@alpic-ai/api 0.0.0-dev.gd9ebdf8 → 0.0.0-dev.gda34b6b

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { z } from "zod";
 import * as z$1 from "zod/v4";
 import { oc } from "@orpc/contract";
 import ms from "ms";
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_supports-color@7.2.0_zod@4.5.4/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_supports-color@8.1.1_zod@4.5.4/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
 /**
 * Reusable URL validation that disallows javascript: scheme
 */
@@ -119,7 +119,12 @@ z$1.object({
 	token_type: z$1.string(),
 	expires_in: z$1.coerce.number().optional(),
 	scope: z$1.string().optional(),
-	refresh_token: z$1.string().optional()
+	refresh_token: z$1.string().optional(),
+	/**
+	* Not part of the wire format: the authorization server this value was obtained from, added by
+	* the client's `auth()` before it is stored and compared when it is read back.
+	*/
+	issuer: z$1.string().optional().catch(void 0)
 }).strip();
 z$1.object({
 	error: z$1.string(),
@@ -158,7 +163,12 @@ const OAuthClientInformationSchema = z$1.object({
 	client_id: z$1.string(),
 	client_secret: z$1.string().optional(),
 	client_id_issued_at: z$1.number().optional(),
-	client_secret_expires_at: z$1.number().optional()
+	client_secret_expires_at: z$1.number().optional(),
+	/**
+	* Not part of the wire format: the authorization server this value was obtained from, added by
+	* the client's `auth()` before it is stored and compared when it is read back.
+	*/
+	issuer: z$1.string().optional().catch(void 0)
 }).strip();
 OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);
 z$1.object({
@@ -336,7 +346,8 @@ const standaloneEnvironmentSchema = z.object({
 const protectedWithoutDiscoveryEnvironmentSchema = z.object({
 	allowsAnonymous: z.literal(false),
 	oAuthMetadata: z.strictObject({}),
-	scope: z.string().optional()
+	scope: z.string().optional(),
+	wwwAuthenticate: z.string().optional()
 });
 const legacyPublicEnvironmentSchema = z.object({
 	isPublic: z.literal(true),
@@ -381,10 +392,13 @@ z.union([
 	legacyProtectedWithoutDiscoveryEnvironmentSchema
 ]);
 const playgroundModelSchema = z.enum([
+	"global.anthropic.claude-haiku-5-5",
 	"global.anthropic.claude-haiku-4-5-20251001-v1:0",
-	"global.anthropic.claude-sonnet-4-5-20250929-v1:0",
+	"global.anthropic.claude-sonnet-5-5",
 	"openai.gpt-5.4",
-	"openai.gpt-5.5"
+	"openai.gpt-5.5",
+	"openai.gpt-6-luna",
+	"openai.gpt-6.1-sol"
 ]);
 const environmentDomainSchema = z.object({
 	name: z.string(),
@@ -420,7 +434,8 @@ z.object({
 	collectResponsePayload: z.boolean(),
 	collectErrorMessage: z.boolean(),
 	collectUserData: z.boolean(),
-	identityTraitKey: z.string().min(1).max(200).nullable()
+	identityTraitKey: z.string().min(1).max(200).nullable(),
+	leadEventName: z.string().min(1).max(200).nullable()
 });
 const feedbackSchema = z.object({
 	id: z.string(),
@@ -539,6 +554,14 @@ z.enum([
 	"DEBUG",
 	"ERROR"
 ]);
+const LOG_SEARCH_MAX_ESCAPED_LENGTH = 960;
+function escapeLogSearchTerm(search) {
+	return [...search].flatMap((character) => [...new TextEncoder().encode(character)]).map((byte) => {
+		const character = String.fromCharCode(byte);
+		return /^[a-zA-Z0-9]$/.test(character) ? character : `\\x${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+	}).join("");
+}
+const logSearchSchema = z.string().max(240, `Search must be 240 characters or fewer`).refine((search) => escapeLogSearchTerm(search).length <= LOG_SEARCH_MAX_ESCAPED_LENGTH, "Search is too complex; shorten it or use fewer special characters");
 /** Only names a vendor actually ships belong here: lookalikes like `claude-code-test` are customers' own scripts. */
 const MCP_CLIENT_GROUPS = [
 	{
@@ -606,7 +629,7 @@ const MCP_CLIENT_GROUPS = [
