@alpic-ai/api 0.0.0-dev.gd909ef3 → 0.0.0-dev.gd90a081

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { z } from "zod";
 import * as z$1 from "zod/v4";
 import { oc } from "@orpc/contract";
 import ms from "ms";
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_supports-color@7.2.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
 /**
 * Reusable URL validation that disallows javascript: scheme
 */
@@ -169,11 +169,21 @@ z$1.object({
 	token: z$1.string(),
 	token_type_hint: z$1.string().optional()
 }).strip();
-const platformSchema = z.enum(["chatgpt", "claudeai"]);
+//#endregion
+//#region ../domains/dist/index.mjs
+const AI_PLATFORMS = ["chatgpt", "claudeai"];
+const platformSchema = z.enum(AI_PLATFORMS);
 const PLATFORM_LABELS = {
 	chatgpt: "ChatGPT",
 	claudeai: "Claude.ai"
 };
+const WAF_PLATFORMS = [
+	"akamai",
+	"cloudflare",
+	"fastly"
+];
+const ALLOWED_PLATFORMS = [...AI_PLATFORMS, ...WAF_PLATFORMS];
+const allowedPlatformSchema = z.enum(ALLOWED_PLATFORMS);
 const auditStatusSchema = z.enum([
 	"pending",
 	"partial",
@@ -273,34 +283,51 @@ const deploymentSummarySchema = z.object({
 	createdAt: z.coerce.date(),
 	updatedAt: z.coerce.date()
 });
-/**
-* Public environment
-*
-* No OAuth metadata exposed.
-*/
+/** Public environment: answers anonymously and exposes no OAuth metadata. */
 const publicEnvironmentSchema = z.object({
+	allowsAnonymous: z.literal(true),
+	oAuthMetadata: z.strictObject({})
+});
+/** Protected environment whose external resource metadata URL is returned in the WWW-Authenticate header on the first 401; everything after is handled outside the MCP server scope. */
+const externalResourceMetadataEnvironmentSchema = z.object({
+	allowsAnonymous: z.boolean(),
+	oAuthMetadata: z.object({ externalResourceMetadataUrl: z.url() }),
+	scope: z.string().optional()
+});
+/** Protected environment whose own /.well-known/oauth-protected-resource endpoint points at an external authorization server; everything after is handled outside the MCP server scope. */
+const externalAuthorizationServerEnvironmentSchema = z.object({
+	allowsAnonymous: z.boolean(),
+	oAuthMetadata: z.object({
+		externalAuthorizationServerUrl: z.url(),
+		resourceMetadata: OAuthProtectedResourceMetadataSchema.optional()
+	}),
+	scope: z.string().optional()
+});
+/** Standalone protected environment: the server itself exposes both the /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server endpoints. */
+const standaloneEnvironmentSchema = z.object({
+	allowsAnonymous: z.boolean(),
+	oAuthMetadata: z.object({
+		authorizationServerMetadata: z.union([OAuthMetadataSchema, OpenIdProviderDiscoveryMetadataSchema]),
+		resourceMetadata: OAuthProtectedResourceMetadataSchema.optional()
+	}),
+	scope: z.string().optional()
+});
+/** Protected environment that enforces authentication but advertises no OAuth discovery metadata; clients must obtain credentials out-of-band. */
+const protectedWithoutDiscoveryEnvironmentSchema = z.object({
+	allowsAnonymous: z.literal(false),
+	oAuthMetadata: z.strictObject({}),
+	scope: z.string().optional()
+});
+const legacyPublicEnvironmentSchema = z.object({
 	isPublic: z.literal(true),
 	oAuthMetadata: z.undefined().optional()
 });
-/**
-* Protected environment with an external resource metadata URL
-*
-* An external resource metadata URL is returned in the WWW-Authenticate header during the first 401 response.
-* Everything that follows is handled outside of the MCP server scope.
-*/
-const externalResourceMetadataEnvironmentSchema = z.object({
+const legacyExternalResourceMetadataEnvironmentSchema = z.object({
 	isPublic: z.literal(false),
 	oAuthMetadata: z.object({ externalResourceMetadataUrl: z.url() }),
 	scope: z.string().optional()
 });
-/**
-* Protected environment with an external authorization server URL
-*
-* The server itself exposes the /.well-known/oauth-protected-resource endpoint.
