@alpic-ai/api 0.0.0-dev.gfc8e798 → 0.0.0-dev.gfd01266

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { z } from "zod";
 import * as z$1 from "zod/v4";
 import { oc } from "@orpc/contract";
 import ms from "ms";
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_supports-color@7.2.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_supports-color@7.2.0_zod@4.5.4/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
 /**
 * Reusable URL validation that disallows javascript: scheme
 */
@@ -179,6 +179,7 @@ const PLATFORM_LABELS = {
 };
 const WAF_PLATFORMS = [
 	"akamai",
+	"cato",
 	"cloudflare",
 	"fastly"
 ];
@@ -256,6 +257,25 @@ z.object({
 	clientSecret: z.string(),
 	clientScopes: z.array(z.string())
 });
+const creditEntryReasonSchema = z.enum([
+	"free_seed",
+	"paid_conversion_floor",
+	"top_up",
+	"usage",
+	"admin_adjustment"
+]);
+z.enum(["playground"]);
+z.number().int().min(500);
+const creditActivityEntrySchema = z.object({
+	reason: creditEntryReasonSchema,
+	day: z.number(),
+	amountInNanoUSD: z.number(),
+	messageCount: z.number().nullable()
+});
+z.object({
+	balanceInNanoUSD: z.number(),
+	recentActivity: z.array(creditActivityEntrySchema)
+});
 const deploymentStatusSchema$1 = z.enum([
 	"ongoing",
 	"deployed",
@@ -283,33 +303,18 @@ const deploymentSummarySchema = z.object({
 	createdAt: z.coerce.date(),
 	updatedAt: z.coerce.date()
 });
-/**
-* Public environment
-*
-* Answers anonymously and exposes no OAuth metadata.
-*/
+/** Public environment: answers anonymously and exposes no OAuth metadata. */
 const publicEnvironmentSchema = z.object({
 	allowsAnonymous: z.literal(true),
 	oAuthMetadata: z.strictObject({})
 });
-/**
-* Protected environment with an external resource metadata URL
-*
-* An external resource metadata URL is returned in the WWW-Authenticate header during the first 401 response.
-* Everything that follows is handled outside of the MCP server scope.
-*/
+/** Protected environment whose external resource metadata URL is returned in the WWW-Authenticate header on the first 401; everything after is handled outside the MCP server scope. */
 const externalResourceMetadataEnvironmentSchema = z.object({
 	allowsAnonymous: z.boolean(),
 	oAuthMetadata: z.object({ externalResourceMetadataUrl: z.url() }),
 	scope: z.string().optional()
 });
-/**
-* Protected environment with an external authorization server URL
-*
-* The server itself exposes the /.well-known/oauth-protected-resource endpoint.
-* An external authorization server URL is returned when requesting the endpoint.
-* Everything that follows is handled outside of the MCP server scope.
-*/
+/** Protected environment whose own /.well-known/oauth-protected-resource endpoint points at an external authorization server; everything after is handled outside the MCP server scope. */
 const externalAuthorizationServerEnvironmentSchema = z.object({
 	allowsAnonymous: z.boolean(),
 	oAuthMetadata: z.object({
@@ -318,12 +323,7 @@ const externalAuthorizationServerEnvironmentSchema = z.object({
 	}),
 	scope: z.string().optional()
 });
-/**
-* Standalone protected environment
-*
-* The server itself exposes the /.well-known/oauth-protected-resource endpoint.
-* The server itself exposes the /.well-known/oauth-authorization-server endpoint.
-*/
+/** Standalone protected environment: the server itself exposes both the /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server endpoints. */
 const standaloneEnvironmentSchema = z.object({
 	allowsAnonymous: z.boolean(),
 	oAuthMetadata: z.object({
@@ -332,13 +332,7 @@ const standaloneEnvironmentSchema = z.object({
 	}),
 	scope: z.string().optional()
 });
-/**
-* Protected environment without OAuth discovery
-*
-* The server enforces authentication but exposes no OAuth discovery metadata.
-* Neither /.well-known/oauth-protected-resource nor /.well-known/oauth-authorization-server
-* are advertised. Clients must obtain credentials out-of-band.
-*/
+/** Protected environment that enforces authentication but advertises no OAuth discovery metadata; clients must obtain credentials out-of-band. */
 const protectedWithoutDiscoveryEnvironmentSchema = z.object({
 	allowsAnonymous: z.literal(false),
 	oAuthMetadata: z.strictObject({}),
@@ -428,12 +422,13 @@ z.object({
 	collectUserData: z.boolean(),
 	identityTraitKey: z.string().min(1).max(200).nullable()
 });
-z.object({
+const feedbackSchema = z.object({
 	id: z.string(),
 	createdAt: z.coerce.date(),
 	environmentId: z.string(),
 	content: z.string(),
-	source: z.enum(["model", "user"])
+	source: z.enum(["model", "user"]),
+	clientName: z.string().nullable()
 });
 z.object({
 	content: z.string(),
@@ -449,7 +444,7 @@ const intentCategoryColorSchema = z.enum([
 	"pink",
 	"gray"
 ]);
-intentCategoryColorSchema.options;
+const INTENT_CATEGORY_COLORS = intentCategoryColorSchema.options;
 const intentCategorySchema = z.object({
 	id: z.string(),
 	createdAt: z.coerce.date(),
@@ -457,7 +452,7 @@ const intentCategorySchema = z.object({
 	name: z.string(),
 	color: intentCategoryColorSchema
 });
-z.object({
+const intentCategorySummarySchema = z.object({
 	id: z.string(),
 	name: z.string(),
 	color: intentCategoryColorSchema,
@@ -469,6 +464,7 @@ z.object({
 	environmentId: z.string(),
 	toolName: z.string(),
 	message: z.string(),
+	clientName: z.string().nullable(),
 	categories: z.array(intentCategorySchema)
 });
 const signalCategorySchema = z.object({
@@ -527,12 +523,262 @@ z.object({
 	createdAt: z.coerce.date(),
 	updatedAt: z.coerce.date()
 });
+const alpicMcpRequestLogSchema = z.object({
+	type: z.literal("mcp_request"),
+	method: z.string()
+});
+const alpicMcpErrorLogSchema = z.object({
+	type: z.literal("mcp_error"),
+	method: z.string(),
+	error: z.string()
+});
+z.union([alpicMcpRequestLogSchema, alpicMcpErrorLogSchema]);
 z.enum([
 	"INFO",
 	"WARNING",
 	"DEBUG",
 	"ERROR"
 ]);
+/** Only names a vendor actually ships belong here: lookalikes like `claude-code-test` are customers' own scripts. */
+const MCP_CLIENT_GROUPS = [
+	{
+		id: "claude_code",
+		label: "Claude Code",
+		vendor: "anthropic",
+		rawNames: ["claude-code", "Anthropic/ClaudeCodeDesktop"]
+	},
+	{
+		id: "claude",
+		label: "Claude",
+		vendor: "anthropic",
+		rawNames: [
+			"Anthropic/ClaudeAI",
+			"claude-ai",
+			"claude",
+			"Claude",
+			"claude-desktop",
+			"claude-desktop-3p"
+		]
+	},
+	{
+		id: "claude_mobile",
+		label: "Claude mobile",
+		vendor: "anthropic",
+		rawNames: ["claude-ios", "ClaudeAndroid"]
+	},
+	{
+		id: "claude_cowork",
+		label: "Claude Cowork",
+		vendor: "anthropic",
+		rawNames: ["Anthropic/Cowork"]
+	},
+	{
+		id: "claude_toolbox",
+		label: "Claude Toolbox",
+		vendor: "anthropic",
+		rawNames: ["Anthropic/Toolbox", "Anthropic/toolbox-bootstrap"]
+	},
+	{
+		id: "anthropic_api",
+		label: "Anthropic API",
+		vendor: "anthropic",
+		rawNames: ["Anthropic/API"]
+	},
+	{
+		id: "anthropic_connector_refresh",
+		label: "Anthropic (connector refresh)",
+		vendor: "anthropic",
+		rawNames: ["Anthropic"]
+	},
+	{
+		id: "codex",
+		label: "Codex",
+		vendor: "openai",
+		rawNames: [
+			"codex-mcp-client",
+			"codex",
+			"Codex",
+			"codex-cli",
+			"openai-mcp (Codex)"
+		]
+	},
+	{
+		id: "chatgpt",
+		label: "ChatGPT",
+		vendor: "openai",
+		rawNames: ["openai-mcp (ChatGPT)"]
+	},
+	{
+		id: "openai_responses_api",
+		label: "OpenAI Responses API",
+		vendor: "openai",
+		rawNames: ["openai-mcp (Responses API)"]
+	},
+	{
+		id: "openai_agent_builder",
+		label: "OpenAI Agent Builder",
+		vendor: "openai",
+		rawNames: ["openai-mcp (Agent Builder)"]
+	},
+	{
+		id: "openai_other",
+		label: "OpenAI Other",
