@alpic-ai/api 0.0.0-dev.geca1d94 → 0.0.0-dev.ged18600

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { z } from "zod";
 import * as z$1 from "zod/v4";
 import { oc } from "@orpc/contract";
 import ms from "ms";
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_supports-color@7.2.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
 /**
 * Reusable URL validation that disallows javascript: scheme
 */
@@ -169,11 +169,21 @@ z$1.object({
 	token: z$1.string(),
 	token_type_hint: z$1.string().optional()
 }).strip();
-const platformSchema = z.enum(["chatgpt", "claudeai"]);
+//#endregion
+//#region ../domains/dist/index.mjs
+const AI_PLATFORMS = ["chatgpt", "claudeai"];
+const platformSchema = z.enum(AI_PLATFORMS);
 const PLATFORM_LABELS = {
 	chatgpt: "ChatGPT",
 	claudeai: "Claude.ai"
 };
+const WAF_PLATFORMS = [
+	"akamai",
+	"cloudflare",
+	"fastly"
+];
+const ALLOWED_PLATFORMS = [...AI_PLATFORMS, ...WAF_PLATFORMS];
+const allowedPlatformSchema = z.enum(ALLOWED_PLATFORMS);
 const auditStatusSchema = z.enum([
 	"pending",
 	"partial",
@@ -273,34 +283,51 @@ const deploymentSummarySchema = z.object({
 	createdAt: z.coerce.date(),
 	updatedAt: z.coerce.date()
 });
-/**
-* Public environment
-*
-* No OAuth metadata exposed.
-*/
+/** Public environment: answers anonymously and exposes no OAuth metadata. */
 const publicEnvironmentSchema = z.object({
+	allowsAnonymous: z.literal(true),
+	oAuthMetadata: z.strictObject({})
+});
+/** Protected environment whose external resource metadata URL is returned in the WWW-Authenticate header on the first 401; everything after is handled outside the MCP server scope. */
+const externalResourceMetadataEnvironmentSchema = z.object({
+	allowsAnonymous: z.boolean(),
+	oAuthMetadata: z.object({ externalResourceMetadataUrl: z.url() }),
+	scope: z.string().optional()
+});
+/** Protected environment whose own /.well-known/oauth-protected-resource endpoint points at an external authorization server; everything after is handled outside the MCP server scope. */
+const externalAuthorizationServerEnvironmentSchema = z.object({
+	allowsAnonymous: z.boolean(),
+	oAuthMetadata: z.object({
+		externalAuthorizationServerUrl: z.url(),
+		resourceMetadata: OAuthProtectedResourceMetadataSchema.optional()
+	}),
+	scope: z.string().optional()
+});
+/** Standalone protected environment: the server itself exposes both the /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server endpoints. */
+const standaloneEnvironmentSchema = z.object({
+	allowsAnonymous: z.boolean(),
+	oAuthMetadata: z.object({
+		authorizationServerMetadata: z.union([OAuthMetadataSchema, OpenIdProviderDiscoveryMetadataSchema]),
+		resourceMetadata: OAuthProtectedResourceMetadataSchema.optional()
+	}),
+	scope: z.string().optional()
+});
+/** Protected environment that enforces authentication but advertises no OAuth discovery metadata; clients must obtain credentials out-of-band. */
+const protectedWithoutDiscoveryEnvironmentSchema = z.object({
+	allowsAnonymous: z.literal(false),
+	oAuthMetadata: z.strictObject({}),
+	scope: z.string().optional()
+});
+const legacyPublicEnvironmentSchema = z.object({
 	isPublic: z.literal(true),
 	oAuthMetadata: z.undefined().optional()
 });
-/**
-* Protected environment with an external resource metadata URL
-*
-* An external resource metadata URL is returned in the WWW-Authenticate header during the first 401 response.
-* Everything that follows is handled outside of the MCP server scope.
-*/
-const externalResourceMetadataEnvironmentSchema = z.object({
+const legacyExternalResourceMetadataEnvironmentSchema = z.object({
 	isPublic: z.literal(false),
 	oAuthMetadata: z.object({ externalResourceMetadataUrl: z.url() }),
 	scope: z.string().optional()
 });
-/**
-* Protected environment with an external authorization server URL
-*
-* The server itself exposes the /.well-known/oauth-protected-resource endpoint.
