chore: import upstream snapshot with attribution

apps/sim/app/api/tools/codepipeline/disable-stage-transition/route.ts

@@ -0,0 +1,71 @@
+import {
+  CodePipelineClient,
+  DisableStageTransitionCommand,
+  type StageTransitionType,
+} from '@aws-sdk/client-codepipeline'
+import { createLogger } from '@sim/logger'
+import { toError } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsCodepipelineDisableStageTransitionContract } from '@/lib/api/contracts/tools/aws/codepipeline-disable-stage-transition'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { awsErrorStatus } from '@/app/api/tools/codepipeline/utils'
+
+const logger = createLogger('CodePipelineDisableStageTransition')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsCodepipelineDisableStageTransitionContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info('Disabling CodePipeline stage transition')
+
+    const client = new CodePipelineClient({
+      region: validatedData.region,
+      credentials: {
+        accessKeyId: validatedData.accessKeyId,
+        secretAccessKey: validatedData.secretAccessKey,
+      },
+    })
+
+    try {
+      const command = new DisableStageTransitionCommand({
+        pipelineName: validatedData.pipelineName,
+        stageName: validatedData.stageName,
+        transitionType: validatedData.transitionType as StageTransitionType,
+        reason: validatedData.reason,
+      })
+
+      await client.send(command)
+
+      logger.info('Successfully disabled stage transition')
+
+      return NextResponse.json({
+        success: true,
+        output: {
+          pipelineName: validatedData.pipelineName,
+          stageName: validatedData.stageName,
+          transitionType: validatedData.transitionType,
+        },
+      })
+    } finally {
+      client.destroy()
+    }
+  } catch (error) {
+    logger.error('DisableStageTransition failed', { error: toError(error).message })
+    return NextResponse.json(
+      { error: `Failed to disable CodePipeline stage transition: ${toError(error).message}` },
+      { status: awsErrorStatus(error) }
+    )
+  }
+})

apps/sim/app/api/tools/codepipeline/enable-stage-transition/route.ts

@@ -0,0 +1,70 @@
+import {
+  CodePipelineClient,
+  EnableStageTransitionCommand,
+  type StageTransitionType,
+} from '@aws-sdk/client-codepipeline'
+import { createLogger } from '@sim/logger'
+import { toError } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsCodepipelineEnableStageTransitionContract } from '@/lib/api/contracts/tools/aws/codepipeline-enable-stage-transition'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { awsErrorStatus } from '@/app/api/tools/codepipeline/utils'
+
+const logger = createLogger('CodePipelineEnableStageTransition')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsCodepipelineEnableStageTransitionContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info('Enabling CodePipeline stage transition')
+
+    const client = new CodePipelineClient({
+      region: validatedData.region,
+      credentials: {
+        accessKeyId: validatedData.accessKeyId,
+        secretAccessKey: validatedData.secretAccessKey,
+      },
+    })
+
+    try {
+      const command = new EnableStageTransitionCommand({
+        pipelineName: validatedData.pipelineName,
+        stageName: validatedData.stageName,
+        transitionType: validatedData.transitionType as StageTransitionType,
+      })
+
+      await client.send(command)
+
+      logger.info('Successfully enabled stage transition')
+
+      return NextResponse.json({
+        success: true,
+        output: {
+          pipelineName: validatedData.pipelineName,
+          stageName: validatedData.stageName,
+          transitionType: validatedData.transitionType,
+        },
+      })
+    } finally {
+      client.destroy()
+    }
+  } catch (error) {
+    logger.error('EnableStageTransition failed', { error: toError(error).message })
+    return NextResponse.json(
+      { error: `Failed to enable CodePipeline stage transition: ${toError(error).message}` },
+      { status: awsErrorStatus(error) }
+    )
+  }
+})

