@pipeline-builder/api-core 0.0.1

package/lib/middleware/index.d.ts

@@ -0,0 +1,3 @@
+export * from './auth.js';
+export * from './mongo-sanitize.js';
+export * from './step-up.js';

package/lib/middleware/index.js

@@ -0,0 +1,6 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+export * from './auth.js';
+export * from './mongo-sanitize.js';
+export * from './step-up.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvbWlkZGxld2FyZS9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxjQUFjLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuZXhwb3J0ICogZnJvbSAnLi9hdXRoLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vbW9uZ28tc2FuaXRpemUuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9zdGVwLXVwLmpzJztcbiJdfQ==

package/lib/middleware/mongo-sanitize.d.ts

@@ -0,0 +1,32 @@
+import type { NextFunction, Request, Response } from 'express';
+/** Maximum nesting depth accepted by {@link mongoSanitize}. */
+export declare const MAX_SANITIZE_DEPTH = 10;
+/**
+ * Thrown when a request payload nests deeper than {@link MAX_SANITIZE_DEPTH}.
+ * The middleware maps this to HTTP 400 instead of silently truncating the walk
+ * (which would let operator-shaped keys below the cap slip through unsanitized).
+ */
+export declare class PayloadTooDeepError extends Error {
+    readonly statusCode: 400;
+    constructor(message?: string);
+}
+/**
+ * MongoDB operator-injection middleware.
+ *
+ * Recursively strips object keys starting with `$` (Mongo operators like
+ * `$ne`, `$gt`, `$where`) and keys containing `.` (dot-walks) from
+ * `req.body`, `req.query`, and `req.params`. Without this, a JSON request
+ * like `{"email": {"$ne": null}}` against a Mongo-backed service can match
+ * any document — Zod catches the wrong *type* but won't reach into nested
+ * objects to strip operator-shaped keys.
+ *
+ * Apply BEFORE any Mongo query handler (typically right after
+ * `express.json()`). Postgres-backed services don't need it.
+ *
+ * `req.body` and `req.params` are plain writable objects, so they're sanitized
+ * in place. On Express 5 `req.query` is a GETTER that re-parses the URL and
+ * returns a fresh object on every access — mutating it is a no-op — so we
+ * sanitize a snapshot and pin it onto the request instance with
+ * `Object.defineProperty`, shadowing the getter for all downstream reads.
+ */
+export declare function mongoSanitize(): (req: Request, res: Response, next: NextFunction) => void;