 		id: "chatgpt",
 		label: "ChatGPT",
 		vendor: "openai",
-		rawNames: ["openai-mcp (ChatGPT)"]
+		rawNames: ["openai-mcp", "openai-mcp (ChatGPT)"]
 	},
 	{
 		id: "openai_responses_api",
@@ -620,12 +643,6 @@ const MCP_CLIENT_GROUPS = [
 		vendor: "openai",
 		rawNames: ["openai-mcp (Agent Builder)"]
 	},
-	{
-		id: "openai_other",
-		label: "OpenAI Other",
-		vendor: "openai",
-		rawNames: ["openai-mcp"]
-	},
 	{
 		id: "cursor",
 		label: "Cursor",
@@ -1210,7 +1227,7 @@ const chatgptTranslationLocaleSchema = z.enum([
 const negativeTestCaseSchema = z.object({
 	scenario: z.string().min(1),
 	userPrompt: z.string().min(1)
-}).describe("Each case: Scenario + User prompt (the app should NOT trigger).");
+}).describe("Each case: Scenario + User prompt (the plugin should NOT trigger).");
 const negativeTestCaseDraftSchema = negativeTestCaseSchema.partial().extend({
 	scenario: z.string().optional(),
 	userPrompt: z.string().optional()
@@ -1239,28 +1256,28 @@ chatgptTranslationSchema.extend({ tagline: clampStringField(chatgptTaglineSchema
 const chatgptSubmissionFormDataSchema = z.object({
 	logoLight: z.string().describe("Logo icon for light mode. Square PNG, no borders or rounded corners (clients apply circular cropping)."),
 	logoDark: z.string().optional().describe("Optional dark-mode logo icon. Square PNG, same specs as the light icon. Leave empty if the light icon also works on dark backgrounds."),
-	appName: z.string().describe("The name users will see in ChatGPT and in the Apps Directory."),
+	appName: z.string().describe("The name users will see in ChatGPT and in the Plugin Directory."),
 	tagline: chatgptTaglineSchema.describe("Plain-language phrase focused on function and user value, 30 chars max. Avoid generic superlatives like \"the best …\"."),
-	description: chatgptDescriptionSchema.describe("Clear, engaging description highlighting what the app does and why people will love it. Appears publicly on the directory page. End it by naming the product categories or intents the app does NOT cover, so ChatGPT learns when not to route to it (define exclusions by absent categories or wrong intents, never by naming other brands)."),
+	description: chatgptDescriptionSchema.describe("Clear, engaging description highlighting what the plugin does and why people will love it. Appears publicly on the directory page. End it by naming the product categories or intents the plugin does NOT cover, so ChatGPT learns when not to route to it (define exclusions by absent categories or wrong intents, never by naming other brands)."),
 	category: chatgptCategorySchema.describe("Category from the OpenAI taxonomy."),
-	developerName: z.string().describe("Developer name shown publicly on the app's directory page."),
+	developerName: z.string().describe("Developer name shown publicly on the plugin's directory page."),
 	companyUrl: urlField.describe("Your company's main website URL."),
 	supportChannel: supportChannelSchema.describe("Customer support URL or email address."),
 	privacyPolicyUrl: urlField.describe("URL to your privacy policy."),
-	termsOfServiceUrl: urlField.describe("URL to the app's terms of service."),
-	demoRecordingUrl: urlField.describe("URL to a video demonstrating the app, recorded via OpenAI Developer Mode. Cover all main use cases on web, iOS, and Android."),
-	appCommerceAndPurchasing: z.boolean().describe("Checkbox: 'My app links or directs users out of ChatGPT to make purchases.' Defaults to false. Verify the app does not offer digital goods."),
+	termsOfServiceUrl: urlField.describe("URL to the plugin's terms of service."),
+	demoRecordingUrl: urlField.describe("URL to a video demonstrating the plugin, recorded via OpenAI Developer Mode. Cover all main use cases on web, iOS, and Android."),
