@alpic-ai/api 0.0.0-dev.ge3de960 → 0.0.0-dev.ge422ee2

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { z } from "zod";
 import * as z$1 from "zod/v4";
 import { oc } from "@orpc/contract";
 import ms from "ms";
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_supports-color@7.2.0_zod@4.5.4/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.1_supports-color@7.2.0_zod@4.5.4/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
 /**
 * Reusable URL validation that disallows javascript: scheme
 */
@@ -420,7 +420,8 @@ z.object({
 	collectResponsePayload: z.boolean(),
 	collectErrorMessage: z.boolean(),
 	collectUserData: z.boolean(),
-	identityTraitKey: z.string().min(1).max(200).nullable()
+	identityTraitKey: z.string().min(1).max(200).nullable(),
+	leadEventName: z.string().min(1).max(200).nullable()
 });
 const feedbackSchema = z.object({
 	id: z.string(),
@@ -864,6 +865,10 @@ const clampStringField = (field) => {
 	const withMin = field.minLength === null ? clamped : clamped.min(field.minLength);
 	return field.description ? withMin.describe(field.description) : withMin;
 };
+const unboundedArrayField = (field) => {
+	const unbounded = z.array(field.element);
+	return field.description ? unbounded.describe(field.description) : unbounded;
+};
 const toolDefinitionSchema = z.object({
 	name: z.string(),
 	title: z.string().optional().describe("Human-friendly name for the tool, used in the UI. If not provided, `name` will be used."),
@@ -876,11 +881,22 @@ const toolDefinitionSchema = z.object({
 	}).optional()
 });
 const positiveTestCaseSchema = z.object({
-	scenario: z.string().describe("Short label for what this case demonstrates."),
-	userPrompt: z.string().describe("A realistic, standalone user message a reviewer can paste and run with no prior state or multi-turn setup. Vary phrasing and tone across cases."),
+	scenario: z.string().min(1).describe("Short label for what this case demonstrates."),
+	userPrompt: z.string().min(1).describe("A realistic, standalone user message a reviewer can paste and run with no prior state or multi-turn setup. Vary phrasing and tone across cases."),
 	toolTriggered: z.string().optional().describe("The tool this prompt should invoke."),
 	expectedOutput: z.string().optional().describe("What the user should see, including post-interaction behaviour where relevant.")
-}).partial().describe("Each case: Scenario, User prompt, Tool triggered, Expected output.");
+}).describe("Each case: Scenario, User prompt, Tool triggered, Expected output.");
+const positiveTestCaseDraftSchema = positiveTestCaseSchema.partial().extend({
+	scenario: z.string().optional(),
+	userPrompt: z.string().optional()
+});
+const blankPositiveTestCase = () => ({
+	scenario: "",
+	userPrompt: "",
+	toolTriggered: "",
+	expectedOutput: ""
+});
+const toFixedLength = (entries, length, blank) => Array.from({ length }, (_, index) => entries[index] ?? blank());
 const screenshotEntrySchema = z.object({
 	prompt: z.string(),
 	url: z.url()
@@ -1193,9 +1209,18 @@ const chatgptTranslationLocaleSchema = z.enum([
 	"zh-TW"
 ]);
 const negativeTestCaseSchema = z.object({
-	scenario: z.string(),
-	userPrompt: z.string()
-}).partial().describe("Each case: Scenario + User prompt (the app should NOT trigger).");
+	scenario: z.string().min(1),
+	userPrompt: z.string().min(1)
+}).describe("Each case: Scenario + User prompt (the app should NOT trigger).");
+const negativeTestCaseDraftSchema = negativeTestCaseSchema.partial().extend({
+	scenario: z.string().optional(),
+	userPrompt: z.string().optional()
+});
+const blankNegativeTestCase = () => ({
+	scenario: "",
+	userPrompt: ""
+});
+const chatgptSkillSchema = z.object({ name: z.string() }).describe("A skill discovered on the MCP server, by name.");
 const chatgptToolJustificationSchema = z.object({
 	toolName: z.string(),
 	readOnlyJustification: z.string().describe("One sentence on what the tool reads and returns."),
@@ -1230,8 +1255,9 @@ const chatgptSubmissionFormDataSchema = z.object({