+		vendor: "openai",
+		rawNames: ["openai-mcp"]
+	},
+	{
+		id: "cursor",
+		label: "Cursor",
+		vendor: "cursor",
+		rawNames: [
+			"cursor-vscode",
+			"Cursor",
+			"cursor"
+		]
+	},
+	{
+		id: "cline",
+		label: "Cline",
+		vendor: "cline",
+		rawNames: [
+			"Cline",
+			"cline",
+			"@cline/core"
+		]
+	},
+	{
+		id: "github_copilot",
+		label: "GitHub Copilot",
+		vendor: "githubCopilot",
+		rawNames: [
+			"Copilot",
+			"github-copilot-developer",
+			"Copilot MCP Gateway",
+			"Xcode/copilot-xcode"
+		]
+	},
+	{
+		id: "gemini_cli",
+		label: "Gemini CLI",
+		vendor: "google",
+		rawNames: ["gemini-cli-mcp-client", "gemini-cli"]
+	},
+	{
+		id: "antigravity",
+		label: "Antigravity",
+		vendor: "google",
+		rawNames: ["antigravity-client"]
+	},
+	{
+		id: "gemini",
+		label: "Gemini",
+		vendor: "google",
+		rawNames: ["Gemini", "google-ai-edge-gallery"]
+	},
+	{
+		id: "windsurf",
+		label: "Windsurf",
+		vendor: "windsurf",
+		rawNames: ["Windsurf", "windsurf-client"]
+	},
+	{
+		id: "mistral",
+		label: "Mistral / Le Chat",
+		vendor: "mistral",
+		rawNames: ["Mistral"],
+		rawNamePrefixes: ["connector:custom-mcp:"]
+	},
+	{
+		id: "n8n",
+		label: "n8n",
+		vendor: "n8n",
+		rawNames: [
+			"@n8n/n8n-nodes-langchain.mcpClient",
+			"@n8n/n8n-nodes-langchain.mcpClientTool",
+			"n8n"
+		]
+	},
+	{
+		id: "alpic_playground",
+		label: "Alpic Playground",
+		vendor: "alpic",
+		rawNames: ["alpic-playground", "playground"]
+	},
+	{
+		id: "opencode",
+		label: "opencode",
+		vendor: "opencode",
+		rawNames: ["opencode"]
+	},
+	{
+		id: "zed",
+		label: "Zed",
+		vendor: "zed",
+		rawNames: ["Zed", "zed"]
+	},
+	{
+		id: "zapier",
+		label: "Zapier",
+		vendor: "zapier",
+		rawNames: ["Zapier", "zapier"]
+	},
+	{
+		id: "make",
+		label: "Make",
+		vendor: "make",
+		rawNames: ["Make", "make"]
+	},
+	{
+		id: "librechat",
+		label: "LibreChat",
+		vendor: "mcp",
+		rawNames: ["LibreChat", "librechat"]
+	},
+	{
+		id: "jan",
+		label: "Jan",
+		vendor: "mcp",
+		rawNames: ["Jan", "jan"]
+	},
+	{
+		id: "goose",
+		label: "goose",
+		vendor: "mcp",
+		rawNames: ["goose", "Goose"]
+	},
+	{
+		id: "mcphost",
+		label: "mcphost",
+		vendor: "mcp",
+		rawNames: ["mcphost"]
+	},
+	{
+		id: "mcporter",
+		label: "mcporter",
+		vendor: "mcp",
+		rawNames: ["mcporter"]
+	},
+	{
+		id: "rmcp",
+		label: "rmcp",
+		vendor: "mcp",
+		rawNames: ["rmcp"]
+	},
+	{
+		id: "unnamed_client",
+		label: "Unnamed client",
+		vendor: "mcp",
+		rawNames: [
+			"mcp",
+			"unknown",
+			""
+		]
+	}
+];
+/** A source pattern, not a RegExp, because analytics renders the same rule into ClickHouse RE2, which shares this syntax. */
+const MCP_REMOTE_WRAPPER_SUFFIX = String.raw` \(via mcp-remote [^\n]+?\)$`;
+new RegExp(MCP_REMOTE_WRAPPER_SUFFIX);
+new Map(MCP_CLIENT_GROUPS.map((group) => [group.id, group]));
 const runtimeSchema = z.enum([
 	"python3.13",
 	"python3.14",
@@ -610,15 +856,7 @@ z.object({
 	serverFields: serverFieldsSchema$1,
 	source: z.enum(["registry", "defaults"])
 });
-/**
-* Returns a variant of a `maxLength`-constrained string that clamps (truncates) instead of
-* rejecting on overflow — used for AI-generated copy where the model routinely overshoots.
-*
-* NOTE: this rebuilds the schema from scratch, carrying over only `maxLength` (as a clamp),
-* `minLength`, and the description. Any other validators on the source field (`.regex()`,
-* `.email()`, custom refinements) are intentionally dropped — this helper is meant for plain
-* free-text length caps only. A field with `null` `maxLength` is returned unchanged.
-*/
+/** Clamps instead of rejecting on max-length overflow (for AI-generated copy that overshoots); intentionally carries over only maxLength, minLength, and description, dropping any other validators. */
 const clampStringField = (field) => {
 	const max = field.maxLength;
 	if (max === null) return field;
@@ -626,6 +864,10 @@ const clampStringField = (field) => {
 	const withMin = field.minLength === null ? clamped : clamped.min(field.minLength);
 	return field.description ? withMin.describe(field.description) : withMin;
 };
+const unboundedArrayField = (field) => {
+	const unbounded = z.array(field.element);
+	return field.description ? unbounded.describe(field.description) : unbounded;
+};
 const toolDefinitionSchema = z.object({
 	name: z.string(),
 	title: z.string().optional().describe("Human-friendly name for the tool, used in the UI. If not provided, `name` will be used."),
@@ -638,11 +880,22 @@ const toolDefinitionSchema = z.object({
 	}).optional()
 });
 const positiveTestCaseSchema = z.object({
-	scenario: z.string().describe("Short label for what this case demonstrates."),
-	userPrompt: z.string().describe("A realistic, standalone user message a reviewer can paste and run with no prior state or multi-turn setup. Vary phrasing and tone across cases."),
+	scenario: z.string().min(1).describe("Short label for what this case demonstrates."),
+	userPrompt: z.string().min(1).describe("A realistic, standalone user message a reviewer can paste and run with no prior state or multi-turn setup. Vary phrasing and tone across cases."),
 	toolTriggered: z.string().optional().describe("The tool this prompt should invoke."),
 	expectedOutput: z.string().optional().describe("What the user should see, including post-interaction behaviour where relevant.")
-}).partial().describe("Each case: Scenario, User prompt, Tool triggered, Expected output.");
+}).describe("Each case: Scenario, User prompt, Tool triggered, Expected output.");
+const positiveTestCaseDraftSchema = positiveTestCaseSchema.partial().extend({
+	scenario: z.string().optional(),
+	userPrompt: z.string().optional()
+});
+const blankPositiveTestCase = () => ({
+	scenario: "",
+	userPrompt: "",
+	toolTriggered: "",
+	expectedOutput: ""
+});
+const toFixedLength = (entries, length, blank) => Array.from({ length }, (_, index) => entries[index] ?? blank());
 const screenshotEntrySchema = z.object({
 	prompt: z.string(),
 	url: z.url()
@@ -955,20 +1208,25 @@ const chatgptTranslationLocaleSchema = z.enum([
 	"zh-TW"
 ]);
 const negativeTestCaseSchema = z.object({
-	scenario: z.string(),
-	userPrompt: z.string()
-}).partial().describe("Each case: Scenario + User prompt (the app should NOT trigger).");
+	scenario: z.string().min(1),
+	userPrompt: z.string().min(1)
+}).describe("Each case: Scenario + User prompt (the app should NOT trigger).");
+const negativeTestCaseDraftSchema = negativeTestCaseSchema.partial().extend({
+	scenario: z.string().optional(),
+	userPrompt: z.string().optional()
+});
+const blankNegativeTestCase = () => ({
+	scenario: "",
+	userPrompt: ""
+});
+const chatgptSkillSchema = z.object({ name: z.string() }).describe("A skill discovered on the MCP server, by name.");
 const chatgptToolJustificationSchema = z.object({
 	toolName: z.string(),
 	readOnlyJustification: z.string().describe("One sentence on what the tool reads and returns."),
 	openWorldJustification: z.string().describe("One sentence on whether the tool reaches external systems beyond your own service."),
 	destructiveJustification: z.string().describe("One sentence on whether the tool changes data. For a read-only tool, state the full triad: \"No data is created, modified, or deleted.\"")
 }).describe("Per-tool justification of each MCP annotation value (one specific sentence per hint).");
-/**
-* Base copy fields, defined once and reused by both the submission form and per-locale
-* translations so the constraints (tagline ≤ 30 chars) never drift. The translation generation
-* path wraps these in {@link clampStringField} since the LLM tends to overshoot the limit.
