@pipeline-builder/api-core 0.0.1

package/lib/utils/ssrf.js

@@ -0,0 +1,106 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Shared SSRF guard for user/tenant-supplied outbound URLs (webhook targets,
+ * callbacks, …). Promoted to api-core so every service that lets an org point
+ * the platform at an arbitrary URL enforces the SAME denylist instead of each
+ * re-deriving it (the compliance notifier and the platform alert relay both
+ * consume this).
+ *
+ * The guard resolves the host up front and rejects any address that is — or
+ * resolves to — a loopback / private / link-local / unique-local / carrier-grade
+ * NAT / cloud-metadata range, so a tenant can't aim a webhook at
+ * `169.254.169.254` or an in-cluster service.
+ *
+ * DNS-rebinding note: the up-front resolve validates the *initial* host only.
+ * Node's global `fetch` (undici) re-resolves DNS for a redirect target
+ * independently, so callers MUST send with `redirect: 'manual'` and treat any
+ * 3xx as a failed delivery — see {@link SSRF_FETCH_INIT}. Pinning the exact
+ * resolved IP for the connection would need a custom undici dispatcher (not a
+ * dependency here); refusing redirects closes the practical rebinding pivot.
+ */
+import { lookup } from 'dns/promises';
+import { isIP } from 'net';
+/**
+ * True for loopback / private / link-local / CGNAT / cloud-metadata / ULA
+ * addresses — the ranges an outbound tenant webhook must never reach.
+ */
+export function isPrivateAddress(ip) {
+    const addr = ip.replace(/^\[|\]$/g, '').toLowerCase();
+    const v4 = addr.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (v4) {
+        const a = Number(v4[1]), b = Number(v4[2]);
+        return a === 0 || a === 10 || a === 127
+            || (a === 169 && b === 254) // link-local incl. 169.254.169.254 metadata
+            || (a === 172 && b >= 16 && b <= 31)
+            || (a === 192 && b === 168)
+            || (a === 100 && b >= 64 && b <= 127); // CGNAT
+    }
+    if (addr === '::1' || addr === '::')
+        return true;
+    if (addr.startsWith('::ffff:')) {
+        const suffix = addr.slice(7);
+        // Dotted form (`::ffff:127.0.0.1`) — recurse straight into the v4 checks.
+        if (suffix.includes('.'))
+            return isPrivateAddress(suffix);
+        // Hex form (`::ffff:7f00:1` = 127.0.0.1, `::ffff:c0a8:1` = 192.168.0.1):
+        // the low 32 bits are written as the last one/two hex groups. Fold them into
+        // a dotted quad and recurse so the v4 ranges below still catch it — without
+        // this the hex form slips past every check and reaches loopback/private space.
+        const groups = suffix.split(':');
+        const high = parseInt(groups[groups.length - 2] ?? '0', 16);
+        const low = parseInt(groups[groups.length - 1] ?? '0', 16);
+        if (Number.isNaN(high) || Number.isNaN(low))
+            return false;
+        // Fold each 16-bit half into two octets (arithmetic, not bitwise, to satisfy
+        // the no-bitwise lint): high → a.b, low → c.d.
+        const dotted = `${Math.floor(high / 256) % 256}.${high % 256}.${Math.floor(low / 256) % 256}.${low % 256}`;
+        return isPrivateAddress(dotted);
+    }
+    return addr.startsWith('fc') || addr.startsWith('fd') // unique-local
+        || addr.startsWith('fe80'); // link-local
+}
+/**
+ * Reject a URL that is malformed, uses a disallowed protocol, or points at a
+ * private/loopback/link-local/metadata address (by IP literal or by DNS
+ * resolution). Throws a plain `Error` with a caller-safe message on rejection;
+ * resolves silently when the URL is safe to fetch.
+ */
+export async function assertSafeUrl(rawUrl, opts = {}) {
+    const protocols = opts.protocols ?? ['https:'];
+    let u;
+    try {
+        u = new URL(rawUrl);
+    }
+    catch {
+        throw new Error('invalid url');
+    }
+    if (!protocols.includes(u.protocol)) {
+        throw new Error(`url must use ${protocols.map((p) => p.replace(/:$/, '')).join('/')}`);
+    }
+    const host = u.hostname;
+    if (isIP(host) && isPrivateAddress(host))
+        throw new Error('url targets a private address');
+    let addrs;
+    try {
+        addrs = await lookup(host, { all: true });
+    }
+    catch {
+        throw new Error('url host did not resolve');
+    }
+    if (addrs.length === 0)
+        throw new Error('url host did not resolve');
+    if (addrs.some((a) => isPrivateAddress(a.address)))
+        throw new Error('url resolves to a private address');
+}
+/**
+ * `fetch` init fragment every SSRF-guarded call MUST spread so a redirect can't
+ * pivot to an unvalidated (and re-resolved) host. Callers treat a 3xx / opaque
+ * redirect response as a failed delivery rather than following it.
+ */
+export const SSRF_FETCH_INIT = { redirect: 'manual' };
+/** True when a `fetch` Response is (or was) a redirect the caller must refuse. */
+export function isRefusedRedirect(resp) {
+    return resp.type === 'opaqueredirect' || (resp.status >= 300 && resp.status < 400);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3NyZi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy9zc3JmLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEM7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQWtCRztBQUVILE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFDdEMsT0FBTyxFQUFFLElBQUksRUFBRSxNQUFNLEtBQUssQ0FBQztBQUUzQjs7O0dBR0c7QUFDSCxNQUFNLFVBQVUsZ0JBQWdCLENBQUMsRUFBVTtJQUN6QyxNQUFNLElBQUksR0FBRyxFQUFFLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQztJQUN0RCxNQUFNLEVBQUUsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDdEUsSUFBSSxFQUFFLEVBQUUsQ0FBQztRQUNQLE1BQU0sQ0FBQyxHQUFHLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEdBQUcsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzNDLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxHQUFHO2VBQ2xDLENBQUMsQ0FBQyxLQUFLLEdBQUcsSUFBSSxDQUFDLEtBQUssR0FBRyxDQUFDLENBQUMsNENBQTRDO2VBQ3JFLENBQUMsQ0FBQyxLQUFLLEdBQUcsSUFBSSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7ZUFDakMsQ0FBQyxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUMsS0FBSyxHQUFHLENBQUM7ZUFDeEIsQ0FBQyxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJLEdBQUcsQ0FBQyxDQUFDLENBQUMsUUFBUTtJQUNuRCxDQUFDO0lBQ0QsSUFBSSxJQUFJLEtBQUssS0FBSyxJQUFJLElBQUksS0FBSyxJQUFJO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDakQsSUFBSSxJQUFJLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDL0IsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUM3QiwwRUFBMEU7UUFDMUUsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQztZQUFFLE9BQU8sZ0JBQWdCLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDMUQseUVBQXlFO1FBQ3pFLDZFQUE2RTtRQUM3RSw0RUFBNEU7UUFDNUUsK0VBQStFO1FBQy9FLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDakMsTUFBTSxJQUFJLEdBQUcsUUFBUSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxJQUFJLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUM1RCxNQUFNLEdBQUcsR0FBRyxRQUFRLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLElBQUksR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQzNELElBQUksTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQztZQUFFLE9BQU8sS0FBSyxDQUFDO1FBQzFELDZFQUE2RTtRQUM3RSwrQ0FBK0M7UUFDL0MsTUFBTSxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksR0FBRyxHQUFHLENBQUMsR0FBRyxHQUFHLElBQUksSUFBSSxHQUFHLEdBQUcsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsR0FBRyxHQUFHLENBQUMsR0FBRyxHQUFHLElBQUksR0FBRyxHQUFHLEdBQUcsRUFBRSxDQUFDO1FBQzNHLE9BQU8sZ0JBQWdCLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDbEMsQ0FBQztJQUNELE9BQU8sSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLGVBQWU7V0FDaEUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLGFBQWE7QUFDN0MsQ0FBQztBQVFEOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxhQUFhLENBQUMsTUFBYyxFQUFFLElBQUksR0FBbUIsRUFBRTtJQUMzRSxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsU0FBUyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDL0MsSUFBSSxDQUFNLENBQUM7SUFDWCxJQUFJLENBQUM7UUFBQyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUM7SUFBQyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUFDLENBQUM7SUFDdEUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDcEMsTUFBTSxJQUFJLEtBQUssQ0FBQyxnQkFBZ0IsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3pGLENBQUM7SUFDRCxNQUFNLElBQUksR0FBRyxDQUFDLENBQUMsUUFBUSxDQUFDO0lBQ3hCLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLGdCQUFnQixDQUFDLElBQUksQ0FBQztRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsK0JBQStCLENBQUMsQ0FBQztJQUMzRixJQUFJLEtBQTRCLENBQUM7SUFDakMsSUFBSSxDQUFDO1FBQUMsS0FBSyxHQUFHLE1BQU0sTUFBTSxDQUFDLElBQUksRUFBRSxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQUMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsMEJBQTBCLENBQUMsQ0FBQztJQUFDLENBQUM7SUFDekcsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLDBCQUEwQixDQUFDLENBQUM7SUFDcEUsSUFBSSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLG1DQUFtQyxDQUFDLENBQUM7QUFDM0csQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsRUFBRSxRQUFRLEVBQUUsUUFBaUIsRUFBRSxDQUFDO0FBRS9ELGtGQUFrRjtBQUNsRixNQUFNLFVBQVUsaUJBQWlCLENBQUMsSUFBdUM7SUFDdkUsT0FBTyxJQUFJLENBQUMsSUFBSSxLQUFLLGdCQUFnQixJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sSUFBSSxHQUFHLElBQUksSUFBSSxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUMsQ0FBQztBQUNyRixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKlxuICogU2hhcmVkIFNTUkYgZ3VhcmQgZm9yIHVzZXIvdGVuYW50LXN1cHBsaWVkIG91dGJvdW5kIFVSTHMgKHdlYmhvb2sgdGFyZ2V0cyxcbiAqIGNhbGxiYWNrcywg4oCmKS4gUHJvbW90ZWQgdG8gYXBpLWNvcmUgc28gZXZlcnkgc2VydmljZSB0aGF0IGxldHMgYW4gb3JnIHBvaW50XG4gKiB0aGUgcGxhdGZvcm0gYXQgYW4gYXJiaXRyYXJ5IFVSTCBlbmZvcmNlcyB0aGUgU0FNRSBkZW55bGlzdCBpbnN0ZWFkIG9mIGVhY2hcbiAqIHJlLWRlcml2aW5nIGl0ICh0aGUgY29tcGxpYW5jZSBub3RpZmllciBhbmQgdGhlIHBsYXRmb3JtIGFsZXJ0IHJlbGF5IGJvdGhcbiAqIGNvbnN1bWUgdGhpcykuXG4gKlxuICogVGhlIGd1YXJkIHJlc29sdmVzIHRoZSBob3N0IHVwIGZyb250IGFuZCByZWplY3RzIGFueSBhZGRyZXNzIHRoYXQgaXMg4oCUIG9yXG4gKiByZXNvbHZlcyB0byDigJQgYSBsb29wYmFjayAvIHByaXZhdGUgLyBsaW5rLWxvY2FsIC8gdW5pcXVlLWxvY2FsIC8gY2Fycmllci1ncmFkZVxuICogTkFUIC8gY2xvdWQtbWV0YWRhdGEgcmFuZ2UsIHNvIGEgdGVuYW50IGNhbid0IGFpbSBhIHdlYmhvb2sgYXRcbiAqIGAxNjkuMjU0LjE2OS4yNTRgIG9yIGFuIGluLWNsdXN0ZXIgc2VydmljZS5cbiAqXG4gKiBETlMtcmViaW5kaW5nIG5vdGU6IHRoZSB1cC1mcm9udCByZXNvbHZlIHZhbGlkYXRlcyB0aGUgKmluaXRpYWwqIGhvc3Qgb25seS5cbiAqIE5vZGUncyBnbG9iYWwgYGZldGNoYCAodW5kaWNpKSByZS1yZXNvbHZlcyBETlMgZm9yIGEgcmVkaXJlY3QgdGFyZ2V0XG4gKiBpbmRlcGVuZGVudGx5LCBzbyBjYWxsZXJzIE1VU1Qgc2VuZCB3aXRoIGByZWRpcmVjdDogJ21hbnVhbCdgIGFuZCB0cmVhdCBhbnlcbiAqIDN4eCBhcyBhIGZhaWxlZCBkZWxpdmVyeSDigJQgc2VlIHtAbGluayBTU1JGX0ZFVENIX0lOSVR9LiBQaW5uaW5nIHRoZSBleGFjdFxuICogcmVzb2x2ZWQgSVAgZm9yIHRoZSBjb25uZWN0aW9uIHdvdWxkIG5lZWQgYSBjdXN0b20gdW5kaWNpIGRpc3BhdGNoZXIgKG5vdCBhXG4gKiBkZXBlbmRlbmN5IGhlcmUpOyByZWZ1c2luZyByZWRpcmVjdHMgY2xvc2VzIHRoZSBwcmFjdGljYWwgcmViaW5kaW5nIHBpdm90LlxuICovXG5cbmltcG9ydCB7IGxvb2t1cCB9IGZyb20gJ2Rucy9wcm9taXNlcyc7XG5pbXBvcnQgeyBpc0lQIH0gZnJvbSAnbmV0JztcblxuLyoqXG4gKiBUcnVlIGZvciBsb29wYmFjayAvIHByaXZhdGUgLyBsaW5rLWxvY2FsIC8gQ0dOQVQgLyBjbG91ZC1tZXRhZGF0YSAvIFVMQVxuICogYWRkcmVzc2VzIOKAlCB0aGUgcmFuZ2VzIGFuIG91dGJvdW5kIHRlbmFudCB3ZWJob29rIG11c3QgbmV2ZXIgcmVhY2guXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBpc1ByaXZhdGVBZGRyZXNzKGlwOiBzdHJpbmcpOiBib29sZWFuIHtcbiAgY29uc3QgYWRkciA9IGlwLnJlcGxhY2UoL15cXFt8XFxdJC9nLCAnJykudG9Mb3dlckNhc2UoKTtcbiAgY29uc3QgdjQgPSBhZGRyLm1hdGNoKC9eKFxcZHsxLDN9KVxcLihcXGR7MSwzfSlcXC4oXFxkezEsM30pXFwuKFxcZHsxLDN9KSQvKTtcbiAgaWYgKHY0KSB7XG4gICAgY29uc3QgYSA9IE51bWJlcih2NFsxXSksIGIgPSBOdW1iZXIodjRbMl0pO1xuICAgIHJldHVybiBhID09PSAwIHx8IGEgPT09IDEwIHx8IGEgPT09IDEyN1xuICAgICAgfHwgKGEgPT09IDE2OSAmJiBiID09PSAyNTQpIC8vIGxpbmstbG9jYWwgaW5jbC4gMTY5LjI1NC4xNjkuMjU0IG1ldGFkYXRhXG4gICAgICB8fCAoYSA9PT0gMTcyICYmIGIgPj0gMTYgJiYgYiA8PSAzMSlcbiAgICAgIHx8IChhID09PSAxOTIgJiYgYiA9PT0gMTY4KVxuICAgICAgfHwgKGEgPT09IDEwMCAmJiBiID49IDY0ICYmIGIgPD0gMTI3KTsgLy8gQ0dOQVRcbiAgfVxuICBpZiAoYWRkciA9PT0gJzo6MScgfHwgYWRkciA9PT0gJzo6JykgcmV0dXJuIHRydWU7XG4gIGlmIChhZGRyLnN0YXJ0c1dpdGgoJzo6ZmZmZjonKSkge1xuICAgIGNvbnN0IHN1ZmZpeCA9IGFkZHIuc2xpY2UoNyk7XG4gICAgLy8gRG90dGVkIGZvcm0gKGA6OmZmZmY6MTI3LjAuMC4xYCkg4oCUIHJlY3Vyc2Ugc3RyYWlnaHQgaW50byB0aGUgdjQgY2hlY2tzLlxuICAgIGlmIChzdWZmaXguaW5jbHVkZXMoJy4nKSkgcmV0dXJuIGlzUHJpdmF0ZUFkZHJlc3Moc3VmZml4KTtcbiAgICAvLyBIZXggZm9ybSAoYDo6ZmZmZjo3ZjAwOjFgID0gMTI3LjAuMC4xLCBgOjpmZmZmOmMwYTg6MWAgPSAxOTIuMTY4LjAuMSk6XG4gICAgLy8gdGhlIGxvdyAzMiBiaXRzIGFyZSB3cml0dGVuIGFzIHRoZSBsYXN0IG9uZS90d28gaGV4IGdyb3Vwcy4gRm9sZCB0aGVtIGludG9cbiAgICAvLyBhIGRvdHRlZCBxdWFkIGFuZCByZWN1cnNlIHNvIHRoZSB2NCByYW5nZXMgYmVsb3cgc3RpbGwgY2F0Y2ggaXQg4oCUIHdpdGhvdXRcbiAgICAvLyB0aGlzIHRoZSBoZXggZm9ybSBzbGlwcyBwYXN0IGV2ZXJ5IGNoZWNrIGFuZCByZWFjaGVzIGxvb3BiYWNrL3ByaXZhdGUgc3BhY2UuXG4gICAgY29uc3QgZ3JvdXBzID0gc3VmZml4LnNwbGl0KCc6Jyk7XG4gICAgY29uc3QgaGlnaCA9IHBhcnNlSW50KGdyb3Vwc1tncm91cHMubGVuZ3RoIC0gMl0gPz8gJzAnLCAxNik7XG4gICAgY29uc3QgbG93ID0gcGFyc2VJbnQoZ3JvdXBzW2dyb3Vwcy5sZW5ndGggLSAxXSA/PyAnMCcsIDE2KTtcbiAgICBpZiAoTnVtYmVyLmlzTmFOKGhpZ2gpIHx8IE51bWJlci5pc05hTihsb3cpKSByZXR1cm4gZmFsc2U7XG4gICAgLy8gRm9sZCBlYWNoIDE2LWJpdCBoYWxmIGludG8gdHdvIG9jdGV0cyAoYXJpdGhtZXRpYywgbm90IGJpdHdpc2UsIHRvIHNhdGlzZnlcbiAgICAvLyB0aGUgbm8tYml0d2lzZSBsaW50KTogaGlnaCDihpIgYS5iLCBsb3cg4oaSIGMuZC5cbiAgICBjb25zdCBkb3R0ZWQgPSBgJHtNYXRoLmZsb29yKGhpZ2ggLyAyNTYpICUgMjU2fS4ke2hpZ2ggJSAyNTZ9LiR7TWF0aC5mbG9vcihsb3cgLyAyNTYpICUgMjU2fS4ke2xvdyAlIDI1Nn1gO1xuICAgIHJldHVybiBpc1ByaXZhdGVBZGRyZXNzKGRvdHRlZCk7XG4gIH1cbiAgcmV0dXJuIGFkZHIuc3RhcnRzV2l0aCgnZmMnKSB8fCBhZGRyLnN0YXJ0c1dpdGgoJ2ZkJykgLy8gdW5pcXVlLWxvY2FsXG4gICAgfHwgYWRkci5zdGFydHNXaXRoKCdmZTgwJyk7IC8vIGxpbmstbG9jYWxcbn1cblxuLyoqIE9wdGlvbnMgZm9yIHtAbGluayBhc3NlcnRTYWZlVXJsfS4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgU2FmZVVybE9wdGlvbnMge1xuICAvKiogQWxsb3dlZCBVUkwgcHJvdG9jb2xzIChkZWZhdWx0OiBgWydodHRwczonXWApLiAqL1xuICBwcm90b2NvbHM/OiBzdHJpbmdbXTtcbn1cblxuLyoqXG4gKiBSZWplY3QgYSBVUkwgdGhhdCBpcyBtYWxmb3JtZWQsIHVzZXMgYSBkaXNhbGxvd2VkIHByb3RvY29sLCBvciBwb2ludHMgYXQgYVxuICogcHJpdmF0ZS9sb29wYmFjay9saW5rLWxvY2FsL21ldGFkYXRhIGFkZHJlc3MgKGJ5IElQIGxpdGVyYWwgb3IgYnkgRE5TXG4gKiByZXNvbHV0aW9uKS4gVGhyb3dzIGEgcGxhaW4gYEVycm9yYCB3aXRoIGEgY2FsbGVyLXNhZmUgbWVzc2FnZSBvbiByZWplY3Rpb247XG4gKiByZXNvbHZlcyBzaWxlbnRseSB3aGVuIHRoZSBVUkwgaXMgc2FmZSB0byBmZXRjaC5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGFzc2VydFNhZmVVcmwocmF3VXJsOiBzdHJpbmcsIG9wdHM6IFNhZmVVcmxPcHRpb25zID0ge30pOiBQcm9taXNlPHZvaWQ+IHtcbiAgY29uc3QgcHJvdG9jb2xzID0gb3B0cy5wcm90b2NvbHMgPz8gWydodHRwczonXTtcbiAgbGV0IHU6IFVSTDtcbiAgdHJ5IHsgdSA9IG5ldyBVUkwocmF3VXJsKTsgfSBjYXRjaCB7IHRocm93IG5ldyBFcnJvcignaW52YWxpZCB1cmwnKTsgfVxuICBpZiAoIXByb3RvY29scy5pbmNsdWRlcyh1LnByb3RvY29sKSkge1xuICAgIHRocm93IG5ldyBFcnJvcihgdXJsIG11c3QgdXNlICR7cHJvdG9jb2xzLm1hcCgocCkgPT4gcC5yZXBsYWNlKC86JC8sICcnKSkuam9pbignLycpfWApO1xuICB9XG4gIGNvbnN0IGhvc3QgPSB1Lmhvc3RuYW1lO1xuICBpZiAoaXNJUChob3N0KSAmJiBpc1ByaXZhdGVBZGRyZXNzKGhvc3QpKSB0aHJvdyBuZXcgRXJyb3IoJ3VybCB0YXJnZXRzIGEgcHJpdmF0ZSBhZGRyZXNzJyk7XG4gIGxldCBhZGRyczogeyBhZGRyZXNzOiBzdHJpbmcgfVtdO1xuICB0cnkgeyBhZGRycyA9IGF3YWl0IGxvb2t1cChob3N0LCB7IGFsbDogdHJ1ZSB9KTsgfSBjYXRjaCB7IHRocm93IG5ldyBFcnJvcigndXJsIGhvc3QgZGlkIG5vdCByZXNvbHZlJyk7IH1cbiAgaWYgKGFkZHJzLmxlbmd0aCA9PT0gMCkgdGhyb3cgbmV3IEVycm9yKCd1cmwgaG9zdCBkaWQgbm90IHJlc29sdmUnKTtcbiAgaWYgKGFkZHJzLnNvbWUoKGEpID0+IGlzUHJpdmF0ZUFkZHJlc3MoYS5hZGRyZXNzKSkpIHRocm93IG5ldyBFcnJvcigndXJsIHJlc29sdmVzIHRvIGEgcHJpdmF0ZSBhZGRyZXNzJyk7XG59XG5cbi8qKlxuICogYGZldGNoYCBpbml0IGZyYWdtZW50IGV2ZXJ5IFNTUkYtZ3VhcmRlZCBjYWxsIE1VU1Qgc3ByZWFkIHNvIGEgcmVkaXJlY3QgY2FuJ3RcbiAqIHBpdm90IHRvIGFuIHVudmFsaWRhdGVkIChhbmQgcmUtcmVzb2x2ZWQpIGhvc3QuIENhbGxlcnMgdHJlYXQgYSAzeHggLyBvcGFxdWVcbiAqIHJlZGlyZWN0IHJlc3BvbnNlIGFzIGEgZmFpbGVkIGRlbGl2ZXJ5IHJhdGhlciB0aGFuIGZvbGxvd2luZyBpdC5cbiAqL1xuZXhwb3J0IGNvbnN0IFNTUkZfRkVUQ0hfSU5JVCA9IHsgcmVkaXJlY3Q6ICdtYW51YWwnIGFzIGNvbnN0IH07XG5cbi8qKiBUcnVlIHdoZW4gYSBgZmV0Y2hgIFJlc3BvbnNlIGlzIChvciB3YXMpIGEgcmVkaXJlY3QgdGhlIGNhbGxlciBtdXN0IHJlZnVzZS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBpc1JlZnVzZWRSZWRpcmVjdChyZXNwOiB7IHR5cGU/OiBzdHJpbmc7IHN0YXR1czogbnVtYmVyIH0pOiBib29sZWFuIHtcbiAgcmV0dXJuIHJlc3AudHlwZSA9PT0gJ29wYXF1ZXJlZGlyZWN0JyB8fCAocmVzcC5zdGF0dXMgPj0gMzAwICYmIHJlc3Auc3RhdHVzIDwgNDAwKTtcbn1cbiJdfQ==

package/lib/validation/ai-schemas.d.ts

@@ -0,0 +1,56 @@
+import { z } from 'zod';
+/**
+ * Schema for AI generation request body.
+ * Used by both POST /pipelines/generate and POST /plugins/generate.
+ */
+export declare const AIGenerateBodySchema: z.ZodObject<{
+    prompt: z.ZodString;
+    provider: z.ZodString;
+    model: z.ZodString;
+    apiKey: z.ZodOptional<z.ZodString>;
+    previousConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    fallbackProviders: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * Schema for POST /plugins/deploy-generated request body.
+ * Validates the AI-generated plugin configuration before Docker build.
+ */
+export declare const PluginDeployGeneratedSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    version: z.ZodString;
+    pluginType: z.ZodDefault<z.ZodEnum<{
+        CodeBuildStep: "CodeBuildStep";
+        ManualApprovalStep: "ManualApprovalStep";
+        ShellStep: "ShellStep";
+    }>>;
+    computeType: z.ZodDefault<z.ZodEnum<{
+        LARGE: "LARGE";
+        MEDIUM: "MEDIUM";
+        SMALL: "SMALL";
+        X2_LARGE: "X2_LARGE";
+    }>>;
+    keywords: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+    primaryOutputDirectory: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    installCommands: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+    commands: z.ZodArray<z.ZodString>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    buildArgs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    dockerfile: z.ZodString;
+    visibility: z.ZodDefault<z.ZodEnum<{
+        org: "org";
+        private: "private";
+        public: "public";
+    }>>;
+}, z.core.$strip>;
+/**
+ * Schema for POST /pipelines/generate/from-url/stream request body.
+ * Validates Git URL + AI provider configuration for repo-based pipeline generation.
+ */
+export declare const AIGenerateFromUrlBodySchema: z.ZodObject<{
+    gitUrl: z.ZodString;
+    provider: z.ZodString;
+    model: z.ZodString;
+    apiKey: z.ZodOptional<z.ZodString>;
+    repoToken: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;

package/lib/validation/ai-schemas.js

@@ -0,0 +1,78 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { z } from 'zod';
+import { VisibilitySchema } from './common-schemas.js';
+const MAX_PROMPT_LENGTH = parseInt(process.env.MAX_PROMPT_LENGTH || '5000', 10);
+// AI Generation Request
+/**
+ * Schema for AI generation request body.
+ * Used by both POST /pipelines/generate and POST /plugins/generate.
