@cobaltcore-dev/aurora 2.1.1 → 2.2.0

package/dist/server/index.js

@@ -260,7 +260,7 @@ var require_error = __commonJS({
       }
     };
     exports2.SignalOpenstackError = SignalOpenstackError4;
-    var SignalOpenstackApiError2 = class SignalOpenstackApiError extends Error {
+    var SignalOpenstackApiError4 = class SignalOpenstackApiError extends Error {
       static {
         __name(this, "SignalOpenstackApiError");
       }
@@ -271,7 +271,7 @@ var require_error = __commonJS({
         this.statusCode = statusCode;
       }
     };
-    exports2.SignalOpenstackApiError = SignalOpenstackApiError2;
+    exports2.SignalOpenstackApiError = SignalOpenstackApiError4;
   }
 });
 
@@ -2699,16 +2699,16 @@ var require_request = __commonJS({
           });
         }
       }
-      onBodySent(chunk) {
+      onBodySent(chunk2) {
         if (channels.bodyChunkSent.hasSubscribers) {
           channels.bodyChunkSent.publish({
             request: this,
-            chunk
+            chunk: chunk2
           });
         }
         if (this[kHandler].onBodySent) {
           try {
-            return this[kHandler].onBodySent(chunk);
+            return this[kHandler].onBodySent(chunk2);
           } catch (err) {
             this.abort(err);
           }
@@ -2760,17 +2760,17 @@ var require_request = __commonJS({
           this.abort(err);
         }
       }
-      onData(chunk) {
+      onData(chunk2) {
         assert(!this.aborted);
         assert(!this.completed);
         if (channels.bodyChunkReceived.hasSubscribers) {
           channels.bodyChunkReceived.publish({
             request: this,
-            chunk
+            chunk: chunk2
           });
         }
         try {
-          return this[kHandler].onData(chunk);
+          return this[kHandler].onData(chunk2);
         } catch (err) {
           this.abort(err);
           return false;
@@ -6084,17 +6084,17 @@ var require_util2 = __commonJS({
         const bytes = [];
         let byteLength = 0;
         do {
-          const { done, value: chunk } = await reader.read();
+          const { done, value: chunk2 } = await reader.read();
           if (done) {
             successSteps(Buffer.concat(bytes, byteLength));
             return;
           }
-          if (!isUint8Array(chunk)) {
+          if (!isUint8Array(chunk2)) {
             failureSteps(new TypeError("Received non-Uint8Array chunk"));
             return;
           }
-          bytes.push(chunk);
-          byteLength += chunk.length;
+          bytes.push(chunk2);
+          byteLength += chunk2.length;
         } while (true);
       } catch (e) {
         failureSteps(e);
@@ -6190,18 +6190,18 @@ var require_util2 = __commonJS({
         super();
         this.#zlibOptions = zlibOptions;
       }
-      _transform(chunk, encoding, callback) {
+      _transform(chunk2, encoding, callback) {
         if (!this._inflateStream) {
-          if (chunk.length === 0) {
+          if (chunk2.length === 0) {
             callback();
             return;
           }
-          this._inflateStream = (chunk[0] & 15) === 8 ? zlib.createInflate(this.#zlibOptions) : zlib.createInflateRaw(this.#zlibOptions);
+          this._inflateStream = (chunk2[0] & 15) === 8 ? zlib.createInflate(this.#zlibOptions) : zlib.createInflateRaw(this.#zlibOptions);
           this._inflateStream.on("data", this.push.bind(this));
           this._inflateStream.on("end", () => this.push(null));
           this._inflateStream.on("error", (err) => this.destroy(err));
         }
-        this._inflateStream.write(chunk, encoding, callback);
+        this._inflateStream.write(chunk2, encoding, callback);
       }
       _final(callback) {
         if (this._inflateStream) {
@@ -6957,29 +6957,29 @@ Content-Disposition: form-data`;
         let hasUnknownSizeValue = false;
         for (const [name, value] of object) {
           if (typeof value === "string") {
-            const chunk2 = textEncoder.encode(prefix + `; name="${formdataEscape(normalizeLinefeeds(name))}"\r
+            const chunk3 = textEncoder.encode(prefix + `; name="${formdataEscape(normalizeLinefeeds(name))}"\r
 \r
 ${normalizeLinefeeds(value)}\r
 `);
-            blobParts.push(chunk2);
-            length += chunk2.byteLength;
+            blobParts.push(chunk3);
+            length += chunk3.byteLength;
           } else {
-            const chunk2 = textEncoder.encode(`${prefix}; name="${formdataEscape(normalizeLinefeeds(name))}"` + (value.name ? `; filename="${formdataEscape(value.name)}"` : "") + `\r
+            const chunk3 = textEncoder.encode(`${prefix}; name="${formdataEscape(normalizeLinefeeds(name))}"` + (value.name ? `; filename="${formdataEscape(value.name)}"` : "") + `\r
 Content-Type: ${value.type || "application/octet-stream"}\r
 \r
 `);
-            blobParts.push(chunk2, value, rn);
+            blobParts.push(chunk3, value, rn);
             if (typeof value.size === "number") {
-              length += chunk2.byteLength + value.size + rn.byteLength;
+              length += chunk3.byteLength + value.size + rn.byteLength;
             } else {
               hasUnknownSizeValue = true;
             }
           }
         }
-        const chunk = textEncoder.encode(`--${boundary}--\r
+        const chunk2 = textEncoder.encode(`--${boundary}--\r
 `);
-        blobParts.push(chunk);
-        length += chunk.byteLength;
+        blobParts.push(chunk2);
+        length += chunk2.byteLength;
         if (hasUnknownSizeValue) {
           length = null;
         }
@@ -7385,41 +7385,41 @@ var require_client_h1 = __commonJS({
       }
       readMore() {
         while (!this.paused && this.ptr) {
-          const chunk = this.socket.read();
-          if (chunk === null) {
+          const chunk2 = this.socket.read();
+          if (chunk2 === null) {
             break;
           }
-          this.execute(chunk);
+          this.execute(chunk2);
         }
       }
       /**
       * @param {Buffer} chunk
       */
-      execute(chunk) {
+      execute(chunk2) {
         assert(currentParser === null);
         assert(this.ptr != null);
         assert(!this.paused);
         const { socket, llhttp } = this;
-        if (chunk.length > currentBufferSize) {
+        if (chunk2.length > currentBufferSize) {
           if (currentBufferPtr) {
             llhttp.free(currentBufferPtr);
           }
-          currentBufferSize = Math.ceil(chunk.length / 4096) * 4096;
+          currentBufferSize = Math.ceil(chunk2.length / 4096) * 4096;
           currentBufferPtr = llhttp.malloc(currentBufferSize);
         }
-        new Uint8Array(llhttp.memory.buffer, currentBufferPtr, currentBufferSize).set(chunk);
+        new Uint8Array(llhttp.memory.buffer, currentBufferPtr, currentBufferSize).set(chunk2);
         try {
           let ret;
           try {
-            currentBufferRef = chunk;
+            currentBufferRef = chunk2;
             currentParser = this;
-            ret = llhttp.llhttp_execute(this.ptr, currentBufferPtr, chunk.length);
+            ret = llhttp.llhttp_execute(this.ptr, currentBufferPtr, chunk2.length);
           } finally {
             currentParser = null;
             currentBufferRef = null;
           }
           if (ret !== constants.ERROR.OK) {
-            const data = chunk.subarray(llhttp.llhttp_get_error_pos(this.ptr) - currentBufferPtr);
+            const data = chunk2.subarray(llhttp.llhttp_get_error_pos(this.ptr) - currentBufferPtr);
             if (ret === constants.ERROR.PAUSED_UPGRADE) {
               this.onUpgrade(data);
             } else if (ret === constants.ERROR.PAUSED) {
@@ -8149,12 +8149,12 @@ upgrade: ${upgrade}\r
         expectsPayload,
         header
       });
-      const onData = /* @__PURE__ */ __name(function(chunk) {
+      const onData = /* @__PURE__ */ __name(function(chunk2) {
         if (finished) {
           return;
         }
         try {
-          if (!writer.write(chunk) && this.pause) {
+          if (!writer.write(chunk2) && this.pause) {
             this.pause();
           }
         } catch (err) {
@@ -8301,11 +8301,11 @@ upgrade: ${upgrade}\r
         header
       });
       try {
-        for await (const chunk of body) {
+        for await (const chunk2 of body) {
           if (socket[kError]) {
             throw socket[kError];
           }
-          if (!writer.write(chunk)) {
+          if (!writer.write(chunk2)) {
             await waitForDrain();
           }
         }
@@ -8347,7 +8347,7 @@ upgrade: ${upgrade}\r
       * @param {Buffer} chunk
       * @returns
       */
-      write(chunk) {
+      write(chunk2) {
         const { socket, request, contentLength, client, bytesWritten, expectsPayload, header } = this;
         if (socket[kError]) {
           throw socket[kError];
@@ -8355,7 +8355,7 @@ upgrade: ${upgrade}\r
         if (socket.destroyed) {
           return false;
         }
-        const len = Buffer.byteLength(chunk);
+        const len = Buffer.byteLength(chunk2);
         if (!len) {
           return true;
         }
@@ -8385,9 +8385,9 @@ ${len.toString(16)}\r
 `, "latin1");
         }
         this.bytesWritten += len;
-        const ret = socket.write(chunk);
+        const ret = socket.write(chunk2);
         socket.uncork();
-        request.onBodySent(chunk);
+        request.onBodySent(chunk2);
         if (!ret) {
           if (socket[kParser].timeout && socket[kParser].timeoutType === TIMEOUT_HEADERS) {
             if (socket[kParser].timeout.refresh) {
@@ -8961,11 +8961,11 @@ var require_client_h2 = __commonJS({
         if (request.onHeaders(Number(statusCode), parseH2Headers(realHeaders), stream.resume.bind(stream), "") === false) {
           stream.pause();
         }
-        stream.on("data", (chunk) => {
+        stream.on("data", (chunk2) => {
           if (request.aborted || request.completed) {
             return;
           }
-          if (request.onData(chunk) === false) {
+          if (request.onData(chunk2) === false) {
             stream.pause();
           }
         });
@@ -9080,8 +9080,8 @@ var require_client_h2 = __commonJS({
         }
       });
       util.addListener(pipe, "data", onPipeData);
-      function onPipeData(chunk) {
-        request.onBodySent(chunk);
+      function onPipeData(chunk2) {
+        request.onBodySent(chunk2);
       }
       __name(onPipeData, "onPipeData");
     }
@@ -9129,12 +9129,12 @@ var require_client_h2 = __commonJS({
       }), "waitForDrain");
       h2stream.on("close", onDrain).on("drain", onDrain);
       try {
-        for await (const chunk of body) {
+        for await (const chunk2 of body) {
           if (socket[kError]) {
             throw socket[kError];
           }
-          const res = h2stream.write(chunk);
-          request.onBodySent(chunk);
+          const res = h2stream.write(chunk2);
+          request.onBodySent(chunk2);
           if (!res) {
             await waitForDrain();
           }
@@ -11898,12 +11898,12 @@ var require_retry_handler = __commonJS({
           });
         }
       }
-      onResponseData(controller, chunk) {
+      onResponseData(controller, chunk2) {
         if (this.error) {
           return;
         }
-        this.start += chunk.length;
-        this.handler.onResponseData?.(controller, chunk);
+        this.start += chunk2.length;
+        this.handler.onResponseData?.(controller, chunk2);
       }
       onResponseEnd(controller, trailers) {
         if (this.error && this.retryOpts.throwOnError) {
@@ -12167,15 +12167,15 @@ var require_readable = __commonJS({
       * @param {Buffer|null} chunk
       * @returns {boolean}
       */
-      push(chunk) {
-        if (chunk) {
-          this[kBytesRead] += chunk.length;
+      push(chunk2) {
+        if (chunk2) {
+          this[kBytesRead] += chunk2.length;
           if (this[kConsume]) {
-            consumePush(this[kConsume], chunk);
-            return this[kReading] ? super.push(chunk) : true;
+            consumePush(this[kConsume], chunk2);
+            return this[kReading] ? super.push(chunk2) : true;
           }
         }
-        return super.push(chunk);
+        return super.push(chunk2);
       }
       /**
       * Consumes and returns the body as a string.
@@ -12369,8 +12369,8 @@ var require_readable = __commonJS({
           consumePush(consume2, state.buffer[n]);
         }
       } else {
-        for (const chunk of state.buffer) {
-          consumePush(consume2, chunk);
+        for (const chunk2 of state.buffer) {
+          consumePush(consume2, chunk2);
         }
       }
       if (state.endEmitted) {
@@ -12409,9 +12409,9 @@ var require_readable = __commonJS({
       const buffer = new Uint8Array(Buffer.allocUnsafeSlow(length).buffer);
       let offset = 0;
       for (let i = 0; i < chunks.length; ++i) {
-        const chunk = chunks[i];
-        buffer.set(chunk, offset);
-        offset += chunk.length;
+        const chunk2 = chunks[i];
+        buffer.set(chunk2, offset);
+        offset += chunk2.length;
       }
       return buffer;
     }
@@ -12438,9 +12438,9 @@ var require_readable = __commonJS({
       }
     }
     __name(consumeEnd, "consumeEnd");
-    function consumePush(consume2, chunk) {
-      consume2.length += chunk.length;
-      consume2.body.push(chunk);
+    function consumePush(consume2, chunk2) {
+      consume2.length += chunk2.length;
+      consume2.body.push(chunk2);
     }
     __name(consumePush, "consumePush");
     function consumeFinish(consume2, err) {
@@ -12594,8 +12594,8 @@ var require_api_request = __commonJS({
           }
         }
       }
-      onData(chunk) {
-        return this.res.push(chunk);
+      onData(chunk2) {
+        return this.res.push(chunk2);
       }
       onComplete(trailers) {
         util.parseHeaders(trailers, this.trailers);
@@ -12830,9 +12830,9 @@ var require_api_stream = __commonJS({
         const needDrain = res.writableNeedDrain !== void 0 ? res.writableNeedDrain : res._writableState?.needDrain;
         return needDrain !== true;
       }
-      onData(chunk) {
+      onData(chunk2) {
         const { res } = this;
-        return res ? res.write(chunk) : true;
+        return res ? res.write(chunk2) : true;
       }
       onComplete(trailers) {
         const { res } = this;
@@ -12984,9 +12984,9 @@ var require_api_pipeline = __commonJS({
               body.resume();
             }
           }, "read"),
-          write: /* @__PURE__ */ __name((chunk, encoding, callback) => {
+          write: /* @__PURE__ */ __name((chunk2, encoding, callback) => {
             const { req } = this;
-            if (req.push(chunk, encoding) || req._readableState.destroyed) {
+            if (req.push(chunk2, encoding) || req._readableState.destroyed) {
               callback();
             } else {
               req[kResume] = callback;
@@ -13054,9 +13054,9 @@ var require_api_pipeline = __commonJS({
         if (!body || typeof body.on !== "function") {
           throw new InvalidReturnValueError("expected Readable");
         }
-        body.on("data", (chunk) => {
+        body.on("data", (chunk2) => {
           const { ret, body: body2 } = this;
-          if (!ret.push(chunk) && body2.pause) {
+          if (!ret.push(chunk2) && body2.pause) {
             body2.pause();
           }
         }).on("error", (err) => {
@@ -13073,9 +13073,9 @@ var require_api_pipeline = __commonJS({
         });
         this.body = body;
       }
-      onData(chunk) {
+      onData(chunk2) {
         const { res } = this;
-        return res.push(chunk);
+        return res.push(chunk2);
       }
       onComplete(trailers) {
         const { res } = this;
@@ -14371,8 +14371,8 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       constructor({ disableColors } = {}) {
         this.transform = new Transform4({
-          transform(chunk, _enc, cb) {
-            cb(null, chunk);
+          transform(chunk2, _enc, cb) {
+            cb(null, chunk2);
           }
         });
         this.logger = new Console({
@@ -15183,9 +15183,9 @@ var require_snapshot_agent = __commonJS({
             responseData.headers = headers;
             return handler.onResponseStart(controller, statusCode, headers, statusMessage);
           },
-          onResponseData(controller, chunk) {
-            responseData.body.push(chunk);
-            return handler.onResponseData(controller, chunk);
+          onResponseData(controller, chunk2) {
+            responseData.body.push(chunk2);
+            return handler.onResponseData(controller, chunk2);
           },
           onResponseEnd(controller, trailers) {
             responseData.trailers = trailers;
@@ -15588,10 +15588,10 @@ var require_redirect_handler = __commonJS({
         this.opts.origin = origin;
         this.opts.query = null;
       }
-      onResponseData(controller, chunk) {
+      onResponseData(controller, chunk2) {
         if (this.location) {
         } else {
-          this.handler.onResponseData?.(controller, chunk);
+          this.handler.onResponseData?.(controller, chunk2);
         }
       }
       onResponseEnd(controller, trailers) {
@@ -15709,11 +15709,11 @@ var require_response_error = __commonJS({
           this.#decoder = new TextDecoder("utf-8");
         }
       }
-      onResponseData(controller, chunk) {
+      onResponseData(controller, chunk2) {
         if (this.#statusCode < 400) {
-          return super.onResponseData(controller, chunk);
+          return super.onResponseData(controller, chunk2);
         }
-        this.#body += this.#decoder?.decode(chunk, {
+        this.#body += this.#decoder?.decode(chunk2, {
           stream: true
         }) ?? "";
       }
@@ -15827,8 +15827,8 @@ var require_dump = __commonJS({
       onResponseError(controller, err) {
         super.onResponseError(controller, this.aborted === true ? this.reason : err);
       }
-      onResponseData(controller, chunk) {
-        this.#size = this.#size + chunk.length;
+      onResponseData(controller, chunk2) {
+        this.#size = this.#size + chunk2.length;
         if (this.#size > this.#maxSize) {
           throw new RequestAbortedError(`Response size (${this.#size}) larger than maxSize (${this.#maxSize})`);
         }
@@ -15868,7 +15868,7 @@ var require_dump = __commonJS({
 var require_dns = __commonJS({
   "../../node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/interceptor/dns.js"(exports2, module2) {
     "use strict";
-    var { isIP } = require("net");
+    var { isIP: isIP2 } = require("net");
     var { lookup } = require("dns");
     var DecoratorHandler = require_decorator_handler();
     var { InvalidArgumentError, InformationalError } = require_errors();
@@ -16284,7 +16284,7 @@ var require_dns = __commonJS({
       return (dispatch) => {
         return /* @__PURE__ */ __name(function dnsInterceptor(origDispatchOpts, handler) {
           const origin = origDispatchOpts.origin.constructor === URL ? origDispatchOpts.origin : new URL(origDispatchOpts.origin);
-          if (isIP(origin.hostname) !== 0) {
+          if (isIP2(origin.hostname) !== 0) {
             return dispatch(origDispatchOpts, handler);
           }
           instance.runLookup(origin, origDispatchOpts, (err, newOrigin) => {
@@ -17616,9 +17616,9 @@ var require_cache_handler = __commonJS({
             if (typeof cachedValue.body.values === "function") {
               const bodyIterator = cachedValue.body.values();
               const streamCachedBody = /* @__PURE__ */ __name(() => {
-                for (const chunk of bodyIterator) {
-                  const full = this.#writeStream.write(chunk) === false;
-                  this.#handler.onResponseData?.(controller, chunk);
+                for (const chunk2 of bodyIterator) {
+                  const full = this.#writeStream.write(chunk2) === false;
+                  this.#handler.onResponseData?.(controller, chunk2);
                   if (full) {
                     break;
                   }
@@ -17636,9 +17636,9 @@ var require_cache_handler = __commonJS({
               });
               streamCachedBody();
             } else if (typeof cachedValue.body.on === "function") {
-              cachedValue.body.on("data", (chunk) => {
-                this.#writeStream.write(chunk);
-                this.#handler.onResponseData?.(controller, chunk);
+              cachedValue.body.on("data", (chunk2) => {
+                this.#writeStream.write(chunk2);
+                this.#handler.onResponseData?.(controller, chunk2);
               }).on("end", () => {
                 this.#writeStream.end();
               }).on("error", () => {
@@ -17681,11 +17681,11 @@ var require_cache_handler = __commonJS({
           downstreamOnHeaders();
         }
       }
-      onResponseData(controller, chunk) {
-        if (this.#writeStream?.write(chunk) === false) {
+      onResponseData(controller, chunk2) {
+        if (this.#writeStream?.write(chunk2) === false) {
           controller.pause();
         }
-        this.#handler.onResponseData?.(controller, chunk);
+        this.#handler.onResponseData?.(controller, chunk2);
       }
       onResponseEnd(controller, trailers) {
         this.#writeStream?.end();
@@ -17999,15 +17999,15 @@ var require_memory_cache_store = __commonJS({
           size: 0
         };
         return new Writable({
-          write(chunk, encoding, callback) {
-            if (typeof chunk === "string") {
-              chunk = Buffer.from(chunk, encoding);
+          write(chunk2, encoding, callback) {
+            if (typeof chunk2 === "string") {
+              chunk2 = Buffer.from(chunk2, encoding);
             }
-            entry.size += chunk.byteLength;
+            entry.size += chunk2.byteLength;
             if (entry.size >= store.#maxEntrySize) {
               this.destroy();
             } else {
-              entry.body.push(chunk);
+              entry.body.push(chunk2);
             }
             callback(null);
           },
@@ -18169,11 +18169,11 @@ var require_cache_revalidation_handler = __commonJS({
         this.#handler.onRequestStart?.(controller, this.#context);
         this.#handler.onResponseStart?.(controller, statusCode, headers, statusMessage);
       }
-      onResponseData(controller, chunk) {
+      onResponseData(controller, chunk2) {
         if (this.#successful) {
           return;
         }
-        return this.#handler.onResponseData?.(controller, chunk);
+        return this.#handler.onResponseData?.(controller, chunk2);
       }
       onResponseEnd(controller, trailers) {
         if (this.#successful) {
@@ -18441,8 +18441,8 @@ var require_cache2 = __commonJS({
       if (opts.method === "HEAD") {
         stream.destroy();
       } else {
-        stream.on("data", function(chunk) {
-          handler.onResponseData?.(controller, chunk);
+        stream.on("data", function(chunk2) {
+          handler.onResponseData?.(controller, chunk2);
         });
       }
     }
@@ -18642,14 +18642,14 @@ var require_decompress = __commonJS({
     function createMaxSizeLimiter(maxSize) {
       let size = 0;
       return new TransformStream2({
-        transform(chunk, _encoding, callback) {
-          const decompressedSize = size + chunk.length;
+        transform(chunk2, _encoding, callback) {
+          const decompressedSize = size + chunk2.length;
           if (decompressedSize > maxSize) {
             callback(new ResponseExceededMaxSizeError(`Decompressed response size (${decompressedSize}) exceeded maxSize (${maxSize})`));
             return;
           }
           size = decompressedSize;
-          callback(null, chunk);
+          callback(null, chunk2);
         }
       });
     }
@@ -18761,15 +18761,15 @@ var require_decompress = __commonJS({
           if (this.#terminated) {
             return;
           }
-          let chunk;
-          while ((chunk = decompressor.read()) !== null) {
-            const decompressedSize = this.#decompressedSize + chunk.length;
+          let chunk2;
+          while ((chunk2 = decompressor.read()) !== null) {
+            const decompressedSize = this.#decompressedSize + chunk2.length;
             if (decompressedSize > this.#maxSize) {
               this.#fail(controller, new ResponseExceededMaxSizeError(`Decompressed response size (${decompressedSize}) exceeded maxSize (${this.#maxSize})`));
               return;
             }
             this.#decompressedSize = decompressedSize;
-            const result = super.onResponseData(controller, chunk);
+            const result = super.onResponseData(controller, chunk2);
             if (result === false) {
               break;
             }
@@ -18878,12 +18878,12 @@ var require_decompress = __commonJS({
       * @param {Buffer} chunk
       * @returns {void}
       */
-      onResponseData(controller, chunk) {
+      onResponseData(controller, chunk2) {
         if (this.#decompressors.length > 0) {
-          this.#decompressors[0].write(chunk);
+          this.#decompressors[0].write(chunk2);
           return;
         }
-        super.onResponseData(controller, chunk);
+        super.onResponseData(controller, chunk2);
       }
       /**
       * @param {Controller} controller
@@ -19081,12 +19081,12 @@ var require_deduplication_handler = __commonJS({
       * @param {import('../../types/dispatcher.d.ts').default.DispatchController} controller
       * @param {Buffer} chunk
       */
-      onResponseData(controller, chunk) {
+      onResponseData(controller, chunk2) {
         if (this.#aborted || this.#completed) {
           return;
         }
         this.#responseDataStarted = true;
-        this.#primaryHandler.onResponseData?.(controller, chunk);
+        this.#primaryHandler.onResponseData?.(controller, chunk2);
         for (const waitingHandler of this.#waitingHandlers) {
           const { handler, controller: waitingController } = waitingHandler;
           if (waitingHandler.done || waitingController.aborted) {
@@ -19094,11 +19094,11 @@ var require_deduplication_handler = __commonJS({
             continue;
           }
           if (waitingController.paused) {
-            this.#bufferWaitingChunk(waitingHandler, chunk);
+            this.#bufferWaitingChunk(waitingHandler, chunk2);
             continue;
           }
           try {
-            handler.onResponseData?.(waitingController, chunk);
+            handler.onResponseData?.(waitingController, chunk2);
           } catch {
           }
           if (waitingController.aborted) {
@@ -19223,14 +19223,14 @@ var require_deduplication_handler = __commonJS({
       * @param {WaitingHandler} waitingHandler
       * @param {Buffer} chunk
       */
-      #bufferWaitingChunk(waitingHandler, chunk) {
+      #bufferWaitingChunk(waitingHandler, chunk2) {
         if (waitingHandler.done || waitingHandler.controller.aborted) {
           waitingHandler.done = true;
           waitingHandler.bufferedChunks = [];
           waitingHandler.bufferedBytes = 0;
           return;
         }
-        const bufferedChunk = Buffer.from(chunk);
+        const bufferedChunk = Buffer.from(chunk2);
         waitingHandler.bufferedChunks.push(bufferedChunk);
         waitingHandler.bufferedBytes += bufferedChunk.length;
         if (waitingHandler.bufferedBytes > this.#maxBufferSize) {
@@ -19594,10 +19594,10 @@ var require_sqlite_cache_store = __commonJS({
         const store = this;
         return new Writable({
           decodeStrings: true,
-          write(chunk, encoding, callback) {
-            size += chunk.byteLength;
+          write(chunk2, encoding, callback) {
+            size += chunk2.byteLength;
             if (size < store.#maxEntrySize) {
-              body.push(chunk);
+              body.push(chunk2);
             } else {
               this.destroy();
             }
@@ -22588,11 +22588,11 @@ var require_fetch = __commonJS({
             });
             return true;
           },
-          onData(chunk) {
+          onData(chunk2) {
             if (fetchParams.controller.dump) {
               return;
             }
-            const bytes = chunk;
+            const bytes = chunk2;
             timingInfo.encodedBodySize += bytes.byteLength;
             return this.body.push(bytes);
           },
@@ -24724,7 +24724,7 @@ var require_permessage_deflate = __commonJS({
       * @param {boolean} fin Final fragment flag
       * @param {Function} callback Callback function
       */
-      decompress(chunk, fin, callback) {
+      decompress(chunk2, fin, callback) {
         if (!this.#inflate) {
           let windowBits = Z_DEFAULT_WINDOWBITS;
           if (this.#options.serverMaxWindowBits) {
@@ -24760,7 +24760,7 @@ var require_permessage_deflate = __commonJS({
             callback(err);
           });
         }
-        this.#inflate.write(chunk);
+        this.#inflate.write(chunk2);
         if (fin) {
           this.#inflate.write(tail);
         }
@@ -24831,9 +24831,9 @@ var require_receiver = __commonJS({
       * @param {Buffer} chunk
       * @param {() => void} callback
       */
-      _write(chunk, _, callback) {
-        this.#buffers.push(chunk);
-        this.#byteOffset += chunk.length;
+      _write(chunk2, _, callback) {
+        this.#buffers.push(chunk2);
+        this.#byteOffset += chunk2.length;
         this.#loop = true;
         this.run(callback);
       }
@@ -25285,8 +25285,8 @@ var require_websocket = __commonJS({
         onMessage: /* @__PURE__ */ __name((opcode, data) => this.#onMessage(opcode, data), "onMessage"),
         onParserError: /* @__PURE__ */ __name((err) => failWebsocketConnection(this.#handler, null, err.message), "onParserError"),
         onParserDrain: /* @__PURE__ */ __name(() => this.#onParserDrain(), "onParserDrain"),
-        onSocketData: /* @__PURE__ */ __name((chunk) => {
-          if (!this.#parser.write(chunk)) {
+        onSocketData: /* @__PURE__ */ __name((chunk2) => {
+          if (!this.#parser.write(chunk2)) {
             this.#handler.socket.pause();
           }
         }, "onSocketData"),
@@ -25855,8 +25855,8 @@ var require_websocketstream = __commonJS({
         onMessage: /* @__PURE__ */ __name((opcode, data) => this.#onMessage(opcode, data), "onMessage"),
         onParserError: /* @__PURE__ */ __name((err) => failWebsocketConnection(this.#handler, null, err.message), "onParserError"),
         onParserDrain: /* @__PURE__ */ __name(() => this.#handler.socket.resume(), "onParserDrain"),
-        onSocketData: /* @__PURE__ */ __name((chunk) => {
-          if (!this.#parser.write(chunk)) {
+        onSocketData: /* @__PURE__ */ __name((chunk2) => {
+          if (!this.#parser.write(chunk2)) {
             this.#handler.socket.pause();
           }
         }, "onSocketData"),
@@ -25947,18 +25947,18 @@ var require_websocketstream = __commonJS({
         const reason = closeInfo.reason;
         closeWebSocketConnection(this.#handler, code, reason, true);
       }
-      #write(chunk) {
-        chunk = webidl.converters.WebSocketStreamWrite(chunk);
+      #write(chunk2) {
+        chunk2 = webidl.converters.WebSocketStreamWrite(chunk2);
         const promise = createDeferredPromise();
         let data = null;
         let opcode = null;
-        if (webidl.is.BufferSource(chunk)) {
-          data = new Uint8Array(ArrayBuffer.isView(chunk) ? new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength) : chunk.slice());
+        if (webidl.is.BufferSource(chunk2)) {
+          data = new Uint8Array(ArrayBuffer.isView(chunk2) ? new Uint8Array(chunk2.buffer, chunk2.byteOffset, chunk2.byteLength) : chunk2.slice());
           opcode = opcodes.BINARY;
         } else {
           let string;
           try {
-            string = webidl.converters.DOMString(chunk);
+            string = webidl.converters.DOMString(chunk2);
           } catch (e) {
             promise.reject(e);
             return promise.promise;
@@ -25999,7 +25999,7 @@ var require_websocketstream = __commonJS({
           start: /* @__PURE__ */ __name((controller) => {
             this.#writableStreamController = controller;
           }, "start"),
-          write: /* @__PURE__ */ __name((chunk) => this.#write(chunk), "write"),
+          write: /* @__PURE__ */ __name((chunk2) => this.#write(chunk2), "write"),
           close: /* @__PURE__ */ __name(() => closeWebSocketConnection(this.#handler, null, null), "close"),
           abort: /* @__PURE__ */ __name((reason) => this.#closeUsingReason(reason), "abort")
         });
@@ -26016,18 +26016,18 @@ var require_websocketstream = __commonJS({
         if (this.#handler.readyState !== states.OPEN) {
           return;
         }
-        let chunk;
+        let chunk2;
         if (type === opcodes.TEXT) {
           try {
-            chunk = utf8Decode(data);
+            chunk2 = utf8Decode(data);
           } catch {
             failWebsocketConnection(this.#handler, 1007, "Received invalid UTF-8 in text frame.");
             return;
           }
         } else if (type === opcodes.BINARY) {
-          chunk = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+          chunk2 = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
         }
-        this.#readableStreamController.enqueue(chunk);
+        this.#readableStreamController.enqueue(chunk2);
       }
       /** @type {import('../websocket').Handler['onSocketClose']} */
       #onSocketClose() {
@@ -26250,12 +26250,12 @@ var require_eventsource_stream = __commonJS({
       * @param {Function} callback
       * @returns {void}
       */
-      _transform(chunk, _encoding, callback) {
-        if (chunk.length === 0) {
+      _transform(chunk2, _encoding, callback) {
+        if (chunk2.length === 0) {
           callback();
           return;
         }
-        this.chunks.push(chunk);
+        this.chunks.push(chunk2);
         if (this.checkBOM) {
           if (this.handleBOM()) {
             callback();
@@ -26423,10 +26423,10 @@ ${value}`;
         const chunks = [];
         let length = 0;
         for (let i = this.lineChunkIndex; i <= this.chunkIndex; i++) {
-          const chunk = this.chunks[i];
+          const chunk2 = this.chunks[i];
           const start = i === this.lineChunkIndex ? this.linePos : 0;
-          const end = i === this.chunkIndex ? this.pos : chunk.length;
-          const slice = chunk.subarray(start, end);
+          const end = i === this.chunkIndex ? this.pos : chunk2.length;
+          const slice = chunk2.subarray(start, end);
           length += slice.length;
           chunks.push(slice);
         }
@@ -26436,10 +26436,10 @@ ${value}`;
         let chunkIndex = this.lineChunkIndex;
         let pos = this.linePos;
         while (chunkIndex < this.chunks.length) {
-          const chunk = this.chunks[chunkIndex];
-          const remaining = chunk.length - pos;
+          const chunk2 = this.chunks[chunkIndex];
+          const remaining = chunk2.length - pos;
           if (offset < remaining) {
-            return chunk[pos + offset];
+            return chunk2[pos + offset];
           }
           offset -= remaining;
           chunkIndex++;
@@ -26448,8 +26448,8 @@ ${value}`;
       }
       discardLeadingBytes(count) {
         while (count > 0 && this.lineChunkIndex < this.chunks.length) {
-          const chunk = this.chunks[this.lineChunkIndex];
-          const remaining = chunk.length - this.linePos;
+          const chunk2 = this.chunks[this.lineChunkIndex];
+          const remaining = chunk2.length - this.linePos;
           if (count < remaining) {
             this.linePos += count;
             count = 0;
@@ -27594,7 +27594,7 @@ var require_pathHelpers = __commonJS({
     });
     exports2.encodeOpenstackPathSegment = encodeOpenstackPathSegment2;
     exports2.encodeOpenstackPath = encodeOpenstackPath;
-    exports2.validateAndEncodeResourceId = validateAndEncodeResourceId8;
+    exports2.validateAndEncodeResourceId = validateAndEncodeResourceId9;
     var error_1 = require_error();
     function encodeOpenstackPathSegment2(segment, label = "Path segment") {
       if (!segment || typeof segment !== "string") {
@@ -27616,10 +27616,10 @@ var require_pathHelpers = __commonJS({
       return segments.map((seg, idx) => encodeOpenstackPathSegment2(seg, `Path segment ${idx}`)).join("/");
     }
     __name(encodeOpenstackPath, "encodeOpenstackPath");
-    function validateAndEncodeResourceId8(id, resourceType = "Resource") {
+    function validateAndEncodeResourceId9(id, resourceType = "Resource") {
       return encodeOpenstackPathSegment2(id, `${resourceType} ID`);
     }
-    __name(validateAndEncodeResourceId8, "validateAndEncodeResourceId");
+    __name(validateAndEncodeResourceId9, "validateAndEncodeResourceId");
   }
 });
 
