");
+      return currentVersion?.version || "2.1";
+    }
+  } catch {
+  }
+  return "2.1";
+}
+__name(getMaxMicroversion, "getMaxMicroversion");
 async function getFlavorById(compute, flavorId) {
   if (!flavorId || flavorId.trim() === "") {
     throw new import_server7.TRPCError({
@@ -31213,7 +31315,13 @@ async function getFlavorById(compute, flavorId) {
   }
   let response;
   try {
-    response = await compute.get(`flavors/${encodedId}`);
+    const maxVersion = await getMaxMicroversion(compute);
+    const options = supportsDescriptionField(maxVersion) ? {
+      headers: {
+        "OpenStack-API-Version": `compute ${maxVersion}`
+      }
+    } : void 0;
+    response = await compute.get(`flavors/${encodedId}`, options);
   } catch (error) {
     if (error instanceof import_server7.TRPCError) throw error;
     const statusCode = getStatusCodeFromError(error);
@@ -31245,11 +31353,20 @@ __name(getFlavorById, "getFlavorById");
 async function fetchFlavors(compute, isPublic) {
   let response;
   try {
-    response = await compute.get("flavors/detail", {
+    const maxVersion = await getMaxMicroversion(compute);
+    const options = supportsDescriptionField(maxVersion) ? {
       queryParams: {
         is_public: isPublic
+      },
+      headers: {
+        "OpenStack-API-Version": `compute ${maxVersion}`
       }
-    });
+    } : {
+      queryParams: {
+        is_public: isPublic
+      }
+    };
+    response = await compute.get("flavors/detail", options);
   } catch (error) {
     if (error instanceof import_server7.TRPCError) throw error;
     const statusCode = getStatusCodeFromError(error);
@@ -31278,16 +31395,32 @@ async function fetchFlavors(compute, isPublic) {
   }
 }
 __name(fetchFlavors, "fetchFlavors");
-async function createFlavor(compute, flavorData) {
+async function createFlavor(compute, flavorData, microversion) {
   const requestBody = {
     flavor: flavorData
   };
+  const headers = {};
+  if (microversion && flavorData.description && supportsDescriptionField(microversion)) {
+    headers["OpenStack-API-Version"] = `compute ${microversion}`;
+  }
   let response;
   try {
-    response = await compute.post("flavors", requestBody);
+    response = await compute.post("flavors", requestBody, Object.keys(headers).length ? {
+      headers
+    } : void 0);
   } catch (error) {
     if (error instanceof import_server7.TRPCError) throw error;
     const statusCode = getStatusCodeFromError(error);
+    if (statusCode === 400) {
+      const errorMessage = error instanceof Error ? error.message : "Unknown error";
+      if (errorMessage.includes("description")) {
+        throw new import_server7.TRPCError({
+          code: "BAD_REQUEST",
+          message: errorMessage,
+          cause: error
+        });
+      }
+    }
     handleHttpError(statusCode, CREATE_FLAVOR_STATUS_MAP, ERROR_CODES.CREATE_FLAVOR_FAILED);
   }
   if (!response.ok) {
@@ -31298,7 +31431,6 @@ async function createFlavor(compute, flavorData) {
     const jsonData = JSON.parse(rawData);
     return jsonData.flavor;
   } catch (error) {
-    console.error("Error parsing flavor response:", error);
     throw new import_server7.TRPCError({
       code: "INTERNAL_SERVER_ERROR",
       message: ERROR_CODES.CREATE_FLAVOR_FAILED,
@@ -31579,6 +31711,38 @@ __name(removeTenantAccess, "removeTenantAccess");
 var import_server8 = require("@trpc/server");
 var import_signal_openstack3 = __toESM(require_esm());
 var flavorRouter = {
+  getComputeApiVersion: projectScopedProcedure.input(import_zod9.z.object({
+    project_id: import_zod9.z.string()
+  })).query(async ({ ctx }) => {
+    try {
+      const compute = ctx.openstack?.service("compute");
+      if (!compute) {
+        throw new import_server8.TRPCError({
+          code: "INTERNAL_SERVER_ERROR",
+          message: ERROR_CODES.COMPUTE_SERVICE_UNAVAILABLE
+        });
+      }
+      const response = await compute.get("");
+      const data = await response.json();
+      let versionString = "2.1";
+      if (data.version) {
+        versionString = data.version.version || "2.1";
+      } else if (data.versions) {
+        const currentVersion = data.versions.find((v) => v.status === "CURRENT");
+        versionString = currentVersion?.version || "2.1";
+      }
+      return {
+        version: versionString,
+        supportsDescription: supportsDescriptionField(versionString)
+      };
+    } catch (error) {
+      console.error("Failed to detect Nova version:", error);
+      return {
+        version: "2.1",
+        supportsDescription: false
+      };
+    }
+  }),
   getFlavorById: projectScopedProcedure.input(import_zod9.z.object({
     project_id: import_zod9.z.string(),
     flavorId: import_zod9.z.string()
@@ -31666,7 +31830,8 @@ var flavorRouter = {
       swap: import_zod9.z.number().optional(),
       rxtx_factor: import_zod9.z.number().optional(),
       "OS-FLV-EXT-DATA:ephemeral": import_zod9.z.number().optional(),
-      "os-flavor-access:is_public": import_zod9.z.boolean().optional()
+      "os-flavor-access:is_public": import_zod9.z.boolean().optional(),
+      description: import_zod9.z.string().optional()
     })
   })).mutation(async ({ input, ctx }) => {
     try {
@@ -31678,11 +31843,35 @@ var flavorRouter = {
           message: ERROR_CODES.COMPUTE_SERVICE_UNAVAILABLE
         });
       }
+      let supportsDescription = false;
+      let detectedVersion = "2.1";
+      try {
+        const versionResponse = await compute.get("");
+        const versionData = await versionResponse.json();
+        let versionString = "2.1";
+        if (versionData.version) {
+          versionString = versionData.version.version || "2.1";
+        } else if (versionData.versions) {
+          const currentVersion = versionData.versions.find((v) => v.status === "CURRENT");
+          versionString = currentVersion?.version || "2.1";
+        }
+        detectedVersion = versionString;
+        supportsDescription = supportsDescriptionField(versionString);
+      } catch {
+        supportsDescription = false;
+      }
+      const flavorToSend = supportsDescription ? flavor : {
+        ...flavor
+      };
+      if (!supportsDescription) {
+        const { description, ...rest } = flavorToSend;
+        Object.assign(flavorToSend, rest);
+      }
       const flavorData = {
-        ...flavor,
+        ...flavorToSend,
         "OS-FLV-EXT-DATA:ephemeral": flavor["OS-FLV-EXT-DATA:ephemeral"] || 0
       };
-      const result = await createFlavor(compute, flavorData);
+      const result = await createFlavor(compute, flavorData, supportsDescription ? detectedVersion : void 0);
       return result;
     } catch (error) {
       if (error instanceof import_server8.TRPCError) {
@@ -32490,7 +32679,7 @@ function buildObjectMetadataHeaders(options) {
 }
 __name(buildObjectMetadataHeaders, "buildObjectMetadataHeaders");
 function mapErrorResponseToTRPCError2(error, context) {
-  const { operation, container, object, additionalInfo } = context;
+  const { operation, container, object, additionalInfo, preconditionFailedMeansAlreadyExists } = context;
   const baseMessage = `Failed to ${operation}`;
   const containerInfo = container ? ` container: ${container}` : "";
   const objectInfo = object ? `, object: ${object}` : "";
@@ -32521,6 +32710,14 @@ function mapErrorResponseToTRPCError2(error, context) {
         code: "CONFLICT",
         message: `Conflict - ${operation}${containerInfo}${objectInfo}${extraInfo}`
       });
+    case 412:
+      return preconditionFailedMeansAlreadyExists ? new import_server10.TRPCError({
+        code: "CONFLICT",
+        message: `Conflict - ${operation}${containerInfo}${objectInfo} - already exists${extraInfo}`
+      }) : new import_server10.TRPCError({
+        code: "PRECONDITION_FAILED",
+        message: `Precondition failed - ${operation}${containerInfo}${objectInfo}${extraInfo}`
+      });
     case 413:
       return new import_server10.TRPCError({
         code: "PAYLOAD_TOO_LARGE",
@@ -32814,6 +33011,11 @@ var createContainerInputSchema = baseContainerInputSchema.extend({
   tempUrlKey: import_zod11.z.string().optional(),
   tempUrlKey2: import_zod11.z.string().optional()
 });
+var createContainerResultSchema = import_zod11.z.object({
+  created: import_zod11.z.literal(true),
+  optionsApplied: import_zod11.z.boolean(),
+  optionsError: import_zod11.z.string().optional()
+});
 var updateContainerMetadataInputSchema = baseContainerInputSchema.extend({
   metadata: import_zod11.z.record(import_zod11.z.string(), import_zod11.z.string()).optional(),
   removeMetadata: import_zod11.z.array(import_zod11.z.string()).optional(),
@@ -33151,21 +33353,54 @@ var swiftRouter = {
   createContainer: projectScopedProcedure.input(projectScopedInputSchema.extend(createContainerInputSchema.shape)).mutation(async ({ input, ctx }) => {
     return withErrorHandling2(async () => {
       const { account, container, ...options } = input;
+      const { storagePolicy, ...applyOptions } = options;
       const openstackSession = ctx.openstack;
       const swift = openstackSession?.service("swift");
       validateSwiftService(swift);
-      const headers = buildContainerMetadataHeaders(options);
       const accountPath = account || "";
       const url = accountPath ? `${accountPath}/${encodeURIComponent(container)}` : encodeURIComponent(container);
-      await swift.put(url, void 0, {
-        headers
+      const probeHeaders = buildContainerMetadataHeaders({
+        storagePolicy
+      });
+      const response = await swift.put(url, void 0, {
+        headers: probeHeaders
       }).catch((error) => {
         throw mapErrorResponseToTRPCError2(error, {
           operation: "create container",
           container
         });
       });
-      return true;
+      if (response.status === 202) {
+        throw new import_server11.TRPCError({
+          code: "CONFLICT",
+          message: `Conflict - create container - container already exists: ${container}`
+        });
+      }
+      const optionHeaders = buildContainerMetadataHeaders(applyOptions);
+      if (Object.keys(optionHeaders).length === 0) {
+        return {
+          created: true,
+          optionsApplied: true
+        };
+      }
+      let optionsError;
+      await swift.post(url, void 0, {
+        headers: optionHeaders
+      }).catch((error) => {
+        optionsError = mapErrorResponseToTRPCError2(error, {
+          operation: "apply container settings",
+          container,
+          additionalInfo: "container was created but its metadata/ACL/quota could not be applied"
+        }).message;
+      });
+      return optionsError === void 0 ? {
+        created: true,
+        optionsApplied: true
+      } : {
+        created: true,
+        optionsApplied: false,
+        optionsError
+      };
     }, "create container");
   }),
   /**
@@ -33591,7 +33826,8 @@ var swiftRouter = {
       const normalizedPath = normalizeFolderPath(folderPath);
       const headers = {
         "Content-Type": "application/directory",
-        "Content-Length": "0"
+        "Content-Length": "0",
+        "If-None-Match": "*"
       };
       if (metadata) {
         Object.entries(metadata).forEach(([key, value]) => {
@@ -33600,14 +33836,14 @@ var swiftRouter = {
       }
       const accountPath = account || "";
       const url = accountPath ? `${accountPath}/${encodeURIComponent(container)}/${encodeURIComponent(normalizedPath)}` : `${encodeURIComponent(container)}/${encodeURIComponent(normalizedPath)}`;
-      await swift.put(url, {
-        headers,
-        body: new ArrayBuffer(0)
+      await swift.put(url, new ArrayBuffer(0), {
+        headers
       }).catch((error) => {
         throw mapErrorResponseToTRPCError2(error, {
           operation: "create folder",
           container,
-          object: normalizedPath
+          object: normalizedPath,
+          preconditionFailedMeansAlreadyExists: true
         });
       });
       return true;
@@ -34368,6 +34604,16 @@ __name(resolveEC2Credential, "resolveEC2Credential");
 
