@alpic-ai/api 0.0.0-dev.gd514aa3 → 0.0.0-dev.gd960912

package/dist/index.d.mts

@@ -29,7 +29,7 @@ declare const createEnvironmentContractV1: _$_orpc_contract0.ContractProcedureBu
   id: z.ZodString;
   name: z.ZodString;
   sourceBranch: z.ZodNullable<z.ZodString>;
-  urls: z.ZodArray<z.ZodString>;
+  urls: z.ZodArray<z.ZodURL>;
   createdAt: z.ZodCoercedDate<unknown>;
   projectId: z.ZodString;
 }, z.core.$strip>, _$_orpc_contract0.MergedErrorMap<Record<never, never>, {
@@ -165,7 +165,10 @@ declare const contract: {
         uploadUrl: z.ZodURL;
         token: z.ZodString;
         expiresAt: z.ZodCoercedDate<unknown>;
-      }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+      }, z.core.$strip>, _$_orpc_contract0.MergedErrorMap<Record<never, never>, {
+        NOT_FOUND: {};
+        BAD_REQUEST: {};
+      }>, Record<never, never>>;
     };
     getLogs: {
       v1: _$_orpc_contract0.ContractProcedureBuilderWithInputOutput<z.ZodObject<{
@@ -196,7 +199,7 @@ declare const contract: {
         id: z.ZodString;
         name: z.ZodString;
         sourceBranch: z.ZodNullable<z.ZodString>;
-        urls: z.ZodArray<z.ZodString>;
+        urls: z.ZodArray<z.ZodURL>;
         createdAt: z.ZodCoercedDate<unknown>;
         projectId: z.ZodString;
       }, z.core.$strip>, _$_orpc_contract0.MergedErrorMap<Record<never, never>, {
@@ -365,6 +368,7 @@ declare const contract: {
         success: z.ZodLiteral<true>;
       }, z.core.$strip>, _$_orpc_contract0.MergedErrorMap<Record<never, never>, {
         NOT_FOUND: {};
+        BAD_REQUEST: {};
       }>, Record<never, never>>;
     };
   };
@@ -593,7 +597,10 @@ declare const contract: {
             completedAt: z.ZodNullable<z.ZodCoercedDate<unknown>>;
           }, z.core.$strip>>;
         }, z.core.$strip>>;
-      }, z.core.$strip>>, Record<never, never>, Record<never, never>>;
+      }, z.core.$strip>>, _$_orpc_contract0.MergedErrorMap<Record<never, never>, {
+        NOT_FOUND: {};
+        BAD_REQUEST: {};
+      }>, Record<never, never>>;
     };
     create: {
       v1: _$_orpc_contract0.ContractProcedureBuilderWithInputOutput<z.ZodObject<{
@@ -737,7 +744,9 @@ declare const contract: {
         subdomain: z.ZodString;
         ticket: z.ZodString;
         tunnelHost: z.ZodString;
-      }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+      }, z.core.$strip>, _$_orpc_contract0.MergedErrorMap<Record<never, never>, {
+        FORBIDDEN: {};
+      }>, Record<never, never>>;
     };
   };
   distribution: {

package/dist/index.mjs

@@ -1,6 +1,174 @@
 import { z } from "zod";
+import * as z$1 from "zod/v4";
 import { oc } from "@orpc/contract";
 import ms from "ms";
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_@cfworker+json-schema@4.1.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
+/**
+* Reusable URL validation that disallows javascript: scheme
+*/
+const SafeUrlSchema = z$1.url().superRefine((val, ctx) => {
+	if (!URL.canParse(val)) {
+		ctx.addIssue({
+			code: z$1.ZodIssueCode.custom,
+			message: "URL must be parseable",
+			fatal: true
+		});
+		return z$1.NEVER;
+	}
+}).refine((url) => {
+	const u = new URL(url);
+	return u.protocol !== "javascript:" && u.protocol !== "data:" && u.protocol !== "vbscript:";
+}, { message: "URL cannot use javascript:, data:, or vbscript: scheme" });
+/**
+* RFC 9728 OAuth Protected Resource Metadata
+*/
+const OAuthProtectedResourceMetadataSchema = z$1.looseObject({
+	resource: z$1.string().url(),
+	authorization_servers: z$1.array(SafeUrlSchema).optional(),
+	jwks_uri: z$1.string().url().optional(),
+	scopes_supported: z$1.array(z$1.string()).optional(),