@@ -28855,6 +28855,8 @@ var require_esm2 = __commonJS({
 // src/server/index.ts
 var server_exports = {};
 __export(server_exports, {
+  SLOT_NAMES: () => SLOT_NAMES,
+  auroraAppConfigSchema: () => auroraAppConfigSchema,
   auroraRouter: () => auroraRouter,
   createServer: () => createServer,
   domainScopedInputSchema: () => domainScopedInputSchema,
@@ -28864,6 +28866,7 @@ __export(server_exports, {
   projectScopedProcedure: () => projectScopedProcedure,
   protectedProcedure: () => protectedProcedure,
   publicProcedure: () => publicProcedure,
+  resolveAppConfig: () => resolveAppConfig,
   validateOpenstackService: () => validateOpenstackService
 });
 module.exports = __toCommonJS(server_exports);
@@ -29893,8 +29896,8 @@ async function processBulkOperation(items, processor, options = {}) {
   if (chunkSize && chunkSize > 0) {
     const chunks = chunkArray(items, chunkSize);
     for (let i = 0; i < chunks.length; i++) {
-      const chunk = chunks[i];
-      const chunkPromises = chunk.map(async (item) => {
+      const chunk2 = chunks[i];
+      const chunkPromises = chunk2.map(async (item) => {
         try {
           await processor(item);
           return {
@@ -30529,19 +30532,19 @@ var imageRouter = {
       try {
         const progress = uploadProgress.get(scopedUploadId);
         const progressTracker = new import_node_stream.Transform({
-          transform(chunk, _encoding, callback) {
-            progress.uploaded += chunk.length;
+          transform(chunk2, _encoding, callback) {
+            progress.uploaded += chunk2.length;
             uploadProgressEmitter.emit(`progress:${scopedUploadId}`, {
               uploaded: progress.uploaded,
               total: progress.total,
               percent: progress.total > 0 ? Math.round(progress.uploaded / progress.total * 100) : 0
             });
-            callback(null, chunk);
+            callback(null, chunk2);
           }
         });
         const passthrough = new import_node_stream.Transform({
-          transform(chunk, _enc, cb) {
-            cb(null, chunk);
+          transform(chunk2, _enc, cb) {
+            cb(null, chunk2);
           }
         });
         const pipelinePromise = (0, import_promises.pipeline)(validatedFile, progressTracker, passthrough);
@@ -32394,6 +32397,7 @@ Pass an absolute path via the policyDir option in createServer.`);
 }, "loadPolicyEngine");
 
 // src/server/policies/createPermissionRouter.ts
+var MISSING_RULE_MESSAGE = /not found and no _default rule available/;
 var getPolicy = /* @__PURE__ */ __name((ctx, engine) => {
   const openstackSession = ctx.openstack;
   const token = openstackSession?.getToken();
@@ -32438,7 +32442,15 @@ function createPermissionRouter(config) {
       });
     }
     const policy = getPolicy(ctx, engine);
-    return policy.check(mapping.rule);
+    try {
+      return policy.check(mapping.rule);
+    } catch (error) {
+      if (error instanceof Error && MISSING_RULE_MESSAGE.test(error.message)) {
+        console.warn(`Permission '${String(permission)}' denied: rule '${mapping.rule}' is not defined in the loaded policy file, which also has no '_default' rule.`);
+        return false;
+      }
+      throw error;
+    }
   }, "checkSinglePermission");
   return {
     /**
@@ -32455,6 +32467,8 @@ function createPermissionRouter(config) {
     *
     * Invalid keys are rejected with a `BAD_REQUEST` error before the handler runs.
     * Empty array input returns an empty array (`[]`).
+    * A key whose rule is missing from the loaded policy file (and that file has no `_default`
+    * rule) evaluates to `false` for that key alone — the rest of the batch is unaffected.
     * Always returns `boolean[]` for consistent destructuring on the client.
     */
     canUser: projectScopedProcedure.input(projectScopedInputSchema.extend({
@@ -34458,14 +34472,14 @@ var swiftRouter = {
       try {
         const progress = uploadProgressMap.get(scopedUploadId);
         const progressTracker = new import_node_stream2.Transform({
-          async transform(chunk, _encoding, callback) {
-            progress.uploaded += chunk.length;
+          async transform(chunk2, _encoding, callback) {
+            progress.uploaded += chunk2.length;
             progress.percent = progress.total > 0 ? Math.round(progress.uploaded / progress.total * 100) : 0;
             uploadProgressEmitter2.emit(`progress:${scopedUploadId}`, {
               ...progress
             });
             await new Promise((resolve) => setTimeout(resolve, 0));
-            callback(null, chunk);
+            callback(null, chunk2);
           }
         });
         const isAbortLike = /* @__PURE__ */ __name((err) => {
@@ -34850,7 +34864,8 @@ async function resolveEC2Credential(ctx) {
       return null;
     }
     const data = await response.json();
-    const ec2Cred = data.credentials?.find((c) => c.type === "ec2" && c.project_id === projectId);
+    const ec2Creds = (data.credentials ?? []).filter((c) => c.type === "ec2" && c.project_id === projectId).sort((a, b) => a.id.localeCompare(b.id));
+    const ec2Cred = ec2Creds[0];
     if (!ec2Cred) {
       return null;
     }
@@ -34941,6 +34956,7 @@ var cephCredentialMiddleware = projectScopedProcedure.use(/* @__PURE__ */ __name
       ...ctx,
       cephCredentials: credentials,
       cephRegion: region,
+      cephEndpoint: endpoint,
       getCephClient: /* @__PURE__ */ __name(() => {
         if (!credentials) {
           throw new import_server12.TRPCError({
@@ -35001,6 +35017,7 @@ var cephUploadProcedure = protectedProcedure.use(/* @__PURE__ */ __name(async fu
       ...scopedCtx,
       cephCredentials: credentials,
       cephRegion: region,
+      cephEndpoint: endpoint,
       getCephClient: /* @__PURE__ */ __name(() => createS3Client(credentials.access, credentials.secret, endpoint, region), "getCephClient")
     }
   });
@@ -35093,7 +35110,7 @@ var ec2CredentialSchema = import_zod13.z.object({
 var ec2CredentialWithSecretSchema = ec2CredentialSchema.extend({
   secret: import_zod13.z.string()
 });
-var deleteEc2CredentialInputSchema = projectScopedInputSchema.extend({
+var ec2CredentialIdInputSchema = projectScopedInputSchema.extend({
   credentialId: import_zod13.z.string().min(1)
 });
 var containerSchema = import_zod13.z.object({
@@ -35173,7 +35190,11 @@ var bucketStateOutputSchema = import_zod13.z.object({
   isPartialScan: import_zod13.z.boolean()
 });
 var s3StatusSchema = import_zod13.z.object({
-  hasCredentials: import_zod13.z.boolean()
+  hasCredentials: import_zod13.z.boolean(),
+  /** Base S3 endpoint of the Ceph RGW for this region (Swift path suffix stripped). */
+  endpoint: import_zod13.z.string(),
+  /** Ceph-compatible region identifier the S3 client signs with. */
+  region: import_zod13.z.string()
 });
 var s3ObjectSchema = import_zod13.z.object({
   key: import_zod13.z.string(),
@@ -35714,9 +35735,17 @@ var deleteLifecycleInputSchema = projectScopedInputSchema.extend({
 