+ */
+export const AIGenerateBodySchema = z.object({
+    /** Natural language description of what to generate. */
+    prompt: z
+        .string()
+        .min(1, 'A prompt with a natural language description is required')
+        .max(MAX_PROMPT_LENGTH, `Prompt must be ${MAX_PROMPT_LENGTH} characters or fewer`),
+    /** AI provider identifier (e.g. "anthropic", "openai", "google"). */
+    provider: z.string().min(1, 'A provider is required (e.g., "anthropic", "openai", "google")'),
+    /** AI model identifier (e.g. "claude-sonnet-5", "gpt-4o"). */
+    model: z.string().min(1, 'A model is required (e.g., "claude-sonnet-5", "gpt-4o")'),
+    /** Optional custom API key to override the server/org key for this request. */
+    apiKey: z.string().min(1).optional(),
+    /** Previous pipeline config for iterative refinement. */
+    previousConfig: z.record(z.string(), z.unknown()).optional(),
+    /** Fallback AI providers if primary fails (e.g., ["openai", "google"]). */
+    fallbackProviders: z.array(z.string()).optional(),
+});
+// Plugin Deploy-Generated Request
+/**
+ * Schema for POST /plugins/deploy-generated request body.
+ * Validates the AI-generated plugin configuration before Docker build.
+ */
+export const PluginDeployGeneratedSchema = z.object({
+    /** Plugin name (lowercase, alphanumeric with hyphens). */
+    name: z.string().min(1, 'Plugin name is required'),
+    /** Human-readable description. */
+    description: z.string().optional(),
+    /** Semantic version (e.g. "1.0.0"). */
+    version: z.string().min(1, 'Version is required'),
+    /** Plugin execution type. */
+    pluginType: z.enum(['CodeBuildStep', 'ShellStep', 'ManualApprovalStep']).default('CodeBuildStep'),
+    /** AWS CodeBuild compute size. */
+    computeType: z.enum(['SMALL', 'MEDIUM', 'LARGE', 'X2_LARGE']).default('MEDIUM'),
+    /** Keywords for categorization. */
+    keywords: z.array(z.string()).optional().default([]),
+    /** Primary output directory path. */
+    primaryOutputDirectory: z.string().nullable().optional(),
+    /** Commands to install dependencies. */
+    installCommands: z.array(z.string()).optional().default([]),
+    /** Build/execution commands. */
+    commands: z.array(z.string()).min(1, 'At least one build command is required'),
+    /** Environment variables. */
+    env: z.record(z.string(), z.string()).optional(),
+    /** Docker build arguments passed via --build-arg at image build time. */
+    buildArgs: z.record(z.string(), z.string()).optional(),
+    /** Complete Dockerfile content for the build environment. */
+    dockerfile: z.string().min(1, 'Dockerfile content is required'),
+    /** Access visibility. */
+    visibility: VisibilitySchema.default('private'),
+});
+// AI Generate From URL Request
+/**
+ * Schema for POST /pipelines/generate/from-url/stream request body.
+ * Validates Git URL + AI provider configuration for repo-based pipeline generation.
+ */
+export const AIGenerateFromUrlBodySchema = z.object({
+    /** Git repository URL (HTTPS, SSH, or git@ format). */
+    gitUrl: z.string().min(1, 'A Git repository URL is required').max(500, 'URL must be 500 characters or fewer'),
+    /** AI provider identifier (e.g. "anthropic", "openai", "google"). */
+    provider: z.string().min(1, 'A provider is required'),
+    /** AI model identifier (e.g. "claude-sonnet-5", "gpt-4o"). */
+    model: z.string().min(1, 'A model is required'),
+    /** Optional custom API key to override the server config. */
+    apiKey: z.string().min(1).optional(),
+    /** Optional authentication token for accessing private repositories. */
+    repoToken: z.string().min(1).optional(),
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWktc2NoZW1hcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy92YWxpZGF0aW9uL2FpLXNjaGVtYXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQUUsQ0FBQyxFQUFFLE1BQU0sS0FBSyxDQUFDO0FBQ3hCLE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBRXZELE1BQU0saUJBQWlCLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsaUJBQWlCLElBQUksTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDO0FBRWhGLHdCQUF3QjtBQUV4Qjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDO0lBQzNDLHdEQUF3RDtJQUN4RCxNQUFNLEVBQUUsQ0FBQztTQUNOLE1BQU0sRUFBRTtTQUNSLEdBQUcsQ0FBQyxDQUFDLEVBQUUsMERBQTBELENBQUM7U0FDbEUsR0FBRyxDQUFDLGlCQUFpQixFQUFFLGtCQUFrQixpQkFBaUIsc0JBQXNCLENBQUM7SUFFcEYscUVBQXFFO0lBQ3JFLFFBQVEsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxnRUFBZ0UsQ0FBQztJQUU3Riw4REFBOEQ7SUFDOUQsS0FBSyxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLHlEQUF5RCxDQUFDO0lBRW5GLCtFQUErRTtJQUMvRSxNQUFNLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFFcEMseURBQXlEO0lBQ3pELGNBQWMsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFFNUQsMkVBQTJFO0lBQzNFLGlCQUFpQixFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsUUFBUSxFQUFFO0NBQ2xELENBQUMsQ0FBQztBQUVILGtDQUFrQztBQUVsQzs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDO0lBQ2xELDBEQUEwRDtJQUMxRCxJQUFJLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUseUJBQXlCLENBQUM7SUFFbEQsa0NBQWtDO0lBQ2xDLFdBQVcsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsUUFBUSxFQUFFO0lBRWxDLHVDQUF1QztJQUN2QyxPQUFPLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUscUJBQXFCLENBQUM7SUFFakQsNkJBQTZCO0lBQzdCLFVBQVUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsZUFBZSxFQUFFLFdBQVcsRUFBRSxvQkFBb0IsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FBQztJQUVqRyxrQ0FBa0M7SUFDbEMsV0FBVyxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUM7SUFFL0UsbUNBQW1DO0lBQ25DLFFBQVEsRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7SUFFcEQscUNBQXFDO0lBQ3JDLHNCQUFzQixFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxRQUFRLEVBQUU7SUFFeEQsd0NBQXdDO0lBQ3hDLGVBQWUsRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7SUFFM0QsZ0NBQWdDO0lBQ2hDLFFBQVEsRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsd0NBQXdDLENBQUM7SUFFOUUsNkJBQTZCO0lBQzdCLEdBQUcsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFFaEQseUVBQXlFO0lBQ3pFLFNBQVMsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFFdEQsNkRBQTZEO0lBQzdELFVBQVUsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxnQ0FBZ0MsQ0FBQztJQUUvRCx5QkFBeUI7SUFDekIsVUFBVSxFQUFFLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUM7Q0FDaEQsQ0FBQyxDQUFDO0FBRUgsK0JBQStCO0FBRS9COzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDbEQsdURBQXVEO0lBQ3ZELE1BQU0sRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxrQ0FBa0MsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUscUNBQXFDLENBQUM7SUFFN0cscUVBQXFFO0lBQ3JFLFFBQVEsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSx3QkFBd0IsQ0FBQztJQUVyRCw4REFBOEQ7SUFDOUQsS0FBSyxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLHFCQUFxQixDQUFDO0lBRS9DLDZEQUE2RDtJQUM3RCxNQUFNLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFFcEMsd0VBQXdFO0lBQ3hFLFNBQVMsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRTtDQUN4QyxDQUFDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuaW1wb3J0IHsgeiB9IGZyb20gJ3pvZCc7XG5pbXBvcnQgeyBWaXNpYmlsaXR5U2NoZW1hIH0gZnJvbSAnLi9jb21tb24tc2NoZW1hcy5qcyc7XG5cbmNvbnN0IE1BWF9QUk9NUFRfTEVOR1RIID0gcGFyc2VJbnQocHJvY2Vzcy5lbnYuTUFYX1BST01QVF9MRU5HVEggfHwgJzUwMDAnLCAxMCk7XG5cbi8vIEFJIEdlbmVyYXRpb24gUmVxdWVzdFxuXG4vKipcbiAqIFNjaGVtYSBmb3IgQUkgZ2VuZXJhdGlvbiByZXF1ZXN0IGJvZHkuXG4gKiBVc2VkIGJ5IGJvdGggUE9TVCAvcGlwZWxpbmVzL2dlbmVyYXRlIGFuZCBQT1NUIC9wbHVnaW5zL2dlbmVyYXRlLlxuICovXG5leHBvcnQgY29uc3QgQUlHZW5lcmF0ZUJvZHlTY2hlbWEgPSB6Lm9iamVjdCh7XG4gIC8qKiBOYXR1cmFsIGxhbmd1YWdlIGRlc2NyaXB0aW9uIG9mIHdoYXQgdG8gZ2VuZXJhdGUuICovXG4gIHByb21wdDogelxuICAgIC5zdHJpbmcoKVxuICAgIC5taW4oMSwgJ0EgcHJvbXB0IHdpdGggYSBuYXR1cmFsIGxhbmd1YWdlIGRlc2NyaXB0aW9uIGlzIHJlcXVpcmVkJylcbiAgICAubWF4KE1BWF9QUk9NUFRfTEVOR1RILCBgUHJvbXB0IG11c3QgYmUgJHtNQVhfUFJPTVBUX0xFTkdUSH0gY2hhcmFjdGVycyBvciBmZXdlcmApLFxuXG4gIC8qKiBBSSBwcm92aWRlciBpZGVudGlmaWVyIChlLmcuIFwiYW50aHJvcGljXCIsIFwib3BlbmFpXCIsIFwiZ29vZ2xlXCIpLiAqL1xuICBwcm92aWRlcjogei5zdHJpbmcoKS5taW4oMSwgJ0EgcHJvdmlkZXIgaXMgcmVxdWlyZWQgKGUuZy4sIFwiYW50aHJvcGljXCIsIFwib3BlbmFpXCIsIFwiZ29vZ2xlXCIpJyksXG5cbiAgLyoqIEFJIG1vZGVsIGlkZW50aWZpZXIgKGUuZy4gXCJjbGF1ZGUtc29ubmV0LTVcIiwgXCJncHQtNG9cIikuICovXG4gIG1vZGVsOiB6LnN0cmluZygpLm1pbigxLCAnQSBtb2RlbCBpcyByZXF1aXJlZCAoZS5nLiwgXCJjbGF1ZGUtc29ubmV0LTVcIiwgXCJncHQtNG9cIiknKSxcblxuICAvKiogT3B0aW9uYWwgY3VzdG9tIEFQSSBrZXkgdG8gb3ZlcnJpZGUgdGhlIHNlcnZlci9vcmcga2V5IGZvciB0aGlzIHJlcXVlc3QuICovXG4gIGFwaUtleTogei5zdHJpbmcoKS5taW4oMSkub3B0aW9uYWwoKSxcblxuICAvKiogUHJldmlvdXMgcGlwZWxpbmUgY29uZmlnIGZvciBpdGVyYXRpdmUgcmVmaW5lbWVudC4gKi9cbiAgcHJldmlvdXNDb25maWc6IHoucmVjb3JkKHouc3RyaW5nKCksIHoudW5rbm93bigpKS5vcHRpb25hbCgpLFxuXG4gIC8qKiBGYWxsYmFjayBBSSBwcm92aWRlcnMgaWYgcHJpbWFyeSBmYWlscyAoZS5nLiwgW1wib3BlbmFpXCIsIFwiZ29vZ2xlXCJdKS4gKi9cbiAgZmFsbGJhY2tQcm92aWRlcnM6IHouYXJyYXkoei5zdHJpbmcoKSkub3B0aW9uYWwoKSxcbn0pO1xuXG4vLyBQbHVnaW4gRGVwbG95LUdlbmVyYXRlZCBSZXF1ZXN0XG5cbi8qKlxuICogU2NoZW1hIGZvciBQT1NUIC9wbHVnaW5zL2RlcGxveS1nZW5lcmF0ZWQgcmVxdWVzdCBib2R5LlxuICogVmFsaWRhdGVzIHRoZSBBSS1nZW5lcmF0ZWQgcGx1Z2luIGNvbmZpZ3VyYXRpb24gYmVmb3JlIERvY2tlciBidWlsZC5cbiAqL1xuZXhwb3J0IGNvbnN0IFBsdWdpbkRlcGxveUdlbmVyYXRlZFNjaGVtYSA9IHoub2JqZWN0KHtcbiAgLyoqIFBsdWdpbiBuYW1lIChsb3dlcmNhc2UsIGFscGhhbnVtZXJpYyB3aXRoIGh5cGhlbnMpLiAqL1xuICBuYW1lOiB6LnN0cmluZygpLm1pbigxLCAnUGx1Z2luIG5hbWUgaXMgcmVxdWlyZWQnKSxcblxuICAvKiogSHVtYW4tcmVhZGFibGUgZGVzY3JpcHRpb24uICovXG4gIGRlc2NyaXB0aW9uOiB6LnN0cmluZygpLm9wdGlvbmFsKCksXG5cbiAgLyoqIFNlbWFudGljIHZlcnNpb24gKGUuZy4gXCIxLjAuMFwiKS4gKi9cbiAgdmVyc2lvbjogei5zdHJpbmcoKS5taW4oMSwgJ1ZlcnNpb24gaXMgcmVxdWlyZWQnKSxcblxuICAvKiogUGx1Z2luIGV4ZWN1dGlvbiB0eXBlLiAqL1xuICBwbHVnaW5UeXBlOiB6LmVudW0oWydDb2RlQnVpbGRTdGVwJywgJ1NoZWxsU3RlcCcsICdNYW51YWxBcHByb3ZhbFN0ZXAnXSkuZGVmYXVsdCgnQ29kZUJ1aWxkU3RlcCcpLFxuXG4gIC8qKiBBV1MgQ29kZUJ1aWxkIGNvbXB1dGUgc2l6ZS4gKi9cbiAgY29tcHV0ZVR5cGU6IHouZW51bShbJ1NNQUxMJywgJ01FRElVTScsICdMQVJHRScsICdYMl9MQVJHRSddKS5kZWZhdWx0KCdNRURJVU0nKSxcblxuICAvKiogS2V5d29yZHMgZm9yIGNhdGVnb3JpemF0aW9uLiAqL1xuICBrZXl3b3Jkczogei5hcnJheSh6LnN0cmluZygpKS5vcHRpb25hbCgpLmRlZmF1bHQoW10pLFxuXG4gIC8qKiBQcmltYXJ5IG91dHB1dCBkaXJlY3RvcnkgcGF0aC4gKi9cbiAgcHJpbWFyeU91dHB1dERpcmVjdG9yeTogei5zdHJpbmcoKS5udWxsYWJsZSgpLm9wdGlvbmFsKCksXG5cbiAgLyoqIENvbW1hbmRzIHRvIGluc3RhbGwgZGVwZW5kZW5jaWVzLiAqL1xuICBpbnN0YWxsQ29tbWFuZHM6IHouYXJyYXkoei5zdHJpbmcoKSkub3B0aW9uYWwoKS5kZWZhdWx0KFtdKSxcblxuICAvKiogQnVpbGQvZXhlY3V0aW9uIGNvbW1hbmRzLiAqL1xuICBjb21tYW5kczogei5hcnJheSh6LnN0cmluZygpKS5taW4oMSwgJ0F0IGxlYXN0IG9uZSBidWlsZCBjb21tYW5kIGlzIHJlcXVpcmVkJyksXG5cbiAgLyoqIEVudmlyb25tZW50IHZhcmlhYmxlcy4gKi9cbiAgZW52OiB6LnJlY29yZCh6LnN0cmluZygpLCB6LnN0cmluZygpKS5vcHRpb25hbCgpLFxuXG4gIC8qKiBEb2NrZXIgYnVpbGQgYXJndW1lbnRzIHBhc3NlZCB2aWEgLS1idWlsZC1hcmcgYXQgaW1hZ2UgYnVpbGQgdGltZS4gKi9cbiAgYnVpbGRBcmdzOiB6LnJlY29yZCh6LnN0cmluZygpLCB6LnN0cmluZygpKS5vcHRpb25hbCgpLFxuXG4gIC8qKiBDb21wbGV0ZSBEb2NrZXJmaWxlIGNvbnRlbnQgZm9yIHRoZSBidWlsZCBlbnZpcm9ubWVudC4gKi9cbiAgZG9ja2VyZmlsZTogei5zdHJpbmcoKS5taW4oMSwgJ0RvY2tlcmZpbGUgY29udGVudCBpcyByZXF1aXJlZCcpLFxuXG4gIC8qKiBBY2Nlc3MgdmlzaWJpbGl0eS4gKi9cbiAgdmlzaWJpbGl0eTogVmlzaWJpbGl0eVNjaGVtYS5kZWZhdWx0KCdwcml2YXRlJyksXG59KTtcblxuLy8gQUkgR2VuZXJhdGUgRnJvbSBVUkwgUmVxdWVzdFxuXG4vKipcbiAqIFNjaGVtYSBmb3IgUE9TVCAvcGlwZWxpbmVzL2dlbmVyYXRlL2Zyb20tdXJsL3N0cmVhbSByZXF1ZXN0IGJvZHkuXG4gKiBWYWxpZGF0ZXMgR2l0IFVSTCArIEFJIHByb3ZpZGVyIGNvbmZpZ3VyYXRpb24gZm9yIHJlcG8tYmFzZWQgcGlwZWxpbmUgZ2VuZXJhdGlvbi5cbiAqL1xuZXhwb3J0IGNvbnN0IEFJR2VuZXJhdGVGcm9tVXJsQm9keVNjaGVtYSA9IHoub2JqZWN0KHtcbiAgLyoqIEdpdCByZXBvc2l0b3J5IFVSTCAoSFRUUFMsIFNTSCwgb3IgZ2l0QCBmb3JtYXQpLiAqL1xuICBnaXRVcmw6IHouc3RyaW5nKCkubWluKDEsICdBIEdpdCByZXBvc2l0b3J5IFVSTCBpcyByZXF1aXJlZCcpLm1heCg1MDAsICdVUkwgbXVzdCBiZSA1MDAgY2hhcmFjdGVycyBvciBmZXdlcicpLFxuXG4gIC8qKiBBSSBwcm92aWRlciBpZGVudGlmaWVyIChlLmcuIFwiYW50aHJvcGljXCIsIFwib3BlbmFpXCIsIFwiZ29vZ2xlXCIpLiAqL1xuICBwcm92aWRlcjogei5zdHJpbmcoKS5taW4oMSwgJ0EgcHJvdmlkZXIgaXMgcmVxdWlyZWQnKSxcblxuICAvKiogQUkgbW9kZWwgaWRlbnRpZmllciAoZS5nLiBcImNsYXVkZS1zb25uZXQtNVwiLCBcImdwdC00b1wiKS4gKi9cbiAgbW9kZWw6IHouc3RyaW5nKCkubWluKDEsICdBIG1vZGVsIGlzIHJlcXVpcmVkJyksXG5cbiAgLyoqIE9wdGlvbmFsIGN1c3RvbSBBUEkga2V5IHRvIG92ZXJyaWRlIHRoZSBzZXJ2ZXIgY29uZmlnLiAqL1xuICBhcGlLZXk6IHouc3RyaW5nKCkubWluKDEpLm9wdGlvbmFsKCksXG5cbiAgLyoqIE9wdGlvbmFsIGF1dGhlbnRpY2F0aW9uIHRva2VuIGZvciBhY2Nlc3NpbmcgcHJpdmF0ZSByZXBvc2l0b3JpZXMuICovXG4gIHJlcG9Ub2tlbjogei5zdHJpbmcoKS5taW4oMSkub3B0aW9uYWwoKSxcbn0pO1xuIl19

package/lib/validation/common-schemas.d.ts

@@ -0,0 +1,133 @@
+import '../openapi/extend-zod.js';
+import { z } from 'zod';
+/** The shared three-rung sharing ladder — see the `Visibility` type. */
+export declare const VisibilitySchema: z.ZodEnum<{
+    org: "org";
+    private: "private";
+    public: "public";
+}>;
+/**
+ * Developer-portal catalog-metadata schemas — shared by pipeline and plugin
+ * create/update bodies (and the filter schema below). Mirror the shared types
+ * in `types/catalog-metadata.ts`.
