@oronts/vendure-data-hub-plugin 0.1.0

package/dist/src/utils/safe-regex.utils.js

@@ -0,0 +1,50 @@
+"use strict";
+/**
+ * Safe Regex Utilities - ReDoS Protection
+ *
+ * Validates and creates user-provided regex patterns with protection
+ * against catastrophic backtracking (ReDoS attacks).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateRegexSafety = validateRegexSafety;
+exports.createSafeRegex = createSafeRegex;
+const MAX_PATTERN_LENGTH = 256;
+/** Nested quantifiers like (a+)+ or (a*)+ that cause exponential backtracking */
+const NESTED_QUANTIFIER_PATTERN = /\([^)]*[+*][^)]*\)[+*{]/;
+/** Adjacent quantifiers like a++, a*+, a{2}+ (possessive-like patterns that fail in JS) */
+const ADJACENT_QUANTIFIER_PATTERN = /[+*}][+*]/;
+/** Backreference followed by quantifier like (.+)\1+ which can cause exponential backtracking */
+const BACKREF_QUANTIFIER_PATTERN = /\\[1-9]\d*[+*{]/;
+function validateRegexSafety(pattern) {
+    if (!pattern || typeof pattern !== 'string') {
+        return { safe: false, reason: 'Pattern must be a non-empty string' };
+    }
+    if (pattern.length > MAX_PATTERN_LENGTH) {
+        return { safe: false, reason: `Pattern exceeds maximum length of ${MAX_PATTERN_LENGTH}` };
+    }
+    try {
+        new RegExp(pattern);
+    }
+    catch {
+        return { safe: false, reason: 'Invalid regex syntax' };
+    }
+    if (NESTED_QUANTIFIER_PATTERN.test(pattern)) {
+        return { safe: false, reason: 'Pattern contains nested quantifiers that may cause catastrophic backtracking' };
+    }
+    if (ADJACENT_QUANTIFIER_PATTERN.test(pattern)) {
+        return { safe: false, reason: 'Pattern contains adjacent quantifiers that may cause catastrophic backtracking' };
+    }
+    if (BACKREF_QUANTIFIER_PATTERN.test(pattern)) {
+        return { safe: false, reason: 'Pattern contains backreference with quantifier that may cause exponential backtracking' };
+    }
+    return { safe: true };
+}
+/** Creates a RegExp only if the pattern passes safety validation. Throws on unsafe patterns. */
+function createSafeRegex(pattern, flags) {
+    const result = validateRegexSafety(pattern);
+    if (!result.safe) {
+        throw new Error(`Unsafe regex pattern: ${result.reason}`);
+    }
+    return new RegExp(pattern, flags);
+}
+//# sourceMappingURL=safe-regex.utils.js.map

package/dist/src/utils/safe-regex.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-regex.utils.js","sourceRoot":"","sources":["../../../src/utils/safe-regex.utils.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAkBH,kDAyBC;AAGD,0CAMC;AAlDD,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B,iFAAiF;AACjF,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAE5D,2FAA2F;AAC3F,MAAM,2BAA2B,GAAG,WAAW,CAAC;AAEhD,iGAAiG;AACjG,MAAM,0BAA0B,GAAG,iBAAiB,CAAC;AAOrD,SAAgB,mBAAmB,CAAC,OAAe;IAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,kBAAkB,EAAE,EAAE,CAAC;IAC9F,CAAC;IAED,IAAI,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,8EAA8E,EAAE,CAAC;IACnH,CAAC;IACD,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,gFAAgF,EAAE,CAAC;IACrH,CAAC;IACD,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,wFAAwF,EAAE,CAAC;IAC7H,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,gGAAgG;AAChG,SAAgB,eAAe,CAAC,OAAe,EAAE,KAAc;IAC3D,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC"}