package/lib/middleware/mongo-sanitize.js

@@ -0,0 +1,100 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { HttpStatus } from '../constants/http-status.js';
+import { ErrorCode } from '../types/error-codes.js';
+import { sendError } from '../utils/response.js';
+/** Maximum nesting depth accepted by {@link mongoSanitize}. */
+export const MAX_SANITIZE_DEPTH = 10;
+/**
+ * Thrown when a request payload nests deeper than {@link MAX_SANITIZE_DEPTH}.
+ * The middleware maps this to HTTP 400 instead of silently truncating the walk
+ * (which would let operator-shaped keys below the cap slip through unsanitized).
+ */
+export class PayloadTooDeepError extends Error {
+    statusCode = HttpStatus.BAD_REQUEST;
+    constructor(message = `Request payload nesting exceeds the maximum depth of ${MAX_SANITIZE_DEPTH}`) {
+        super(message);
+        this.name = 'PayloadTooDeepError';
+    }
+}
+/**
+ * MongoDB operator-injection middleware.
+ *
+ * Recursively strips object keys starting with `$` (Mongo operators like
+ * `$ne`, `$gt`, `$where`) and keys containing `.` (dot-walks) from
+ * `req.body`, `req.query`, and `req.params`. Without this, a JSON request
+ * like `{"email": {"$ne": null}}` against a Mongo-backed service can match
+ * any document — Zod catches the wrong *type* but won't reach into nested
+ * objects to strip operator-shaped keys.
+ *
+ * Apply BEFORE any Mongo query handler (typically right after
+ * `express.json()`). Postgres-backed services don't need it.
+ *
+ * `req.body` and `req.params` are plain writable objects, so they're sanitized
+ * in place. On Express 5 `req.query` is a GETTER that re-parses the URL and
+ * returns a fresh object on every access — mutating it is a no-op — so we
+ * sanitize a snapshot and pin it onto the request instance with
+ * `Object.defineProperty`, shadowing the getter for all downstream reads.
+ */
+export function mongoSanitize() {
+    return (req, res, next) => {
+        try {
+            if (req.body && typeof req.body === 'object')
+                sanitizeObject(req.body);
+            if (req.params && typeof req.params === 'object')
+                sanitizeObject(req.params);
+            if (req.query && typeof req.query === 'object') {
+                const q = req.query;
+                sanitizeObject(q);
+                // Pin the sanitized snapshot so the Express 5 getter can't re-parse a
+                // fresh (unsanitized) object on the next access.
+                try {
+                    Object.defineProperty(req, 'query', { value: q, writable: true, configurable: true, enumerable: true });
+                }
+                catch {
+                    // Express 4 (writable data prop) — the in-place sanitize above sufficed.
+                }
+            }
+        }
+        catch (err) {
+            // Reject over-deep payloads with a 400 rather than silently truncating
+            // the sanitize walk (which risked leaving deep operator keys in place).
+            if (err instanceof PayloadTooDeepError) {
+                return sendError(res, err.statusCode, err.message, ErrorCode.VALIDATION_ERROR);
+            }
+            throw err;
+        }
+        next();
+    };
+}
+// Prototype-pollution keys — these never belong in JSON request bodies, and a
+// downstream recursive merge/assign on the parsed object could otherwise walk
+// `constructor.prototype` to inject Mongo operators or pollute Object.prototype.
+const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+function sanitizeObject(obj, depth = 0) {
+    // Reject pathologically nested input rather than silently returning — a
+    // silent cap would leave any operator/dot/prototype keys deeper than the
+    // cap un-sanitized. The middleware maps this to a 400.
+    if (depth > MAX_SANITIZE_DEPTH) {
+        throw new PayloadTooDeepError();
+    }
+    for (const key of Object.keys(obj)) {
+        if (key.startsWith('$') || key.includes('.') || FORBIDDEN_KEYS.has(key)) {
+            delete obj[key];
+            continue;
+        }
+        const v = obj[key];
+        if (v && typeof v === 'object') {
+            if (Array.isArray(v)) {
+                for (const item of v) {
+                    if (item && typeof item === 'object')
+                        sanitizeObject(item, depth + 1);
+                }
+            }
+            else {
+                sanitizeObject(v, depth + 1);
+            }
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibW9uZ28tc2FuaXRpemUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvbWlkZGxld2FyZS9tb25nby1zYW5pdGl6ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBR3RDLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUN6RCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFDcEQsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBRWpELCtEQUErRDtBQUMvRCxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxFQUFFLENBQUM7QUFFckM7Ozs7R0FJRztBQUNILE1BQU0sT0FBTyxtQkFBb0IsU0FBUSxLQUFLO0lBQ25DLFVBQVUsR0FBRyxVQUFVLENBQUMsV0FBVyxDQUFDO0lBQzdDLFlBQVksT0FBTyxHQUFHLHdEQUF3RCxrQkFBa0IsRUFBRTtRQUNoRyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDZixJQUFJLENBQUMsSUFBSSxHQUFHLHFCQUFxQixDQUFDO0lBQ3BDLENBQUM7Q0FDRjtBQUVEOzs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FrQkc7QUFDSCxNQUFNLFVBQVUsYUFBYTtJQUMzQixPQUFPLENBQUMsR0FBWSxFQUFFLEdBQWEsRUFBRSxJQUFrQixFQUFFLEVBQUU7UUFDekQsSUFBSSxDQUFDO1lBQ0gsSUFBSSxHQUFHLENBQUMsSUFBSSxJQUFJLE9BQU8sR0FBRyxDQUFDLElBQUksS0FBSyxRQUFRO2dCQUFFLGNBQWMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDdkUsSUFBSSxHQUFHLENBQUMsTUFBTSxJQUFJLE9BQU8sR0FBRyxDQUFDLE1BQU0sS0FBSyxRQUFRO2dCQUFFLGNBQWMsQ0FBQyxHQUFHLENBQUMsTUFBaUMsQ0FBQyxDQUFDO1lBQ3hHLElBQUksR0FBRyxDQUFDLEtBQUssSUFBSSxPQUFPLEdBQUcsQ0FBQyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQy9DLE1BQU0sQ0FBQyxHQUFHLEdBQUcsQ0FBQyxLQUFnQyxDQUFDO2dCQUMvQyxjQUFjLENBQUMsQ0FBQyxDQUFDLENBQUM7Z0JBQ2xCLHNFQUFzRTtnQkFDdEUsaURBQWlEO2dCQUNqRCxJQUFJLENBQUM7b0JBQ0gsTUFBTSxDQUFDLGNBQWMsQ0FBQyxHQUFHLEVBQUUsT0FBTyxFQUFFLEVBQUUsS0FBSyxFQUFFLENBQUMsRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLFlBQVksRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7Z0JBQzFHLENBQUM7Z0JBQUMsTUFBTSxDQUFDO29CQUNQLHlFQUF5RTtnQkFDM0UsQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDO1FBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztZQUNiLHVFQUF1RTtZQUN2RSx3RUFBd0U7WUFDeEUsSUFBSSxHQUFHLFlBQVksbUJBQW1CLEVBQUUsQ0FBQztnQkFDdkMsT0FBTyxTQUFTLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxVQUFVLEVBQUUsR0FBRyxDQUFDLE9BQU8sRUFBRSxTQUFTLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUNqRixDQUFDO1lBQ0QsTUFBTSxHQUFHLENBQUM7UUFDWixDQUFDO1FBQ0QsSUFBSSxFQUFFLENBQUM7SUFDVCxDQUFDLENBQUM7QUFDSixDQUFDO0FBRUQsOEVBQThFO0FBQzlFLDhFQUE4RTtBQUM5RSxpRkFBaUY7QUFDakYsTUFBTSxjQUFjLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxXQUFXLEVBQUUsYUFBYSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7QUFFMUUsU0FBUyxjQUFjLENBQUMsR0FBNEIsRUFBRSxLQUFLLEdBQUcsQ0FBQztJQUM3RCx3RUFBd0U7SUFDeEUseUVBQXlFO0lBQ3pFLHVEQUF1RDtJQUN2RCxJQUFJLEtBQUssR0FBRyxrQkFBa0IsRUFBRSxDQUFDO1FBQy9CLE1BQU0sSUFBSSxtQkFBbUIsRUFBRSxDQUFDO0lBQ2xDLENBQUM7SUFDRCxLQUFLLE1BQU0sR0FBRyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNuQyxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxjQUFjLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDeEUsT0FBTyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDaEIsU0FBUztRQUNYLENBQUM7UUFDRCxNQUFNLENBQUMsR0FBRyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDbkIsSUFBSSxDQUFDLElBQUksT0FBTyxDQUFDLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDL0IsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQ3JCLEtBQUssTUFBTSxJQUFJLElBQUksQ0FBQyxFQUFFLENBQUM7b0JBQ3JCLElBQUksSUFBSSxJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVE7d0JBQUUsY0FBYyxDQUFDLElBQStCLEVBQUUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDO2dCQUNuRyxDQUFDO1lBQ0gsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLGNBQWMsQ0FBQyxDQUE0QixFQUFFLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQztZQUMxRCxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7QUFDSCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmltcG9ydCB0eXBlIHsgTmV4dEZ1bmN0aW9uLCBSZXF1ZXN0LCBSZXNwb25zZSB9IGZyb20gJ2V4cHJlc3MnO1xuaW1wb3J0IHsgSHR0cFN0YXR1cyB9IGZyb20gJy4uL2NvbnN0YW50cy9odHRwLXN0YXR1cy5qcyc7XG5pbXBvcnQgeyBFcnJvckNvZGUgfSBmcm9tICcuLi90eXBlcy9lcnJvci1jb2Rlcy5qcyc7XG5pbXBvcnQgeyBzZW5kRXJyb3IgfSBmcm9tICcuLi91dGlscy9yZXNwb25zZS5qcyc7XG5cbi8qKiBNYXhpbXVtIG5lc3RpbmcgZGVwdGggYWNjZXB0ZWQgYnkge0BsaW5rIG1vbmdvU2FuaXRpemV9LiAqL1xuZXhwb3J0IGNvbnN0IE1BWF9TQU5JVElaRV9ERVBUSCA9IDEwO1xuXG4vKipcbiAqIFRocm93biB3aGVuIGEgcmVxdWVzdCBwYXlsb2FkIG5lc3RzIGRlZXBlciB0aGFuIHtAbGluayBNQVhfU0FOSVRJWkVfREVQVEh9LlxuICogVGhlIG1pZGRsZXdhcmUgbWFwcyB0aGlzIHRvIEhUVFAgNDAwIGluc3RlYWQgb2Ygc2lsZW50bHkgdHJ1bmNhdGluZyB0aGUgd2Fsa1xuICogKHdoaWNoIHdvdWxkIGxldCBvcGVyYXRvci1zaGFwZWQga2V5cyBiZWxvdyB0aGUgY2FwIHNsaXAgdGhyb3VnaCB1bnNhbml0aXplZCkuXG4gKi9cbmV4cG9ydCBjbGFzcyBQYXlsb2FkVG9vRGVlcEVycm9yIGV4dGVuZHMgRXJyb3Ige1xuICByZWFkb25seSBzdGF0dXNDb2RlID0gSHR0cFN0YXR1cy5CQURfUkVRVUVTVDtcbiAgY29uc3RydWN0b3IobWVzc2FnZSA9IGBSZXF1ZXN0IHBheWxvYWQgbmVzdGluZyBleGNlZWRzIHRoZSBtYXhpbXVtIGRlcHRoIG9mICR7TUFYX1NBTklUSVpFX0RFUFRIfWApIHtcbiAgICBzdXBlcihtZXNzYWdlKTtcbiAgICB0aGlzLm5hbWUgPSAnUGF5bG9hZFRvb0RlZXBFcnJvcic7XG4gIH1cbn1cblxuLyoqXG4gKiBNb25nb0RCIG9wZXJhdG9yLWluamVjdGlvbiBtaWRkbGV3YXJlLlxuICpcbiAqIFJlY3Vyc2l2ZWx5IHN0cmlwcyBvYmplY3Qga2V5cyBzdGFydGluZyB3aXRoIGAkYCAoTW9uZ28gb3BlcmF0b3JzIGxpa2VcbiAqIGAkbmVgLCBgJGd0YCwgYCR3aGVyZWApIGFuZCBrZXlzIGNvbnRhaW5pbmcgYC5gIChkb3Qtd2Fsa3MpIGZyb21cbiAqIGByZXEuYm9keWAsIGByZXEucXVlcnlgLCBhbmQgYHJlcS5wYXJhbXNgLiBXaXRob3V0IHRoaXMsIGEgSlNPTiByZXF1ZXN0XG4gKiBsaWtlIGB7XCJlbWFpbFwiOiB7XCIkbmVcIjogbnVsbH19YCBhZ2FpbnN0IGEgTW9uZ28tYmFja2VkIHNlcnZpY2UgY2FuIG1hdGNoXG4gKiBhbnkgZG9jdW1lbnQg4oCUIFpvZCBjYXRjaGVzIHRoZSB3cm9uZyAqdHlwZSogYnV0IHdvbid0IHJlYWNoIGludG8gbmVzdGVkXG4gKiBvYmplY3RzIHRvIHN0cmlwIG9wZXJhdG9yLXNoYXBlZCBrZXlzLlxuICpcbiAqIEFwcGx5IEJFRk9SRSBhbnkgTW9uZ28gcXVlcnkgaGFuZGxlciAodHlwaWNhbGx5IHJpZ2h0IGFmdGVyXG4gKiBgZXhwcmVzcy5qc29uKClgKS4gUG9zdGdyZXMtYmFja2VkIHNlcnZpY2VzIGRvbid0IG5lZWQgaXQuXG4gKlxuICogYHJlcS5ib2R5YCBhbmQgYHJlcS5wYXJhbXNgIGFyZSBwbGFpbiB3cml0YWJsZSBvYmplY3RzLCBzbyB0aGV5J3JlIHNhbml0aXplZFxuICogaW4gcGxhY2UuIE9uIEV4cHJlc3MgNSBgcmVxLnF1ZXJ5YCBpcyBhIEdFVFRFUiB0aGF0IHJlLXBhcnNlcyB0aGUgVVJMIGFuZFxuICogcmV0dXJucyBhIGZyZXNoIG9iamVjdCBvbiBldmVyeSBhY2Nlc3Mg4oCUIG11dGF0aW5nIGl0IGlzIGEgbm8tb3Ag4oCUIHNvIHdlXG4gKiBzYW5pdGl6ZSBhIHNuYXBzaG90IGFuZCBwaW4gaXQgb250byB0aGUgcmVxdWVzdCBpbnN0YW5jZSB3aXRoXG4gKiBgT2JqZWN0LmRlZmluZVByb3BlcnR5YCwgc2hhZG93aW5nIHRoZSBnZXR0ZXIgZm9yIGFsbCBkb3duc3RyZWFtIHJlYWRzLlxuICovXG5leHBvcnQgZnVuY3Rpb24gbW9uZ29TYW5pdGl6ZSgpIHtcbiAgcmV0dXJuIChyZXE6IFJlcXVlc3QsIHJlczogUmVzcG9uc2UsIG5leHQ6IE5leHRGdW5jdGlvbikgPT4ge1xuICAgIHRyeSB7XG4gICAgICBpZiAocmVxLmJvZHkgJiYgdHlwZW9mIHJlcS5ib2R5ID09PSAnb2JqZWN0Jykgc2FuaXRpemVPYmplY3QocmVxLmJvZHkpO1xuICAgICAgaWYgKHJlcS5wYXJhbXMgJiYgdHlwZW9mIHJlcS5wYXJhbXMgPT09ICdvYmplY3QnKSBzYW5pdGl6ZU9iamVjdChyZXEucGFyYW1zIGFzIFJlY29yZDxzdHJpbmcsIHVua25vd24+KTtcbiAgICAgIGlmIChyZXEucXVlcnkgJiYgdHlwZW9mIHJlcS5xdWVyeSA9PT0gJ29iamVjdCcpIHtcbiAgICAgICAgY29uc3QgcSA9IHJlcS5xdWVyeSBhcyBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPjtcbiAgICAgICAgc2FuaXRpemVPYmplY3QocSk7XG4gICAgICAgIC8vIFBpbiB0aGUgc2FuaXRpemVkIHNuYXBzaG90IHNvIHRoZSBFeHByZXNzIDUgZ2V0dGVyIGNhbid0IHJlLXBhcnNlIGFcbiAgICAgICAgLy8gZnJlc2ggKHVuc2FuaXRpemVkKSBvYmplY3Qgb24gdGhlIG5leHQgYWNjZXNzLlxuICAgICAgICB0cnkge1xuICAgICAgICAgIE9iamVjdC5kZWZpbmVQcm9wZXJ0eShyZXEsICdxdWVyeScsIHsgdmFsdWU6IHEsIHdyaXRhYmxlOiB0cnVlLCBjb25maWd1cmFibGU6IHRydWUsIGVudW1lcmFibGU6IHRydWUgfSk7XG4gICAgICAgIH0gY2F0Y2gge1xuICAgICAgICAgIC8vIEV4cHJlc3MgNCAod3JpdGFibGUgZGF0YSBwcm9wKSDigJQgdGhlIGluLXBsYWNlIHNhbml0aXplIGFib3ZlIHN1ZmZpY2VkLlxuICAgICAgICB9XG4gICAgICB9XG4gICAgfSBjYXRjaCAoZXJyKSB7XG4gICAgICAvLyBSZWplY3Qgb3Zlci1kZWVwIHBheWxvYWRzIHdpdGggYSA0MDAgcmF0aGVyIHRoYW4gc2lsZW50bHkgdHJ1bmNhdGluZ1xuICAgICAgLy8gdGhlIHNhbml0aXplIHdhbGsgKHdoaWNoIHJpc2tlZCBsZWF2aW5nIGRlZXAgb3BlcmF0b3Iga2V5cyBpbiBwbGFjZSkuXG4gICAgICBpZiAoZXJyIGluc3RhbmNlb2YgUGF5bG9hZFRvb0RlZXBFcnJvcikge1xuICAgICAgICByZXR1cm4gc2VuZEVycm9yKHJlcywgZXJyLnN0YXR1c0NvZGUsIGVyci5tZXNzYWdlLCBFcnJvckNvZGUuVkFMSURBVElPTl9FUlJPUik7XG4gICAgICB9XG4gICAgICB0aHJvdyBlcnI7XG4gICAgfVxuICAgIG5leHQoKTtcbiAgfTtcbn1cblxuLy8gUHJvdG90eXBlLXBvbGx1dGlvbiBrZXlzIOKAlCB0aGVzZSBuZXZlciBiZWxvbmcgaW4gSlNPTiByZXF1ZXN0IGJvZGllcywgYW5kIGFcbi8vIGRvd25zdHJlYW0gcmVjdXJzaXZlIG1lcmdlL2Fzc2lnbiBvbiB0aGUgcGFyc2VkIG9iamVjdCBjb3VsZCBvdGhlcndpc2Ugd2Fsa1xuLy8gYGNvbnN0cnVjdG9yLnByb3RvdHlwZWAgdG8gaW5qZWN0IE1vbmdvIG9wZXJhdG9ycyBvciBwb2xsdXRlIE9iamVjdC5wcm90b3R5cGUuXG5jb25zdCBGT1JCSURERU5fS0VZUyA9IG5ldyBTZXQoWydfX3Byb3RvX18nLCAnY29uc3RydWN0b3InLCAncHJvdG90eXBlJ10pO1xuXG5mdW5jdGlvbiBzYW5pdGl6ZU9iamVjdChvYmo6IFJlY29yZDxzdHJpbmcsIHVua25vd24+LCBkZXB0aCA9IDApOiB2b2lkIHtcbiAgLy8gUmVqZWN0IHBhdGhvbG9naWNhbGx5IG5lc3RlZCBpbnB1dCByYXRoZXIgdGhhbiBzaWxlbnRseSByZXR1cm5pbmcg4oCUIGFcbiAgLy8gc2lsZW50IGNhcCB3b3VsZCBsZWF2ZSBhbnkgb3BlcmF0b3IvZG90L3Byb3RvdHlwZSBrZXlzIGRlZXBlciB0aGFuIHRoZVxuICAvLyBjYXAgdW4tc2FuaXRpemVkLiBUaGUgbWlkZGxld2FyZSBtYXBzIHRoaXMgdG8gYSA0MDAuXG4gIGlmIChkZXB0aCA+IE1BWF9TQU5JVElaRV9ERVBUSCkge1xuICAgIHRocm93IG5ldyBQYXlsb2FkVG9vRGVlcEVycm9yKCk7XG4gIH1cbiAgZm9yIChjb25zdCBrZXkgb2YgT2JqZWN0LmtleXMob2JqKSkge1xuICAgIGlmIChrZXkuc3RhcnRzV2l0aCgnJCcpIHx8IGtleS5pbmNsdWRlcygnLicpIHx8IEZPUkJJRERFTl9LRVlTLmhhcyhrZXkpKSB7XG4gICAgICBkZWxldGUgb2JqW2tleV07XG4gICAgICBjb250aW51ZTtcbiAgICB9XG4gICAgY29uc3QgdiA9IG9ialtrZXldO1xuICAgIGlmICh2ICYmIHR5cGVvZiB2ID09PSAnb2JqZWN0Jykge1xuICAgICAgaWYgKEFycmF5LmlzQXJyYXkodikpIHtcbiAgICAgICAgZm9yIChjb25zdCBpdGVtIG9mIHYpIHtcbiAgICAgICAgICBpZiAoaXRlbSAmJiB0eXBlb2YgaXRlbSA9PT0gJ29iamVjdCcpIHNhbml0aXplT2JqZWN0KGl0ZW0gYXMgUmVjb3JkPHN0cmluZywgdW5rbm93bj4sIGRlcHRoICsgMSk7XG4gICAgICAgIH1cbiAgICAgIH0gZWxzZSB7XG4gICAgICAgIHNhbml0aXplT2JqZWN0KHYgYXMgUmVjb3JkPHN0cmluZywgdW5rbm93bj4sIGRlcHRoICsgMSk7XG4gICAgICB9XG4gICAgfVxuICB9XG59XG4iXX0=