-*/
+/** Defined once and reused by both the submission form and per-locale translations so the tagline ≤ 30 chars constraint never drifts. */
 const chatgptTaglineSchema = z.string().max(30);
 const chatgptDescriptionSchema = z.string();
 const chatgptTranslationSchema = z.object({
@@ -977,10 +1235,7 @@ const chatgptTranslationSchema = z.object({
 	description: chatgptDescriptionSchema
 }).describe("Locale-scoped override for tagline + description. English (US) is the default.");
 chatgptTranslationSchema.extend({ tagline: clampStringField(chatgptTaglineSchema) });
-/**
-* Field order mirrors the ChatGPT (OpenAI) submission spreadsheet, grouped by section.
-* When adding/removing/reordering fields, keep this in sync with the sheet.
-*/
+/** Field order mirrors the ChatGPT (OpenAI) submission spreadsheet, grouped by section; keep it in sync with the sheet. */
 const chatgptSubmissionFormDataSchema = z.object({
 	logoLight: z.string().describe("Logo icon for light mode. Square PNG, no borders or rounded corners (clients apply circular cropping)."),
 	logoDark: z.string().optional().describe("Optional dark-mode logo icon. Square PNG, same specs as the light icon. Leave empty if the light icon also works on dark backgrounds."),
@@ -999,8 +1254,9 @@ const chatgptSubmissionFormDataSchema = z.object({
 	authentication: chatgptAuthenticationSchema.describe("OAuth 2.0 or No auth. OAuth configuration is auto-discovered from the MCP server's metadata."),
 	tools: z.array(toolDefinitionSchema).describe("List of tools exposed by the MCP server (auto-populated from the production server's manifest)."),
 	toolJustifications: z.array(chatgptToolJustificationSchema).describe("Per-tool justification of `readOnlyHint`, `openWorldHint`, and `destructiveHint` annotation values. One short, specific sentence per hint describing what the tool actually does."),
-	testCases: z.array(positiveTestCaseSchema).describe("At least 5 positive test cases. Each: Scenario, User prompt, Tool triggered, Expected output. Collectively cover the full capability across different flow stages (initial search or browse, market or locale handling, post-interaction detail, an action ChatGPT performs on the user's behalf, and a conversion or secondary tool) rather than five variations of the same first step."),
-	negativeTestCases: z.array(negativeTestCaseSchema).describe("3 negative test cases: prompts where the app should NOT trigger but the model might think it is relevant. These become production routing metadata that teaches ChatGPT when to stay silent, so pick tight near-misses: a product category the app does not carry, the right brand or domain but an intent the app does not serve, or a boundary with a sibling app."),
+	skills: z.array(chatgptSkillSchema).optional().describe("Skills the server exposes over MCP (auto-populated from the production server's manifest). Left unset when the server does not advertise the skills extension, which is a different state from advertising it and exposing none."),
+	testCases: z.array(positiveTestCaseSchema).length(5).describe("Exactly 5 positive test cases. Each: Scenario, User prompt, Tool triggered, Expected output. Collectively cover the full capability across different flow stages (initial search or browse, market or locale handling, post-interaction detail, an action ChatGPT performs on the user's behalf, and a conversion or secondary tool) rather than five variations of the same first step."),
+	negativeTestCases: z.array(negativeTestCaseSchema).length(3).describe("Exactly 3 negative test cases: prompts where the app should NOT trigger but the model might think it is relevant. These become production routing metadata that teaches ChatGPT when to stay silent, so pick tight near-misses: a product category the app does not carry, the right brand or domain but an intent the app does not serve, or a boundary with a sibling app."),
 	screenshots: z.array(screenshotEntrySchema.extend({ prompt: z.string().max(75, { error: "Screenshot prompts are limited to 75 characters." }) })).max(3).describe("In-app screenshots paired with the user prompt that produced them (each prompt is 75 characters max). Widget apps must show the widget UI; non-widget apps show the model response. Min 1, max 3 entries, all public. Images: 706px wide, 400–860px tall, PNG."),
 	translations: z.array(chatgptTranslationSchema).describe("Per-locale translation of tagline + description. English (US) is the default."),
 	allowedCountries: chatgptAllowedCountriesSchema.describe("Availability: all supported countries, or an allow-list / block-list of specific ones (ISO alpha-2)."),
@@ -1015,23 +1271,35 @@ const chatgptSubmissionDraftSchema = chatgptSubmissionFormDataSchema.partial().e
 	demoRecordingUrl: z.string().optional(),
 	serverUrl: z.string().optional(),
 	screenshots: z.array(screenshotDraftEntrySchema).optional(),
+	testCases: z.array(positiveTestCaseDraftSchema).optional(),
+	negativeTestCases: z.array(negativeTestCaseDraftSchema).optional(),
 	translations: z.array(chatgptTranslationSchema.extend({ tagline: z.string() })).optional()
 });
-chatgptSubmissionFormDataSchema.pick({
+/** Source of truth for the fields `SubmissionPrefillService.prefill({ platform: "chatgpt" })` can populate. */
+const chatgptPrefillFormDataSchema = chatgptSubmissionFormDataSchema.pick({
 	appName: true,
 	developerName: true,
 	serverUrl: true,
 	tools: true,
+	skills: true,
 	authentication: true
 });
-chatgptSubmissionFormDataSchema.pick({
+/** Source of truth for `SubmissionPrefillService.generate({ platform: "chatgpt" })`. */
+const chatgptAiGeneratedFormDataSchema = chatgptSubmissionFormDataSchema.pick({
 	tagline: true,
 	description: true,
 	category: true,
 	testCases: true,
 	negativeTestCases: true,
 	toolJustifications: true
-}).extend({ tagline: clampStringField(chatgptSubmissionFormDataSchema.shape.tagline) });
+}).extend({
+	testCases: unboundedArrayField(chatgptSubmissionFormDataSchema.shape.testCases),
+	negativeTestCases: unboundedArrayField(chatgptSubmissionFormDataSchema.shape.negativeTestCases)
+}).extend({
+	tagline: clampStringField(chatgptSubmissionFormDataSchema.shape.tagline),
+	testCases: z.array(positiveTestCaseDraftSchema).transform((cases) => toFixedLength(cases, 5, blankPositiveTestCase)),
+	negativeTestCases: z.array(negativeTestCaseDraftSchema).transform((cases) => toFixedLength(cases, 3, blankNegativeTestCase))
+});
 const claudeCategorySchema = z.enum([
 	"Productivity",
 	"Communication",
@@ -1077,11 +1345,7 @@ const claudePolicyAcknowledgementSchema = z.enum([
 	"My connector does not collect conversation data beyond what is needed for its function.",
 	"Public documentation for this connector will be live by the publish date."
 ]);
-/**
-* Field order mirrors the claude.ai directory submission wizard
-* (`claude.ai/admin-settings/directory/submissions/new`), grouped by step.
-* When adding/removing/reordering fields, keep this in sync with the wizard.
-*/
+/** Field order mirrors the claude.ai directory submission wizard (`claude.ai/admin-settings/directory/submissions/new`), grouped by step; keep it in sync with the wizard. */
 const claudeSubmissionFormDataSchema = z.object({
 	serverUrl: z.url().describe(`The full https:// URL where your MCP server is hosted and reachable. In the claude.ai wizard this is read live
 from the custom connector you select — the connection is used to verify the URL and the tool list at submission time.
@@ -1158,7 +1422,8 @@ const claudeSubmissionDraftSchema = claudeSubmissionFormDataSchema.partial().ext
 	categories: z.array(claudeCategorySchema).optional(),
 	screenshots: z.array(screenshotDraftEntrySchema).optional()
 });
-claudeSubmissionFormDataSchema.pick({
+/** Source of truth for the fields `SubmissionPrefillService.prefill({ platform: "claudeai" })` can populate. */
+const claudePrefillFormDataSchema = claudeSubmissionFormDataSchema.pick({
 	serverUrl: true,
 	name: true,
 	slug: true,
@@ -1173,39 +1438,93 @@ claudeSubmissionFormDataSchema.pick({
 	connectionRequirements: claudeSubmissionFormDataSchema.shape.connectionRequirements.optional(),
 	testInstructions: claudeSubmissionFormDataSchema.shape.testInstructions.optional()
 });
-/**
-* Narrative fields the LLM-backed generation step produces for Claude submissions.
-* This schema accepts the slightly loose shape returned by AI generation, then normalizes it into
-* the strict form shape. Keep transforms here rather than in callers so generation leniency is
-* colocated with the Claude contract.