 // src/server/Storage/clients/s3Client.ts
 var import_client_s3 = require("@aws-sdk/client-s3");
+
+// src/server/Storage/constants.ts
+var S3_MAX_KEYS_PER_REQUEST = 1e3;
+var S3_PRESIGN_MAX_EXPIRY_SECONDS = 604800;
+var S3_MAX_SCAN_PAGES = 20;
+var S3_CONNECTION_TIMEOUT_MS = 5e3;
+var S3_MAX_BUFFERED_VERSIONS_PER_KEY = 2e4;
+var MAX_REPORTED_DELETE_ERRORS = 100;
+
+// src/server/Storage/clients/s3Client.ts
 function createS3Client(access, secret, endpoint, region = "default") {
   if (!access?.trim()) {
     throw new Error("S3 access key is required");
@@ -34385,7 +34631,10 @@ function createS3Client(access, secret, endpoint, region = "default") {
       accessKeyId: access,
       secretAccessKey: secret
     },
-    forcePathStyle: true
+    forcePathStyle: true,
+    requestHandler: {
+      connectionTimeout: S3_CONNECTION_TIMEOUT_MS
+    }
   });
 }
 __name(createS3Client, "createS3Client");
@@ -34496,6 +34745,8 @@ var cephUploadProcedure = protectedProcedure.use(/* @__PURE__ */ __name(async fu
 var import_server13 = require("@trpc/server");
 var import_signal_openstack4 = __toESM(require_esm());
 var S3_ERROR_MAP = {
+  NotFound: "NOT_FOUND",
+  Forbidden: "FORBIDDEN",
   NoSuchBucket: "NOT_FOUND",
   NoSuchKey: "NOT_FOUND",
   NoSuchUpload: "NOT_FOUND",
@@ -34506,6 +34757,7 @@ var S3_ERROR_MAP = {
   BucketAlreadyExists: "CONFLICT",
   BucketAlreadyOwnedByYou: "CONFLICT",
   BucketNotEmpty: "PRECONDITION_FAILED",
+  PreconditionFailed: "CONFLICT",
   InvalidBucketState: "BAD_REQUEST",
   VersioningNotEnabled: "PRECONDITION_FAILED",
   AccessDenied: "FORBIDDEN",
@@ -34530,7 +34782,7 @@ function mapS3ErrorToTRPCError(error, context) {
   }
   const s3Error = error;
   const errorCode = s3Error.Code ?? s3Error.name ?? "";
-  const trpcCode = S3_ERROR_MAP[errorCode] ?? "INTERNAL_SERVER_ERROR";
+  const trpcCode = errorCode === "PreconditionFailed" && !context.preconditionFailedMeansAlreadyExists ? "PRECONDITION_FAILED" : S3_ERROR_MAP[errorCode] ?? "INTERNAL_SERVER_ERROR";
   if (!S3_ERROR_MAP[errorCode] && errorCode) {
     import_signal_openstack4.logger.warn("Unmapped S3 error code", {
       errorCode,
@@ -34549,6 +34801,8 @@ function mapS3ErrorToTRPCError(error, context) {
     parts.push("Invalid access key \u2014 your credentials may be expired or incorrect");
   } else if (errorCode === "BucketNotEmpty") {
     parts.push("The bucket is not empty. Some objects or versions may still exist. Use 'Empty Bucket' first to delete all contents.");
+  } else if (errorCode === "PreconditionFailed") {
+    parts.push(context.preconditionFailedMeansAlreadyExists ? "The object already exists" : "Precondition failed");
   } else if (s3Error.message) {
     parts.push(s3Error.message);
   }
@@ -34565,12 +34819,6 @@ __name(mapS3ErrorToTRPCError, "mapS3ErrorToTRPCError");
 