package/dist/src/utils/sql-security.utils.d.ts

@@ -0,0 +1,16 @@
+/**
+ * SQL Security Utilities
+ *
+ * IMPORTANT: These utilities should be used alongside parameterized queries,
+ * not as a replacement. Always use parameterized queries for user input.
+ */
+export declare function validateColumnName(column: string | undefined, allowedColumns?: Set<string>): void;
+export declare function validateTableName(table: string | undefined): void;
+/** IMPORTANT: Prefer parameterized queries. Use only when identifiers must be interpolated. */
+export declare function escapeSqlIdentifier(identifier: string): string;
+export declare function validateLimitOffset(value: number | string | undefined, min?: number, max?: number): number;
+/** Escape LIKE metacharacters (%, _, \) in a user-provided search string. */
+export declare function escapeLikePattern(value: string): string;
+/** Heuristic check - use alongside parameterized queries. */
+export declare function containsSqlInjection(str: string): boolean;
+//# sourceMappingURL=sql-security.utils.d.ts.map

package/dist/src/utils/sql-security.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-security.utils.d.ts","sourceRoot":"","sources":["../../../src/utils/sql-security.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,wBAAgB,kBAAkB,CAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,cAAc,GAAE,GAAG,CAAC,MAAM,CAAa,GACxC,IAAI,CAgBN;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAajE;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAG9D;AAED,wBAAgB,mBAAmB,CAC/B,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,EAClC,GAAG,GAAE,MAAU,EACf,GAAG,GAAE,MAAgB,GACtB,MAAM,CAYR;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAiCzD"}

package/dist/src/utils/sql-security.utils.js

@@ -0,0 +1,90 @@
+"use strict";
+/**
+ * SQL Security Utilities
+ *
+ * IMPORTANT: These utilities should be used alongside parameterized queries,
+ * not as a replacement. Always use parameterized queries for user input.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateColumnName = validateColumnName;
+exports.validateTableName = validateTableName;
+exports.escapeSqlIdentifier = escapeSqlIdentifier;
+exports.validateLimitOffset = validateLimitOffset;
+exports.escapeLikePattern = escapeLikePattern;
+exports.containsSqlInjection = containsSqlInjection;
+const sql_1 = require("../constants/sql");
+function validateColumnName(column, allowedColumns = new Set()) {
+    if (!column) {
+        throw new Error('Column name is required');
+    }
+    if (column.length > sql_1.SQL_IDENTIFIER_MAX_LENGTH) {
+        throw new Error(`Column name exceeds maximum length of ${sql_1.SQL_IDENTIFIER_MAX_LENGTH} characters`);
+    }
+    if (!sql_1.SQL_PATTERNS.COLUMN.test(column)) {
+        throw new Error(`Invalid column name: "${column}". Column names must start with letter or underscore and contain only letters, numbers, and underscores.`);
+    }
+    if (allowedColumns.size > 0 && !allowedColumns.has(column)) {
+        throw new Error(`Column "${column}" is not in allowed columns list`);
+    }
+}
+function validateTableName(table) {
+    if (!table) {
+        throw new Error('Table name is required');
+    }
+    // Check total length (schema.table could be up to 2x + 1)
+    if (table.length > (sql_1.SQL_IDENTIFIER_MAX_LENGTH * 2 + 1)) {
+        throw new Error(`Table name exceeds maximum allowed length`);
+    }
+    if (!sql_1.SQL_PATTERNS.TABLE.test(table)) {
+        throw new Error(`Invalid table name: "${table}"`);
+    }
+}
+/** IMPORTANT: Prefer parameterized queries. Use only when identifiers must be interpolated. */
+function escapeSqlIdentifier(identifier) {
+    validateColumnName(identifier);
+    return `"${identifier.replace(/"/g, '""')}"`;
+}
+function validateLimitOffset(value, min = 0, max = 1000000) {
+    if (value === undefined || value === null) {
+        throw new Error(`Invalid LIMIT/OFFSET value: ${value}. Value is required`);
+    }
+    const num = typeof value === 'string' ? parseInt(value, 10) : value;
+    if (isNaN(num) || num < min || num > max) {
+        throw new Error(`Invalid LIMIT/OFFSET value: ${value}. Must be between ${min} and ${max}`);
+    }
+    return Math.floor(num);
+}
+/** Escape LIKE metacharacters (%, _, \) in a user-provided search string. */
+function escapeLikePattern(value) {
+    return value.replace(/[%_\\]/g, '\\$&');
+}
+/** Heuristic check - use alongside parameterized queries. */
+function containsSqlInjection(str) {
+    // Truncate very long strings to prevent ReDoS
+    const checkStr = str.length > sql_1.SQL_CHECK_MAX_LENGTH ? str.slice(0, sql_1.SQL_CHECK_MAX_LENGTH) : str;
+    // Use simpler patterns that are less susceptible to ReDoS
+    // Pattern 1: Statement terminator followed by DDL/DML commands
+    if (/;\s*(DROP|DELETE|INSERT|UPDATE|ALTER|CREATE|TRUNCATE|EXEC)\b/i.test(checkStr)) {
+        return true;
+    }
+    // Pattern 2: SQL comment indicators
+    if (/--/.test(checkStr) || /\/\*/.test(checkStr) || /\*\//.test(checkStr)) {
+        return true;
+    }
+    // Pattern 3: xp_ extended stored procedures (SQL Server specific)
+    if (/\bxp_\w/i.test(checkStr)) {
+        return true;
+    }
+    // Pattern 4: UNION-based injection (simplified to avoid ReDoS)
+    if (/\bUNION\b[\s\S]{0,50}\bSELECT\b/i.test(checkStr)) {
+        return true;
+    }
+    // Pattern 5: Multiple single quotes (potential string escape attack)
+    // Count single quotes instead of using regex that could ReDoS
+    const quoteCount = (checkStr.match(/'/g) || []).length;
+    if (quoteCount >= 4) {
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=sql-security.utils.js.map