-*/
+/** Loose shape returned by AI generation for Claude narrative fields; transforms live here so generation leniency stays colocated with the Claude contract. */
 const claudeAiGeneratedFormDataRawSchema = z.object({
 	oneLiner: claudeSubmissionFormDataSchema.shape.oneLiner,
 	description: claudeSubmissionFormDataSchema.shape.description,
 	categories: z.array(claudeCategorySchema).describe(claudeCategoryDescription),
 	primaryUseCases: claudeSubmissionFormDataSchema.shape.primaryUseCases
 });
-claudeAiGeneratedFormDataRawSchema.extend({
+const claudeAiGeneratedFormDataSchema = claudeAiGeneratedFormDataRawSchema.extend({
 	oneLiner: clampStringField(claudeSubmissionFormDataSchema.shape.oneLiner),
 	categories: claudeAiGeneratedFormDataRawSchema.shape.categories.transform((categories) => categories.slice(0, 5))
 });
+function provenanceByField(prefillShape, aiGeneratedShape) {
+	const byField = {};
+	for (const field of Object.keys(prefillShape)) byField[field] = "prefilled";
+	for (const field of Object.keys(aiGeneratedShape)) byField[field] = "ai-generated";
+	return byField;
+}
+provenanceByField(claudePrefillFormDataSchema.shape, claudeAiGeneratedFormDataSchema.shape), provenanceByField(chatgptPrefillFormDataSchema.shape, chatgptAiGeneratedFormDataSchema.shape);
+const urlVerificationOutcomeSchema = z.enum([
+	"pass",
+	"fail",
+	"unverified"
+]);
+const VERIFIABLE_URL_FIELDS = {
+	chatgpt: ["privacyPolicyUrl", "termsOfServiceUrl"],
+	claudeai: ["privacyPolicy"]
+};
+const verifiableUrlFieldSchema = z.enum([...VERIFIABLE_URL_FIELDS.chatgpt, ...VERIFIABLE_URL_FIELDS.claudeai]);
+const policyDisclosureSchema = z.enum([
+	"dataCategories",
+	"purposesOfUse",
+	"recipients",
+	"retention"
+]);
+const urlVerificationFieldResultSchema = z.object({
+	field: verifiableUrlFieldSchema,
+	url: z.string(),
+	outcome: urlVerificationOutcomeSchema,
+	reason: z.string(),
+	concerns: z.array(z.string()).optional(),
+	scrapedWith: z.enum(["fetch", "firecrawl"]).optional()
+});
+const urlVerificationSchema = z.object({
+	verifiedAt: z.coerce.date(),
+	results: z.array(urlVerificationFieldResultSchema)
+});
+const pageKindSchema = z.enum([
+	"expectedDocument",
+	"errorPage",
+	"loginWall",
+	"parkedDomain",
+	"comingSoon",
+	"marketingPage",
+	"unrelatedDocument"
+]);
+z.object({
+	pageKind: pageKindSchema.describe("What the page actually is. Use 'expectedDocument' only when it is genuinely the document the field claims."),
+	reason: z.string().max(200).describe("One sentence naming what the page is, addressed to the developer who entered the URL."),
+	missingDisclosures: z.array(policyDisclosureSchema).describe("For a privacy policy only: which of the four required disclosures the text does not cover. Empty for every other page kind.")
+});
 const submissionMetaFieldsSchema = z.object({
 	id: z.string(),
 	environmentId: z.string(),
 	auditId: z.string().nullable(),
+	urlVerification: urlVerificationSchema.nullable().default(null),
 	createdAt: z.coerce.date(),
 	updatedAt: z.coerce.date()
 });
 const claudeSubmissionSchemaInternal = submissionMetaFieldsSchema.extend({
 	platform: z.literal("claudeai"),
-	formData: claudeSubmissionDraftSchema
+	formData: claudeSubmissionDraftSchema,
+	prefillSnapshot: claudeSubmissionDraftSchema.nullable().default(null)
 });
 const chatgptSubmissionSchemaInternal = submissionMetaFieldsSchema.extend({
 	platform: z.literal("chatgpt"),
-	formData: chatgptSubmissionDraftSchema
+	formData: chatgptSubmissionDraftSchema,
+	prefillSnapshot: chatgptSubmissionDraftSchema.nullable().default(null)
 });
-z.discriminatedUnion("platform", [claudeSubmissionSchemaInternal, chatgptSubmissionSchemaInternal]);
+const submissionSchemaInternal = z.discriminatedUnion("platform", [claudeSubmissionSchemaInternal, chatgptSubmissionSchemaInternal]);
 z.union([claudeSubmissionDraftSchema, chatgptSubmissionDraftSchema]);
+/** Discriminated on `platform`, which pins the shape of `formData`: a Claude submission cannot carry chatgpt-only fields, and vice-versa. */
+const submissionSchema = submissionSchemaInternal;
+z.literal([
+	100,
+	75,
+	50
+]);
 const subscriptionPlanSchema = z.enum([
 	"pro",
 	"business",
@@ -1217,17 +1536,96 @@ const customerCreditsSchema = z.object({
 	expiresAt: z.number().nullable(),
 	currency: z.string()
 });
-const customerUsageSchema = z.object({
-	amountInCents: z.number(),
-	currency: z.string(),
-	periodEnd: z.number()
-});
 const partnerDiscountSchema = z.object({ endsAt: z.number() });
 z.object({
 	customerCredits: customerCreditsSchema.nullable(),
-	customerUsage: customerUsageSchema.nullable(),
 	partnerDiscount: partnerDiscountSchema.nullable()
 });
+const metricsQueueEventSchema = z.object({
+	ts: z.number().int(),
+	method: z.string(),
+	tool: z.string().nullable(),
+	client: z.string(),
+	sessionId: z.string().nullable(),
+	durationMs: z.number().int(),
+	outputTokens: z.number().int().nullable(),
+	errorType: z.enum([
+		"mcp_error",
+		"tool_error",
+		"timeout"
+	]).nullable(),
+	errorCode: z.number().int().nullable()
+});
+z.object({
+	v: z.literal(1),
+	envId: z.string(),
+	events: z.array(metricsQueueEventSchema)
+});
+z.object({ v: z.number() });
+const telemetrySignalSchema = z.enum([
+	"logs",
+	"metrics",
+	"traces"
+]);
+const otlpProtocolSchema = z.enum(["http/protobuf", "http/json"]);
+const otlpEndpointSchema = z.string().trim().min(1).max(2048);
+const OTLP_HEADER_VALUE_MAX_LENGTH = 2048;
+const otlpHeaderNameSchema = z.string().trim().min(1, "Enter a header name").max(128).regex(/^[A-Za-z0-9!#$%&'*+\-.^_`|~]+$/, "Use letters, digits and !#$%&'*+-.^_`|~ only");
+const otlpHeaderValueSchema = z.string().trim().max(OTLP_HEADER_VALUE_MAX_LENGTH).refine((value) => !/[\r\n]/.test(value), "Line breaks are not allowed in a header value");
+const telemetryDestinationHeaderSchema = z.object({
+	id: z.string(),
+	name: otlpHeaderNameSchema,
+	value: otlpHeaderValueSchema,
+	isSecret: z.boolean()
+});
+const otlpPushFailureReasonSchema = z.enum([
+	"credentials",
+	"wrong-path",
+	"wrong-protocol",
+	"invalid-payload",
+	"partial-rejection",
+	"blocked-target",
+	"timeout",
+	"unreachable",
+	"receiver-error",
+	"unexpected-status"
+]);
+const telemetryDestinationStatusSchema = z.enum(["active", "suspended"]);
+z.object({
+	id: z.string(),
+	signal: telemetrySignalSchema,
+	endpoint: otlpEndpointSchema,
+	protocol: otlpProtocolSchema,
+	headers: z.array(telemetryDestinationHeaderSchema),
+	status: telemetryDestinationStatusSchema,
+	lastFailureReason: otlpPushFailureReasonSchema.nullable()
+});
+const webhookEventSchema = z.enum([
+	"deployment.succeeded",
+	"deployment.failed",
+	"deployment.canceled"
+]);
+const webhookDestinationStatusSchema = z.enum(["active", "suspended"]);
+const webhookDeliveryFailureReasonSchema = z.enum([
+	"credentials",
+	"blocked-target",
+	"timeout",
+	"unreachable",
+	"receiver-error",
+	"unexpected-status"
+]);
+const webhookUrlSchema = z.url({
+	protocol: /^https$/,
+	error: "Enter a valid HTTPS URL"
+}).max(2048, "Webhook URL must be at most 2048 characters");
+const webhookEventsSchema = z.array(webhookEventSchema).min(1, "Select at least one event").refine((events) => new Set(events).size === events.length, "Events must be unique");
+z.object({
+	id: z.string(),
+	url: webhookUrlSchema,
+	events: webhookEventsSchema,
+	status: webhookDestinationStatusSchema,
+	lastFailureReason: webhookDeliveryFailureReasonSchema.nullable()
+}).extend({ secret: z.string().min(1) });
 //#endregion
 //#region src/auth-scope.ts
 /** Accepts an API key or OAuth access token (default for most routes). */
@@ -1326,6 +1724,14 @@ const serverFieldsSchema = z.object({
 });
 //#endregion
 //#region src/api.contract.ts
+const isValidIanaTimeZone = (timeZone) => {
+	try {
+		new Intl.DateTimeFormat("en-US", { timeZone });
+		return true;
+	} catch {
+		return false;
+	}
+};
 const deploymentStatusSchema = z.enum([
 	"ongoing",
 	"deployed",
@@ -1354,21 +1760,20 @@ const deploymentSchema = z.object({
 	isCurrent: z.boolean(),
 	deploymentPageUrl: z.url().nullable()
 });
-const isValidLogTimeInput = (value) => {
+const isValidTimeInput = (value) => {
 	if (ms(value) !== void 0) return true;
 	return !Number.isNaN(new Date(value).getTime());
 };
-const createEnvironmentContractV1 = oc.route({
+const timeInputSchema = z.string().refine(isValidTimeInput, { message: "Invalid time. Use relative (1h, 30m, 2d) or ISO 8601 format." });
