@alpic-ai/api 0.0.0-staging.g3da6945 → 0.0.0-staging.g430b4ff

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/index.mjs +243 -0
  2. package/package.json +1 -1
package/dist/index.mjs CHANGED
@@ -1,6 +1,174 @@
1
1
  import { z } from "zod";
2
+ import * as z$1 from "zod/v4";
2
3
  import { oc } from "@orpc/contract";
3
4
  import ms from "ms";
5
+ //#region ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_@cfworker+json-schema@4.1.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
6
+ /**
7
+ * Reusable URL validation that disallows javascript: scheme
8
+ */
9
+ const SafeUrlSchema = z$1.url().superRefine((val, ctx) => {
10
+ if (!URL.canParse(val)) {
11
+ ctx.addIssue({
12
+ code: z$1.ZodIssueCode.custom,
13
+ message: "URL must be parseable",
14
+ fatal: true
15
+ });
16
+ return z$1.NEVER;
17
+ }
18
+ }).refine((url) => {
19
+ const u = new URL(url);
20
+ return u.protocol !== "javascript:" && u.protocol !== "data:" && u.protocol !== "vbscript:";
21
+ }, { message: "URL cannot use javascript:, data:, or vbscript: scheme" });
22
+ /**
23
+ * RFC 9728 OAuth Protected Resource Metadata
24
+ */
25
+ const OAuthProtectedResourceMetadataSchema = z$1.looseObject({
26
+ resource: z$1.string().url(),
27
+ authorization_servers: z$1.array(SafeUrlSchema).optional(),
28
+ jwks_uri: z$1.string().url().optional(),
29
+ scopes_supported: z$1.array(z$1.string()).optional(),
30
+ bearer_methods_supported: z$1.array(z$1.string()).optional(),
31
+ resource_signing_alg_values_supported: z$1.array(z$1.string()).optional(),
32
+ resource_name: z$1.string().optional(),
33
+ resource_documentation: z$1.string().optional(),
34
+ resource_policy_uri: z$1.string().url().optional(),
35
+ resource_tos_uri: z$1.string().url().optional(),
36
+ tls_client_certificate_bound_access_tokens: z$1.boolean().optional(),
37
+ authorization_details_types_supported: z$1.array(z$1.string()).optional(),
38
+ dpop_signing_alg_values_supported: z$1.array(z$1.string()).optional(),
39
+ dpop_bound_access_tokens_required: z$1.boolean().optional()
40
+ });
41
+ /**
42
+ * RFC 8414 OAuth 2.0 Authorization Server Metadata
43
+ */
44
+ const OAuthMetadataSchema = z$1.looseObject({
45
+ issuer: z$1.string(),
46
+ authorization_endpoint: SafeUrlSchema,
47
+ token_endpoint: SafeUrlSchema,
48
+ registration_endpoint: SafeUrlSchema.optional(),
49
+ scopes_supported: z$1.array(z$1.string()).optional(),
50
+ response_types_supported: z$1.array(z$1.string()),
51
+ response_modes_supported: z$1.array(z$1.string()).optional(),
52
+ grant_types_supported: z$1.array(z$1.string()).optional(),
53
+ token_endpoint_auth_methods_supported: z$1.array(z$1.string()).optional(),
54
+ token_endpoint_auth_signing_alg_values_supported: z$1.array(z$1.string()).optional(),
55
+ service_documentation: SafeUrlSchema.optional(),
56
+ revocation_endpoint: SafeUrlSchema.optional(),
57
+ revocation_endpoint_auth_methods_supported: z$1.array(z$1.string()).optional(),
58
+ revocation_endpoint_auth_signing_alg_values_supported: z$1.array(z$1.string()).optional(),
59
+ introspection_endpoint: z$1.string().optional(),
60
+ introspection_endpoint_auth_methods_supported: z$1.array(z$1.string()).optional(),
61
+ introspection_endpoint_auth_signing_alg_values_supported: z$1.array(z$1.string()).optional(),
62
+ code_challenge_methods_supported: z$1.array(z$1.string()).optional(),
63