package/lib/middleware/step-up.d.ts

@@ -0,0 +1,45 @@
+/**
+ * `requireStepUp` — a shared step-up (recent-password-reverify) gate for the
+ * stateless api services, mirroring the platform middleware of the same name.
+ *
+ * Flow: the UI hits `POST /api/auth/step-up` (platform) to re-verify the user's
+ * password; platform mints a short-lived (60s) `step-up` JWT signed with the
+ * SAME `JWT_SECRET` these services already verify access tokens with. The UI
+ * replays it as the `X-Step-Up-Token` header on the destructive/sensitive call;
+ * this middleware verifies it, binds it to the caller (`sub` match), and
+ * consumes its `jti` once (Redis-backed cross-instance when configured, else a
+ * bounded process-local set) so a replay inside the TTL is rejected.
+ *
+ * WHY here: restore endpoints on the api services (pipeline/plugin/...) are
+ * step-up-gated, but step-up previously lived only in `platform`. This ports the
+ * verify + single-use jti into api-core so any service can require it.
+ */
+import type { Request, Response, NextFunction } from 'express';
+/** Payload of a platform-issued step-up token (see platform issueStepUpToken). */
+export interface StepUpTokenPayload {
+    type: 'step-up';
+    sub: string;
+    jti: string;
+    iat: number;
+    exp: number;
+}
+/**
+ * Verify a step-up token: valid signature (primary `JWT_SECRET`, or
+ * `JWT_SECRET_PREVIOUS` during a rotation), allow-listed algorithm, AND the
+ * `type: 'step-up'` + `jti` claims — a plain access token shares the secret and
+ * `sub`, so without asserting the step-up shape it would bypass the gate.
+ * Throws on any failure. Does NOT bind to a caller — `requireStepUp` does the
+ * `sub` match and single-use consume.
+ */
+export declare function verifyStepUpToken(token: string): StepUpTokenPayload;
+/**
+ * Consume a step-up `jti` exactly once. Returns true if this call claimed it
+ * (first use), false if it was already consumed (replay). `expEpochSeconds` is
+ * the token's `exp`, so the marker auto-expires with the token.
+ */
+export declare function consumeStepUpJti(jti: string, expEpochSeconds: number): Promise<boolean>;
+/**
+ * Express middleware: require a valid, caller-bound, single-use step-up token in
+ * the `X-Step-Up-Token` header. Must run AFTER `requireAuth` (needs `req.user`).
+ */
+export declare function requireStepUp(req: Request, res: Response, next: NextFunction): Promise<void>;