 	authentication: chatgptAuthenticationSchema.describe("OAuth 2.0 or No auth. OAuth configuration is auto-discovered from the MCP server's metadata."),
 	tools: z.array(toolDefinitionSchema).describe("List of tools exposed by the MCP server (auto-populated from the production server's manifest)."),
 	toolJustifications: z.array(chatgptToolJustificationSchema).describe("Per-tool justification of `readOnlyHint`, `openWorldHint`, and `destructiveHint` annotation values. One short, specific sentence per hint describing what the tool actually does."),
-	testCases: z.array(positiveTestCaseSchema).describe("At least 5 positive test cases. Each: Scenario, User prompt, Tool triggered, Expected output. Collectively cover the full capability across different flow stages (initial search or browse, market or locale handling, post-interaction detail, an action ChatGPT performs on the user's behalf, and a conversion or secondary tool) rather than five variations of the same first step."),
-	negativeTestCases: z.array(negativeTestCaseSchema).describe("3 negative test cases: prompts where the app should NOT trigger but the model might think it is relevant. These become production routing metadata that teaches ChatGPT when to stay silent, so pick tight near-misses: a product category the app does not carry, the right brand or domain but an intent the app does not serve, or a boundary with a sibling app."),
+	skills: z.array(chatgptSkillSchema).optional().describe("Skills the server exposes over MCP (auto-populated from the production server's manifest). Left unset when the server does not advertise the skills extension, which is a different state from advertising it and exposing none."),
+	testCases: z.array(positiveTestCaseSchema).length(5).describe("Exactly 5 positive test cases. Each: Scenario, User prompt, Tool triggered, Expected output. Collectively cover the full capability across different flow stages (initial search or browse, market or locale handling, post-interaction detail, an action ChatGPT performs on the user's behalf, and a conversion or secondary tool) rather than five variations of the same first step."),
+	negativeTestCases: z.array(negativeTestCaseSchema).length(3).describe("Exactly 3 negative test cases: prompts where the app should NOT trigger but the model might think it is relevant. These become production routing metadata that teaches ChatGPT when to stay silent, so pick tight near-misses: a product category the app does not carry, the right brand or domain but an intent the app does not serve, or a boundary with a sibling app."),
 	screenshots: z.array(screenshotEntrySchema.extend({ prompt: z.string().max(75, { error: "Screenshot prompts are limited to 75 characters." }) })).max(3).describe("In-app screenshots paired with the user prompt that produced them (each prompt is 75 characters max). Widget apps must show the widget UI; non-widget apps show the model response. Min 1, max 3 entries, all public. Images: 706px wide, 400–860px tall, PNG."),
 	translations: z.array(chatgptTranslationSchema).describe("Per-locale translation of tagline + description. English (US) is the default."),
 	allowedCountries: chatgptAllowedCountriesSchema.describe("Availability: all supported countries, or an allow-list / block-list of specific ones (ISO alpha-2)."),
@@ -1246,23 +1272,35 @@ const chatgptSubmissionDraftSchema = chatgptSubmissionFormDataSchema.partial().e
 	demoRecordingUrl: z.string().optional(),
 	serverUrl: z.string().optional(),
 	screenshots: z.array(screenshotDraftEntrySchema).optional(),
+	testCases: z.array(positiveTestCaseDraftSchema).optional(),
+	negativeTestCases: z.array(negativeTestCaseDraftSchema).optional(),
 	translations: z.array(chatgptTranslationSchema.extend({ tagline: z.string() })).optional()
 });
-chatgptSubmissionFormDataSchema.pick({
+/** Source of truth for the fields `SubmissionPrefillService.prefill({ platform: "chatgpt" })` can populate. */
+const chatgptPrefillFormDataSchema = chatgptSubmissionFormDataSchema.pick({
 	appName: true,
 	developerName: true,
 	serverUrl: true,
 	tools: true,
+	skills: true,