package/dist/src/utils/sql-security.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-security.utils.js","sourceRoot":"","sources":["../../../src/utils/sql-security.utils.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAQH,gDAmBC;AAED,8CAaC;AAGD,kDAGC;AAED,kDAgBC;AAGD,8CAEC;AAGD,oDAiCC;AAzGD,0CAI0B;AAE1B,SAAgB,kBAAkB,CAC9B,MAA0B,EAC1B,iBAA8B,IAAI,GAAG,EAAE;IAEvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,+BAAyB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,yCAAyC,+BAAyB,aAAa,CAAC,CAAC;IACrG,CAAC;IAED,IAAI,CAAC,kBAAY,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,0GAA0G,CAAC,CAAC;IAC/J,CAAC;IAED,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,kCAAkC,CAAC,CAAC;IACzE,CAAC;AACL,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAAyB;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC9C,CAAC;IAED,0DAA0D;IAC1D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,+BAAyB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,CAAC,kBAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,GAAG,CAAC,CAAC;IACtD,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,SAAgB,mBAAmB,CAAC,UAAkB;IAClD,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/B,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACjD,CAAC;AAED,SAAgB,mBAAmB,CAC/B,KAAkC,EAClC,MAAc,CAAC,EACf,MAAc,OAAO;IAErB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,qBAAqB,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAEpE,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,qBAAqB,GAAG,QAAQ,GAAG,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,SAAgB,iBAAiB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,6DAA6D;AAC7D,SAAgB,oBAAoB,CAAC,GAAW;IAC5C,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,0BAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,0BAAoB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAE9F,0DAA0D;IAC1D,+DAA+D;IAC/D,IAAI,+DAA+D,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,oCAAoC;IACpC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,kEAAkE;IAClE,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,+DAA+D;IAC/D,IAAI,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,qEAAqE;IACrE,8DAA8D;IAC9D,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACvD,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC"}

package/dist/src/utils/step-utils.d.ts

@@ -0,0 +1,3 @@
+import { PipelineStepDefinition } from '../../shared/types';
+export declare function getStepStrategy(step: PipelineStepDefinition): string | undefined;
+//# sourceMappingURL=step-utils.d.ts.map

package/dist/src/utils/step-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-utils.d.ts","sourceRoot":"","sources":["../../../src/utils/step-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAM5D,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,GAAG,SAAS,CAMhF"}

package/dist/src/utils/step-utils.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getStepStrategy = getStepStrategy;
+function isConfigObject(config) {
+    return config !== null && typeof config === 'object' && !Array.isArray(config);
+}
+function getStepStrategy(step) {
+    if (!step || !isConfigObject(step.config)) {
+        return undefined;
+    }
+    const { strategy } = step.config;
+    return typeof strategy === 'string' ? strategy : undefined;
+}
+//# sourceMappingURL=step-utils.js.map