 // src/server/Storage/routers/ceph/containerRouter.ts
 var containerRouter = {
+  /**
+  * Reports whether the user has EC2 credentials in this project, plus the S3 endpoint/region
+  * they'd use if they did. Deliberately built on `cephProcedure` (not `cephProtectedProcedure`):
+  * the UI needs endpoint/region to render Connection Details even when `hasCredentials` is
+  * false (e.g. the empty state in ManageCredentialsModal, or CredentialPrompt).
+  */
   status: cephProcedure.input(projectScopedInputSchema).query(async ({ ctx }) => {
     return {
-      hasCredentials: !!ctx.cephCredentials
+      hasCredentials: !!ctx.cephCredentials,
+      endpoint: ctx.cephEndpoint,
+      region: ctx.cephRegion
     };
   }),
   /**
@@ -36136,12 +36165,12 @@ async function bulkDeleteItems(s3, containerName, items, abortSignal, operation)
   const errors = [];
   for (let offset = 0; offset < items.length; offset += S3_MAX_KEYS_PER_REQUEST) {
     if (abortSignal?.aborted) break;
-    const chunk = items.slice(offset, offset + S3_MAX_KEYS_PER_REQUEST);
+    const chunk2 = items.slice(offset, offset + S3_MAX_KEYS_PER_REQUEST);
     try {
       const response = await s3.send(new import_client_s33.DeleteObjectsCommand({
         Bucket: containerName,
         Delete: {
-          Objects: chunk.map((item) => ({
+          Objects: chunk2.map((item) => ({
             Key: item.key,
             ...item.versionId && {
               VersionId: item.versionId
@@ -36179,7 +36208,7 @@ async function bulkDeleteItems(s3, containerName, items, abortSignal, operation)
         });
       }
       const message = error instanceof Error ? error.message : String(error);
-      for (const item of chunk) {
+      for (const item of chunk2) {
         errors.push({
           key: item.key,
           versionId: item.versionId,
@@ -37300,14 +37329,14 @@ var objectRouter = {
       const progress = uploadProgressMap2.get(scopedUploadId);
       const fileStream = import_node_stream3.Readable.fromWeb(input);
       const progressTracker = new import_node_stream3.Transform({
-        async transform(chunk, _encoding, callback) {
-          progress.uploaded += chunk.length;
+        async transform(chunk2, _encoding, callback) {
+          progress.uploaded += chunk2.length;
           progress.percent = progress.total > 0 ? Math.round(progress.uploaded / progress.total * 100) : 0;
           uploadProgressEmitter3.emit(`progress:${scopedUploadId}`, {
             ...progress
           });
           await new Promise((resolve) => setImmediate(resolve));
-          callback(null, chunk);
+          callback(null, chunk2);
         }
       });
       const isAbortLike = /* @__PURE__ */ __name((err) => {
@@ -37433,9 +37462,141 @@ var objectRouter = {
 };
 
 // src/server/Storage/routers/ceph/ec2CredentialRouter.ts
-var import_server15 = require("@trpc/server");
-var import_zod15 = require("zod");
+var import_server16 = require("@trpc/server");
+var import_signal_openstack5 = __toESM(require_esm());
 var import_crypto = require("crypto");
+
+// src/server/Storage/helpers/ec2CredentialMapper.ts
+var import_server15 = require("@trpc/server");
+function toEc2Credential(raw) {
+  const blob = parseBlob(raw);
+  const result = ec2CredentialSchema.safeParse({
+    id: raw.id,
+    access: blob.access,
+    user_id: raw.user_id,
+    project_id: raw.project_id
+  });
+  if (!result.success) {
+    throw invalidFormat(raw.id);
+  }
+  return result.data;
+}
+__name(toEc2Credential, "toEc2Credential");
+function toEc2CredentialWithSecret(raw) {
+  const blob = parseBlob(raw);
+  const result = ec2CredentialWithSecretSchema.safeParse({
+    id: raw.id,
+    access: blob.access,
+    secret: blob.secret,
+    user_id: raw.user_id,
+    project_id: raw.project_id
+  });
+  if (!result.success) {
+    throw invalidFormat(raw.id);
+  }
+  return result.data;
+}
+__name(toEc2CredentialWithSecret, "toEc2CredentialWithSecret");
+function parseBlob(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw.blob);
+  } catch {
+    throw parseFailed(raw.id);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw parseFailed(raw.id);
+  }
+  return parsed;
+}
+__name(parseBlob, "parseBlob");
+function parseFailed(credentialId) {
+  return new import_server15.TRPCError({
+    code: "INTERNAL_SERVER_ERROR",
+    message: `Failed to parse EC2 credential blob for credential ${credentialId}`
+  });
+}
+__name(parseFailed, "parseFailed");
+function invalidFormat(credentialId) {
+  return new import_server15.TRPCError({
+    code: "INTERNAL_SERVER_ERROR",
+    message: `Invalid EC2 credential format for credential ${credentialId}`
+  });
+}
+__name(invalidFormat, "invalidFormat");
+
+// src/server/Storage/routers/ceph/ec2CredentialRouter.ts
+function rejectForIdentityStatus(status, whatFailed) {
+  if (status === 401) {
+    throw new import_server16.TRPCError({
+      code: "UNAUTHORIZED",
+      message: "Authentication failed"
+    });
+  }
+  if (status === 403) {
+    throw new import_server16.TRPCError({
+      code: "FORBIDDEN",
+      message: "Access denied"
+    });
+  }
+  throw new import_server16.TRPCError({
+    code: "INTERNAL_SERVER_ERROR",
+    message: whatFailed
+  });
+}
+__name(rejectForIdentityStatus, "rejectForIdentityStatus");
+function credentialNotFound() {
+  return new import_server16.TRPCError({
+    code: "NOT_FOUND",
+    message: "Credential not found"
+  });
+}
+__name(credentialNotFound, "credentialNotFound");
+async function fetchOwnedCredential(ctx, credentialId) {
+  const userId = ctx.openstack.getToken()?.tokenData.user?.id;
+  const projectId = ctx.openstack.getToken()?.tokenData.project?.id;
+  if (!userId) {
+    throw new import_server16.TRPCError({
+      code: "UNAUTHORIZED",
+      message: "User ID not found in token"
+    });
+  }
+  if (!projectId) {
+    throw new import_server16.TRPCError({
+      code: "UNAUTHORIZED",
+      message: "Project ID not found in token"
+    });
+  }
+  const identityService = ctx.openstack.service("identity");
+  let getResponse;
+  try {
+    getResponse = await identityService.get(`credentials/${credentialId}`);
+  } catch (error) {
+    if (error instanceof import_signal_openstack5.SignalOpenstackApiError) {
+      if (error.statusCode === 404) {
+        return null;
+      }
+      rejectForIdentityStatus(error.statusCode, "Failed to fetch credential for verification");
+    }
+    throw error;
+  }
+  if (!getResponse.ok) {
+    if (getResponse.status === 404) {
+      return null;
+    }
+    rejectForIdentityStatus(getResponse.status, "Failed to fetch credential for verification");
+  }
+  const credentialData = await getResponse.json();
+  const credential = credentialData.credential;
+  if (credential.user_id !== userId || credential.project_id !== projectId) {
+    throw credentialNotFound();
+  }
+  if (credential.type !== "ec2") {
+    return null;
+  }
+  return credential;
+}
+__name(fetchOwnedCredential, "fetchOwnedCredential");
 var ec2CredentialRouter = {
   /**
   * Lists EC2 credentials for the current user scoped to the given project.
@@ -37444,7 +37605,7 @@ var ec2CredentialRouter = {
   list: projectScopedProcedure.input(projectScopedInputSchema).query(async ({ ctx, input }) => {
     const userId = ctx.openstack.getToken()?.tokenData.user?.id;
     if (!userId) {
-      throw new import_server15.TRPCError({
+      throw new import_server16.TRPCError({
         code: "UNAUTHORIZED",
         message: "User ID not found in token"
       });
@@ -37457,48 +37618,31 @@ var ec2CredentialRouter = {
       }
     });
     if (!response.ok) {
-      throw new import_server15.TRPCError({
+      throw new import_server16.TRPCError({
         code: "INTERNAL_SERVER_ERROR",
         message: "Failed to list EC2 credentials"
       });
     }
     const data = await response.json();
     const ec2Creds = (data.credentials ?? []).filter((c) => c.type === "ec2" && c.project_id === input.project_id);
-    return ec2Creds.map((c) => {
-      try {
-        const blob = JSON.parse(c.blob);
-        const result = ec2CredentialSchema.safeParse({
-          id: c.id,
-          access: blob.access,
-          user_id: c.user_id,
-          project_id: c.project_id
-        });
-        if (!result.success) {
-          throw new import_server15.TRPCError({
-            code: "INTERNAL_SERVER_ERROR",
-            message: `Invalid EC2 credential format for credential ${c.id}`
-          });
-        }
-        return result.data;
-      } catch (error) {
-        if (error instanceof import_server15.TRPCError) {
-          throw error;
-        }
-        throw new import_server15.TRPCError({
-          code: "INTERNAL_SERVER_ERROR",
-          message: `Failed to parse EC2 credential blob for credential ${c.id}`
-        });
-      }
-    });
+    return ec2Creds.map(toEc2Credential);
   }),
   /**
   * Creates a new EC2 credential for the current user scoped to the given project.
-  * The secret key is returned exactly once in this response and never stored.
+  *
+  * The secret is generated here and handed to Keystone, but deliberately not returned: the UI
+  * shows a new key concealed like any other and reads it through `reveal`, so a secret in this
+  * response would be a value crossing the wire that nothing consumes. `reveal` remains the one
+  * procedure that hands a secret out.
+  *
+  * No ceiling on how many a user may hold: neither Keystone nor RGW imposes one, and all of a
+  * user's keys in a project map to the same RGW identity, so an extra key grants no extra access
+  * and costs no quota. A limit here would only be this router refusing what the backend allows.
   */
   create: projectScopedProcedure.input(projectScopedInputSchema).mutation(async ({ ctx, input }) => {
     const userId = ctx.openstack.getToken()?.tokenData.user?.id;
     if (!userId) {
-      throw new import_server15.TRPCError({
+      throw new import_server16.TRPCError({
         code: "UNAUTHORIZED",
         message: "User ID not found in token"
       });
@@ -37518,98 +37662,76 @@ var ec2CredentialRouter = {
       }
     }));
     if (!response.ok) {
-      throw new import_server15.TRPCError({
+      throw new import_server16.TRPCError({
         code: "INTERNAL_SERVER_ERROR",
         message: "Failed to create EC2 credentials. Please try again or contact your administrator."
       });
     }
     const data = await response.json();
-    try {
-      const blob = JSON.parse(data.credential.blob);
-      const result = ec2CredentialWithSecretSchema.safeParse({
-        id: data.credential.id,
-        access: blob.access,
-        secret: blob.secret,
-        user_id: data.credential.user_id,
-        project_id: data.credential.project_id
-      });
-      if (!result.success) {
-        throw new import_server15.TRPCError({
-          code: "INTERNAL_SERVER_ERROR",
-          message: "Created credential has invalid format"
-        });
-      }
-      return result.data;
-    } catch (error) {
-      if (error instanceof import_server15.TRPCError) {
-        throw error;
-      }
-      throw new import_server15.TRPCError({
-        code: "INTERNAL_SERVER_ERROR",
-        message: "Failed to parse created credential response"
-      });
+    return toEc2Credential(data.credential);
+  }),
+  /**
+  * Returns one credential including its secret key.
+  *
+  * EC2 credentials in Keystone are reversible by design: the blob is stored encrypted and
+  * decrypted on every read, so `GET /v3/credentials/{id}` hands back {"access","secret"}.
+  * This is NOT an Application Credential (whose secret is hashed and unrecoverable) — the
+  * BFF already reads this exact secret on every single Ceph request
+  * (`middleware/resolveEC2Credential.ts`), so exposing it to its own owner adds no new
+  * disclosure surface.
+  *
+  * Modelled as a mutation rather than a query on purpose: a query is the shape React Query
+  * caches by default, and a secret in that cache would outlive the modal that asked for it and
+  * show up in devtools. Same trick as `objects.generatePresignedUrl`. A mutation is not a cache
+  * guarantee on its own, though - `useMutation` keeps its answer in the MutationCache for
+  * `gcTime` after the observer lets go - so the client calls this one through the vanilla tRPC
+  * client, which caches nothing. See `ManageCredentialsModal`.
+  */
+  reveal: projectScopedProcedure.input(ec2CredentialIdInputSchema).mutation(async ({ ctx, input }) => {
+    const credential = await fetchOwnedCredential(ctx, input.credentialId);
+    if (!credential) {
+      throw credentialNotFound();
     }
+    return toEc2CredentialWithSecret(credential);
   }),
   /**
   * Deletes an EC2 credential by ID.
   * Verifies ownership before deletion to prevent IDOR attacks.
+  *
+  * Deliberately NOT idempotent: a credential that is not there answers NOT_FOUND rather than
+  * success. Reporting a deletion this procedure did not perform is a lie the UI then repeats in a
+  * toast naming a key nobody deleted, and it hides the one case worth seeing — someone else
+  * removing that key while this screen was open. The caller is told what the identity service
+  * actually said, and the UI refreshes the list either way, so the table stops showing the key
+  * regardless of which answer came back.
+  *
+  * NOT_FOUND here is the same answer `fetchOwnedCredential` gives for a credential owned by
+  * somebody else, which keeps the two indistinguishable (the anti-enumeration property from
+  * #1182) — it is not weakened by this change, only extended to one more case.
   */
-  delete: projectScopedProcedure.input(projectScopedInputSchema.extend({
-    credentialId: import_zod15.z.string().min(1)
-  })).mutation(async ({ ctx, input }) => {
-    const userId = ctx.openstack.getToken()?.tokenData.user?.id;
-    const projectId = ctx.openstack.getToken()?.tokenData.project?.id;
-    if (!userId) {
-      throw new import_server15.TRPCError({
-        code: "UNAUTHORIZED",
-        message: "User ID not found in token"
-      });
-    }
-    if (!projectId) {
-      throw new import_server15.TRPCError({
-        code: "UNAUTHORIZED",
-        message: "Project ID not found in token"
-      });
+  delete: projectScopedProcedure.input(ec2CredentialIdInputSchema).mutation(async ({ ctx, input }) => {
+    const credential = await fetchOwnedCredential(ctx, input.credentialId);
+    if (!credential) {
+      throw credentialNotFound();
     }
     const identityService = ctx.openstack.service("identity");
-    const getResponse = await identityService.get(`credentials/${input.credentialId}`);
-    if (!getResponse.ok) {
-      if (getResponse.status === 404) {
-        return {
-          success: true
-        };
-      }
-      if (getResponse.status === 401) {
-        throw new import_server15.TRPCError({
-          code: "UNAUTHORIZED",
-          message: "Authentication failed"
-        });
-      }
-      if (getResponse.status === 403) {
-        throw new import_server15.TRPCError({
-          code: "FORBIDDEN",
-          message: "Access denied"
-        });
+    let deleteResponse;
+    try {
+      deleteResponse = await identityService.del(`credentials/${input.credentialId}`);
+    } catch (error) {
+      if (error instanceof import_signal_openstack5.SignalOpenstackApiError) {
+        if (error.statusCode === 404) {
+          throw credentialNotFound();
+        }
+        rejectForIdentityStatus(error.statusCode, "Failed to delete EC2 credential");
       }
-      throw new import_server15.TRPCError({
-        code: "INTERNAL_SERVER_ERROR",
-        message: "Failed to fetch credential for verification"
-      });
-    }
-    const credentialData = await getResponse.json();
-    const credential = credentialData.credential;
-    if (credential.user_id !== userId || credential.project_id !== projectId) {
-      throw new import_server15.TRPCError({
-        code: "NOT_FOUND",
-        message: "Credential not found"
-      });
+      throw error;
     }
-    const deleteResponse = await identityService.del(`credentials/${input.credentialId}`);
-    if (!deleteResponse.ok && deleteResponse.status !== 404) {
-      throw new import_server15.TRPCError({
-        code: "INTERNAL_SERVER_ERROR",
-        message: "Failed to delete EC2 credential"
-      });
+    if (!deleteResponse.ok) {
+      if (deleteResponse.status === 404) {
+        throw credentialNotFound();
+      }
+      rejectForIdentityStatus(deleteResponse.status, "Failed to delete EC2 credential");
     }
     return {
       success: true
@@ -37621,80 +37743,80 @@ var ec2CredentialRouter = {
 var import_client_s34 = require("@aws-sdk/client-s3");
 
 // src/server/Storage/types/versioning.ts
-var import_zod16 = require("zod");
-var versioningStatusSchema = import_zod16.z.object({
-  status: import_zod16.z.enum([
+var import_zod15 = require("zod");
+var versioningStatusSchema = import_zod15.z.object({
+  status: import_zod15.z.enum([
     "Enabled",
     "Suspended",
     "Unversioned"
   ]),
-  mfaDelete: import_zod16.z.enum([
+  mfaDelete: import_zod15.z.enum([
     "Enabled",
     "Disabled"
   ]).optional()
 });
 var setVersioningInputSchema = projectScopedInputSchema.extend({
-  bucket: import_zod16.z.string().min(1),
-  status: import_zod16.z.enum([
+  bucket: import_zod15.z.string().min(1),
+  status: import_zod15.z.enum([
     "Enabled",
     "Suspended"
   ])
 });
 var getVersioningStatusInputSchema = projectScopedInputSchema.extend({
-  bucket: import_zod16.z.string().min(1)
-});
-var objectVersionSchema = import_zod16.z.object({
-  key: import_zod16.z.string(),
-  versionId: import_zod16.z.string(),
-  isLatest: import_zod16.z.boolean(),
-  lastModified: import_zod16.z.string(),
-  size: import_zod16.z.number(),
-  storageClass: import_zod16.z.string().optional(),
-  owner: import_zod16.z.object({
-    displayName: import_zod16.z.string().optional(),
-    id: import_zod16.z.string().optional()
+  bucket: import_zod15.z.string().min(1)
+});
+var objectVersionSchema = import_zod15.z.object({
+  key: import_zod15.z.string(),
+  versionId: import_zod15.z.string(),
+  isLatest: import_zod15.z.boolean(),
+  lastModified: import_zod15.z.string(),
+  size: import_zod15.z.number(),
+  storageClass: import_zod15.z.string().optional(),
+  owner: import_zod15.z.object({
+    displayName: import_zod15.z.string().optional(),
+    id: import_zod15.z.string().optional()
   }).optional(),
-  etag: import_zod16.z.string().optional(),
-  isDeleteMarker: import_zod16.z.boolean().default(false)
+  etag: import_zod15.z.string().optional(),
+  isDeleteMarker: import_zod15.z.boolean().default(false)
 });
 var listVersionsInputSchema = projectScopedInputSchema.extend({
-  bucket: import_zod16.z.string().min(1),
-  prefix: import_zod16.z.string().optional(),
-  keyMarker: import_zod16.z.string().optional(),
-  versionIdMarker: import_zod16.z.string().optional(),
-  maxKeys: import_zod16.z.number().int().positive().max(1e3).optional()
-});
-var listVersionsOutputSchema = import_zod16.z.object({
-  versions: import_zod16.z.array(objectVersionSchema),
-  deleteMarkers: import_zod16.z.array(objectVersionSchema),
-  isTruncated: import_zod16.z.boolean(),
-  nextKeyMarker: import_zod16.z.string().optional(),
-  nextVersionIdMarker: import_zod16.z.string().optional(),
-  prefix: import_zod16.z.string().optional(),
-  maxKeys: import_zod16.z.number().optional()
+  bucket: import_zod15.z.string().min(1),
+  prefix: import_zod15.z.string().optional(),
+  keyMarker: import_zod15.z.string().optional(),
+  versionIdMarker: import_zod15.z.string().optional(),
+  maxKeys: import_zod15.z.number().int().positive().max(1e3).optional()
+});
+var listVersionsOutputSchema = import_zod15.z.object({
+  versions: import_zod15.z.array(objectVersionSchema),
+  deleteMarkers: import_zod15.z.array(objectVersionSchema),
+  isTruncated: import_zod15.z.boolean(),
+  nextKeyMarker: import_zod15.z.string().optional(),
+  nextVersionIdMarker: import_zod15.z.string().optional(),
+  prefix: import_zod15.z.string().optional(),
+  maxKeys: import_zod15.z.number().optional()
 });
 var deleteVersionInputSchema = projectScopedInputSchema.extend({
-  bucket: import_zod16.z.string().min(1),
-  key: import_zod16.z.string().min(1),
-  versionId: import_zod16.z.string().min(1)
+  bucket: import_zod15.z.string().min(1),
+  key: import_zod15.z.string().min(1),
+  versionId: import_zod15.z.string().min(1)
 });
 var restoreVersionInputSchema = projectScopedInputSchema.extend({
-  bucket: import_zod16.z.string().min(1),
-  key: import_zod16.z.string().min(1),
-  versionId: import_zod16.z.string().min(1)
+  bucket: import_zod15.z.string().min(1),
+  key: import_zod15.z.string().min(1),
+  versionId: import_zod15.z.string().min(1)
 });
-var restoreVersionOutputSchema = import_zod16.z.object({
-  success: import_zod16.z.boolean(),
-  versionId: import_zod16.z.string()
+var restoreVersionOutputSchema = import_zod15.z.object({
+  success: import_zod15.z.boolean(),
+  versionId: import_zod15.z.string()
 });
 var listObjectVersionsInputSchema = projectScopedInputSchema.extend({
-  bucket: import_zod16.z.string().min(1),
-  key: import_zod16.z.string().min(1)
+  bucket: import_zod15.z.string().min(1),
+  key: import_zod15.z.string().min(1)
 });
 var checkDeletedContentInputSchema = projectScopedInputSchema.extend({
-  bucket: import_zod16.z.string().min(1),
-  prefix: import_zod16.z.string().optional(),
-  folders: import_zod16.z.array(import_zod16.z.string()).max(1e3).optional()
+  bucket: import_zod15.z.string().min(1),
+  prefix: import_zod15.z.string().optional(),
+  folders: import_zod15.z.array(import_zod15.z.string()).max(1e3).optional()
 }).refine((input) => input.prefix !== void 0 || (input.folders?.length ?? 0) > 0, {
   message: "Either prefix or a non-empty folders array is required",
   path: [
@@ -37706,13 +37828,13 @@ var checkDeletedContentInputSchema = projectScopedInputSchema.extend({
     "folders"
   ]
 });
-var checkDeletedContentOutputSchema = import_zod16.z.array(import_zod16.z.object({
-  prefix: import_zod16.z.string(),
-  hasDeletedContent: import_zod16.z.boolean(),
-  isFolderDeleted: import_zod16.z.boolean(),
-  folderDeleteMarkerVersionId: import_zod16.z.string().optional(),
-  folderMarkerVersionId: import_zod16.z.string().optional(),
-  isPartialScan: import_zod16.z.boolean()
+var checkDeletedContentOutputSchema = import_zod15.z.array(import_zod15.z.object({
+  prefix: import_zod15.z.string(),
+  hasDeletedContent: import_zod15.z.boolean(),
+  isFolderDeleted: import_zod15.z.boolean(),
+  folderDeleteMarkerVersionId: import_zod15.z.string().optional(),
+  folderMarkerVersionId: import_zod15.z.string().optional(),
+  isPartialScan: import_zod15.z.boolean()
 }));
 
 // src/server/Storage/helpers/versionScan.ts
@@ -38138,8 +38260,8 @@ var versioningRouter = {
 
