@cobaltcore-dev/aurora 2.1.1 → 2.2.0

package/dist/server/index.d.ts

@@ -2,13 +2,13 @@ import * as fastify from 'fastify';
 import { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
 import * as _trpc_server from '@trpc/server';
 import { AnyRouter } from '@trpc/server';
+import * as zod from 'zod';
+import { z, ZodTypeAny, output } from 'zod';
 import * as _cobaltcore_dev_signal_openstack from '@cobaltcore-dev/signal-openstack';
 import { SignalOpenstackSessionType } from '@cobaltcore-dev/signal-openstack';
 import * as _cobaltcore_dev_signal_openstack_dist_types_client from '@cobaltcore-dev/signal-openstack/dist/types/client';
 import * as fastify_types_type_provider from 'fastify/types/type-provider';
 import * as http from 'http';
-import * as zod from 'zod';
-import { z, ZodTypeAny, output } from 'zod';
 import * as _trpc_server_http from '@trpc/server/http';
 
 declare module "fastify" {
@@ -17,6 +17,133 @@ declare module "fastify" {
     }
 }
 
+/**
+ * Canonical list of the UI extension points a consumer can register components for.
+ *
+ * Declared as a runtime array (rather than a bare type) so it can drive both the
+ * {@link SlotName} type and runtime validation (see `auroraAppConfigSchema`). Kept in this
+ * JSX-free module so the server build can consume it; a compile-time guard in
+ * `client/AuroraApp.tsx` keeps it in lockstep with the keys of the `Slots` type.
+ */
+declare const SLOT_NAMES: readonly ["logo", "login", "pageFooter", "sideNavBanner", "serviceBadge", "servicePageActions", "projectsBanner", "serviceBanner"];
+/** Names of the UI extension points a consumer can register components for. */
+type SlotName = (typeof SLOT_NAMES)[number];
+/**
+ * An open, consumer-typed bag of flags/values. Aurora never introspects its contents.
+ * Consumers narrow this via the generic parameters on {@link AuroraAppConfig}.
+ */
+type FeatureBag = Record<string, unknown>;
+/**
+ * Per-slot runtime data bag, e.g. `{ text: "Maintenance tonight" }` for a banner slot.
+ * Carried in {@link AppConfigBase.slotSettings}; it never affects whether a slot renders.
+ */
+type SlotConfigEntry = Record<string, unknown>;
+/**
+ * Map of service key to that service's settings bag. Supplied by the consumer via the
+ * `TServices` generic to get precise, typo-checked per-service settings. Each entry is the
+ * settings object itself (a flat bag), symmetric with {@link SlotConfigEntry}.
+ */
+type ServiceFeatureMap = Record<string, FeatureBag>;
+/**
+ * Visibility rule for one dimension (services or slots). The base layer declares the
+ * posture explicitly:
+ * - `allowlist`: nothing shows unless its key is in `allow`.
+ * - `denylist`: everything shows unless its key is in `deny`.
+ *
+ * Omit the rule entirely for default-open (every service/slot shows). Because posture is a
+ * discriminated union on `mode`, only the list that posture makes meaningful is accepted,
+ * so an `allow` and a `deny` list can never be present at the same time. Switching posture
+ * is a one-field edit: change `mode` and rename the list.
+ */
+type Visibility<TKey extends string = string> = {
+    mode: "allowlist";
+    allow: TKey[];
+} | {
+    mode: "denylist";
+    deny: TKey[];
+};
+/**
+ * Membership change a domain override applies on top of the base layer's visibility.
+ * `enable` makes a key visible for the domain, `disable` hides it, regardless of the base
+ * posture. Overrides carry no `mode`, so they can never flip the posture the base pinned.
+ * When a key is in both, `disable` wins.
+ */
+interface VisibilityDelta<TKey extends string = string> {
+    enable?: TKey[];
+    disable?: TKey[];
+}
+/**
+ * The base configuration layer. The resolved result shares this shape (overrides folded in
+ * and stripped out). Visibility and settings are independent axes: `services`/`slots` decide
+ * what renders, while `serviceSettings`/`slotSettings`/`features` carry data and never gate.