package/dist/src/utils/step-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-utils.js","sourceRoot":"","sources":["../../../src/utils/step-utils.ts"],"names":[],"mappings":";;AAMA,0CAMC;AAVD,SAAS,cAAc,CAAC,MAAe;IACnC,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AACnF,CAAC;AAED,SAAgB,eAAe,CAAC,IAA4B;IACxD,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;IACjC,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC"}

package/dist/src/utils/trigger-utils.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Trigger types and their handlers:
+ * - schedule: ScheduleHandler (cron/interval)
+ * - webhook: WebhookController (HTTP endpoints)
+ * - event: EventTriggerService (Vendure events)
+ * - message: MessageConsumerService (queue messages)
+ * - manual: Pipeline runs started via API
+ */
+import { PipelineDefinition, PipelineStepDefinition, TriggerType } from '../../shared/types';
+/** Parsed trigger config (type-safe subset) */
+interface ParsedTriggerConfig {
+    type: TriggerType;
+    enabled?: boolean;
+    [key: string]: unknown;
+}
+export declare function parseTriggerConfig(step: PipelineStepDefinition | undefined | null): ParsedTriggerConfig | null;
+export declare function findEnabledTriggersByType(definition: PipelineDefinition | undefined | null, triggerType: TriggerType): PipelineStepDefinition[];
+export {};
+//# sourceMappingURL=trigger-utils.d.ts.map

package/dist/src/utils/trigger-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trigger-utils.d.ts","sourceRoot":"","sources":["../../../src/utils/trigger-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAG7F,+CAA+C;AAC/C,UAAU,mBAAmB;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAwBD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,GAAG,SAAS,GAAG,IAAI,GAAG,mBAAmB,GAAG,IAAI,CAS9G;AAED,wBAAgB,yBAAyB,CACrC,UAAU,EAAE,kBAAkB,GAAG,SAAS,GAAG,IAAI,EACjD,WAAW,EAAE,WAAW,GACzB,sBAAsB,EAAE,CAM1B"}

package/dist/src/utils/trigger-utils.js

@@ -0,0 +1,47 @@
+"use strict";
+/**
+ * Trigger types and their handlers:
+ * - schedule: ScheduleHandler (cron/interval)
+ * - webhook: WebhookController (HTTP endpoints)
+ * - event: EventTriggerService (Vendure events)
+ * - message: MessageConsumerService (queue messages)
+ * - manual: Pipeline runs started via API
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseTriggerConfig = parseTriggerConfig;
+exports.findEnabledTriggersByType = findEnabledTriggersByType;
+const enums_1 = require("../constants/enums");
+function isTriggerStep(step) {
+    return step?.type === enums_1.StepType.TRIGGER;
+}
+function findTriggerSteps(definition) {
+    if (!definition?.steps || !Array.isArray(definition.steps)) {
+        return [];
+    }
+    return definition.steps.filter(isTriggerStep);
+}
+function findTriggerStepsByType(definition, triggerType) {
+    const triggers = findTriggerSteps(definition);
+    return triggers.filter(step => {
+        const config = step.config;
+        return config?.type === triggerType;
+    });
+}
+function parseTriggerConfig(step) {
+    if (!isTriggerStep(step)) {
+        return null;
+    }
+    const config = step.config;
+    if (!config || typeof config.type !== 'string') {
+        return null;
+    }
+    return config;
+}
+function findEnabledTriggersByType(definition, triggerType) {
+    return findTriggerStepsByType(definition, triggerType).filter(step => {
+        const config = step.config;
+        // enabled defaults to true if not specified
+        return config?.enabled !== false;
+    });
+}
+//# sourceMappingURL=trigger-utils.js.map

package/dist/src/utils/trigger-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trigger-utils.js","sourceRoot":"","sources":["../../../src/utils/trigger-utils.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAkCH,gDASC;AAED,8DASC;AAnDD,8CAA8C;AAS9C,SAAS,aAAa,CAAC,IAA+C;IAClE,OAAO,IAAI,EAAE,IAAI,KAAK,gBAAQ,CAAC,OAAO,CAAC;AAC3C,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAiD;IACvE,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,sBAAsB,CAC3B,UAAiD,EACjD,WAAwB;IAExB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAyC,CAAC;QAC9D,OAAO,MAAM,EAAE,IAAI,KAAK,WAAW,CAAC;IACxC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAgB,kBAAkB,CAAC,IAA+C;IAC9E,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAyC,CAAC;IAC9D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAgB,yBAAyB,CACrC,UAAiD,EACjD,WAAwB;IAExB,OAAO,sBAAsB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAyC,CAAC;QAC9D,4CAA4C;QAC5C,OAAO,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/utils/url-helpers.d.ts