 // src/server/Storage/routers/ceph/bucketPolicyRouter.ts
 var import_client_s35 = require("@aws-sdk/client-s3");
-var import_server16 = require("@trpc/server");
-var import_zod17 = require("zod");
+var import_server17 = require("@trpc/server");
+var import_zod16 = require("zod");
 var policySetRateLimits = /* @__PURE__ */ new Map();
 function checkPolicySetRateLimit(bucketName, projectId) {
   const key = `${projectId}:${bucketName}`;
@@ -38160,7 +38282,7 @@ function checkPolicySetRateLimit(bucketName, projectId) {
     return;
   }
   if (limit.count >= 10) {
-    throw new import_server16.TRPCError({
+    throw new import_server17.TRPCError({
       code: "TOO_MANY_REQUESTS",
       message: "Policy modification rate limit exceeded. Maximum 10 policy changes per 5 minutes per bucket."
     });
@@ -38178,13 +38300,13 @@ function validateResourceARNsMatchBucket(policy, bucketName) {
       const arnRegex = /^arn:aws:s3::[^:/]*:([^/]+)/;
       const match = resource.match(arnRegex);
       if (!match) {
-        throw new import_server16.TRPCError({
+        throw new import_server17.TRPCError({
           code: "BAD_REQUEST",
           message: `Policy Resource '${resource}' is not a valid S3 bucket ARN for bucket '${bucketName}'. Expected: arn:aws:s3:::${bucketName}, arn:aws:s3:::${bucketName}/* or arn:aws:s3::TENANT:${bucketName}`
         });
       }
       if (match[1] !== bucketName) {
-        throw new import_server16.TRPCError({
+        throw new import_server17.TRPCError({
           code: "BAD_REQUEST",
           message: `Policy Resource ARN '${resource}' does not match bucket '${bucketName}'`
         });
@@ -38195,7 +38317,7 @@ function validateResourceARNsMatchBucket(policy, bucketName) {
 __name(validateResourceARNsMatchBucket, "validateResourceARNsMatchBucket");
 function validatePolicySemantics(policy) {
   if (policy.Statement.length > 100) {
-    throw new import_server16.TRPCError({
+    throw new import_server17.TRPCError({
       code: "BAD_REQUEST",
       message: "Policy exceeds maximum of 100 statements"
     });
@@ -38208,7 +38330,7 @@ function validatePolicySemantics(policy) {
     return actions.some((a) => a === "*" || a === "s3:*");
   });
   if (denyAllStatement) {
-    throw new import_server16.TRPCError({
+    throw new import_server17.TRPCError({
       code: "BAD_REQUEST",
       message: "Policy contains 'Deny *' or 'Deny s3:*' which may lock out all access including the bucket owner. Please use more specific deny rules."
     });
@@ -38282,14 +38404,14 @@ var bucketPolicyRouter = {
     const { bucketName, policy } = input;
     checkPolicySetRateLimit(bucketName, input.project_id);
     if (policy.length > 20480) {
-      throw new import_server16.TRPCError({
+      throw new import_server17.TRPCError({
         code: "PAYLOAD_TOO_LARGE",
         message: "Policy document exceeds maximum size of 20KB"
       });
     }
     const openBrackets = (policy.match(/[{[]/g) || []).length;
     if (openBrackets > 50) {
-      throw new import_server16.TRPCError({
+      throw new import_server17.TRPCError({
         code: "BAD_REQUEST",
         message: "Policy JSON is too deeply nested (maximum 50 levels)"
       });
@@ -38307,16 +38429,16 @@ var bucketPolicyRouter = {
       return true;
     } catch (error) {
       if (error instanceof SyntaxError) {
-        throw new import_server16.TRPCError({
+        throw new import_server17.TRPCError({
           code: "BAD_REQUEST",
           message: "Invalid JSON format"
         });
       }
-      if (error instanceof import_zod17.z.ZodError) {
+      if (error instanceof import_zod16.z.ZodError) {
         const zodError = error;
         const firstError = zodError.issues?.[0];
         if (!firstError) {
-          throw new import_server16.TRPCError({
+          throw new import_server17.TRPCError({
             code: "BAD_REQUEST",
             message: "Invalid policy structure"
           });
@@ -38333,7 +38455,7 @@ var bucketPolicyRouter = {
         }, "formatPath");
         const path3 = formatPath(firstError.path);
         const message = firstError.message || "Invalid policy structure";
-        throw new import_server16.TRPCError({
+        throw new import_server17.TRPCError({
           code: "BAD_REQUEST",
           message: `${path3}${message}`
         });
@@ -38376,7 +38498,7 @@ var bucketPolicyRouter = {
 
 // src/server/Storage/routers/ceph/corsRouter.ts
 var import_client_s36 = require("@aws-sdk/client-s3");
-var import_server17 = require("@trpc/server");
+var import_server18 = require("@trpc/server");
 var corsSetRateLimits = /* @__PURE__ */ new Map();
 function checkCorsSetRateLimit(bucketName, projectId) {
   const key = `${projectId}:${bucketName}`;
@@ -38397,7 +38519,7 @@ function checkCorsSetRateLimit(bucketName, projectId) {
     return;
   }
   if (limit.count >= 10) {
-    throw new import_server17.TRPCError({
+    throw new import_server18.TRPCError({
       code: "TOO_MANY_REQUESTS",
       message: "CORS modification rate limit exceeded. Maximum 10 CORS changes per minute per bucket."
     });
@@ -38514,7 +38636,7 @@ var corsRouter = {
 
 // src/server/Storage/routers/ceph/lifecycleRouter.ts
 var import_client_s37 = require("@aws-sdk/client-s3");
-var import_server18 = require("@trpc/server");
+var import_server19 = require("@trpc/server");
 
 // src/server/Storage/helpers/lifecycleMapper.ts
 function toMidnightUTC(date) {
@@ -38631,7 +38753,7 @@ function checkLifecycleSetRateLimit(bucketName, projectId) {
     return;
   }
   if (limit.count >= 10) {
-    throw new import_server18.TRPCError({
+    throw new import_server19.TRPCError({
       code: "TOO_MANY_REQUESTS",
       message: "Lifecycle modification rate limit exceeded. Maximum 10 lifecycle changes per minute per bucket."
     });
@@ -38913,6 +39035,10 @@ var STORAGE_MAPPINGS = {
   "storage:credentials:create": {
     engine: "storage",
     rule: "storage:credential_create"
+  },
+  "storage:credentials:delete": {
+    engine: "storage",
+    rule: "storage:credential_delete"
   }
 };
 var buildStoragePermissionRouter = /* @__PURE__ */ __name((policyDir) => createPermissionRouter({
@@ -38959,48 +39085,48 @@ var buildObjectStorageRouters = /* @__PURE__ */ __name((policyDir) => ({
 }), "buildObjectStorageRouters");
 
 // src/server/Project/routers/projectRouter.ts
-var import_zod19 = require("zod");
-var import_server19 = require("@trpc/server");
+var import_zod18 = require("zod");
+var import_server20 = require("@trpc/server");
 
 // src/server/Project/types/models.ts
-var import_zod18 = require("zod");
-var baseProjectSchema = import_zod18.z.object({
-  id: import_zod18.z.string(),
-  name: import_zod18.z.string(),
-  enabled: import_zod18.z.boolean(),
-  domain_id: import_zod18.z.string().nullable().optional(),
-  parent_id: import_zod18.z.string().nullable().optional(),
-  is_domain: import_zod18.z.boolean().nullable().optional(),
-  tags: import_zod18.z.array(import_zod18.z.string()).nullable().optional(),
-  options: import_zod18.z.record(import_zod18.z.string(), import_zod18.z.string().or(import_zod18.z.boolean())).nullable().optional(),
-  description: import_zod18.z.string().nullable().optional(),
-  links: import_zod18.z.object({
-    self: import_zod18.z.string().url().nullable().optional()
+var import_zod17 = require("zod");
+var baseProjectSchema = import_zod17.z.object({
+  id: import_zod17.z.string(),
+  name: import_zod17.z.string(),
+  enabled: import_zod17.z.boolean(),
+  domain_id: import_zod17.z.string().nullable().optional(),
+  parent_id: import_zod17.z.string().nullable().optional(),
+  is_domain: import_zod17.z.boolean().nullable().optional(),
+  tags: import_zod17.z.array(import_zod17.z.string()).nullable().optional(),
+  options: import_zod17.z.record(import_zod17.z.string(), import_zod17.z.string().or(import_zod17.z.boolean())).nullable().optional(),
+  description: import_zod17.z.string().nullable().optional(),
+  links: import_zod17.z.object({
+    self: import_zod17.z.string().url().nullable().optional()
   }).optional()
 });
 var projectSchema = baseProjectSchema.extend({
-  domain_name: import_zod18.z.string().optional(),
-  parents: import_zod18.z.array(import_zod18.z.object({
+  domain_name: import_zod17.z.string().optional(),
+  parents: import_zod17.z.array(import_zod17.z.object({
     project: baseProjectSchema
   })).optional()
 });
-var projectResponseSchema = import_zod18.z.object({
+var projectResponseSchema = import_zod17.z.object({
   project: projectSchema
 });
-var projectsResponseSchema = import_zod18.z.object({
-  projects: import_zod18.z.array(projectSchema),
-  links: import_zod18.z.object({
-    self: import_zod18.z.string().url().optional(),
-    previous: import_zod18.z.string().url().nullable().optional(),
-    next: import_zod18.z.string().url().nullable().optional()
+var projectsResponseSchema = import_zod17.z.object({
+  projects: import_zod17.z.array(projectSchema),
+  links: import_zod17.z.object({
+    self: import_zod17.z.string().url().optional(),
+    previous: import_zod17.z.string().url().nullable().optional(),
+    next: import_zod17.z.string().url().nullable().optional()
   }).optional()
 });
 
 // src/server/Project/routers/projectRouter.ts
-var import_signal_openstack5 = __toESM(require_esm());
+var import_signal_openstack6 = __toESM(require_esm());
 async function callIdentityAPI(identityEndpoint, authToken, path3) {
   if (!identityEndpoint) {
-    throw new import_server19.TRPCError({
+    throw new import_server20.TRPCError({
       code: "INTERNAL_SERVER_ERROR",
       message: "Identity endpoint not configured"
     });
@@ -39016,7 +39142,7 @@ async function callIdentityAPI(identityEndpoint, authToken, path3) {
     }
   });
   if (!response.ok) {
-    throw new import_server19.TRPCError({
+    throw new import_server20.TRPCError({
       code: "INTERNAL_SERVER_ERROR",
       message: `Identity API call failed: ${response.status} ${response.statusText}`
     });
@@ -39056,14 +39182,14 @@ var projectRouter = {
   */
   getAuthProjects: protectedProcedure.query(async ({ ctx }) => {
     if (!ctx.openstack) {
-      throw new import_server19.TRPCError({
+      throw new import_server20.TRPCError({
         code: "UNAUTHORIZED",
         message: "No authenticated session"
       });
     }
     const token = ctx.openstack.getToken();
     if (!token?.authToken) {
-      throw new import_server19.TRPCError({
+      throw new import_server20.TRPCError({
         code: "UNAUTHORIZED",
         message: "No auth token available"
       });
@@ -39079,10 +39205,10 @@ var projectRouter = {
       return void 0;
     }
     const domainsData = domainsResponse ? await domainsResponse.json().catch(() => null) : null;
-    const domainsResponseSchema = import_zod19.z.object({
-      domains: import_zod19.z.array(import_zod19.z.object({
-        id: import_zod19.z.string(),
-        name: import_zod19.z.string()
+    const domainsResponseSchema = import_zod18.z.object({
+      domains: import_zod18.z.array(import_zod18.z.object({
+        id: import_zod18.z.string(),
+        name: import_zod18.z.string()
       }))
     });
     const parsedDomains = domainsResponseSchema.safeParse(domainsData);
@@ -39102,18 +39228,18 @@ var projectRouter = {
   * filtered by the optional search term. Uses the OpenStack /v3/auth/projects
   * endpoint which works with any valid token.
   */
-  searchProjects: protectedProcedure.input(import_zod19.z.object({
-    search: import_zod19.z.string().optional()
+  searchProjects: protectedProcedure.input(import_zod18.z.object({
+    search: import_zod18.z.string().optional()
   }).optional()).query(async ({ ctx, input }) => {
     if (!ctx.openstack) {
-      throw new import_server19.TRPCError({
+      throw new import_server20.TRPCError({
         code: "UNAUTHORIZED",
         message: "No authenticated session"
       });
     }
     const token = ctx.openstack.getToken();
     if (!token?.authToken) {
-      throw new import_server19.TRPCError({
+      throw new import_server20.TRPCError({
         code: "UNAUTHORIZED",
         message: "No auth token available"
       });
@@ -39140,18 +39266,18 @@ var projectRouter = {
   * filtered by ID, name, and description using the standard filterBySearchParams helper.
   * This endpoint provides consistent search behavior with other resources in the system.
   */
-  listProjectsWithSearch: protectedProcedure.input(import_zod19.z.object({
-    searchTerm: import_zod19.z.string().optional()
+  listProjectsWithSearch: protectedProcedure.input(import_zod18.z.object({
+    searchTerm: import_zod18.z.string().optional()
   })).query(async ({ ctx, input }) => {
     if (!ctx.openstack) {
-      throw new import_server19.TRPCError({
+      throw new import_server20.TRPCError({
         code: "UNAUTHORIZED",
         message: "No authenticated session"
       });
     }
     const token = ctx.openstack.getToken();
     if (!token?.authToken) {
-      throw new import_server19.TRPCError({
+      throw new import_server20.TRPCError({
         code: "UNAUTHORIZED",
         message: "No auth token available"
       });
@@ -39167,10 +39293,10 @@ var projectRouter = {
       return void 0;
     }
     const domainsData = domainsResponse ? await domainsResponse.json().catch(() => null) : null;
-    const domainsResponseSchema = import_zod19.z.object({
-      domains: import_zod19.z.array(import_zod19.z.object({
-        id: import_zod19.z.string(),
-        name: import_zod19.z.string()
+    const domainsResponseSchema = import_zod18.z.object({
+      domains: import_zod18.z.array(import_zod18.z.object({
+        id: import_zod18.z.string(),
+        name: import_zod18.z.string()
       }))
     });
     const parsedDomains = domainsResponseSchema.safeParse(domainsData);
@@ -39190,25 +39316,25 @@ var projectRouter = {
       "domain_id"
     ]);
   }),
-  getProject: protectedProcedure.input(import_zod19.z.object({
-    projectId: import_zod19.z.string()
+  getProject: protectedProcedure.input(import_zod18.z.object({
+    projectId: import_zod18.z.string()
   })).query(async ({ ctx, input }) => {
     if (!ctx.openstack) {
-      throw new import_server19.TRPCError({
+      throw new import_server20.TRPCError({
         code: "UNAUTHORIZED",
         message: "No authenticated session"
       });
     }
     const token = ctx.openstack.getToken();
     if (!token?.authToken) {
-      throw new import_server19.TRPCError({
+      throw new import_server20.TRPCError({
         code: "UNAUTHORIZED",
         message: "No auth token available"
       });
     }
     let encodedId;
     try {
-      encodedId = (0, import_signal_openstack5.validateAndEncodeResourceId)(input.projectId, "Project");
+      encodedId = (0, import_signal_openstack6.validateAndEncodeResourceId)(input.projectId, "Project");
     } catch {
       return null;
     }
@@ -39228,24 +39354,24 @@ var projectRouters = {
 };
 
 // src/server/Network/routers/floatingIpRouter.ts
-var import_server24 = require("@trpc/server");
+var import_server25 = require("@trpc/server");
 
 // src/server/helpers/errorHandling.ts
-var import_server20 = require("@trpc/server");
-var import_signal_openstack6 = __toESM(require_esm());
+var import_server21 = require("@trpc/server");
+var import_signal_openstack7 = __toESM(require_esm());
 function wrapError3(error, operation) {
-  if (error instanceof import_server20.TRPCError) {
+  if (error instanceof import_server21.TRPCError) {
     return error;
   }
-  if (error instanceof import_signal_openstack6.SignalOpenstackError) {
-    return new import_server20.TRPCError({
+  if (error instanceof import_signal_openstack7.SignalOpenstackError) {
+    return new import_server21.TRPCError({
       code: "BAD_REQUEST",
       message: error.message,
       cause: error
     });
   }
   const baseErrorMessage = `Error during ${operation}`;
-  return new import_server20.TRPCError({
+  return new import_server21.TRPCError({
     code: "INTERNAL_SERVER_ERROR",
     message: typeof error !== "string" && error.message ? `${baseErrorMessage}: ${error.message}` : baseErrorMessage,
     cause: error
@@ -39285,11 +39411,11 @@ function appendQueryParamsFromObject(source, options) {
 __name(appendQueryParamsFromObject, "appendQueryParamsFromObject");
 
 // src/server/helpers/validateOpenstackService.ts
-var import_server21 = require("@trpc/server");
+var import_server22 = require("@trpc/server");
 var capitalize = /* @__PURE__ */ __name((str) => str.charAt(0).toUpperCase() + str.slice(1), "capitalize");
 function validateOpenstackService(service, serviceName) {
   if (!service) {
-    throw new import_server21.TRPCError({
+    throw new import_server22.TRPCError({
       code: "INTERNAL_SERVER_ERROR",
       message: `${capitalize(serviceName)} service is not available`
     });
@@ -39298,19 +39424,19 @@ function validateOpenstackService(service, serviceName) {
 __name(validateOpenstackService, "validateOpenstackService");
 
 // src/server/Network/routers/floatingIpRouter.ts
-var import_signal_openstack7 = __toESM(require_esm());
+var import_signal_openstack8 = __toESM(require_esm());
 
 // src/server/Network/types/floatingIp.ts
-var import_zod21 = require("zod");
+var import_zod20 = require("zod");
 
 // src/server/Network/types/index.ts
-var import_zod20 = require("zod");
-var ISO8601TimestampSchema = import_zod20.z.string().brand("ISO8601Timestamp");
-var SortDirSchema = import_zod20.z.enum([
+var import_zod19 = require("zod");
+var ISO8601TimestampSchema = import_zod19.z.string().brand("ISO8601Timestamp");
+var SortDirSchema = import_zod19.z.enum([
   "asc",
   "desc"
 ]);
-var NetworkPortStatusSchema = import_zod20.z.enum([
+var NetworkPortStatusSchema = import_zod19.z.enum([
   "ACTIVE",
   "DOWN",
   "BUILD",
@@ -39318,153 +39444,153 @@ var NetworkPortStatusSchema = import_zod20.z.enum([
 ]);
 