package/lib/middleware/step-up.js

@@ -0,0 +1,138 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import jwt from 'jsonwebtoken';
+import { isServicePrincipal } from './auth.js';
+import { createEnvRedisClient } from '../services/env-redis.js';
+import { getHeaderString } from '../utils/headers.js';
+import { createLogger } from '../utils/logger.js';
+import { sendError } from '../utils/response.js';
+const logger = createLogger('step-up');
+const HEADER = 'x-step-up-token';
+function jwtAlgorithm() {
+    return (process.env.JWT_ALGORITHM || 'HS256');
+}
+/**
+ * Verify a step-up token: valid signature (primary `JWT_SECRET`, or
+ * `JWT_SECRET_PREVIOUS` during a rotation), allow-listed algorithm, AND the
+ * `type: 'step-up'` + `jti` claims — a plain access token shares the secret and
+ * `sub`, so without asserting the step-up shape it would bypass the gate.
+ * Throws on any failure. Does NOT bind to a caller — `requireStepUp` does the
+ * `sub` match and single-use consume.
+ */
+export function verifyStepUpToken(token) {
+    const secret = process.env.JWT_SECRET;
+    if (!secret)
+        throw new Error('JWT_SECRET environment variable is required');
+    const opts = { algorithms: [jwtAlgorithm()] };
+    let payload;
+    try {
+        payload = jwt.verify(token, secret, opts);
+    }
+    catch (primaryErr) {
+        const previous = process.env.JWT_SECRET_PREVIOUS;
+        if (!previous)
+            throw primaryErr;
+        payload = jwt.verify(token, previous, opts);
+    }
+    if (payload.type !== 'step-up' || !payload.jti || !payload.sub) {
+        throw new Error('INVALID_STEP_UP_TOKEN');
+    }
+    return payload;
+}
+// -- Single-use jti store -----------------------------------------------------
+// Redis SET NX EX when Redis is configured (cross-instance single-use); else a
+// bounded process-local map with TTL sweep (per-process). A step-up token is
+// 60s-lived. When Redis IS configured it's the authoritative store: a Redis
+// error FAILS CLOSED (throws → STEP_UP_INVALID, user re-verifies) rather than
+// degrading to the per-instance mem guard, which would accept a cross-instance
+// replay during the outage. The mem guard is used ONLY when Redis is absent.
+let _redis;
+function redis() {
+    if (_redis === undefined) {
+        _redis = createEnvRedisClient('step-up-jti');
+    }
+    return _redis;
+}
+const memJti = new Map(); // jti -> expiry epoch ms
+const memSweep = setInterval(() => {
+    const now = Date.now();
+    for (const [jti, exp] of memJti)
+        if (exp <= now)
+            memJti.delete(jti);
+}, 30_000);
+memSweep.unref?.();
+/**
+ * Consume a step-up `jti` exactly once. Returns true if this call claimed it
+ * (first use), false if it was already consumed (replay). `expEpochSeconds` is
+ * the token's `exp`, so the marker auto-expires with the token.
+ */
+export async function consumeStepUpJti(jti, expEpochSeconds) {
+    const ttlSeconds = Math.max(1, expEpochSeconds - Math.floor(Date.now() / 1000));
+    const client = redis();
+    if (client) {
+        // Redis configured ⇒ authoritative cross-instance store. SET NX EX → 'OK'
+        // when newly set, null when already consumed. A thrown Redis error is NOT
+        // caught here: it propagates so `requireStepUp` fails closed (STEP_UP_INVALID)
+        // instead of silently degrading to the per-instance mem guard.
+        const res = await client.set(`stepup:jti:${jti}`, '1', 'EX', ttlSeconds, 'NX');
+        return res === 'OK';
+    }
+    // No Redis ⇒ single-instance deployment; the process-local map IS the store.
+    if (memJti.has(jti))
+        return false;
+    memJti.set(jti, Date.now() + ttlSeconds * 1000);
+    return true;
+}
+/**
+ * Express middleware: require a valid, caller-bound, single-use step-up token in
+ * the `X-Step-Up-Token` header. Must run AFTER `requireAuth` (needs `req.user`).
+ */
+export async function requireStepUp(req, res, next) {
+    // Verified internal service principals are EXEMPT: step-up is a re-verify-the-
+    // HUMAN gate (they replay a password-reverify token), which a service token
+    // structurally cannot produce. Services already bypass `requirePermission` on
+    // the same trust basis (a signed service JWT), and internal callers of a
+    // step-up-gated route — e.g. the platform org-cascade's `DELETE /quotas/:orgId`
+    // or the billing→quota entitlement sync — would otherwise be hard-blocked.
+    // Safe: a service token can only be minted with `JWT_SECRET`, so this can't be
+    // spoofed by an external client to skip step-up.
+    if (isServicePrincipal(req)) {
+        next();
+        return;
+    }
+    const callerSub = req.user?.sub;
+    if (!callerSub) {
+        sendError(res, 401, 'Authentication required', 'UNAUTHORIZED');
+        return;
+    }
+    const token = getHeaderString(req.headers[HEADER]);
+    if (!token) {
+        sendError(res, 401, 'Step-up verification required', 'STEP_UP_REQUIRED');
+        return;
+    }
+    let payload;
+    try {
+        payload = verifyStepUpToken(token);
+    }
+    catch {
+        sendError(res, 401, 'Step-up token invalid or expired', 'STEP_UP_INVALID');
+        return;
+    }
+    if (payload.sub !== callerSub) {
+        sendError(res, 401, 'Step-up token does not match session', 'STEP_UP_MISMATCH');
+        return;
+    }
+    try {
+        if (!(await consumeStepUpJti(payload.jti, payload.exp))) {
+            sendError(res, 401, 'Step-up token already used or expired', 'STEP_UP_REPLAY');
+            return;
+        }
+    }
+    catch (err) {
+        logger.error('Step-up jti consume errored', { error: String(err) });
+        sendError(res, 401, 'Step-up verification failed', 'STEP_UP_INVALID');
+        return;
+    }
+    next();
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RlcC11cC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9taWRkbGV3YXJlL3N0ZXAtdXAudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQW9CdEMsT0FBTyxHQUFHLE1BQU0sY0FBYyxDQUFDO0FBQy9CLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxNQUFNLFdBQVcsQ0FBQztBQUMvQyxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSwwQkFBMEIsQ0FBQztBQUNoRSxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDdEQsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQ2xELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxzQkFBc0IsQ0FBQztBQUVqRCxNQUFNLE1BQU0sR0FBRyxZQUFZLENBQUMsU0FBUyxDQUFDLENBQUM7QUFDdkMsTUFBTSxNQUFNLEdBQUcsaUJBQWlCLENBQUM7QUFXakMsU0FBUyxZQUFZO0lBQ25CLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsSUFBSSxPQUFPLENBQWtCLENBQUM7QUFDakUsQ0FBQztBQUVEOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLFVBQVUsaUJBQWlCLENBQUMsS0FBYTtJQUM3QyxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQztJQUN0QyxJQUFJLENBQUMsTUFBTTtRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsNkNBQTZDLENBQUMsQ0FBQztJQUM1RSxNQUFNLElBQUksR0FBc0IsRUFBRSxVQUFVLEVBQUUsQ0FBQyxZQUFZLEVBQUUsQ0FBQyxFQUFFLENBQUM7SUFFakUsSUFBSSxPQUEyQixDQUFDO0lBQ2hDLElBQUksQ0FBQztRQUNILE9BQU8sR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUF1QixDQUFDO0lBQ2xFLENBQUM7SUFBQyxPQUFPLFVBQVUsRUFBRSxDQUFDO1FBQ3BCLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsbUJBQW1CLENBQUM7UUFDakQsSUFBSSxDQUFDLFFBQVE7WUFBRSxNQUFNLFVBQVUsQ0FBQztRQUNoQyxPQUFPLEdBQUcsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsUUFBUSxFQUFFLElBQUksQ0FBdUIsQ0FBQztJQUNwRSxDQUFDO0lBRUQsSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDL0QsTUFBTSxJQUFJLEtBQUssQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDO0lBQzNDLENBQUM7SUFDRCxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDO0FBRUQsZ0ZBQWdGO0FBQ2hGLCtFQUErRTtBQUMvRSw2RUFBNkU7QUFDN0UsNEVBQTRFO0FBQzVFLDhFQUE4RTtBQUM5RSwrRUFBK0U7QUFDL0UsNkVBQTZFO0FBRTdFLElBQUksTUFBNEUsQ0FBQztBQUNqRixTQUFTLEtBQUs7SUFDWixJQUFJLE1BQU0sS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUN6QixNQUFNLEdBQUcsb0JBQW9CLENBQW9ELGFBQWEsQ0FBQyxDQUFDO0lBQ2xHLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDO0FBRUQsTUFBTSxNQUFNLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUMsQ0FBQyx5QkFBeUI7QUFDbkUsTUFBTSxRQUFRLEdBQUcsV0FBVyxDQUFDLEdBQUcsRUFBRTtJQUNoQyxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7SUFDdkIsS0FBSyxNQUFNLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxJQUFJLE1BQU07UUFBRSxJQUFJLEdBQUcsSUFBSSxHQUFHO1lBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztBQUN0RSxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUM7QUFDWCxRQUFRLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQztBQUVuQjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxnQkFBZ0IsQ0FBQyxHQUFXLEVBQUUsZUFBdUI7SUFDekUsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsZUFBZSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDaEYsTUFBTSxNQUFNLEdBQUcsS0FBSyxFQUFFLENBQUM7SUFDdkIsSUFBSSxNQUFNLEVBQUUsQ0FBQztRQUNYLDBFQUEwRTtRQUMxRSwwRUFBMEU7UUFDMUUsK0VBQStFO1FBQy9FLCtEQUErRDtRQUMvRCxNQUFNLEdBQUcsR0FBRyxNQUFNLE1BQU0sQ0FBQyxHQUFHLENBQUMsY0FBYyxHQUFHLEVBQUUsRUFBRSxHQUFHLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUMvRSxPQUFPLEdBQUcsS0FBSyxJQUFJLENBQUM7SUFDdEIsQ0FBQztJQUNELDZFQUE2RTtJQUM3RSxJQUFJLE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDbEMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLFVBQVUsR0FBRyxJQUFJLENBQUMsQ0FBQztJQUNoRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLGFBQWEsQ0FBQyxHQUFZLEVBQUUsR0FBYSxFQUFFLElBQWtCO0lBQ2pGLCtFQUErRTtJQUMvRSw0RUFBNEU7SUFDNUUsOEVBQThFO0lBQzlFLHlFQUF5RTtJQUN6RSxnRkFBZ0Y7SUFDaEYsMkVBQTJFO0lBQzNFLCtFQUErRTtJQUMvRSxpREFBaUQ7SUFDakQsSUFBSSxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzVCLElBQUksRUFBRSxDQUFDO1FBQ1AsT0FBTztJQUNULENBQUM7SUFFRCxNQUFNLFNBQVMsR0FBSSxHQUE2QyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUM7SUFDM0UsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ2YsU0FBUyxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUseUJBQXlCLEVBQUUsY0FBYyxDQUFDLENBQUM7UUFDL0QsT0FBTztJQUNULENBQUM7SUFFRCxNQUFNLEtBQUssR0FBRyxlQUFlLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ25ELElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUNYLFNBQVMsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLCtCQUErQixFQUFFLGtCQUFrQixDQUFDLENBQUM7UUFDekUsT0FBTztJQUNULENBQUM7SUFFRCxJQUFJLE9BQTJCLENBQUM7SUFDaEMsSUFBSSxDQUFDO1FBQ0gsT0FBTyxHQUFHLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3JDLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxTQUFTLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxrQ0FBa0MsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO1FBQzNFLE9BQU87SUFDVCxDQUFDO0lBRUQsSUFBSSxPQUFPLENBQUMsR0FBRyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzlCLFNBQVMsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLHNDQUFzQyxFQUFFLGtCQUFrQixDQUFDLENBQUM7UUFDaEYsT0FBTztJQUNULENBQUM7SUFFRCxJQUFJLENBQUM7UUFDSCxJQUFJLENBQUMsQ0FBQyxNQUFNLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN4RCxTQUFTLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSx1Q0FBdUMsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO1lBQy9FLE9BQU87UUFDVCxDQUFDO0lBQ0gsQ0FBQztJQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7UUFDYixNQUFNLENBQUMsS0FBSyxDQUFDLDZCQUE2QixFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDcEUsU0FBUyxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsNkJBQTZCLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztRQUN0RSxPQUFPO0lBQ1QsQ0FBQztJQUVELElBQUksRUFBRSxDQUFDO0FBQ1QsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG4vKipcbiAqIGByZXF1aXJlU3RlcFVwYCDigJQgYSBzaGFyZWQgc3RlcC11cCAocmVjZW50LXBhc3N3b3JkLXJldmVyaWZ5KSBnYXRlIGZvciB0aGVcbiAqIHN0YXRlbGVzcyBhcGkgc2VydmljZXMsIG1pcnJvcmluZyB0aGUgcGxhdGZvcm0gbWlkZGxld2FyZSBvZiB0aGUgc2FtZSBuYW1lLlxuICpcbiAqIEZsb3c6IHRoZSBVSSBoaXRzIGBQT1NUIC9hcGkvYXV0aC9zdGVwLXVwYCAocGxhdGZvcm0pIHRvIHJlLXZlcmlmeSB0aGUgdXNlcidzXG4gKiBwYXNzd29yZDsgcGxhdGZvcm0gbWludHMgYSBzaG9ydC1saXZlZCAoNjBzKSBgc3RlcC11cGAgSldUIHNpZ25lZCB3aXRoIHRoZVxuICogU0FNRSBgSldUX1NFQ1JFVGAgdGhlc2Ugc2VydmljZXMgYWxyZWFkeSB2ZXJpZnkgYWNjZXNzIHRva2VucyB3aXRoLiBUaGUgVUlcbiAqIHJlcGxheXMgaXQgYXMgdGhlIGBYLVN0ZXAtVXAtVG9rZW5gIGhlYWRlciBvbiB0aGUgZGVzdHJ1Y3RpdmUvc2Vuc2l0aXZlIGNhbGw7XG4gKiB0aGlzIG1pZGRsZXdhcmUgdmVyaWZpZXMgaXQsIGJpbmRzIGl0IHRvIHRoZSBjYWxsZXIgKGBzdWJgIG1hdGNoKSwgYW5kXG4gKiBjb25zdW1lcyBpdHMgYGp0aWAgb25jZSAoUmVkaXMtYmFja2VkIGNyb3NzLWluc3RhbmNlIHdoZW4gY29uZmlndXJlZCwgZWxzZSBhXG4gKiBib3VuZGVkIHByb2Nlc3MtbG9jYWwgc2V0KSBzbyBhIHJlcGxheSBpbnNpZGUgdGhlIFRUTCBpcyByZWplY3RlZC5cbiAqXG4gKiBXSFkgaGVyZTogcmVzdG9yZSBlbmRwb2ludHMgb24gdGhlIGFwaSBzZXJ2aWNlcyAocGlwZWxpbmUvcGx1Z2luLy4uLikgYXJlXG4gKiBzdGVwLXVwLWdhdGVkLCBidXQgc3RlcC11cCBwcmV2aW91c2x5IGxpdmVkIG9ubHkgaW4gYHBsYXRmb3JtYC4gVGhpcyBwb3J0cyB0aGVcbiAqIHZlcmlmeSArIHNpbmdsZS11c2UganRpIGludG8gYXBpLWNvcmUgc28gYW55IHNlcnZpY2UgY2FuIHJlcXVpcmUgaXQuXG4gKi9cblxuaW1wb3J0IHR5cGUgeyBSZXF1ZXN0LCBSZXNwb25zZSwgTmV4dEZ1bmN0aW9uIH0gZnJvbSAnZXhwcmVzcyc7XG5pbXBvcnQgand0IGZyb20gJ2pzb253ZWJ0b2tlbic7XG5pbXBvcnQgeyBpc1NlcnZpY2VQcmluY2lwYWwgfSBmcm9tICcuL2F1dGguanMnO1xuaW1wb3J0IHsgY3JlYXRlRW52UmVkaXNDbGllbnQgfSBmcm9tICcuLi9zZXJ2aWNlcy9lbnYtcmVkaXMuanMnO1xuaW1wb3J0IHsgZ2V0SGVhZGVyU3RyaW5nIH0gZnJvbSAnLi4vdXRpbHMvaGVhZGVycy5qcyc7XG5pbXBvcnQgeyBjcmVhdGVMb2dnZXIgfSBmcm9tICcuLi91dGlscy9sb2dnZXIuanMnO1xuaW1wb3J0IHsgc2VuZEVycm9yIH0gZnJvbSAnLi4vdXRpbHMvcmVzcG9uc2UuanMnO1xuXG5jb25zdCBsb2dnZXIgPSBjcmVhdGVMb2dnZXIoJ3N0ZXAtdXAnKTtcbmNvbnN0IEhFQURFUiA9ICd4LXN0ZXAtdXAtdG9rZW4nO1xuXG4vKiogUGF5bG9hZCBvZiBhIHBsYXRmb3JtLWlzc3VlZCBzdGVwLXVwIHRva2VuIChzZWUgcGxhdGZvcm0gaXNzdWVTdGVwVXBUb2tlbikuICovXG5leHBvcnQgaW50ZXJmYWNlIFN0ZXBVcFRva2VuUGF5bG9hZCB7XG4gIHR5cGU6ICdzdGVwLXVwJztcbiAgc3ViOiBzdHJpbmc7XG4gIGp0aTogc3RyaW5nO1xuICBpYXQ6IG51bWJlcjtcbiAgZXhwOiBudW1iZXI7XG59XG5cbmZ1bmN0aW9uIGp3dEFsZ29yaXRobSgpOiBqd3QuQWxnb3JpdGhtIHtcbiAgcmV0dXJuIChwcm9jZXNzLmVudi5KV1RfQUxHT1JJVEhNIHx8ICdIUzI1NicpIGFzIGp3dC5BbGdvcml0aG07XG59XG5cbi8qKlxuICogVmVyaWZ5IGEgc3RlcC11cCB0b2tlbjogdmFsaWQgc2lnbmF0dXJlIChwcmltYXJ5IGBKV1RfU0VDUkVUYCwgb3JcbiAqIGBKV1RfU0VDUkVUX1BSRVZJT1VTYCBkdXJpbmcgYSByb3RhdGlvbiksIGFsbG93LWxpc3RlZCBhbGdvcml0aG0sIEFORCB0aGVcbiAqIGB0eXBlOiAnc3RlcC11cCdgICsgYGp0aWAgY2xhaW1zIOKAlCBhIHBsYWluIGFjY2VzcyB0b2tlbiBzaGFyZXMgdGhlIHNlY3JldCBhbmRcbiAqIGBzdWJgLCBzbyB3aXRob3V0IGFzc2VydGluZyB0aGUgc3RlcC11cCBzaGFwZSBpdCB3b3VsZCBieXBhc3MgdGhlIGdhdGUuXG4gKiBUaHJvd3Mgb24gYW55IGZhaWx1cmUuIERvZXMgTk9UIGJpbmQgdG8gYSBjYWxsZXIg4oCUIGByZXF1aXJlU3RlcFVwYCBkb2VzIHRoZVxuICogYHN1YmAgbWF0Y2ggYW5kIHNpbmdsZS11c2UgY29uc3VtZS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHZlcmlmeVN0ZXBVcFRva2VuKHRva2VuOiBzdHJpbmcpOiBTdGVwVXBUb2tlblBheWxvYWQge1xuICBjb25zdCBzZWNyZXQgPSBwcm9jZXNzLmVudi5KV1RfU0VDUkVUO1xuICBpZiAoIXNlY3JldCkgdGhyb3cgbmV3IEVycm9yKCdKV1RfU0VDUkVUIGVudmlyb25tZW50IHZhcmlhYmxlIGlzIHJlcXVpcmVkJyk7XG4gIGNvbnN0IG9wdHM6IGp3dC5WZXJpZnlPcHRpb25zID0geyBhbGdvcml0aG1zOiBband0QWxnb3JpdGhtKCldIH07XG5cbiAgbGV0IHBheWxvYWQ6IFN0ZXBVcFRva2VuUGF5bG9hZDtcbiAgdHJ5IHtcbiAgICBwYXlsb2FkID0gand0LnZlcmlmeSh0b2tlbiwgc2VjcmV0LCBvcHRzKSBhcyBTdGVwVXBUb2tlblBheWxvYWQ7XG4gIH0gY2F0Y2ggKHByaW1hcnlFcnIpIHtcbiAgICBjb25zdCBwcmV2aW91cyA9IHByb2Nlc3MuZW52LkpXVF9TRUNSRVRfUFJFVklPVVM7XG4gICAgaWYgKCFwcmV2aW91cykgdGhyb3cgcHJpbWFyeUVycjtcbiAgICBwYXlsb2FkID0gand0LnZlcmlmeSh0b2tlbiwgcHJldmlvdXMsIG9wdHMpIGFzIFN0ZXBVcFRva2VuUGF5bG9hZDtcbiAgfVxuXG4gIGlmIChwYXlsb2FkLnR5cGUgIT09ICdzdGVwLXVwJyB8fCAhcGF5bG9hZC5qdGkgfHwgIXBheWxvYWQuc3ViKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKCdJTlZBTElEX1NURVBfVVBfVE9LRU4nKTtcbiAgfVxuICByZXR1cm4gcGF5bG9hZDtcbn1cblxuLy8gLS0gU2luZ2xlLXVzZSBqdGkgc3RvcmUgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cbi8vIFJlZGlzIFNFVCBOWCBFWCB3aGVuIFJlZGlzIGlzIGNvbmZpZ3VyZWQgKGNyb3NzLWluc3RhbmNlIHNpbmdsZS11c2UpOyBlbHNlIGFcbi8vIGJvdW5kZWQgcHJvY2Vzcy1sb2NhbCBtYXAgd2l0aCBUVEwgc3dlZXAgKHBlci1wcm9jZXNzKS4gQSBzdGVwLXVwIHRva2VuIGlzXG4vLyA2MHMtbGl2ZWQuIFdoZW4gUmVkaXMgSVMgY29uZmlndXJlZCBpdCdzIHRoZSBhdXRob3JpdGF0aXZlIHN0b3JlOiBhIFJlZGlzXG4vLyBlcnJvciBGQUlMUyBDTE9TRUQgKHRocm93cyDihpIgU1RFUF9VUF9JTlZBTElELCB1c2VyIHJlLXZlcmlmaWVzKSByYXRoZXIgdGhhblxuLy8gZGVncmFkaW5nIHRvIHRoZSBwZXItaW5zdGFuY2UgbWVtIGd1YXJkLCB3aGljaCB3b3VsZCBhY2NlcHQgYSBjcm9zcy1pbnN0YW5jZVxuLy8gcmVwbGF5IGR1cmluZyB0aGUgb3V0YWdlLiBUaGUgbWVtIGd1YXJkIGlzIHVzZWQgT05MWSB3aGVuIFJlZGlzIGlzIGFic2VudC5cblxubGV0IF9yZWRpczogeyBzZXQ6ICguLi5hcmdzOiB1bmtub3duW10pID0+IFByb21pc2U8dW5rbm93bj4gfSB8IG51bGwgfCB1bmRlZmluZWQ7XG5mdW5jdGlvbiByZWRpcygpOiB7IHNldDogKC4uLmFyZ3M6IHVua25vd25bXSkgPT4gUHJvbWlzZTx1bmtub3duPiB9IHwgbnVsbCB7XG4gIGlmIChfcmVkaXMgPT09IHVuZGVmaW5lZCkge1xuICAgIF9yZWRpcyA9IGNyZWF0ZUVudlJlZGlzQ2xpZW50PHsgc2V0OiAoLi4uYXJnczogdW5rbm93bltdKSA9PiBQcm9taXNlPHVua25vd24+IH0+KCdzdGVwLXVwLWp0aScpO1xuICB9XG4gIHJldHVybiBfcmVkaXM7XG59XG5cbmNvbnN0IG1lbUp0aSA9IG5ldyBNYXA8c3RyaW5nLCBudW1iZXI+KCk7IC8vIGp0aSAtPiBleHBpcnkgZXBvY2ggbXNcbmNvbnN0IG1lbVN3ZWVwID0gc2V0SW50ZXJ2YWwoKCkgPT4ge1xuICBjb25zdCBub3cgPSBEYXRlLm5vdygpO1xuICBmb3IgKGNvbnN0IFtqdGksIGV4cF0gb2YgbWVtSnRpKSBpZiAoZXhwIDw9IG5vdykgbWVtSnRpLmRlbGV0ZShqdGkpO1xufSwgMzBfMDAwKTtcbm1lbVN3ZWVwLnVucmVmPy4oKTtcblxuLyoqXG4gKiBDb25zdW1lIGEgc3RlcC11cCBganRpYCBleGFjdGx5IG9uY2UuIFJldHVybnMgdHJ1ZSBpZiB0aGlzIGNhbGwgY2xhaW1lZCBpdFxuICogKGZpcnN0IHVzZSksIGZhbHNlIGlmIGl0IHdhcyBhbHJlYWR5IGNvbnN1bWVkIChyZXBsYXkpLiBgZXhwRXBvY2hTZWNvbmRzYCBpc1xuICogdGhlIHRva2VuJ3MgYGV4cGAsIHNvIHRoZSBtYXJrZXIgYXV0by1leHBpcmVzIHdpdGggdGhlIHRva2VuLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gY29uc3VtZVN0ZXBVcEp0aShqdGk6IHN0cmluZywgZXhwRXBvY2hTZWNvbmRzOiBudW1iZXIpOiBQcm9taXNlPGJvb2xlYW4+IHtcbiAgY29uc3QgdHRsU2Vjb25kcyA9IE1hdGgubWF4KDEsIGV4cEVwb2NoU2Vjb25kcyAtIE1hdGguZmxvb3IoRGF0ZS5ub3coKSAvIDEwMDApKTtcbiAgY29uc3QgY2xpZW50ID0gcmVkaXMoKTtcbiAgaWYgKGNsaWVudCkge1xuICAgIC8vIFJlZGlzIGNvbmZpZ3VyZWQg4oeSIGF1dGhvcml0YXRpdmUgY3Jvc3MtaW5zdGFuY2Ugc3RvcmUuIFNFVCBOWCBFWCDihpIgJ09LJ1xuICAgIC8vIHdoZW4gbmV3bHkgc2V0LCBudWxsIHdoZW4gYWxyZWFkeSBjb25zdW1lZC4gQSB0aHJvd24gUmVkaXMgZXJyb3IgaXMgTk9UXG4gICAgLy8gY2F1Z2h0IGhlcmU6IGl0IHByb3BhZ2F0ZXMgc28gYHJlcXVpcmVTdGVwVXBgIGZhaWxzIGNsb3NlZCAoU1RFUF9VUF9JTlZBTElEKVxuICAgIC8vIGluc3RlYWQgb2Ygc2lsZW50bHkgZGVncmFkaW5nIHRvIHRoZSBwZXItaW5zdGFuY2UgbWVtIGd1YXJkLlxuICAgIGNvbnN0IHJlcyA9IGF3YWl0IGNsaWVudC5zZXQoYHN0ZXB1cDpqdGk6JHtqdGl9YCwgJzEnLCAnRVgnLCB0dGxTZWNvbmRzLCAnTlgnKTtcbiAgICByZXR1cm4gcmVzID09PSAnT0snO1xuICB9XG4gIC8vIE5vIFJlZGlzIOKHkiBzaW5nbGUtaW5zdGFuY2UgZGVwbG95bWVudDsgdGhlIHByb2Nlc3MtbG9jYWwgbWFwIElTIHRoZSBzdG9yZS5cbiAgaWYgKG1lbUp0aS5oYXMoanRpKSkgcmV0dXJuIGZhbHNlO1xuICBtZW1KdGkuc2V0KGp0aSwgRGF0ZS5ub3coKSArIHR0bFNlY29uZHMgKiAxMDAwKTtcbiAgcmV0dXJuIHRydWU7XG59XG5cbi8qKlxuICogRXhwcmVzcyBtaWRkbGV3YXJlOiByZXF1aXJlIGEgdmFsaWQsIGNhbGxlci1ib3VuZCwgc2luZ2xlLXVzZSBzdGVwLXVwIHRva2VuIGluXG4gKiB0aGUgYFgtU3RlcC1VcC1Ub2tlbmAgaGVhZGVyLiBNdXN0IHJ1biBBRlRFUiBgcmVxdWlyZUF1dGhgIChuZWVkcyBgcmVxLnVzZXJgKS5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJlcXVpcmVTdGVwVXAocmVxOiBSZXF1ZXN0LCByZXM6IFJlc3BvbnNlLCBuZXh0OiBOZXh0RnVuY3Rpb24pOiBQcm9taXNlPHZvaWQ+IHtcbiAgLy8gVmVyaWZpZWQgaW50ZXJuYWwgc2VydmljZSBwcmluY2lwYWxzIGFyZSBFWEVNUFQ6IHN0ZXAtdXAgaXMgYSByZS12ZXJpZnktdGhlLVxuICAvLyBIVU1BTiBnYXRlICh0aGV5IHJlcGxheSBhIHBhc3N3b3JkLXJldmVyaWZ5IHRva2VuKSwgd2hpY2ggYSBzZXJ2aWNlIHRva2VuXG4gIC8vIHN0cnVjdHVyYWxseSBjYW5ub3QgcHJvZHVjZS4gU2VydmljZXMgYWxyZWFkeSBieXBhc3MgYHJlcXVpcmVQZXJtaXNzaW9uYCBvblxuICAvLyB0aGUgc2FtZSB0cnVzdCBiYXNpcyAoYSBzaWduZWQgc2VydmljZSBKV1QpLCBhbmQgaW50ZXJuYWwgY2FsbGVycyBvZiBhXG4gIC8vIHN0ZXAtdXAtZ2F0ZWQgcm91dGUg4oCUIGUuZy4gdGhlIHBsYXRmb3JtIG9yZy1jYXNjYWRlJ3MgYERFTEVURSAvcXVvdGFzLzpvcmdJZGBcbiAgLy8gb3IgdGhlIGJpbGxpbmfihpJxdW90YSBlbnRpdGxlbWVudCBzeW5jIOKAlCB3b3VsZCBvdGhlcndpc2UgYmUgaGFyZC1ibG9ja2VkLlxuICAvLyBTYWZlOiBhIHNlcnZpY2UgdG9rZW4gY2FuIG9ubHkgYmUgbWludGVkIHdpdGggYEpXVF9TRUNSRVRgLCBzbyB0aGlzIGNhbid0IGJlXG4gIC8vIHNwb29mZWQgYnkgYW4gZXh0ZXJuYWwgY2xpZW50IHRvIHNraXAgc3RlcC11cC5cbiAgaWYgKGlzU2VydmljZVByaW5jaXBhbChyZXEpKSB7XG4gICAgbmV4dCgpO1xuICAgIHJldHVybjtcbiAgfVxuXG4gIGNvbnN0IGNhbGxlclN1YiA9IChyZXEgYXMgUmVxdWVzdCAmIHsgdXNlcj86IHsgc3ViPzogc3RyaW5nIH0gfSkudXNlcj8uc3ViO1xuICBpZiAoIWNhbGxlclN1Yikge1xuICAgIHNlbmRFcnJvcihyZXMsIDQwMSwgJ0F1dGhlbnRpY2F0aW9uIHJlcXVpcmVkJywgJ1VOQVVUSE9SSVpFRCcpO1xuICAgIHJldHVybjtcbiAgfVxuXG4gIGNvbnN0IHRva2VuID0gZ2V0SGVhZGVyU3RyaW5nKHJlcS5oZWFkZXJzW0hFQURFUl0pO1xuICBpZiAoIXRva2VuKSB7XG4gICAgc2VuZEVycm9yKHJlcywgNDAxLCAnU3RlcC11cCB2ZXJpZmljYXRpb24gcmVxdWlyZWQnLCAnU1RFUF9VUF9SRVFVSVJFRCcpO1xuICAgIHJldHVybjtcbiAgfVxuXG4gIGxldCBwYXlsb2FkOiBTdGVwVXBUb2tlblBheWxvYWQ7XG4gIHRyeSB7XG4gICAgcGF5bG9hZCA9IHZlcmlmeVN0ZXBVcFRva2VuKHRva2VuKTtcbiAgfSBjYXRjaCB7XG4gICAgc2VuZEVycm9yKHJlcywgNDAxLCAnU3RlcC11cCB0b2tlbiBpbnZhbGlkIG9yIGV4cGlyZWQnLCAnU1RFUF9VUF9JTlZBTElEJyk7XG4gICAgcmV0dXJuO1xuICB9XG5cbiAgaWYgKHBheWxvYWQuc3ViICE9PSBjYWxsZXJTdWIpIHtcbiAgICBzZW5kRXJyb3IocmVzLCA0MDEsICdTdGVwLXVwIHRva2VuIGRvZXMgbm90IG1hdGNoIHNlc3Npb24nLCAnU1RFUF9VUF9NSVNNQVRDSCcpO1xuICAgIHJldHVybjtcbiAgfVxuXG4gIHRyeSB7XG4gICAgaWYgKCEoYXdhaXQgY29uc3VtZVN0ZXBVcEp0aShwYXlsb2FkLmp0aSwgcGF5bG9hZC5leHApKSkge1xuICAgICAgc2VuZEVycm9yKHJlcywgNDAxLCAnU3RlcC11cCB0b2tlbiBhbHJlYWR5IHVzZWQgb3IgZXhwaXJlZCcsICdTVEVQX1VQX1JFUExBWScpO1xuICAgICAgcmV0dXJuO1xuICAgIH1cbiAgfSBjYXRjaCAoZXJyKSB7XG4gICAgbG9nZ2VyLmVycm9yKCdTdGVwLXVwIGp0aSBjb25zdW1lIGVycm9yZWQnLCB7IGVycm9yOiBTdHJpbmcoZXJyKSB9KTtcbiAgICBzZW5kRXJyb3IocmVzLCA0MDEsICdTdGVwLXVwIHZlcmlmaWNhdGlvbiBmYWlsZWQnLCAnU1RFUF9VUF9JTlZBTElEJyk7XG4gICAgcmV0dXJuO1xuICB9XG5cbiAgbmV4dCgpO1xufVxuIl19