+ */
+interface AppConfigBase<TServices extends ServiceFeatureMap = ServiceFeatureMap, TFeatures extends FeatureBag = FeatureBag> {
+    /** Which services render. Omit for default-open (all catalog services). */
+    services?: Visibility<Extract<keyof TServices, string>>;
+    /** Which slots render. Omit for default-open (all registered slots). */
+    slots?: Visibility<SlotName>;
+    /** Per-service settings bags, independent of visibility. Deep-merged across overrides. */
+    serviceSettings?: {
+        [K in keyof TServices]?: TServices[K];
+    };
+    /** Per-slot data bags (e.g. banner text), independent of visibility. Deep-merged across overrides. */
+    slotSettings?: Partial<Record<SlotName, SlotConfigEntry>>;
+    /** App-wide, consumer-typed feature flags. Deep-merged across overrides. */
+    features?: TFeatures;
+}
+/** A base layer applies to every domain; an override applies only to matching domains. */
+interface DomainOverride<TServices extends ServiceFeatureMap = ServiceFeatureMap, TFeatures extends FeatureBag = FeatureBag> {
+    /** Human-readable label. Used only for logging and debugging. */
+    name?: string;
+    /**
+     * Matched against the user's home domain name. A string is compiled to a RegExp;
+     * a RegExp literal is preferred because it is validated at compile time.
+     */
+    domain: string | RegExp;
+    /** Enable/disable services for this domain. Cannot change the base posture. */
+    services?: VisibilityDelta<Extract<keyof TServices, string>>;
+    /** Enable/disable slots for this domain. Cannot change the base posture. */
+    slots?: VisibilityDelta<SlotName>;
+    serviceSettings?: {
+        [K in keyof TServices]?: TServices[K];
+    };
+    slotSettings?: Partial<Record<SlotName, SlotConfigEntry>>;
+    features?: TFeatures;
+}
+/**
+ * The full domain configuration a consumer passes to `createServer`.
+ *
+ * The top-level fields form the base layer that applies to every domain. `overrides` are
+ * applied on top for domains whose name matches, in array order, with later matches winning.
+ * `services`/`slots` fold each override's enable/disable deltas onto the base-pinned posture;
+ * `serviceSettings`/`slotSettings`/`features` deep-merge per key.
+ *
+ * Everything is optional: with no config at all, the resolved result is empty and Aurora
+ * behaves in its default-open state (all implemented services, all registered slots).
+ *
+ * @example
+ * ```ts
+ * const config: AuroraAppConfig = {
+ *   services: { mode: "allowlist", allow: ["ceph-containers", "images"] },
+ *   slots: { mode: "denylist", deny: ["projectsBanner"] },
+ *   serviceSettings: { images: { showAdvancedOptions: true } },
+ *   features: { termsAndConditionsUrl: "https://example.com/terms" },
+ *   overrides: [
+ *     { name: "acme", domain: /^acme-/, services: { enable: ["flavors"], disable: ["images"] } },
+ *   ],
+ * }
+ * ```
+ */
+interface AuroraAppConfig<TServices extends ServiceFeatureMap = ServiceFeatureMap, TFeatures extends FeatureBag = FeatureBag> extends AppConfigBase<TServices, TFeatures> {
+    overrides?: DomainOverride<TServices, TFeatures>[];
+}
+/**
+ * The merged result for a single domain: a base layer with the overrides already applied and
+ * stripped out. This is what the BFF returns to the client and what custom BFF procedures
+ * read from `ctx.appConfig`. It never contains `overrides` or a RegExp, so it is wire-safe.
+ */
+type ResolvedAppConfig<TServices extends ServiceFeatureMap = ServiceFeatureMap, TFeatures extends FeatureBag = FeatureBag> = AppConfigBase<TServices, TFeatures>;
+
 interface AuroraServerConfig {
     bffEndpoint?: string;
     viteRoot?: string;
@@ -85,10 +212,128 @@ interface AuroraServerConfig {
      * ```
      */
     routers?: AnyRouter[];
+    /**
+     * Optional per-domain configuration. When provided, the BFF resolves it for the
+     * logged-in user's home domain and exposes the merged result via the `appConfig.get`
+     * procedure and on `ctx.appConfig` for custom procedures. When omitted, Aurora stays
+     * in its default-open state (all implemented services, all registered slots).