+	appCommerceAndPurchasing: z.boolean().describe("Checkbox: 'My plugin links or directs users out of ChatGPT to make purchases.' Defaults to false. Verify the plugin does not offer digital goods."),
 	serverUrl: urlField.describe("URL of the MCP server."),
 	authentication: chatgptAuthenticationSchema.describe("OAuth 2.0 or No auth. OAuth configuration is auto-discovered from the MCP server's metadata."),
 	tools: z.array(toolDefinitionSchema).describe("List of tools exposed by the MCP server (auto-populated from the production server's manifest)."),
 	toolJustifications: z.array(chatgptToolJustificationSchema).describe("Per-tool justification of `readOnlyHint`, `openWorldHint`, and `destructiveHint` annotation values. One short, specific sentence per hint describing what the tool actually does."),
 	skills: z.array(chatgptSkillSchema).optional().describe("Skills the server exposes over MCP (auto-populated from the production server's manifest). Left unset when the server does not advertise the skills extension, which is a different state from advertising it and exposing none."),
 	testCases: z.array(positiveTestCaseSchema).length(5).describe("Exactly 5 positive test cases. Each: Scenario, User prompt, Tool triggered, Expected output. Collectively cover the full capability across different flow stages (initial search or browse, market or locale handling, post-interaction detail, an action ChatGPT performs on the user's behalf, and a conversion or secondary tool) rather than five variations of the same first step."),
-	negativeTestCases: z.array(negativeTestCaseSchema).length(3).describe("Exactly 3 negative test cases: prompts where the app should NOT trigger but the model might think it is relevant. These become production routing metadata that teaches ChatGPT when to stay silent, so pick tight near-misses: a product category the app does not carry, the right brand or domain but an intent the app does not serve, or a boundary with a sibling app."),
-	screenshots: z.array(screenshotEntrySchema.extend({ prompt: z.string().max(75, { error: "Screenshot prompts are limited to 75 characters." }) })).max(3).describe("In-app screenshots paired with the user prompt that produced them (each prompt is 75 characters max). Widget apps must show the widget UI; non-widget apps show the model response. Min 1, max 3 entries, all public. Images: 706px wide, 400–860px tall, PNG."),
+	negativeTestCases: z.array(negativeTestCaseSchema).length(3).describe("Exactly 3 negative test cases: prompts where the plugin should NOT trigger but the model might think it is relevant. These become production routing metadata that teaches ChatGPT when to stay silent, so pick tight near-misses: a product category the plugin does not carry, the right brand or domain but an intent the plugin does not serve, or a boundary with a sibling plugin."),
+	screenshots: z.array(screenshotEntrySchema.extend({ prompt: z.string().max(75, { error: "Screenshot prompts are limited to 75 characters." }) })).max(3).describe("In-plugin screenshots paired with the user prompt that produced them (each prompt is 75 characters max). Widget plugins must show the widget UI; non-widget plugins show the model response. Min 1, max 3 entries, all public. Images: 706px wide, 400–860px tall, PNG."),
 	translations: z.array(chatgptTranslationSchema).describe("Per-locale translation of tagline + description. English (US) is the default."),
 	allowedCountries: chatgptAllowedCountriesSchema.describe("Availability: all supported countries, or an allow-list / block-list of specific ones (ISO alpha-2)."),
-	releaseNotes: z.string().describe("Publicly displayed on the app details page.")
+	releaseNotes: z.string().describe("Publicly displayed on the plugin details page.")