+const base = oc.errors({ BAD_REQUEST: {} });
+const createEnvironmentContractV1 = base.route({
 	path: "/v1/environments",
 	method: "POST",
 	summary: "Create an environment",
 	description: "Create an environment for a project",
 	tags: ["environments"],
 	successDescription: "The environment has been created successfully"
-}).errors({
-	NOT_FOUND: {},
-	BAD_REQUEST: {}
-}).input(z.object({
+}).errors({ NOT_FOUND: {} }).input(z.object({
 	projectId: z.string().describe("The ID of the project to create the environment for"),
 	name: z.string().min(1).describe("The name of the environment"),
 	sourceBranch: z.string().min(1).describe("The branch used to build the environment"),
@@ -1381,7 +1786,7 @@ const createEnvironmentContractV1 = oc.route({
 	createdAt: z.coerce.date(),
 	projectId: z.string().describe("The ID of the project the environment belongs to")
 }));
-const getEnvironmentContractV1 = oc.route({
+const getEnvironmentContractV1 = base.route({
 	path: "/v1/environments/{environmentId}",
 	method: "GET",
 	summary: "Get an environment",
@@ -1397,6 +1802,14 @@ const getEnvironmentContractV1 = oc.route({
 	createdAt: z.coerce.date(),
 	projectId: z.string()
 }));
+const deleteEnvironmentContractV1 = base.route({
+	path: "/v1/environments/{environmentId}",
+	method: "DELETE",
+	summary: "Delete an environment",
+	description: "All environments can be deleted except the production environment. This operation is not reversible: associated logs, analytics, and metrics are deleted as well.",
+	tags: ["environments"],
+	successDescription: "The environment has been deleted successfully"
+}).errors({ NOT_FOUND: {} }).input(z.object({ environmentId: z.string().describe("The ID of the environment") })).output(z.object({ success: z.literal(true) }));
 const domainSchema = z.object({
 	domain: z.string(),
 	status: z.enum([
@@ -1438,7 +1851,7 @@ const projectOutputSchema = z.object({
 	productionEnvironment: productionEnvironmentSchema.nullable(),
 	environments: z.array(environmentSchema)
 });
-const getProjectContractV1 = oc.route({
+const getProjectContractV1 = base.route({
 	path: "/v1/projects/{projectId}",
 	method: "GET",
 	summary: "Get a project",
@@ -1446,18 +1859,15 @@ const getProjectContractV1 = oc.route({
 	tags: ["projects"],
 	successDescription: "The project details"
 }).errors({ NOT_FOUND: {} }).input(z.object({ projectId: z.string().describe("The ID of the project") })).output(projectOutputSchema);
-const listProjectsContractV1 = oc.route({
+const listProjectsContractV1 = base.route({
 	path: "/v1/projects",
 	method: "GET",
 	summary: "List projects",
 	description: "List all projects for a team",
 	tags: ["projects"],
 	successDescription: "The list of projects"
-}).errors({
-	NOT_FOUND: {},
-	BAD_REQUEST: {}
-}).input(z.object({ teamId: z.string().optional() }).optional()).output(z.array(projectOutputSchema));
-const createProjectContractV1 = oc.route({
+}).errors({ NOT_FOUND: {} }).input(z.object({ teamId: z.string().optional() }).optional()).output(z.array(projectOutputSchema));
+const createProjectContractV1 = base.route({
 	path: "/v1/projects",
 	method: "POST",
 	summary: "Create a project",
@@ -1466,7 +1876,6 @@ const createProjectContractV1 = oc.route({
 	successDescription: "The project has been created successfully"
 }).errors({
 	NOT_FOUND: {},
-	BAD_REQUEST: {},
 	FORBIDDEN: {}
 }).input(z.object({
 	teamId: z.string().optional(),
@@ -1507,7 +1916,7 @@ const environmentVariableOutputSchema = z.object({
 	isSecret: z.boolean(),
 	createdAt: z.coerce.date()
 });
-const listEnvironmentVariablesContractV1 = oc.route({
+const listEnvironmentVariablesContractV1 = base.route({
 	path: "/v1/environments/{environmentId}/environment-variables",
 	method: "GET",
 	summary: "List environment variables",
@@ -1515,48 +1924,39 @@ const listEnvironmentVariablesContractV1 = oc.route({
 	tags: ["environments"],
 	successDescription: "The list of environment variables"
 }).errors({ NOT_FOUND: {} }).input(z.object({ environmentId: z.string().describe("The ID of the environment") })).output(z.array(environmentVariableOutputSchema));
-const createEnvironmentVariablesContractV1 = oc.route({
+const createEnvironmentVariablesContractV1 = base.route({
 	path: "/v1/environments/{environmentId}/environment-variables",
 	method: "POST",
 	summary: "Add environment variables",
 	description: "Add one or more environment variables to an environment",
 	tags: ["environments"],
 	successDescription: "The environment variables have been added successfully"
-}).errors({
-	NOT_FOUND: {},
-	BAD_REQUEST: {}
-}).input(z.object({
+}).errors({ NOT_FOUND: {} }).input(z.object({
 	environmentId: z.string().describe("The ID of the environment"),
 	environmentVariables: environmentVariablesSchema
 })).output(z.object({ success: z.literal(true) }));
-const updateEnvironmentVariableContractV1 = oc.route({
+const updateEnvironmentVariableContractV1 = base.route({
 	path: "/v1/environment-variables/{environmentVariableId}",
 	method: "PATCH",
 	summary: "Update an environment variable",
 	description: "Update an environment variable by ID",
 	tags: ["environments"],
 	successDescription: "The environment variable has been updated successfully"
-}).errors({
-	NOT_FOUND: {},
-	BAD_REQUEST: {}
-}).input(z.object({
+}).errors({ NOT_FOUND: {} }).input(z.object({
 	environmentVariableId: z.string().describe("The ID of the environment variable"),
 	key: environmentVariableSchema.shape.key,
 	value: environmentVariableSchema.shape.value.optional(),
 	isSecret: environmentVariableSchema.shape.isSecret.optional()
 })).output(z.object({ success: z.literal(true) }));
-const deleteEnvironmentVariableContractV1 = oc.route({
+const deleteEnvironmentVariableContractV1 = base.route({
 	path: "/v1/environment-variables/{environmentVariableId}",
 	method: "DELETE",
 	summary: "Delete an environment variable",
 	description: "Delete an environment variable by ID",
 	tags: ["environments"],
 	successDescription: "The environment variable has been deleted successfully"
-}).errors({
-	NOT_FOUND: {},
-	BAD_REQUEST: {}
-}).input(z.object({ environmentVariableId: z.string().describe("The ID of the environment variable") })).output(z.object({ success: z.literal(true) }));
-const deleteProjectContractV1 = oc.route({
+}).errors({ NOT_FOUND: {} }).input(z.object({ environmentVariableId: z.string().describe("The ID of the environment variable") })).output(z.object({ success: z.literal(true) }));
+const deleteProjectContractV1 = base.route({
 	path: "/v1/projects/{projectId}",
 	method: "DELETE",
 	summary: "Delete a project",
@@ -1564,7 +1964,7 @@ const deleteProjectContractV1 = oc.route({
 	tags: ["projects"],
 	successDescription: "The project has been deleted successfully"
 }).errors({ NOT_FOUND: {} }).input(z.object({ projectId: z.string().describe("The ID of the project") })).output(z.object({ success: z.literal(true) }));
-const updateProjectContractV1 = oc.route({
+const updateProjectContractV1 = base.route({
 	path: "/v1/projects/{projectId}",
 	method: "PATCH",
 	summary: "Update a project",
@@ -1573,14 +1973,13 @@ const updateProjectContractV1 = oc.route({
 	successDescription: "The project has been updated successfully"
 }).errors({
 	NOT_FOUND: {},
-	BAD_REQUEST: {},
 	FORBIDDEN: {}
 }).input(z.object({
 	projectId: z.string().describe("The ID of the project"),
 	name: z.string().min(1).max(100).optional().describe("The new name for the project"),
 	sourceRepository: z.string().nullable().optional().describe("The source repository to connect to the project")
 })).output(projectOutputSchema);
-const deployEnvironmentContractV1 = oc.route({
+const deployEnvironmentContractV1 = base.route({
 	path: "/v1/environments/{environmentId}/deploy",
 	method: "POST",
 	summary: "Deploy an environment",
@@ -1589,29 +1988,25 @@ const deployEnvironmentContractV1 = oc.route({
 	successDescription: "The environment has been deployed successfully"
 }).errors({
 	NOT_FOUND: {},
-	BAD_REQUEST: {},
 	CONFLICT: {}
 }).input(z.object({
 	environmentId: z.string().describe("The ID of the environment to deploy"),
 	token: z.string().describe("The token to identify the source archive").optional(),
 	settings: buildSettingsSchema.extend({ transport: transportSchema }).optional().describe("Project settings detected by the client from the source. When provided, the server skips downloading and extracting the source archive to detect them.")