apps/sim/app/api/tools/codepipeline/get-pipeline-execution/route.ts

@@ -0,0 +1,87 @@
+import { CodePipelineClient, GetPipelineExecutionCommand } from '@aws-sdk/client-codepipeline'
+import { createLogger } from '@sim/logger'
+import { toError } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsCodepipelineGetPipelineExecutionContract } from '@/lib/api/contracts/tools/aws/codepipeline-get-pipeline-execution'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { awsErrorStatus } from '@/app/api/tools/codepipeline/utils'
+
+const logger = createLogger('CodePipelineGetPipelineExecution')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsCodepipelineGetPipelineExecutionContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info('Getting CodePipeline pipeline execution')
+
+    const client = new CodePipelineClient({
+      region: validatedData.region,
+      credentials: {
+        accessKeyId: validatedData.accessKeyId,
+        secretAccessKey: validatedData.secretAccessKey,
+      },
+    })
+
+    try {
+      const command = new GetPipelineExecutionCommand({
+        pipelineName: validatedData.pipelineName,
+        pipelineExecutionId: validatedData.pipelineExecutionId,
+      })
+
+      const response = await client.send(command)
+      const execution = response.pipelineExecution
+
+      if (!execution) {
+        throw new Error('Pipeline execution not found in response')
+      }
+
+      logger.info('Successfully got pipeline execution')
+
+      return NextResponse.json({
+        success: true,
+        output: {
+          pipelineExecutionId: execution.pipelineExecutionId ?? validatedData.pipelineExecutionId,
+          pipelineName: execution.pipelineName ?? validatedData.pipelineName,
+          pipelineVersion: execution.pipelineVersion,
+          status: execution.status ?? 'Unknown',
+          statusSummary: execution.statusSummary,
+          executionMode: execution.executionMode,
+          executionType: execution.executionType,
+          triggerType: execution.trigger?.triggerType,
+          triggerDetail: execution.trigger?.triggerDetail,
+          artifactRevisions: (execution.artifactRevisions ?? []).map((r) => ({
+            name: r.name ?? '',
+            revisionId: r.revisionId,
+            revisionSummary: r.revisionSummary,
+            revisionUrl: r.revisionUrl,
+            created: r.created?.getTime(),
+          })),
+          variables: (execution.variables ?? []).map((v) => ({
+            name: v.name ?? '',
+            resolvedValue: v.resolvedValue ?? '',
+          })),
+        },
+      })
+    } finally {
+      client.destroy()
+    }
+  } catch (error) {
+    logger.error('GetPipelineExecution failed', { error: toError(error).message })
+    return NextResponse.json(
+      { error: `Failed to get CodePipeline pipeline execution: ${toError(error).message}` },
+      { status: awsErrorStatus(error) }
+    )
+  }
+})

apps/sim/app/api/tools/codepipeline/get-pipeline-state/route.ts

@@ -0,0 +1,84 @@
+import { CodePipelineClient, GetPipelineStateCommand } from '@aws-sdk/client-codepipeline'
+import { createLogger } from '@sim/logger'
+import { toError } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsCodepipelineGetPipelineStateContract } from '@/lib/api/contracts/tools/aws/codepipeline-get-pipeline-state'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { awsErrorStatus } from '@/app/api/tools/codepipeline/utils'
+
+const logger = createLogger('CodePipelineGetPipelineState')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsCodepipelineGetPipelineStateContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info('Getting CodePipeline pipeline state')
+
+    const client = new CodePipelineClient({
+      region: validatedData.region,
+      credentials: {
+        accessKeyId: validatedData.accessKeyId,
+        secretAccessKey: validatedData.secretAccessKey,
+      },
+    })
+
+    try {
+      const command = new GetPipelineStateCommand({ name: validatedData.pipelineName })
+      const response = await client.send(command)
+
+      const stageStates = (response.stageStates ?? []).map((stage) => ({
+        stageName: stage.stageName ?? '',
+        status: stage.latestExecution?.status,
+        pipelineExecutionId: stage.latestExecution?.pipelineExecutionId,
+        inboundTransitionEnabled: stage.inboundTransitionState?.enabled,
+        actionStates: (stage.actionStates ?? []).map((action) => ({
+          actionName: action.actionName ?? '',
+          status: action.latestExecution?.status,
+          summary: action.latestExecution?.summary,
+          lastStatusChange: action.latestExecution?.lastStatusChange?.getTime(),
+          externalExecutionId: action.latestExecution?.externalExecutionId,
+          externalExecutionUrl: action.latestExecution?.externalExecutionUrl,
+          errorCode: action.latestExecution?.errorDetails?.code,
+          errorMessage: action.latestExecution?.errorDetails?.message,
+          percentComplete: action.latestExecution?.percentComplete,
+          token: action.latestExecution?.token,
+          revisionId: action.currentRevision?.revisionId,
+          entityUrl: action.entityUrl,
+        })),
+      }))
+
+      logger.info(`Successfully got pipeline state with ${stageStates.length} stages`)
+
+      return NextResponse.json({
+        success: true,
+        output: {
+          pipelineName: response.pipelineName ?? validatedData.pipelineName,
+          pipelineVersion: response.pipelineVersion,
+          created: response.created?.getTime(),
+          updated: response.updated?.getTime(),
+          stageStates,
+        },
+      })
+    } finally {
+      client.destroy()
+    }
+  } catch (error) {
+    logger.error('GetPipelineState failed', { error: toError(error).message })
+    return NextResponse.json(
+      { error: `Failed to get CodePipeline pipeline state: ${toError(error).message}` },
+      { status: awsErrorStatus(error) }
+    )
+  }
+})