 // src/server/Storage/types/ceph.ts
 var import_zod13 = require("zod");
-
-// src/server/Storage/constants.ts
-var S3_MAX_KEYS_PER_REQUEST = 1e3;
-var S3_PRESIGN_MAX_EXPIRY_SECONDS = 604800;
-
-// src/server/Storage/types/ceph.ts
 var ec2CredentialSchema = import_zod13.z.object({
   id: import_zod13.z.string(),
   access: import_zod13.z.string(),
@@ -34606,6 +34854,59 @@ var createBucketOutputSchema = import_zod13.z.object({
 var deleteBucketInputSchema = projectScopedInputSchema.extend({
   bucketName: import_zod13.z.string().min(1)
 });
+var headBucketInputSchema = projectScopedInputSchema.extend({
+  bucketName: existingBucketNameSchema
+});
+var bucketStateInputSchema = projectScopedInputSchema.extend({
+  bucketName: existingBucketNameSchema
+});
+var bucketStateOutputSchema = import_zod13.z.object({
+  /**
+  * Raw versioning status, straight from `GetBucketVersioning` — the same value
+  * `versioning.getStatus` reports.
+  *
+  * Exposed here so a caller that needs to tell "Suspended" from "Unversioned" (the bucket
+  * header renders a different badge for each) does not have to issue a second
+  * `GetBucketVersioning` alongside this one. `isVersioningEnabled` below is the collapsed
+  * form most callers actually want.
+  */
+  status: import_zod13.z.enum([
+    "Enabled",
+    "Suspended",
+    "Unversioned"
+  ]),
+  isVersioningEnabled: import_zod13.z.boolean(),
+  /**
+  * No current (non-delete-marker) objects. Always exact, never affected by `isPartialScan`:
+  * it comes from a dedicated one-key `ListObjectsV2`, which by definition lists only current
+  * objects and omits delete markers, so "no keys returned" *is* emptiness.
+  *
+  * Deliberately a boolean, not a count - no caller ever needed more than the yes/no, and a
+  * one-key probe has no count to give.
+  */
+  isEmpty: import_zod13.z.boolean(),
+  /**
+  * Every key in the bucket is hidden behind a delete marker: versioning is on, the scan saw
+  * entries, and none of them was a real (non-delete-marker) version.
+  *
+  * Forced to `false` under `isPartialScan`, because a truncated scan that happened to see only
+  * delete markers cannot tell "no real versions exist" from "no real versions yet".
+  */
+  hasOnlyDeleteMarkers: import_zod13.z.boolean(),
+  /** At least one non-current version or delete marker exists. Reliable when true. */
+  hasOldVersionsOrDeleteMarkers: import_zod13.z.boolean(),
+  /**
+  * True when the version-history scan stopped before it could rule the history flags in either
+  * direction: it hit the page ceiling, the request was aborted, or S3 returned a truncated
+  * page carrying no continuation marker to follow.
+  *
+  * It says nothing about `isEmpty` or `isVersioningEnabled`, which are established by their own
+  * single requests. Of the two flags it does cover, `hasOldVersionsOrDeleteMarkers: true`
+  * remains reliable - finding one such entry is proof - while `false` means "none found so
+  * far", and `hasOnlyDeleteMarkers` is forced to `false` outright.
+  */
+  isPartialScan: import_zod13.z.boolean()
+});
 var s3StatusSchema = import_zod13.z.object({
   hasCredentials: import_zod13.z.boolean()
 });
@@ -34673,6 +34974,9 @@ var deleteVersionsBulkInputSchema = projectScopedInputSchema.extend({
     versionId: import_zod13.z.string().min(1)
   })).min(1).max(1e4)
 });
+var deleteNonCurrentVersionsInputSchema = projectScopedInputSchema.extend({
+  containerName: existingBucketNameSchema
+});
 var deletedObjectSchema = import_zod13.z.object({
   key: import_zod13.z.string(),
   versionId: import_zod13.z.string().optional(),
@@ -34691,6 +34995,22 @@ var deleteObjectsBulkOutputSchema = import_zod13.z.object({
   deletedCount: import_zod13.z.number().int().nonnegative(),
   errorCount: import_zod13.z.number().int().nonnegative()
 });
+var deleteNonCurrentVersionsOutputSchema = import_zod13.z.object({
+  errors: import_zod13.z.array(deleteObjectErrorSchema),
+  deletedCount: import_zod13.z.number().int().nonnegative(),
+  errorCount: import_zod13.z.number().int().nonnegative(),
+  /**
+  * The run did not cover the whole bucket, so non-current versions may survive.
+  * Set when the request was aborted (including during the last page's deletes),
+  * when S3 returned a truncated page without a continuation marker, and when a
+  * key had to be skipped (NoCurrentVersion, MissingVersionId, TooManyVersions) -
+  * the last of which also records an entry in `errors`, so a caller must treat
+  * this flag and `errorCount` as independent rather than as alternatives.
+  * The counts remain accurate for what was actually deleted - this flag only
+  * denies that the wipe was exhaustive, which a bare success count would imply.
+  */
+  isPartial: import_zod13.z.boolean()
+});
 var createFolderInputSchema2 = projectScopedInputSchema.extend({
   containerName: import_zod13.z.string().min(1),
   folderPath: import_zod13.z.string().min(1)
@@ -34809,19 +35129,6 @@ var bucketPolicyStatementSchema = import_zod13.z.object({
         message: "Principal object must contain at least one of: AWS, Service, or Federated"
       });
     }
-    if (typeof val === "object" && val.AWS) {
-      const arns = Array.isArray(val.AWS) ? val.AWS : [
-        val.AWS
-      ];
-      for (const arn of arns) {
-        if (arn !== "*" && !/^arn:aws:iam::\d{12}:(?:root|user\/.+|role\/.+)$/.test(arn)) {
-          ctx.addIssue({
-            code: "custom",
-            message: `Invalid AWS principal ARN format: ${arn}. Expected arn:aws:iam::ACCOUNT-ID:root or arn:aws:iam::ACCOUNT-ID:(user|role)/NAME`
-          });
-        }
-      }
-    }
   }),
   NotPrincipal: import_zod13.z.union([
     import_zod13.z.string(),
@@ -35218,6 +35525,193 @@ var containerRouter = {
     }
   }),
   /**
+  * Existence probe for a single bucket — one HeadBucket request, no body.
+  *
+  * Exists for route guards that must answer "is there such a bucket?" before rendering a
+  * bucket page. `list` would answer it too, but ListBuckets only returns buckets the
+  * caller *owns*: a bucket reachable through a policy would read as missing. HeadBucket
+  * asks about the bucket itself, so 404 means 404 and 403 means 403.
+  *
+  * @throws TRPCError NOT_FOUND - bucket does not exist (SDK error name `NotFound`)
+  * @throws TRPCError FORBIDDEN - no credentials, or the bucket exists but is not readable
+  */
+  head: cephProtectedProcedure.input(headBucketInputSchema).query(async ({ ctx, input }) => {
+    const s3 = ctx.getCephClient();
+    const { bucketName } = input;
+    try {
+      await s3.send(new import_client_s32.HeadBucketCommand({
+        Bucket: bucketName
+      }));
+      return {
+        exists: true
+      };
+    } catch (error) {
+      throw mapS3ErrorToTRPCError(error, {
+        operation: "head bucket",
+        bucket: bucketName
+      });
+    }
+  }),
+  /**
+  * Authoritative bucket emptiness/version state.
+  *
+  * Replaces three separate client-side probes (`useBucketInfo`, `DeleteBucketModal`,
+  * `EmptyBucketModal`) that each read only the first page of `objects.list` and derived
+  * `isBucketEmpty`/`hasOldVersionsOrDeleteMarkers` from it — silently wrong for buckets whose
+  * first 100 (or 1000) entries don't tell the whole story.
+  *
+  * Cost, honestly:
+  *  - unversioned bucket: **exactly two** requests, whatever its size. Without a version
+  *    history there is nothing to scan, so both history flags are false by definition.
+  *  - versioned bucket with both an old version (or delete marker) and a surviving real
+  *    version: **three** — one page settles both history flags and the scan stops.
+  *  - versioned bucket whose history is clean: the scan has nothing to find and no way to know
+  *    that early, so it runs to the end of the bucket or to `S3_MAX_SCAN_PAGES`.
+  *  - versioned bucket holding *only* delete markers, with no surviving non-current version —
+  *    what a `NoncurrentVersionExpiration` lifecycle rule leaves behind once it has expired the
+  *    real versions: same cost as the clean-history shape, and for the same reason. The scan
+  *    sees `hasOldVersionsOrDeleteMarkers` on page one but can only prove `hasOnlyDeleteMarkers`
+  *    by reaching the end, since any later page could still hold a real version.
+  *
+  * The last two are the shapes that cost real round-trips. Both are bounded, and in both the
+  * scan is doing work that has an answer to produce — it is not spinning to re-learn something
+  * already known. Callers that force `staleTime: 0` (the two destructive modals, deliberately)
+  * pay it on every open.
+  *
+  * `isEmpty` is deliberately established by its own one-key `ListObjectsV2` rather than by the
+  * scan: that command lists current objects only, so it answers emptiness exactly, in one
+  * request, on a bucket of any size. That matters beyond speed — emptiness gates "Delete
+  * Bucket", and deriving it from a scan that may be truncated left large buckets permanently
+  * unconfirmable and therefore permanently undeletable, with a "refresh and try again" that
+  * could never succeed.
+  *
+  * Versioning status is read from S3 here, not taken from client input, so the answer can't be
+  * computed against a stale client-cached status. It is also returned raw as `status`, so a
+  * caller needing the three-way value has no reason to issue a second `GetBucketVersioning`
+  * against `versioning.getStatus` alongside this call.
+  *
+  * @throws TRPCError NOT_FOUND - bucket does not exist
+  * @throws TRPCError FORBIDDEN - no credentials or access denied
+  */
+  getState: cephProtectedProcedure.input(bucketStateInputSchema).query(async ({ ctx, input }) => {
+    const s3 = ctx.getCephClient();
+    const { bucketName } = input;
+    let status;
+    let isVersioningEnabled;
+    let isEmpty;
+    try {
+      const [versioningResponse, currentObjectsResponse] = await Promise.all([
+        s3.send(new import_client_s32.GetBucketVersioningCommand({
+          Bucket: bucketName
+        }), {
+          abortSignal: ctx.req.signal
+        }),
+        s3.send(new import_client_s32.ListObjectsV2Command({
+          Bucket: bucketName,
+          MaxKeys: 1
+        }), {
+          abortSignal: ctx.req.signal
+        })
+      ]);
+      status = versioningResponse.Status ?? "Unversioned";
+      isVersioningEnabled = status === "Enabled" || status === "Suspended";
+      isEmpty = (currentObjectsResponse.KeyCount ?? currentObjectsResponse.Contents?.length ?? 0) === 0;
+    } catch (error) {
+      console.error("getState: failed to read bucket versioning status or emptiness", {
+        bucket: bucketName,
+        error
+      });
+      throw mapS3ErrorToTRPCError(error, {
+        operation: "get bucket state",
+        bucket: bucketName
+      });
+    }
+    if (!isVersioningEnabled) {
+      return bucketStateOutputSchema.parse({
+        status,
+        isVersioningEnabled: false,
+        isEmpty,
+        hasOnlyDeleteMarkers: false,
+        hasOldVersionsOrDeleteMarkers: false,
+        isPartialScan: false
+      });
+    }
+    let hasOldVersionOrDeleteMarker = false;
+    let hasRealVersion = false;
+    let anyEntrySeen = false;
+    let keyMarker;
+    let versionIdMarker;
+    let pages = 0;
+    let isPartialScan = false;
+    while (true) {
+      if (ctx.req.signal?.aborted) {
+        isPartialScan = true;
+        break;
+      }
+      let response;
+      try {
+        response = await s3.send(new import_client_s32.ListObjectVersionsCommand({
+          Bucket: bucketName,
+          MaxKeys: S3_MAX_KEYS_PER_REQUEST,
+          KeyMarker: keyMarker,
+          VersionIdMarker: versionIdMarker
+        }), {
+          abortSignal: ctx.req.signal
+        });
+      } catch (error) {
+        if (ctx.req.signal?.aborted) {
+          isPartialScan = true;
+          break;
+        }
+        console.error("getState: version scan failed", {
+          bucket: bucketName,
+          pages,
+          error
+        });
+        throw mapS3ErrorToTRPCError(error, {
+          operation: "get bucket state",
+          bucket: bucketName
+        });
+      }
+      for (const v of response.Versions ?? []) {
+        anyEntrySeen = true;
+        hasRealVersion = true;
+        if (!v.IsLatest) {
+          hasOldVersionOrDeleteMarker = true;
+        }
+      }
+      if ((response.DeleteMarkers?.length ?? 0) > 0) {
+        anyEntrySeen = true;
+        hasOldVersionOrDeleteMarker = true;
+      }
+      pages++;
+      if (hasOldVersionOrDeleteMarker && hasRealVersion) {
+        break;
+      }
+      if (!response.IsTruncated) {
+        break;
+      }
+      if (!response.NextKeyMarker) {
+        isPartialScan = true;
+        break;
+      }
+      if (pages >= S3_MAX_SCAN_PAGES) {
+        isPartialScan = true;
+        break;
+      }
+      keyMarker = response.NextKeyMarker;
+      versionIdMarker = response.NextVersionIdMarker;
+    }
+    return bucketStateOutputSchema.parse({
+      status,
+      isVersioningEnabled,
+      isEmpty,
+      hasOnlyDeleteMarkers: !isPartialScan && anyEntrySeen && !hasRealVersion,
+      hasOldVersionsOrDeleteMarkers: hasOldVersionOrDeleteMarker,
+      isPartialScan
+    });
+  }),
+  /**
   * Create a new S3 bucket.
   *
   * Uses AWS SDK CreateBucketCommand. The AWS SDK automatically adds LocationConstraint
@@ -35866,11 +36360,239 @@ var objectRouter = {
     return bulkDeleteItems(s3, containerName, uniqueVersions, ctx.req.signal, "delete versions");
   }),
   /**
+  * Delete every non-current version and delete marker in a bucket, keeping
+  * each key's current live version intact ("Delete Versions" bucket action).
+  *
+  * Deliberately NOT built on top of `deleteAll` (which the "Empty Bucket"
+  * checkbox also uses): that procedure's full-wipe branch discards
+  * `IsLatest` entirely and re-scans from scratch whenever a page is
+  * exhausted, specifically so it can catch delete markers created by its
+  * own non-versioned-delete branch. Bolting a third "keep the latest"
+  * mode onto that already-intricate loop would risk regressing the other
+  * two. This procedure keeps its own single-pass scan instead.
+  *
+  * ⚠️ IsLatest correctness across pages:
+  * `IsLatest` is computed by S3 at *list time*, not stored permanently. If a
+  * key's versions are split across two list pages and we deleted anything
+  * from that key after page 1 but before fetching page 2, the remaining
+  * version would be re-evaluated as IsLatest=true on page 2 - resurrecting
+  * a version (or worse, a deleted object) that should have stayed removed.
+  * To avoid this, a key's records are only ever acted on once its full
+  * group has been seen: the last key-group on every truncated page is
+  * buffered (`pendingKey`/`pendingItems`) and merged with the next page's
+  * leading group (S3 returns Versions/DeleteMarkers sorted by key, so a
+  * split key's remaining records always appear at the very start of the
+  * next page) before that group is decided on and deleted.
+  *
+  * Per completed key-group: if the current (IsLatest) record is a regular
+  * version, every other record in the group is deleted and the current
+  * version is kept. If the current record is a delete marker, the entire
+  * group - including the marker - is deleted, since a versioned bucket has
+  * no other way to represent "this key was deleted" once its history is
+  * gone; keeping the marker without its superseded versions would leave the
+  * key listed in the "Deleted" tab with nothing left to restore.
+  *
+  * No second pass is needed (unlike `deleteAll`'s full-wipe branch): every
+  * deletion here targets a specific `VersionId`, which never creates a new
+  * delete marker, so nothing new can appear behind the scan as it
+  * progresses. One pass over the bucket is exhaustive.
+  *
+  * @throws TRPCError NOT_FOUND - bucket does not exist
+  * @throws TRPCError FORBIDDEN - no credentials or access denied
+  */
+  deleteNonCurrentVersions: cephProtectedProcedure.input(deleteNonCurrentVersionsInputSchema).mutation(async ({ ctx, input }) => {
+    const s3 = ctx.getCephClient();
+    const { containerName } = input;
+    const errors = [];
+    let deletedCount = 0;
+    let errorCount = 0;
+    let isPartial = false;
+    const recordErrors = /* @__PURE__ */ __name((newErrors) => {
+      errorCount += newErrors.length;
+      for (const error of newErrors) {
+        if (errors.length >= MAX_REPORTED_DELETE_ERRORS) break;
+        errors.push(error);
+      }
+    }, "recordErrors");
+    let keyMarker;
+    let versionIdMarker;
+    let pendingKey;
+    let pendingItems = [];
+    let sameMarkerCount = 0;
+    const MAX_SAME_MARKER = 5;
+    let skipKey;
+    while (true) {
+      if (ctx.req.signal?.aborted) {
+        isPartial = true;
+        break;
+      }
+      let response;
+      try {
+        response = await s3.send(new import_client_s33.ListObjectVersionsCommand({
+          Bucket: containerName,
+          MaxKeys: S3_MAX_KEYS_PER_REQUEST,
+          KeyMarker: keyMarker,
+          VersionIdMarker: versionIdMarker
+        }), {
+          abortSignal: ctx.req.signal
+        });
+      } catch (error) {
+        if (ctx.req.signal?.aborted) {
+          isPartial = true;
+          break;
+        }
+        throw mapS3ErrorToTRPCError(error, {
+          operation: "delete non-current versions",
+          bucket: containerName
+        });
+      }
+      const combined = [
+        ...(response.Versions ?? []).map((v) => ({
+          Key: v.Key ?? "",
+          VersionId: v.VersionId,
+          IsLatest: v.IsLatest ?? false,
+          isDeleteMarker: false
+        })),
+        ...(response.DeleteMarkers ?? []).map((dm) => ({
+          Key: dm.Key ?? "",
+          VersionId: dm.VersionId,
+          IsLatest: dm.IsLatest ?? false,
+          isDeleteMarker: true
+        }))
+      ].sort((a, b) => a.Key < b.Key ? -1 : a.Key > b.Key ? 1 : 0);
+      const pageGroups = [];
+      for (const item of combined) {
+        const last = pageGroups[pageGroups.length - 1];
+        if (last && last.key === item.Key) {
+          last.items.push(item);
+        } else {
+          pageGroups.push({
+            key: item.Key,
+            items: [
+              item
+            ]
+          });
+        }
+      }
+      if (pendingItems.length > 0) {
+        if (pageGroups.length > 0 && pageGroups[0].key === pendingKey) {
+          pageGroups[0].items = [
+            ...pendingItems,
+            ...pageGroups[0].items
+          ];
+        } else {
+          pageGroups.unshift({
+            key: pendingKey,
+            items: pendingItems
+          });
+        }
+        pendingItems = [];
+        pendingKey = void 0;
+      }
+      if (skipKey !== void 0) {
+        const remaining = pageGroups.filter((group) => group.key !== skipKey);
+        if (remaining.length === pageGroups.length) skipKey = void 0;
+        pageGroups.length = 0;
+        pageGroups.push(...remaining);
+      }
+      let groupsToProcess = pageGroups;
+      if (response.IsTruncated && response.NextKeyMarker && pageGroups.length > 0) {
+        const markerIndex = pageGroups.findIndex((group) => group.key === response.NextKeyMarker);
+        const index = markerIndex >= 0 ? markerIndex : pageGroups.length - 1;
+        const deferredGroup = pageGroups[index];
+        groupsToProcess = pageGroups.filter((_, i) => i !== index);
+        if (deferredGroup.items.length > S3_MAX_BUFFERED_VERSIONS_PER_KEY) {
+          console.error(`[deleteNonCurrentVersions] Abandoning key with more than ${S3_MAX_BUFFERED_VERSIONS_PER_KEY} versions in bucket ${containerName}`);
+          recordErrors([
+            {
+              key: deferredGroup.key,
+              code: "TooManyVersions",
+              message: `Key has more than ${S3_MAX_BUFFERED_VERSIONS_PER_KEY} versions and was skipped`
+            }
+          ]);
+          isPartial = true;
+          skipKey = deferredGroup.key;
+        } else {
+          pendingKey = deferredGroup.key;
+          pendingItems = deferredGroup.items;
+        }
+      }
+      const itemsToDelete = [];
+      for (const group of groupsToProcess) {
+        const current = group.items.find((item) => item.IsLatest);
+        if (current === void 0) {
+          console.error(`[deleteNonCurrentVersions] Skipping key with no current version in bucket ${containerName}`);
+          recordErrors([
+            {
+              key: group.key,
+              code: "NoCurrentVersion",
+              message: "No version flagged as current; skipped to avoid deleting the live object"
+            }
+          ]);
+          isPartial = true;
+          continue;
+        }
+        const keepCurrentVersion = !current.isDeleteMarker;
+        for (const item of group.items) {
+          if (keepCurrentVersion && item === current) continue;
+          if (!item.VersionId) {
+            console.error(`[deleteNonCurrentVersions] Skipping item without VersionId in bucket ${containerName}`);
+            recordErrors([
+              {
+                key: item.Key,
+                code: "MissingVersionId",
+                message: "Version record carried no VersionId; skipped to avoid creating a delete marker"
+              }
+            ]);
+            isPartial = true;
+            continue;
+          }
+          itemsToDelete.push({
+            key: item.Key,
+            versionId: item.VersionId
+          });
+        }
+      }
+      if (itemsToDelete.length > 0) {
+        const pageResult = await bulkDeleteItems(s3, containerName, itemsToDelete, ctx.req.signal, "delete non-current versions");
+        deletedCount += pageResult.deletedCount;
+        recordErrors(pageResult.errors);
+      }
+      if (!response.IsTruncated || !response.NextKeyMarker) {
+        if (response.IsTruncated || ctx.req.signal?.aborted) isPartial = true;
+        break;
+      }
+      const currentMarkerKey = `${keyMarker ?? ""}:${versionIdMarker ?? ""}`;
+      const newMarkerKey = `${response.NextKeyMarker ?? ""}:${response.NextVersionIdMarker ?? ""}`;
+      if (currentMarkerKey === newMarkerKey) {
+        sameMarkerCount++;
+        if (sameMarkerCount >= MAX_SAME_MARKER) {
+          throw new import_server14.TRPCError({
+            code: "INTERNAL_SERVER_ERROR",
+            message: `Pagination stalled: markers not advancing after ${MAX_SAME_MARKER} iterations while deleting non-current versions from bucket ${containerName}.`
+          });
+        }
+      } else {
+        sameMarkerCount = 0;
+      }
+      keyMarker = response.NextKeyMarker;
+      versionIdMarker = response.NextVersionIdMarker;
+    }
+    return deleteNonCurrentVersionsOutputSchema.parse({
+      errors,
+      deletedCount,
+      errorCount,
+      isPartial
+    });
+  }),
+  /**
   * Create a folder (zero-byte object with key ending in "/").
   *
   * In S3, folders are virtual - they're just zero-byte objects with keys ending in "/".
-  * This operation is idempotent - creating an existing folder succeeds.
+  * The write is conditional (IfNoneMatch: "*"), so creating a folder that
+  * already exists throws CONFLICT instead of silently overwriting it.
   *
+  * @throws TRPCError CONFLICT - a folder (or object) with this key already exists
   * @throws TRPCError NOT_FOUND - bucket does not exist
   * @throws TRPCError FORBIDDEN - no credentials or access denied
   */
@@ -35883,14 +36605,16 @@ var objectRouter = {
         Bucket: containerName,
         Key: normalizedPath,
         Body: Buffer.from(""),
-        ContentLength: 0
+        ContentLength: 0,
+        IfNoneMatch: "*"
       }));
       return true;
     } catch (error) {
       throw mapS3ErrorToTRPCError(error, {
         operation: "create folder",
         bucket: containerName,
-        key: normalizedPath
+        key: normalizedPath,
+        preconditionFailedMeansAlreadyExists: true
       });
     }
   }),
@@ -36630,7 +37354,6 @@ var ec2CredentialRouter = {
 