+	bearer_methods_supported: z$1.array(z$1.string()).optional(),
+	resource_signing_alg_values_supported: z$1.array(z$1.string()).optional(),
+	resource_name: z$1.string().optional(),
+	resource_documentation: z$1.string().optional(),
+	resource_policy_uri: z$1.string().url().optional(),
+	resource_tos_uri: z$1.string().url().optional(),
+	tls_client_certificate_bound_access_tokens: z$1.boolean().optional(),
+	authorization_details_types_supported: z$1.array(z$1.string()).optional(),
+	dpop_signing_alg_values_supported: z$1.array(z$1.string()).optional(),
+	dpop_bound_access_tokens_required: z$1.boolean().optional()
+});
+/**
+* RFC 8414 OAuth 2.0 Authorization Server Metadata
+*/
+const OAuthMetadataSchema = z$1.looseObject({
+	issuer: z$1.string(),
+	authorization_endpoint: SafeUrlSchema,
+	token_endpoint: SafeUrlSchema,
+	registration_endpoint: SafeUrlSchema.optional(),
+	scopes_supported: z$1.array(z$1.string()).optional(),
+	response_types_supported: z$1.array(z$1.string()),
+	response_modes_supported: z$1.array(z$1.string()).optional(),
+	grant_types_supported: z$1.array(z$1.string()).optional(),
+	token_endpoint_auth_methods_supported: z$1.array(z$1.string()).optional(),
+	token_endpoint_auth_signing_alg_values_supported: z$1.array(z$1.string()).optional(),
+	service_documentation: SafeUrlSchema.optional(),
+	revocation_endpoint: SafeUrlSchema.optional(),
+	revocation_endpoint_auth_methods_supported: z$1.array(z$1.string()).optional(),
+	revocation_endpoint_auth_signing_alg_values_supported: z$1.array(z$1.string()).optional(),
+	introspection_endpoint: z$1.string().optional(),
+	introspection_endpoint_auth_methods_supported: z$1.array(z$1.string()).optional(),
+	introspection_endpoint_auth_signing_alg_values_supported: z$1.array(z$1.string()).optional(),
+	code_challenge_methods_supported: z$1.array(z$1.string()).optional(),
+	client_id_metadata_document_supported: z$1.boolean().optional()
+});
+/**
+* OpenID Connect Discovery 1.0 Provider Metadata
+* see: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
+*/
+const OpenIdProviderMetadataSchema = z$1.looseObject({
+	issuer: z$1.string(),
+	authorization_endpoint: SafeUrlSchema,
+	token_endpoint: SafeUrlSchema,
+	userinfo_endpoint: SafeUrlSchema.optional(),
+	jwks_uri: SafeUrlSchema,
+	registration_endpoint: SafeUrlSchema.optional(),
+	scopes_supported: z$1.array(z$1.string()).optional(),
+	response_types_supported: z$1.array(z$1.string()),
+	response_modes_supported: z$1.array(z$1.string()).optional(),
+	grant_types_supported: z$1.array(z$1.string()).optional(),
+	acr_values_supported: z$1.array(z$1.string()).optional(),
+	subject_types_supported: z$1.array(z$1.string()),
+	id_token_signing_alg_values_supported: z$1.array(z$1.string()),
+	id_token_encryption_alg_values_supported: z$1.array(z$1.string()).optional(),
+	id_token_encryption_enc_values_supported: z$1.array(z$1.string()).optional(),
+	userinfo_signing_alg_values_supported: z$1.array(z$1.string()).optional(),
+	userinfo_encryption_alg_values_supported: z$1.array(z$1.string()).optional(),
+	userinfo_encryption_enc_values_supported: z$1.array(z$1.string()).optional(),
+	request_object_signing_alg_values_supported: z$1.array(z$1.string()).optional(),
+	request_object_encryption_alg_values_supported: z$1.array(z$1.string()).optional(),
+	request_object_encryption_enc_values_supported: z$1.array(z$1.string()).optional(),
+	token_endpoint_auth_methods_supported: z$1.array(z$1.string()).optional(),
+	token_endpoint_auth_signing_alg_values_supported: z$1.array(z$1.string()).optional(),
+	display_values_supported: z$1.array(z$1.string()).optional(),
+	claim_types_supported: z$1.array(z$1.string()).optional(),