 	authentication: true
 });
-chatgptSubmissionFormDataSchema.pick({
+/** Source of truth for `SubmissionPrefillService.generate({ platform: "chatgpt" })`. */
+const chatgptAiGeneratedFormDataSchema = chatgptSubmissionFormDataSchema.pick({
 	tagline: true,
 	description: true,
 	category: true,
 	testCases: true,
 	negativeTestCases: true,
 	toolJustifications: true
-}).extend({ tagline: clampStringField(chatgptSubmissionFormDataSchema.shape.tagline) });
+}).extend({
+	testCases: unboundedArrayField(chatgptSubmissionFormDataSchema.shape.testCases),
+	negativeTestCases: unboundedArrayField(chatgptSubmissionFormDataSchema.shape.negativeTestCases)
+}).extend({
+	tagline: clampStringField(chatgptSubmissionFormDataSchema.shape.tagline),
+	testCases: z.array(positiveTestCaseDraftSchema).transform((cases) => toFixedLength(cases, 5, blankPositiveTestCase)),
+	negativeTestCases: z.array(negativeTestCaseDraftSchema).transform((cases) => toFixedLength(cases, 3, blankNegativeTestCase))
+});
 const claudeCategorySchema = z.enum([
 	"Productivity",
 	"Communication",
@@ -1385,7 +1423,8 @@ const claudeSubmissionDraftSchema = claudeSubmissionFormDataSchema.partial().ext
 	categories: z.array(claudeCategorySchema).optional(),
 	screenshots: z.array(screenshotDraftEntrySchema).optional()
 });
-claudeSubmissionFormDataSchema.pick({
+/** Source of truth for the fields `SubmissionPrefillService.prefill({ platform: "claudeai" })` can populate. */
+const claudePrefillFormDataSchema = claudeSubmissionFormDataSchema.pick({
 	serverUrl: true,
 	name: true,
 	slug: true,
@@ -1407,27 +1446,81 @@ const claudeAiGeneratedFormDataRawSchema = z.object({
 	categories: z.array(claudeCategorySchema).describe(claudeCategoryDescription),
 	primaryUseCases: claudeSubmissionFormDataSchema.shape.primaryUseCases
 });
-claudeAiGeneratedFormDataRawSchema.extend({
+const claudeAiGeneratedFormDataSchema = claudeAiGeneratedFormDataRawSchema.extend({
 	oneLiner: clampStringField(claudeSubmissionFormDataSchema.shape.oneLiner),
 	categories: claudeAiGeneratedFormDataRawSchema.shape.categories.transform((categories) => categories.slice(0, 5))
 });
+function provenanceByField(prefillShape, aiGeneratedShape) {
+	const byField = {};
+	for (const field of Object.keys(prefillShape)) byField[field] = "prefilled";
+	for (const field of Object.keys(aiGeneratedShape)) byField[field] = "ai-generated";
+	return byField;
+}
+provenanceByField(claudePrefillFormDataSchema.shape, claudeAiGeneratedFormDataSchema.shape), provenanceByField(chatgptPrefillFormDataSchema.shape, chatgptAiGeneratedFormDataSchema.shape);
+const urlVerificationOutcomeSchema = z.enum([
+	"pass",
+	"fail",
+	"unverified"
+]);
+const VERIFIABLE_URL_FIELDS = {
+	chatgpt: ["privacyPolicyUrl", "termsOfServiceUrl"],
+	claudeai: ["privacyPolicy"]
+};
+const verifiableUrlFieldSchema = z.enum([...VERIFIABLE_URL_FIELDS.chatgpt, ...VERIFIABLE_URL_FIELDS.claudeai]);
+const policyDisclosureSchema = z.enum([
+	"dataCategories",
+	"purposesOfUse",
+	"recipients",
+	"retention"
+]);
+const urlVerificationFieldResultSchema = z.object({
+	field: verifiableUrlFieldSchema,
+	url: z.string(),
+	outcome: urlVerificationOutcomeSchema,
+	reason: z.string(),
+	concerns: z.array(z.string()).optional(),
+	scrapedWith: z.enum(["fetch", "firecrawl"]).optional()
+});
+const urlVerificationSchema = z.object({
+	verifiedAt: z.coerce.date(),
+	results: z.array(urlVerificationFieldResultSchema)
+});
+const pageKindSchema = z.enum([
+	"expectedDocument",
+	"errorPage",
+	"loginWall",
+	"parkedDomain",
+	"comingSoon",
+	"marketingPage",
+	"unrelatedDocument"
+]);
+z.object({
+	pageKind: pageKindSchema.describe("What the page actually is. Use 'expectedDocument' only when it is genuinely the document the field claims."),
+	reason: z.string().max(200).describe("One sentence naming what the page is, addressed to the developer who entered the URL."),
+	missingDisclosures: z.array(policyDisclosureSchema).describe("For a privacy policy only: which of the four required disclosures the text does not cover. Empty for every other page kind.")