-* An external authorization server URL is returned when requesting the endpoint.
-* Everything that follows is handled outside of the MCP server scope.
-*/
-const externalAuthorizationServerEnvironmentSchema = z.object({
+const legacyExternalAuthorizationServerEnvironmentSchema = z.object({
 	isPublic: z.literal(false),
 	oAuthMetadata: z.object({
 		externalAuthorizationServerUrl: z.url(),
@@ -308,13 +335,7 @@ const externalAuthorizationServerEnvironmentSchema = z.object({
 	}),
 	scope: z.string().optional()
 });
-/**
-* Standalone protected environment
-*
-* The server itself exposes the /.well-known/oauth-protected-resource endpoint.
-* The server itself exposes the /.well-known/oauth-authorization-server endpoint.
-*/
-const standaloneEnvironmentSchema = z.object({
+const legacyStandaloneEnvironmentSchema = z.object({
 	isPublic: z.literal(false),
 	oAuthMetadata: z.object({
 		authorizationServerMetadata: z.union([OAuthMetadataSchema, OpenIdProviderDiscoveryMetadataSchema]),
@@ -322,14 +343,7 @@ const standaloneEnvironmentSchema = z.object({
 	}),
 	scope: z.string().optional()
 });
-/**
-* Protected environment without OAuth discovery
-*
-* The server enforces authentication but exposes no OAuth discovery metadata.
-* Neither /.well-known/oauth-protected-resource nor /.well-known/oauth-authorization-server
-* are advertised. Clients must obtain credentials out-of-band.
-*/
-const protectedWithoutDiscoveryEnvironmentSchema = z.object({
+const legacyProtectedWithoutDiscoveryEnvironmentSchema = z.object({
 	isPublic: z.literal(false),
 	oAuthMetadata: z.strictObject({}),
 	scope: z.string().optional()
@@ -339,9 +353,13 @@ z.union([
 	externalResourceMetadataEnvironmentSchema,
 	externalAuthorizationServerEnvironmentSchema,
 	standaloneEnvironmentSchema,
-	protectedWithoutDiscoveryEnvironmentSchema
+	protectedWithoutDiscoveryEnvironmentSchema,
+	legacyPublicEnvironmentSchema,
+	legacyExternalResourceMetadataEnvironmentSchema,
+	legacyExternalAuthorizationServerEnvironmentSchema,
+	legacyStandaloneEnvironmentSchema,
+	legacyProtectedWithoutDiscoveryEnvironmentSchema
 ]);
-const allowedPlatformSchema = platformSchema;
 const playgroundModelSchema = z.enum([
 	"global.anthropic.claude-haiku-4-5-20251001-v1:0",
 	"global.anthropic.claude-sonnet-4-5-20250929-v1:0",
@@ -381,14 +399,16 @@ z.object({
 	collectRequestPayload: z.boolean(),
 	collectResponsePayload: z.boolean(),
 	collectErrorMessage: z.boolean(),
-	collectUserData: z.boolean()
+	collectUserData: z.boolean(),
+	identityTraitKey: z.string().min(1).max(200).nullable()
 });
 z.object({
 	id: z.string(),
 	createdAt: z.coerce.date(),
 	environmentId: z.string(),
 	content: z.string(),
-	source: z.enum(["model", "user"])
+	source: z.enum(["model", "user"]),
+	clientName: z.string().nullable()
 });
 z.object({
 	content: z.string(),
@@ -424,6 +444,7 @@ z.object({
 	environmentId: z.string(),
 	toolName: z.string(),
 	message: z.string(),
+	clientName: z.string().nullable(),
 	categories: z.array(intentCategorySchema)
 });
 const signalCategorySchema = z.object({
@@ -488,6 +509,246 @@ z.enum([
 	"DEBUG",
 	"ERROR"
 ]);
+/** Only names a vendor actually ships belong here: lookalikes like `claude-code-test` are customers' own scripts. */
+const MCP_CLIENT_GROUPS = [
+	{
+		id: "claude_code",
+		label: "Claude Code",
+		vendor: "anthropic",
+		rawNames: ["claude-code", "Anthropic/ClaudeCodeDesktop"]