+     */
+    appConfig?: AuroraAppConfig;
 }
 
 declare function createServer(config: AuroraServerConfig): Promise<FastifyInstance>;
 
+/**
+ * Resolve a consumer's domain configuration for one domain.
+ *
+ * Starts from the base layer (the config's top-level fields), then applies every override
+ * whose `domain` matches `domainName`, in array order. For each override: `services` and
+ * `slots` deltas fold onto the base-pinned posture (see {@link foldVisibility}); and
+ * `serviceSettings`, `slotSettings`, `features` deep-merge per key. When `domainName` is
+ * undefined (e.g. an unauthenticated request, where no domain is known yet) no override
+ * matches and only the base layer is returned.
+ *
+ * The returned object never contains `overrides` or any RegExp, so it is safe to send over
+ * the wire to the client.
+ */
+declare function resolveAppConfig<TServices extends ServiceFeatureMap = ServiceFeatureMap, TFeatures extends FeatureBag = FeatureBag>(config: AuroraAppConfig<TServices, TFeatures>, domainName?: string): ResolvedAppConfig<TServices, TFeatures>;
+
+/**
+ * Builds a Zod schema for the {@link AuroraAppConfig} envelope, for validating configuration
+ * loaded at runtime from an external source (e.g. a Kubernetes ConfigMap mounted as YAML).
+ *
+ * The envelope (service/slot visibility, settings maps, overrides, domain matchers) is owned
+ * and validated by Aurora. The consumer-specific `features` bag is validated by the schema
+ * passed in `featuresSchema`; when omitted it is accepted as an open record. Per-service
+ * `features` are always accepted as an open record (consumers validate those themselves).
+ *
+ * Visibility is a discriminated union on `mode`, so `allowlist` accepts only an `allow` list
+ * and `denylist` only a `deny` list; the two can never coexist. `domain` is validated as a
+ * string (YAML cannot express a RegExp) and checked to be a compilable regular expression.
+ * Unknown keys are rejected so a typo in a ConfigMap fails fast at boot.
+ *
+ * @example
+ * ```ts
+ * const sciFeatures = z.object({ termsAndConditionsUrl: z.string().optional() })
+ * const schema = auroraAppConfigSchema(sciFeatures)
+ * const appConfig = schema.parse(parsedYaml)
+ * ```
+ */
+declare function auroraAppConfigSchema(featuresSchema?: z.ZodType): z.ZodObject<{
+    overrides: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        domain: z.ZodString;
+        services: z.ZodOptional<z.ZodObject<{
+            enable: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            disable: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        slots: z.ZodOptional<z.ZodObject<{
+            enable: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                logo: "logo";
+                login: "login";
+                pageFooter: "pageFooter";
+                sideNavBanner: "sideNavBanner";
+                serviceBadge: "serviceBadge";
+                servicePageActions: "servicePageActions";
+                projectsBanner: "projectsBanner";
+                serviceBanner: "serviceBanner";
+            }>>>;
+            disable: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                logo: "logo";
+                login: "login";
+                pageFooter: "pageFooter";
+                sideNavBanner: "sideNavBanner";
+                serviceBadge: "serviceBadge";
+                servicePageActions: "servicePageActions";
+                projectsBanner: "projectsBanner";
+                serviceBanner: "serviceBanner";
+            }>>>;
+        }, z.core.$strict>>;
+        serviceSettings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+        slotSettings: z.ZodOptional<z.ZodObject<{
+            [x: string]: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>>;
+        features: z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+    }, z.core.$strict>>>;
+    services: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"allowlist">;
+        allow: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"denylist">;
+        deny: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>], "mode">>;
+    slots: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"allowlist">;
+        allow: z.ZodArray<z.ZodEnum<{
+            logo: "logo";
+            login: "login";
+            pageFooter: "pageFooter";
+            sideNavBanner: "sideNavBanner";
+            serviceBadge: "serviceBadge";
+            servicePageActions: "servicePageActions";
+            projectsBanner: "projectsBanner";
+            serviceBanner: "serviceBanner";
+        }>>;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"denylist">;
+        deny: z.ZodArray<z.ZodEnum<{
+            logo: "logo";
+            login: "login";
+            pageFooter: "pageFooter";