+ */
+export declare const LifecycleSchema: z.ZodEnum<{
+    deprecated: "deprecated";
+    experimental: "experimental";
+    production: "production";
+}>;
+export declare const CriticalitySchema: z.ZodEnum<{
+    critical: "critical";
+    high: "high";
+    low: "low";
+    medium: "medium";
+}>;
+export declare const OwnerTypeSchema: z.ZodEnum<{
+    team: "team";
+    user: "user";
+}>;
+export declare const EntityLinkSchema: z.ZodObject<{
+    title: z.ZodString;
+    url: z.ZodString;
+    icon: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** Typed classification labels: `{ team: 'payments', tier: 'gold' }`. */
+export declare const EntityLabelsSchema: z.ZodRecord<z.ZodString, z.ZodString>;
+/**
+ * Catalog-metadata fields common to catalog entities. Spread into create/update
+ * body schemas so pipelines and plugins accept identical ownership/lifecycle/
+ * classification input. All optional — owner defaults to the creator server-side.
+ */
+export declare const CatalogMetadataShape: {
+    readonly ownerId: z.ZodOptional<z.ZodString>;
+    readonly ownerType: z.ZodOptional<z.ZodEnum<{
+        team: "team";
+        user: "user";
+    }>>;
+    readonly lifecycle: z.ZodOptional<z.ZodEnum<{
+        deprecated: "deprecated";
+        experimental: "experimental";
+        production: "production";
+    }>>;
+    readonly criticality: z.ZodOptional<z.ZodEnum<{
+        critical: "critical";
+        high: "high";
+        low: "low";
+        medium: "medium";
+    }>>;
+    readonly labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    readonly links: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        title: z.ZodString;
+        url: z.ZodString;
+        icon: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+};
+/**
+ * Sort order schema
+ */
+export declare const SortOrderSchema: z.ZodEnum<{
+    asc: "asc";
+    desc: "desc";
+}>;
+/**
+ * Pagination parameters schema.
+ *
+ * `MAX_PAGE_LIMIT` / `DEFAULT_PAGE_LIMIT` are the SINGLE source for these values
+ * across the monorepo — pipeline-core's `CoreConstants` and pipeline-data's
+ * `CrudService` import them from here instead of re-reading the env (which drifted).
+ */
+export declare const MAX_PAGE_LIMIT: number;
+export declare const DEFAULT_PAGE_LIMIT: number;
+/** Ceiling on offset-based paging — beyond this, deep paging must use the cursor API
+ *  (an unbounded offset is a scan-and-discard DoS amplifier on hot list routes). */
+export declare const MAX_PAGE_OFFSET: number;
+export declare const PaginationSchema: z.ZodObject<{
+    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    offset: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    sortBy: z.ZodOptional<z.ZodString>;
+    sortOrder: z.ZodOptional<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+}, z.core.$strip>;
+/**
+ * Boolean query parameter schema
+ * Handles string "true"/"false" and boolean values
+ */
+export declare const BooleanQuerySchema: z.ZodUnion<readonly [z.ZodBoolean, z.ZodPipe<z.ZodEnum<{
+    false: "false";
+    true: "true";
+}>, z.ZodTransform<boolean, "false" | "true">>, z.ZodPipe<z.ZodString, z.ZodTransform<boolean, string>>]>;
+/**
+ * UUID schema with validation
+ */
+export declare const UUIDSchema: z.ZodString;
+/**
+ * Optional UUID schema (for partial UUIDs or prefixes)
+ */
+export declare const UUIDPrefixSchema: z.ZodString;
+/**
+ * Base filter schema for entities with common fields
+ */
+export declare const BaseFilterSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodString]>>;
+    visibility: z.ZodOptional<z.ZodEnum<{
+        org: "org";
+        private: "private";
+        public: "public";
+    }>>;
+    isActive: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodPipe<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>, z.ZodTransform<boolean, "false" | "true">>, z.ZodPipe<z.ZodString, z.ZodTransform<boolean, string>>]>>;
+    isDefault: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodPipe<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>, z.ZodTransform<boolean, "false" | "true">>, z.ZodPipe<z.ZodString, z.ZodTransform<boolean, string>>]>>;
+    ownerId: z.ZodOptional<z.ZodString>;
+    lifecycle: z.ZodOptional<z.ZodEnum<{
+        deprecated: "deprecated";
+        experimental: "experimental";
+        production: "production";
+    }>>;
+}, z.core.$strip>;

package/lib/validation/common-schemas.js

@@ -0,0 +1,94 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+// Must run before any z.* schema creation — Zod 4 requires eager extension
+import '../openapi/extend-zod.js';
+import { z } from 'zod';
+import { VISIBILITIES } from '../types/visibility.js';
+import { envInt } from '../utils/env.js';
+/** The shared three-rung sharing ladder — see the `Visibility` type. */
+export const VisibilitySchema = z.enum(VISIBILITIES);
+/**
+ * Developer-portal catalog-metadata schemas — shared by pipeline and plugin
+ * create/update bodies (and the filter schema below). Mirror the shared types
+ * in `types/catalog-metadata.ts`.
+ */
+export const LifecycleSchema = z.enum(['experimental', 'production', 'deprecated']);
+export const CriticalitySchema = z.enum(['low', 'medium', 'high', 'critical']);
+export const OwnerTypeSchema = z.enum(['user', 'team']);
+export const EntityLinkSchema = z.object({
+    title: z.string().min(1).max(120),
+    url: z.string().url().max(2048),
+    icon: z.string().max(40).optional(),
+});
+/** Typed classification labels: `{ team: 'payments', tier: 'gold' }`. */
+export const EntityLabelsSchema = z.record(z.string().min(1).max(63), z.string().max(255));
+/**
+ * Catalog-metadata fields common to catalog entities. Spread into create/update
+ * body schemas so pipelines and plugins accept identical ownership/lifecycle/
+ * classification input. All optional — owner defaults to the creator server-side.
+ */
+export const CatalogMetadataShape = {
+    ownerId: z.string().min(1).max(255).optional(),
+    ownerType: OwnerTypeSchema.optional(),
+    lifecycle: LifecycleSchema.optional(),
+    criticality: CriticalitySchema.optional(),
+    labels: EntityLabelsSchema.optional(),
+    links: z.array(EntityLinkSchema).max(50).optional(),
+};
+/**
+ * Sort order schema
+ */
+export const SortOrderSchema = z.enum(['asc', 'desc']);
+/**
+ * Pagination parameters schema.
+ *
+ * `MAX_PAGE_LIMIT` / `DEFAULT_PAGE_LIMIT` are the SINGLE source for these values
+ * across the monorepo — pipeline-core's `CoreConstants` and pipeline-data's
+ * `CrudService` import them from here instead of re-reading the env (which drifted).
+ */
+export const MAX_PAGE_LIMIT = envInt('MAX_PAGE_LIMIT', 1000, { min: 1 });
+export const DEFAULT_PAGE_LIMIT = envInt('DEFAULT_PAGE_LIMIT', 100, { min: 1 });
+/** Ceiling on offset-based paging — beyond this, deep paging must use the cursor API
+ *  (an unbounded offset is a scan-and-discard DoS amplifier on hot list routes). */
+export const MAX_PAGE_OFFSET = envInt('MAX_PAGE_OFFSET', 100000, { min: 0 });
+export const PaginationSchema = z.object({
+    limit: z.coerce.number().int().min(1).max(MAX_PAGE_LIMIT).optional(),
+    offset: z.coerce.number().int().min(0).optional(),
+    sortBy: z.string().optional(),
+    sortOrder: SortOrderSchema.optional(),
+});
+/**
+ * Boolean query parameter schema
+ * Handles string "true"/"false" and boolean values
+ */
+export const BooleanQuerySchema = z.union([
+    z.boolean(),
+    z.enum(['true', 'false']).transform(val => val === 'true'),
+    z.string().transform(val => val === 'true'),
+]);
+/**
+ * UUID schema with validation
+ */
+export const UUIDSchema = z.string().uuid({
+    message: 'Invalid UUID format',
+});
+/**
+ * Optional UUID schema (for partial UUIDs or prefixes)
+ */
+export const UUIDPrefixSchema = z.string().regex(/^[0-9a-f-]+$/i, {
+    message: 'Invalid UUID prefix format',
+});
+/**
+ * Base filter schema for entities with common fields
+ */
+export const BaseFilterSchema = z.object({
+    id: z.union([UUIDSchema, z.array(UUIDSchema), UUIDPrefixSchema]).optional(),
+    visibility: VisibilitySchema.optional(),
+    isActive: BooleanQuerySchema.optional(),
+    isDefault: BooleanQuerySchema.optional(),
+    // Developer-portal catalog filters (applied only by entities that carry
+    // owner/lifecycle columns — pipelines and plugins).