+	claims_supported: z$1.array(z$1.string()).optional(),
+	service_documentation: z$1.string().optional(),
+	claims_locales_supported: z$1.array(z$1.string()).optional(),
+	ui_locales_supported: z$1.array(z$1.string()).optional(),
+	claims_parameter_supported: z$1.boolean().optional(),
+	request_parameter_supported: z$1.boolean().optional(),
+	request_uri_parameter_supported: z$1.boolean().optional(),
+	require_request_uri_registration: z$1.boolean().optional(),
+	op_policy_uri: SafeUrlSchema.optional(),
+	op_tos_uri: SafeUrlSchema.optional(),
+	client_id_metadata_document_supported: z$1.boolean().optional()
+});
+/**
+* OpenID Connect Discovery metadata that may include OAuth 2.0 fields
+* This schema represents the real-world scenario where OIDC providers
+* return a mix of OpenID Connect and OAuth 2.0 metadata fields
+*/
+const OpenIdProviderDiscoveryMetadataSchema = z$1.object({
+	...OpenIdProviderMetadataSchema.shape,
+	...OAuthMetadataSchema.pick({ code_challenge_methods_supported: true }).shape
+});
+z$1.object({
+	access_token: z$1.string(),
+	id_token: z$1.string().optional(),
+	token_type: z$1.string(),
+	expires_in: z$1.coerce.number().optional(),
+	scope: z$1.string().optional(),
+	refresh_token: z$1.string().optional()
+}).strip();
+z$1.object({
+	error: z$1.string(),
+	error_description: z$1.string().optional(),
+	error_uri: z$1.string().optional()
+});
+/**
+* Optional version of SafeUrlSchema that allows empty string for retrocompatibility on tos_uri and logo_uri
+*/
+const OptionalSafeUrlSchema = SafeUrlSchema.optional().or(z$1.literal("").transform(() => void 0));
+/**
+* RFC 7591 OAuth 2.0 Dynamic Client Registration metadata
+*/
+const OAuthClientMetadataSchema = z$1.object({
+	redirect_uris: z$1.array(SafeUrlSchema),
+	token_endpoint_auth_method: z$1.string().optional(),
+	grant_types: z$1.array(z$1.string()).optional(),
+	response_types: z$1.array(z$1.string()).optional(),
+	client_name: z$1.string().optional(),
+	client_uri: SafeUrlSchema.optional(),
+	logo_uri: OptionalSafeUrlSchema,
+	scope: z$1.string().optional(),
+	contacts: z$1.array(z$1.string()).optional(),
+	tos_uri: OptionalSafeUrlSchema,
+	policy_uri: z$1.string().optional(),
+	jwks_uri: SafeUrlSchema.optional(),
+	jwks: z$1.any().optional(),
+	software_id: z$1.string().optional(),
+	software_version: z$1.string().optional(),
+	software_statement: z$1.string().optional()
+}).strip();
+/**
+* RFC 7591 OAuth 2.0 Dynamic Client Registration client information
+*/
+const OAuthClientInformationSchema = z$1.object({
+	client_id: z$1.string(),
+	client_secret: z$1.string().optional(),
+	client_id_issued_at: z$1.number().optional(),
+	client_secret_expires_at: z$1.number().optional()
+}).strip();
+OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);
+z$1.object({
+	error: z$1.string(),
+	error_description: z$1.string().optional()
+}).strip();
+z$1.object({
+	token: z$1.string(),
+	token_type_hint: z$1.string().optional()
+}).strip();
 const platformSchema = z.enum(["chatgpt", "claudeai"]);
 const PLATFORM_LABELS = {
 	chatgpt: "ChatGPT",
@@ -71,6 +239,13 @@ const auditReportWithScreenshotsSchema = auditReportSchema.extend({ widgetScreen
 	chatgpt: widgetScreenshotSchema.optional(),
 	claudeai: widgetScreenshotSchema.optional()
 }) });
+z.object({
+	id: z.string(),
+	environmentId: z.string(),
+	clientId: z.string(),
+	clientSecret: z.string(),
+	clientScopes: z.array(z.string())
+});
 const deploymentStatusSchema$1 = z.enum([
 	"ongoing",
 	"deployed",
@@ -98,6 +273,74 @@ const deploymentSummarySchema = z.object({
 	createdAt: z.coerce.date(),
 	updatedAt: z.coerce.date()
 });
+/**
+* Public environment
+*
+* No OAuth metadata exposed.