apps/sim/app/api/tools/codepipeline/get-pipeline/route.ts

@@ -0,0 +1,97 @@
+import { CodePipelineClient, GetPipelineCommand } from '@aws-sdk/client-codepipeline'
+import { createLogger } from '@sim/logger'
+import { toError } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsCodepipelineGetPipelineContract } from '@/lib/api/contracts/tools/aws/codepipeline-get-pipeline'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { awsErrorStatus } from '@/app/api/tools/codepipeline/utils'
+
+const logger = createLogger('CodePipelineGetPipeline')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsCodepipelineGetPipelineContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info('Getting CodePipeline pipeline structure')
+
+    const client = new CodePipelineClient({
+      region: validatedData.region,
+      credentials: {
+        accessKeyId: validatedData.accessKeyId,
+        secretAccessKey: validatedData.secretAccessKey,
+      },
+    })
+
+    try {
+      const command = new GetPipelineCommand({
+        name: validatedData.pipelineName,
+        ...(validatedData.version !== undefined && { version: validatedData.version }),
+      })
+      const response = await client.send(command)
+      const pipeline = response.pipeline
+
+      if (!pipeline) {
+        throw new Error('Pipeline structure not found in response')
+      }
+
+      const stages = (pipeline.stages ?? []).map((stage) => ({
+        stageName: stage.name ?? '',
+        actions: (stage.actions ?? []).map((action) => ({
+          name: action.name ?? '',
+          category: action.actionTypeId?.category ?? '',
+          owner: action.actionTypeId?.owner ?? '',
+          provider: action.actionTypeId?.provider ?? '',
+          version: action.actionTypeId?.version ?? '',
+          runOrder: action.runOrder,
+          configuration: action.configuration ?? {},
+          inputArtifacts: (action.inputArtifacts ?? []).map((a) => a.name ?? ''),
+          outputArtifacts: (action.outputArtifacts ?? []).map((a) => a.name ?? ''),
+        })),
+      }))
+
+      logger.info(`Successfully got pipeline structure with ${stages.length} stages`)
+
+      return NextResponse.json({
+        success: true,
+        output: {
+          pipelineName: pipeline.name ?? validatedData.pipelineName,
+          pipelineArn: response.metadata?.pipelineArn,
+          roleArn: pipeline.roleArn ?? '',
+          version: pipeline.version,
+          pipelineType: pipeline.pipelineType,
+          executionMode: pipeline.executionMode,
+          artifactStoreType: pipeline.artifactStore?.type,
+          artifactStoreLocation: pipeline.artifactStore?.location,
+          stages,
+          variables: (pipeline.variables ?? []).map((v) => ({
+            name: v.name ?? '',
+            defaultValue: v.defaultValue,
+            description: v.description,
+          })),
+          created: response.metadata?.created?.getTime(),
+          updated: response.metadata?.updated?.getTime(),
+        },
+      })
+    } finally {
+      client.destroy()
+    }
+  } catch (error) {
+    logger.error('GetPipeline failed', { error: toError(error).message })
+    return NextResponse.json(
+      { error: `Failed to get CodePipeline pipeline: ${toError(error).message}` },
+      { status: awsErrorStatus(error) }
+    )
+  }
+})

apps/sim/app/api/tools/codepipeline/list-action-executions/route.ts

@@ -0,0 +1,85 @@
+import { CodePipelineClient, ListActionExecutionsCommand } from '@aws-sdk/client-codepipeline'
+import { createLogger } from '@sim/logger'
+import { toError } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsCodepipelineListActionExecutionsContract } from '@/lib/api/contracts/tools/aws/codepipeline-list-action-executions'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { awsErrorStatus } from '@/app/api/tools/codepipeline/utils'
+
+const logger = createLogger('CodePipelineListActionExecutions')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsCodepipelineListActionExecutionsContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info('Listing CodePipeline action executions')
+
+    const client = new CodePipelineClient({
+      region: validatedData.region,
+      credentials: {
+        accessKeyId: validatedData.accessKeyId,
+        secretAccessKey: validatedData.secretAccessKey,
+      },
+    })
+
+    try {
+      const command = new ListActionExecutionsCommand({
+        pipelineName: validatedData.pipelineName,
+        ...(validatedData.pipelineExecutionId && {
+          filter: { pipelineExecutionId: validatedData.pipelineExecutionId },
+        }),
+        ...(validatedData.maxResults !== undefined && { maxResults: validatedData.maxResults }),
+        ...(validatedData.nextToken && { nextToken: validatedData.nextToken }),
+      })
+
+      const response = await client.send(command)
+
+      const actionExecutionDetails = (response.actionExecutionDetails ?? []).map((d) => ({
+        pipelineExecutionId: d.pipelineExecutionId,
+        actionExecutionId: d.actionExecutionId,
+        pipelineVersion: d.pipelineVersion,
+        stageName: d.stageName,
+        actionName: d.actionName,
+        startTime: d.startTime?.getTime(),
+        lastUpdateTime: d.lastUpdateTime?.getTime(),
+        updatedBy: d.updatedBy,
+        status: d.status,
+        externalExecutionId: d.output?.executionResult?.externalExecutionId,
+        externalExecutionSummary: d.output?.executionResult?.externalExecutionSummary,
+        externalExecutionUrl: d.output?.executionResult?.externalExecutionUrl,
+        errorCode: d.output?.executionResult?.errorDetails?.code,
+        errorMessage: d.output?.executionResult?.errorDetails?.message,
+      }))
+
+      logger.info(`Successfully listed ${actionExecutionDetails.length} action executions`)
+
+      return NextResponse.json({
+        success: true,
+        output: {
+          actionExecutionDetails,
+          ...(response.nextToken && { nextToken: response.nextToken }),
+        },
+      })
+    } finally {
+      client.destroy()
+    }
+  } catch (error) {
+    logger.error('ListActionExecutions failed', { error: toError(error).message })
+    return NextResponse.json(
+      { error: `Failed to list CodePipeline action executions: ${toError(error).message}` },
+      { status: awsErrorStatus(error) }
+    )
+  }
+})

apps/sim/app/api/tools/codepipeline/list-pipeline-executions/route.ts

@@ -0,0 +1,88 @@
+import { CodePipelineClient, ListPipelineExecutionsCommand } from '@aws-sdk/client-codepipeline'
+import { createLogger } from '@sim/logger'
+import { toError } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsCodepipelineListPipelineExecutionsContract } from '@/lib/api/contracts/tools/aws/codepipeline-list-pipeline-executions'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { awsErrorStatus } from '@/app/api/tools/codepipeline/utils'
+
+const logger = createLogger('CodePipelineListPipelineExecutions')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsCodepipelineListPipelineExecutionsContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info('Listing CodePipeline pipeline executions')
+
+    const client = new CodePipelineClient({
+      region: validatedData.region,
+      credentials: {
+        accessKeyId: validatedData.accessKeyId,
+        secretAccessKey: validatedData.secretAccessKey,
+      },
+    })
+
+    try {
+      const command = new ListPipelineExecutionsCommand({
+        pipelineName: validatedData.pipelineName,
+        ...(validatedData.maxResults !== undefined && { maxResults: validatedData.maxResults }),
+        ...(validatedData.nextToken && { nextToken: validatedData.nextToken }),
+        ...(validatedData.succeededInStage && {
+          filter: { succeededInStage: { stageName: validatedData.succeededInStage } },
+        }),
+      })
+
+      const response = await client.send(command)
+
+      const executions = (response.pipelineExecutionSummaries ?? []).map((e) => ({
+        pipelineExecutionId: e.pipelineExecutionId ?? '',
+        status: e.status ?? 'Unknown',
+        statusSummary: e.statusSummary,
+        startTime: e.startTime?.getTime(),
+        lastUpdateTime: e.lastUpdateTime?.getTime(),
+        executionMode: e.executionMode,
+        executionType: e.executionType,
+        stopTriggerReason: e.stopTrigger?.reason,
+        triggerType: e.trigger?.triggerType,
+        triggerDetail: e.trigger?.triggerDetail,
+        rollbackTargetPipelineExecutionId: e.rollbackMetadata?.rollbackTargetPipelineExecutionId,
+        sourceRevisions: (e.sourceRevisions ?? []).map((r) => ({
+          actionName: r.actionName ?? '',
+          revisionId: r.revisionId,
+          revisionSummary: r.revisionSummary,
+          revisionUrl: r.revisionUrl,
+        })),
+      }))
+
+      logger.info(`Successfully listed ${executions.length} pipeline executions`)
+
+      return NextResponse.json({
+        success: true,
+        output: {
+          executions,
+          ...(response.nextToken && { nextToken: response.nextToken }),
+        },
+      })
+    } finally {
+      client.destroy()
+    }
+  } catch (error) {
+    logger.error('ListPipelineExecutions failed', { error: toError(error).message })
+    return NextResponse.json(
+      { error: `Failed to list CodePipeline pipeline executions: ${toError(error).message}` },
+      { status: awsErrorStatus(error) }
+    )
+  }
+})

apps/sim/app/api/tools/codepipeline/list-pipelines/route.ts

@@ -0,0 +1,73 @@
+import { CodePipelineClient, ListPipelinesCommand } from '@aws-sdk/client-codepipeline'
+import { createLogger } from '@sim/logger'
+import { toError } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsCodepipelineListPipelinesContract } from '@/lib/api/contracts/tools/aws/codepipeline-list-pipelines'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { awsErrorStatus } from '@/app/api/tools/codepipeline/utils'
+
+const logger = createLogger('CodePipelineListPipelines')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsCodepipelineListPipelinesContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info('Listing CodePipeline pipelines')
+
+    const client = new CodePipelineClient({
+      region: validatedData.region,
+      credentials: {
+        accessKeyId: validatedData.accessKeyId,
+        secretAccessKey: validatedData.secretAccessKey,
+      },
+    })
+
+    try {
+      const command = new ListPipelinesCommand({
+        ...(validatedData.maxResults !== undefined && { maxResults: validatedData.maxResults }),
+        ...(validatedData.nextToken && { nextToken: validatedData.nextToken }),
+      })
+
+      const response = await client.send(command)
+
+      const pipelines = (response.pipelines ?? []).map((p) => ({
+        name: p.name ?? '',
+        version: p.version,
+        pipelineType: p.pipelineType,
+        executionMode: p.executionMode,
+        created: p.created?.getTime(),
+        updated: p.updated?.getTime(),
+      }))
+
+      logger.info(`Successfully listed ${pipelines.length} pipelines`)
+
+      return NextResponse.json({
+        success: true,
+        output: {
+          pipelines,
+          ...(response.nextToken && { nextToken: response.nextToken }),
+        },
+      })
+    } finally {
+      client.destroy()
+    }
+  } catch (error) {
+    logger.error('ListPipelines failed', { error: toError(error).message })
+    return NextResponse.json(
+      { error: `Failed to list CodePipeline pipelines: ${toError(error).message}` },
+      { status: awsErrorStatus(error) }
+    )
+  }
+})

apps/sim/app/api/tools/codepipeline/put-approval-result/route.ts

@@ -0,0 +1,74 @@
+import {
+  type ApprovalStatus,
+  CodePipelineClient,
+  PutApprovalResultCommand,
+} from '@aws-sdk/client-codepipeline'
+import { createLogger } from '@sim/logger'
+import { toError } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsCodepipelinePutApprovalResultContract } from '@/lib/api/contracts/tools/aws/codepipeline-put-approval-result'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { awsErrorStatus } from '@/app/api/tools/codepipeline/utils'
+
+const logger = createLogger('CodePipelinePutApprovalResult')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsCodepipelinePutApprovalResultContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info('Submitting CodePipeline approval result')
+
+    const client = new CodePipelineClient({
+      region: validatedData.region,
+      credentials: {
+        accessKeyId: validatedData.accessKeyId,
+        secretAccessKey: validatedData.secretAccessKey,
+      },
+    })
+
+    try {
+      const command = new PutApprovalResultCommand({
+        pipelineName: validatedData.pipelineName,
+        stageName: validatedData.stageName,
+        actionName: validatedData.actionName,
+        token: validatedData.token,
+        result: {
+          status: validatedData.status as ApprovalStatus,
+          summary: validatedData.summary,
+        },
+      })
+
+      const response = await client.send(command)
+
+      logger.info('Successfully submitted approval result')
+
+      return NextResponse.json({
+        success: true,
+        output: {
+          approvedAt: response.approvedAt?.getTime(),
+          status: validatedData.status,
+        },
+      })
+    } finally {
+      client.destroy()
+    }
+  } catch (error) {
+    logger.error('PutApprovalResult failed', { error: toError(error).message })
+    return NextResponse.json(
+      { error: `Failed to submit CodePipeline approval result: ${toError(error).message}` },
+      { status: awsErrorStatus(error) }
+    )
+  }
+})

apps/sim/app/api/tools/codepipeline/retry-stage-execution/route.ts

@@ -0,0 +1,69 @@
+import {
+  CodePipelineClient,
+  RetryStageExecutionCommand,
+  type StageRetryMode,
+} from '@aws-sdk/client-codepipeline'
+import { createLogger } from '@sim/logger'
+import { toError } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsCodepipelineRetryStageExecutionContract } from '@/lib/api/contracts/tools/aws/codepipeline-retry-stage-execution'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { awsErrorStatus } from '@/app/api/tools/codepipeline/utils'
+
+const logger = createLogger('CodePipelineRetryStageExecution')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsCodepipelineRetryStageExecutionContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info('Retrying CodePipeline stage execution')
+
+    const client = new CodePipelineClient({
+      region: validatedData.region,
+      credentials: {
+        accessKeyId: validatedData.accessKeyId,
+        secretAccessKey: validatedData.secretAccessKey,
+      },
+    })
+
+    try {
+      const command = new RetryStageExecutionCommand({
+        pipelineName: validatedData.pipelineName,
+        stageName: validatedData.stageName,
+        pipelineExecutionId: validatedData.pipelineExecutionId,
+        retryMode: validatedData.retryMode as StageRetryMode,
+      })
+
+      const response = await client.send(command)
+
+      logger.info('Successfully retried stage execution')
+
+      return NextResponse.json({
+        success: true,
+        output: {
+          pipelineExecutionId: response.pipelineExecutionId ?? validatedData.pipelineExecutionId,
+        },
+      })
+    } finally {
+      client.destroy()
+    }
+  } catch (error) {
+    logger.error('RetryStageExecution failed', { error: toError(error).message })
+    return NextResponse.json(
+      { error: `Failed to retry CodePipeline stage execution: ${toError(error).message}` },
+      { status: awsErrorStatus(error) }
+    )
+  }
+})

apps/sim/app/api/tools/codepipeline/start-execution/route.ts

@@ -0,0 +1,69 @@
+import { CodePipelineClient, StartPipelineExecutionCommand } from '@aws-sdk/client-codepipeline'
+import { createLogger } from '@sim/logger'
+import { toError } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsCodepipelineStartExecutionContract } from '@/lib/api/contracts/tools/aws/codepipeline-start-execution'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { awsErrorStatus } from '@/app/api/tools/codepipeline/utils'
+
+const logger = createLogger('CodePipelineStartExecution')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsCodepipelineStartExecutionContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info('Starting CodePipeline pipeline execution')
+
+    const client = new CodePipelineClient({
+      region: validatedData.region,
+      credentials: {
+        accessKeyId: validatedData.accessKeyId,
+        secretAccessKey: validatedData.secretAccessKey,
+      },
+    })
+
+    try {
+      const command = new StartPipelineExecutionCommand({
+        name: validatedData.pipelineName,
+        ...(validatedData.clientRequestToken && {
+          clientRequestToken: validatedData.clientRequestToken,
+        }),
+        ...(validatedData.variables &&
+          validatedData.variables.length > 0 && { variables: validatedData.variables }),
+      })
+
+      const response = await client.send(command)
+
+      if (!response.pipelineExecutionId) {
+        throw new Error('No pipeline execution ID returned')
+      }
+
+      logger.info('Successfully started pipeline execution')
+
+      return NextResponse.json({
+        success: true,
+        output: { pipelineExecutionId: response.pipelineExecutionId },
+      })
+    } finally {
+      client.destroy()
+    }
+  } catch (error) {
+    logger.error('StartPipelineExecution failed', { error: toError(error).message })
+    return NextResponse.json(
+      { error: `Failed to start CodePipeline pipeline execution: ${toError(error).message}` },
+      { status: awsErrorStatus(error) }
+    )
+  }
+})

apps/sim/app/api/tools/codepipeline/stop-execution/route.ts

@@ -0,0 +1,65 @@
+import { CodePipelineClient, StopPipelineExecutionCommand } from '@aws-sdk/client-codepipeline'
+import { createLogger } from '@sim/logger'
+import { toError } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsCodepipelineStopExecutionContract } from '@/lib/api/contracts/tools/aws/codepipeline-stop-execution'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { awsErrorStatus } from '@/app/api/tools/codepipeline/utils'
+
+const logger = createLogger('CodePipelineStopExecution')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsCodepipelineStopExecutionContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info('Stopping CodePipeline pipeline execution')
+
+    const client = new CodePipelineClient({
+      region: validatedData.region,
+      credentials: {
+        accessKeyId: validatedData.accessKeyId,
+        secretAccessKey: validatedData.secretAccessKey,
+      },
+    })
+
+    try {
+      const command = new StopPipelineExecutionCommand({
+        pipelineName: validatedData.pipelineName,
+        pipelineExecutionId: validatedData.pipelineExecutionId,
+        ...(validatedData.abandon !== undefined && { abandon: validatedData.abandon }),
+        ...(validatedData.reason && { reason: validatedData.reason }),
+      })
+
+      const response = await client.send(command)
+
+      logger.info('Successfully stopped pipeline execution')
+
+      return NextResponse.json({
+        success: true,
+        output: {
+          pipelineExecutionId: response.pipelineExecutionId ?? validatedData.pipelineExecutionId,
+        },
+      })
+    } finally {
+      client.destroy()
+    }
+  } catch (error) {
+    logger.error('StopPipelineExecution failed', { error: toError(error).message })
+    return NextResponse.json(
+      { error: `Failed to stop CodePipeline pipeline execution: ${toError(error).message}` },
+      { status: awsErrorStatus(error) }
+    )
+  }
+})

apps/sim/app/api/tools/codepipeline/utils.ts

@@ -0,0 +1,10 @@
+/**
+ * Maps an AWS SDK error to a response status. Client faults (e.g.
+ * PipelineNotFoundException, InvalidApprovalTokenException) keep the 4xx
+ * status AWS reports via `$metadata`; everything else maps to 500.
+ */
+export function awsErrorStatus(error: unknown): number {
+  const status = (error as { $metadata?: { httpStatusCode?: number } } | null)?.$metadata
+    ?.httpStatusCode
+  return typeof status === 'number' && status >= 400 && status < 500 ? status : 500
+}