+    ownerId: z.string().min(1).optional(),
+    lifecycle: LifecycleSchema.optional(),
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tbW9uLXNjaGVtYXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdmFsaWRhdGlvbi9jb21tb24tc2NoZW1hcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDLDJFQUEyRTtBQUMzRSxPQUFPLDBCQUEwQixDQUFDO0FBQ2xDLE9BQU8sRUFBRSxDQUFDLEVBQUUsTUFBTSxLQUFLLENBQUM7QUFDeEIsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQ3RELE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQUV6Qyx3RUFBd0U7QUFDeEUsTUFBTSxDQUFDLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQztBQUVyRDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxjQUFjLEVBQUUsWUFBWSxFQUFFLFlBQVksQ0FBQyxDQUFDLENBQUM7QUFDcEYsTUFBTSxDQUFDLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7QUFDL0UsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztBQUV4RCxNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDO0lBQ3ZDLEtBQUssRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUM7SUFDakMsR0FBRyxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDO0lBQy9CLElBQUksRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsRUFBRTtDQUNwQyxDQUFDLENBQUM7QUFFSCx5RUFBeUU7QUFDekUsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQUcsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7QUFFM0Y7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFHO0lBQ2xDLE9BQU8sRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFDOUMsU0FBUyxFQUFFLGVBQWUsQ0FBQyxRQUFRLEVBQUU7SUFDckMsU0FBUyxFQUFFLGVBQWUsQ0FBQyxRQUFRLEVBQUU7SUFDckMsV0FBVyxFQUFFLGlCQUFpQixDQUFDLFFBQVEsRUFBRTtJQUN6QyxNQUFNLEVBQUUsa0JBQWtCLENBQUMsUUFBUSxFQUFFO0lBQ3JDLEtBQUssRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsRUFBRTtDQUMzQyxDQUFDO0FBRVg7O0dBRUc7QUFDSCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO0FBRXZEOzs7Ozs7R0FNRztBQUNILE1BQU0sQ0FBQyxNQUFNLGNBQWMsR0FBRyxNQUFNLENBQUMsZ0JBQWdCLEVBQUUsSUFBSSxFQUFFLEVBQUUsR0FBRyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUM7QUFDekUsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQUcsTUFBTSxDQUFDLG9CQUFvQixFQUFFLEdBQUcsRUFBRSxFQUFFLEdBQUcsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQ2hGO29GQUNvRjtBQUNwRixNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsTUFBTSxDQUFDLGlCQUFpQixFQUFFLE1BQU0sRUFBRSxFQUFFLEdBQUcsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBRTdFLE1BQU0sQ0FBQyxNQUFNLGdCQUFnQixHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDdkMsS0FBSyxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFDcEUsTUFBTSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRTtJQUNqRCxNQUFNLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUM3QixTQUFTLEVBQUUsZUFBZSxDQUFDLFFBQVEsRUFBRTtDQUN0QyxDQUFDLENBQUM7QUFFSDs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLENBQUMsS0FBSyxDQUFDO0lBQ3hDLENBQUMsQ0FBQyxPQUFPLEVBQUU7SUFDWCxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsR0FBRyxLQUFLLE1BQU0sQ0FBQztJQUMxRCxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsR0FBRyxLQUFLLE1BQU0sQ0FBQztDQUM1QyxDQUFDLENBQUM7QUFFSDs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLFVBQVUsR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBSSxDQUFDO0lBQ3hDLE9BQU8sRUFBRSxxQkFBcUI7Q0FDL0IsQ0FBQyxDQUFDO0FBRUg7O0dBRUc7QUFDSCxNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBSyxDQUFDLGVBQWUsRUFBRTtJQUNoRSxPQUFPLEVBQUUsNEJBQTRCO0NBQ3RDLENBQUMsQ0FBQztBQUVIOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxDQUFDLE1BQU0sQ0FBQztJQUN2QyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxFQUFFLGdCQUFnQixDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFDM0UsVUFBVSxFQUFFLGdCQUFnQixDQUFDLFFBQVEsRUFBRTtJQUN2QyxRQUFRLEVBQUUsa0JBQWtCLENBQUMsUUFBUSxFQUFFO0lBQ3ZDLFNBQVMsRUFBRSxrQkFBa0IsQ0FBQyxRQUFRLEVBQUU7SUFDeEMsd0VBQXdFO0lBQ3hFLG9EQUFvRDtJQUNwRCxPQUFPLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFDckMsU0FBUyxFQUFFLGVBQWUsQ0FBQyxRQUFRLEVBQUU7Q0FDdEMsQ0FBQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8vIE11c3QgcnVuIGJlZm9yZSBhbnkgei4qIHNjaGVtYSBjcmVhdGlvbiDigJQgWm9kIDQgcmVxdWlyZXMgZWFnZXIgZXh0ZW5zaW9uXG5pbXBvcnQgJy4uL29wZW5hcGkvZXh0ZW5kLXpvZC5qcyc7XG5pbXBvcnQgeyB6IH0gZnJvbSAnem9kJztcbmltcG9ydCB7IFZJU0lCSUxJVElFUyB9IGZyb20gJy4uL3R5cGVzL3Zpc2liaWxpdHkuanMnO1xuaW1wb3J0IHsgZW52SW50IH0gZnJvbSAnLi4vdXRpbHMvZW52LmpzJztcblxuLyoqIFRoZSBzaGFyZWQgdGhyZWUtcnVuZyBzaGFyaW5nIGxhZGRlciDigJQgc2VlIHRoZSBgVmlzaWJpbGl0eWAgdHlwZS4gKi9cbmV4cG9ydCBjb25zdCBWaXNpYmlsaXR5U2NoZW1hID0gei5lbnVtKFZJU0lCSUxJVElFUyk7XG5cbi8qKlxuICogRGV2ZWxvcGVyLXBvcnRhbCBjYXRhbG9nLW1ldGFkYXRhIHNjaGVtYXMg4oCUIHNoYXJlZCBieSBwaXBlbGluZSBhbmQgcGx1Z2luXG4gKiBjcmVhdGUvdXBkYXRlIGJvZGllcyAoYW5kIHRoZSBmaWx0ZXIgc2NoZW1hIGJlbG93KS4gTWlycm9yIHRoZSBzaGFyZWQgdHlwZXNcbiAqIGluIGB0eXBlcy9jYXRhbG9nLW1ldGFkYXRhLnRzYC5cbiAqL1xuZXhwb3J0IGNvbnN0IExpZmVjeWNsZVNjaGVtYSA9IHouZW51bShbJ2V4cGVyaW1lbnRhbCcsICdwcm9kdWN0aW9uJywgJ2RlcHJlY2F0ZWQnXSk7XG5leHBvcnQgY29uc3QgQ3JpdGljYWxpdHlTY2hlbWEgPSB6LmVudW0oWydsb3cnLCAnbWVkaXVtJywgJ2hpZ2gnLCAnY3JpdGljYWwnXSk7XG5leHBvcnQgY29uc3QgT3duZXJUeXBlU2NoZW1hID0gei5lbnVtKFsndXNlcicsICd0ZWFtJ10pO1xuXG5leHBvcnQgY29uc3QgRW50aXR5TGlua1NjaGVtYSA9IHoub2JqZWN0KHtcbiAgdGl0bGU6IHouc3RyaW5nKCkubWluKDEpLm1heCgxMjApLFxuICB1cmw6IHouc3RyaW5nKCkudXJsKCkubWF4KDIwNDgpLFxuICBpY29uOiB6LnN0cmluZygpLm1heCg0MCkub3B0aW9uYWwoKSxcbn0pO1xuXG4vKiogVHlwZWQgY2xhc3NpZmljYXRpb24gbGFiZWxzOiBgeyB0ZWFtOiAncGF5bWVudHMnLCB0aWVyOiAnZ29sZCcgfWAuICovXG5leHBvcnQgY29uc3QgRW50aXR5TGFiZWxzU2NoZW1hID0gei5yZWNvcmQoei5zdHJpbmcoKS5taW4oMSkubWF4KDYzKSwgei5zdHJpbmcoKS5tYXgoMjU1KSk7XG5cbi8qKlxuICogQ2F0YWxvZy1tZXRhZGF0YSBmaWVsZHMgY29tbW9uIHRvIGNhdGFsb2cgZW50aXRpZXMuIFNwcmVhZCBpbnRvIGNyZWF0ZS91cGRhdGVcbiAqIGJvZHkgc2NoZW1hcyBzbyBwaXBlbGluZXMgYW5kIHBsdWdpbnMgYWNjZXB0IGlkZW50aWNhbCBvd25lcnNoaXAvbGlmZWN5Y2xlL1xuICogY2xhc3NpZmljYXRpb24gaW5wdXQuIEFsbCBvcHRpb25hbCDigJQgb3duZXIgZGVmYXVsdHMgdG8gdGhlIGNyZWF0b3Igc2VydmVyLXNpZGUuXG4gKi9cbmV4cG9ydCBjb25zdCBDYXRhbG9nTWV0YWRhdGFTaGFwZSA9IHtcbiAgb3duZXJJZDogei5zdHJpbmcoKS5taW4oMSkubWF4KDI1NSkub3B0aW9uYWwoKSxcbiAgb3duZXJUeXBlOiBPd25lclR5cGVTY2hlbWEub3B0aW9uYWwoKSxcbiAgbGlmZWN5Y2xlOiBMaWZlY3ljbGVTY2hlbWEub3B0aW9uYWwoKSxcbiAgY3JpdGljYWxpdHk6IENyaXRpY2FsaXR5U2NoZW1hLm9wdGlvbmFsKCksXG4gIGxhYmVsczogRW50aXR5TGFiZWxzU2NoZW1hLm9wdGlvbmFsKCksXG4gIGxpbmtzOiB6LmFycmF5KEVudGl0eUxpbmtTY2hlbWEpLm1heCg1MCkub3B0aW9uYWwoKSxcbn0gYXMgY29uc3Q7XG5cbi8qKlxuICogU29ydCBvcmRlciBzY2hlbWFcbiAqL1xuZXhwb3J0IGNvbnN0IFNvcnRPcmRlclNjaGVtYSA9IHouZW51bShbJ2FzYycsICdkZXNjJ10pO1xuXG4vKipcbiAqIFBhZ2luYXRpb24gcGFyYW1ldGVycyBzY2hlbWEuXG4gKlxuICogYE1BWF9QQUdFX0xJTUlUYCAvIGBERUZBVUxUX1BBR0VfTElNSVRgIGFyZSB0aGUgU0lOR0xFIHNvdXJjZSBmb3IgdGhlc2UgdmFsdWVzXG4gKiBhY3Jvc3MgdGhlIG1vbm9yZXBvIOKAlCBwaXBlbGluZS1jb3JlJ3MgYENvcmVDb25zdGFudHNgIGFuZCBwaXBlbGluZS1kYXRhJ3NcbiAqIGBDcnVkU2VydmljZWAgaW1wb3J0IHRoZW0gZnJvbSBoZXJlIGluc3RlYWQgb2YgcmUtcmVhZGluZyB0aGUgZW52ICh3aGljaCBkcmlmdGVkKS5cbiAqL1xuZXhwb3J0IGNvbnN0IE1BWF9QQUdFX0xJTUlUID0gZW52SW50KCdNQVhfUEFHRV9MSU1JVCcsIDEwMDAsIHsgbWluOiAxIH0pO1xuZXhwb3J0IGNvbnN0IERFRkFVTFRfUEFHRV9MSU1JVCA9IGVudkludCgnREVGQVVMVF9QQUdFX0xJTUlUJywgMTAwLCB7IG1pbjogMSB9KTtcbi8qKiBDZWlsaW5nIG9uIG9mZnNldC1iYXNlZCBwYWdpbmcg4oCUIGJleW9uZCB0aGlzLCBkZWVwIHBhZ2luZyBtdXN0IHVzZSB0aGUgY3Vyc29yIEFQSVxuICogIChhbiB1bmJvdW5kZWQgb2Zmc2V0IGlzIGEgc2Nhbi1hbmQtZGlzY2FyZCBEb1MgYW1wbGlmaWVyIG9uIGhvdCBsaXN0IHJvdXRlcykuICovXG5leHBvcnQgY29uc3QgTUFYX1BBR0VfT0ZGU0VUID0gZW52SW50KCdNQVhfUEFHRV9PRkZTRVQnLCAxMDAwMDAsIHsgbWluOiAwIH0pO1xuXG5leHBvcnQgY29uc3QgUGFnaW5hdGlvblNjaGVtYSA9IHoub2JqZWN0KHtcbiAgbGltaXQ6IHouY29lcmNlLm51bWJlcigpLmludCgpLm1pbigxKS5tYXgoTUFYX1BBR0VfTElNSVQpLm9wdGlvbmFsKCksXG4gIG9mZnNldDogei5jb2VyY2UubnVtYmVyKCkuaW50KCkubWluKDApLm9wdGlvbmFsKCksXG4gIHNvcnRCeTogei5zdHJpbmcoKS5vcHRpb25hbCgpLFxuICBzb3J0T3JkZXI6IFNvcnRPcmRlclNjaGVtYS5vcHRpb25hbCgpLFxufSk7XG5cbi8qKlxuICogQm9vbGVhbiBxdWVyeSBwYXJhbWV0ZXIgc2NoZW1hXG4gKiBIYW5kbGVzIHN0cmluZyBcInRydWVcIi9cImZhbHNlXCIgYW5kIGJvb2xlYW4gdmFsdWVzXG4gKi9cbmV4cG9ydCBjb25zdCBCb29sZWFuUXVlcnlTY2hlbWEgPSB6LnVuaW9uKFtcbiAgei5ib29sZWFuKCksXG4gIHouZW51bShbJ3RydWUnLCAnZmFsc2UnXSkudHJhbnNmb3JtKHZhbCA9PiB2YWwgPT09ICd0cnVlJyksXG4gIHouc3RyaW5nKCkudHJhbnNmb3JtKHZhbCA9PiB2YWwgPT09ICd0cnVlJyksXG5dKTtcblxuLyoqXG4gKiBVVUlEIHNjaGVtYSB3aXRoIHZhbGlkYXRpb25cbiAqL1xuZXhwb3J0IGNvbnN0IFVVSURTY2hlbWEgPSB6LnN0cmluZygpLnV1aWQoe1xuICBtZXNzYWdlOiAnSW52YWxpZCBVVUlEIGZvcm1hdCcsXG59KTtcblxuLyoqXG4gKiBPcHRpb25hbCBVVUlEIHNjaGVtYSAoZm9yIHBhcnRpYWwgVVVJRHMgb3IgcHJlZml4ZXMpXG4gKi9cbmV4cG9ydCBjb25zdCBVVUlEUHJlZml4U2NoZW1hID0gei5zdHJpbmcoKS5yZWdleCgvXlswLTlhLWYtXSskL2ksIHtcbiAgbWVzc2FnZTogJ0ludmFsaWQgVVVJRCBwcmVmaXggZm9ybWF0Jyxcbn0pO1xuXG4vKipcbiAqIEJhc2UgZmlsdGVyIHNjaGVtYSBmb3IgZW50aXRpZXMgd2l0aCBjb21tb24gZmllbGRzXG4gKi9cbmV4cG9ydCBjb25zdCBCYXNlRmlsdGVyU2NoZW1hID0gei5vYmplY3Qoe1xuICBpZDogei51bmlvbihbVVVJRFNjaGVtYSwgei5hcnJheShVVUlEU2NoZW1hKSwgVVVJRFByZWZpeFNjaGVtYV0pLm9wdGlvbmFsKCksXG4gIHZpc2liaWxpdHk6IFZpc2liaWxpdHlTY2hlbWEub3B0aW9uYWwoKSxcbiAgaXNBY3RpdmU6IEJvb2xlYW5RdWVyeVNjaGVtYS5vcHRpb25hbCgpLFxuICBpc0RlZmF1bHQ6IEJvb2xlYW5RdWVyeVNjaGVtYS5vcHRpb25hbCgpLFxuICAvLyBEZXZlbG9wZXItcG9ydGFsIGNhdGFsb2cgZmlsdGVycyAoYXBwbGllZCBvbmx5IGJ5IGVudGl0aWVzIHRoYXQgY2FycnlcbiAgLy8gb3duZXIvbGlmZWN5Y2xlIGNvbHVtbnMg4oCUIHBpcGVsaW5lcyBhbmQgcGx1Z2lucykuXG4gIG93bmVySWQ6IHouc3RyaW5nKCkubWluKDEpLm9wdGlvbmFsKCksXG4gIGxpZmVjeWNsZTogTGlmZWN5Y2xlU2NoZW1hLm9wdGlvbmFsKCksXG59KTtcbiJdfQ==

package/lib/validation/index.d.ts

@@ -0,0 +1,7 @@
+export * from './common-schemas.js';
+export * from './pipeline-schemas.js';
+export * from './pipeline-template-schemas.js';
+export * from './plugin-schemas.js';
+export * from './message-schemas.js';
+export * from './ai-schemas.js';
+export * from './middleware.js';

package/lib/validation/index.js

@@ -0,0 +1,10 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+export * from './common-schemas.js';
+export * from './pipeline-schemas.js';
+export * from './pipeline-template-schemas.js';
+export * from './plugin-schemas.js';
+export * from './message-schemas.js';
+export * from './ai-schemas.js';
+export * from './middleware.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdmFsaWRhdGlvbi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGdDQUFnQyxDQUFDO0FBQy9DLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMsaUJBQWlCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuZXhwb3J0ICogZnJvbSAnLi9jb21tb24tc2NoZW1hcy5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3BpcGVsaW5lLXNjaGVtYXMuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9waXBlbGluZS10ZW1wbGF0ZS1zY2hlbWFzLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vcGx1Z2luLXNjaGVtYXMuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9tZXNzYWdlLXNjaGVtYXMuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9haS1zY2hlbWFzLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vbWlkZGxld2FyZS5qcyc7XG4iXX0=