+*/
+const publicEnvironmentSchema = z.object({
+	isPublic: z.literal(true),
+	oAuthMetadata: z.undefined().optional()
+});
+/**
+* Protected environment with an external resource metadata URL
+*
+* An external resource metadata URL is returned in the WWW-Authenticate header during the first 401 response.
+* Everything that follows is handled outside of the MCP server scope.
+*/
+const externalResourceMetadataEnvironmentSchema = z.object({
+	isPublic: z.literal(false),
+	oAuthMetadata: z.object({ externalResourceMetadataUrl: z.url() }),
+	scope: z.string().optional()
+});
+/**
+* Protected environment with an external authorization server URL
+*
+* The server itself exposes the /.well-known/oauth-protected-resource endpoint.
+* An external authorization server URL is returned when requesting the endpoint.
+* Everything that follows is handled outside of the MCP server scope.
+*/
+const externalAuthorizationServerEnvironmentSchema = z.object({
+	isPublic: z.literal(false),
+	oAuthMetadata: z.object({
+		externalAuthorizationServerUrl: z.url(),
+		resourceMetadata: OAuthProtectedResourceMetadataSchema.optional()
+	}),
+	scope: z.string().optional()
+});
+/**
+* Standalone protected environment
+*
+* The server itself exposes the /.well-known/oauth-protected-resource endpoint.
+* The server itself exposes the /.well-known/oauth-authorization-server endpoint.
+*/
+const standaloneEnvironmentSchema = z.object({
+	isPublic: z.literal(false),
+	oAuthMetadata: z.object({
+		authorizationServerMetadata: z.union([OAuthMetadataSchema, OpenIdProviderDiscoveryMetadataSchema]),
+		resourceMetadata: OAuthProtectedResourceMetadataSchema.optional()
+	}),
+	scope: z.string().optional()
+});
+/**
+* Protected environment without OAuth discovery
+*
+* The server enforces authentication but exposes no OAuth discovery metadata.
+* Neither /.well-known/oauth-protected-resource nor /.well-known/oauth-authorization-server
+* are advertised. Clients must obtain credentials out-of-band.
+*/
+const protectedWithoutDiscoveryEnvironmentSchema = z.object({
+	isPublic: z.literal(false),
+	oAuthMetadata: z.strictObject({}),
+	scope: z.string().optional()
+});
+z.union([
+	publicEnvironmentSchema,
+	externalResourceMetadataEnvironmentSchema,
+	externalAuthorizationServerEnvironmentSchema,
+	standaloneEnvironmentSchema,
+	protectedWithoutDiscoveryEnvironmentSchema
+]);
 const allowedPlatformSchema = platformSchema;
 const environmentDomainSchema = z.object({
 	domain: z.string(),
@@ -351,7 +594,292 @@ const chatgptCategorySchema = z.enum([
 	"TRAVEL"
 ]);
 const chatgptAuthenticationSchema = z.enum(["No auth needed", "OAuth 2.0"]);
-const chatgptAllowedCountriesSchema = z.enum(["Allow all", "Restrict to specific countries"]);
+const chatgptCountryCodeSchema = z.enum([
+	"AD",
+	"AE",
+	"AF",
+	"AG",
+	"AL",
+	"AM",
+	"AO",
+	"AR",
+	"AT",
+	"AU",
+	"AW",
+	"AX",
+	"AZ",
+	"BA",
+	"BB",
+	"BD",
+	"BE",
+	"BF",
+	"BG",
+	"BH",
+	"BI",
+	"BJ",
+	"BL",
+	"BM",
+	"BN",
+	"BO",
+	"BR",
+	"BS",
+	"BT",
+	"BW",
+	"BZ",
+	"CA",
+	"CD",
+	"CF",
+	"CG",