-* An external authorization server URL is returned when requesting the endpoint.
-* Everything that follows is handled outside of the MCP server scope.
-*/
-const externalAuthorizationServerEnvironmentSchema = z.object({
+const legacyExternalAuthorizationServerEnvironmentSchema = z.object({
 	isPublic: z.literal(false),
 	oAuthMetadata: z.object({
 		externalAuthorizationServerUrl: z.url(),
@@ -308,13 +335,7 @@ const externalAuthorizationServerEnvironmentSchema = z.object({
 	}),
 	scope: z.string().optional()
 });
-/**
-* Standalone protected environment
-*
-* The server itself exposes the /.well-known/oauth-protected-resource endpoint.
-* The server itself exposes the /.well-known/oauth-authorization-server endpoint.
-*/
-const standaloneEnvironmentSchema = z.object({
+const legacyStandaloneEnvironmentSchema = z.object({
 	isPublic: z.literal(false),
 	oAuthMetadata: z.object({
 		authorizationServerMetadata: z.union([OAuthMetadataSchema, OpenIdProviderDiscoveryMetadataSchema]),
@@ -322,14 +343,7 @@ const standaloneEnvironmentSchema = z.object({
 	}),
 	scope: z.string().optional()
 });
-/**
-* Protected environment without OAuth discovery
-*
-* The server enforces authentication but exposes no OAuth discovery metadata.
-* Neither /.well-known/oauth-protected-resource nor /.well-known/oauth-authorization-server
-* are advertised. Clients must obtain credentials out-of-band.
-*/
-const protectedWithoutDiscoveryEnvironmentSchema = z.object({
+const legacyProtectedWithoutDiscoveryEnvironmentSchema = z.object({
 	isPublic: z.literal(false),
 	oAuthMetadata: z.strictObject({}),
 	scope: z.string().optional()
@@ -339,9 +353,19 @@ z.union([
 	externalResourceMetadataEnvironmentSchema,
 	externalAuthorizationServerEnvironmentSchema,
 	standaloneEnvironmentSchema,
-	protectedWithoutDiscoveryEnvironmentSchema
+	protectedWithoutDiscoveryEnvironmentSchema,
+	legacyPublicEnvironmentSchema,
+	legacyExternalResourceMetadataEnvironmentSchema,
+	legacyExternalAuthorizationServerEnvironmentSchema,
+	legacyStandaloneEnvironmentSchema,
+	legacyProtectedWithoutDiscoveryEnvironmentSchema
+]);
+const playgroundModelSchema = z.enum([
+	"global.anthropic.claude-haiku-4-5-20251001-v1:0",
+	"global.anthropic.claude-sonnet-4-5-20250929-v1:0",
+	"openai.gpt-5.4",
+	"openai.gpt-5.5"
 ]);
-const allowedPlatformSchema = platformSchema;
 const environmentDomainSchema = z.object({
 	name: z.string(),
 	status: z.enum([
@@ -361,6 +385,7 @@ const environmentSchema$1 = z.object({
 	latestDeployment: deploymentSummarySchema.optional(),
 	openaiAppsChallenge: z.string().nullable().optional(),
 	isPlaygroundEnabled: z.boolean(),
+	playgroundModel: playgroundModelSchema,
 	isIpWhitelistEnabled: z.boolean(),
 	ipAllowlist: z.array(z.string()).nullable(),
 	allowedPlatforms: z.array(allowedPlatformSchema),
@@ -374,7 +399,8 @@ z.object({
 	collectRequestPayload: z.boolean(),
 	collectResponsePayload: z.boolean(),
 	collectErrorMessage: z.boolean(),
-	collectUserData: z.boolean()
+	collectUserData: z.boolean(),
+	identityTraitKey: z.string().min(1).max(200).nullable()
 });
 z.object({
 	id: z.string(),
@@ -515,6 +541,10 @@ const domainFailureReasonSchema = z.enum([
 	"invalid_domain",
 	"other"
 ]);
+const projectDomainMappingSchema = z.object({
+	pathPrefix: z.string(),
+	environment: environmentSchema$1
+});
 z.object({
 	name: z.string(),
 	createdAt: z.coerce.date(),
@@ -524,7 +554,8 @@ z.object({
 		"failed"
 	]),
 	failureReason: domainFailureReasonSchema.nullable(),
-	environment: environmentSchema$1
+	environment: environmentSchema$1,
+	mappings: z.array(projectDomainMappingSchema)
 });
 const serverFieldsSchema$1 = z.object({
 	$schema: z.string(),
@@ -553,15 +584,7 @@ z.object({
 	serverFields: serverFieldsSchema$1,
 	source: z.enum(["registry", "defaults"])
 });
-/**
-* Returns a variant of a `maxLength`-constrained string that clamps (truncates) instead of
-* rejecting on overflow — used for AI-generated copy where the model routinely overshoots.