 // src/server/Storage/routers/ceph/versioningRouter.ts
 var import_client_s34 = require("@aws-sdk/client-s3");
-var import_zod17 = require("zod");
 
 // src/server/Storage/types/versioning.ts
 var import_zod16 = require("zod");
@@ -36703,6 +37426,72 @@ var listObjectVersionsInputSchema = projectScopedInputSchema.extend({
   bucket: import_zod16.z.string().min(1),
   key: import_zod16.z.string().min(1)
 });
+var checkDeletedContentInputSchema = projectScopedInputSchema.extend({
+  bucket: import_zod16.z.string().min(1),
+  prefix: import_zod16.z.string().optional(),
+  folders: import_zod16.z.array(import_zod16.z.string()).max(1e3).optional()
+}).refine((input) => input.prefix !== void 0 || (input.folders?.length ?? 0) > 0, {
+  message: "Either prefix or a non-empty folders array is required",
+  path: [
+    "prefix"
+  ]
+}).refine((input) => input.folders?.every((folder) => folder.startsWith(input.prefix ?? "")) ?? true, {
+  message: "Every folder must live under prefix",
+  path: [
+    "folders"
+  ]
+});
+var checkDeletedContentOutputSchema = import_zod16.z.array(import_zod16.z.object({
+  prefix: import_zod16.z.string(),
+  hasDeletedContent: import_zod16.z.boolean(),
+  isFolderDeleted: import_zod16.z.boolean(),
+  folderDeleteMarkerVersionId: import_zod16.z.string().optional(),
+  folderMarkerVersionId: import_zod16.z.string().optional(),
+  isPartialScan: import_zod16.z.boolean()
+}));
+
+// src/server/Storage/helpers/versionScan.ts
+function folderPrefixOf(key, prefix) {
+  if (!key.startsWith(prefix)) return void 0;
+  const rest = key.slice(prefix.length);
+  const i = rest.indexOf("/");
+  return i === -1 ? void 0 : prefix + rest.slice(0, i + 1);
+}
+__name(folderPrefixOf, "folderPrefixOf");
+function isFolderCovered(folderPrefix, stoppedAtKey) {
+  return stoppedAtKey === void 0 ? true : folderPrefix < stoppedAtKey && !stoppedAtKey.startsWith(folderPrefix);
+}
+__name(isFolderCovered, "isFolderCovered");
+function longestCommonPrefix(folders) {
+  if (folders.length === 0) return "";
+  let common = folders[0];
+  for (let i = 1; i < folders.length && common.length > 0; i++) {
+    const folder = folders[i];
+    let j = 0;
+    while (j < common.length && j < folder.length && common[j] === folder[j]) j++;
+    common = common.slice(0, j);
+  }
+  if (common.endsWith("/") && folders.some((folder) => folder === common)) {
+    common = common.slice(0, -1);
+  }
+  const lastSlash = common.lastIndexOf("/");
+  return lastSlash === -1 ? "" : common.slice(0, lastSlash + 1);
+}
+__name(longestCommonPrefix, "longestCommonPrefix");
+function greatestKeyOnPage(versions, deleteMarkers) {
+  let greatest;
+  for (const entries of [
+    versions,
+    deleteMarkers
+  ]) {
+    for (const entry of entries ?? []) {
+      const key = entry.Key;
+      if (key !== void 0 && (greatest === void 0 || key > greatest)) greatest = key;
+    }
+  }
+  return greatest;
+}
+__name(greatestKeyOnPage, "greatestKeyOnPage");
 
 // src/server/Storage/routers/ceph/versioningRouter.ts
 var versioningRouter = {
@@ -36948,104 +37737,144 @@ var versioningRouter = {
   /**
   * Check if folders contain deleted files (files with delete markers) or if the folder marker itself is deleted.
   *
-  * For each folder, checks:
-  * 1. If the folder marker itself (key ending in "/") has a delete marker
-  * 2. If any nested objects have delete markers
+  * Performs a single paginated, delimiter-less scan of the parent prefix (either the
+  * caller-supplied `prefix`, or — for backward compatibility — the longest common prefix of
+  * `folders`) and attributes every key it sees to its direct-child folder. This replaces the
+  * previous design of one unbounded scan per folder: the union of what N per-folder scans
+  * would return is exactly what one scan of their common parent returns, minus "loose" objects
+  * that live directly under the parent (which aren't attributed to any folder and are ignored).
   *
-  * Note: This can be expensive for many folders (N S3 requests for N folders).
-  * Use sparingly and consider caching.
+  * Cost: at most `S3_MAX_SCAN_PAGES` requests total, independent of how many folders are being
+  * checked (as opposed to the old N-scans-for-N-folders behaviour).
+  *
+  * Honours `ctx.req.signal`: if the caller navigates away mid-scan, the loop stops and returns
+  * whatever it has accumulated so far, flagged via `isPartialScan`.
+  *
+  * `isPartialScan` (per folder) is `true` when the scan hit the page ceiling (or was aborted)
+  * before fully covering that folder's key range. It is the caller's job to treat it as
+  * "unknown", not as "confirmed empty": `hasDeletedContent: false` together with
+  * `isPartialScan: true` means "not fully checked", not "clean". A `true` value for
+  * `hasDeletedContent` or `isFolderDeleted` is always reliable, partial scan or not — an
+  * incomplete scan can only miss a delete marker, never invent one.
   *
   * @throws TRPCError NOT_FOUND - bucket does not exist
   * @throws TRPCError FORBIDDEN - no credentials or access denied
   */
-  checkDeletedContent: cephProtectedProcedure.input(import_zod17.z.object({
-    project_id: import_zod17.z.string(),
-    bucket: import_zod17.z.string().min(1),
-    folders: import_zod17.z.array(import_zod17.z.string()).max(100)
-  })).query(async ({ ctx, input }) => {
+  checkDeletedContent: cephProtectedProcedure.input(checkDeletedContentInputSchema).query(async ({ ctx, input }) => {
     const s3 = ctx.getCephClient();
-    try {
-      const results = await Promise.all(input.folders.map(async (folderPrefix) => {
-        try {
-          let hasDeletedNestedObjects = false;
-          let isFolderMarkerDeleted = false;
-          let folderDeleteMarkerVersionId;
-          let folderMarkerVersionId;
-          let keyMarker;
-          let versionIdMarker;
-          do {
-            const response = await s3.send(new import_client_s34.ListObjectVersionsCommand({
-              Bucket: input.bucket,
-              Prefix: folderPrefix,
-              MaxKeys: 100,
-              KeyMarker: keyMarker,
-              VersionIdMarker: versionIdMarker
-            }));
-            if (!folderMarkerVersionId && response.Versions) {
-              const folderMarkerVersions = response.Versions.filter((v) => v.Key === folderPrefix);
-              if (folderMarkerVersions.length > 0) {
-                const latestVersion = folderMarkerVersions.sort((a, b) => {
-                  const aTime = a.LastModified?.getTime() ?? 0;
-                  const bTime = b.LastModified?.getTime() ?? 0;
-                  return bTime - aTime;
-                })[0];
-                if (latestVersion) {
-                  folderMarkerVersionId = latestVersion.VersionId;
-                }
-              }
-            }
-            if (!isFolderMarkerDeleted && response.DeleteMarkers) {
-              const folderMarkerDeleteMarkers = response.DeleteMarkers.filter((dm) => dm.Key === folderPrefix);
-              if (folderMarkerDeleteMarkers.length > 0) {
-                const latestFolderMarker = folderMarkerDeleteMarkers.find((dm) => dm.IsLatest);
-                if (latestFolderMarker) {
-                  isFolderMarkerDeleted = true;
-                  folderDeleteMarkerVersionId = latestFolderMarker.VersionId;
-                }
-              }
-            }
-            if (!hasDeletedNestedObjects) {
-              const deleteMarkersExcludingFolder = response.DeleteMarkers?.filter((dm) => dm.Key !== folderPrefix && dm.IsLatest === true) ?? [];
-              hasDeletedNestedObjects = deleteMarkersExcludingFolder.length > 0;
-            }
-            if (hasDeletedNestedObjects && isFolderMarkerDeleted && folderMarkerVersionId) {
-              break;
-            }
-            if (!response.IsTruncated || !response.NextKeyMarker) {
-              break;
-            }
-            keyMarker = response.NextKeyMarker;
-            versionIdMarker = response.NextVersionIdMarker;
-          } while (true);
-          return {
-            prefix: folderPrefix,
-            hasDeletedContent: isFolderMarkerDeleted || hasDeletedNestedObjects,
-            isFolderDeleted: isFolderMarkerDeleted,
-            folderDeleteMarkerVersionId,
-            folderMarkerVersionId
-          };
-        } catch {
-          return {
-            prefix: folderPrefix,
-            hasDeletedContent: false,
-            isFolderDeleted: false
-          };
+    const scanPrefix = input.prefix ?? longestCommonPrefix(input.folders ?? []);
+    const acc = /* @__PURE__ */ new Map();
+    const getOrCreate = /* @__PURE__ */ __name((folder) => {
+      let entry = acc.get(folder);
+      if (!entry) {
+        entry = {
+          hasDeletedNested: false,
+          isFolderDeleted: false
+        };
+        acc.set(folder, entry);
+      }
+      return entry;
+    }, "getOrCreate");
+    let keyMarker;
+    let versionIdMarker;
+    let pages = 0;
+    let stoppedAtKey;
+    while (true) {
+      if (ctx.req.signal?.aborted) {
+        stoppedAtKey = keyMarker ?? "";
+        break;
+      }
+      let response;
+      try {
+        response = await s3.send(new import_client_s34.ListObjectVersionsCommand({
+          Bucket: input.bucket,
+          Prefix: scanPrefix || void 0,
+          MaxKeys: S3_MAX_KEYS_PER_REQUEST,
+          KeyMarker: keyMarker,
+          VersionIdMarker: versionIdMarker
+        }), {
+          abortSignal: ctx.req.signal
+        });
+      } catch (error) {
+        if (ctx.req.signal?.aborted) {
+          stoppedAtKey = keyMarker ?? "";
+          break;
         }
-      }));
-      return results;
-    } catch (error) {
-      throw mapS3ErrorToTRPCError(error, {
-        operation: "check deleted content",
-        bucket: input.bucket
-      });
+        console.error("checkDeletedContent scan failed", {
+          bucket: input.bucket,
+          prefix: scanPrefix,
+          pages,
+          error
+        });
+        throw mapS3ErrorToTRPCError(error, {
+          operation: "check deleted content",
+          bucket: input.bucket
+        });
+      }
+      for (const v of response.Versions ?? []) {
+        const key = v.Key ?? "";
+        const folder = folderPrefixOf(key, scanPrefix);
+        if (!folder) continue;
+        if (key === folder) {
+          const entry = getOrCreate(folder);
+          const lastModified = v.LastModified?.getTime() ?? 0;
+          if (entry.folderMarkerVersionId === void 0 || lastModified > (entry.folderMarkerLastModified ?? -1)) {
+            entry.folderMarkerVersionId = v.VersionId;
+            entry.folderMarkerLastModified = lastModified;
+          }
+        }
+      }
+      for (const dm of response.DeleteMarkers ?? []) {
+        const key = dm.Key ?? "";
+        const folder = folderPrefixOf(key, scanPrefix);
+        if (!folder) continue;
+        const entry = getOrCreate(folder);
+        if (key === folder) {
+          if (dm.IsLatest) {
+            entry.isFolderDeleted = true;
+            entry.folderDeleteMarkerVersionId = dm.VersionId;
+          }
+        } else if (dm.IsLatest === true) {
+          entry.hasDeletedNested = true;
+        }
+      }
+      pages++;
+      if (!response.IsTruncated) {
+        stoppedAtKey = void 0;
+        break;
+      }
+      if (!response.NextKeyMarker) {
+        stoppedAtKey = greatestKeyOnPage(response.Versions, response.DeleteMarkers) ?? keyMarker ?? "";
+        break;
+      }
+      if (pages >= S3_MAX_SCAN_PAGES) {
+        stoppedAtKey = response.NextKeyMarker;
+        break;
+      }
+      keyMarker = response.NextKeyMarker;
+      versionIdMarker = response.NextVersionIdMarker;
     }
+    const folders = input.folders ?? [
+      ...acc.keys()
+    ];
+    return checkDeletedContentOutputSchema.parse(folders.map((prefix) => {
+      const entry = acc.get(prefix);
+      return {
+        prefix,
+        hasDeletedContent: (entry?.isFolderDeleted ?? false) || (entry?.hasDeletedNested ?? false),
+        isFolderDeleted: entry?.isFolderDeleted ?? false,
+        folderDeleteMarkerVersionId: entry?.folderDeleteMarkerVersionId,
+        folderMarkerVersionId: entry?.folderMarkerVersionId,
+        isPartialScan: !isFolderCovered(prefix, stoppedAtKey)
+      };
+    }));
   })
 };
 