 })).output(deploymentSchema);
-const uploadDeploymentArtifactContractV1 = oc.route({
+const uploadDeploymentArtifactContractV1 = base.route({
 	path: "/v1/deployments/upload",
 	method: "POST",
 	summary: "Upload deployment artifacts",
 	description: "Return a presigned S3 URL to upload a deployment artifact",
 	tags: ["deployments"],
 	successDescription: "The presigned upload URL has been generated successfully"
-}).errors({
-	NOT_FOUND: {},
-	BAD_REQUEST: {}
-}).input(z.object({ teamId: z.string().optional() }).optional()).output(z.object({
+}).errors({ NOT_FOUND: {} }).input(z.object({ teamId: z.string().optional() }).optional()).output(z.object({
 	uploadUrl: z.url().describe("Presigned S3 URL to upload the source archive with HTTP PUT"),
 	token: z.string().describe("Token to identify the source archive"),
 	expiresAt: z.coerce.date().describe("Expiration date of the presigned URL")
 }));
-const listDeploymentsContractV1 = oc.route({
+const listDeploymentsContractV1 = base.route({
 	path: "/v1/projects/{projectId}/deployments",
 	method: "GET",
 	summary: "List project deployments",
@@ -1623,7 +2018,7 @@ const listDeploymentsContractV1 = oc.route({
 	status: z.array(deploymentStatusSchema).optional().describe("Filter by one or more statuses"),
 	environmentId: z.string().optional().describe("Filter by environment ID")
 })).output(z.array(deploymentSchema));
-const getDeploymentContractV1 = oc.route({
+const getDeploymentContractV1 = base.route({
 	path: "/v1/deployments/{deploymentId}",
 	method: "GET",
 	summary: "Get a deployment",
@@ -1646,20 +2041,17 @@ const logEntrySchema = z.object({
 	method: z.string().optional(),
 	durationInMs: z.number().optional()
 });
-const getLogsContractV1 = oc.route({
+const getLogsContractV1 = base.route({
 	path: "/v1/environments/{environmentId}/logs",
 	method: "GET",
 	summary: "Get logs",
 	description: "Get logs for an environment",
 	tags: ["environments"],
 	successDescription: "The logs"
-}).errors({
-	NOT_FOUND: {},
-	BAD_REQUEST: {}
-}).input(z.object({
+}).errors({ NOT_FOUND: {} }).input(z.object({
 	environmentId: z.string().describe("The ID of the environment"),
-	since: z.string().refine(isValidLogTimeInput, { message: "Invalid time. Use relative (1h, 30m, 2d) or ISO 8601 format." }).optional().describe("Start time — ISO 8601 (2024-01-01T00:00:00Z) or relative (1h, 30m, 2d)"),
-	until: z.string().refine(isValidLogTimeInput, { message: "Invalid time. Use relative (1h, 30m, 2d) or ISO 8601 format." }).optional().describe("End time — ISO 8601 or relative"),
+	since: timeInputSchema.optional().describe("Start time — ISO 8601 (2024-01-01T00:00:00Z) or relative (1h, 30m, 2d)"),
+	until: timeInputSchema.optional().describe("End time — ISO 8601 or relative"),
 	limit: z.coerce.number().int().min(1).max(1e3).default(1e3).describe("Maximum number of log entries to return."),
 	level: z.array(z.enum([
 		"INFO",
@@ -1673,17 +2065,14 @@ const getLogsContractV1 = oc.route({
 	logs: z.array(logEntrySchema),
 	nextToken: z.string().nullable()
 }));
-const getLatestLogsContractV1 = oc.route({
+const getLatestLogsContractV1 = base.route({
 	path: "/v1/environments/{environmentId}/latest-logs",
 	method: "GET",
 	summary: "Get latest logs",
 	description: "Get the N most recent logs for an environment",
 	tags: ["environments"],
 	successDescription: "The latest logs"
-}).errors({
-	NOT_FOUND: {},
-	BAD_REQUEST: {}
-}).input(z.object({
+}).errors({ NOT_FOUND: {} }).input(z.object({
 	environmentId: z.string().describe("The ID of the environment"),
 	limit: z.coerce.number().int().min(1).max(1e3).default(100).describe("Number of most recent log entries to return"),
 	level: z.array(z.enum([
@@ -1694,7 +2083,7 @@ const getLatestLogsContractV1 = oc.route({
 	])).optional().describe("Filter by log level"),
 	search: z.string().optional().describe("Filter pattern to search for in log content")
 })).output(z.object({ logs: z.array(logEntrySchema) }));
-const getDeploymentLogsContractV1 = oc.route({
+const getDeploymentLogsContractV1 = base.route({
 	path: "/v1/deployments/{deploymentId}/logs",
 	method: "GET",
 	summary: "Get deployment logs",
@@ -1721,22 +2110,19 @@ const analyticsTimeSeriesSchema = z.object({
 	output_token_mean: z.array(analyticsDataPointSchema),
 	task_count: z.array(analyticsDataPointSchema)
 });
-const getProjectAnalyticsContractV1 = oc.route({
+const getProjectAnalyticsContractV1 = base.route({
 	path: "/v1/analytics/{projectId}",
 	method: "GET",
 	summary: "Get project analytics",
 	description: "Get analytics data for a project over a time range",
 	tags: ["analytics"],
 	successDescription: "The project analytics data"
-}).errors({
-	NOT_FOUND: {},
-	BAD_REQUEST: {}
-}).input(z.object({
+}).errors({ NOT_FOUND: {} }).input(z.object({
 	projectId: z.string().describe("The ID of the project"),
 	startTimestamp: z.coerce.number().describe("Start timestamp in milliseconds"),
 	endTimestamp: z.coerce.number().describe("End timestamp in milliseconds"),
 	timeZone: z.string().describe("IANA timezone (e.g. Europe/Paris)")
-}).refine(({ startTimestamp, endTimestamp }) => endTimestamp - startTimestamp > 0, { message: "End date must be after start date" }).refine(({ startTimestamp, endTimestamp }) => endTimestamp - startTimestamp <= 744 * 60 * 60 * 1e3, { message: "Date range must be less than 1 month" }).refine(({ timeZone }) => Intl.supportedValuesOf("timeZone").includes(timeZone), { message: "Time zone must be a valid IANA timezone" })).output(z.object({
+}).refine(({ startTimestamp, endTimestamp }) => endTimestamp - startTimestamp > 0, { message: "End date must be after start date" }).refine(({ startTimestamp, endTimestamp }) => endTimestamp - startTimestamp <= 26784e5, { message: "Date range must be less than 1 month" }).refine(({ timeZone }) => isValidIanaTimeZone(timeZone), { message: "Time zone must be a valid IANA timezone" })).output(z.object({
 	metadata: z.object({
 		startTimestamp: z.number(),
 		endTimestamp: z.number(),
@@ -1746,7 +2132,132 @@ const getProjectAnalyticsContractV1 = oc.route({
 	}),
 	timeSeries: analyticsTimeSeriesSchema
 }));
-const listTeamsContractV1 = oc.route({
+const paginatedInsightsInputShape = {
+	environmentId: z.string().describe("The ID of the environment"),
+	since: timeInputSchema.default("7d").describe("Start time — ISO 8601 (2024-01-01T00:00:00Z) or relative (1h, 30m, 2d)"),
+	until: timeInputSchema.optional().describe("End time — ISO 8601 or relative"),
+	limit: z.coerce.number().int().min(1).max(200).default(50),
+	offset: z.coerce.number().int().min(0).default(0),
+	search: z.string().trim().min(1).max(200).optional()
+};
+const listIntentsContractV1 = base.route({
+	path: "/v1/environments/{environmentId}/intents",
+	method: "GET",
+	summary: "List intents",
+	description: "List grouped user intents for an environment over a time range",
+	tags: ["insights"],
+	successDescription: "The grouped user intents"
+}).errors({ NOT_FOUND: {} }).input(z.object({
+	...paginatedInsightsInputShape,
+	tools: z.array(z.string().trim().min(1)).min(1).max(100).optional(),
+	clientIds: z.array(z.string().min(1)).min(1).max(100).optional(),
+	categoryIds: z.array(z.string().trim().min(1)).min(1).max(100).optional(),
+	sortDir: z.enum(["asc", "desc"]).default("desc")
+})).output(z.object({
+	intents: z.array(z.object({
+		id: z.string(),
+		intentIds: z.array(z.string()).min(1),
+		environmentId: z.string(),
+		message: z.string(),
+		toolName: z.string(),
+		createdAt: z.coerce.date(),
+		occurrenceCount: z.number().int().positive(),
+		clientName: z.string().nullable(),
+		clientId: z.string().nullable(),
+		categories: z.array(z.object({
+			id: z.string(),
+			name: z.string(),
+			color: intentCategoryColorSchema
+		}))
+	})),
+	totalCount: z.number().int().nonnegative()
+}));
+const listFeedbacksContractV1 = base.route({
+	path: "/v1/environments/{environmentId}/feedbacks",
+	method: "GET",
+	summary: "List feedbacks",
+	description: "List user feedback for an environment over a time range",
+	tags: ["insights"],
+	successDescription: "The user feedback"
+}).errors({ NOT_FOUND: {} }).input(z.object({
+	...paginatedInsightsInputShape,
+	clientIds: z.array(z.string().min(1)).min(1).max(100).optional()