-*
-* NOTE: this rebuilds the schema from scratch, carrying over only `maxLength` (as a clamp),
-* `minLength`, and the description. Any other validators on the source field (`.regex()`,
-* `.email()`, custom refinements) are intentionally dropped — this helper is meant for plain
-* free-text length caps only. A field with `null` `maxLength` is returned unchanged.
-*/
+/** Clamps instead of rejecting on max-length overflow (for AI-generated copy that overshoots); intentionally carries over only maxLength, minLength, and description, dropping any other validators. */
 const clampStringField = (field) => {
 	const max = field.maxLength;
 	if (max === null) return field;
@@ -588,8 +611,9 @@ const positiveTestCaseSchema = z.object({
 }).partial().describe("Each case: Scenario, User prompt, Tool triggered, Expected output.");
 const screenshotEntrySchema = z.object({
 	prompt: z.string(),
-	url: z.url().or(z.literal(""))
+	url: z.url()
 }).describe("Each screenshot: the user prompt that produced it + the image URL.");
+const screenshotDraftEntrySchema = screenshotEntrySchema.extend({ url: z.string() });
 /** Accepts either a valid email or URL. */
 const supportChannelSchema = z.string().refine((value) => z.email().safeParse(value).success || z.url().safeParse(value).success, { error: "Must be a valid email or URL" });
 /** A URL field whose error spells out that the scheme is required. */
@@ -906,11 +930,7 @@ const chatgptToolJustificationSchema = z.object({
 	openWorldJustification: z.string().describe("One sentence on whether the tool reaches external systems beyond your own service."),
 	destructiveJustification: z.string().describe("One sentence on whether the tool changes data. For a read-only tool, state the full triad: \"No data is created, modified, or deleted.\"")
 }).describe("Per-tool justification of each MCP annotation value (one specific sentence per hint).");
-/**
-* Base copy fields, defined once and reused by both the submission form and per-locale
-* translations so the constraints (tagline ≤ 30 chars) never drift. The translation generation
-* path wraps these in {@link clampStringField} since the LLM tends to overshoot the limit.
-*/
+/** Defined once and reused by both the submission form and per-locale translations so the tagline ≤ 30 chars constraint never drifts. */
 const chatgptTaglineSchema = z.string().max(30);
 const chatgptDescriptionSchema = z.string();
 const chatgptTranslationSchema = z.object({
@@ -919,10 +939,7 @@ const chatgptTranslationSchema = z.object({
 	description: chatgptDescriptionSchema
 }).describe("Locale-scoped override for tagline + description. English (US) is the default.");
 chatgptTranslationSchema.extend({ tagline: clampStringField(chatgptTaglineSchema) });
-/**
-* Field order mirrors the ChatGPT (OpenAI) submission spreadsheet, grouped by section.
-* When adding/removing/reordering fields, keep this in sync with the sheet.