+	},
+	{
+		id: "claude",
+		label: "Claude",
+		vendor: "anthropic",
+		rawNames: [
+			"Anthropic/ClaudeAI",
+			"claude-ai",
+			"claude",
+			"Claude",
+			"claude-desktop",
+			"claude-desktop-3p"
+		]
+	},
+	{
+		id: "claude_mobile",
+		label: "Claude mobile",
+		vendor: "anthropic",
+		rawNames: ["claude-ios", "ClaudeAndroid"]
+	},
+	{
+		id: "claude_cowork",
+		label: "Claude Cowork",
+		vendor: "anthropic",
+		rawNames: ["Anthropic/Cowork"]
+	},
+	{
+		id: "claude_toolbox",
+		label: "Claude Toolbox",
+		vendor: "anthropic",
+		rawNames: ["Anthropic/Toolbox", "Anthropic/toolbox-bootstrap"]
+	},
+	{
+		id: "anthropic_api",
+		label: "Anthropic API",
+		vendor: "anthropic",
+		rawNames: ["Anthropic/API"]
+	},
+	{
+		id: "anthropic_connector_refresh",
+		label: "Anthropic (connector refresh)",
+		vendor: "anthropic",
+		rawNames: ["Anthropic"]
+	},
+	{
+		id: "codex",
+		label: "Codex",
+		vendor: "openai",
+		rawNames: [
+			"codex-mcp-client",
+			"codex",
+			"Codex",
+			"codex-cli",
+			"openai-mcp (Codex)"
+		]
+	},
+	{
+		id: "chatgpt",
+		label: "ChatGPT",
+		vendor: "openai",
+		rawNames: ["openai-mcp (ChatGPT)"]
+	},
+	{
+		id: "openai_responses_api",
+		label: "OpenAI Responses API",
+		vendor: "openai",
+		rawNames: ["openai-mcp (Responses API)"]
+	},
+	{
+		id: "openai_agent_builder",
+		label: "OpenAI Agent Builder",
+		vendor: "openai",
+		rawNames: ["openai-mcp (Agent Builder)"]
+	},
+	{
+		id: "openai_other",
+		label: "OpenAI Other",
+		vendor: "openai",
+		rawNames: ["openai-mcp"]
+	},
+	{
+		id: "cursor",
+		label: "Cursor",
+		vendor: "cursor",
+		rawNames: [
+			"cursor-vscode",
+			"Cursor",
+			"cursor"
+		]
+	},
+	{
+		id: "cline",
+		label: "Cline",
+		vendor: "cline",
+		rawNames: [
+			"Cline",
+			"cline",
+			"@cline/core"
+		]
+	},
+	{
+		id: "github_copilot",
+		label: "GitHub Copilot",
+		vendor: "githubCopilot",
+		rawNames: [
+			"Copilot",
+			"github-copilot-developer",
+			"Copilot MCP Gateway",
+			"Xcode/copilot-xcode"
+		]
+	},
+	{
+		id: "gemini_cli",
+		label: "Gemini CLI",
+		vendor: "google",
+		rawNames: ["gemini-cli-mcp-client", "gemini-cli"]
+	},
+	{
+		id: "antigravity",
+		label: "Antigravity",
+		vendor: "google",
+		rawNames: ["antigravity-client"]
+	},
+	{
+		id: "gemini",
+		label: "Gemini",
+		vendor: "google",
+		rawNames: ["Gemini", "google-ai-edge-gallery"]
+	},
+	{
+		id: "windsurf",
+		label: "Windsurf",
+		vendor: "windsurf",
+		rawNames: ["Windsurf", "windsurf-client"]
+	},
+	{
+		id: "mistral",
+		label: "Mistral / Le Chat",
+		vendor: "mistral",
+		rawNames: ["Mistral"],
+		rawNamePrefixes: ["connector:custom-mcp:"]
+	},
+	{
+		id: "n8n",
+		label: "n8n",
+		vendor: "n8n",
+		rawNames: [
+			"@n8n/n8n-nodes-langchain.mcpClient",
+			"@n8n/n8n-nodes-langchain.mcpClientTool",
+			"n8n"
+		]
+	},
+	{
+		id: "alpic_playground",
+		label: "Alpic Playground",
+		vendor: "alpic",
+		rawNames: ["alpic-playground", "playground"]
+	},
+	{
+		id: "opencode",
+		label: "opencode",
+		vendor: "opencode",
+		rawNames: ["opencode"]
+	},
+	{
+		id: "zed",
+		label: "Zed",
+		vendor: "zed",
+		rawNames: ["Zed", "zed"]
+	},
+	{
+		id: "zapier",
+		label: "Zapier",
+		vendor: "zapier",
+		rawNames: ["Zapier", "zapier"]
+	},
+	{
+		id: "make",
+		label: "Make",
+		vendor: "make",
+		rawNames: ["Make", "make"]
+	},
+	{
+		id: "librechat",
+		label: "LibreChat",
+		vendor: "mcp",