 });
 const chatgptSubmissionDraftSchema = chatgptSubmissionFormDataSchema.partial().extend({
 	tagline: z.string().optional(),
@@ -1547,6 +1564,7 @@ const metricsQueueEventSchema = z.object({
 	tool: z.string().nullable(),
 	client: z.string(),
 	sessionId: z.string().nullable(),
+	conversationId: z.string().nullable().optional(),
 	durationMs: z.number().int(),
 	outputTokens: z.number().int().nullable(),
 	errorType: z.enum([
@@ -1562,12 +1580,14 @@ z.object({
 	events: z.array(metricsQueueEventSchema)
 });
 z.object({ v: z.number() });
-const telemetrySignalSchema = z.enum([
+const TELEMETRY_SIGNALS = [
 	"logs",
 	"metrics",
 	"traces"
-]);
-const otlpProtocolSchema = z.enum(["http/protobuf", "http/json"]);
+];
+const telemetrySignalSchema = z.enum(TELEMETRY_SIGNALS);
+const OTLP_PROTOCOLS = ["http/protobuf", "http/json"];
+const otlpProtocolSchema = z.enum(OTLP_PROTOCOLS);
 const otlpEndpointSchema = z.string().trim().min(1).max(2048);
 const OTLP_HEADER_VALUE_MAX_LENGTH = 2048;
 const otlpHeaderNameSchema = z.string().trim().min(1, "Enter a header name").max(128).regex(/^[A-Za-z0-9!#$%&'*+\-.^_`|~]+$/, "Use letters, digits and !#$%&'*+-.^_`|~ only");
@@ -1598,34 +1618,13 @@ z.object({
 	protocol: otlpProtocolSchema,
 	headers: z.array(telemetryDestinationHeaderSchema),
 	status: telemetryDestinationStatusSchema,
-	lastFailureReason: otlpPushFailureReasonSchema.nullable()
+	lastFailureReason: otlpPushFailureReasonSchema.nullable(),
+	isScopedToIntentionalRequestsOnly: z.boolean()
 });
-const webhookEventSchema = z.enum([
-	"deployment.succeeded",
-	"deployment.failed",
-	"deployment.canceled"
-]);
-const webhookDestinationStatusSchema = z.enum(["active", "suspended"]);
-const webhookDeliveryFailureReasonSchema = z.enum([
-	"credentials",
-	"blocked-target",
-	"timeout",
-	"unreachable",
-	"receiver-error",
-	"unexpected-status"
-]);
-const webhookUrlSchema = z.url({
-	protocol: /^https$/,
-	error: "Enter a valid HTTPS URL"
-}).max(2048, "Webhook URL must be at most 2048 characters");
-const webhookEventsSchema = z.array(webhookEventSchema).min(1, "Select at least one event").refine((events) => new Set(events).size === events.length, "Events must be unique");
-z.object({
-	id: z.string(),
-	url: webhookUrlSchema,
-	events: webhookEventsSchema,
-	status: webhookDestinationStatusSchema,
-	lastFailureReason: webhookDeliveryFailureReasonSchema.nullable()
-}).extend({ secret: z.string().min(1) });
+const hasDuplicateHeaderNames = (headers) => {
+	const names = headers.map(({ name }) => name.trim().toLowerCase());
+	return new Set(names).size !== names.length;
+};
 //#endregion
 //#region src/auth-scope.ts
 /** Accepts an API key or OAuth access token (default for most routes). */
@@ -1916,6 +1915,100 @@ const environmentVariableOutputSchema = z.object({
 	isSecret: z.boolean(),
 	createdAt: z.coerce.date()
 });
+const telemetryDestinationHeaderOutputSchema = z.discriminatedUnion("isSecret", [z.object({
+	id: z.string(),
+	name: otlpHeaderNameSchema,
+	value: z.null(),
+	isSecret: z.literal(true)
+}), z.object({
+	id: z.string(),
+	name: otlpHeaderNameSchema,
+	value: otlpHeaderValueSchema,
+	isSecret: z.literal(false)
+})]);
+const telemetryDestinationOutputSchema = z.object({
+	id: z.string(),
+	signal: telemetrySignalSchema,
+	endpoint: otlpEndpointSchema,
+	protocol: otlpProtocolSchema,
+	headers: z.array(telemetryDestinationHeaderOutputSchema),
+	status: telemetryDestinationStatusSchema,
+	lastFailureReason: otlpPushFailureReasonSchema.nullable(),
+	isScopedToIntentionalRequestsOnly: z.boolean()
+});
+const createTelemetryDestinationHeaderInputSchema = z.object({