+            sideNavBanner: "sideNavBanner";
+            serviceBadge: "serviceBadge";
+            servicePageActions: "servicePageActions";
+            projectsBanner: "projectsBanner";
+            serviceBanner: "serviceBanner";
+        }>>;
+    }, z.core.$strict>], "mode">>;
+    serviceSettings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    slotSettings: z.ZodOptional<z.ZodObject<{
+        [x: string]: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+    features: z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+}, z.core.$strict>;
+
 interface AuroraContext {
     validateSession: () => boolean;
     openstack?: Awaited<SignalOpenstackSessionType>;
@@ -113,6 +358,12 @@ interface AuroraPortalContext extends AuroraContext {
     cephRegion?: string;
     /** Parsed list of image metadata keys excluded from the UI */
     imageMetadataExcludedProperties: string[];
+    /**
+     * Per-domain configuration resolved for the current user's home domain. Undefined when
+     * the consumer supplied no `appConfig`. For unauthenticated requests this holds the
+     * base layer only (no domain is known yet).
+     */
+    appConfig?: ResolvedAppConfig;
     createSession: (params: {
         user: string;
         password: string;
@@ -148,6 +399,7 @@ declare const protectedProcedure: _trpc_server.TRPCProcedureBuilder<AuroraPortal
     }) => Promise<Awaited<_cobaltcore_dev_signal_openstack.SignalOpenstackSessionType | null>>;
     identityEndpoint: string;
     cephRegion: string | undefined;
+    appConfig: ResolvedAppConfig | undefined;
     terminateSession: () => Promise<void>;
     validateSession: () => boolean;
     openstack: {
@@ -322,6 +574,7 @@ declare const projectScopedProcedure: _trpc_server.TRPCProcedureBuilder<AuroraPo
     }) => Promise<Awaited<_cobaltcore_dev_signal_openstack.SignalOpenstackSessionType | null>>;
     identityEndpoint: string;
     cephRegion: string | undefined;
+    appConfig: ResolvedAppConfig | undefined;
     terminateSession: () => Promise<void>;
     validateSession: () => boolean;
     openstack: {
@@ -498,6 +751,7 @@ declare const domainScopedProcedure: _trpc_server.TRPCProcedureBuilder<AuroraPor
     }) => Promise<Awaited<_cobaltcore_dev_signal_openstack.SignalOpenstackSessionType | null>>;
     identityEndpoint: string;
     cephRegion: string | undefined;
+    appConfig: ResolvedAppConfig | undefined;
     terminateSession: () => Promise<void>;
     validateSession: () => boolean;
     openstack: {
@@ -653,12 +907,148 @@ interface ListVersionsOutput {
     maxKeys?: number;
 }
 
+declare const ExternalFixedIpSchema: z.ZodObject<{
+    subnet_id: z.ZodString;
+    ip_address: z.ZodString;
+}, z.core.$strip>;
+declare const ExternalGatewayInfoSchema: z.ZodObject<{
+    network_id: z.ZodString;
+    enable_snat: z.ZodOptional<z.ZodBoolean>;
+    external_fixed_ips: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        subnet_id: z.ZodString;
+        ip_address: z.ZodString;
+    }, z.core.$strip>>>;
+    qos_policy_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+declare const RouterSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodDefault<z.ZodString>;
+    description: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    status: z.ZodString;
+    admin_state_up: z.ZodBoolean;
+    external_gateway_info: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        network_id: z.ZodString;
+        enable_snat: z.ZodOptional<z.ZodBoolean>;
+        external_fixed_ips: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            subnet_id: z.ZodString;
+            ip_address: z.ZodString;
+        }, z.core.$strip>>>;
+        qos_policy_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
+    routes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
+        destination: z.ZodString;
+        nexthop: z.ZodString;
+    }, z.core.$strip>>>>;
+    distributed: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    ha: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    enable_ndp_proxy: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    enable_default_route_bfd: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    enable_default_route_ecmp: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    availability_zone_hints: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    availability_zones: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    flavor_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    project_id: z.ZodString;
+    tenant_id: z.ZodOptional<z.ZodString>;
+    revision_number: z.ZodOptional<z.ZodNumber>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    created_at: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "ISO8601Timestamp", "out">>;