package/lib/openapi/extend-zod.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/openapi/extend-zod.js

@@ -0,0 +1,6 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { extendZodWithOpenApi } from '@asteasolutions/zod-to-openapi';
+import { z } from 'zod';
+extendZodWithOpenApi(z);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXh0ZW5kLXpvZC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9vcGVuYXBpL2V4dGVuZC16b2QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUN0RSxPQUFPLEVBQUUsQ0FBQyxFQUFFLE1BQU0sS0FBSyxDQUFDO0FBRXhCLG9CQUFvQixDQUFDLENBQUMsQ0FBQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmltcG9ydCB7IGV4dGVuZFpvZFdpdGhPcGVuQXBpIH0gZnJvbSAnQGFzdGVhc29sdXRpb25zL3pvZC10by1vcGVuYXBpJztcbmltcG9ydCB7IHogfSBmcm9tICd6b2QnO1xuXG5leHRlbmRab2RXaXRoT3BlbkFwaSh6KTtcbiJdfQ==

package/lib/openapi/index.d.ts

@@ -0,0 +1,2 @@
+export { registry, generateOpenApiSpec } from './registry.js';
+export type { OpenApiSpecOptions } from './registry.js';

package/lib/openapi/index.js

@@ -0,0 +1,5 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+// Public API
+export { registry, generateOpenApiSpec } from './registry.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvb3BlbmFwaS9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDLGFBQWE7QUFDYixPQUFPLEVBQUUsUUFBUSxFQUFFLG1CQUFtQixFQUFFLE1BQU0sZUFBZSxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8vIFB1YmxpYyBBUElcbmV4cG9ydCB7IHJlZ2lzdHJ5LCBnZW5lcmF0ZU9wZW5BcGlTcGVjIH0gZnJvbSAnLi9yZWdpc3RyeS5qcyc7XG5leHBvcnQgdHlwZSB7IE9wZW5BcGlTcGVjT3B0aW9ucyB9IGZyb20gJy4vcmVnaXN0cnkuanMnO1xuIl19