+})).output(z.object({
+	feedbacks: z.array(feedbackSchema.extend({ clientId: z.string().nullable() })),
+	totalCount: z.number().int().nonnegative()
+}));
+const intentCategoryNameSchema = z.string().trim().min(1).max(100).describe("The category name");
+const categorizableIntentIdsSchema = z.array(z.string().trim().min(1)).min(1).max(100).describe("IDs of the intents to categorize");
+const listIntentCategoriesContractV1 = base.route({
+	path: "/v1/environments/{environmentId}/intent-categories",
+	method: "GET",
+	summary: "List intent categories",
+	description: "List intent categories for an environment, including how many intents each category is linked to",
+	tags: ["insights"],
+	successDescription: "The intent categories"
+}).errors({ NOT_FOUND: {} }).input(z.object({ environmentId: z.string().describe("The ID of the environment") })).output(z.array(intentCategorySummarySchema));
+const createIntentCategoryContractV1 = base.route({
+	path: "/v1/environments/{environmentId}/intent-categories",
+	method: "POST",
+	summary: "Create an intent category",
+	description: "Create an intent category, optionally linking it to existing intents",
+	tags: ["insights"],
+	successDescription: "The created intent category"
+}).errors({ NOT_FOUND: {} }).input(z.object({
+	environmentId: z.string().describe("The ID of the environment"),
+	name: intentCategoryNameSchema,
+	color: intentCategoryColorSchema.optional().describe("The category color; derived from the name when omitted"),
+	intentIds: categorizableIntentIdsSchema.optional().describe("IDs of intents to link to the new category")
+})).output(intentCategorySchema);
+const updateIntentCategoryContractV1 = base.route({
+	path: "/v1/environments/{environmentId}/intent-categories/{categoryId}",
+	method: "PATCH",
+	summary: "Update an intent category",
+	description: "Rename or recolor an intent category",
+	tags: ["insights"],
+	successDescription: "The updated intent category"
+}).errors({ NOT_FOUND: {} }).input(z.object({
+	environmentId: z.string().describe("The ID of the environment"),
+	categoryId: z.string().describe("The ID of the category"),
+	name: intentCategoryNameSchema.optional(),
+	color: intentCategoryColorSchema.optional().describe("The category color")
+}).refine(({ name, color }) => name !== void 0 || color !== void 0, { message: "At least one of name or color must be provided" })).output(intentCategorySchema);
+const deleteIntentCategoryContractV1 = base.route({
+	path: "/v1/environments/{environmentId}/intent-categories/{categoryId}",
+	method: "DELETE",
+	summary: "Delete an intent category",
+	description: "Delete an intent category; its intents are unlinked but not deleted",
+	tags: ["insights"],
+	successDescription: "The intent category has been deleted successfully"
+}).errors({ NOT_FOUND: {} }).input(z.object({
+	environmentId: z.string().describe("The ID of the environment"),
+	categoryId: z.string().describe("The ID of the category")
+})).output(z.object({ success: z.literal(true) }));
+const linkIntentCategoryContractV1 = base.route({
+	path: "/v1/environments/{environmentId}/intent-categories/{categoryId}/link",
+	method: "POST",
+	summary: "Link an intent category",
+	description: "Link an intent category to intents; already linked intents are ignored",
+	tags: ["insights"],
+	successDescription: "The intents have been linked successfully"
+}).errors({ NOT_FOUND: {} }).input(z.object({
+	environmentId: z.string().describe("The ID of the environment"),
+	categoryId: z.string().describe("The ID of the category"),
+	intentIds: categorizableIntentIdsSchema
+})).output(z.object({ success: z.literal(true) }));
+const unlinkIntentCategoryContractV1 = base.route({
+	path: "/v1/environments/{environmentId}/intent-categories/{categoryId}/unlink",
+	method: "POST",
+	summary: "Unlink an intent category",
+	description: "Unlink an intent category from intents; intents without the category are ignored",
+	tags: ["insights"],
+	successDescription: "The intents have been unlinked successfully"
+}).errors({ NOT_FOUND: {} }).input(z.object({
+	environmentId: z.string().describe("The ID of the environment"),
+	categoryId: z.string().describe("The ID of the category"),
+	intentIds: categorizableIntentIdsSchema
+})).output(z.object({ success: z.literal(true) }));
+const listTeamsContractV1 = base.route({
 	path: "/v1/teams",
 	method: "GET",
 	summary: "List teams",
@@ -1759,7 +2270,22 @@ const listTeamsContractV1 = oc.route({
 	createdAt: z.coerce.date(),
 	hasStripeAccount: z.boolean()
 })));
-const getTunnelTicketContractV1 = oc.route({
+const getTeamUsageContractV1 = base.route({
+	path: "/v1/teams/{teamId}/usage",
+	method: "GET",
+	summary: "Get team usage",
+	description: "Get the MCP request usage of a team for its current billing window. A team that has made no request in the window reports zero.",
+	tags: ["teams"],
+	successDescription: "The current billing window usage"
+}).errors({ NOT_FOUND: {} }).input(z.object({ teamId: z.string().describe("The ID of the team") })).output(z.object({
+	teamId: z.string(),
+	plan: subscriptionPlanSchema.nullable().describe("The plan in force for the window, null on the Free plan"),
+	periodStart: z.coerce.date().describe("Start of the current billing window"),
+	periodEnd: z.coerce.date().describe("End of the current billing window"),
+	requestCount: z.number().int().describe("MCP requests settled during the current billing window"),
+	includedRequests: z.number().int().nullable().describe("Requests included in the plan for one window, null when the allowance is contract-specific")
+}));
+const getTunnelTicketContractV1 = base.route({
 	path: "/v1/tunnels/ticket",
 	method: "GET",
 	summary: "Get a tunnel ticket",
@@ -1771,16 +2297,13 @@ const getTunnelTicketContractV1 = oc.route({
 	ticket: z.string().describe("The signed tunnel ticket"),
 	tunnelHost: z.string().describe("The tunnel host to connect to")
 }));
-const publishServerContractV1 = oc.route({
+const publishServerContractV1 = base.route({
 	path: "/v1/distribution/publish",
 	method: "POST",
 	summary: "Publish a server to the MCP registry",
 	tags: ["distribution"],
 	successDescription: "The server has been published successfully"
-}).errors({
-	NOT_FOUND: {},
-	BAD_REQUEST: {}
-}).input(z.object({
+}).errors({ NOT_FOUND: {} }).input(z.object({
 	projectId: z.string(),
 	domain: z.string(),
 	title: z.string().min(1).max(100),
@@ -1789,17 +2312,14 @@ const publishServerContractV1 = oc.route({
 	iconSrc: z.url().max(255).optional(),
 	dryRun: z.boolean().optional()
 })).output(z.object({ serverFields: serverFieldsSchema }));
-const getServerInfoContractV1 = oc.route({
+const getServerInfoContractV1 = base.route({
 	path: "/v1/distribution/get",
 	method: "GET",
 	summary: "Get server info",
 	description: "Get info about a server",
 	tags: ["distribution"],
 	successDescription: "The server info"
-}).errors({
-	NOT_FOUND: {},
-	BAD_REQUEST: {}
-}).input(z.object({
+}).errors({ NOT_FOUND: {} }).input(z.object({
 	projectId: z.string(),
 	domain: z.string()
 })).output(z.object({ serverFields: serverFieldsSchema }));
@@ -1818,7 +2338,7 @@ const playgroundOutputSchema = z.object({
 	isPlaygroundEnabled: z.boolean(),
 	serverMetadata: playgroundServerMetadataOutputSchema.nullable()
 });
-const getPlaygroundContractV1 = oc.route({
+const getPlaygroundContractV1 = base.route({
 	path: "/v1/environments/{environmentId}/playground",
 	method: "GET",
 	summary: "Get playground configuration",
@@ -1826,17 +2346,14 @@ const getPlaygroundContractV1 = oc.route({
 	tags: ["environments"],
 	successDescription: "The playground configuration"
 }).errors({ NOT_FOUND: {} }).input(z.object({ environmentId: z.string().describe("The ID of the environment") })).output(playgroundOutputSchema);
-const upsertPlaygroundContractV1 = oc.route({
+const upsertPlaygroundContractV1 = base.route({
 	path: "/v1/environments/{environmentId}/playground",
 	method: "PUT",
 	summary: "Update playground configuration",
 	description: "Update the playground configuration for an environment. All fields are optional — only provided fields are updated.",
 	tags: ["environments"],
 	successDescription: "The updated playground configuration"
-}).errors({
-	NOT_FOUND: {},
-	BAD_REQUEST: {}
-}).input(z.object({
+}).errors({ NOT_FOUND: {} }).input(z.object({
 	environmentId: z.string().describe("The ID of the environment"),
 	isPlaygroundEnabled: z.boolean().optional(),
 	name: z.string().min(1).max(100).optional(),
@@ -1844,7 +2361,7 @@ const upsertPlaygroundContractV1 = oc.route({
 	headers: z.array(playgroundHeaderSchema).optional(),
 	examplePrompts: z.array(playgroundExamplePromptSchema).max(5).optional()
 })).output(playgroundOutputSchema);
-const createBeaconContractV1 = oc.route({
+const createBeaconContractV1 = base.route({
 	path: "/v1/beacon/audits",
 	method: "POST",
 	summary: "Create a beacon audit",
@@ -1853,7 +2370,6 @@ const createBeaconContractV1 = oc.route({
 	successDescription: "The audit has been created"
 }).errors({
 	NOT_FOUND: {},
-	BAD_REQUEST: {},
 	DNS_RESOLUTION_FAILED: { status: 400 }
 }).input(z.object({
 	targetUrl: z.url().describe("The HTTPS URL of the MCP server to audit"),
@@ -1861,7 +2377,7 @@ const createBeaconContractV1 = oc.route({
 	projectId: z.string().optional().describe("The project ID to associate the audit with"),
 	excludeCategories: z.array(checkCategorySchema).optional().describe("Check categories to exclude from the audit")
 })).output(z.object({ id: z.string() }));
-const getBeaconContractV1 = oc.route({
+const getBeaconContractV1 = base.route({
 	path: "/v1/beacon/audits/{auditId}",
 	method: "GET",
 	summary: "Get a beacon audit",
@@ -1876,9 +2392,73 @@ const getBeaconContractV1 = oc.route({
 	createdAt: z.coerce.date(),
 	report: auditReportWithScreenshotsSchema.nullable()
 }));
+const PLATFORM_DESCRIPTION = "The directory the package targets: `chatgpt` for the OpenAI App Directory, `claudeai` for the Anthropic MCP Directory";
+const submissionIdSchema = z.string().describe("The ID of the submission package");
+const claudeSubmissionUpdateSchema = claudeSubmissionDraftSchema.strict();
+const chatgptSubmissionUpdateSchema = chatgptSubmissionDraftSchema.strict();
+const createSubmissionContractV1 = base.route({
+	path: "/v1/submissions",
+	method: "POST",
+	summary: "Create a submission package",
+	description: "Create a submission package for an environment. Alpic reads the environment's live MCP server and prefills every field it can infer, so the response already carries the populated package. The environment must have a successful deployment and must not require authentication.",
+	tags: ["submissions"],
+	successDescription: "The created submission package, with its prefilled fields"
+}).errors({ NOT_FOUND: {} }).input(z.object({
+	environmentId: z.string().describe("The ID of the environment to build the package from"),
+	platform: platformSchema.describe(PLATFORM_DESCRIPTION)
+})).output(submissionSchema);
+const listSubmissionsContractV1 = base.route({
+	path: "/v1/projects/{projectId}/submissions",
+	method: "GET",
+	summary: "List submission packages",
+	description: "List the submission packages of a project, grouped by directory and most recently updated first, optionally narrowed to one environment or one directory",
+	tags: ["submissions"],
+	successDescription: "The list of submission packages"
+}).errors({ NOT_FOUND: {} }).input(z.object({
+	projectId: z.string().describe("The ID of the project"),
+	environmentId: z.string().optional().describe("Filter by environment ID"),
+	platform: platformSchema.optional().describe(PLATFORM_DESCRIPTION)
+})).output(z.array(submissionSchema));
+const getSubmissionContractV1 = base.route({
+	path: "/v1/submissions/{submissionId}",
+	method: "GET",
+	summary: "Get a submission package",
+	description: "Get a submission package by ID, including its form data and the prefill it started from",
+	tags: ["submissions"],
+	successDescription: "The submission package"
+}).errors({ NOT_FOUND: {} }).input(z.object({ submissionId: submissionIdSchema })).output(submissionSchema);
+const updateSubmissionContractV1 = base.route({
+	path: "/v1/submissions/{submissionId}",
+	method: "PUT",
+	summary: "Update a submission package",
+	description: "Update the form data of a submission package. Only the fields you send are changed; the rest are left as they are. Unknown field names are rejected rather than ignored, so a typo fails the call. `platform` must match the package's own platform.",
+	tags: ["submissions"],
+	successDescription: "The updated submission package"
+}).errors({ NOT_FOUND: {} }).input(z.discriminatedUnion("platform", [z.object({
+	submissionId: submissionIdSchema,
+	platform: z.literal("claudeai").describe(PLATFORM_DESCRIPTION),
+	formData: claudeSubmissionUpdateSchema
+}), z.object({
+	submissionId: submissionIdSchema,
+	platform: z.literal("chatgpt").describe(PLATFORM_DESCRIPTION),
+	formData: chatgptSubmissionUpdateSchema
+})])).output(submissionSchema);
 const contract = {
-	teams: { list: { v1: listTeamsContractV1 } },
+	teams: {
+		list: { v1: listTeamsContractV1 },
+		getUsage: { v1: getTeamUsageContractV1 }
+	},
 	analytics: { get: { v1: getProjectAnalyticsContractV1 } },
+	intents: { list: { v1: listIntentsContractV1 } },
+	intentCategories: {
+		list: { v1: listIntentCategoriesContractV1 },
+		create: { v1: createIntentCategoryContractV1 },
+		update: { v1: updateIntentCategoryContractV1 },
+		delete: { v1: deleteIntentCategoryContractV1 },
+		link: { v1: linkIntentCategoryContractV1 },
+		unlink: { v1: unlinkIntentCategoryContractV1 }
+	},
+	feedbacks: { list: { v1: listFeedbacksContractV1 } },
 	deployments: {
 		list: { v1: listDeploymentsContractV1 },
 		get: { v1: getDeploymentContractV1 },
@@ -1888,6 +2468,7 @@ const contract = {
 	environments: {
 		create: { v1: createEnvironmentContractV1 },
 		get: { v1: getEnvironmentContractV1 },
+		delete: { v1: deleteEnvironmentContractV1 },
 		deploy: { v1: deployEnvironmentContractV1 },
 		getLogs: { v1: getLogsContractV1 },
 		getLatestLogs: { v1: getLatestLogsContractV1 }
@@ -1917,6 +2498,12 @@ const contract = {
 	beacon: {
 		create: { v1: createBeaconContractV1 },
 		get: { v1: getBeaconContractV1 }
+	},
+	submissions: {
+		create: { v1: createSubmissionContractV1 },
+		list: { v1: listSubmissionsContractV1 },
+		get: { v1: getSubmissionContractV1 },
+		update: { v1: updateSubmissionContractV1 }
 	}
 };
 const { uploadArtifact: _discard, ...deploymentsForDocs } = contract.deployments;
@@ -1924,5 +2511,26 @@ const contractForDocs = {
 	...contract,
 	deployments: deploymentsForDocs
 };
+/** Shared by the served `openapi.json` and the snapshot test that guards it, so the two cannot drift. */
+const OPENAPI_DOC_OPTIONS = {
+	info: {
+		title: "Alpic API",
+		version: "1.0.0"
+	},
+	servers: [{ url: "https://api.alpic.ai" }],
+	security: [{ bearerAuth: [] }],
+	components: { securitySchemes: { bearerAuth: {
+		type: "http",
+		description: "Bearer token for authentication. Use an API key from the API Keys page in team settings, or an OAuth access token.",
+		scheme: "bearer"
+	} } },
+	commonSchemas: {
+		Submission: { schema: submissionSchema },
+		ClaudeSubmissionFormData: { schema: claudeSubmissionDraftSchema },
+		ChatgptSubmissionFormData: { schema: chatgptSubmissionDraftSchema },
+		ClaudeSubmissionFormDataUpdate: { schema: claudeSubmissionUpdateSchema },
+		ChatgptSubmissionFormDataUpdate: { schema: chatgptSubmissionUpdateSchema }
+	}
+};
 //#endregion
-export { AUTH_SCOPE_ANY, AUTH_SCOPE_USER, PLATFORM_LABELS, buildSettingsSchema, contract, contractForDocs, createEnvironmentContractV1, deploymentStatusSchema, environmentVariableSchema, environmentVariablesSchema, playgroundExamplePromptSchema, playgroundHeaderSchema, runtimeSchema, serverFieldsSchema, transportSchema, updateEnvironmentVariableSchema };
+export { AI_PLATFORMS, AUTH_SCOPE_ANY, AUTH_SCOPE_USER, INTENT_CATEGORY_COLORS, OPENAPI_DOC_OPTIONS, PLATFORM_LABELS, buildSettingsSchema, chatgptSubmissionUpdateSchema, claudeSubmissionUpdateSchema, contract, contractForDocs, createEnvironmentContractV1, deploymentStatusSchema, environmentVariableSchema, environmentVariablesSchema, intentCategoryColorSchema, playgroundExamplePromptSchema, playgroundHeaderSchema, runtimeSchema, serverFieldsSchema, transportSchema, updateEnvironmentVariableSchema };