+    updated_at: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "ISO8601Timestamp", "out">>;
+}, z.core.$strip>;
+declare const RouterPortSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    network_id: z.ZodString;
+    device_owner: z.ZodString;
+    status: z.ZodEnum<{
+        DOWN: "DOWN";
+        ACTIVE: "ACTIVE";
+        BUILD: "BUILD";
+        ERROR: "ERROR";
+    }>;
+    admin_state_up: z.ZodOptional<z.ZodBoolean>;
+    mac_address: z.ZodOptional<z.ZodString>;
+    fixed_ips: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
+        subnet_id: z.ZodString;
+        ip_address: z.ZodString;
+    }, z.core.$strip>>>>;
+}, z.core.$strip>;
+type Router = z.infer<typeof RouterSchema>;
+type ExternalGatewayInfo = z.infer<typeof ExternalGatewayInfoSchema>;
+type RouterPort = z.infer<typeof RouterPortSchema>;
+type ExternalFixedIp = z.infer<typeof ExternalFixedIpSchema>;
+/**
+ * Router as returned by `list`: the external gateway is enriched with the external network name
+ * and the subnet names of its fixed IPs, and the router's private networks are added.
+ * Names are undefined when they can't be resolved.
+ */
+type RouterListItem = Omit<Router, "external_gateway_info"> & {
+    external_gateway_info?: (Omit<ExternalGatewayInfo, "external_fixed_ips"> & {
+        network_name?: string;
+        external_fixed_ips?: Array<ExternalFixedIp & {
+            subnet_name?: string;
+        }>;
+    }) | null;
+    /**
+     * Internal (private) networks the router is attached to via interfaces, deduplicated.
+     * `[]` = no interfaces, `undefined` = interfaces could not be resolved.
+     */
+    private_networks?: RouterPrivateNetwork[];
+};
+/** Router as returned by `getById`: external gateway enriched with network and subnet names. */
+type RouterDetails = Omit<RouterListItem, "private_networks">;
+/** A private network attached to a router via an interface port. */
+interface RouterPrivateNetwork {
+    network_id: string;
+    network_name?: string;
+}
+/** Router interface as returned to the UI: a port enriched with network name and subnet name/CIDR */
+interface RouterInterface {
+    port_id: string;
+    port_name: string;
+    network_id: string;
+    /** Undefined when the network name can't be resolved */
+    network_name?: string;
+    device_owner: string;
+    status: RouterPort["status"];
+    admin_state_up?: boolean;
+    mac_address?: string;
+    fixed_ips: Array<{
+        subnet_id: string;
+        subnet_name?: string;
+        subnet_cidr?: string;
+        ip_address: string;
+    }>;
+}
+/** Which router-related Neutron extensions are enabled — drives conditional UI sections */
+interface RouterExtensionFlags {
+    dvr: boolean;
+    l3Ha: boolean;
+    extraRoute: boolean;
+    extGwMode: boolean;
+    ndpProxy: boolean;
+    externalGatewayMultihoming: boolean;
+    availabilityZone: boolean;
+}
+
 declare const buildBaseRouter: (policyDir: string) => _trpc_server.TRPCBuiltRouter<{
     ctx: AuroraPortalContext;
     meta: object;
     errorShape: _trpc_server.TRPCDefaultErrorShape;
     transformer: false;
 }, _trpc_server.TRPCDecorateCreateRouterOptions<{
+    appConfig: _trpc_server.TRPCBuiltRouter<{
+        ctx: AuroraPortalContext;
+        meta: object;
+        errorShape: _trpc_server.TRPCDefaultErrorShape;
+        transformer: false;
+    }, _trpc_server.TRPCDecorateCreateRouterOptions<{
+        get: _trpc_server.TRPCQueryProcedure<{
+            input: void;
+            output: ResolvedAppConfig;
+            meta: object;
+        }>;
+    }>>;
+}> & _trpc_server.TRPCDecorateCreateRouterOptions<{
     network: _trpc_server.TRPCBuiltRouter<{
         ctx: AuroraPortalContext;
         meta: object;
@@ -1237,6 +1627,292 @@ declare const buildBaseRouter: (policyDir: string) => _trpc_server.TRPCBuiltRout
                 meta: object;
             }>;
         };
+        routers: {
+            list: _trpc_server.TRPCQueryProcedure<{
+                input: {
+                    project_id: string;
+                    name?: string | undefined;
+                    description?: string | undefined;
+                    admin_state_up?: boolean | undefined;
+                    sort_key?: "id" | "name" | "project_id" | "status" | "tenant_id" | "admin_state_up" | "flavor_id" | undefined;
+                    sort_dir?: "asc" | "desc" | undefined;
+                    tags?: string | undefined;
+                    tags_any?: string | undefined;
+                    not_tags?: string | undefined;
+                    not_tags_any?: string | undefined;
+                    searchTerm?: string | undefined;
+                    status?: string | undefined;
+                    has_gateway?: boolean | undefined;
+                };
+                output: RouterListItem[];