+	"CH",
+	"CI",
+	"CL",
+	"CM",
+	"CO",
+	"CR",
+	"CV",
+	"CY",
+	"CZ",
+	"DE",
+	"DJ",
+	"DK",
+	"DM",
+	"DO",
+	"DZ",
+	"EC",
+	"EE",
+	"EG",
+	"ER",
+	"ES",
+	"ET",
+	"FI",
+	"FJ",
+	"FM",
+	"FO",
+	"FR",
+	"GA",
+	"GB",
+	"GD",
+	"GE",
+	"GF",
+	"GH",
+	"GL",
+	"GM",
+	"GN",
+	"GP",
+	"GQ",
+	"GR",
+	"GT",
+	"GW",
+	"GY",
+	"HN",
+	"HR",
+	"HT",
+	"HU",
+	"ID",
+	"IE",
+	"IL",
+	"IN",
+	"IQ",
+	"IS",
+	"IT",
+	"JM",
+	"JO",
+	"JP",
+	"KE",
+	"KG",
+	"KH",
+	"KI",
+	"KM",
+	"KN",
+	"KR",
+	"KW",
+	"KY",
+	"KZ",
+	"LA",
+	"LB",
+	"LC",
+	"LI",
+	"LK",
+	"LR",
+	"LS",
+	"LT",
+	"LU",
+	"LV",
+	"LY",
+	"MA",
+	"MC",
+	"MD",
+	"ME",
+	"MF",
+	"MG",
+	"MH",
+	"MK",
+	"ML",
+	"MM",
+	"MN",
+	"MQ",
+	"MR",
+	"MT",
+	"MU",
+	"MV",
+	"MW",
+	"MX",
+	"MY",
+	"MZ",
+	"NA",
+	"NC",
+	"NE",
+	"NG",
+	"NI",
+	"NL",
+	"NO",
+	"NP",
+	"NR",
+	"NZ",
+	"OM",
+	"PA",
+	"PE",
+	"PF",
+	"PG",
+	"PH",
+	"PK",
+	"PL",
+	"PM",
+	"PS",
+	"PT",
+	"PW",
+	"PY",
+	"QA",
+	"RE",
+	"RO",
+	"RS",
+	"RW",
+	"SA",
+	"SB",
+	"SC",
+	"SD",
+	"SE",
+	"SG",
+	"SH",
+	"SI",
+	"SJ",
+	"SK",
+	"SL",
+	"SM",
+	"SN",
+	"SO",
+	"SR",
+	"SS",
+	"ST",
+	"SV",
+	"SZ",
+	"TD",
+	"TF",
+	"TG",
+	"TH",
+	"TJ",
+	"TL",
+	"TM",
+	"TN",
+	"TO",
+	"TR",
+	"TT",
+	"TV",
+	"TW",
+	"TZ",
+	"UA",
+	"UG",
+	"US",
+	"UY",
+	"UZ",
+	"VA",
+	"VC",
+	"VN",
+	"VU",
+	"WF",
+	"WS",
+	"YE",
+	"YT",
+	"ZA",
+	"ZM",
+	"ZW"
+]);
+const chatgptAllowedCountriesSchema = z.discriminatedUnion("mode", [
+	z.object({ mode: z.literal("all") }),
+	z.object({
+		mode: z.literal("allow"),
+		countries: z.array(chatgptCountryCodeSchema)
+	}),
+	z.object({
+		mode: z.literal("block"),
+		countries: z.array(chatgptCountryCodeSchema)
+	})
+]);
+const chatgptTranslationLocaleSchema = z.enum([
+	"am",
+	"ar",
+	"bg-BG",
+	"bn-BD",
+	"bs-BA",
+	"ca-ES",
+	"cs-CZ",
+	"da-DK",
+	"de-DE",
+	"el-GR",
+	"es-419",
+	"es-ES",
+	"et-EE",
+	"fi-FI",
+	"fr-CA",
+	"fr-FR",
+	"gu-IN",
+	"hi-IN",
+	"hr-HR",
+	"hu-HU",
+	"hy-AM",
+	"id-ID",
+	"is-IS",
+	"it-IT",
+	"ja-JP",
+	"ka-GE",
+	"kk",
+	"kn-IN",
+	"ko-KR",
+	"lt",
+	"lv-LV",
+	"mk-MK",
+	"ml",
+	"mn",
+	"mr-IN",
+	"ms-MY",
+	"my-MM",
+	"nb-NO",
+	"nl-NL",
+	"pa",
+	"pl-PL",
+	"pt-BR",
+	"pt-PT",
+	"ro-RO",
+	"ru-RU",
+	"sk-SK",
+	"sl-SI",
+	"so-SO",
+	"sq-AL",
+	"sr-RS",
+	"sv-SE",
+	"sw-TZ",
+	"ta-IN",
+	"te-IN",
+	"th-TH",
+	"tl",
+	"tr-TR",
+	"uk-UA",
+	"ur",
+	"vi-VN",
+	"zh-CN",
+	"zh-HK",
+	"zh-TW"
+]);
 const negativeTestCaseSchema = z.object({
 	scenario: z.string(),
 	userPrompt: z.string()
@@ -362,11 +890,19 @@ const chatgptToolJustificationSchema = z.object({
 	openWorldJustification: z.string(),
 	destructiveJustification: z.string()
 }).describe("Per-tool justification of each MCP annotation value (one sentence per hint).");
+/**
+* Base copy fields, defined once and reused by both the submission form and per-locale
+* translations so the constraints (tagline ≤ 30 chars) never drift. The translation generation
+* path wraps these in {@link clampStringField} since the LLM tends to overshoot the limit.
+*/
+const chatgptTaglineSchema = z.string().max(30);