+		rawNames: ["LibreChat", "librechat"]
+	},
+	{
+		id: "jan",
+		label: "Jan",
+		vendor: "mcp",
+		rawNames: ["Jan", "jan"]
+	},
+	{
+		id: "goose",
+		label: "goose",
+		vendor: "mcp",
+		rawNames: ["goose", "Goose"]
+	},
+	{
+		id: "mcphost",
+		label: "mcphost",
+		vendor: "mcp",
+		rawNames: ["mcphost"]
+	},
+	{
+		id: "mcporter",
+		label: "mcporter",
+		vendor: "mcp",
+		rawNames: ["mcporter"]
+	},
+	{
+		id: "rmcp",
+		label: "rmcp",
+		vendor: "mcp",
+		rawNames: ["rmcp"]
+	},
+	{
+		id: "unnamed_client",
+		label: "Unnamed client",
+		vendor: "mcp",
+		rawNames: [
+			"mcp",
+			"unknown",
+			""
+		]
+	}
+];
+/** A source pattern, not a RegExp, because analytics renders the same rule into ClickHouse RE2, which shares this syntax. */
+const MCP_REMOTE_WRAPPER_SUFFIX = String.raw` \(via mcp-remote [^\n]+?\)$`;
+new RegExp(MCP_REMOTE_WRAPPER_SUFFIX);
+new Map(MCP_CLIENT_GROUPS.map((group) => [group.id, group]));
 const runtimeSchema = z.enum([
 	"python3.13",
 	"python3.14",
@@ -565,15 +826,7 @@ z.object({
 	serverFields: serverFieldsSchema$1,
 	source: z.enum(["registry", "defaults"])
 });
-/**
-* Returns a variant of a `maxLength`-constrained string that clamps (truncates) instead of
-* rejecting on overflow — used for AI-generated copy where the model routinely overshoots.
-*
-* NOTE: this rebuilds the schema from scratch, carrying over only `maxLength` (as a clamp),
-* `minLength`, and the description. Any other validators on the source field (`.regex()`,
-* `.email()`, custom refinements) are intentionally dropped — this helper is meant for plain
-* free-text length caps only. A field with `null` `maxLength` is returned unchanged.
-*/
+/** Clamps instead of rejecting on max-length overflow (for AI-generated copy that overshoots); intentionally carries over only maxLength, minLength, and description, dropping any other validators. */
 const clampStringField = (field) => {
 	const max = field.maxLength;
 	if (max === null) return field;
@@ -919,11 +1172,7 @@ const chatgptToolJustificationSchema = z.object({
 	openWorldJustification: z.string().describe("One sentence on whether the tool reaches external systems beyond your own service."),
 	destructiveJustification: z.string().describe("One sentence on whether the tool changes data. For a read-only tool, state the full triad: \"No data is created, modified, or deleted.\"")
 }).describe("Per-tool justification of each MCP annotation value (one specific sentence per hint).");
-/**
-* Base copy fields, defined once and reused by both the submission form and per-locale
-* translations so the constraints (tagline ≤ 30 chars) never drift. The translation generation
-* path wraps these in {@link clampStringField} since the LLM tends to overshoot the limit.
-*/
+/** Defined once and reused by both the submission form and per-locale translations so the tagline ≤ 30 chars constraint never drifts. */
 const chatgptTaglineSchema = z.string().max(30);
 const chatgptDescriptionSchema = z.string();
 const chatgptTranslationSchema = z.object({
@@ -932,10 +1181,7 @@ const chatgptTranslationSchema = z.object({
 	description: chatgptDescriptionSchema
 }).describe("Locale-scoped override for tagline + description. English (US) is the default.");
 chatgptTranslationSchema.extend({ tagline: clampStringField(chatgptTaglineSchema) });
-/**
-* Field order mirrors the ChatGPT (OpenAI) submission spreadsheet, grouped by section.