 // src/server/Network/types/floatingIp.ts
-var FloatingIpStatusSchema = import_zod21.z.enum([
+var FloatingIpStatusSchema = import_zod20.z.enum([
   "ACTIVE",
   "DOWN",
   "ERROR"
 ]);
-var PortDetailsSchema = import_zod21.z.object({
+var PortDetailsSchema = import_zod20.z.object({
   /** The status of the port */
   status: FloatingIpStatusSchema,
   /** The name of the port */
-  name: import_zod21.z.string(),
+  name: import_zod20.z.string(),
   /** Administrative state of the port (true = UP, false = DOWN) */
-  admin_state_up: import_zod21.z.boolean(),
+  admin_state_up: import_zod20.z.boolean(),
   /** The ID of the network the port is attached to */
-  network_id: import_zod21.z.string(),
+  network_id: import_zod20.z.string(),
   /** The owner of the port device */
-  device_owner: import_zod21.z.string(),
+  device_owner: import_zod20.z.string(),
   /** The MAC address of the port */
-  mac_address: import_zod21.z.string(),
+  mac_address: import_zod20.z.string(),
   /** The ID of the device the port is attached to */
-  device_id: import_zod21.z.string()
+  device_id: import_zod20.z.string()
 });
-var PortForwardingSchema = import_zod21.z.object({
+var PortForwardingSchema = import_zod20.z.object({
   /** Port forwarding protocol  */
-  protocol: import_zod21.z.enum([
+  protocol: import_zod20.z.enum([
     "tcp",
     "udp"
   ]),
   /** The internal fixed IP address associated with the port forwarding */
-  internal_ip_address: import_zod21.z.string(),
+  internal_ip_address: import_zod20.z.string(),
   /** The internal port number or starting port of the range */
-  internal_port: import_zod21.z.number().optional(),
+  internal_port: import_zod20.z.number().optional(),
   /** The internal port range (e.g., "1024:2048") */
-  internal_port_range: import_zod21.z.string().optional(),
+  internal_port_range: import_zod20.z.string().optional(),
   /** The internal port ID for the port forwarding (requires floating-ip-port-forwarding-detail extension) */
-  internal_port_id: import_zod21.z.string().optional(),
+  internal_port_id: import_zod20.z.string().optional(),
   /** The external port number or starting port of the range */
-  external_port: import_zod21.z.number().optional(),
+  external_port: import_zod20.z.number().optional(),
   /** The external port range (e.g., "8000:9000") */
-  external_port_range: import_zod21.z.string().optional(),
+  external_port_range: import_zod20.z.string().optional(),
   /** The ID of the port forwarding resource */
-  id: import_zod21.z.string(),
+  id: import_zod20.z.string(),
   /** Description of the port forwarding rule (requires floating-ip-port-forwarding-description extension) */
-  description: import_zod21.z.string().nullable().optional()
+  description: import_zod20.z.string().nullable().optional()
 });
-var FloatingIpSchema = import_zod21.z.object({
+var FloatingIpSchema = import_zod20.z.object({
   /** The ID of the router for the floating IP (null if not associated) */
-  router_id: import_zod21.z.string().nullable(),
+  router_id: import_zod20.z.string().nullable(),
   /** A human-readable description for the resource */
-  description: import_zod21.z.string().nullable().optional(),
+  description: import_zod20.z.string().nullable().optional(),
   /** Whether this is a distributed floating IP (requires floating-ip-distributed extension) */
-  distributed: import_zod21.z.boolean().optional(),
+  distributed: import_zod20.z.boolean().optional(),
   /** A valid DNS domain (requires dns-integration extension) */
-  dns_domain: import_zod21.z.string().optional(),
+  dns_domain: import_zod20.z.string().optional(),
   /** A valid DNS name (requires dns-integration extension) */
-  dns_name: import_zod21.z.string().optional(),
+  dns_name: import_zod20.z.string().optional(),
   /** Time at which the resource was created (UTC ISO8601 format, requires standard-attr-timestamp extension) */
   created_at: ISO8601TimestampSchema.optional(),
   /** Time at which the resource was last updated (UTC ISO8601 format, requires standard-attr-timestamp extension) */
   updated_at: ISO8601TimestampSchema.optional(),
   /** The revision number of the resource (set by server, for concurrency control) */
-  revision_number: import_zod21.z.number(),
+  revision_number: import_zod20.z.number(),
   /** The ID of the project that owns the floating IP */
-  project_id: import_zod21.z.string(),
+  project_id: import_zod20.z.string(),
   /** The ID of the tenant (deprecated, use project_id) */
-  tenant_id: import_zod21.z.string(),
+  tenant_id: import_zod20.z.string(),
   /** The ID of the network associated with the floating IP */
-  floating_network_id: import_zod21.z.string(),
+  floating_network_id: import_zod20.z.string(),
   /** The fixed IP address associated with the floating IP (null if not associated) */
-  fixed_ip_address: import_zod21.z.string().nullable(),
+  fixed_ip_address: import_zod20.z.string().nullable(),
   /** The floating IP address */
-  floating_ip_address: import_zod21.z.string(),
+  floating_ip_address: import_zod20.z.string(),
   /** The ID of the port associated with the floating IP (null if not associated) */
-  port_id: import_zod21.z.string().nullable(),
+  port_id: import_zod20.z.string().nullable(),
   /** The ID of the floating IP address */
-  id: import_zod21.z.string(),
+  id: import_zod20.z.string(),
   /** The status of the floating IP */
   status: FloatingIpStatusSchema,
   /** The information of the associated port (null if not associated, requires fip-port-details extension) */
   port_details: PortDetailsSchema.nullable().optional(),
   /** The list of tags on the resource (requires standard-attr-tag extension) */
-  tags: import_zod21.z.array(import_zod21.z.string()).optional(),
+  tags: import_zod20.z.array(import_zod20.z.string()).optional(),
   /** The associated port forwarding resources for the floating IP (requires expose-port-forwarding-in-fip extension) */
-  port_forwardings: import_zod21.z.array(PortForwardingSchema).nullish(),
+  port_forwardings: import_zod20.z.array(PortForwardingSchema).nullish(),
   /** The ID of the QoS policy of the network where this floating IP is plugged (requires qos-fip extension) */
-  qos_network_policy_id: import_zod21.z.string().optional(),
+  qos_network_policy_id: import_zod20.z.string().optional(),
   /** The ID of the QoS policy associated with the floating IP (requires qos extension) */
-  qos_policy_id: import_zod21.z.string().optional()
-});
-var FloatingIpIdInputSchema = import_zod21.z.object({
-  project_id: import_zod21.z.string(),
-  floatingip_id: import_zod21.z.string()
-});
-var FloatingIpCreateRequestSchema = import_zod21.z.object({
-  project_id: import_zod21.z.string().trim().min(1, "project_id must be a non-empty string"),
-  floating_network_id: import_zod21.z.string(),
-  fixed_ip_address: import_zod21.z.string().optional(),
-  floating_ip_address: import_zod21.z.string().optional(),
-  port_id: import_zod21.z.string().optional(),
-  subnet_id: import_zod21.z.string().optional(),
-  distributed: import_zod21.z.boolean().optional(),
-  description: import_zod21.z.string().optional(),
-  dns_domain: import_zod21.z.string().optional(),
-  dns_name: import_zod21.z.string().optional(),
-  qos_policy_id: import_zod21.z.string().optional()
-});
-var FloatingIpUpdateRequestSchema = import_zod21.z.object({
-  project_id: import_zod21.z.string(),
-  floatingip_id: import_zod21.z.string(),
-  port_id: import_zod21.z.string().nullable(),
-  fixed_ip_address: import_zod21.z.string().optional(),
-  description: import_zod21.z.string().optional(),
-  distributed: import_zod21.z.boolean().optional()
-});
-var FloatingIpResponseSchema = import_zod21.z.object({
+  qos_policy_id: import_zod20.z.string().optional()
+});
+var FloatingIpIdInputSchema = import_zod20.z.object({
+  project_id: import_zod20.z.string(),
+  floatingip_id: import_zod20.z.string()
+});
+var FloatingIpCreateRequestSchema = import_zod20.z.object({
+  project_id: import_zod20.z.string().trim().min(1, "project_id must be a non-empty string"),
+  floating_network_id: import_zod20.z.string(),
+  fixed_ip_address: import_zod20.z.string().optional(),
+  floating_ip_address: import_zod20.z.string().optional(),
+  port_id: import_zod20.z.string().optional(),
+  subnet_id: import_zod20.z.string().optional(),
+  distributed: import_zod20.z.boolean().optional(),
+  description: import_zod20.z.string().optional(),
+  dns_domain: import_zod20.z.string().optional(),
+  dns_name: import_zod20.z.string().optional(),
+  qos_policy_id: import_zod20.z.string().optional()
+});
+var FloatingIpUpdateRequestSchema = import_zod20.z.object({
+  project_id: import_zod20.z.string(),
+  floatingip_id: import_zod20.z.string(),
+  port_id: import_zod20.z.string().nullable(),
+  fixed_ip_address: import_zod20.z.string().optional(),
+  description: import_zod20.z.string().optional(),
+  distributed: import_zod20.z.boolean().optional()
+});
+var FloatingIpResponseSchema = import_zod20.z.object({
   floatingip: FloatingIpSchema
 });
-var FloatingIpListResponseSchema = import_zod21.z.object({
+var FloatingIpListResponseSchema = import_zod20.z.object({
   /** A list of floating IP objects */
-  floatingips: import_zod21.z.array(FloatingIpSchema)
+  floatingips: import_zod20.z.array(FloatingIpSchema)
 });
-var FloatingIpQueryParametersSchema = import_zod21.z.object({
+var FloatingIpQueryParametersSchema = import_zod20.z.object({
   /** Project ID for rescoping (required for projectScopedProcedure) */
-  project_id: import_zod21.z.string(),
+  project_id: import_zod20.z.string(),
   /** Filter by the ID of the floating IP */
-  id: import_zod21.z.string().optional(),
+  id: import_zod20.z.string().optional(),
   /** Filter by the ID of the router for the floating IP */
-  router_id: import_zod21.z.string().nullable().optional(),
+  router_id: import_zod20.z.string().nullable().optional(),
   /** Filter by the status of the floating IP */
   status: FloatingIpStatusSchema.optional(),
   /** Filter by the ID of the project that owns the resource */
-  tenant_id: import_zod21.z.string().optional(),
+  tenant_id: import_zod20.z.string().optional(),
   /** Filter by the revision number of the resource */
-  revision_number: import_zod21.z.number().optional(),
+  revision_number: import_zod20.z.number().optional(),
   /** Filter by the human-readable description of the resource */
-  description: import_zod21.z.string().nullable().optional(),
+  description: import_zod20.z.string().nullable().optional(),
   /** Filter by the ID of the network associated with the floating IP */
-  floating_network_id: import_zod21.z.string().optional(),
+  floating_network_id: import_zod20.z.string().optional(),
   /** Filter by the fixed IP address associated with the floating IP */
-  fixed_ip_address: import_zod21.z.string().optional(),
+  fixed_ip_address: import_zod20.z.string().optional(),
   /** Filter by the floating IP address */
-  floating_ip_address: import_zod21.z.string().optional(),
+  floating_ip_address: import_zod20.z.string().optional(),
   /** Filter by the ID of a port associated with the floating IP */
-  port_id: import_zod21.z.string().nullable().optional(),
+  port_id: import_zod20.z.string().nullable().optional(),
   /** Sort direction (asc or desc) */
   sort_dir: SortDirSchema.optional(),
   /** Sort key - valid keys: fixed_ip_address, floating_ip_address, floating_network_id, id, router_id, status, tenant_id, project_id */
-  sort_key: import_zod21.z.enum([
+  sort_key: import_zod20.z.enum([
     "fixed_ip_address",
     "floating_ip_address",
     "floating_network_id",
@@ -39475,80 +39601,80 @@ var FloatingIpQueryParametersSchema = import_zod21.z.object({
     "project_id"
   ]).optional(),
   /** Filter by tags (comma-separated, resources must match all tags) -  requires standard-attr-tag extension */
-  tags: import_zod21.z.array(import_zod21.z.string()).optional(),
+  tags: import_zod20.z.array(import_zod20.z.string()).optional(),
   /** Filter by tags with OR logic (comma-separated, resources match any tag) */
-  "tags-any": import_zod21.z.string().optional(),
+  "tags-any": import_zod20.z.string().optional(),
   /** Exclude resources with these tags (comma-separated, resources must match all excluded tags) */
-  "not-tags": import_zod21.z.string().optional(),
+  "not-tags": import_zod20.z.string().optional(),
   /** Exclude resources with these tags using OR logic (comma-separated, resources match any excluded tag) */
-  "not-tags-any": import_zod21.z.string().optional(),
+  "not-tags-any": import_zod20.z.string().optional(),
   /** Specific fields to return (can be repeated) */
-  fields: import_zod21.z.union([
-    import_zod21.z.string(),
-    import_zod21.z.array(import_zod21.z.string())
+  fields: import_zod20.z.union([
+    import_zod20.z.string(),
+    import_zod20.z.array(import_zod20.z.string())
   ]).optional(),
   /** Pagination limit */
-  limit: import_zod21.z.number().optional(),
+  limit: import_zod20.z.number().optional(),
   /** Pagination marker (ID of the last item in the previous list) */
-  marker: import_zod21.z.string().optional(),
+  marker: import_zod20.z.string().optional(),
   /** Pagination direction (false = ascending, true = descending) */
-  page_reverse: import_zod21.z.boolean().optional(),
+  page_reverse: import_zod20.z.boolean().optional(),
   // BFF-side search (filtered in BFF layer, not sent to OpenStack)
-  searchTerm: import_zod21.z.string().optional()
-});
-var ExternalNetworksQuerySchema = import_zod21.z.object({
-  project_id: import_zod21.z.string(),
-  "router:external": import_zod21.z.literal(true).default(true)
-});
-var ExternalNetworkSchema = import_zod21.z.object({
-  id: import_zod21.z.string(),
-  name: import_zod21.z.string(),
-  project_id: import_zod21.z.string(),
-  "router:external": import_zod21.z.boolean().optional(),
-  shared: import_zod21.z.boolean(),
+  searchTerm: import_zod20.z.string().optional()
+});
+var ExternalNetworksQuerySchema = import_zod20.z.object({
+  project_id: import_zod20.z.string(),
+  "router:external": import_zod20.z.literal(true).default(true)
+});
+var ExternalNetworkSchema = import_zod20.z.object({
+  id: import_zod20.z.string(),
+  name: import_zod20.z.string(),
+  project_id: import_zod20.z.string(),
+  "router:external": import_zod20.z.boolean().optional(),
+  shared: import_zod20.z.boolean(),
   status: NetworkPortStatusSchema,
   updated_at: ISO8601TimestampSchema.optional(),
-  is_default: import_zod21.z.boolean().optional()
+  is_default: import_zod20.z.boolean().optional()
 });
-var ExternalNetworksResponseSchema = import_zod21.z.object({
-  networks: import_zod21.z.array(ExternalNetworkSchema)
+var ExternalNetworksResponseSchema = import_zod20.z.object({
+  networks: import_zod20.z.array(ExternalNetworkSchema)
 });
-var DnsDomainSchema = import_zod21.z.object({
-  id: import_zod21.z.string(),
-  name: import_zod21.z.string()
+var DnsDomainSchema = import_zod20.z.object({
+  id: import_zod20.z.string(),
+  name: import_zod20.z.string()
 });
-var DnsDomainResponseSchema = import_zod21.z.object({
-  zones: import_zod21.z.array(DnsDomainSchema)
+var DnsDomainResponseSchema = import_zod20.z.object({
+  zones: import_zod20.z.array(DnsDomainSchema)
 });
-var AvailablePortsQuerySchema = import_zod21.z.object({
-  project_id: import_zod21.z.string(),
+var AvailablePortsQuerySchema = import_zod20.z.object({
+  project_id: import_zod20.z.string(),
   /** Only ACTIVE ports are eligible for floating IP association */
-  status: import_zod21.z.literal("ACTIVE").default("ACTIVE"),
+  status: import_zod20.z.literal("ACTIVE").default("ACTIVE"),
   /** Only administratively UP ports are eligible for floating IP association */
-  admin_state_up: import_zod21.z.literal(true).default(true)
+  admin_state_up: import_zod20.z.literal(true).default(true)
 });
-var AvailablePortSchema = import_zod21.z.object({
+var AvailablePortSchema = import_zod20.z.object({
   /** The ID of the port */
-  id: import_zod21.z.string(),
+  id: import_zod20.z.string(),
   /** Human-readable name of the port */
-  name: import_zod21.z.string().nullable().optional(),
+  name: import_zod20.z.string().nullable().optional(),
   /** List of fixed IPs assigned to the port, each entry pairs an IP address with its subnet. */
-  fixed_ips: import_zod21.z.array(import_zod21.z.object({
+  fixed_ips: import_zod20.z.array(import_zod20.z.object({
     /** The fixed IP address assigned to the port */
-    ip_address: import_zod21.z.string(),
+    ip_address: import_zod20.z.string(),
     /** The ID of the subnet the IP belongs to */
-    subnet_id: import_zod21.z.string().optional()
+    subnet_id: import_zod20.z.string().optional()
   })).optional()
 });
-var AvailablePortsResponseSchema = import_zod21.z.object({
-  ports: import_zod21.z.array(AvailablePortSchema)
+var AvailablePortsResponseSchema = import_zod20.z.object({
+  ports: import_zod20.z.array(AvailablePortSchema)
 });
 
 // src/server/Network/helpers/errorHandling.ts
-var import_server23 = require("@trpc/server");
+var import_server24 = require("@trpc/server");
 
 // src/server/Network/helpers/index.ts
-var import_server22 = require("@trpc/server");
+var import_server23 = require("@trpc/server");
 var HTTP_STATUS_ERROR_MAP = {
   400: "BAD_REQUEST",
   401: "UNAUTHORIZED",
@@ -39568,7 +39694,7 @@ var parseOrThrow = /* @__PURE__ */ __name((schema, data, context) => {
   const parsed = schema.safeParse(data);
   if (!parsed.success) {
     console.error(`Zod Parsing Error in ${context}:`, parsed.error.issues);
-    throw new import_server22.TRPCError({
+    throw new import_server23.TRPCError({
       code: "PARSE_ERROR",
       message: `Failed to parse response in ${context}`
     });
@@ -39578,27 +39704,27 @@ var parseOrThrow = /* @__PURE__ */ __name((schema, data, context) => {
 
 // src/server/Network/helpers/errorHandling.ts
 var DEFAULT_HANDLERS = {
-  400: (response, resourceLabel) => new import_server23.TRPCError({
+  400: (response, resourceLabel) => new import_server24.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[400],
     message: `Invalid request data for ${resourceLabel}: ${response.statusText || "Unknown error"}`
   }),
-  401: (response, resourceLabel) => new import_server23.TRPCError({
+  401: (response, resourceLabel) => new import_server24.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[401],
     message: `Unauthorized access to ${resourceLabel}: ${response.statusText || "Unknown error"}`
   }),
-  403: (response, resourceLabel) => new import_server23.TRPCError({
+  403: (response, resourceLabel) => new import_server24.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[403],
     message: `Access forbidden to ${resourceLabel}: ${response.statusText || "Unknown error"}`
   }),
-  404: (response, resourceLabel) => new import_server23.TRPCError({
+  404: (response, resourceLabel) => new import_server24.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[404],
     message: `${resourceLabel} not found: ${response.statusText || "Unknown error"}`
   }),
-  409: (response, resourceLabel) => new import_server23.TRPCError({
+  409: (response, resourceLabel) => new import_server24.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[409],
     message: `Conflict - ${resourceLabel} is in use: ${response.statusText || "Unknown error"}`
   }),
-  412: (response, resourceLabel) => new import_server23.TRPCError({
+  412: (response, resourceLabel) => new import_server24.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[412],
     message: `Precondition failed - revision number mismatch in ${resourceLabel}: ${response.statusText || "Unknown error"}`
   })
@@ -39613,7 +39739,7 @@ var ErrorHandler = /* @__PURE__ */ __name((resourceName, customHandlers) => {
     if (response.status && handlers[response.status]) {
       return handlers[response.status](response, resourceLabel);
     }
-    return new import_server23.TRPCError({
+    return new import_server24.TRPCError({
       code: DEFAULT_ERROR_NAME,
       message: `Failed to process ${resourceLabel}: ${response.statusText || "Unknown error"}`
     });
@@ -39663,7 +39789,7 @@ var floatingIpRouter = {
       const token = ctx.openstack?.getToken();
       const projectId = token?.tokenData.project?.id;
       if (!projectId) {
-        throw new import_server24.TRPCError({
+        throw new import_server25.TRPCError({
           code: "UNAUTHORIZED",
           message: "No project scope in session"
         });
@@ -39714,7 +39840,7 @@ var floatingIpRouter = {
     return withErrorHandling3(async () => {
       const { floatingip_id } = input;
       const network = getNetworkService(ctx);
-      const encodedId = (0, import_signal_openstack7.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
+      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
       const response = await network.get(`${FLOATING_IPS_BASE_URL}/${encodedId}`);
       if (!response.ok) {
         throw FloatingIpErrorHandlers.get(response, floatingip_id);
@@ -39741,7 +39867,7 @@ var floatingIpRouter = {
           }
         }
       };
-      const encodedId = (0, import_signal_openstack7.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
+      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
       const response = await network.put(`${FLOATING_IPS_BASE_URL}/${encodedId}`, requestBody);
       if (!response.ok) {
         throw FloatingIpErrorHandlers.update(response, floatingip_id);
@@ -39754,7 +39880,7 @@ var floatingIpRouter = {
     return withErrorHandling3(async () => {
       const { floatingip_id } = input;
       const network = getNetworkService(ctx);
-      const encodedId = (0, import_signal_openstack7.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
+      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
       const response = await network.del(`${FLOATING_IPS_BASE_URL}/${encodedId}`);
       if (!response.ok) {
         throw FloatingIpErrorHandlers.delete(response, floatingip_id);
@@ -39803,115 +39929,115 @@ var floatingIpRouter = {
 };
 