+                meta: object;
+            }>;
+            getById: _trpc_server.TRPCQueryProcedure<{
+                input: {
+                    project_id: string;
+                    router_id: string;
+                };
+                output: RouterDetails;
+                meta: object;
+            }>;
+            create: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    project_id: string;
+                    name: string;
+                    description?: string | undefined;
+                    admin_state_up?: boolean | undefined;
+                    external_gateway_info?: {
+                        network_id: string;
+                        enable_snat?: boolean | undefined;
+                        external_fixed_ips?: {
+                            subnet_id?: string | undefined;
+                            ip_address?: string | undefined;
+                        }[] | undefined;
+                    } | undefined;
+                    distributed?: boolean | undefined;
+                    ha?: boolean | undefined;
+                    availability_zone_hints?: string[] | undefined;
+                    enable_ndp_proxy?: boolean | undefined;
+                };
+                output: {
+                    id: string;
+                    name: string;
+                    description: string;
+                    status: string;
+                    admin_state_up: boolean;
+                    routes: {
+                        destination: string;
+                        nexthop: string;
+                    }[];
+                    project_id: string;
+                    external_gateway_info?: {
+                        network_id: string;
+                        enable_snat?: boolean | undefined;
+                        external_fixed_ips?: {
+                            subnet_id: string;
+                            ip_address: string;
+                        }[] | undefined;
+                        qos_policy_id?: string | null | undefined;
+                    } | null | undefined;
+                    distributed?: boolean | null | undefined;
+                    ha?: boolean | null | undefined;
+                    enable_ndp_proxy?: boolean | null | undefined;
+                    enable_default_route_bfd?: boolean | null | undefined;
+                    enable_default_route_ecmp?: boolean | null | undefined;
+                    availability_zone_hints?: string[] | undefined;
+                    availability_zones?: string[] | undefined;
+                    flavor_id?: string | null | undefined;
+                    tenant_id?: string | undefined;
+                    revision_number?: number | undefined;
+                    tags?: string[] | undefined;
+                    created_at?: (string & zod.$brand<"ISO8601Timestamp">) | undefined;
+                    updated_at?: (string & zod.$brand<"ISO8601Timestamp">) | undefined;
+                };
+                meta: object;
+            }>;
+            update: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    project_id: string;
+                    router_id: string;
+                    name?: string | undefined;
+                    description?: string | undefined;
+                    admin_state_up?: boolean | undefined;
+                    routes?: {
+                        destination: string;
+                        nexthop: string;
+                    }[] | undefined;
+                    distributed?: boolean | undefined;
+                    ha?: boolean | undefined;
+                    enable_ndp_proxy?: boolean | undefined;
+                };
+                output: {
+                    id: string;
+                    name: string;
+                    description: string;
+                    status: string;
+                    admin_state_up: boolean;
+                    routes: {
+                        destination: string;
+                        nexthop: string;
+                    }[];
+                    project_id: string;
+                    external_gateway_info?: {
+                        network_id: string;
+                        enable_snat?: boolean | undefined;
+                        external_fixed_ips?: {
+                            subnet_id: string;
+                            ip_address: string;
+                        }[] | undefined;
+                        qos_policy_id?: string | null | undefined;
+                    } | null | undefined;
+                    distributed?: boolean | null | undefined;
+                    ha?: boolean | null | undefined;
+                    enable_ndp_proxy?: boolean | null | undefined;
+                    enable_default_route_bfd?: boolean | null | undefined;