package/lib/openapi/registry.d.ts

@@ -0,0 +1,17 @@
+import { OpenAPIRegistry, OpenApiGeneratorV31 } from '@asteasolutions/zod-to-openapi';
+/** Shared OpenAPI registry for all schema and path registrations. */
+export declare const registry: OpenAPIRegistry;
+/** Options for customizing the generated OpenAPI spec. */
+export interface OpenApiSpecOptions {
+    title?: string;
+    version?: string;
+    description?: string;
+    serverUrl?: string;
+}
+/**
+ * Generate the complete OpenAPI 3.1.0 specification document.
+ *
+ * @param options - Optional overrides for spec metadata
+ * @returns OpenAPI 3.1 specification object
+ */
+export declare function generateOpenApiSpec(options?: OpenApiSpecOptions): ReturnType<OpenApiGeneratorV31['generateDocument']>;

package/lib/openapi/registry.js

@@ -0,0 +1,38 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { OpenAPIRegistry, OpenApiGeneratorV31 } from '@asteasolutions/zod-to-openapi';
+import { registerAllRoutes } from './routes/index.js';
+import { registerSchemas } from './schema-registry.js';
+/** Shared OpenAPI registry for all schema and path registrations. */
+export const registry = new OpenAPIRegistry();
+let _initialized = false;
+/** Execute all registrations once. */
+function ensureInitialized() {
+    if (_initialized)
+        return;
+    _initialized = true;
+    registerSchemas();
+    registerAllRoutes();
+}
+/**
+ * Generate the complete OpenAPI 3.1.0 specification document.
+ *
+ * @param options - Optional overrides for spec metadata
+ * @returns OpenAPI 3.1 specification object
+ */
+export function generateOpenApiSpec(options) {
+    ensureInitialized();
+    const generator = new OpenApiGeneratorV31(registry.definitions);
+    return generator.generateDocument({
+        openapi: '3.1.0',
+        info: {
+            title: options?.title ?? 'Pipeline Builder API',
+            version: options?.version ?? '1.0.0',
+            description: options?.description ?? 'CI/CD Pipeline Builder Platform API — manage pipelines, plugins, messages, quotas, and billing.',
+        },
+        servers: [
+            { url: options?.serverUrl ?? '/api', description: 'API base path' },
+        ],
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVnaXN0cnkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvb3BlbmFwaS9yZWdpc3RyeS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDLE9BQU8sRUFBRSxlQUFlLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUV0RixPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQztBQUN0RCxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFFdkQscUVBQXFFO0FBQ3JFLE1BQU0sQ0FBQyxNQUFNLFFBQVEsR0FBRyxJQUFJLGVBQWUsRUFBRSxDQUFDO0FBVTlDLElBQUksWUFBWSxHQUFHLEtBQUssQ0FBQztBQUV6QixzQ0FBc0M7QUFDdEMsU0FBUyxpQkFBaUI7SUFDeEIsSUFBSSxZQUFZO1FBQUUsT0FBTztJQUN6QixZQUFZLEdBQUcsSUFBSSxDQUFDO0lBQ3BCLGVBQWUsRUFBRSxDQUFDO0lBQ2xCLGlCQUFpQixFQUFFLENBQUM7QUFDdEIsQ0FBQztBQUVEOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLG1CQUFtQixDQUNqQyxPQUE0QjtJQUU1QixpQkFBaUIsRUFBRSxDQUFDO0lBRXBCLE1BQU0sU0FBUyxHQUFHLElBQUksbUJBQW1CLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQ2hFLE9BQU8sU0FBUyxDQUFDLGdCQUFnQixDQUFDO1FBQ2hDLE9BQU8sRUFBRSxPQUFPO1FBQ2hCLElBQUksRUFBRTtZQUNKLEtBQUssRUFBRSxPQUFPLEVBQUUsS0FBSyxJQUFJLHNCQUFzQjtZQUMvQyxPQUFPLEVBQUUsT0FBTyxFQUFFLE9BQU8sSUFBSSxPQUFPO1lBQ3BDLFdBQVcsRUFBRSxPQUFPLEVBQUUsV0FBVyxJQUFJLGlHQUFpRztTQUN2STtRQUNELE9BQU8sRUFBRTtZQUNQLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxTQUFTLElBQUksTUFBTSxFQUFFLFdBQVcsRUFBRSxlQUFlLEVBQUU7U0FDcEU7S0FDRixDQUFDLENBQUM7QUFDTCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmltcG9ydCB7IE9wZW5BUElSZWdpc3RyeSwgT3BlbkFwaUdlbmVyYXRvclYzMSB9IGZyb20gJ0Bhc3RlYXNvbHV0aW9ucy96b2QtdG8tb3BlbmFwaSc7XG5cbmltcG9ydCB7IHJlZ2lzdGVyQWxsUm91dGVzIH0gZnJvbSAnLi9yb3V0ZXMvaW5kZXguanMnO1xuaW1wb3J0IHsgcmVnaXN0ZXJTY2hlbWFzIH0gZnJvbSAnLi9zY2hlbWEtcmVnaXN0cnkuanMnO1xuXG4vKiogU2hhcmVkIE9wZW5BUEkgcmVnaXN0cnkgZm9yIGFsbCBzY2hlbWEgYW5kIHBhdGggcmVnaXN0cmF0aW9ucy4gKi9cbmV4cG9ydCBjb25zdCByZWdpc3RyeSA9IG5ldyBPcGVuQVBJUmVnaXN0cnkoKTtcblxuLyoqIE9wdGlvbnMgZm9yIGN1c3RvbWl6aW5nIHRoZSBnZW5lcmF0ZWQgT3BlbkFQSSBzcGVjLiAqL1xuZXhwb3J0IGludGVyZmFjZSBPcGVuQXBpU3BlY09wdGlvbnMge1xuICB0aXRsZT86IHN0cmluZztcbiAgdmVyc2lvbj86IHN0cmluZztcbiAgZGVzY3JpcHRpb24/OiBzdHJpbmc7XG4gIHNlcnZlclVybD86IHN0cmluZztcbn1cblxubGV0IF9pbml0aWFsaXplZCA9IGZhbHNlO1xuXG4vKiogRXhlY3V0ZSBhbGwgcmVnaXN0cmF0aW9ucyBvbmNlLiAqL1xuZnVuY3Rpb24gZW5zdXJlSW5pdGlhbGl6ZWQoKTogdm9pZCB7XG4gIGlmIChfaW5pdGlhbGl6ZWQpIHJldHVybjtcbiAgX2luaXRpYWxpemVkID0gdHJ1ZTtcbiAgcmVnaXN0ZXJTY2hlbWFzKCk7XG4gIHJlZ2lzdGVyQWxsUm91dGVzKCk7XG59XG5cbi8qKlxuICogR2VuZXJhdGUgdGhlIGNvbXBsZXRlIE9wZW5BUEkgMy4xLjAgc3BlY2lmaWNhdGlvbiBkb2N1bWVudC5cbiAqXG4gKiBAcGFyYW0gb3B0aW9ucyAtIE9wdGlvbmFsIG92ZXJyaWRlcyBmb3Igc3BlYyBtZXRhZGF0YVxuICogQHJldHVybnMgT3BlbkFQSSAzLjEgc3BlY2lmaWNhdGlvbiBvYmplY3RcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGdlbmVyYXRlT3BlbkFwaVNwZWMoXG4gIG9wdGlvbnM/OiBPcGVuQXBpU3BlY09wdGlvbnMsXG4pOiBSZXR1cm5UeXBlPE9wZW5BcGlHZW5lcmF0b3JWMzFbJ2dlbmVyYXRlRG9jdW1lbnQnXT4ge1xuICBlbnN1cmVJbml0aWFsaXplZCgpO1xuXG4gIGNvbnN0IGdlbmVyYXRvciA9IG5ldyBPcGVuQXBpR2VuZXJhdG9yVjMxKHJlZ2lzdHJ5LmRlZmluaXRpb25zKTtcbiAgcmV0dXJuIGdlbmVyYXRvci5nZW5lcmF0ZURvY3VtZW50KHtcbiAgICBvcGVuYXBpOiAnMy4xLjAnLFxuICAgIGluZm86IHtcbiAgICAgIHRpdGxlOiBvcHRpb25zPy50aXRsZSA/PyAnUGlwZWxpbmUgQnVpbGRlciBBUEknLFxuICAgICAgdmVyc2lvbjogb3B0aW9ucz8udmVyc2lvbiA/PyAnMS4wLjAnLFxuICAgICAgZGVzY3JpcHRpb246IG9wdGlvbnM/LmRlc2NyaXB0aW9uID8/ICdDSS9DRCBQaXBlbGluZSBCdWlsZGVyIFBsYXRmb3JtIEFQSSDigJQgbWFuYWdlIHBpcGVsaW5lcywgcGx1Z2lucywgbWVzc2FnZXMsIHF1b3RhcywgYW5kIGJpbGxpbmcuJyxcbiAgICB9LFxuICAgIHNlcnZlcnM6IFtcbiAgICAgIHsgdXJsOiBvcHRpb25zPy5zZXJ2ZXJVcmwgPz8gJy9hcGknLCBkZXNjcmlwdGlvbjogJ0FQSSBiYXNlIHBhdGgnIH0sXG4gICAgXSxcbiAgfSk7XG59XG4iXX0=

package/lib/openapi/routes/ask-routes.d.ts

@@ -0,0 +1,7 @@
+/**
+ * OpenAPI definitions for the "Ask" assistant service (api/ask), mounted at
+ * `/ask`. All routes are gated by the `ai_generation` feature and are READ /
+ * PROPOSE only — the agent never mutates; `propose_*` tool results are drafts the
+ * user confirms in the UI.
+ */
+export declare function registerAskRoutes(): void;