-*/
+/** Field order mirrors the ChatGPT (OpenAI) submission spreadsheet, grouped by section; keep it in sync with the sheet. */
 const chatgptSubmissionFormDataSchema = z.object({
 	logoLight: z.string().describe("Logo icon for light mode. Square PNG, no borders or rounded corners (clients apply circular cropping)."),
 	logoDark: z.string().optional().describe("Optional dark-mode logo icon. Square PNG, same specs as the light icon. Leave empty if the light icon also works on dark backgrounds."),
@@ -948,6 +965,17 @@ const chatgptSubmissionFormDataSchema = z.object({
 	allowedCountries: chatgptAllowedCountriesSchema.describe("Availability: all supported countries, or an allow-list / block-list of specific ones (ISO alpha-2)."),
 	releaseNotes: z.string().describe("Publicly displayed on the app details page.")
 });
+const chatgptSubmissionDraftSchema = chatgptSubmissionFormDataSchema.partial().extend({
+	tagline: z.string().optional(),
+	companyUrl: z.string().optional(),
+	supportChannel: z.string().optional(),
+	privacyPolicyUrl: z.string().optional(),
+	termsOfServiceUrl: z.string().optional(),
+	demoRecordingUrl: z.string().optional(),
+	serverUrl: z.string().optional(),
+	screenshots: z.array(screenshotDraftEntrySchema).optional(),
+	translations: z.array(chatgptTranslationSchema.extend({ tagline: z.string() })).optional()
+});
 chatgptSubmissionFormDataSchema.pick({
 	appName: true,
 	developerName: true,
@@ -1008,11 +1036,7 @@ const claudePolicyAcknowledgementSchema = z.enum([
 	"My connector does not collect conversation data beyond what is needed for its function.",
 	"Public documentation for this connector will be live by the publish date."
 ]);
-/**
-* Field order mirrors the claude.ai directory submission wizard
-* (`claude.ai/admin-settings/directory/submissions/new`), grouped by step.
-* When adding/removing/reordering fields, keep this in sync with the wizard.
-*/
+/** Field order mirrors the claude.ai directory submission wizard (`claude.ai/admin-settings/directory/submissions/new`), grouped by step; keep it in sync with the wizard. */
 const claudeSubmissionFormDataSchema = z.object({
 	serverUrl: z.url().describe(`The full https:// URL where your MCP server is hosted and reachable. In the claude.ai wizard this is read live
 from the custom connector you select — the connection is used to verify the URL and the tool list at submission time.
@@ -1074,6 +1098,21 @@ fully populated account.`),
 submission. Each is an attestation you are legally agreeing to by submitting.`),
 	additionalNotes: z.string().optional().describe("Anything else the review team should know about your connector. Optional.")
 });
+const claudeSubmissionDraftSchema = claudeSubmissionFormDataSchema.partial().extend({
+	serverUrl: z.string().optional(),
+	name: z.string().optional(),
+	slug: z.string().optional(),
+	oneLiner: z.string().optional(),
+	description: z.string().optional(),
+	iconUrl: z.string().optional(),
+	documentation: z.string().optional(),
+	support: z.string().optional(),
+	privacyPolicy: z.string().optional(),
+	companyWebsite: z.string().optional(),
+	primaryContactEmail: z.string().optional(),
+	categories: z.array(claudeCategorySchema).optional(),
+	screenshots: z.array(screenshotDraftEntrySchema).optional()
+});
 claudeSubmissionFormDataSchema.pick({
 	serverUrl: true,
 	name: true,
@@ -1089,12 +1128,7 @@ claudeSubmissionFormDataSchema.pick({
 	connectionRequirements: claudeSubmissionFormDataSchema.shape.connectionRequirements.optional(),
 	testInstructions: claudeSubmissionFormDataSchema.shape.testInstructions.optional()
 });
-/**
-* Narrative fields the LLM-backed generation step produces for Claude submissions.
-* This schema accepts the slightly loose shape returned by AI generation, then normalizes it into
-* the strict form shape. Keep transforms here rather than in callers so generation leniency is
-* colocated with the Claude contract.