 // src/server/Storage/routers/ceph/bucketPolicyRouter.ts
 var import_client_s35 = require("@aws-sdk/client-s3");
 var import_server16 = require("@trpc/server");
-var import_zod18 = require("zod");
+var import_zod17 = require("zod");
 var policySetRateLimits = /* @__PURE__ */ new Map();
 function checkPolicySetRateLimit(bucketName, projectId) {
   const key = `${projectId}:${bucketName}`;
@@ -37081,12 +37910,12 @@ function validateResourceARNsMatchBucket(policy, bucketName) {
       statement.Resource
     ];
     for (const resource of resources) {
-      const arnRegex = /^arn:aws:s3:::([^/]+)/;
+      const arnRegex = /^arn:aws:s3::[^:/]*:([^/]+)/;
       const match = resource.match(arnRegex);
       if (!match) {
         throw new import_server16.TRPCError({
           code: "BAD_REQUEST",
-          message: `Policy Resource '${resource}' is not a valid S3 bucket ARN for bucket '${bucketName}'. Expected: arn:aws:s3:::${bucketName} or arn:aws:s3:::${bucketName}/*`
+          message: `Policy Resource '${resource}' is not a valid S3 bucket ARN for bucket '${bucketName}'. Expected: arn:aws:s3:::${bucketName}, arn:aws:s3:::${bucketName}/* or arn:aws:s3::TENANT:${bucketName}`
         });
       }
       if (match[1] !== bucketName) {
@@ -37121,12 +37950,22 @@ function validatePolicySemantics(policy) {
   }
 }
 __name(validatePolicySemantics, "validatePolicySemantics");
+function parseStoredPolicy(policyText) {
+  try {
+    const result = bucketPolicyDocumentSchema.safeParse(JSON.parse(policyText));
+    return result.success ? result.data : null;
+  } catch {
+    return null;
+  }
+}
+__name(parseStoredPolicy, "parseStoredPolicy");
 var bucketPolicyRouter = {
   /**
   * Get the current bucket policy.
   *
-  * Returns the policy as both a parsed object and raw JSON string.
-  * Returns null if no policy is set (not an error).
+  * Returns the policy as both a parsed object and raw JSON string. `policyText` is always the
+  * document exactly as RGW stored it; `policy` is null when no policy is set, and also when the
+  * stored document doesn't fit our schema — the editor shows the raw text either way.
   *
   * @throws TRPCError NOT_FOUND - bucket does not exist
   * @throws TRPCError FORBIDDEN - no credentials or access denied
@@ -37145,10 +37984,8 @@ var bucketPolicyRouter = {
           policyText: null
         };
       }
-      const policyObj = JSON.parse(policyText);
-      const policy = bucketPolicyDocumentSchema.parse(policyObj);
       return {
-        policy,
+        policy: parseStoredPolicy(policyText),
         policyText
       };
     } catch (error) {
@@ -37210,7 +38047,7 @@ var bucketPolicyRouter = {
           message: "Invalid JSON format"
         });
       }
-      if (error instanceof import_zod18.z.ZodError) {
+      if (error instanceof import_zod17.z.ZodError) {
         const zodError = error;
         const firstError = zodError.issues?.[0];
         if (!firstError) {
@@ -37857,40 +38694,40 @@ var buildObjectStorageRouters = /* @__PURE__ */ __name((policyDir) => ({
 }), "buildObjectStorageRouters");
 
 // src/server/Project/routers/projectRouter.ts
-var import_zod20 = require("zod");
+var import_zod19 = require("zod");
 var import_server19 = require("@trpc/server");
 
 // src/server/Project/types/models.ts
-var import_zod19 = require("zod");
-var baseProjectSchema = import_zod19.z.object({
-  id: import_zod19.z.string(),
-  name: import_zod19.z.string(),
-  enabled: import_zod19.z.boolean(),
-  domain_id: import_zod19.z.string().nullable().optional(),
-  parent_id: import_zod19.z.string().nullable().optional(),
-  is_domain: import_zod19.z.boolean().nullable().optional(),
-  tags: import_zod19.z.array(import_zod19.z.string()).nullable().optional(),
-  options: import_zod19.z.record(import_zod19.z.string(), import_zod19.z.string().or(import_zod19.z.boolean())).nullable().optional(),
-  description: import_zod19.z.string().nullable().optional(),
-  links: import_zod19.z.object({
-    self: import_zod19.z.string().url().nullable().optional()
+var import_zod18 = require("zod");
+var baseProjectSchema = import_zod18.z.object({
+  id: import_zod18.z.string(),
+  name: import_zod18.z.string(),
+  enabled: import_zod18.z.boolean(),
+  domain_id: import_zod18.z.string().nullable().optional(),
+  parent_id: import_zod18.z.string().nullable().optional(),
+  is_domain: import_zod18.z.boolean().nullable().optional(),
+  tags: import_zod18.z.array(import_zod18.z.string()).nullable().optional(),
+  options: import_zod18.z.record(import_zod18.z.string(), import_zod18.z.string().or(import_zod18.z.boolean())).nullable().optional(),
+  description: import_zod18.z.string().nullable().optional(),
+  links: import_zod18.z.object({
+    self: import_zod18.z.string().url().nullable().optional()
   }).optional()
 });
 var projectSchema = baseProjectSchema.extend({
-  domain_name: import_zod19.z.string().optional(),
-  parents: import_zod19.z.array(import_zod19.z.object({
+  domain_name: import_zod18.z.string().optional(),
+  parents: import_zod18.z.array(import_zod18.z.object({
     project: baseProjectSchema
   })).optional()
 });
-var projectResponseSchema = import_zod19.z.object({
+var projectResponseSchema = import_zod18.z.object({
   project: projectSchema
 });
-var projectsResponseSchema = import_zod19.z.object({
-  projects: import_zod19.z.array(projectSchema),
-  links: import_zod19.z.object({
-    self: import_zod19.z.string().url().optional(),
-    previous: import_zod19.z.string().url().nullable().optional(),
-    next: import_zod19.z.string().url().nullable().optional()
+var projectsResponseSchema = import_zod18.z.object({
+  projects: import_zod18.z.array(projectSchema),
+  links: import_zod18.z.object({
+    self: import_zod18.z.string().url().optional(),
+    previous: import_zod18.z.string().url().nullable().optional(),
+    next: import_zod18.z.string().url().nullable().optional()
   }).optional()
 });
 
@@ -37977,10 +38814,10 @@ var projectRouter = {
       return void 0;
     }
     const domainsData = domainsResponse ? await domainsResponse.json().catch(() => null) : null;
-    const domainsResponseSchema = import_zod20.z.object({
-      domains: import_zod20.z.array(import_zod20.z.object({
-        id: import_zod20.z.string(),
-        name: import_zod20.z.string()
+    const domainsResponseSchema = import_zod19.z.object({
+      domains: import_zod19.z.array(import_zod19.z.object({
+        id: import_zod19.z.string(),
+        name: import_zod19.z.string()
       }))
     });
     const parsedDomains = domainsResponseSchema.safeParse(domainsData);
@@ -38000,8 +38837,8 @@ var projectRouter = {
   * filtered by the optional search term. Uses the OpenStack /v3/auth/projects
   * endpoint which works with any valid token.
   */
-  searchProjects: protectedProcedure.input(import_zod20.z.object({
-    search: import_zod20.z.string().optional()
+  searchProjects: protectedProcedure.input(import_zod19.z.object({
+    search: import_zod19.z.string().optional()
   }).optional()).query(async ({ ctx, input }) => {
     if (!ctx.openstack) {
       throw new import_server19.TRPCError({
@@ -38031,8 +38868,65 @@ var projectRouter = {
     projects.sort((a, b) => a.name.localeCompare(b.name));
     return projects;
   }),
-  getProject: protectedProcedure.input(import_zod20.z.object({
-    projectId: import_zod20.z.string()
+  /**
+  * List projects with unified search functionality
+  *
+  * Returns all projects that the authenticated user has access to,
+  * filtered by ID, name, and description using the standard filterBySearchParams helper.
+  * This endpoint provides consistent search behavior with other resources in the system.
+  */
+  listProjectsWithSearch: protectedProcedure.input(import_zod19.z.object({
+    searchTerm: import_zod19.z.string().optional()
+  })).query(async ({ ctx, input }) => {
+    if (!ctx.openstack) {
+      throw new import_server19.TRPCError({
+        code: "UNAUTHORIZED",
+        message: "No authenticated session"
+      });
+    }
+    const token = ctx.openstack.getToken();
+    if (!token?.authToken) {
+      throw new import_server19.TRPCError({
+        code: "UNAUTHORIZED",
+        message: "No auth token available"
+      });
+    }
+    const [response, domainsResponse] = await Promise.all([
+      callIdentityAPI(ctx.identityEndpoint, token.authToken, "auth/projects"),
+      callIdentityAPI(ctx.identityEndpoint, token.authToken, "auth/domains").catch(() => null)
+    ]);
+    const data = await response.json();
+    const parsedData = projectsResponseSchema.safeParse(data);
+    if (!parsedData.success) {
+      console.error("Zod Parsing Error:", parsedData.error.message);
+      return void 0;
+    }
+    const domainsData = domainsResponse ? await domainsResponse.json().catch(() => null) : null;
+    const domainsResponseSchema = import_zod19.z.object({
+      domains: import_zod19.z.array(import_zod19.z.object({
+        id: import_zod19.z.string(),
+        name: import_zod19.z.string()
+      }))
+    });
+    const parsedDomains = domainsResponseSchema.safeParse(domainsData);
+    const domainMap = new Map((parsedDomains.success ? parsedDomains.data.domains : []).map((d) => [
+      d.id,
+      d.name
+    ]));
+    const projectsWithDomain = parsedData.data.projects.map((project) => ({
+      ...project,
+      domain_name: project.domain_id ? domainMap.get(project.domain_id) ?? void 0 : void 0
+    }));
+    return filterBySearchParams(projectsWithDomain, input.searchTerm, [
+      "id",
+      "name",
+      "description",
+      "domain_name",
+      "domain_id"
+    ]);
+  }),
+  getProject: protectedProcedure.input(import_zod19.z.object({
+    projectId: import_zod19.z.string()
   })).query(async ({ ctx, input }) => {
     if (!ctx.openstack) {
       throw new import_server19.TRPCError({
@@ -38142,16 +39036,16 @@ __name(validateOpenstackService, "validateOpenstackService");
 var import_signal_openstack7 = __toESM(require_esm());
 
 // src/server/Network/types/floatingIp.ts
-var import_zod22 = require("zod");
+var import_zod21 = require("zod");
 