 // src/server/Network/types/securityGroup.ts
-var import_zod22 = require("zod");
-var securityGroupRuleSchema = import_zod22.z.object({
-  id: import_zod22.z.string(),
-  direction: import_zod22.z.enum([
+var import_zod21 = require("zod");
+var securityGroupRuleSchema = import_zod21.z.object({
+  id: import_zod21.z.string(),
+  direction: import_zod21.z.enum([
     "ingress",
     "egress"
   ]).optional(),
-  ethertype: import_zod22.z.enum([
+  ethertype: import_zod21.z.enum([
     "IPv4",
     "IPv6"
   ]).optional(),
-  description: import_zod22.z.string().nullable().optional(),
-  security_group_id: import_zod22.z.string().optional(),
-  protocol: import_zod22.z.string().nullable().optional(),
-  port_range_min: import_zod22.z.number().nullable().optional(),
-  port_range_max: import_zod22.z.number().nullable().optional(),
-  remote_ip_prefix: import_zod22.z.string().nullable().optional(),
-  remote_group_id: import_zod22.z.string().nullable().optional(),
-  remote_address_group_id: import_zod22.z.string().nullable().optional(),
-  tenant_id: import_zod22.z.string().nullable().optional(),
-  project_id: import_zod22.z.string().nullable().optional(),
-  revision_number: import_zod22.z.number().optional(),
-  tags: import_zod22.z.array(import_zod22.z.string()).optional(),
-  created_at: import_zod22.z.string().optional(),
-  updated_at: import_zod22.z.string().nullable().optional()
+  description: import_zod21.z.string().nullable().optional(),
+  security_group_id: import_zod21.z.string().optional(),
+  protocol: import_zod21.z.string().nullable().optional(),
+  port_range_min: import_zod21.z.number().nullable().optional(),
+  port_range_max: import_zod21.z.number().nullable().optional(),
+  remote_ip_prefix: import_zod21.z.string().nullable().optional(),
+  remote_group_id: import_zod21.z.string().nullable().optional(),
+  remote_address_group_id: import_zod21.z.string().nullable().optional(),
+  tenant_id: import_zod21.z.string().nullable().optional(),
+  project_id: import_zod21.z.string().nullable().optional(),
+  revision_number: import_zod21.z.number().optional(),
+  tags: import_zod21.z.array(import_zod21.z.string()).optional(),
+  created_at: import_zod21.z.string().optional(),
+  updated_at: import_zod21.z.string().nullable().optional()
 });
-var securityGroupSchema = import_zod22.z.object({
-  id: import_zod22.z.string(),
-  name: import_zod22.z.string().nullable().optional(),
-  description: import_zod22.z.string().nullable().optional(),
-  tenant_id: import_zod22.z.string().nullable().optional(),
-  project_id: import_zod22.z.string().nullable().optional(),
-  stateful: import_zod22.z.boolean().optional(),
-  shared: import_zod22.z.boolean().optional(),
-  tags: import_zod22.z.array(import_zod22.z.string()).optional(),
-  security_group_rules: import_zod22.z.array(securityGroupRuleSchema).optional(),
-  revision_number: import_zod22.z.number().optional(),
-  created_at: import_zod22.z.string().optional(),
-  updated_at: import_zod22.z.string().nullable().optional()
-});
-var securityGroupsResponseSchema = import_zod22.z.object({
-  security_groups: import_zod22.z.array(securityGroupSchema)
-});
-var securityGroupResponseSchema = import_zod22.z.object({
+var securityGroupSchema = import_zod21.z.object({
+  id: import_zod21.z.string(),
+  name: import_zod21.z.string().nullable().optional(),
+  description: import_zod21.z.string().nullable().optional(),
+  tenant_id: import_zod21.z.string().nullable().optional(),
+  project_id: import_zod21.z.string().nullable().optional(),
+  stateful: import_zod21.z.boolean().optional(),
+  shared: import_zod21.z.boolean().optional(),
+  tags: import_zod21.z.array(import_zod21.z.string()).optional(),
+  security_group_rules: import_zod21.z.array(securityGroupRuleSchema).optional(),
+  revision_number: import_zod21.z.number().optional(),
+  created_at: import_zod21.z.string().optional(),
+  updated_at: import_zod21.z.string().nullable().optional()
+});
+var securityGroupsResponseSchema = import_zod21.z.object({
+  security_groups: import_zod21.z.array(securityGroupSchema)
+});
+var securityGroupResponseSchema = import_zod21.z.object({
   security_group: securityGroupSchema
 });
-var securityGroupRuleResponseSchema = import_zod22.z.object({
+var securityGroupRuleResponseSchema = import_zod21.z.object({
   security_group_rule: securityGroupRuleSchema
 });
 var listSecurityGroupsInputSchema = projectScopedInputSchema.extend({
   // Sorting
-  sort_key: import_zod22.z.string().optional(),
+  sort_key: import_zod21.z.string().optional(),
   sort_dir: SortDirSchema.optional(),
   // Basic filtering
-  name: import_zod22.z.string().optional(),
-  description: import_zod22.z.string().optional(),
-  shared: import_zod22.z.boolean().optional(),
+  name: import_zod21.z.string().optional(),
+  description: import_zod21.z.string().optional(),
+  shared: import_zod21.z.boolean().optional(),
   // Tag-based filtering (string values follow Neutron semantics)
-  tags: import_zod22.z.string().optional(),
-  tags_any: import_zod22.z.string().optional(),
-  not_tags: import_zod22.z.string().optional(),
-  not_tags_any: import_zod22.z.string().optional(),
+  tags: import_zod21.z.string().optional(),
+  tags_any: import_zod21.z.string().optional(),
+  not_tags: import_zod21.z.string().optional(),
+  not_tags_any: import_zod21.z.string().optional(),
   // Filtered in the BFF layer, not forwarded to Neutron
-  stateful: import_zod22.z.boolean().optional(),
+  stateful: import_zod21.z.boolean().optional(),
   // BFF-side search (filtered in BFF layer, not sent to OpenStack)
-  searchTerm: import_zod22.z.string().optional()
+  searchTerm: import_zod21.z.string().optional()
 });
 var getSecurityGroupByIdInputSchema = projectScopedInputSchema.extend({
-  securityGroupId: import_zod22.z.string()
+  securityGroupId: import_zod21.z.string()
 });
 var createSecurityGroupInputSchema = projectScopedInputSchema.extend({
-  name: import_zod22.z.string().min(1, "Name is required"),
-  description: import_zod22.z.string().optional(),
-  stateful: import_zod22.z.boolean().optional()
+  name: import_zod21.z.string().min(1, "Name is required"),
+  description: import_zod21.z.string().optional(),
+  stateful: import_zod21.z.boolean().optional()
 });
 var deleteSecurityGroupInputSchema = projectScopedInputSchema.extend({
-  securityGroupId: import_zod22.z.string()
+  securityGroupId: import_zod21.z.string()
 });
 var updateSecurityGroupInputSchema = projectScopedInputSchema.extend({
-  securityGroupId: import_zod22.z.string(),
-  name: import_zod22.z.string().min(1, "Name is required").optional(),
-  description: import_zod22.z.string().optional(),
-  stateful: import_zod22.z.boolean().optional()
+  securityGroupId: import_zod21.z.string(),
+  name: import_zod21.z.string().min(1, "Name is required").optional(),
+  description: import_zod21.z.string().optional(),
+  stateful: import_zod21.z.boolean().optional()
 });
 var deleteSecurityGroupRuleInputSchema = projectScopedInputSchema.extend({
-  ruleId: import_zod22.z.string()
+  ruleId: import_zod21.z.string()
 });
 var createSecurityGroupRuleInputSchema = projectScopedInputSchema.extend({
-  security_group_id: import_zod22.z.string(),
-  direction: import_zod22.z.enum([
+  security_group_id: import_zod21.z.string(),
+  direction: import_zod21.z.enum([
     "ingress",
     "egress"
   ]),
-  ethertype: import_zod22.z.enum([
+  ethertype: import_zod21.z.enum([
     "IPv4",
     "IPv6"
   ]).default("IPv4"),
-  description: import_zod22.z.string().optional(),
-  protocol: import_zod22.z.string().nullable().optional(),
-  port_range_min: import_zod22.z.number().int().max(65535).nullable().optional(),
-  port_range_max: import_zod22.z.number().int().max(65535).nullable().optional(),
+  description: import_zod21.z.string().optional(),
+  protocol: import_zod21.z.string().nullable().optional(),
+  port_range_min: import_zod21.z.number().int().max(65535).nullable().optional(),
+  port_range_max: import_zod21.z.number().int().max(65535).nullable().optional(),
   // Transform empty strings to undefined for proper validation
-  remote_ip_prefix: import_zod22.z.string().nullable().optional().transform((val) => val === "" ? void 0 : val),
-  remote_group_id: import_zod22.z.string().nullable().optional().transform((val) => val === "" ? void 0 : val),
-  remote_address_group_id: import_zod22.z.string().nullable().optional().transform((val) => val === "" ? void 0 : val)
+  remote_ip_prefix: import_zod21.z.string().nullable().optional().transform((val) => val === "" ? void 0 : val),
+  remote_group_id: import_zod21.z.string().nullable().optional().transform((val) => val === "" ? void 0 : val),
+  remote_address_group_id: import_zod21.z.string().nullable().optional().transform((val) => val === "" ? void 0 : val)
 });
 
 // src/server/Network/helpers/securityGroupHelpers.ts
-var import_server25 = require("@trpc/server");
+var import_server26 = require("@trpc/server");
 var SecurityGroupErrorHandlers = {
   /**
   * Handles errors specific to security group list operations
@@ -39921,17 +40047,17 @@ var SecurityGroupErrorHandlers = {
   list: /* @__PURE__ */ __name((response) => {
     switch (response.status) {
       case 401:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${response.statusText || "Unknown error"}`
         });
       default:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to list security groups: ${response.statusText || "Unknown error"}`
         });
@@ -39946,22 +40072,22 @@ var SecurityGroupErrorHandlers = {
   getById: /* @__PURE__ */ __name((response, securityGroupId) => {
     switch (response.status) {
       case 401:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${response.statusText || "Unknown error"}`
         });
       case 404:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: `Security group not found: ${securityGroupId}`
         });
       default:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to fetch security group: ${response.statusText || "Unknown error"}`
         });
@@ -39975,32 +40101,32 @@ var SecurityGroupErrorHandlers = {
   create: /* @__PURE__ */ __name((response) => {
     switch (response.status) {
       case 401:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${response.statusText || "Unknown error"}`
         });
       case 409:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[409],
           message: `Conflict: ${response.statusText || "Security group already exists"}`
         });
       case 413:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: "BAD_REQUEST",
           message: `Quota exceeded for security groups. Please delete an existing security group or contact your administrator to increase your quota.`
         });
       case 400:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: "BAD_REQUEST",
           message: `Invalid request: ${response.statusText || "Unknown error"}`
         });
       default:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: "INTERNAL_SERVER_ERROR",
           message: `Failed to create security group: ${response.statusText || "Unknown error"}`
         });
@@ -40015,22 +40141,22 @@ var SecurityGroupErrorHandlers = {
   delete: /* @__PURE__ */ __name((response, securityGroupId) => {
     switch (response.status) {
       case 401:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 404:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: `Security group not found: ${securityGroupId}`
         });
       case 409:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[409],
           message: "Cannot delete security group because it is in use by one or more ports. Please remove all associations before deleting."
         });
       default:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to delete security group: ${response.statusText || "Unknown error"}`
         });
@@ -40045,39 +40171,39 @@ var SecurityGroupErrorHandlers = {
   update: /* @__PURE__ */ __name((response, securityGroupId) => {
     const errorMessage = response.statusText || "";
     if (errorMessage.toLowerCase().includes("stateful") && errorMessage.toLowerCase().includes("in use")) {
-      return new import_server25.TRPCError({
+      return new import_server26.TRPCError({
         code: "CONFLICT",
         message: "Cannot update the 'stateful' attribute because this security group is in use by one or more ports."
       });
     }
     switch (response.status) {
       case 401:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${errorMessage || "Unknown error"}`
         });
       case 404:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: `Security group not found: ${securityGroupId}`
         });
       case 409:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[409],
           message: `Conflict: ${errorMessage || "Security group conflict"}`
         });
       case 400:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[400],
           message: `Invalid request: ${errorMessage || "Unknown error"}`
         });
       default:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to update security group: ${errorMessage || "Unknown error"}`
         });
@@ -40095,48 +40221,48 @@ var SecurityGroupRuleErrorHandlers = {
     switch (response.status) {
       case 400:
         if (statusText.toLowerCase().includes("cidr")) {
-          return new import_server25.TRPCError({
+          return new import_server26.TRPCError({
             code: "BAD_REQUEST",
             message: "Invalid CIDR format. Please provide a valid IP address block (e.g., 0.0.0.0/0)"
           });
         }
         if (statusText.toLowerCase().includes("port")) {
-          return new import_server25.TRPCError({
+          return new import_server26.TRPCError({
             code: "BAD_REQUEST",
             message: "Invalid port range. Ports must be between 1 and 65535, and min must be <= max"
           });
         }
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: "BAD_REQUEST",
           message: `Invalid request: ${statusText}`
         });
       case 401:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: "UNAUTHORIZED",
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: "FORBIDDEN",
           message: `Access forbidden: ${statusText}`
         });
       case 404:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: "NOT_FOUND",
           message: "Security group not found"
         });
       case 409:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: "CONFLICT",
           message: "A rule with these parameters already exists in this security group"
         });
       case 413:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: "BAD_REQUEST",
           message: "Quota exceeded for security group rules. Please delete existing rules or contact your administrator."
         });
       default:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: "INTERNAL_SERVER_ERROR",
           message: `Failed to create security group rule: ${statusText}`
         });
@@ -40155,22 +40281,22 @@ var SecurityGroupRuleErrorHandlers = {
   delete: /* @__PURE__ */ __name((response, ruleId) => {
     switch (response.status) {
       case 401:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: "UNAUTHORIZED",
           message: "Unauthorized access"
         });
       case 404:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: "NOT_FOUND",
           message: `Security group rule not found: ${ruleId}`
         });
       case 412:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: "PRECONDITION_FAILED",
           message: `Cannot delete security group rule: precondition failed`
         });
       default:
-        return new import_server25.TRPCError({
+        return new import_server26.TRPCError({
           code: "INTERNAL_SERVER_ERROR",
           message: `Failed to delete security group rule: ${response.statusText || "Unknown error"}`
         });
@@ -40181,7 +40307,7 @@ var parseOpenStackResponse = /* @__PURE__ */ __name((data, schema, operation, er
   const parsed = schema.safeParse(data);
   if (!parsed.success) {
     console.error(`Zod Parsing Error in ${operation}:`, parsed.error.format());
-    throw new import_server25.TRPCError({
+    throw new import_server26.TRPCError({
       code: "INTERNAL_SERVER_ERROR",
       message: errorMessage
     });
@@ -40240,7 +40366,7 @@ var sortSecurityGroups = /* @__PURE__ */ __name((items, sortKey, sortDir = "asc"
 }, "sortSecurityGroups");
 
 // src/server/Network/routers/securityGroupRouter.ts
-var import_signal_openstack8 = __toESM(require_esm());
+var import_signal_openstack9 = __toESM(require_esm());
 var SECURITY_GROUPS_BASE_URL = "v2.0/security-groups";
 var LIST_SECURITY_GROUPS_QUERY_KEY_MAP = {
   tags_any: "tags-any",
@@ -40296,7 +40422,7 @@ var securityGroupRouter = {
     return withErrorHandling3(async () => {
       const { securityGroupId } = input;
       const network = getNetworkService(ctx);
-      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(securityGroupId, "Security group");
+      const encodedId = (0, import_signal_openstack9.validateAndEncodeResourceId)(securityGroupId, "Security group");
       const response = await network.get(`${SECURITY_GROUPS_BASE_URL}/${encodedId}`);
       if (!response.ok) {
         throw SecurityGroupErrorHandlers.getById(response, securityGroupId);
@@ -40332,7 +40458,7 @@ var securityGroupRouter = {
     return withErrorHandling3(async () => {
       const { securityGroupId } = input;
       const network = getNetworkService(ctx);
-      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(securityGroupId, "Security group");
+      const encodedId = (0, import_signal_openstack9.validateAndEncodeResourceId)(securityGroupId, "Security group");
       const response = await network.del(`${SECURITY_GROUPS_BASE_URL}/${encodedId}`);
       if (!response?.ok) {
         throw SecurityGroupErrorHandlers.delete(response, securityGroupId);
@@ -40356,7 +40482,7 @@ var securityGroupRouter = {
           }
         }
       };
-      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(securityGroupId, "Security group");
+      const encodedId = (0, import_signal_openstack9.validateAndEncodeResourceId)(securityGroupId, "Security group");
       const response = await network.put(`${SECURITY_GROUPS_BASE_URL}/${encodedId}`, requestBody);
       if (!response.ok) {
         throw SecurityGroupErrorHandlers.update(response, securityGroupId);
@@ -40368,14 +40494,14 @@ var securityGroupRouter = {
 };
 
 // src/server/Network/routers/securityGroupRuleRouter.ts
-var import_signal_openstack9 = __toESM(require_esm());
+var import_signal_openstack10 = __toESM(require_esm());
 var SECURITY_GROUP_RULES_BASE_URL = "v2.0/security-group-rules";
 var securityGroupRuleRouter = {
   delete: projectScopedProcedure.input(deleteSecurityGroupRuleInputSchema).mutation(async ({ input, ctx }) => {
     return withErrorHandling3(async () => {
       const { ruleId } = input;
       const network = getNetworkService(ctx);
-      const encodedRuleId = (0, import_signal_openstack9.validateAndEncodeResourceId)(ruleId, "Security group rule");
+      const encodedRuleId = (0, import_signal_openstack10.validateAndEncodeResourceId)(ruleId, "Security group rule");
       const response = await network.del(`${SECURITY_GROUP_RULES_BASE_URL}/${encodedRuleId}`);
       if (!response?.ok) {
         throw SecurityGroupRuleErrorHandlers.delete(response, ruleId);
@@ -40424,46 +40550,46 @@ var securityGroupRuleRouter = {
 };
 
 // src/server/Network/types/rbacPolicy.ts
-var import_zod23 = require("zod");
-var rbacPolicySchema = import_zod23.z.object({
-  id: import_zod23.z.string(),
-  object_type: import_zod23.z.enum([
+var import_zod22 = require("zod");
+var rbacPolicySchema = import_zod22.z.object({
+  id: import_zod22.z.string(),
+  object_type: import_zod22.z.enum([
     "qos_policy",
     "network",
     "security_group"
   ]),
-  object_id: import_zod23.z.string(),
-  action: import_zod23.z.enum([
+  object_id: import_zod22.z.string(),
+  action: import_zod22.z.enum([
     "access_as_shared",
     "access_as_external"
   ]),
-  target_tenant: import_zod23.z.string(),
-  tenant_id: import_zod23.z.string().nullable().optional(),
-  project_id: import_zod23.z.string().nullable().optional()
+  target_tenant: import_zod22.z.string(),
+  tenant_id: import_zod22.z.string().nullable().optional(),
+  project_id: import_zod22.z.string().nullable().optional()
 });
-var rbacPoliciesResponseSchema = import_zod23.z.object({
-  rbac_policies: import_zod23.z.array(rbacPolicySchema)
+var rbacPoliciesResponseSchema = import_zod22.z.object({
+  rbac_policies: import_zod22.z.array(rbacPolicySchema)
 });
-var rbacPolicyResponseSchema = import_zod23.z.object({
+var rbacPolicyResponseSchema = import_zod22.z.object({
   rbac_policy: rbacPolicySchema
 });
 var listRBACPoliciesForSecurityGroupInputSchema = projectScopedInputSchema.extend({
-  securityGroupId: import_zod23.z.string()
+  securityGroupId: import_zod22.z.string()
 });
 var createRBACPolicyInputSchema = projectScopedInputSchema.extend({
-  securityGroupId: import_zod23.z.string(),
-  targetTenant: import_zod23.z.string().trim().min(1, "Target project ID is required")
+  securityGroupId: import_zod22.z.string(),
+  targetTenant: import_zod22.z.string().trim().min(1, "Target project ID is required")
 });
 var updateRBACPolicyInputSchema = projectScopedInputSchema.extend({
-  policyId: import_zod23.z.string(),
-  targetTenant: import_zod23.z.string().trim().min(1, "Target project ID is required")
+  policyId: import_zod22.z.string(),
+  targetTenant: import_zod22.z.string().trim().min(1, "Target project ID is required")
 });
 var deleteRBACPolicyInputSchema = projectScopedInputSchema.extend({
-  policyId: import_zod23.z.string()
+  policyId: import_zod22.z.string()
 });
 
 // src/server/Network/helpers/rbacPolicyHelpers.ts
-var import_server26 = require("@trpc/server");
+var import_server27 = require("@trpc/server");
 var RBACPolicyErrorHandlers = {
   /**
   * Handles errors specific to RBAC policy list operations
@@ -40473,17 +40599,17 @@ var RBACPolicyErrorHandlers = {
   list: /* @__PURE__ */ __name((response) => {
     switch (response.status) {
       case 401:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${response.statusText || "Unknown error"}`
         });
       default:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to list RBAC policies: ${response.statusText || "Unknown error"}`
         });
@@ -40497,32 +40623,32 @@ var RBACPolicyErrorHandlers = {
   create: /* @__PURE__ */ __name((response) => {
     switch (response.status) {
       case 400:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[400],
           message: `Invalid request: ${response.statusText || "Unknown error"}`
         });
       case 401:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: "You don't have permission to share this security group"
         });
       case 404:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: "Security group not found or target project does not exist"
         });
       case 409:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[409],
           message: "This security group is already shared with the specified project"
         });
       default:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: "INTERNAL_SERVER_ERROR",
           message: `Failed to create RBAC policy: ${response.statusText || "Unknown error"}`
         });
@@ -40537,27 +40663,27 @@ var RBACPolicyErrorHandlers = {
   update: /* @__PURE__ */ __name((response, policyId) => {
     switch (response.status) {
       case 400:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[400],
           message: `Invalid request: ${response.statusText || "Unknown error"}`
         });
       case 401:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${response.statusText || "Unknown error"}`
         });
       case 404:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: `RBAC policy not found: ${policyId}`
         });
       default:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: "INTERNAL_SERVER_ERROR",
           message: `Failed to update RBAC policy: ${response.statusText || "Unknown error"}`
         });
@@ -40572,22 +40698,22 @@ var RBACPolicyErrorHandlers = {
   delete: /* @__PURE__ */ __name((response, policyId) => {
     switch (response.status) {
       case 401:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 404:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: `RBAC policy not found: ${policyId}`
         });
       case 409:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[409],
           message: "Cannot delete RBAC policy because it is in use"
         });
       default:
-        return new import_server26.TRPCError({
+        return new import_server27.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to delete RBAC policy: ${response.statusText || "Unknown error"}`
         });
@@ -40598,7 +40724,7 @@ var parseOpenStackResponse2 = /* @__PURE__ */ __name((data, schema, operation, e
   const parsed = schema.safeParse(data);
   if (!parsed.success) {
     console.error(`Zod Parsing Error in ${operation}:`, parsed.error.format());
-    throw new import_server26.TRPCError({
+    throw new import_server27.TRPCError({
       code: "INTERNAL_SERVER_ERROR",
       message: errorMessage
     });
@@ -40617,7 +40743,7 @@ function parseRBACPoliciesListResponse(data, operation) {
 __name(parseRBACPoliciesListResponse, "parseRBACPoliciesListResponse");
 
 // src/server/Network/routers/rbacPolicyRouter.ts
-var import_signal_openstack10 = __toESM(require_esm());
+var import_signal_openstack11 = __toESM(require_esm());
 var RBAC_POLICIES_BASE_URL = "v2.0/rbac-policies";
 var rbacPolicyRouter = {
   list: projectScopedProcedure.input(listRBACPoliciesForSecurityGroupInputSchema).query(async ({ input, ctx }) => {
@@ -40666,7 +40792,7 @@ var rbacPolicyRouter = {
           target_tenant: targetTenant
         }
       };
-      const encodedPolicyId = (0, import_signal_openstack10.validateAndEncodeResourceId)(policyId, "RBAC policy");
+      const encodedPolicyId = (0, import_signal_openstack11.validateAndEncodeResourceId)(policyId, "RBAC policy");
       const response = await network.put(`${RBAC_POLICIES_BASE_URL}/${encodedPolicyId}`, requestBody);
       if (!response.ok) {
         throw RBACPolicyErrorHandlers.update(response, policyId);
@@ -40679,7 +40805,7 @@ var rbacPolicyRouter = {
     return withErrorHandling3(async () => {
       const { policyId } = input;
       const network = getNetworkService(ctx);
-      const encodedPolicyId = (0, import_signal_openstack10.validateAndEncodeResourceId)(policyId, "RBAC policy");
+      const encodedPolicyId = (0, import_signal_openstack11.validateAndEncodeResourceId)(policyId, "RBAC policy");
       const response = await network.del(`${RBAC_POLICIES_BASE_URL}/${encodedPolicyId}`);
       if (!response.ok) {
         throw RBACPolicyErrorHandlers.delete(response, policyId);
@@ -40688,6 +40814,725 @@ var rbacPolicyRouter = {
   })
 };
 