-*/
+/** Loose shape returned by AI generation for Claude narrative fields; transforms live here so generation leniency stays colocated with the Claude contract. */
 const claudeAiGeneratedFormDataRawSchema = z.object({
 	oneLiner: claudeSubmissionFormDataSchema.shape.oneLiner,
 	description: claudeSubmissionFormDataSchema.shape.description,
@@ -1114,14 +1148,14 @@ const submissionMetaFieldsSchema = z.object({
 });
 const claudeSubmissionSchemaInternal = submissionMetaFieldsSchema.extend({
 	platform: z.literal("claudeai"),
-	formData: claudeSubmissionFormDataSchema.partial()
+	formData: claudeSubmissionDraftSchema
 });
 const chatgptSubmissionSchemaInternal = submissionMetaFieldsSchema.extend({
 	platform: z.literal("chatgpt"),
-	formData: chatgptSubmissionFormDataSchema.partial()
+	formData: chatgptSubmissionDraftSchema
 });
 z.discriminatedUnion("platform", [claudeSubmissionSchemaInternal, chatgptSubmissionSchemaInternal]);
-z.union([claudeSubmissionFormDataSchema.partial(), chatgptSubmissionFormDataSchema.partial()]);
+z.union([claudeSubmissionDraftSchema, chatgptSubmissionDraftSchema]);
 const subscriptionPlanSchema = z.enum([
 	"pro",
 	"business",
@@ -1186,7 +1220,10 @@ const RESERVED_KEYS = [
 	"BUILD_ARG_START_COMMAND",
 	"ALPIC_HOST",
 	"ALPIC_CUSTOM_DOMAINS",
-	"ALPIC_INTENT_META_KEY"
+	"ALPIC_INTENT_META_KEY",
+	"ALPIC_FEEDBACK_META_KEY",
+	"ALPIC_EVENTS_META_KEY",
+	"ALPIC_IDENTIFY_META_KEY"
 ];
 const environmentVariableSchema = z.object({
 	key: z.string().min(2, "Key must be at least 2 characters").regex(/^[a-zA-Z]([a-zA-Z0-9_])+$/, "Key must start with a letter and contain only letters, numbers, and underscores").refine((key) => !RESERVED_KEYS.includes(key), "This key is reserved and cannot be used as an environment variable key"),
@@ -1502,10 +1539,12 @@ const deployEnvironmentContractV1 = oc.route({
 	successDescription: "The environment has been deployed successfully"
 }).errors({
 	NOT_FOUND: {},
-	BAD_REQUEST: {}
+	BAD_REQUEST: {},
+	CONFLICT: {}
 }).input(z.object({
 	environmentId: z.string().describe("The ID of the environment to deploy"),
-	token: z.string().describe("The token to identify the source archive").optional()
+	token: z.string().describe("The token to identify the source archive").optional(),
+	settings: buildSettingsSchema.extend({ transport: transportSchema }).optional().describe("Project settings detected by the client from the source. When provided, the server skips downloading and extracting the source archive to detect them.")
 })).output(deploymentSchema);
 const uploadDeploymentArtifactContractV1 = oc.route({
 	path: "/v1/deployments/upload",
@@ -1542,6 +1581,21 @@ const getDeploymentContractV1 = oc.route({
 	tags: ["deployments"],
 	successDescription: "The deployment details"
 }).errors({ NOT_FOUND: {} }).input(z.object({ deploymentId: z.string().describe("The ID of the deployment") })).output(deploymentSchema);
+const logEntrySchema = z.object({
+	timestamp: z.coerce.date(),
+	type: z.enum([
+		"START",
+		"END",
+		"INFO",
+		"ERROR",
+		"WARNING",
+		"DEBUG"
+	]),
+	requestId: z.string(),
+	content: z.string().optional(),
+	method: z.string().optional(),
+	durationInMs: z.number().optional()
+});
 const getLogsContractV1 = oc.route({
 	path: "/v1/environments/{environmentId}/logs",
 	method: "GET",
@@ -1566,21 +1620,7 @@ const getLogsContractV1 = oc.route({
 	search: z.string().optional().describe("Filter pattern to search for in log content"),
 	nextToken: z.string().optional().describe("Pagination token from a previous response")
 })).output(z.object({
-	logs: z.array(z.object({
-		timestamp: z.coerce.date(),