 // src/server/Network/types/index.ts
-var import_zod21 = require("zod");
-var ISO8601TimestampSchema = import_zod21.z.string().brand("ISO8601Timestamp");
-var SortDirSchema = import_zod21.z.enum([
+var import_zod20 = require("zod");
+var ISO8601TimestampSchema = import_zod20.z.string().brand("ISO8601Timestamp");
+var SortDirSchema = import_zod20.z.enum([
   "asc",
   "desc"
 ]);
-var NetworkPortStatusSchema = import_zod21.z.enum([
+var NetworkPortStatusSchema = import_zod20.z.enum([
   "ACTIVE",
   "DOWN",
   "BUILD",
@@ -38159,153 +39053,153 @@ var NetworkPortStatusSchema = import_zod21.z.enum([
 ]);
 
 // src/server/Network/types/floatingIp.ts
-var FloatingIpStatusSchema = import_zod22.z.enum([
+var FloatingIpStatusSchema = import_zod21.z.enum([
   "ACTIVE",
   "DOWN",
   "ERROR"
 ]);
-var PortDetailsSchema = import_zod22.z.object({
+var PortDetailsSchema = import_zod21.z.object({
   /** The status of the port */
   status: FloatingIpStatusSchema,
   /** The name of the port */
-  name: import_zod22.z.string(),
+  name: import_zod21.z.string(),
   /** Administrative state of the port (true = UP, false = DOWN) */
-  admin_state_up: import_zod22.z.boolean(),
+  admin_state_up: import_zod21.z.boolean(),
   /** The ID of the network the port is attached to */
-  network_id: import_zod22.z.string(),
+  network_id: import_zod21.z.string(),
   /** The owner of the port device */
-  device_owner: import_zod22.z.string(),
+  device_owner: import_zod21.z.string(),
   /** The MAC address of the port */
-  mac_address: import_zod22.z.string(),
+  mac_address: import_zod21.z.string(),
   /** The ID of the device the port is attached to */
-  device_id: import_zod22.z.string()
+  device_id: import_zod21.z.string()
 });
-var PortForwardingSchema = import_zod22.z.object({
+var PortForwardingSchema = import_zod21.z.object({
   /** Port forwarding protocol  */
-  protocol: import_zod22.z.enum([
+  protocol: import_zod21.z.enum([
     "tcp",
     "udp"
   ]),
   /** The internal fixed IP address associated with the port forwarding */
-  internal_ip_address: import_zod22.z.string(),
+  internal_ip_address: import_zod21.z.string(),
   /** The internal port number or starting port of the range */
-  internal_port: import_zod22.z.number().optional(),
+  internal_port: import_zod21.z.number().optional(),
   /** The internal port range (e.g., "1024:2048") */
-  internal_port_range: import_zod22.z.string().optional(),
+  internal_port_range: import_zod21.z.string().optional(),
   /** The internal port ID for the port forwarding (requires floating-ip-port-forwarding-detail extension) */
-  internal_port_id: import_zod22.z.string().optional(),
+  internal_port_id: import_zod21.z.string().optional(),
   /** The external port number or starting port of the range */
-  external_port: import_zod22.z.number().optional(),
+  external_port: import_zod21.z.number().optional(),
   /** The external port range (e.g., "8000:9000") */
-  external_port_range: import_zod22.z.string().optional(),
+  external_port_range: import_zod21.z.string().optional(),
   /** The ID of the port forwarding resource */
-  id: import_zod22.z.string(),
+  id: import_zod21.z.string(),
   /** Description of the port forwarding rule (requires floating-ip-port-forwarding-description extension) */
-  description: import_zod22.z.string().nullable().optional()
+  description: import_zod21.z.string().nullable().optional()
 });
-var FloatingIpSchema = import_zod22.z.object({
+var FloatingIpSchema = import_zod21.z.object({
   /** The ID of the router for the floating IP (null if not associated) */
-  router_id: import_zod22.z.string().nullable(),
+  router_id: import_zod21.z.string().nullable(),
   /** A human-readable description for the resource */
-  description: import_zod22.z.string().nullable().optional(),
+  description: import_zod21.z.string().nullable().optional(),
   /** Whether this is a distributed floating IP (requires floating-ip-distributed extension) */
-  distributed: import_zod22.z.boolean().optional(),
+  distributed: import_zod21.z.boolean().optional(),
   /** A valid DNS domain (requires dns-integration extension) */
-  dns_domain: import_zod22.z.string().optional(),
+  dns_domain: import_zod21.z.string().optional(),
   /** A valid DNS name (requires dns-integration extension) */
-  dns_name: import_zod22.z.string().optional(),
+  dns_name: import_zod21.z.string().optional(),
   /** Time at which the resource was created (UTC ISO8601 format, requires standard-attr-timestamp extension) */
   created_at: ISO8601TimestampSchema.optional(),
   /** Time at which the resource was last updated (UTC ISO8601 format, requires standard-attr-timestamp extension) */
   updated_at: ISO8601TimestampSchema.optional(),
   /** The revision number of the resource (set by server, for concurrency control) */
-  revision_number: import_zod22.z.number(),
+  revision_number: import_zod21.z.number(),
   /** The ID of the project that owns the floating IP */
-  project_id: import_zod22.z.string(),
+  project_id: import_zod21.z.string(),
   /** The ID of the tenant (deprecated, use project_id) */
-  tenant_id: import_zod22.z.string(),
+  tenant_id: import_zod21.z.string(),
   /** The ID of the network associated with the floating IP */
-  floating_network_id: import_zod22.z.string(),
+  floating_network_id: import_zod21.z.string(),
   /** The fixed IP address associated with the floating IP (null if not associated) */
-  fixed_ip_address: import_zod22.z.string().nullable(),
+  fixed_ip_address: import_zod21.z.string().nullable(),
   /** The floating IP address */
-  floating_ip_address: import_zod22.z.string(),
+  floating_ip_address: import_zod21.z.string(),
   /** The ID of the port associated with the floating IP (null if not associated) */
-  port_id: import_zod22.z.string().nullable(),
+  port_id: import_zod21.z.string().nullable(),
   /** The ID of the floating IP address */
-  id: import_zod22.z.string(),
+  id: import_zod21.z.string(),
   /** The status of the floating IP */
   status: FloatingIpStatusSchema,
   /** The information of the associated port (null if not associated, requires fip-port-details extension) */
   port_details: PortDetailsSchema.nullable().optional(),
   /** The list of tags on the resource (requires standard-attr-tag extension) */
-  tags: import_zod22.z.array(import_zod22.z.string()).optional(),
+  tags: import_zod21.z.array(import_zod21.z.string()).optional(),
   /** The associated port forwarding resources for the floating IP (requires expose-port-forwarding-in-fip extension) */
-  port_forwardings: import_zod22.z.array(PortForwardingSchema).nullish(),
+  port_forwardings: import_zod21.z.array(PortForwardingSchema).nullish(),
   /** The ID of the QoS policy of the network where this floating IP is plugged (requires qos-fip extension) */
-  qos_network_policy_id: import_zod22.z.string().optional(),
+  qos_network_policy_id: import_zod21.z.string().optional(),
   /** The ID of the QoS policy associated with the floating IP (requires qos extension) */
-  qos_policy_id: import_zod22.z.string().optional()
-});
-var FloatingIpIdInputSchema = import_zod22.z.object({
-  project_id: import_zod22.z.string(),
-  floatingip_id: import_zod22.z.string()
-});
-var FloatingIpCreateRequestSchema = import_zod22.z.object({
-  project_id: import_zod22.z.string().trim().min(1, "project_id must be a non-empty string"),
-  floating_network_id: import_zod22.z.string(),
-  fixed_ip_address: import_zod22.z.string().optional(),
-  floating_ip_address: import_zod22.z.string().optional(),
-  port_id: import_zod22.z.string().optional(),
-  subnet_id: import_zod22.z.string().optional(),
-  distributed: import_zod22.z.boolean().optional(),
-  description: import_zod22.z.string().optional(),
-  dns_domain: import_zod22.z.string().optional(),
-  dns_name: import_zod22.z.string().optional(),
-  qos_policy_id: import_zod22.z.string().optional()
-});
-var FloatingIpUpdateRequestSchema = import_zod22.z.object({
-  project_id: import_zod22.z.string(),
-  floatingip_id: import_zod22.z.string(),
-  port_id: import_zod22.z.string().nullable(),
-  fixed_ip_address: import_zod22.z.string().optional(),
-  description: import_zod22.z.string().optional(),
-  distributed: import_zod22.z.boolean().optional()
-});
-var FloatingIpResponseSchema = import_zod22.z.object({
+  qos_policy_id: import_zod21.z.string().optional()
+});
+var FloatingIpIdInputSchema = import_zod21.z.object({
+  project_id: import_zod21.z.string(),
+  floatingip_id: import_zod21.z.string()
+});
+var FloatingIpCreateRequestSchema = import_zod21.z.object({
+  project_id: import_zod21.z.string().trim().min(1, "project_id must be a non-empty string"),
+  floating_network_id: import_zod21.z.string(),
+  fixed_ip_address: import_zod21.z.string().optional(),
+  floating_ip_address: import_zod21.z.string().optional(),
+  port_id: import_zod21.z.string().optional(),
+  subnet_id: import_zod21.z.string().optional(),
+  distributed: import_zod21.z.boolean().optional(),
+  description: import_zod21.z.string().optional(),
+  dns_domain: import_zod21.z.string().optional(),
+  dns_name: import_zod21.z.string().optional(),
+  qos_policy_id: import_zod21.z.string().optional()
+});
+var FloatingIpUpdateRequestSchema = import_zod21.z.object({
+  project_id: import_zod21.z.string(),
+  floatingip_id: import_zod21.z.string(),
+  port_id: import_zod21.z.string().nullable(),
+  fixed_ip_address: import_zod21.z.string().optional(),
+  description: import_zod21.z.string().optional(),
+  distributed: import_zod21.z.boolean().optional()
+});
+var FloatingIpResponseSchema = import_zod21.z.object({
   floatingip: FloatingIpSchema
 });
-var FloatingIpListResponseSchema = import_zod22.z.object({
+var FloatingIpListResponseSchema = import_zod21.z.object({
   /** A list of floating IP objects */
-  floatingips: import_zod22.z.array(FloatingIpSchema)
+  floatingips: import_zod21.z.array(FloatingIpSchema)
 });
-var FloatingIpQueryParametersSchema = import_zod22.z.object({
+var FloatingIpQueryParametersSchema = import_zod21.z.object({
   /** Project ID for rescoping (required for projectScopedProcedure) */
-  project_id: import_zod22.z.string(),
+  project_id: import_zod21.z.string(),
   /** Filter by the ID of the floating IP */
-  id: import_zod22.z.string().optional(),
+  id: import_zod21.z.string().optional(),
   /** Filter by the ID of the router for the floating IP */
-  router_id: import_zod22.z.string().nullable().optional(),
+  router_id: import_zod21.z.string().nullable().optional(),
   /** Filter by the status of the floating IP */
   status: FloatingIpStatusSchema.optional(),
   /** Filter by the ID of the project that owns the resource */
-  tenant_id: import_zod22.z.string().optional(),
+  tenant_id: import_zod21.z.string().optional(),
   /** Filter by the revision number of the resource */
-  revision_number: import_zod22.z.number().optional(),
+  revision_number: import_zod21.z.number().optional(),
   /** Filter by the human-readable description of the resource */
-  description: import_zod22.z.string().nullable().optional(),
+  description: import_zod21.z.string().nullable().optional(),
   /** Filter by the ID of the network associated with the floating IP */
-  floating_network_id: import_zod22.z.string().optional(),
+  floating_network_id: import_zod21.z.string().optional(),
   /** Filter by the fixed IP address associated with the floating IP */
-  fixed_ip_address: import_zod22.z.string().optional(),
+  fixed_ip_address: import_zod21.z.string().optional(),
   /** Filter by the floating IP address */
-  floating_ip_address: import_zod22.z.string().optional(),
+  floating_ip_address: import_zod21.z.string().optional(),
   /** Filter by the ID of a port associated with the floating IP */
-  port_id: import_zod22.z.string().nullable().optional(),
+  port_id: import_zod21.z.string().nullable().optional(),
   /** Sort direction (asc or desc) */
   sort_dir: SortDirSchema.optional(),
   /** Sort key - valid keys: fixed_ip_address, floating_ip_address, floating_network_id, id, router_id, status, tenant_id, project_id */
-  sort_key: import_zod22.z.enum([
+  sort_key: import_zod21.z.enum([
     "fixed_ip_address",
     "floating_ip_address",
     "floating_network_id",
@@ -38316,73 +39210,73 @@ var FloatingIpQueryParametersSchema = import_zod22.z.object({
     "project_id"
   ]).optional(),
   /** Filter by tags (comma-separated, resources must match all tags) -  requires standard-attr-tag extension */
-  tags: import_zod22.z.array(import_zod22.z.string()).optional(),
+  tags: import_zod21.z.array(import_zod21.z.string()).optional(),
   /** Filter by tags with OR logic (comma-separated, resources match any tag) */
-  "tags-any": import_zod22.z.string().optional(),
+  "tags-any": import_zod21.z.string().optional(),
   /** Exclude resources with these tags (comma-separated, resources must match all excluded tags) */
-  "not-tags": import_zod22.z.string().optional(),
+  "not-tags": import_zod21.z.string().optional(),
   /** Exclude resources with these tags using OR logic (comma-separated, resources match any excluded tag) */
-  "not-tags-any": import_zod22.z.string().optional(),
+  "not-tags-any": import_zod21.z.string().optional(),
   /** Specific fields to return (can be repeated) */
-  fields: import_zod22.z.union([
-    import_zod22.z.string(),
-    import_zod22.z.array(import_zod22.z.string())
+  fields: import_zod21.z.union([
+    import_zod21.z.string(),
+    import_zod21.z.array(import_zod21.z.string())
   ]).optional(),
   /** Pagination limit */
-  limit: import_zod22.z.number().optional(),
+  limit: import_zod21.z.number().optional(),
   /** Pagination marker (ID of the last item in the previous list) */
-  marker: import_zod22.z.string().optional(),
+  marker: import_zod21.z.string().optional(),
   /** Pagination direction (false = ascending, true = descending) */
-  page_reverse: import_zod22.z.boolean().optional(),
+  page_reverse: import_zod21.z.boolean().optional(),
   // BFF-side search (filtered in BFF layer, not sent to OpenStack)
-  searchTerm: import_zod22.z.string().optional()
-});
-var ExternalNetworksQuerySchema = import_zod22.z.object({
-  project_id: import_zod22.z.string(),
-  "router:external": import_zod22.z.literal(true).default(true)
-});
-var ExternalNetworkSchema = import_zod22.z.object({
-  id: import_zod22.z.string(),
-  name: import_zod22.z.string(),
-  project_id: import_zod22.z.string(),
-  "router:external": import_zod22.z.boolean().optional(),
-  shared: import_zod22.z.boolean(),
+  searchTerm: import_zod21.z.string().optional()
+});
+var ExternalNetworksQuerySchema = import_zod21.z.object({
+  project_id: import_zod21.z.string(),
+  "router:external": import_zod21.z.literal(true).default(true)
+});
+var ExternalNetworkSchema = import_zod21.z.object({
+  id: import_zod21.z.string(),
+  name: import_zod21.z.string(),
+  project_id: import_zod21.z.string(),
+  "router:external": import_zod21.z.boolean().optional(),
+  shared: import_zod21.z.boolean(),
   status: NetworkPortStatusSchema,
   updated_at: ISO8601TimestampSchema.optional(),
-  is_default: import_zod22.z.boolean().optional()
+  is_default: import_zod21.z.boolean().optional()
 });
-var ExternalNetworksResponseSchema = import_zod22.z.object({
-  networks: import_zod22.z.array(ExternalNetworkSchema)
+var ExternalNetworksResponseSchema = import_zod21.z.object({
+  networks: import_zod21.z.array(ExternalNetworkSchema)
 });
-var DnsDomainSchema = import_zod22.z.object({
-  id: import_zod22.z.string(),
-  name: import_zod22.z.string()
+var DnsDomainSchema = import_zod21.z.object({
+  id: import_zod21.z.string(),
+  name: import_zod21.z.string()
 });
-var DnsDomainResponseSchema = import_zod22.z.object({
-  zones: import_zod22.z.array(DnsDomainSchema)
+var DnsDomainResponseSchema = import_zod21.z.object({
+  zones: import_zod21.z.array(DnsDomainSchema)
 });
-var AvailablePortsQuerySchema = import_zod22.z.object({
-  project_id: import_zod22.z.string(),
+var AvailablePortsQuerySchema = import_zod21.z.object({
+  project_id: import_zod21.z.string(),
   /** Only ACTIVE ports are eligible for floating IP association */
-  status: import_zod22.z.literal("ACTIVE").default("ACTIVE"),
+  status: import_zod21.z.literal("ACTIVE").default("ACTIVE"),
   /** Only administratively UP ports are eligible for floating IP association */
-  admin_state_up: import_zod22.z.literal(true).default(true)
+  admin_state_up: import_zod21.z.literal(true).default(true)
 });
-var AvailablePortSchema = import_zod22.z.object({
+var AvailablePortSchema = import_zod21.z.object({
   /** The ID of the port */
-  id: import_zod22.z.string(),
+  id: import_zod21.z.string(),
   /** Human-readable name of the port */
-  name: import_zod22.z.string().nullable().optional(),
+  name: import_zod21.z.string().nullable().optional(),
   /** List of fixed IPs assigned to the port, each entry pairs an IP address with its subnet. */
-  fixed_ips: import_zod22.z.array(import_zod22.z.object({
+  fixed_ips: import_zod21.z.array(import_zod21.z.object({
     /** The fixed IP address assigned to the port */
-    ip_address: import_zod22.z.string(),
+    ip_address: import_zod21.z.string(),
     /** The ID of the subnet the IP belongs to */
-    subnet_id: import_zod22.z.string().optional()
+    subnet_id: import_zod21.z.string().optional()
   })).optional()
 });
-var AvailablePortsResponseSchema = import_zod22.z.object({
-  ports: import_zod22.z.array(AvailablePortSchema)
+var AvailablePortsResponseSchema = import_zod21.z.object({
+  ports: import_zod21.z.array(AvailablePortSchema)
 });
 