@@ -0,0 +1,17 @@
+/** Minimal connection config for URL building (subset of full ConnectionConfig). */
+export interface UrlConnectionConfig {
+    baseUrl?: string;
+    headers?: Record<string, string>;
+    auth?: {
+        type: string;
+        secretCode?: string;
+        headerName?: string;
+        username?: string;
+        usernameSecretCode?: string;
+        token?: string;
+        password?: string;
+    };
+}
+export declare function buildUrlWithConnection(url: string, connection?: UrlConnectionConfig): string;
+export declare function isValidGraphQLUrl(url: string, hasConnection: boolean): boolean;
+//# sourceMappingURL=url-helpers.d.ts.map

package/dist/src/utils/url-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-helpers.d.ts","sourceRoot":"","sources":["../../../src/utils/url-helpers.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE;QACH,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACL;AAED,wBAAgB,sBAAsB,CAClC,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,mBAAmB,GACjC,MAAM,CAiBR;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO,CAe9E"}

package/dist/src/utils/url-helpers.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildUrlWithConnection = buildUrlWithConnection;
+exports.isValidGraphQLUrl = isValidGraphQLUrl;
+function buildUrlWithConnection(url, connection) {
+    if (!connection?.baseUrl) {
+        return url;
+    }
+    // If URL is a relative path starting with '/', combine with baseUrl
+    if (url.startsWith('/')) {
+        return `${connection.baseUrl.replace(/\/$/, '')}${url}`;
+    }
+    // If URL is empty, use baseUrl directly
+    if (!url) {
+        return connection.baseUrl;
+    }
+    // URL is absolute, return as-is
+    return url;
+}
+function isValidGraphQLUrl(url, hasConnection) {
+    if (!url) {
+        return hasConnection; // Empty URL is ok if we have a connection
+    }
+    if (hasConnection && url.startsWith('/')) {
+        return true;
+    }
+    try {
+        const parsed = new URL(url);
+        return ['http:', 'https:'].includes(parsed.protocol);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=url-helpers.js.map

package/dist/src/utils/url-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-helpers.js","sourceRoot":"","sources":["../../../src/utils/url-helpers.ts"],"names":[],"mappings":";;AAeA,wDAoBC;AAED,8CAeC;AArCD,SAAgB,sBAAsB,CAClC,GAAW,EACX,UAAgC;IAEhC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC;IACf,CAAC;IAED,oEAAoE;IACpE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC;IAC5D,CAAC;IAED,wCAAwC;IACxC,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,OAAO,UAAU,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,gCAAgC;IAChC,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAgB,iBAAiB,CAAC,GAAW,EAAE,aAAsB;IACjE,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,OAAO,aAAa,CAAC,CAAC,0CAA0C;IACpE,CAAC;IAED,IAAI,aAAa,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC"}

package/dist/src/utils/url-sanitize.utils.d.ts

@@ -0,0 +1,27 @@
+/**
+ * URL Sanitization Utilities
+ *
+ * Provides URL sanitization for safe logging, removing sensitive information
+ * such as query parameters (which may contain tokens) or embedded credentials.
+ */
+export interface SanitizeUrlOptions {
+    /** Strip query parameters (e.g., ?token=xxx). Default: true */
+    stripQueryParams?: boolean;
+    /** Strip embedded credentials (e.g., user:pass@host). Default: true */
+    stripCredentials?: boolean;
+    /** Fallback string when URL is invalid. Default: '<invalid-url>' */
+    invalidFallback?: string;
+}
+/**
+ * Sanitize a URL for safe logging by removing sensitive information.
+ *
+ * Supports two sanitization strategies (both enabled by default):
+ * - Strip query parameters: removes ?token=xxx, ?key=abc, etc.
+ * - Strip credentials: removes user:pass@ from the URL
+ *
+ * @param url - The URL to sanitize
+ * @param options - Sanitization options
+ * @returns Sanitized URL string safe for logging
+ */
+export declare function sanitizeUrlForLogging(url: string, options?: SanitizeUrlOptions): string;
+//# sourceMappingURL=url-sanitize.utils.d.ts.map