+});
 const submissionMetaFieldsSchema = z.object({
 	id: z.string(),
 	environmentId: z.string(),
 	auditId: z.string().nullable(),
+	urlVerification: urlVerificationSchema.nullable().default(null),
 	createdAt: z.coerce.date(),
 	updatedAt: z.coerce.date()
 });
 const claudeSubmissionSchemaInternal = submissionMetaFieldsSchema.extend({
 	platform: z.literal("claudeai"),
-	formData: claudeSubmissionDraftSchema
+	formData: claudeSubmissionDraftSchema,
+	prefillSnapshot: claudeSubmissionDraftSchema.nullable().default(null)
 });
 const chatgptSubmissionSchemaInternal = submissionMetaFieldsSchema.extend({
 	platform: z.literal("chatgpt"),
-	formData: chatgptSubmissionDraftSchema
+	formData: chatgptSubmissionDraftSchema,
+	prefillSnapshot: chatgptSubmissionDraftSchema.nullable().default(null)
 });
-z.discriminatedUnion("platform", [claudeSubmissionSchemaInternal, chatgptSubmissionSchemaInternal]);
+const submissionSchemaInternal = z.discriminatedUnion("platform", [claudeSubmissionSchemaInternal, chatgptSubmissionSchemaInternal]);
 z.union([claudeSubmissionDraftSchema, chatgptSubmissionDraftSchema]);
+/** Discriminated on `platform`, which pins the shape of `formData`: a Claude submission cannot carry chatgpt-only fields, and vice-versa. */
+const submissionSchema = submissionSchemaInternal;
 z.literal([
 	100,
 	75,
@@ -2274,6 +2367,57 @@ const getBeaconContractV1 = base.route({
 	createdAt: z.coerce.date(),
 	report: auditReportWithScreenshotsSchema.nullable()
 }));
+const PLATFORM_DESCRIPTION = "The directory the package targets: `chatgpt` for the OpenAI App Directory, `claudeai` for the Anthropic MCP Directory";
+const submissionIdSchema = z.string().describe("The ID of the submission package");
+const claudeSubmissionUpdateSchema = claudeSubmissionDraftSchema.strict();
+const chatgptSubmissionUpdateSchema = chatgptSubmissionDraftSchema.strict();
+const createSubmissionContractV1 = base.route({
+	path: "/v1/submissions",
+	method: "POST",
+	summary: "Create a submission package",
+	description: "Create a submission package for an environment. Alpic reads the environment's live MCP server and prefills every field it can infer, so the response already carries the populated package. The environment must have a successful deployment and must not require authentication.",
+	tags: ["submissions"],
+	successDescription: "The created submission package, with its prefilled fields"
+}).errors({ NOT_FOUND: {} }).input(z.object({
+	environmentId: z.string().describe("The ID of the environment to build the package from"),
+	platform: platformSchema.describe(PLATFORM_DESCRIPTION)
+})).output(submissionSchema);
+const listSubmissionsContractV1 = base.route({
+	path: "/v1/projects/{projectId}/submissions",
+	method: "GET",
+	summary: "List submission packages",
+	description: "List the submission packages of a project, grouped by directory and most recently updated first, optionally narrowed to one environment or one directory",
+	tags: ["submissions"],
+	successDescription: "The list of submission packages"
+}).errors({ NOT_FOUND: {} }).input(z.object({
+	projectId: z.string().describe("The ID of the project"),
+	environmentId: z.string().optional().describe("Filter by environment ID"),
+	platform: platformSchema.optional().describe(PLATFORM_DESCRIPTION)
+})).output(z.array(submissionSchema));
+const getSubmissionContractV1 = base.route({
+	path: "/v1/submissions/{submissionId}",
+	method: "GET",
+	summary: "Get a submission package",
+	description: "Get a submission package by ID, including its form data and the prefill it started from",
+	tags: ["submissions"],
+	successDescription: "The submission package"
+}).errors({ NOT_FOUND: {} }).input(z.object({ submissionId: submissionIdSchema })).output(submissionSchema);
+const updateSubmissionContractV1 = base.route({
+	path: "/v1/submissions/{submissionId}",
+	method: "PUT",
+	summary: "Update a submission package",