 // src/server/Network/helpers/errorHandling.ts
@@ -38490,6 +39384,7 @@ var floatingIpRouter = {
       const data = await response.json();
       const { floatingips } = parseOrThrow(FloatingIpListResponseSchema, data, "floatingIpRouter.list");
       return filterBySearchParams(floatingips, searchTerm, [
+        "id",
         "description",
         "floating_ip_address",
         "fixed_ip_address",
@@ -38643,110 +39538,112 @@ var floatingIpRouter = {
 };
 
 // src/server/Network/types/securityGroup.ts
-var import_zod23 = require("zod");
-var securityGroupRuleSchema = import_zod23.z.object({
-  id: import_zod23.z.string(),
-  direction: import_zod23.z.enum([
+var import_zod22 = require("zod");
+var securityGroupRuleSchema = import_zod22.z.object({
+  id: import_zod22.z.string(),
+  direction: import_zod22.z.enum([
     "ingress",
     "egress"
   ]).optional(),
-  ethertype: import_zod23.z.enum([
+  ethertype: import_zod22.z.enum([
     "IPv4",
     "IPv6"
   ]).optional(),
-  description: import_zod23.z.string().nullable().optional(),
-  security_group_id: import_zod23.z.string().optional(),
-  protocol: import_zod23.z.string().nullable().optional(),
-  port_range_min: import_zod23.z.number().nullable().optional(),
-  port_range_max: import_zod23.z.number().nullable().optional(),
-  remote_ip_prefix: import_zod23.z.string().nullable().optional(),
-  remote_group_id: import_zod23.z.string().nullable().optional(),
-  remote_address_group_id: import_zod23.z.string().nullable().optional(),
-  tenant_id: import_zod23.z.string().nullable().optional(),
-  project_id: import_zod23.z.string().nullable().optional(),
-  revision_number: import_zod23.z.number().optional(),
-  tags: import_zod23.z.array(import_zod23.z.string()).optional(),
-  created_at: import_zod23.z.string().optional(),
-  updated_at: import_zod23.z.string().nullable().optional()
+  description: import_zod22.z.string().nullable().optional(),
+  security_group_id: import_zod22.z.string().optional(),
+  protocol: import_zod22.z.string().nullable().optional(),
+  port_range_min: import_zod22.z.number().nullable().optional(),
+  port_range_max: import_zod22.z.number().nullable().optional(),
+  remote_ip_prefix: import_zod22.z.string().nullable().optional(),
+  remote_group_id: import_zod22.z.string().nullable().optional(),
+  remote_address_group_id: import_zod22.z.string().nullable().optional(),
+  tenant_id: import_zod22.z.string().nullable().optional(),
+  project_id: import_zod22.z.string().nullable().optional(),
+  revision_number: import_zod22.z.number().optional(),
+  tags: import_zod22.z.array(import_zod22.z.string()).optional(),
+  created_at: import_zod22.z.string().optional(),
+  updated_at: import_zod22.z.string().nullable().optional()
 });
-var securityGroupSchema = import_zod23.z.object({
-  id: import_zod23.z.string(),
-  name: import_zod23.z.string().nullable().optional(),
-  description: import_zod23.z.string().nullable().optional(),
-  tenant_id: import_zod23.z.string().nullable().optional(),
-  project_id: import_zod23.z.string().nullable().optional(),
-  stateful: import_zod23.z.boolean().optional(),
-  shared: import_zod23.z.boolean().optional(),
-  tags: import_zod23.z.array(import_zod23.z.string()).optional(),
-  security_group_rules: import_zod23.z.array(securityGroupRuleSchema).optional(),
-  revision_number: import_zod23.z.number().optional(),
-  created_at: import_zod23.z.string().optional(),
-  updated_at: import_zod23.z.string().nullable().optional()
-});
-var securityGroupsResponseSchema = import_zod23.z.object({
-  security_groups: import_zod23.z.array(securityGroupSchema)
-});
-var securityGroupResponseSchema = import_zod23.z.object({
+var securityGroupSchema = import_zod22.z.object({
+  id: import_zod22.z.string(),
+  name: import_zod22.z.string().nullable().optional(),
+  description: import_zod22.z.string().nullable().optional(),
+  tenant_id: import_zod22.z.string().nullable().optional(),
+  project_id: import_zod22.z.string().nullable().optional(),
+  stateful: import_zod22.z.boolean().optional(),
+  shared: import_zod22.z.boolean().optional(),
+  tags: import_zod22.z.array(import_zod22.z.string()).optional(),
+  security_group_rules: import_zod22.z.array(securityGroupRuleSchema).optional(),
+  revision_number: import_zod22.z.number().optional(),
+  created_at: import_zod22.z.string().optional(),
+  updated_at: import_zod22.z.string().nullable().optional()
+});
+var securityGroupsResponseSchema = import_zod22.z.object({
+  security_groups: import_zod22.z.array(securityGroupSchema)
+});
+var securityGroupResponseSchema = import_zod22.z.object({
   security_group: securityGroupSchema
 });
-var securityGroupRuleResponseSchema = import_zod23.z.object({
+var securityGroupRuleResponseSchema = import_zod22.z.object({
   security_group_rule: securityGroupRuleSchema
 });
 var listSecurityGroupsInputSchema = projectScopedInputSchema.extend({
   // Sorting
-  sort_key: import_zod23.z.string().optional(),
+  sort_key: import_zod22.z.string().optional(),
   sort_dir: SortDirSchema.optional(),
   // Basic filtering
-  name: import_zod23.z.string().optional(),
-  description: import_zod23.z.string().optional(),
-  tenant_id: import_zod23.z.string().optional(),
-  shared: import_zod23.z.boolean().optional(),
+  name: import_zod22.z.string().optional(),
+  description: import_zod22.z.string().optional(),
+  tenant_id: import_zod22.z.string().optional(),
+  shared: import_zod22.z.boolean().optional(),
   // Tag-based filtering (string values follow Neutron semantics)
-  tags: import_zod23.z.string().optional(),
-  tags_any: import_zod23.z.string().optional(),
-  not_tags: import_zod23.z.string().optional(),
-  not_tags_any: import_zod23.z.string().optional(),
+  tags: import_zod22.z.string().optional(),
+  tags_any: import_zod22.z.string().optional(),
+  not_tags: import_zod22.z.string().optional(),
+  not_tags_any: import_zod22.z.string().optional(),
+  // Filtered in the BFF layer, not forwarded to Neutron
+  stateful: import_zod22.z.boolean().optional(),
   // BFF-side search (filtered in BFF layer, not sent to OpenStack)
-  searchTerm: import_zod23.z.string().optional()
+  searchTerm: import_zod22.z.string().optional()
 });
 var getSecurityGroupByIdInputSchema = projectScopedInputSchema.extend({
-  securityGroupId: import_zod23.z.string()
+  securityGroupId: import_zod22.z.string()
 });
 var createSecurityGroupInputSchema = projectScopedInputSchema.extend({
-  name: import_zod23.z.string().min(1, "Name is required"),
-  description: import_zod23.z.string().optional(),
-  stateful: import_zod23.z.boolean().optional()
+  name: import_zod22.z.string().min(1, "Name is required"),
+  description: import_zod22.z.string().optional(),
+  stateful: import_zod22.z.boolean().optional()
 });
 var deleteSecurityGroupInputSchema = projectScopedInputSchema.extend({
-  securityGroupId: import_zod23.z.string()
+  securityGroupId: import_zod22.z.string()
 });
 var updateSecurityGroupInputSchema = projectScopedInputSchema.extend({
-  securityGroupId: import_zod23.z.string(),
-  name: import_zod23.z.string().min(1, "Name is required").optional(),
-  description: import_zod23.z.string().optional(),
-  stateful: import_zod23.z.boolean().optional()
+  securityGroupId: import_zod22.z.string(),
+  name: import_zod22.z.string().min(1, "Name is required").optional(),
+  description: import_zod22.z.string().optional(),
+  stateful: import_zod22.z.boolean().optional()
 });
 var deleteSecurityGroupRuleInputSchema = projectScopedInputSchema.extend({
-  ruleId: import_zod23.z.string()
+  ruleId: import_zod22.z.string()
 });
 var createSecurityGroupRuleInputSchema = projectScopedInputSchema.extend({
-  security_group_id: import_zod23.z.string(),
-  direction: import_zod23.z.enum([
+  security_group_id: import_zod22.z.string(),
+  direction: import_zod22.z.enum([
     "ingress",
     "egress"
   ]),
-  ethertype: import_zod23.z.enum([
+  ethertype: import_zod22.z.enum([
     "IPv4",
     "IPv6"
   ]).default("IPv4"),
-  description: import_zod23.z.string().optional(),
-  protocol: import_zod23.z.string().nullable().optional(),
-  port_range_min: import_zod23.z.number().int().max(65535).nullable().optional(),
-  port_range_max: import_zod23.z.number().int().max(65535).nullable().optional(),
+  description: import_zod22.z.string().optional(),
+  protocol: import_zod22.z.string().nullable().optional(),
+  port_range_min: import_zod22.z.number().int().max(65535).nullable().optional(),
+  port_range_max: import_zod22.z.number().int().max(65535).nullable().optional(),
   // Transform empty strings to undefined for proper validation
-  remote_ip_prefix: import_zod23.z.string().nullable().optional().transform((val) => val === "" ? void 0 : val),
-  remote_group_id: import_zod23.z.string().nullable().optional().transform((val) => val === "" ? void 0 : val),
-  remote_address_group_id: import_zod23.z.string().nullable().optional().transform((val) => val === "" ? void 0 : val)
+  remote_ip_prefix: import_zod22.z.string().nullable().optional().transform((val) => val === "" ? void 0 : val),
+  remote_group_id: import_zod22.z.string().nullable().optional().transform((val) => val === "" ? void 0 : val),
+  remote_address_group_id: import_zod22.z.string().nullable().optional().transform((val) => val === "" ? void 0 : val)
 });
 