+                    enable_default_route_ecmp?: boolean | null | undefined;
+                    availability_zone_hints?: string[] | undefined;
+                    availability_zones?: string[] | undefined;
+                    flavor_id?: string | null | undefined;
+                    tenant_id?: string | undefined;
+                    revision_number?: number | undefined;
+                    tags?: string[] | undefined;
+                    created_at?: (string & zod.$brand<"ISO8601Timestamp">) | undefined;
+                    updated_at?: (string & zod.$brand<"ISO8601Timestamp">) | undefined;
+                };
+                meta: object;
+            }>;
+            setGateway: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    project_id: string;
+                    router_id: string;
+                    external_gateway_info: {
+                        network_id: string;
+                        enable_snat?: boolean | undefined;
+                        external_fixed_ips?: {
+                            subnet_id?: string | undefined;
+                            ip_address?: string | undefined;
+                        }[] | undefined;
+                    };
+                };
+                output: {
+                    id: string;
+                    name: string;
+                    description: string;
+                    status: string;
+                    admin_state_up: boolean;
+                    routes: {
+                        destination: string;
+                        nexthop: string;
+                    }[];
+                    project_id: string;
+                    external_gateway_info?: {
+                        network_id: string;
+                        enable_snat?: boolean | undefined;
+                        external_fixed_ips?: {
+                            subnet_id: string;
+                            ip_address: string;
+                        }[] | undefined;
+                        qos_policy_id?: string | null | undefined;
+                    } | null | undefined;
+                    distributed?: boolean | null | undefined;
+                    ha?: boolean | null | undefined;
+                    enable_ndp_proxy?: boolean | null | undefined;
+                    enable_default_route_bfd?: boolean | null | undefined;
+                    enable_default_route_ecmp?: boolean | null | undefined;
+                    availability_zone_hints?: string[] | undefined;
+                    availability_zones?: string[] | undefined;
+                    flavor_id?: string | null | undefined;
+                    tenant_id?: string | undefined;
+                    revision_number?: number | undefined;
+                    tags?: string[] | undefined;
+                    created_at?: (string & zod.$brand<"ISO8601Timestamp">) | undefined;
+                    updated_at?: (string & zod.$brand<"ISO8601Timestamp">) | undefined;
+                };
+                meta: object;
+            }>;
+            clearGateway: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    project_id: string;
+                    router_id: string;
+                };
+                output: {
+                    id: string;
+                    name: string;
+                    description: string;
+                    status: string;
+                    admin_state_up: boolean;
+                    routes: {
+                        destination: string;
+                        nexthop: string;
+                    }[];
+                    project_id: string;
+                    external_gateway_info?: {
+                        network_id: string;
+                        enable_snat?: boolean | undefined;
+                        external_fixed_ips?: {
+                            subnet_id: string;
+                            ip_address: string;
+                        }[] | undefined;
+                        qos_policy_id?: string | null | undefined;
+                    } | null | undefined;
+                    distributed?: boolean | null | undefined;
+                    ha?: boolean | null | undefined;
+                    enable_ndp_proxy?: boolean | null | undefined;
+                    enable_default_route_bfd?: boolean | null | undefined;
+                    enable_default_route_ecmp?: boolean | null | undefined;
+                    availability_zone_hints?: string[] | undefined;
+                    availability_zones?: string[] | undefined;
+                    flavor_id?: string | null | undefined;
+                    tenant_id?: string | undefined;
+                    revision_number?: number | undefined;
+                    tags?: string[] | undefined;
+                    created_at?: (string & zod.$brand<"ISO8601Timestamp">) | undefined;