package/lib/openapi/routes/ask-routes.js

@@ -0,0 +1,62 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { registry } from '../registry.js';
+const tags = ['Ask'];
+const auth = [{ bearerAuth: [] }];
+/**
+ * OpenAPI definitions for the "Ask" assistant service (api/ask), mounted at
+ * `/ask`. All routes are gated by the `ai_generation` feature and are READ /
+ * PROPOSE only — the agent never mutates; `propose_*` tool results are drafts the
+ * user confirms in the UI.
+ */
+export function registerAskRoutes() {
+    registry.registerPath({
+        method: 'get',
+        path: '/ask/providers',
+        summary: 'List configured AI providers',
+        description: 'The AI providers/models available to the Ask assistant (from server env — cloud keys and/or the OpenAI-compatible local endpoint).',
+        tags,
+        security: auth,
+        responses: { 200: { description: 'Configured providers' }, 403: { description: 'ai_generation feature required' } },
+    });
+    registry.registerPath({
+        method: 'post',
+        path: '/ask',
+        summary: 'Grounded how-to answer (non-streaming)',
+        description: 'Answer a platform how-to question grounded in the docs corpus. Reserves one aiCalls quota slot.',
+        tags,
+        security: auth,
+        responses: {
+            200: { description: 'Answer with grounded sources' },
+            403: { description: 'ai_generation feature required' },
+            429: { description: 'aiCalls quota exceeded or rate limited' },
+        },
+    });
+    registry.registerPath({
+        method: 'post',
+        path: '/ask/stream',
+        summary: 'Grounded how-to answer (SSE stream)',
+        description: 'Same as POST /ask but streams the grounded sources then answer tokens as Server-Sent Events.',
+        tags,
+        security: auth,
+        responses: {
+            200: { description: 'text/event-stream of sources + answer tokens' },
+            403: { description: 'ai_generation feature required' },
+            429: { description: 'aiCalls quota exceeded or rate limited' },
+        },
+    });
+    registry.registerPath({
+        method: 'post',
+        path: '/ask/agent/stream',
+        summary: 'Tool-calling Ask agent (SSE stream)',
+        description: 'Runs the tool-calling assistant loop and streams reasoning tokens, tool-call events, and reviewable `propose_*` drafts (pipeline/plugin/template) as SSE. Read-only: proposals are confirmed separately in the UI.',
+        tags,
+        security: auth,
+        responses: {
+            200: { description: 'text/event-stream of tokens, tool-calls, and proposal drafts' },
+            403: { description: 'ai_generation feature required' },
+            429: { description: 'aiCalls quota exceeded or rate limited' },
+        },
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXNrLXJvdXRlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9vcGVuYXBpL3JvdXRlcy9hc2stcm91dGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEMsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBRTFDLE1BQU0sSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDckIsTUFBTSxJQUFJLEdBQUcsQ0FBQyxFQUFFLFVBQVUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDO0FBRWxDOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLGlCQUFpQjtJQUMvQixRQUFRLENBQUMsWUFBWSxDQUFDO1FBQ3BCLE1BQU0sRUFBRSxLQUFLO1FBQ2IsSUFBSSxFQUFFLGdCQUFnQjtRQUN0QixPQUFPLEVBQUUsOEJBQThCO1FBQ3ZDLFdBQVcsRUFBRSxvSUFBb0k7UUFDakosSUFBSTtRQUNKLFFBQVEsRUFBRSxJQUFJO1FBQ2QsU0FBUyxFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsV0FBVyxFQUFFLHNCQUFzQixFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsV0FBVyxFQUFFLGdDQUFnQyxFQUFFLEVBQUU7S0FDcEgsQ0FBQyxDQUFDO0lBRUgsUUFBUSxDQUFDLFlBQVksQ0FBQztRQUNwQixNQUFNLEVBQUUsTUFBTTtRQUNkLElBQUksRUFBRSxNQUFNO1FBQ1osT0FBTyxFQUFFLHdDQUF3QztRQUNqRCxXQUFXLEVBQUUsaUdBQWlHO1FBQzlHLElBQUk7UUFDSixRQUFRLEVBQUUsSUFBSTtRQUNkLFNBQVMsRUFBRTtZQUNULEdBQUcsRUFBRSxFQUFFLFdBQVcsRUFBRSw4QkFBOEIsRUFBRTtZQUNwRCxHQUFHLEVBQUUsRUFBRSxXQUFXLEVBQUUsZ0NBQWdDLEVBQUU7WUFDdEQsR0FBRyxFQUFFLEVBQUUsV0FBVyxFQUFFLHdDQUF3QyxFQUFFO1NBQy9EO0tBQ0YsQ0FBQyxDQUFDO0lBRUgsUUFBUSxDQUFDLFlBQVksQ0FBQztRQUNwQixNQUFNLEVBQUUsTUFBTTtRQUNkLElBQUksRUFBRSxhQUFhO1FBQ25CLE9BQU8sRUFBRSxxQ0FBcUM7UUFDOUMsV0FBVyxFQUFFLDhGQUE4RjtRQUMzRyxJQUFJO1FBQ0osUUFBUSxFQUFFLElBQUk7UUFDZCxTQUFTLEVBQUU7WUFDVCxHQUFHLEVBQUUsRUFBRSxXQUFXLEVBQUUsOENBQThDLEVBQUU7WUFDcEUsR0FBRyxFQUFFLEVBQUUsV0FBVyxFQUFFLGdDQUFnQyxFQUFFO1lBQ3RELEdBQUcsRUFBRSxFQUFFLFdBQVcsRUFBRSx3Q0FBd0MsRUFBRTtTQUMvRDtLQUNGLENBQUMsQ0FBQztJQUVILFFBQVEsQ0FBQyxZQUFZLENBQUM7UUFDcEIsTUFBTSxFQUFFLE1BQU07UUFDZCxJQUFJLEVBQUUsbUJBQW1CO1FBQ3pCLE9BQU8sRUFBRSxxQ0FBcUM7UUFDOUMsV0FBVyxFQUFFLG9OQUFvTjtRQUNqTyxJQUFJO1FBQ0osUUFBUSxFQUFFLElBQUk7UUFDZCxTQUFTLEVBQUU7WUFDVCxHQUFHLEVBQUUsRUFBRSxXQUFXLEVBQUUsOERBQThELEVBQUU7WUFDcEYsR0FBRyxFQUFFLEVBQUUsV0FBVyxFQUFFLGdDQUFnQyxFQUFFO1lBQ3RELEdBQUcsRUFBRSxFQUFFLFdBQVcsRUFBRSx3Q0FBd0MsRUFBRTtTQUMvRDtLQUNGLENBQUMsQ0FBQztBQUNMLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuaW1wb3J0IHsgcmVnaXN0cnkgfSBmcm9tICcuLi9yZWdpc3RyeS5qcyc7XG5cbmNvbnN0IHRhZ3MgPSBbJ0FzayddO1xuY29uc3QgYXV0aCA9IFt7IGJlYXJlckF1dGg6IFtdIH1dO1xuXG4vKipcbiAqIE9wZW5BUEkgZGVmaW5pdGlvbnMgZm9yIHRoZSBcIkFza1wiIGFzc2lzdGFudCBzZXJ2aWNlIChhcGkvYXNrKSwgbW91bnRlZCBhdFxuICogYC9hc2tgLiBBbGwgcm91dGVzIGFyZSBnYXRlZCBieSB0aGUgYGFpX2dlbmVyYXRpb25gIGZlYXR1cmUgYW5kIGFyZSBSRUFEIC9cbiAqIFBST1BPU0Ugb25seSDigJQgdGhlIGFnZW50IG5ldmVyIG11dGF0ZXM7IGBwcm9wb3NlXypgIHRvb2wgcmVzdWx0cyBhcmUgZHJhZnRzIHRoZVxuICogdXNlciBjb25maXJtcyBpbiB0aGUgVUkuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZWdpc3RlckFza1JvdXRlcygpOiB2b2lkIHtcbiAgcmVnaXN0cnkucmVnaXN0ZXJQYXRoKHtcbiAgICBtZXRob2Q6ICdnZXQnLFxuICAgIHBhdGg6ICcvYXNrL3Byb3ZpZGVycycsXG4gICAgc3VtbWFyeTogJ0xpc3QgY29uZmlndXJlZCBBSSBwcm92aWRlcnMnLFxuICAgIGRlc2NyaXB0aW9uOiAnVGhlIEFJIHByb3ZpZGVycy9tb2RlbHMgYXZhaWxhYmxlIHRvIHRoZSBBc2sgYXNzaXN0YW50IChmcm9tIHNlcnZlciBlbnYg4oCUIGNsb3VkIGtleXMgYW5kL29yIHRoZSBPcGVuQUktY29tcGF0aWJsZSBsb2NhbCBlbmRwb2ludCkuJyxcbiAgICB0YWdzLFxuICAgIHNlY3VyaXR5OiBhdXRoLFxuICAgIHJlc3BvbnNlczogeyAyMDA6IHsgZGVzY3JpcHRpb246ICdDb25maWd1cmVkIHByb3ZpZGVycycgfSwgNDAzOiB7IGRlc2NyaXB0aW9uOiAnYWlfZ2VuZXJhdGlvbiBmZWF0dXJlIHJlcXVpcmVkJyB9IH0sXG4gIH0pO1xuXG4gIHJlZ2lzdHJ5LnJlZ2lzdGVyUGF0aCh7XG4gICAgbWV0aG9kOiAncG9zdCcsXG4gICAgcGF0aDogJy9hc2snLFxuICAgIHN1bW1hcnk6ICdHcm91bmRlZCBob3ctdG8gYW5zd2VyIChub24tc3RyZWFtaW5nKScsXG4gICAgZGVzY3JpcHRpb246ICdBbnN3ZXIgYSBwbGF0Zm9ybSBob3ctdG8gcXVlc3Rpb24gZ3JvdW5kZWQgaW4gdGhlIGRvY3MgY29ycHVzLiBSZXNlcnZlcyBvbmUgYWlDYWxscyBxdW90YSBzbG90LicsXG4gICAgdGFncyxcbiAgICBzZWN1cml0eTogYXV0aCxcbiAgICByZXNwb25zZXM6IHtcbiAgICAgIDIwMDogeyBkZXNjcmlwdGlvbjogJ0Fuc3dlciB3aXRoIGdyb3VuZGVkIHNvdXJjZXMnIH0sXG4gICAgICA0MDM6IHsgZGVzY3JpcHRpb246ICdhaV9nZW5lcmF0aW9uIGZlYXR1cmUgcmVxdWlyZWQnIH0sXG4gICAgICA0Mjk6IHsgZGVzY3JpcHRpb246ICdhaUNhbGxzIHF1b3RhIGV4Y2VlZGVkIG9yIHJhdGUgbGltaXRlZCcgfSxcbiAgICB9LFxuICB9KTtcblxuICByZWdpc3RyeS5yZWdpc3RlclBhdGgoe1xuICAgIG1ldGhvZDogJ3Bvc3QnLFxuICAgIHBhdGg6ICcvYXNrL3N0cmVhbScsXG4gICAgc3VtbWFyeTogJ0dyb3VuZGVkIGhvdy10byBhbnN3ZXIgKFNTRSBzdHJlYW0pJyxcbiAgICBkZXNjcmlwdGlvbjogJ1NhbWUgYXMgUE9TVCAvYXNrIGJ1dCBzdHJlYW1zIHRoZSBncm91bmRlZCBzb3VyY2VzIHRoZW4gYW5zd2VyIHRva2VucyBhcyBTZXJ2ZXItU2VudCBFdmVudHMuJyxcbiAgICB0YWdzLFxuICAgIHNlY3VyaXR5OiBhdXRoLFxuICAgIHJlc3BvbnNlczoge1xuICAgICAgMjAwOiB7IGRlc2NyaXB0aW9uOiAndGV4dC9ldmVudC1zdHJlYW0gb2Ygc291cmNlcyArIGFuc3dlciB0b2tlbnMnIH0sXG4gICAgICA0MDM6IHsgZGVzY3JpcHRpb246ICdhaV9nZW5lcmF0aW9uIGZlYXR1cmUgcmVxdWlyZWQnIH0sXG4gICAgICA0Mjk6IHsgZGVzY3JpcHRpb246ICdhaUNhbGxzIHF1b3RhIGV4Y2VlZGVkIG9yIHJhdGUgbGltaXRlZCcgfSxcbiAgICB9LFxuICB9KTtcblxuICByZWdpc3RyeS5yZWdpc3RlclBhdGgoe1xuICAgIG1ldGhvZDogJ3Bvc3QnLFxuICAgIHBhdGg6ICcvYXNrL2FnZW50L3N0cmVhbScsXG4gICAgc3VtbWFyeTogJ1Rvb2wtY2FsbGluZyBBc2sgYWdlbnQgKFNTRSBzdHJlYW0pJyxcbiAgICBkZXNjcmlwdGlvbjogJ1J1bnMgdGhlIHRvb2wtY2FsbGluZyBhc3Npc3RhbnQgbG9vcCBhbmQgc3RyZWFtcyByZWFzb25pbmcgdG9rZW5zLCB0b29sLWNhbGwgZXZlbnRzLCBhbmQgcmV2aWV3YWJsZSBgcHJvcG9zZV8qYCBkcmFmdHMgKHBpcGVsaW5lL3BsdWdpbi90ZW1wbGF0ZSkgYXMgU1NFLiBSZWFkLW9ubHk6IHByb3Bvc2FscyBhcmUgY29uZmlybWVkIHNlcGFyYXRlbHkgaW4gdGhlIFVJLicsXG4gICAgdGFncyxcbiAgICBzZWN1cml0eTogYXV0aCxcbiAgICByZXNwb25zZXM6IHtcbiAgICAgIDIwMDogeyBkZXNjcmlwdGlvbjogJ3RleHQvZXZlbnQtc3RyZWFtIG9mIHRva2VucywgdG9vbC1jYWxscywgYW5kIHByb3Bvc2FsIGRyYWZ0cycgfSxcbiAgICAgIDQwMzogeyBkZXNjcmlwdGlvbjogJ2FpX2dlbmVyYXRpb24gZmVhdHVyZSByZXF1aXJlZCcgfSxcbiAgICAgIDQyOTogeyBkZXNjcmlwdGlvbjogJ2FpQ2FsbHMgcXVvdGEgZXhjZWVkZWQgb3IgcmF0ZSBsaW1pdGVkJyB9LFxuICAgIH0sXG4gIH0pO1xufVxuIl19

package/lib/openapi/routes/billing-routes.d.ts

@@ -0,0 +1 @@
+export declare function registerBillingRoutes(): void;