 // src/server/Network/helpers/securityGroupHelpers.ts
@@ -39048,6 +39945,10 @@ var deduplicateSecurityGroupsById = /* @__PURE__ */ __name((items) => {
   }
   return Array.from(seen.values());
 }, "deduplicateSecurityGroupsById");
+var filterSecurityGroupsByStateful = /* @__PURE__ */ __name((items, stateful) => {
+  if (stateful === void 0) return items;
+  return items.filter((item) => (item.stateful ?? true) === stateful);
+}, "filterSecurityGroupsByStateful");
 var sortSecurityGroups = /* @__PURE__ */ __name((items, sortKey, sortDir = "asc") => {
   if (!sortKey) return items;
   return [
@@ -39099,7 +40000,7 @@ __name(fetchSecurityGroupsWithParams, "fetchSecurityGroupsWithParams");
 var securityGroupRouter = {
   list: projectScopedProcedure.input(listSecurityGroupsInputSchema).query(async ({ input, ctx }) => {
     return withErrorHandling3(async () => {
-      const { searchTerm, project_id, shared, sort_key, sort_dir, ...queryInput } = input;
+      const { searchTerm, project_id, shared, stateful, sort_key, sort_dir, ...queryInput } = input;
       const network = getNetworkService(ctx);
       if (shared !== void 0) {
         const securityGroups = await fetchSecurityGroupsWithParams(network, {
@@ -39108,7 +40009,7 @@ var securityGroupRouter = {
           sort_key,
           sort_dir
         });
-        return filterBySearchParams(securityGroups, searchTerm, [
+        return filterBySearchParams(filterSecurityGroupsByStateful(securityGroups, stateful), searchTerm, [
           "name",
           "description",
           "id"
@@ -39129,6 +40030,7 @@ var securityGroupRouter = {
         ...ownGroups,
         ...sharedGroups
       ]);
+      combined = filterSecurityGroupsByStateful(combined, stateful);
       combined = filterBySearchParams(combined, searchTerm, [
         "name",
         "description",
@@ -39214,13 +40116,15 @@ var securityGroupRouter = {
 };
 
 // src/server/Network/routers/securityGroupRuleRouter.ts
+var import_signal_openstack9 = __toESM(require_esm());
 var SECURITY_GROUP_RULES_BASE_URL = "v2.0/security-group-rules";
 var securityGroupRuleRouter = {
   delete: projectScopedProcedure.input(deleteSecurityGroupRuleInputSchema).mutation(async ({ input, ctx }) => {
     return withErrorHandling3(async () => {
       const { ruleId } = input;
       const network = getNetworkService(ctx);
-      const response = await network.del(`${SECURITY_GROUP_RULES_BASE_URL}/${ruleId}`);
+      const encodedRuleId = (0, import_signal_openstack9.validateAndEncodeResourceId)(ruleId, "Security group rule");
+      const response = await network.del(`${SECURITY_GROUP_RULES_BASE_URL}/${encodedRuleId}`);
       if (!response?.ok) {
         throw SecurityGroupRuleErrorHandlers.delete(response, ruleId);
       }
@@ -39268,42 +40172,42 @@ var securityGroupRuleRouter = {
 };
 
 // src/server/Network/types/rbacPolicy.ts
-var import_zod24 = require("zod");
-var rbacPolicySchema = import_zod24.z.object({
-  id: import_zod24.z.string(),
-  object_type: import_zod24.z.enum([
+var import_zod23 = require("zod");
+var rbacPolicySchema = import_zod23.z.object({
+  id: import_zod23.z.string(),
+  object_type: import_zod23.z.enum([
     "qos_policy",
     "network",
     "security_group"
   ]),
-  object_id: import_zod24.z.string(),
-  action: import_zod24.z.enum([
+  object_id: import_zod23.z.string(),
+  action: import_zod23.z.enum([
     "access_as_shared",
     "access_as_external"
   ]),
-  target_tenant: import_zod24.z.string(),
-  tenant_id: import_zod24.z.string().nullable().optional(),
-  project_id: import_zod24.z.string().nullable().optional()
+  target_tenant: import_zod23.z.string(),
+  tenant_id: import_zod23.z.string().nullable().optional(),
+  project_id: import_zod23.z.string().nullable().optional()
 });
-var rbacPoliciesResponseSchema = import_zod24.z.object({
-  rbac_policies: import_zod24.z.array(rbacPolicySchema)
+var rbacPoliciesResponseSchema = import_zod23.z.object({
+  rbac_policies: import_zod23.z.array(rbacPolicySchema)
 });
-var rbacPolicyResponseSchema = import_zod24.z.object({
+var rbacPolicyResponseSchema = import_zod23.z.object({
   rbac_policy: rbacPolicySchema
 });
 var listRBACPoliciesForSecurityGroupInputSchema = projectScopedInputSchema.extend({
-  securityGroupId: import_zod24.z.string()
+  securityGroupId: import_zod23.z.string()
 });
 var createRBACPolicyInputSchema = projectScopedInputSchema.extend({
-  securityGroupId: import_zod24.z.string(),
-  targetTenant: import_zod24.z.string().trim().min(1, "Target project ID is required")
+  securityGroupId: import_zod23.z.string(),
+  targetTenant: import_zod23.z.string().trim().min(1, "Target project ID is required")
 });
 var updateRBACPolicyInputSchema = projectScopedInputSchema.extend({
-  policyId: import_zod24.z.string(),
-  targetTenant: import_zod24.z.string().trim().min(1, "Target project ID is required")
+  policyId: import_zod23.z.string(),
+  targetTenant: import_zod23.z.string().trim().min(1, "Target project ID is required")
 });
 var deleteRBACPolicyInputSchema = projectScopedInputSchema.extend({
-  policyId: import_zod24.z.string()
+  policyId: import_zod23.z.string()
 });
 
 // src/server/Network/helpers/rbacPolicyHelpers.ts
@@ -39461,6 +40365,7 @@ function parseRBACPoliciesListResponse(data, operation) {
 __name(parseRBACPoliciesListResponse, "parseRBACPoliciesListResponse");
 
 // src/server/Network/routers/rbacPolicyRouter.ts
+var import_signal_openstack10 = __toESM(require_esm());
 var RBAC_POLICIES_BASE_URL = "v2.0/rbac-policies";
 var rbacPolicyRouter = {
   list: projectScopedProcedure.input(listRBACPoliciesForSecurityGroupInputSchema).query(async ({ input, ctx }) => {
@@ -39509,7 +40414,8 @@ var rbacPolicyRouter = {
           target_tenant: targetTenant
         }
       };
-      const response = await network.put(`${RBAC_POLICIES_BASE_URL}/${policyId}`, requestBody);
+      const encodedPolicyId = (0, import_signal_openstack10.validateAndEncodeResourceId)(policyId, "RBAC policy");
+      const response = await network.put(`${RBAC_POLICIES_BASE_URL}/${encodedPolicyId}`, requestBody);
       if (!response.ok) {
         throw RBACPolicyErrorHandlers.update(response, policyId);
       }
@@ -39521,7 +40427,8 @@ var rbacPolicyRouter = {
     return withErrorHandling3(async () => {
       const { policyId } = input;
       const network = getNetworkService(ctx);
-      const response = await network.del(`${RBAC_POLICIES_BASE_URL}/${policyId}`);
+      const encodedPolicyId = (0, import_signal_openstack10.validateAndEncodeResourceId)(policyId, "RBAC policy");
+      const response = await network.del(`${RBAC_POLICIES_BASE_URL}/${encodedPolicyId}`);
       if (!response.ok) {
         throw RBACPolicyErrorHandlers.delete(response, policyId);
       }
@@ -39686,10 +40593,6 @@ var NETWORK_MAPPINGS = {
     engine: "network",
     rule: "create_security_group_rule"
   },
-  "network:security_group_rules:update": {
-    engine: "network",
-    rule: "update_security_group_rule"
-  },
   "network:security_group_rules:delete": {
     engine: "network",
     rule: "delete_security_group_rule"
@@ -39766,7 +40669,7 @@ var buildAppRouter = /* @__PURE__ */ __name((policyDir, extraRouters = []) => {
 }, "buildAppRouter");
 
 // src/server/context.ts
-var import_signal_openstack9 = __toESM(require_esm());
+var import_signal_openstack11 = __toESM(require_esm());
 
 // src/server/sessionCookie.ts
 var import_cookie = require("@fastify/cookie");
@@ -39854,7 +40757,7 @@ async function createContext(opts, config) {
     writable: false
   });
   if (currentAuthToken) {
-    openstackSession = await (0, import_signal_openstack9.SignalOpenstackSession)(normalizedEndpoint, {
+    openstackSession = await (0, import_signal_openstack11.SignalOpenstackSession)(normalizedEndpoint, {
       auth: {
         identity: {
           methods: [
@@ -39917,7 +40820,7 @@ async function createContext(opts, config) {
     }
   }, "getUserInfo");
   const createSession = /* @__PURE__ */ __name(async (params) => {
-    openstackSession = await (0, import_signal_openstack9.SignalOpenstackSession)(normalizedEndpoint, {
+    openstackSession = await (0, import_signal_openstack11.SignalOpenstackSession)(normalizedEndpoint, {
       auth: {
         identity: {
           methods: [
@@ -40061,7 +40964,7 @@ __name(createContext, "createContext");
 // src/server/server.ts
 var import_path2 = __toESM(require("path"));
 var import_node_stream4 = require("stream");
-var import_zod25 = require("zod");
+var import_zod24 = require("zod");
 
 // src/server/aurora-fastify-plugins/csrfProtection.ts
 var import_csrf_protection = __toESM(require("@fastify/csrf-protection"));
@@ -40262,7 +41165,7 @@ async function createServer(config) {
       router: appRouter,
       createContext: /* @__PURE__ */ __name((opts) => createContext(opts, contextConfig), "createContext"),
       onError: /* @__PURE__ */ __name((err) => {
-        if (err.error.cause instanceof import_zod25.ZodError) err.error.message = err.error.cause.issues.map((e) => e.message).join(",");
+        if (err.error.cause instanceof import_zod24.ZodError) err.error.message = err.error.cause.issues.map((e) => e.message).join(",");
       }, "onError")
     }
   });