-* When adding/removing/reordering fields, keep this in sync with the sheet.
-*/
+/** Field order mirrors the ChatGPT (OpenAI) submission spreadsheet, grouped by section; keep it in sync with the sheet. */
 const chatgptSubmissionFormDataSchema = z.object({
 	logoLight: z.string().describe("Logo icon for light mode. Square PNG, no borders or rounded corners (clients apply circular cropping)."),
 	logoDark: z.string().optional().describe("Optional dark-mode logo icon. Square PNG, same specs as the light icon. Leave empty if the light icon also works on dark backgrounds."),
@@ -1032,11 +1278,7 @@ const claudePolicyAcknowledgementSchema = z.enum([
 	"My connector does not collect conversation data beyond what is needed for its function.",
 	"Public documentation for this connector will be live by the publish date."
 ]);
-/**
-* Field order mirrors the claude.ai directory submission wizard
-* (`claude.ai/admin-settings/directory/submissions/new`), grouped by step.
-* When adding/removing/reordering fields, keep this in sync with the wizard.
-*/
+/** Field order mirrors the claude.ai directory submission wizard (`claude.ai/admin-settings/directory/submissions/new`), grouped by step; keep it in sync with the wizard. */
 const claudeSubmissionFormDataSchema = z.object({
 	serverUrl: z.url().describe(`The full https:// URL where your MCP server is hosted and reachable. In the claude.ai wizard this is read live
 from the custom connector you select — the connection is used to verify the URL and the tool list at submission time.
@@ -1128,12 +1370,7 @@ claudeSubmissionFormDataSchema.pick({
 	connectionRequirements: claudeSubmissionFormDataSchema.shape.connectionRequirements.optional(),
 	testInstructions: claudeSubmissionFormDataSchema.shape.testInstructions.optional()
 });
-/**
-* Narrative fields the LLM-backed generation step produces for Claude submissions.
-* This schema accepts the slightly loose shape returned by AI generation, then normalizes it into
-* the strict form shape. Keep transforms here rather than in callers so generation leniency is
-* colocated with the Claude contract.
-*/
+/** Loose shape returned by AI generation for Claude narrative fields; transforms live here so generation leniency stays colocated with the Claude contract. */
 const claudeAiGeneratedFormDataRawSchema = z.object({
 	oneLiner: claudeSubmissionFormDataSchema.shape.oneLiner,
 	description: claudeSubmissionFormDataSchema.shape.description,
@@ -1225,7 +1462,10 @@ const RESERVED_KEYS = [
 	"BUILD_ARG_START_COMMAND",
 	"ALPIC_HOST",
 	"ALPIC_CUSTOM_DOMAINS",
-	"ALPIC_INTENT_META_KEY"
+	"ALPIC_INTENT_META_KEY",
+	"ALPIC_FEEDBACK_META_KEY",
+	"ALPIC_EVENTS_META_KEY",
+	"ALPIC_IDENTIFY_META_KEY"
 ];
 const environmentVariableSchema = z.object({
 	key: z.string().min(2, "Key must be at least 2 characters").regex(/^[a-zA-Z]([a-zA-Z0-9_])+$/, "Key must start with a letter and contain only letters, numbers, and underscores").refine((key) => !RESERVED_KEYS.includes(key), "This key is reserved and cannot be used as an environment variable key"),
@@ -1541,7 +1781,8 @@ const deployEnvironmentContractV1 = oc.route({
 	successDescription: "The environment has been deployed successfully"
 }).errors({
 	NOT_FOUND: {},
-	BAD_REQUEST: {}
+	BAD_REQUEST: {},
+	CONFLICT: {}
 }).input(z.object({
 	environmentId: z.string().describe("The ID of the environment to deploy"),
 	token: z.string().describe("The token to identify the source archive").optional(),
@@ -1582,6 +1823,21 @@ const getDeploymentContractV1 = oc.route({
 	tags: ["deployments"],
 	successDescription: "The deployment details"