-		type: z.enum([
-			"START",
-			"END",
-			"INFO",
-			"ERROR",
-			"WARNING",
-			"DEBUG"
-		]),
-		requestId: z.string(),
-		content: z.string().optional(),
-		method: z.string().optional(),
-		durationInMs: z.number().optional()
-	})),
+	logs: z.array(logEntrySchema),
 	nextToken: z.string().nullable()
 }));
 const getLatestLogsContractV1 = oc.route({
@@ -1603,21 +1643,7 @@ const getLatestLogsContractV1 = oc.route({
 		"DEBUG"
 	])).optional().describe("Filter by log level"),
 	search: z.string().optional().describe("Filter pattern to search for in log content")
-})).output(z.object({ logs: z.array(z.object({
-	timestamp: z.coerce.date(),
-	type: z.enum([
-		"START",
-		"END",
-		"INFO",
-		"ERROR",
-		"WARNING",
-		"DEBUG"
-	]),
-	requestId: z.string(),
-	content: z.string().optional(),
-	method: z.string().optional(),
-	durationInMs: z.number().optional()
-})) }));
+})).output(z.object({ logs: z.array(logEntrySchema) }));
 const getDeploymentLogsContractV1 = oc.route({
 	path: "/v1/deployments/{deploymentId}/logs",
 	method: "GET",
@@ -1843,5 +1869,10 @@ const contract = {
 		get: { v1: getBeaconContractV1 }
 	}
 };
+const { uploadArtifact: _discard, ...deploymentsForDocs } = contract.deployments;
+const contractForDocs = {
+	...contract,
+	deployments: deploymentsForDocs
+};
 //#endregion
-export { AUTH_SCOPE_ANY, AUTH_SCOPE_USER, PLATFORM_LABELS, buildSettingsSchema, contract, createEnvironmentContractV1, deploymentStatusSchema, environmentVariableSchema, environmentVariablesSchema, playgroundExamplePromptSchema, playgroundHeaderSchema, runtimeSchema, serverFieldsSchema, transportSchema, updateEnvironmentVariableSchema };
+export { AUTH_SCOPE_ANY, AUTH_SCOPE_USER, PLATFORM_LABELS, buildSettingsSchema, contract, contractForDocs, createEnvironmentContractV1, deploymentStatusSchema, environmentVariableSchema, environmentVariablesSchema, playgroundExamplePromptSchema, playgroundHeaderSchema, runtimeSchema, serverFieldsSchema, transportSchema, updateEnvironmentVariableSchema };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alpic-ai/api",
-  "version": "0.0.0-dev.gd909ef3",
+  "version": "0.0.0-dev.gd90a081",
   "description": "Contract for the Alpic API",
   "type": "module",
   "main": "./dist/index.mjs",
@@ -14,22 +14,38 @@
   "files": [
     "dist"
   ],
+  "nx": {
+    "targets": {
+      "build": {
+        "cache": true,
+        "inputs": [
+          "{projectRoot}/src/**/*",
+          "{projectRoot}/tsdown.config.ts",
+          "{projectRoot}/tsconfig.json",
+          "^default"
+        ],
+        "outputs": [
+          "{projectRoot}/dist"
+        ]
+      }
+    }
+  },
   "author": "Alpic",
   "license": "ISC",
   "dependencies": {
-    "@orpc/contract": "^1.14.6",
+    "@orpc/contract": "^1.14.13",
     "ms": "^2.1.3",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@orpc/openapi": "^1.14.6",
-    "@orpc/zod": "^1.14.6",
+    "@orpc/openapi": "^1.14.13",
+    "@orpc/zod": "^1.14.13",
     "@total-typescript/tsconfig": "^1.0.4",
     "@types/ms": "^2.1.0",
     "shx": "^0.4.0",
-    "tsdown": "^0.22.3",
+    "tsdown": "^0.22.14",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.9",
+    "vitest": "^4.1.10",
     "@alpic-ai/domains": "0.0.0"
   },
   "scripts": {
@@ -38,7 +54,7 @@
     "test": "pnpm run test:unit && pnpm run test:type && pnpm run test:format",
     "test:unit": "vitest run",
     "test:format": "biome check --error-on-warnings .",
-    "test:type": "tsc --noEmit",
+    "test:type": "tsgo --noEmit",
     "publish:npm": "pnpm publish --tag \"${NPM_TAG}\" --access public --no-git-checks"
   }
 }