+	name: otlpHeaderNameSchema,
+	value: otlpHeaderValueSchema.min(1, "Enter a header value"),
+	isSecret: z.boolean()
+});
+const updateTelemetryDestinationHeaderInputSchema = z.object({
+	id: z.string().optional(),
+	name: otlpHeaderNameSchema,
+	value: otlpHeaderValueSchema.optional(),
+	isSecret: z.boolean()
+});
+const uniqueTelemetryHeaders = (headers) => !hasDuplicateHeaderNames(headers);
+const listTelemetryDestinationsContractV1 = base.route({
+	path: "/v1/environments/{environmentId}/telemetry-destinations",
+	method: "GET",
+	summary: "List telemetry destinations",
+	description: "List the OTLP destinations configured for an environment. Secret header values are never returned.",
+	tags: ["telemetry"],
+	successDescription: "The list of telemetry destinations"
+}).errors({ NOT_FOUND: {} }).input(z.object({ environmentId: z.string().describe("The ID of the environment") })).output(z.array(telemetryDestinationOutputSchema));
+const createTelemetryDestinationContractV1 = base.route({
+	path: "/v1/environments/{environmentId}/telemetry-destinations",
+	method: "POST",
+	summary: "Create a telemetry destination",
+	description: "Verify and save an OTLP destination for logs, metrics, or traces.",
+	tags: ["telemetry"],
+	successDescription: "The telemetry destination has been created"
+}).errors({
+	NOT_FOUND: {},
+	FORBIDDEN: {},
+	OTLP_DESTINATION_UNVERIFIED: { status: 400 },
+	INTERNAL_SERVER_ERROR: {}
+}).input(z.object({
+	environmentId: z.string().describe("The ID of the environment"),
+	signal: telemetrySignalSchema,
+	endpoint: otlpEndpointSchema,
+	protocol: otlpProtocolSchema.default("http/protobuf"),
+	isScopedToIntentionalRequestsOnly: z.boolean().default(false),
+	headers: z.array(createTelemetryDestinationHeaderInputSchema).default([]).refine(uniqueTelemetryHeaders, "Header names must be unique")
+})).output(telemetryDestinationOutputSchema);
+const updateTelemetryDestinationContractV1 = base.route({
+	path: "/v1/environments/{environmentId}/telemetry-destinations/{destinationId}",
+	method: "PATCH",
+	summary: "Update a telemetry destination",
+	description: "Verify and save changes to an OTLP destination. Omit headers to keep them unchanged; omit the value of an existing header to preserve it. A secret header value must be re-entered when the endpoint changes.",
+	tags: ["telemetry"],
+	successDescription: "The telemetry destination has been updated"
+}).errors({
+	NOT_FOUND: {},
+	FORBIDDEN: {},
+	OTLP_DESTINATION_UNVERIFIED: { status: 400 }
+}).input(z.object({
+	environmentId: z.string().describe("The ID of the environment"),
+	destinationId: z.string().describe("The ID of the telemetry destination"),
+	endpoint: otlpEndpointSchema.optional(),
+	protocol: otlpProtocolSchema.optional(),
+	isScopedToIntentionalRequestsOnly: z.boolean().optional(),
+	headers: z.array(updateTelemetryDestinationHeaderInputSchema).refine(uniqueTelemetryHeaders, "Header names must be unique").optional()
+})).output(telemetryDestinationOutputSchema);
+const deleteTelemetryDestinationContractV1 = base.route({
+	path: "/v1/environments/{environmentId}/telemetry-destinations/{destinationId}",
+	method: "DELETE",
+	summary: "Delete a telemetry destination",
+	description: "Delete an OTLP destination from an environment.",
+	tags: ["telemetry"],
+	successDescription: "The telemetry destination has been deleted"
+}).errors({
+	NOT_FOUND: {},
+	INTERNAL_SERVER_ERROR: {}
+}).input(z.object({
+	environmentId: z.string().describe("The ID of the environment"),
+	destinationId: z.string().describe("The ID of the telemetry destination")
+})).output(z.object({ success: z.literal(true) }));