+                    updated_at?: (string & zod.$brand<"ISO8601Timestamp">) | undefined;
+                };
+                meta: object;
+            }>;
+            addInterface: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    project_id: string;
+                    router_id: string;
+                    subnet_id?: string | undefined;
+                    port_id?: string | undefined;
+                };
+                output: {
+                    id: string;
+                    port_id: string;
+                    subnet_id?: string | undefined;
+                    subnet_ids?: string[] | undefined;
+                    network_id?: string | undefined;
+                    project_id?: string | undefined;
+                    tenant_id?: string | undefined;
+                    tags?: string[] | undefined;
+                };
+                meta: object;
+            }>;
+            removeInterface: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    project_id: string;
+                    router_id: string;
+                    subnet_id?: string | undefined;
+                    port_id?: string | undefined;
+                };
+                output: {
+                    id: string;
+                    port_id: string;
+                    subnet_id?: string | undefined;
+                    subnet_ids?: string[] | undefined;
+                    network_id?: string | undefined;
+                    project_id?: string | undefined;
+                    tenant_id?: string | undefined;
+                    tags?: string[] | undefined;
+                };
+                meta: object;
+            }>;
+            delete: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    project_id: string;
+                    router_id: string;
+                };
+                output: boolean;
+                meta: object;
+            }>;
+            listInterfaces: _trpc_server.TRPCQueryProcedure<{
+                input: {
+                    project_id: string;
+                    router_id: string;
+                };
+                output: RouterInterface[];
+                meta: object;
+            }>;
+            listExtensions: _trpc_server.TRPCQueryProcedure<{
+                input: {
+                    project_id: string;
+                };
+                output: RouterExtensionFlags;
+                meta: object;
+            }>;
+        };
     }>>;
 }> & _trpc_server.TRPCDecorateCreateRouterOptions<{
     project: _trpc_server.TRPCBuiltRouter<{
@@ -1877,6 +2553,19 @@ declare const buildBaseRouter: (policyDir: string) => _trpc_server.TRPCBuiltRout
                     input: {
                         project_id: string;
                     };
+                    output: {
+                        id: string;
+                        access: string;
+                        user_id: string;
+                        project_id: string;
+                    };
+                    meta: object;
+                }>;
+                reveal: _trpc_server.TRPCMutationProcedure<{
+                    input: {
+                        project_id: string;
+                        credentialId: string;
+                    };
                     output: {
                         id: string;
                         access: string;
@@ -1909,6 +2598,8 @@ declare const buildBaseRouter: (policyDir: string) => _trpc_server.TRPCBuiltRout
                     };
                     output: {
                         hasCredentials: boolean;
+                        endpoint: string;
+                        region: string;
                     };
                     meta: object;
                 }>;
@@ -3736,4 +4427,4 @@ declare function validateOpenstackService(service: unknown, serviceName: string)
  */
 declare const parseOrThrow: <S extends ZodTypeAny>(schema: S, data: unknown, context: string) => output<S>;
 
-export { type AuroraRouter, type AuroraRouterWithCustom, type AuroraServerConfig, auroraRouter, createServer, domainScopedInputSchema, domainScopedProcedure, parseOrThrow, projectScopedInputSchema, projectScopedProcedure, protectedProcedure, publicProcedure, validateOpenstackService };
+export { type AppConfigBase, type AuroraAppConfig, type AuroraRouter, type AuroraRouterWithCustom, type AuroraServerConfig, type DomainOverride, type FeatureBag, type ResolvedAppConfig, SLOT_NAMES, type ServiceFeatureMap, type SlotConfigEntry, type SlotName, type Visibility, type VisibilityDelta, auroraAppConfigSchema, auroraRouter, createServer, domainScopedInputSchema, domainScopedProcedure, parseOrThrow, projectScopedInputSchema, projectScopedProcedure, protectedProcedure, publicProcedure, resolveAppConfig, validateOpenstackService };