+	description: "Update the form data of a submission package. Only the fields you send are changed; the rest are left as they are. Unknown field names are rejected rather than ignored, so a typo fails the call. `platform` must match the package's own platform.",
+	tags: ["submissions"],
+	successDescription: "The updated submission package"
+}).errors({ NOT_FOUND: {} }).input(z.discriminatedUnion("platform", [z.object({
+	submissionId: submissionIdSchema,
+	platform: z.literal("claudeai").describe(PLATFORM_DESCRIPTION),
+	formData: claudeSubmissionUpdateSchema
+}), z.object({
+	submissionId: submissionIdSchema,
+	platform: z.literal("chatgpt").describe(PLATFORM_DESCRIPTION),
+	formData: chatgptSubmissionUpdateSchema
+})])).output(submissionSchema);
 const contract = {
 	teams: {
 		list: { v1: listTeamsContractV1 },
@@ -2329,6 +2473,12 @@ const contract = {
 	beacon: {
 		create: { v1: createBeaconContractV1 },
 		get: { v1: getBeaconContractV1 }
+	},
+	submissions: {
+		create: { v1: createSubmissionContractV1 },
+		list: { v1: listSubmissionsContractV1 },
+		get: { v1: getSubmissionContractV1 },
+		update: { v1: updateSubmissionContractV1 }
 	}
 };
 const { uploadArtifact: _discard, ...deploymentsForDocs } = contract.deployments;
@@ -2336,5 +2486,26 @@ const contractForDocs = {
 	...contract,
 	deployments: deploymentsForDocs
 };
+/** Shared by the served `openapi.json` and the snapshot test that guards it, so the two cannot drift. */
+const OPENAPI_DOC_OPTIONS = {
+	info: {
+		title: "Alpic API",
+		version: "1.0.0"
+	},
+	servers: [{ url: "https://api.alpic.ai" }],
+	security: [{ bearerAuth: [] }],
+	components: { securitySchemes: { bearerAuth: {
+		type: "http",
+		description: "Bearer token for authentication. Use an API key from the API Keys page in team settings, or an OAuth access token.",
+		scheme: "bearer"
+	} } },
+	commonSchemas: {
+		Submission: { schema: submissionSchema },
+		ClaudeSubmissionFormData: { schema: claudeSubmissionDraftSchema },
+		ChatgptSubmissionFormData: { schema: chatgptSubmissionDraftSchema },
+		ClaudeSubmissionFormDataUpdate: { schema: claudeSubmissionUpdateSchema },
+		ChatgptSubmissionFormDataUpdate: { schema: chatgptSubmissionUpdateSchema }
+	}
+};
 //#endregion
-export { AUTH_SCOPE_ANY, AUTH_SCOPE_USER, INTENT_CATEGORY_COLORS, PLATFORM_LABELS, buildSettingsSchema, contract, contractForDocs, createEnvironmentContractV1, deploymentStatusSchema, environmentVariableSchema, environmentVariablesSchema, intentCategoryColorSchema, playgroundExamplePromptSchema, playgroundHeaderSchema, runtimeSchema, serverFieldsSchema, transportSchema, updateEnvironmentVariableSchema };
+export { AI_PLATFORMS, AUTH_SCOPE_ANY, AUTH_SCOPE_USER, INTENT_CATEGORY_COLORS, OPENAPI_DOC_OPTIONS, PLATFORM_LABELS, buildSettingsSchema, chatgptSubmissionUpdateSchema, claudeSubmissionUpdateSchema, contract, contractForDocs, createEnvironmentContractV1, deploymentStatusSchema, environmentVariableSchema, environmentVariablesSchema, intentCategoryColorSchema, playgroundExamplePromptSchema, playgroundHeaderSchema, runtimeSchema, serverFieldsSchema, transportSchema, updateEnvironmentVariableSchema };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alpic-ai/api",
-  "version": "0.0.0-dev.ge3de960",
+  "version": "0.0.0-dev.ge422ee2",
   "description": "Contract for the Alpic API",
   "type": "module",
   "main": "./dist/index.mjs",
@@ -33,20 +33,20 @@
   "author": "Alpic",
   "license": "ISC",
   "dependencies": {
-    "@orpc/contract": "^1.15.0",
+    "@orpc/contract": "^1.15.4",
     "ms": "^2.1.3",
     "zod": "^4.5.4"
   },
   "devDependencies": {
     "@alpic-ai/domains": "0.0.0",
-    "@orpc/openapi": "^1.15.0",
-    "@orpc/zod": "^1.15.0",
+    "@orpc/openapi": "^1.15.4",
+    "@orpc/zod": "^1.15.4",
     "@total-typescript/tsconfig": "^1.0.4",
     "@types/ms": "^2.1.0",
     "shx": "^0.4.0",
-    "tsdown": "^0.22.14",
+    "tsdown": "^0.23.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.2"
   },
   "scripts": {
     "build": "shx rm -rf dist && tsdown",