+const chatgptDescriptionSchema = z.string();
 const chatgptTranslationSchema = z.object({
-	locale: z.string(),
-	tagline: z.string().optional(),
-	description: z.string().optional()
+	locale: chatgptTranslationLocaleSchema,
+	tagline: chatgptTaglineSchema,
+	description: chatgptDescriptionSchema
 }).describe("Locale-scoped override for tagline + description. English (US) is the default.");
+chatgptTranslationSchema.extend({ tagline: clampStringField(chatgptTaglineSchema) });
 /**
 * Field order mirrors the ChatGPT (OpenAI) submission spreadsheet, grouped by section.
 * When adding/removing/reordering fields, keep this in sync with the sheet.
@@ -375,8 +911,8 @@ const chatgptSubmissionFormDataSchema = z.object({
 	logoLight: z.string().describe("Logo icon for light mode. Square PNG, no borders or rounded corners (clients apply circular cropping)."),
 	logoDark: z.string().optional().describe("Optional dark-mode logo icon. Square PNG, same specs as the light icon. Leave empty if the light icon also works on dark backgrounds."),
 	appName: z.string().describe("The name users will see in ChatGPT and in the Apps Directory."),
-	tagline: z.string().max(30).describe("Plain-language phrase focused on function and user value. 30 chars max."),
-	description: z.string().describe("Clear, engaging description highlighting what the app does and why people will love it. Appears publicly on the directory page."),
+	tagline: chatgptTaglineSchema.describe("Plain-language phrase focused on function and user value. 30 chars max."),
+	description: chatgptDescriptionSchema.describe("Clear, engaging description highlighting what the app does and why people will love it. Appears publicly on the directory page."),
 	category: chatgptCategorySchema.describe("Category from the OpenAI taxonomy."),
 	developerName: z.string().describe("Developer name shown publicly on the app's directory page."),
 	companyUrl: z.url().describe("Your company's main website URL."),
@@ -393,7 +929,7 @@ const chatgptSubmissionFormDataSchema = z.object({
 	negativeTestCases: z.array(negativeTestCaseSchema).describe("3 negative test cases — prompts where the app should NOT trigger but the model might think it's relevant."),
 	screenshots: z.array(screenshotEntrySchema).describe("In-app screenshots paired with the user prompt that produced them. Widget apps must show the widget UI; non-widget apps show the model response. Min 1, max 4 entries. First three are public. Images: 706px wide, 400–860px tall, PNG."),
 	translations: z.array(chatgptTranslationSchema).describe("Per-locale translation of tagline + description. English (US) is the default."),
-	allowedCountries: chatgptAllowedCountriesSchema.describe("'Allow all' or restrict to a specific list. See OpenAI's supported countries list."),
+	allowedCountries: chatgptAllowedCountriesSchema.describe("Availability: all supported countries, or an allow-list / block-list of specific ones (ISO alpha-2)."),
 	releaseNotes: z.string().describe("Publicly displayed on the app details page.")