+// src/server/Network/routers/routersRouter.ts
+var import_server29 = require("@trpc/server");
+var import_signal_openstack13 = __toESM(require_esm());
+
+// src/server/Network/types/router.ts
+var import_zod23 = require("zod");
+var import_node_net = require("net");
+var isValidIpAddress = /* @__PURE__ */ __name((value) => (0, import_node_net.isIP)(value) !== 0, "isValidIpAddress");
+var isValidCidr = /* @__PURE__ */ __name((value) => {
+  const parts = value.split("/");
+  if (parts.length !== 2) return false;
+  const [address, prefix] = parts;
+  if (!/^\d{1,3}$/.test(prefix)) return false;
+  const version = (0, import_node_net.isIP)(address);
+  if (version === 0) return false;
+  const prefixLength = Number(prefix);
+  return version === 4 ? prefixLength <= 32 : prefixLength <= 128;
+}, "isValidCidr");
+var resourceIdSchema = import_zod23.z.string().trim().min(1, "ID is required");
+var ipAddressSchema = import_zod23.z.string().trim().refine(isValidIpAddress, {
+  message: "Must be a valid IPv4 or IPv6 address"
+});
+var cidrSchema = import_zod23.z.string().trim().refine(isValidCidr, {
+  message: "Must be a valid CIDR, e.g. 10.0.0.0/24"
+});
+var nameSchema = import_zod23.z.string().trim().max(255, "Name must be at most 255 characters");
+var descriptionSchema = import_zod23.z.string().max(255, "Description must be at most 255 characters");
+var ExternalFixedIpSchema = import_zod23.z.object({
+  subnet_id: import_zod23.z.string(),
+  ip_address: import_zod23.z.string()
+});
+var ExternalGatewayInfoSchema = import_zod23.z.object({
+  network_id: import_zod23.z.string(),
+  enable_snat: import_zod23.z.boolean().optional(),
+  external_fixed_ips: import_zod23.z.array(ExternalFixedIpSchema).optional(),
+  qos_policy_id: import_zod23.z.string().nullish()
+});
+var ExtraRouteSchema = import_zod23.z.object({
+  destination: import_zod23.z.string(),
+  nexthop: import_zod23.z.string()
+});
+var RouterSchema = import_zod23.z.object({
+  id: import_zod23.z.string(),
+  name: import_zod23.z.string().default(""),
+  description: import_zod23.z.string().optional().default(""),
+  status: import_zod23.z.string(),
+  admin_state_up: import_zod23.z.boolean(),
+  // Neutron returns `null` when no gateway is set
+  external_gateway_info: ExternalGatewayInfoSchema.nullish(),
+  // Only present when the `extraroute` extension is enabled
+  routes: import_zod23.z.array(ExtraRouteSchema).optional().default([]),
+  // Only present when the corresponding extensions are enabled (dvr, l3-ha, ...)
+  distributed: import_zod23.z.boolean().nullish(),
+  ha: import_zod23.z.boolean().nullish(),
+  enable_ndp_proxy: import_zod23.z.boolean().nullish(),
+  enable_default_route_bfd: import_zod23.z.boolean().nullish(),
+  enable_default_route_ecmp: import_zod23.z.boolean().nullish(),
+  availability_zone_hints: import_zod23.z.array(import_zod23.z.string()).optional(),
+  availability_zones: import_zod23.z.array(import_zod23.z.string()).optional(),
+  flavor_id: import_zod23.z.string().nullish(),
+  project_id: import_zod23.z.string(),
+  tenant_id: import_zod23.z.string().optional(),
+  revision_number: import_zod23.z.number().optional(),
+  tags: import_zod23.z.array(import_zod23.z.string()).optional(),
+  created_at: ISO8601TimestampSchema.optional(),
+  updated_at: ISO8601TimestampSchema.optional()
+});
+var RouterListResponseSchema = import_zod23.z.object({
+  routers: import_zod23.z.array(RouterSchema)
+});
+var RouterResponseSchema = import_zod23.z.object({
+  router: RouterSchema
+});
+var RouterInterfaceInfoSchema = import_zod23.z.object({
+  id: import_zod23.z.string(),
+  subnet_id: import_zod23.z.string().optional(),
+  subnet_ids: import_zod23.z.array(import_zod23.z.string()).optional(),
+  port_id: import_zod23.z.string(),
+  network_id: import_zod23.z.string().optional(),
+  project_id: import_zod23.z.string().optional(),
+  tenant_id: import_zod23.z.string().optional(),
+  tags: import_zod23.z.array(import_zod23.z.string()).optional()
+});
+var RouterPortSchema = import_zod23.z.object({
+  id: import_zod23.z.string(),
+  name: import_zod23.z.string().optional().default(""),
+  network_id: import_zod23.z.string(),
+  device_owner: import_zod23.z.string(),
+  status: NetworkPortStatusSchema,
+  admin_state_up: import_zod23.z.boolean().optional(),
+  mac_address: import_zod23.z.string().optional(),
+  fixed_ips: import_zod23.z.array(ExternalFixedIpSchema).optional().default([])
+});
+var RouterPortListResponseSchema = import_zod23.z.object({
+  ports: import_zod23.z.array(RouterPortSchema)
+});
+var SubnetSummarySchema = import_zod23.z.object({
+  id: import_zod23.z.string(),
+  name: import_zod23.z.string().optional().default(""),
+  cidr: import_zod23.z.string().optional()
+});
+var SubnetSummaryListResponseSchema = import_zod23.z.object({
+  subnets: import_zod23.z.array(SubnetSummarySchema)
+});
+var RouterInterfacePortSummarySchema = import_zod23.z.object({
+  id: import_zod23.z.string(),
+  /** The ID of the router owning the interface */
+  device_id: import_zod23.z.string(),
+  device_owner: import_zod23.z.string(),
+  network_id: import_zod23.z.string()
+});
+var RouterInterfacePortSummaryListResponseSchema = import_zod23.z.object({
+  ports: import_zod23.z.array(RouterInterfacePortSummarySchema)
+});
+var NetworkSummarySchema = import_zod23.z.object({
+  id: import_zod23.z.string(),
+  name: import_zod23.z.string().nullable().optional()
+});
+var NetworkSummaryListResponseSchema = import_zod23.z.object({
+  networks: import_zod23.z.array(NetworkSummarySchema)
+});
+var ExtensionListResponseSchema = import_zod23.z.object({
+  extensions: import_zod23.z.array(import_zod23.z.object({
+    alias: import_zod23.z.string(),
+    name: import_zod23.z.string().optional()
+  }))
+});
+var RouterSortKeySchema = import_zod23.z.enum([
+  "admin_state_up",
+  "flavor_id",
+  "id",
+  "name",
+  "status",
+  "project_id",
+  "tenant_id"
+]);
+var RouterQueryParametersSchema = projectScopedInputSchema.extend({
+  // Passed through to Neutron
+  name: import_zod23.z.string().optional(),
+  description: import_zod23.z.string().optional(),
+  admin_state_up: import_zod23.z.boolean().optional(),
+  sort_key: RouterSortKeySchema.optional(),
+  sort_dir: SortDirSchema.optional(),
+  // Comma-separated tag lists, as Neutron expects
+  tags: import_zod23.z.string().optional(),
+  tags_any: import_zod23.z.string().optional(),
+  not_tags: import_zod23.z.string().optional(),
+  not_tags_any: import_zod23.z.string().optional(),
+  // Applied BFF-side
+  searchTerm: import_zod23.z.string().trim().optional(),
+  status: import_zod23.z.string().optional(),
+  has_gateway: import_zod23.z.boolean().optional()
+});
+var RouterIdInputSchema = projectScopedInputSchema.extend({
+  router_id: resourceIdSchema
+});
+var GatewayFixedIpInputSchema = import_zod23.z.object({
+  subnet_id: resourceIdSchema.optional(),
+  ip_address: ipAddressSchema.optional()
+}).refine((value) => Boolean(value.subnet_id || value.ip_address), {
+  message: "Either subnet_id or ip_address is required"
+});
+var ExternalGatewayInfoInputSchema = import_zod23.z.object({
+  network_id: resourceIdSchema,
+  // Note: setting enable_snat is admin-only in the default Neutron policy
+  enable_snat: import_zod23.z.boolean().optional(),
+  external_fixed_ips: import_zod23.z.array(GatewayFixedIpInputSchema).optional()
+});
+var ExtraRouteInputSchema = import_zod23.z.object({
+  destination: cidrSchema,
+  nexthop: ipAddressSchema
+});
+var RouterCreateRequestSchema = projectScopedInputSchema.extend({
+  name: nameSchema.min(1, "Name is required"),
+  description: descriptionSchema.optional(),
+  admin_state_up: import_zod23.z.boolean().optional(),
+  external_gateway_info: ExternalGatewayInfoInputSchema.optional(),
+  distributed: import_zod23.z.boolean().optional(),
+  ha: import_zod23.z.boolean().optional(),
+  availability_zone_hints: import_zod23.z.array(import_zod23.z.string().trim().min(1)).optional(),
+  enable_ndp_proxy: import_zod23.z.boolean().optional()
+});
+var RouterUpdateRequestSchema = projectScopedInputSchema.extend({
+  router_id: resourceIdSchema,
+  name: nameSchema.optional(),
+  description: descriptionSchema.optional(),
+  admin_state_up: import_zod23.z.boolean().optional(),
+  // Replaces the FULL list of extra routes (requires `extraroute` extension)
+  routes: import_zod23.z.array(ExtraRouteInputSchema).optional(),
+  // Changing distributed / ha requires the router to be admin_state_up=false first
+  distributed: import_zod23.z.boolean().optional(),
+  ha: import_zod23.z.boolean().optional(),
+  enable_ndp_proxy: import_zod23.z.boolean().optional()
+});
+var RouterSetGatewayRequestSchema = projectScopedInputSchema.extend({
+  router_id: resourceIdSchema,
+  external_gateway_info: ExternalGatewayInfoInputSchema
+});
+var RouterInterfaceRequestSchema = projectScopedInputSchema.extend({
+  router_id: resourceIdSchema,
+  subnet_id: resourceIdSchema.optional(),
+  port_id: resourceIdSchema.optional()
+}).refine((value) => Boolean(value.subnet_id) !== Boolean(value.port_id), {
+  message: "Provide exactly one of subnet_id or port_id",
+  path: [
+    "subnet_id"
+  ]
+});
+
+// src/server/Network/helpers/routerHelpers.ts
+var import_server28 = require("@trpc/server");
+var import_signal_openstack12 = __toESM(require_esm());
+var QUOTA_EXCEEDED_MESSAGE = "Router quota exceeded. Delete unused resources or contact an administrator to increase the quota.";
+var conflict = /* @__PURE__ */ __name((message) => (response) => new import_server28.TRPCError({
+  code: HTTP_STATUS_ERROR_MAP[409],
+  message: /quota/i.test(response.statusText ?? "") ? QUOTA_EXCEEDED_MESSAGE : message
+}), "conflict");
+var badRequest = /* @__PURE__ */ __name((message) => (response) => new import_server28.TRPCError({
+  code: HTTP_STATUS_ERROR_MAP[400],
+  message: `${message}${response.statusText ? ` (${response.statusText})` : ""}`
+}), "badRequest");
+var notFound = /* @__PURE__ */ __name((message) => (_response, resourceLabel) => new import_server28.TRPCError({
+  code: HTTP_STATUS_ERROR_MAP[404],
+  message: message(resourceLabel)
+}), "notFound");
+var RouterErrorHandlers = {
+  list: ErrorHandler("Router"),
+  get: ErrorHandler("Router", {
+    404: notFound((routerId) => `Router ${routerId} was not found.`)
+  }),
+  create: ErrorHandler("Router", {
+    404: notFound(() => "The selected external network or subnet was not found."),
+    409: conflict("The requested external IP address is already in use or the external network has no free IP addresses.")
+  }),
+  update: ErrorHandler("Router", {
+    404: notFound((routerId) => `Router ${routerId} was not found.`),
+    409: conflict("The router is in a state that doesn't allow this change. Distributed/HA mode can only be changed while the admin state is DOWN.")
+  }),
+  setGateway: ErrorHandler("Router", {
+    404: notFound((routerId) => `Router ${routerId} or the selected external network was not found.`),
+    409: conflict("The requested external IP address is already in use or the external network has no free IP addresses.")
+  }),
+  clearGateway: ErrorHandler("Router", {
+    404: notFound((routerId) => `Router ${routerId} was not found.`),
+    409: conflict("The gateway can't be cleared while floating IPs are still associated through this router. Disassociate them first.")
+  }),
+  addInterface: ErrorHandler("Router", {
+    // Neutron returns 400 for: subnet already attached, no gateway IP, overlapping CIDRs
+    400: badRequest("The interface can't be added. The subnet may already be attached, have no gateway IP, or overlap with a subnet on this router"),
+    404: notFound((routerId) => `Router ${routerId} or the selected subnet/port was not found.`),
+    409: conflict("The subnet or port is already in use by another router, or its IP address is already allocated.")
+  }),
+  removeInterface: ErrorHandler("Router", {
+    404: notFound((routerId) => `The interface is not attached to router ${routerId}.`),
+    409: conflict("The interface can't be removed while floating IPs are still associated with ports on this subnet.")
+  }),
+  delete: ErrorHandler("Router", {
+    404: notFound((routerId) => `Router ${routerId} was not found.`),
+    409: conflict("The router still has attached interfaces. Remove all interfaces before deleting it.")
+  }),
+  listInterfaces: ErrorHandler("Router"),
+  listExtensions: ErrorHandler("Router")
+};
+var requestOrThrow = /* @__PURE__ */ __name(async (request, handleError, resourceLabel) => {
+  let response;
+  try {
+    response = await request();
+  } catch (error) {
+    if (error instanceof import_signal_openstack12.SignalOpenstackApiError) {
+      throw handleError({
+        status: error.statusCode,
+        statusText: error.message
+      }, resourceLabel);
+    }
+    throw error;
+  }
+  if (!response.ok) throw handleError(response, resourceLabel);
+  return response;
+}, "requestOrThrow");
+var pickDefined = /* @__PURE__ */ __name((obj) => Object.fromEntries(Object.entries(obj).filter(([, value]) => value !== void 0)), "pickDefined");
+var buildExternalGatewayInfoBody = /* @__PURE__ */ __name((info) => ({
+  network_id: info.network_id,
+  ...info.enable_snat !== void 0 && {
+    enable_snat: info.enable_snat
+  },
+  ...info.external_fixed_ips !== void 0 && {
+    external_fixed_ips: info.external_fixed_ips.map((fixedIp) => pickDefined(fixedIp))
+  }
+}), "buildExternalGatewayInfoBody");
+var filterRoutersByBffParams = /* @__PURE__ */ __name((routers, { status, has_gateway }) => routers.filter((router2) => {
+  if (status && router2.status.toUpperCase() !== status.toUpperCase()) return false;
+  if (has_gateway !== void 0 && Boolean(router2.external_gateway_info) !== has_gateway) return false;
+  return true;
+}), "filterRoutersByBffParams");
+var collectGatewayIds = /* @__PURE__ */ __name((routers) => {
+  const networkIds = /* @__PURE__ */ new Set();
+  const subnetIds = /* @__PURE__ */ new Set();
+  for (const router2 of routers) {
+    const gateway = router2.external_gateway_info;
+    if (!gateway) continue;
+    networkIds.add(gateway.network_id);
+    for (const fixedIp of gateway.external_fixed_ips ?? []) {
+      subnetIds.add(fixedIp.subnet_id);
+    }
+  }
+  return {
+    networkIds: [
+      ...networkIds
+    ],
+    subnetIds: [
+      ...subnetIds
+    ]
+  };
+}, "collectGatewayIds");
+var applyGatewayNames = /* @__PURE__ */ __name((routers, networks = [], subnets = []) => {
+  const networkNames = new Map(networks.map((network) => [
+    network.id,
+    network.name || void 0
+  ]));
+  const subnetNames = new Map(subnets.map((subnet) => [
+    subnet.id,
+    subnet.name || void 0
+  ]));
+  return routers.map((router2) => {
+    const gateway = router2.external_gateway_info;
+    if (!gateway) return router2;
+    return {
+      ...router2,
+      external_gateway_info: {
+        ...gateway,
+        network_name: networkNames.get(gateway.network_id),
+        external_fixed_ips: gateway.external_fixed_ips?.map((fixedIp) => ({
+          ...fixedIp,
+          subnet_name: subnetNames.get(fixedIp.subnet_id)
+        }))
+      }
+    };
+  });
+}, "applyGatewayNames");
+var ROUTER_INTERFACE_DEVICE_OWNERS = /* @__PURE__ */ new Set([
+  "network:router_interface",
+  "network:router_interface_distributed",
+  "network:ha_router_replicated_interface"
+]);
+var isRouterInterfacePort = /* @__PURE__ */ __name((port) => ROUTER_INTERFACE_DEVICE_OWNERS.has(port.device_owner), "isRouterInterfacePort");
+var chunk = /* @__PURE__ */ __name((items, size) => {
+  if (size < 1) throw new Error("Chunk size must be at least 1");
+  const chunks = [];
+  for (let i = 0; i < items.length; i += size) {
+    chunks.push(items.slice(i, i + size));
+  }
+  return chunks;
+}, "chunk");
+var groupPrivateNetworkIdsByRouter = /* @__PURE__ */ __name((ports) => {
+  const byRouter = /* @__PURE__ */ new Map();
+  for (const port of ports) {
+    if (!isRouterInterfacePort(port)) continue;
+    const networkIds = byRouter.get(port.device_id) ?? /* @__PURE__ */ new Set();
+    networkIds.add(port.network_id);
+    byRouter.set(port.device_id, networkIds);
+  }
+  return new Map([
+    ...byRouter
+  ].map(([routerId, networkIds]) => [
+    routerId,
+    [
+      ...networkIds
+    ]
+  ]));
+}, "groupPrivateNetworkIdsByRouter");
+var applyPrivateNetworks = /* @__PURE__ */ __name((routers, privateNetworkIdsByRouter, networks = []) => {
+  if (!privateNetworkIdsByRouter) return routers;
+  const networkNames = new Map(networks.map((network) => [
+    network.id,
+    network.name || void 0
+  ]));
+  return routers.map((router2) => ({
+    ...router2,
+    private_networks: (privateNetworkIdsByRouter.get(router2.id) ?? []).map((networkId) => ({
+      network_id: networkId,
+      network_name: networkNames.get(networkId)
+    }))
+  }));
+}, "applyPrivateNetworks");
+var collectSubnetIds = /* @__PURE__ */ __name((ports) => [
+  ...new Set(ports.flatMap((port) => port.fixed_ips.map((fixedIp) => fixedIp.subnet_id)))
+], "collectSubnetIds");
+var buildRouterInterfaces = /* @__PURE__ */ __name((ports, subnets = [], networks = []) => {
+  const subnetsById = new Map(subnets.map((subnet) => [
+    subnet.id,
+    subnet
+  ]));
+  const networkNames = new Map(networks.map((network) => [
+    network.id,
+    network.name || void 0
+  ]));
+  return ports.filter(isRouterInterfacePort).map((port) => ({
+    port_id: port.id,
+    port_name: port.name,
+    network_id: port.network_id,
+    network_name: networkNames.get(port.network_id),
+    device_owner: port.device_owner,
+    status: port.status,
+    admin_state_up: port.admin_state_up,
+    mac_address: port.mac_address,
+    fixed_ips: port.fixed_ips.map((fixedIp) => ({
+      subnet_id: fixedIp.subnet_id,
+      subnet_name: subnetsById.get(fixedIp.subnet_id)?.name,
+      subnet_cidr: subnetsById.get(fixedIp.subnet_id)?.cidr,
+      ip_address: fixedIp.ip_address
+    }))
+  }));
+}, "buildRouterInterfaces");
+var getRouterExtensionFlags = /* @__PURE__ */ __name((aliases) => {
+  const enabled = new Set(aliases);
+  return {
+    dvr: enabled.has("dvr"),
+    l3Ha: enabled.has("l3-ha"),
+    extraRoute: enabled.has("extraroute"),
+    extGwMode: enabled.has("ext-gw-mode"),
+    ndpProxy: enabled.has("router-extend-ndp-proxy"),
+    externalGatewayMultihoming: enabled.has("external-gateway-multihoming"),
+    availabilityZone: enabled.has("router_availability_zone")
+  };
+}, "getRouterExtensionFlags");
+
+// src/server/Network/routers/routersRouter.ts
+var ROUTERS_BASE_URL = "v2.0/routers";
+var PORTS_BASE_URL = "v2.0/ports";
+var SUBNETS_BASE_URL = "v2.0/subnets";
+var NETWORKS_BASE_URL = "v2.0/networks";
+var ROUTER_INTERFACE_PORTS_CHUNK_SIZE = 50;
+var EXTENSIONS_BASE_URL = "v2.0/extensions";
+var LIST_ROUTERS_QUERY_KEY_MAP = {
+  tags_any: "tags-any",
+  not_tags: "not-tags",
+  not_tags_any: "not-tags-any"
+};
+var withQuery = /* @__PURE__ */ __name((baseUrl, params) => {
+  const queryString = params.toString();
+  return queryString ? `${baseUrl}?${queryString}` : baseUrl;
+}, "withQuery");
+var routerUrl = /* @__PURE__ */ __name((routerId, action) => {
+  const encodedId = (0, import_signal_openstack13.validateAndEncodeResourceId)(routerId, "Router");
+  return action ? `${ROUTERS_BASE_URL}/${encodedId}/${action}` : `${ROUTERS_BASE_URL}/${encodedId}`;
+}, "routerUrl");
+var fetchNetworkSummaries = /* @__PURE__ */ __name(async (network, ids) => {
+  if (ids.length === 0) return [];
+  try {
+    const params = appendQueryParamsFromObject({
+      id: ids,
+      fields: [
+        "id",
+        "name"
+      ]
+    });
+    const response = await network.get(withQuery(NETWORKS_BASE_URL, params));
+    if (!response.ok) return [];
+    const data = await response.json();
+    return parseOrThrow(NetworkSummaryListResponseSchema, data, "routersRouter.networks").networks;
+  } catch {
+    return [];
+  }
+}, "fetchNetworkSummaries");
+var fetchSubnetSummaries = /* @__PURE__ */ __name(async (network, ids, fields = [
+  "id",
+  "name"
+]) => {
+  if (ids.length === 0) return [];
+  try {
+    const params = appendQueryParamsFromObject({
+      id: ids,
+      fields
+    });
+    const response = await network.get(withQuery(SUBNETS_BASE_URL, params));
+    if (!response.ok) return [];
+    const data = await response.json();
+    return parseOrThrow(SubnetSummaryListResponseSchema, data, "routersRouter.subnets").subnets;
+  } catch {
+    return [];
+  }
+}, "fetchSubnetSummaries");
+var fetchRouterInterfacePorts = /* @__PURE__ */ __name(async (network, routerIds) => {
+  if (routerIds.length === 0) return [];
+  try {
+    const portChunks = await Promise.all(chunk(routerIds, ROUTER_INTERFACE_PORTS_CHUNK_SIZE).map(async (ids) => {
+      const params = appendQueryParamsFromObject({
+        device_id: ids,
+        device_owner: [
+          ...ROUTER_INTERFACE_DEVICE_OWNERS
+        ],
+        fields: [
+          "id",
+          "device_id",
+          "device_owner",
+          "network_id"
+        ]
+      });
+      const response = await network.get(withQuery(PORTS_BASE_URL, params));
+      if (!response.ok) throw new Error(`Failed to list router interface ports (HTTP ${response.status})`);
+      const data = await response.json();
+      return parseOrThrow(RouterInterfacePortSummaryListResponseSchema, data, "routersRouter.list.ports").ports;
+    }));
+    return portChunks.flat();
+  } catch {
+    return null;
+  }
+}, "fetchRouterInterfacePorts");
+var routersRouter = {
+  list: projectScopedProcedure.input(RouterQueryParametersSchema).query(async ({ input, ctx }) => {
+    return withErrorHandling3(async () => {
+      const { searchTerm, status, has_gateway, ...openstackFilters } = input;
+      const network = getNetworkService(ctx);
+      const queryParams = appendQueryParamsFromObject(openstackFilters, {
+        keyMap: LIST_ROUTERS_QUERY_KEY_MAP
+      });
+      const response = await requestOrThrow(() => network.get(withQuery(ROUTERS_BASE_URL, queryParams)), RouterErrorHandlers.list);
+      const data = await response.json();
+      const { routers } = parseOrThrow(RouterListResponseSchema, data, "routersRouter.list");
+      const filteredRouters = filterBySearchParams(filterRoutersByBffParams(routers, {
+        status,
+        has_gateway
+      }), searchTerm, [
+        "id",
+        "name",
+        "description"
+      ]);
+      const interfacePorts = await fetchRouterInterfacePorts(network, filteredRouters.map((router2) => router2.id));
+      const privateNetworkIdsByRouter = interfacePorts ? groupPrivateNetworkIdsByRouter(interfacePorts) : null;
+      const { networkIds: gatewayNetworkIds, subnetIds } = collectGatewayIds(filteredRouters);
+      const privateNetworkIds = [
+        ...privateNetworkIdsByRouter?.values() ?? []
+      ].flat();
+      const networkIds = [
+        .../* @__PURE__ */ new Set([
+          ...gatewayNetworkIds,
+          ...privateNetworkIds
+        ])
+      ];
+      const [networks, subnets] = await Promise.all([
+        fetchNetworkSummaries(network, networkIds),
+        fetchSubnetSummaries(network, subnetIds)
+      ]);
+      return applyPrivateNetworks(applyGatewayNames(filteredRouters, networks, subnets), privateNetworkIdsByRouter, networks);
+    }, "list routers");
+  }),
+  getById: projectScopedProcedure.input(RouterIdInputSchema).query(async ({ input, ctx }) => {
+    return withErrorHandling3(async () => {
+      const { router_id } = input;
+      const network = getNetworkService(ctx);
+      const url = routerUrl(router_id);
+      const response = await requestOrThrow(() => network.get(url), RouterErrorHandlers.get, router_id);
+      const data = await response.json();
+      const router2 = parseOrThrow(RouterResponseSchema, data, "routersRouter.getById").router;
+      const { networkIds, subnetIds } = collectGatewayIds([
+        router2
+      ]);
+      const [networks, subnets] = await Promise.all([
+        fetchNetworkSummaries(network, networkIds),
+        fetchSubnetSummaries(network, subnetIds)
+      ]);
+      const [routerWithNames] = applyGatewayNames([
+        router2
+      ], networks, subnets);
+      return routerWithNames;
+    }, "show router details");
+  }),
+  create: projectScopedProcedure.input(RouterCreateRequestSchema).mutation(async ({ input, ctx }) => {
+    return withErrorHandling3(async () => {
+      const network = getNetworkService(ctx);
+      const { external_gateway_info, ...fields } = omit(input, "project_id");
+      const requestBody = {
+        router: {
+          ...pickDefined(fields),
+          ...external_gateway_info && {
+            external_gateway_info: buildExternalGatewayInfoBody(external_gateway_info)
+          }
+        }
+      };
+      const response = await requestOrThrow(() => network.post(ROUTERS_BASE_URL, requestBody), RouterErrorHandlers.create);
+      const data = await response.json();
+      return parseOrThrow(RouterResponseSchema, data, "routersRouter.create").router;
+    }, "create router");
+  }),
+  update: projectScopedProcedure.input(RouterUpdateRequestSchema).mutation(async ({ input, ctx }) => {
+    return withErrorHandling3(async () => {
+      const { router_id, ...fields } = omit(input, "project_id");
+      const network = getNetworkService(ctx);
+      const updateFields = pickDefined(fields);
+      if (Object.keys(updateFields).length === 0) {
+        throw new import_server29.TRPCError({
+          code: "BAD_REQUEST",
+          message: "No fields provided to update"
+        });
+      }
+      const url = routerUrl(router_id);
+      const response = await requestOrThrow(() => network.put(url, {
+        router: updateFields
+      }), RouterErrorHandlers.update, router_id);
+      const data = await response.json();
+      return parseOrThrow(RouterResponseSchema, data, "routersRouter.update").router;
+    }, "update router");
+  }),
+  setGateway: projectScopedProcedure.input(RouterSetGatewayRequestSchema).mutation(async ({ input, ctx }) => {
+    return withErrorHandling3(async () => {
+      const { router_id, external_gateway_info } = input;
+      const network = getNetworkService(ctx);
+      const requestBody = {
+        router: {
+          external_gateway_info: buildExternalGatewayInfoBody(external_gateway_info)
+        }
+      };
+      const url = routerUrl(router_id);
+      const response = await requestOrThrow(() => network.put(url, requestBody), RouterErrorHandlers.setGateway, router_id);
+      const data = await response.json();
+      return parseOrThrow(RouterResponseSchema, data, "routersRouter.setGateway").router;
+    }, "set router external gateway");
+  }),
+  clearGateway: projectScopedProcedure.input(RouterIdInputSchema).mutation(async ({ input, ctx }) => {
+    return withErrorHandling3(async () => {
+      const { router_id } = input;
+      const network = getNetworkService(ctx);
+      const url = routerUrl(router_id);
+      const response = await requestOrThrow(() => network.put(url, {
+        router: {
+          external_gateway_info: {}
+        }
+      }), RouterErrorHandlers.clearGateway, router_id);
+      const data = await response.json();
+      return parseOrThrow(RouterResponseSchema, data, "routersRouter.clearGateway").router;
+    }, "clear router external gateway");
+  }),
+  addInterface: projectScopedProcedure.input(RouterInterfaceRequestSchema).mutation(async ({ input, ctx }) => {
+    return withErrorHandling3(async () => {
+      const { router_id, subnet_id, port_id } = input;
+      const network = getNetworkService(ctx);
+      const requestBody = subnet_id ? {
+        subnet_id
+      } : {
+        port_id
+      };
+      const url = routerUrl(router_id, "add_router_interface");
+      const response = await requestOrThrow(() => network.put(url, requestBody), RouterErrorHandlers.addInterface, router_id);
+      const data = await response.json();
+      return parseOrThrow(RouterInterfaceInfoSchema, data, "routersRouter.addInterface");
+    }, "add router interface");
+  }),
+  removeInterface: projectScopedProcedure.input(RouterInterfaceRequestSchema).mutation(async ({ input, ctx }) => {
+    return withErrorHandling3(async () => {
+      const { router_id, subnet_id, port_id } = input;
+      const network = getNetworkService(ctx);
+      const requestBody = subnet_id ? {
+        subnet_id
+      } : {
+        port_id
+      };
+      const url = routerUrl(router_id, "remove_router_interface");
+      const response = await requestOrThrow(() => network.put(url, requestBody), RouterErrorHandlers.removeInterface, router_id);
+      const data = await response.json();
+      return parseOrThrow(RouterInterfaceInfoSchema, data, "routersRouter.removeInterface");
+    }, "remove router interface");
+  }),
+  delete: projectScopedProcedure.input(RouterIdInputSchema).mutation(async ({ input, ctx }) => {
+    return withErrorHandling3(async () => {
+      const { router_id } = input;
+      const network = getNetworkService(ctx);
+      const url = routerUrl(router_id);
+      await requestOrThrow(() => network.del(url), RouterErrorHandlers.delete, router_id);
+      return true;
+    }, "delete router");
+  }),
+  listInterfaces: projectScopedProcedure.input(RouterIdInputSchema).query(async ({ input, ctx }) => {
+    return withErrorHandling3(async () => {
+      const { router_id } = input;
+      const network = getNetworkService(ctx);
+      (0, import_signal_openstack13.validateAndEncodeResourceId)(router_id, "Router");
+      const portParams = appendQueryParamsFromObject({
+        device_id: router_id,
+        fields: [
+          "id",
+          "name",
+          "network_id",
+          "device_owner",
+          "status",
+          "admin_state_up",
+          "mac_address",
+          "fixed_ips"
+        ]
+      });
+      const portsResponse = await requestOrThrow(() => network.get(withQuery(PORTS_BASE_URL, portParams)), RouterErrorHandlers.listInterfaces, router_id);
+      const portsData = await portsResponse.json();
+      const { ports } = parseOrThrow(RouterPortListResponseSchema, portsData, "routersRouter.listInterfaces");
+      const interfacePorts = ports.filter(isRouterInterfacePort);
+      const subnetIds = collectSubnetIds(interfacePorts);
+      const networkIds = [
+        ...new Set(interfacePorts.map((port) => port.network_id))
+      ];
+      const [subnets, networks] = await Promise.all([
+        fetchSubnetSummaries(network, subnetIds, [
+          "id",
+          "name",
+          "cidr"
+        ]),
+        fetchNetworkSummaries(network, networkIds)
+      ]);
+      return buildRouterInterfaces(interfacePorts, subnets, networks);
+    }, "list router interfaces");
+  }),
+  listExtensions: projectScopedProcedure.input(projectScopedInputSchema).query(async ({ ctx }) => {
+    return withErrorHandling3(async () => {
+      const network = getNetworkService(ctx);
+      const response = await requestOrThrow(() => network.get(EXTENSIONS_BASE_URL), RouterErrorHandlers.listExtensions);
+      const data = await response.json();
+      const { extensions } = parseOrThrow(ExtensionListResponseSchema, data, "routersRouter.listExtensions");
+      return getRouterExtensionFlags(extensions.map((extension) => extension.alias));
+    }, "list router-related network extensions");
+  })
+};
+
 // src/server/Network/routers/permissionRouter.ts
 var NETWORK_MAPPINGS = {
   // Network Operations
@@ -40909,19 +41754,27 @@ var buildNetworkRouters = /* @__PURE__ */ __name((policyDir) => ({
     securityGroup: securityGroupRouter,
     securityGroupRule: securityGroupRuleRouter,
     rbacPolicy: rbacPolicyRouter,
+    routers: routersRouter,
     ...buildNetworkPermissionRouter(policyDir)
   })
 }), "buildNetworkRouters");
 