package/dist/src/utils/url-sanitize.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-sanitize.utils.d.ts","sourceRoot":"","sources":["../../../src/utils/url-sanitize.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,kBAAkB;IAC/B,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,oEAAoE;IACpE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC5B;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAmBvF"}

package/dist/src/utils/url-sanitize.utils.js

@@ -0,0 +1,43 @@
+"use strict";
+/**
+ * URL Sanitization Utilities
+ *
+ * Provides URL sanitization for safe logging, removing sensitive information
+ * such as query parameters (which may contain tokens) or embedded credentials.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeUrlForLogging = sanitizeUrlForLogging;
+const DEFAULT_OPTIONS = {
+    stripQueryParams: true,
+    stripCredentials: true,
+    invalidFallback: '<invalid-url>',
+};
+/**
+ * Sanitize a URL for safe logging by removing sensitive information.
+ *
+ * Supports two sanitization strategies (both enabled by default):
+ * - Strip query parameters: removes ?token=xxx, ?key=abc, etc.
+ * - Strip credentials: removes user:pass@ from the URL
+ *
+ * @param url - The URL to sanitize
+ * @param options - Sanitization options
+ * @returns Sanitized URL string safe for logging
+ */
+function sanitizeUrlForLogging(url, options) {
+    const opts = { ...DEFAULT_OPTIONS, ...options };
+    try {
+        const parsed = new URL(url);
+        if (opts.stripCredentials) {
+            parsed.username = '';
+            parsed.password = '';
+        }
+        if (opts.stripQueryParams) {
+            return parsed.origin + parsed.pathname;
+        }
+        return parsed.toString();
+    }
+    catch {
+        return opts.invalidFallback;
+    }
+}
+//# sourceMappingURL=url-sanitize.utils.js.map

package/dist/src/utils/url-sanitize.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-sanitize.utils.js","sourceRoot":"","sources":["../../../src/utils/url-sanitize.utils.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AA4BH,sDAmBC;AApCD,MAAM,eAAe,GAAiC;IAClD,gBAAgB,EAAE,IAAI;IACtB,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,eAAe;CACnC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,SAAgB,qBAAqB,CAAC,GAAW,EAAE,OAA4B;IAC3E,MAAM,IAAI,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;IAEhD,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5B,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;YACrB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QACzB,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3C,CAAC;QAED,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC,eAAe,CAAC;IAChC,CAAC;AACL,CAAC"}

package/dist/src/utils/url-security.utils.d.ts

@@ -0,0 +1,20 @@
+export interface UrlSecurityConfig {
+    disableSsrfProtection?: boolean;
+    additionalBlockedHostnames?: string[];
+    additionalBlockedRanges?: string[];
+    allowedHostnames?: string[];
+    allowPrivateIPs?: boolean;
+}
+export interface UrlSafetyResult {
+    safe: boolean;
+    reason?: string;
+    resolvedIPs?: string[];
+}
+export declare function isPrivateIP(ip: string): boolean;
+export declare function isBlockedHostname(hostname: string, additionalBlocked?: string[]): boolean;
+/** SSRF protection: validates scheme, hostname blocklist, and DNS resolution */
+export declare function validateUrlSafety(url: string, config?: UrlSecurityConfig): Promise<UrlSafetyResult>;
+/** Synchronous validation without DNS resolution (DNS rebinding attacks may bypass) */
+export declare function validateUrlSafetySync(url: string, config?: UrlSecurityConfig): UrlSafetyResult;
+export declare function assertUrlSafe(url: string, config?: UrlSecurityConfig): Promise<void>;
+//# sourceMappingURL=url-security.utils.d.ts.map

package/dist/src/utils/url-security.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-security.utils.d.ts","sourceRoot":"","sources":["../../../src/utils/url-security.utils.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,iBAAiB;IAC9B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAmID,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAW/C;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAyBzF;AAED,gFAAgF;AAChF,wBAAsB,iBAAiB,CACnC,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC,eAAe,CAAC,CA0G1B;AAED,uFAAuF;AACvF,wBAAgB,qBAAqB,CACjC,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,iBAAiB,GAC3B,eAAe,CAkDjB;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAK1F"}