 });
 chatgptSubmissionFormDataSchema.pick({
@@ -797,7 +1333,7 @@ const createEnvironmentContractV1 = oc.route({
 	id: z.string(),
 	name: z.string(),
 	sourceBranch: z.string().nullable().describe("The branch used to build the environment"),
-	urls: z.array(z.string().url()).describe("The URLs of the MCP server"),
+	urls: z.array(z.url()).describe("The URLs of the MCP server"),
 	createdAt: z.coerce.date(),
 	projectId: z.string().describe("The ID of the project the environment belongs to")
 }));
@@ -873,6 +1409,9 @@ const listProjectsContractV1 = oc.route({
 	description: "List all projects for a team",
 	tags: ["projects"],
 	successDescription: "The list of projects"
+}).errors({
+	NOT_FOUND: {},
+	BAD_REQUEST: {}
 }).input(z.object({ teamId: z.string().optional() }).optional()).output(z.array(projectOutputSchema));
 const createProjectContractV1 = oc.route({
 	path: "/v1/projects",
@@ -968,7 +1507,10 @@ const deleteEnvironmentVariableContractV1 = oc.route({
 	description: "Delete an environment variable by ID",
 	tags: ["environments"],
 	successDescription: "The environment variable has been deleted successfully"
-}).errors({ NOT_FOUND: {} }).input(z.object({ environmentVariableId: z.string().describe("The ID of the environment variable") })).output(z.object({ success: z.literal(true) }));
+}).errors({
+	NOT_FOUND: {},
+	BAD_REQUEST: {}
+}).input(z.object({ environmentVariableId: z.string().describe("The ID of the environment variable") })).output(z.object({ success: z.literal(true) }));
 const deleteProjectContractV1 = oc.route({
 	path: "/v1/projects/{projectId}",
 	method: "DELETE",
@@ -1013,6 +1555,9 @@ const uploadDeploymentArtifactContractV1 = oc.route({
 	description: "Return a presigned S3 URL to upload a deployment artifact",
 	tags: ["deployments"],
 	successDescription: "The presigned upload URL has been generated successfully"
+}).errors({
+	NOT_FOUND: {},
+	BAD_REQUEST: {}
 }).input(z.object({ teamId: z.string().optional() }).optional()).output(z.object({
 	uploadUrl: z.url().describe("Presigned S3 URL to upload the source archive with HTTP PUT"),
 	token: z.string().describe("Token to identify the source archive"),
@@ -1186,7 +1731,7 @@ const getTunnelTicketContractV1 = oc.route({
 	description: "Get a signed ticket for establishing a tunnel connection. Requires user authentication (API keys are not supported).",
 	tags: ["tunnels"],
 	successDescription: "The tunnel ticket"
-}).output(z.object({
+}).errors({ FORBIDDEN: {} }).output(z.object({
 	subdomain: z.string().describe("The subdomain assigned to the user"),
 	ticket: z.string().describe("The signed tunnel ticket"),
 	tunnelHost: z.string().describe("The tunnel host to connect to")
@@ -1262,7 +1807,7 @@ const upsertPlaygroundContractV1 = oc.route({
 	name: z.string().min(1).max(100).optional(),
 	description: z.string().min(1).max(500).optional(),
 	headers: z.array(playgroundHeaderSchema).optional(),
-	examplePrompts: z.array(playgroundExamplePromptSchema).max(3).optional()
+	examplePrompts: z.array(playgroundExamplePromptSchema).max(5).optional()
 })).output(playgroundOutputSchema);
 const createBeaconContractV1 = oc.route({
 	path: "/v1/beacon/audits",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alpic-ai/api",
-  "version": "0.0.0-dev.gd514aa3",
+  "version": "0.0.0-dev.gd960912",
   "description": "Contract for the Alpic API",
   "type": "module",
   "main": "./dist/index.mjs",