package/lib/openapi/routes/billing-routes.js

@@ -0,0 +1,66 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { registry } from '../registry.js';
+const tags = ['Billing'];
+const auth = [{ bearerAuth: [] }];
+export function registerBillingRoutes() {
+    registry.registerPath({
+        method: 'get',
+        path: '/billing/plans',
+        summary: 'List active plans',
+        description: 'List all active billing plans. No authentication required.',
+        tags,
+        responses: { 200: { description: 'List of active billing plans' } },
+    });
+    registry.registerPath({
+        method: 'get',
+        path: '/billing/plans/{planId}',
+        summary: 'Get plan by ID',
+        tags,
+        responses: { 200: { description: 'Plan details' }, 404: { description: 'Plan not found' } },
+    });
+    registry.registerPath({
+        method: 'post',
+        path: '/billing/subscriptions',
+        summary: 'Create subscription',
+        description: 'Create a new billing subscription for the current organization.',
+        tags,
+        security: auth,
+        responses: { 201: { description: 'Subscription created' }, 400: { description: 'Validation error' } },
+    });
+    registry.registerPath({
+        method: 'get',
+        path: '/billing/subscriptions',
+        summary: 'List subscriptions',
+        description: 'List billing subscriptions for the current organization.',
+        tags,
+        security: auth,
+        responses: { 200: { description: 'List of subscriptions' } },
+    });
+    registry.registerPath({
+        method: 'put',
+        path: '/billing/subscriptions/{id}',
+        summary: 'Update subscription',
+        tags,
+        security: auth,
+        responses: { 200: { description: 'Subscription updated' }, 404: { description: 'Not found' } },
+    });
+    registry.registerPath({
+        method: 'delete',
+        path: '/billing/subscriptions/{id}',
+        summary: 'Cancel subscription',
+        tags,
+        security: auth,
+        responses: { 200: { description: 'Subscription cancelled' }, 404: { description: 'Not found' } },
+    });
+    registry.registerPath({
+        method: 'post',
+        path: '/billing/marketplace',
+        summary: 'AWS Marketplace integration',
+        description: 'Handle AWS Marketplace subscription events.',
+        tags,
+        security: auth,
+        responses: { 200: { description: 'Marketplace event processed' } },
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYmlsbGluZy1yb3V0ZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvb3BlbmFwaS9yb3V0ZXMvYmlsbGluZy1yb3V0ZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUFFMUMsTUFBTSxJQUFJLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQztBQUN6QixNQUFNLElBQUksR0FBRyxDQUFDLEVBQUUsVUFBVSxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7QUFFbEMsTUFBTSxVQUFVLHFCQUFxQjtJQUNuQyxRQUFRLENBQUMsWUFBWSxDQUFDO1FBQ3BCLE1BQU0sRUFBRSxLQUFLO1FBQ2IsSUFBSSxFQUFFLGdCQUFnQjtRQUN0QixPQUFPLEVBQUUsbUJBQW1CO1FBQzVCLFdBQVcsRUFBRSw0REFBNEQ7UUFDekUsSUFBSTtRQUNKLFNBQVMsRUFBRSxFQUFFLEdBQUcsRUFBRSxFQUFFLFdBQVcsRUFBRSw4QkFBOEIsRUFBRSxFQUFFO0tBQ3BFLENBQUMsQ0FBQztJQUVILFFBQVEsQ0FBQyxZQUFZLENBQUM7UUFDcEIsTUFBTSxFQUFFLEtBQUs7UUFDYixJQUFJLEVBQUUseUJBQXlCO1FBQy9CLE9BQU8sRUFBRSxnQkFBZ0I7UUFDekIsSUFBSTtRQUNKLFNBQVMsRUFBRSxFQUFFLEdBQUcsRUFBRSxFQUFFLFdBQVcsRUFBRSxjQUFjLEVBQUUsRUFBRSxHQUFHLEVBQUUsRUFBRSxXQUFXLEVBQUUsZ0JBQWdCLEVBQUUsRUFBRTtLQUM1RixDQUFDLENBQUM7SUFFSCxRQUFRLENBQUMsWUFBWSxDQUFDO1FBQ3BCLE1BQU0sRUFBRSxNQUFNO1FBQ2QsSUFBSSxFQUFFLHdCQUF3QjtRQUM5QixPQUFPLEVBQUUscUJBQXFCO1FBQzlCLFdBQVcsRUFBRSxpRUFBaUU7UUFDOUUsSUFBSTtRQUNKLFFBQVEsRUFBRSxJQUFJO1FBQ2QsU0FBUyxFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsV0FBVyxFQUFFLHNCQUFzQixFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsV0FBVyxFQUFFLGtCQUFrQixFQUFFLEVBQUU7S0FDdEcsQ0FBQyxDQUFDO0lBRUgsUUFBUSxDQUFDLFlBQVksQ0FBQztRQUNwQixNQUFNLEVBQUUsS0FBSztRQUNiLElBQUksRUFBRSx3QkFBd0I7UUFDOUIsT0FBTyxFQUFFLG9CQUFvQjtRQUM3QixXQUFXLEVBQUUsMERBQTBEO1FBQ3ZFLElBQUk7UUFDSixRQUFRLEVBQUUsSUFBSTtRQUNkLFNBQVMsRUFBRSxFQUFFLEdBQUcsRUFBRSxFQUFFLFdBQVcsRUFBRSx1QkFBdUIsRUFBRSxFQUFFO0tBQzdELENBQUMsQ0FBQztJQUVILFFBQVEsQ0FBQyxZQUFZLENBQUM7UUFDcEIsTUFBTSxFQUFFLEtBQUs7UUFDYixJQUFJLEVBQUUsNkJBQTZCO1FBQ25DLE9BQU8sRUFBRSxxQkFBcUI7UUFDOUIsSUFBSTtRQUNKLFFBQVEsRUFBRSxJQUFJO1FBQ2QsU0FBUyxFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsV0FBVyxFQUFFLHNCQUFzQixFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxFQUFFO0tBQy9GLENBQUMsQ0FBQztJQUVILFFBQVEsQ0FBQyxZQUFZLENBQUM7UUFDcEIsTUFBTSxFQUFFLFFBQVE7UUFDaEIsSUFBSSxFQUFFLDZCQUE2QjtRQUNuQyxPQUFPLEVBQUUscUJBQXFCO1FBQzlCLElBQUk7UUFDSixRQUFRLEVBQUUsSUFBSTtRQUNkLFNBQVMsRUFBRSxFQUFFLEdBQUcsRUFBRSxFQUFFLFdBQVcsRUFBRSx3QkFBd0IsRUFBRSxFQUFFLEdBQUcsRUFBRSxFQUFFLFdBQVcsRUFBRSxXQUFXLEVBQUUsRUFBRTtLQUNqRyxDQUFDLENBQUM7SUFFSCxRQUFRLENBQUMsWUFBWSxDQUFDO1FBQ3BCLE1BQU0sRUFBRSxNQUFNO1FBQ2QsSUFBSSxFQUFFLHNCQUFzQjtRQUM1QixPQUFPLEVBQUUsNkJBQTZCO1FBQ3RDLFdBQVcsRUFBRSw2Q0FBNkM7UUFDMUQsSUFBSTtRQUNKLFFBQVEsRUFBRSxJQUFJO1FBQ2QsU0FBUyxFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsV0FBVyxFQUFFLDZCQUE2QixFQUFFLEVBQUU7S0FDbkUsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgeyByZWdpc3RyeSB9IGZyb20gJy4uL3JlZ2lzdHJ5LmpzJztcblxuY29uc3QgdGFncyA9IFsnQmlsbGluZyddO1xuY29uc3QgYXV0aCA9IFt7IGJlYXJlckF1dGg6IFtdIH1dO1xuXG5leHBvcnQgZnVuY3Rpb24gcmVnaXN0ZXJCaWxsaW5nUm91dGVzKCk6IHZvaWQge1xuICByZWdpc3RyeS5yZWdpc3RlclBhdGgoe1xuICAgIG1ldGhvZDogJ2dldCcsXG4gICAgcGF0aDogJy9iaWxsaW5nL3BsYW5zJyxcbiAgICBzdW1tYXJ5OiAnTGlzdCBhY3RpdmUgcGxhbnMnLFxuICAgIGRlc2NyaXB0aW9uOiAnTGlzdCBhbGwgYWN0aXZlIGJpbGxpbmcgcGxhbnMuIE5vIGF1dGhlbnRpY2F0aW9uIHJlcXVpcmVkLicsXG4gICAgdGFncyxcbiAgICByZXNwb25zZXM6IHsgMjAwOiB7IGRlc2NyaXB0aW9uOiAnTGlzdCBvZiBhY3RpdmUgYmlsbGluZyBwbGFucycgfSB9LFxuICB9KTtcblxuICByZWdpc3RyeS5yZWdpc3RlclBhdGgoe1xuICAgIG1ldGhvZDogJ2dldCcsXG4gICAgcGF0aDogJy9iaWxsaW5nL3BsYW5zL3twbGFuSWR9JyxcbiAgICBzdW1tYXJ5OiAnR2V0IHBsYW4gYnkgSUQnLFxuICAgIHRhZ3MsXG4gICAgcmVzcG9uc2VzOiB7IDIwMDogeyBkZXNjcmlwdGlvbjogJ1BsYW4gZGV0YWlscycgfSwgNDA0OiB7IGRlc2NyaXB0aW9uOiAnUGxhbiBub3QgZm91bmQnIH0gfSxcbiAgfSk7XG5cbiAgcmVnaXN0cnkucmVnaXN0ZXJQYXRoKHtcbiAgICBtZXRob2Q6ICdwb3N0JyxcbiAgICBwYXRoOiAnL2JpbGxpbmcvc3Vic2NyaXB0aW9ucycsXG4gICAgc3VtbWFyeTogJ0NyZWF0ZSBzdWJzY3JpcHRpb24nLFxuICAgIGRlc2NyaXB0aW9uOiAnQ3JlYXRlIGEgbmV3IGJpbGxpbmcgc3Vic2NyaXB0aW9uIGZvciB0aGUgY3VycmVudCBvcmdhbml6YXRpb24uJyxcbiAgICB0YWdzLFxuICAgIHNlY3VyaXR5OiBhdXRoLFxuICAgIHJlc3BvbnNlczogeyAyMDE6IHsgZGVzY3JpcHRpb246ICdTdWJzY3JpcHRpb24gY3JlYXRlZCcgfSwgNDAwOiB7IGRlc2NyaXB0aW9uOiAnVmFsaWRhdGlvbiBlcnJvcicgfSB9LFxuICB9KTtcblxuICByZWdpc3RyeS5yZWdpc3RlclBhdGgoe1xuICAgIG1ldGhvZDogJ2dldCcsXG4gICAgcGF0aDogJy9iaWxsaW5nL3N1YnNjcmlwdGlvbnMnLFxuICAgIHN1bW1hcnk6ICdMaXN0IHN1YnNjcmlwdGlvbnMnLFxuICAgIGRlc2NyaXB0aW9uOiAnTGlzdCBiaWxsaW5nIHN1YnNjcmlwdGlvbnMgZm9yIHRoZSBjdXJyZW50IG9yZ2FuaXphdGlvbi4nLFxuICAgIHRhZ3MsXG4gICAgc2VjdXJpdHk6IGF1dGgsXG4gICAgcmVzcG9uc2VzOiB7IDIwMDogeyBkZXNjcmlwdGlvbjogJ0xpc3Qgb2Ygc3Vic2NyaXB0aW9ucycgfSB9LFxuICB9KTtcblxuICByZWdpc3RyeS5yZWdpc3RlclBhdGgoe1xuICAgIG1ldGhvZDogJ3B1dCcsXG4gICAgcGF0aDogJy9iaWxsaW5nL3N1YnNjcmlwdGlvbnMve2lkfScsXG4gICAgc3VtbWFyeTogJ1VwZGF0ZSBzdWJzY3JpcHRpb24nLFxuICAgIHRhZ3MsXG4gICAgc2VjdXJpdHk6IGF1dGgsXG4gICAgcmVzcG9uc2VzOiB7IDIwMDogeyBkZXNjcmlwdGlvbjogJ1N1YnNjcmlwdGlvbiB1cGRhdGVkJyB9LCA0MDQ6IHsgZGVzY3JpcHRpb246ICdOb3QgZm91bmQnIH0gfSxcbiAgfSk7XG5cbiAgcmVnaXN0cnkucmVnaXN0ZXJQYXRoKHtcbiAgICBtZXRob2Q6ICdkZWxldGUnLFxuICAgIHBhdGg6ICcvYmlsbGluZy9zdWJzY3JpcHRpb25zL3tpZH0nLFxuICAgIHN1bW1hcnk6ICdDYW5jZWwgc3Vic2NyaXB0aW9uJyxcbiAgICB0YWdzLFxuICAgIHNlY3VyaXR5OiBhdXRoLFxuICAgIHJlc3BvbnNlczogeyAyMDA6IHsgZGVzY3JpcHRpb246ICdTdWJzY3JpcHRpb24gY2FuY2VsbGVkJyB9LCA0MDQ6IHsgZGVzY3JpcHRpb246ICdOb3QgZm91bmQnIH0gfSxcbiAgfSk7XG5cbiAgcmVnaXN0cnkucmVnaXN0ZXJQYXRoKHtcbiAgICBtZXRob2Q6ICdwb3N0JyxcbiAgICBwYXRoOiAnL2JpbGxpbmcvbWFya2V0cGxhY2UnLFxuICAgIHN1bW1hcnk6ICdBV1MgTWFya2V0cGxhY2UgaW50ZWdyYXRpb24nLFxuICAgIGRlc2NyaXB0aW9uOiAnSGFuZGxlIEFXUyBNYXJrZXRwbGFjZSBzdWJzY3JpcHRpb24gZXZlbnRzLicsXG4gICAgdGFncyxcbiAgICBzZWN1cml0eTogYXV0aCxcbiAgICByZXNwb25zZXM6IHsgMjAwOiB7IGRlc2NyaXB0aW9uOiAnTWFya2V0cGxhY2UgZXZlbnQgcHJvY2Vzc2VkJyB9IH0sXG4gIH0pO1xufVxuIl19

package/lib/openapi/routes/image-registry-routes.d.ts

@@ -0,0 +1,7 @@
+/**
+ * OpenAPI definitions for the image-registry service (api/image-registry): the
+ * Docker-registry token endpoint (`/token`), the org-scoped image API
+ * (`/api/images`), and the admin API (`/api/admin`). Image read/write is gated by
+ * the `registry:read` / `registry:write` permissions.
+ */
+export declare function registerImageRegistryRoutes(): void;