 const listEnvironmentVariablesContractV1 = base.route({
 	path: "/v1/environments/{environmentId}/environment-variables",
 	method: "GET",
@@ -2059,7 +2152,7 @@ const getLogsContractV1 = base.route({
 		"WARNING",
 		"DEBUG"
 	])).optional().describe("Filter by log level"),
-	search: z.string().optional().describe("Filter pattern to search for in log content"),
+	search: logSearchSchema.optional().describe("Term to search for in log content"),
 	nextToken: z.string().optional().describe("Pagination token from a previous response")
 })).output(z.object({
 	logs: z.array(logEntrySchema),
@@ -2081,7 +2174,7 @@ const getLatestLogsContractV1 = base.route({
 		"WARNING",
 		"DEBUG"
 	])).optional().describe("Filter by log level"),
-	search: z.string().optional().describe("Filter pattern to search for in log content")
+	search: logSearchSchema.optional().describe("Term to search for in log content")
 })).output(z.object({ logs: z.array(logEntrySchema) }));
 const getDeploymentLogsContractV1 = base.route({
 	path: "/v1/deployments/{deploymentId}/logs",
@@ -2479,6 +2572,12 @@ const contract = {
 		update: { v1: updateEnvironmentVariableContractV1 },
 		delete: { v1: deleteEnvironmentVariableContractV1 }
 	},
+	telemetryDestinations: {
+		list: { v1: listTelemetryDestinationsContractV1 },
+		create: { v1: createTelemetryDestinationContractV1 },
+		update: { v1: updateTelemetryDestinationContractV1 },
+		delete: { v1: deleteTelemetryDestinationContractV1 }
+	},
 	projects: {
 		update: { v1: updateProjectContractV1 },
 		get: { v1: getProjectContractV1 },
@@ -2533,4 +2632,4 @@ const OPENAPI_DOC_OPTIONS = {
 	}
 };
 //#endregion
-export { AI_PLATFORMS, AUTH_SCOPE_ANY, AUTH_SCOPE_USER, INTENT_CATEGORY_COLORS, OPENAPI_DOC_OPTIONS, PLATFORM_LABELS, buildSettingsSchema, chatgptSubmissionUpdateSchema, claudeSubmissionUpdateSchema, contract, contractForDocs, createEnvironmentContractV1, deploymentStatusSchema, environmentVariableSchema, environmentVariablesSchema, intentCategoryColorSchema, playgroundExamplePromptSchema, playgroundHeaderSchema, runtimeSchema, serverFieldsSchema, transportSchema, updateEnvironmentVariableSchema };
+export { AI_PLATFORMS, AUTH_SCOPE_ANY, AUTH_SCOPE_USER, INTENT_CATEGORY_COLORS, OPENAPI_DOC_OPTIONS, OTLP_PROTOCOLS, PLATFORM_LABELS, TELEMETRY_SIGNALS, buildSettingsSchema, chatgptSubmissionUpdateSchema, claudeSubmissionUpdateSchema, contract, contractForDocs, createEnvironmentContractV1, deploymentStatusSchema, environmentVariableSchema, environmentVariablesSchema, intentCategoryColorSchema, otlpProtocolSchema, playgroundExamplePromptSchema, playgroundHeaderSchema, runtimeSchema, serverFieldsSchema, telemetrySignalSchema, transportSchema, updateEnvironmentVariableSchema };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alpic-ai/api",
-  "version": "0.0.0-dev.gd9ebdf8",
+  "version": "0.0.0-dev.gda34b6b",
   "description": "Contract for the Alpic API",
   "type": "module",
   "main": "./dist/index.mjs",
@@ -33,20 +33,20 @@
   "author": "Alpic",
   "license": "ISC",
   "dependencies": {
-    "@orpc/contract": "^1.15.2",
+    "@orpc/contract": "^1.15.5",
     "ms": "^2.1.3",
     "zod": "^4.5.4"
   },
   "devDependencies": {
     "@alpic-ai/domains": "0.0.0",
-    "@orpc/openapi": "^1.15.2",
-    "@orpc/zod": "^1.15.2",
+    "@orpc/openapi": "^1.15.5",
+    "@orpc/zod": "^1.15.5",
     "@total-typescript/tsconfig": "^1.0.4",
     "@types/ms": "^2.1.0",
     "shx": "^0.4.0",
-    "tsdown": "^0.23.0",
+    "tsdown": "^0.23.1",
     "typescript": "^6.0.3",
-    "vitest": "^5.0.1"
+    "vitest": "^5.0.3"
   },
   "scripts": {
     "build": "shx rm -rf dist && tsdown",