+// src/server/AppConfig/routers.ts
+var appConfigRouters = {
+  appConfig: auroraRouter({
+    get: publicProcedure.query(({ ctx }) => ctx.appConfig ?? {})
+  })
+};
+
 // src/server/routers.ts
-var buildBaseRouter = /* @__PURE__ */ __name((policyDir) => mergeRouters(auroraRouter(authRouters), auroraRouter(buildComputeRouters(policyDir)), auroraRouter(buildObjectStorageRouters(policyDir)), auroraRouter(projectRouters), auroraRouter(buildNetworkRouters(policyDir))), "buildBaseRouter");
+var buildBaseRouter = /* @__PURE__ */ __name((policyDir) => mergeRouters(auroraRouter(authRouters), auroraRouter(buildComputeRouters(policyDir)), auroraRouter(buildObjectStorageRouters(policyDir)), auroraRouter(projectRouters), auroraRouter(buildNetworkRouters(policyDir)), auroraRouter(appConfigRouters)), "buildBaseRouter");
 var buildAppRouter = /* @__PURE__ */ __name((policyDir, extraRouters = []) => {
   if (extraRouters.length === 0) return buildBaseRouter(policyDir);
   return mergeRouters(buildBaseRouter(policyDir), ...extraRouters);
 }, "buildAppRouter");
 
 // src/server/context.ts
-var import_signal_openstack11 = __toESM(require_esm());
+var import_signal_openstack14 = __toESM(require_esm());
 
 // src/server/sessionCookie.ts
 var import_cookie = require("@fastify/cookie");
@@ -40955,6 +41808,88 @@ function SessionCookie({ cookieName = DEFAULT_COOKIE_NAME, cookieDomain, insecur
 }
 __name(SessionCookie, "SessionCookie");
 
+// src/server/AppConfig/resolveAppConfig.ts
+function toRegExp(pattern) {
+  return typeof pattern === "string" ? new RegExp(pattern) : pattern;
+}
+__name(toRegExp, "toRegExp");
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isPlainObject, "isPlainObject");
+function deepMerge(target, source) {
+  const out = {
+    ...target
+  };
+  for (const key of Object.keys(source)) {
+    const sourceValue = source[key];
+    if (sourceValue === void 0) continue;
+    const targetValue = out[key];
+    out[key] = isPlainObject(targetValue) && isPlainObject(sourceValue) ? deepMerge(targetValue, sourceValue) : sourceValue;
+  }
+  return out;
+}
+__name(deepMerge, "deepMerge");
+function mergeSettings(a, b) {
+  if (!a && !b) return void 0;
+  return deepMerge(a ?? {}, b ?? {});
+}
+__name(mergeSettings, "mergeSettings");
+function foldVisibility(base, delta) {
+  if (!delta) return base;
+  const enable = delta.enable ?? [];
+  const disable = delta.disable ?? [];
+  if (base?.mode === "allowlist") {
+    const shown = new Set(base.allow);
+    for (const key of enable) shown.add(key);
+    for (const key of disable) shown.delete(key);
+    return {
+      mode: "allowlist",
+      allow: [
+        ...shown
+      ]
+    };
+  }
+  const hidden = new Set(base?.mode === "denylist" ? base.deny : []);
+  for (const key of enable) hidden.delete(key);
+  for (const key of disable) hidden.add(key);
+  if (!base && hidden.size === 0) return void 0;
+  return {
+    mode: "denylist",
+    deny: [
+      ...hidden
+    ]
+  };
+}
+__name(foldVisibility, "foldVisibility");
+function pruneLayer(layer) {
+  const out = {};
+  if (layer.services) out.services = layer.services;
+  if (layer.slots) out.slots = layer.slots;
+  if (layer.serviceSettings) out.serviceSettings = layer.serviceSettings;
+  if (layer.slotSettings) out.slotSettings = layer.slotSettings;
+  if (layer.features) out.features = layer.features;
+  return out;
+}
+__name(pruneLayer, "pruneLayer");
+function resolveAppConfig(config, domainName) {
+  const { overrides = [], ...base } = config;
+  let resolved = pruneLayer(base);
+  if (!domainName) return resolved;
+  for (const override of overrides) {
+    if (!toRegExp(override.domain).test(domainName)) continue;
+    resolved = pruneLayer({
+      services: foldVisibility(resolved.services, override.services),
+      slots: foldVisibility(resolved.slots, override.slots),
+      serviceSettings: mergeSettings(resolved.serviceSettings, override.serviceSettings),
+      slotSettings: mergeSettings(resolved.slotSettings, override.slotSettings),
+      features: mergeSettings(resolved.features, override.features)
+    });
+  }
+  return resolved;
+}
+__name(resolveAppConfig, "resolveAppConfig");
+
 // src/server/context.ts
 var sessionRescopes = /* @__PURE__ */ new Map();
 async function createContext(opts, config) {
@@ -41009,7 +41944,7 @@ async function createContext(opts, config) {
     writable: false
   });
   if (currentAuthToken) {
-    openstackSession = await (0, import_signal_openstack11.SignalOpenstackSession)(normalizedEndpoint, {
+    openstackSession = await (0, import_signal_openstack14.SignalOpenstackSession)(normalizedEndpoint, {
       auth: {
         identity: {
           methods: [
@@ -41027,6 +41962,7 @@ async function createContext(opts, config) {
     });
   }
   const validateSession = /* @__PURE__ */ __name(() => openstackSession?.isValid() || false, "validateSession");
+  const appConfig = config.appConfig ? resolveAppConfig(config.appConfig, openstackSession?.getToken()?.tokenData?.user?.domain?.name) : void 0;
   let cachedUserInfo;
   let cachedUserId;
   const getUserInfo = /* @__PURE__ */ __name(async () => {
@@ -41072,7 +42008,7 @@ async function createContext(opts, config) {
     }
   }, "getUserInfo");
   const createSession = /* @__PURE__ */ __name(async (params) => {
-    openstackSession = await (0, import_signal_openstack11.SignalOpenstackSession)(normalizedEndpoint, {
+    openstackSession = await (0, import_signal_openstack14.SignalOpenstackSession)(normalizedEndpoint, {
       auth: {
         identity: {
           methods: [
@@ -41203,6 +42139,7 @@ async function createContext(opts, config) {
     identityEndpoint: normalizedEndpoint,
     cephRegion: config.cephRegion,
     imageMetadataExcludedProperties: (config.imageMetadataExcludedProperties ?? "").split(",").map((s) => s.trim()).filter(Boolean),
+    appConfig,
     createSession,
     rescopeSession,
     terminateSession,
@@ -41300,7 +42237,8 @@ async function createServer(config) {
     cookieName: config.cookieName,
     cookieDomain: config.cookieDomain,
     insecureCookies: config.insecureCookies,
-    debug: config.debug
+    debug: config.debug,
+    appConfig: config.appConfig
   };
   const appRouter = buildAppRouter(config.policyDir, config.routers ?? []);
   const server = (0, import_fastify.default)({
@@ -41476,8 +42414,95 @@ async function createServer(config) {
   return server;
 }
 __name(createServer, "createServer");
+
+// src/server/AppConfig/appConfigSchema.ts
+var import_zod25 = require("zod");
+
+// src/types/appConfig.ts
+var SLOT_NAMES = [
+  "logo",
+  "login",
+  "pageFooter",
+  "sideNavBanner",
+  "serviceBadge",
+  "servicePageActions",
+  "projectsBanner",
+  "serviceBanner"
+];
+
+// src/server/AppConfig/appConfigSchema.ts
+function auroraAppConfigSchema(featuresSchema = import_zod25.z.record(import_zod25.z.string(), import_zod25.z.unknown())) {
+  const serviceVisibility = import_zod25.z.discriminatedUnion("mode", [
+    import_zod25.z.strictObject({
+      mode: import_zod25.z.literal("allowlist"),
+      allow: import_zod25.z.array(import_zod25.z.string())
+    }),
+    import_zod25.z.strictObject({
+      mode: import_zod25.z.literal("denylist"),
+      deny: import_zod25.z.array(import_zod25.z.string())
+    })
+  ]).optional();
+  const slotVisibility = import_zod25.z.discriminatedUnion("mode", [
+    import_zod25.z.strictObject({
+      mode: import_zod25.z.literal("allowlist"),
+      allow: import_zod25.z.array(import_zod25.z.enum(SLOT_NAMES))
+    }),
+    import_zod25.z.strictObject({
+      mode: import_zod25.z.literal("denylist"),
+      deny: import_zod25.z.array(import_zod25.z.enum(SLOT_NAMES))
+    })
+  ]).optional();
+  const serviceSettings = import_zod25.z.record(import_zod25.z.string(), import_zod25.z.record(import_zod25.z.string(), import_zod25.z.unknown())).optional();
+  const slotSettingsShape = Object.fromEntries(SLOT_NAMES.map((name) => [
+    name,
+    import_zod25.z.record(import_zod25.z.string(), import_zod25.z.unknown()).optional()
+  ]));
+  const slotSettings = import_zod25.z.strictObject(slotSettingsShape).optional();
+  const features = featuresSchema.optional();
+  const base = {
+    services: serviceVisibility,
+    slots: slotVisibility,
+    serviceSettings,
+    slotSettings,
+    features
+  };
+  const serviceDelta = import_zod25.z.strictObject({
+    enable: import_zod25.z.array(import_zod25.z.string()).optional(),
+    disable: import_zod25.z.array(import_zod25.z.string()).optional()
+  }).optional();
+  const slotDelta = import_zod25.z.strictObject({
+    enable: import_zod25.z.array(import_zod25.z.enum(SLOT_NAMES)).optional(),
+    disable: import_zod25.z.array(import_zod25.z.enum(SLOT_NAMES)).optional()
+  }).optional();
+  const domain = import_zod25.z.string().refine((pattern) => {
+    try {
+      new RegExp(pattern);
+      return true;
+    } catch {
+      return false;
+    }
+  }, {
+    message: "domain must be a valid regular expression pattern"
+  });
+  const override = import_zod25.z.strictObject({
+    name: import_zod25.z.string().optional(),
+    domain,
+    services: serviceDelta,
+    slots: slotDelta,
+    serviceSettings,
+    slotSettings,
+    features
+  });
+  return import_zod25.z.strictObject({
+    ...base,
+    overrides: import_zod25.z.array(override).optional()
+  });
+}
+__name(auroraAppConfigSchema, "auroraAppConfigSchema");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  SLOT_NAMES,
+  auroraAppConfigSchema,
   auroraRouter,
   createServer,
   domainScopedInputSchema,
@@ -41487,6 +42512,7 @@ __name(createServer, "createServer");
   projectScopedProcedure,
   protectedProcedure,
   publicProcedure,
+  resolveAppConfig,
   validateOpenstackService
 });
 /*! Bundled license information: