Validation ordering

Keep request processing explicit:

1. Apply transport/body size limits and parse the accepted content type.
2. Authenticate and establish authorized request/tenant context as appropriate.
3. Validate structure, required fields and field constraints.
4. Await cross-field and external business checks.
5. Perform authorized effects inside the appropriate transaction.
6. Encode the response for its output context.

Use controller schemas with the Express adapter, or the public validationMiddleware in a correctly populated HTTP pipeline. Check the pipeline result's success/error fields before treating an operation as successful.

Do not confuse the internal legacy ValidationPipeline type export with a public runtime constructor. AISanitizer is not exported; generic string sanitization is not a replacement for parameterized SQL or context-specific HTML/URL encoding.

See async validation, errors and production composition.