 }).errors({ NOT_FOUND: {} }).input(z.object({ deploymentId: z.string().describe("The ID of the deployment") })).output(deploymentSchema);
+const logEntrySchema = z.object({
+	timestamp: z.coerce.date(),
+	type: z.enum([
+		"START",
+		"END",
+		"INFO",
+		"ERROR",
+		"WARNING",
+		"DEBUG"
+	]),
+	requestId: z.string(),
+	content: z.string().optional(),
+	method: z.string().optional(),
+	durationInMs: z.number().optional()
+});
 const getLogsContractV1 = oc.route({
 	path: "/v1/environments/{environmentId}/logs",
 	method: "GET",
@@ -1606,21 +1862,7 @@ const getLogsContractV1 = oc.route({
 	search: z.string().optional().describe("Filter pattern to search for in log content"),
 	nextToken: z.string().optional().describe("Pagination token from a previous response")
 })).output(z.object({
-	logs: z.array(z.object({
-		timestamp: z.coerce.date(),
-		type: z.enum([
-			"START",
-			"END",
-			"INFO",
-			"ERROR",
-			"WARNING",
-			"DEBUG"
-		]),
-		requestId: z.string(),
-		content: z.string().optional(),
-		method: z.string().optional(),
-		durationInMs: z.number().optional()
-	})),
+	logs: z.array(logEntrySchema),
 	nextToken: z.string().nullable()
 }));
 const getLatestLogsContractV1 = oc.route({
@@ -1643,21 +1885,7 @@ const getLatestLogsContractV1 = oc.route({
 		"DEBUG"
 	])).optional().describe("Filter by log level"),
 	search: z.string().optional().describe("Filter pattern to search for in log content")
-})).output(z.object({ logs: z.array(z.object({
-	timestamp: z.coerce.date(),
-	type: z.enum([
-		"START",
-		"END",
-		"INFO",
-		"ERROR",
-		"WARNING",
-		"DEBUG"
-	]),
-	requestId: z.string(),
-	content: z.string().optional(),
-	method: z.string().optional(),
-	durationInMs: z.number().optional()
-})) }));
+})).output(z.object({ logs: z.array(logEntrySchema) }));
 const getDeploymentLogsContractV1 = oc.route({
 	path: "/v1/deployments/{deploymentId}/logs",
 	method: "GET",
@@ -1883,5 +2111,10 @@ const contract = {
 		get: { v1: getBeaconContractV1 }
 	}
 };
+const { uploadArtifact: _discard, ...deploymentsForDocs } = contract.deployments;
+const contractForDocs = {
+	...contract,
+	deployments: deploymentsForDocs
+};
 //#endregion
-export { AUTH_SCOPE_ANY, AUTH_SCOPE_USER, PLATFORM_LABELS, buildSettingsSchema, contract, createEnvironmentContractV1, deploymentStatusSchema, environmentVariableSchema, environmentVariablesSchema, playgroundExamplePromptSchema, playgroundHeaderSchema, runtimeSchema, serverFieldsSchema, transportSchema, updateEnvironmentVariableSchema };
+export { AUTH_SCOPE_ANY, AUTH_SCOPE_USER, PLATFORM_LABELS, buildSettingsSchema, contract, contractForDocs, createEnvironmentContractV1, deploymentStatusSchema, environmentVariableSchema, environmentVariablesSchema, playgroundExamplePromptSchema, playgroundHeaderSchema, runtimeSchema, serverFieldsSchema, transportSchema, updateEnvironmentVariableSchema };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alpic-ai/api",
-  "version": "0.0.0-dev.geca1d94",
+  "version": "0.0.0-dev.ged18600",
   "description": "Contract for the Alpic API",
   "type": "module",
   "main": "./dist/index.mjs",
@@ -33,17 +33,17 @@
   "author": "Alpic",
   "license": "ISC",
   "dependencies": {
-    "@orpc/contract": "^1.14.7",
+    "@orpc/contract": "^1.14.13",
     "ms": "^2.1.3",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@orpc/openapi": "^1.14.7",
-    "@orpc/zod": "^1.14.7",
+    "@orpc/openapi": "^1.14.13",
+    "@orpc/zod": "^1.14.13",
     "@total-typescript/tsconfig": "^1.0.4",
     "@types/ms": "^2.1.0",
     "shx": "^0.4.0",
-    "tsdown": "^0.22.5",
+    "tsdown": "^0.22.14",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
     "@alpic-ai/domains": "0.0.0"