+ client_id_metadata_document_supported: z$1.boolean().optional()
64
+ });
65
+ /**
66
+ * OpenID Connect Discovery 1.0 Provider Metadata
67
+ * see: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
68
+ */
69
+ const OpenIdProviderMetadataSchema = z$1.looseObject({
70
+ issuer: z$1.string(),
71
+ authorization_endpoint: SafeUrlSchema,
72
+ token_endpoint: SafeUrlSchema,
73
+ userinfo_endpoint: SafeUrlSchema.optional(),
74
+ jwks_uri: SafeUrlSchema,
75
+ registration_endpoint: SafeUrlSchema.optional(),
76
+ scopes_supported: z$1.array(z$1.string()).optional(),
77
+ response_types_supported: z$1.array(z$1.string()),
78
+ response_modes_supported: z$1.array(z$1.string()).optional(),
79
+ grant_types_supported: z$1.array(z$1.string()).optional(),
80
+ acr_values_supported: z$1.array(z$1.string()).optional(),
81
+ subject_types_supported: z$1.array(z$1.string()),
82
+ id_token_signing_alg_values_supported: z$1.array(z$1.string()),
83
+ id_token_encryption_alg_values_supported: z$1.array(z$1.string()).optional(),
84
+ id_token_encryption_enc_values_supported: z$1.array(z$1.string()).optional(),
85
+ userinfo_signing_alg_values_supported: z$1.array(z$1.string()).optional(),
86
+ userinfo_encryption_alg_values_supported: z$1.array(z$1.string()).optional(),
87
+ userinfo_encryption_enc_values_supported: z$1.array(z$1.string()).optional(),
88
+ request_object_signing_alg_values_supported: z$1.array(z$1.string()).optional(),
89
+ request_object_encryption_alg_values_supported: z$1.array(z$1.string()).optional(),
90
+ request_object_encryption_enc_values_supported: z$1.array(z$1.string()).optional(),
91
+ token_endpoint_auth_methods_supported: z$1.array(z$1.string()).optional(),
92
+ token_endpoint_auth_signing_alg_values_supported: z$1.array(z$1.string()).optional(),
93
+ display_values_supported: z$1.array(z$1.string()).optional(),
94
+ claim_types_supported: z$1.array(z$1.string()).optional(),
95
+ claims_supported: z$1.array(z$1.string()).optional(),
96
+ service_documentation: z$1.string().optional(),
97
+ claims_locales_supported: z$1.array(z$1.string()).optional(),
98
+ ui_locales_supported: z$1.array(z$1.string()).optional(),
99
+ claims_parameter_supported: z$1.boolean().optional(),
100
+ request_parameter_supported: z$1.boolean().optional(),
101
+ request_uri_parameter_supported: z$1.boolean().optional(),
102
+ require_request_uri_registration: z$1.boolean().optional(),
103
+ op_policy_uri: SafeUrlSchema.optional(),
104
+ op_tos_uri: SafeUrlSchema.optional(),
105
+ client_id_metadata_document_supported: z$1.boolean().optional()
106
+ });
107
+ /**
108
+ * OpenID Connect Discovery metadata that may include OAuth 2.0 fields
109
+ * This schema represents the real-world scenario where OIDC providers
110
+ * return a mix of OpenID Connect and OAuth 2.0 metadata fields
111
+ */
112
+ const OpenIdProviderDiscoveryMetadataSchema = z$1.object({
113
+ ...OpenIdProviderMetadataSchema.shape,
114
+ ...OAuthMetadataSchema.pick({ code_challenge_methods_supported: true }).shape
115
+ });
116
+ z$1.object({
117
+ access_token: z$1.string(),
118
+ id_token: z$1.string().optional(),
119
+ token_type: z$1.string(),
120
+ expires_in: z$1.coerce.number().optional(),
121
+ scope: z$1.string().optional(),
122
+ refresh_token: z$1.string().optional()
123
+ }).strip();
124
+ z$1.object({
125
+ error: z$1.string(),
126
+ error_description: z$1.string().optional(),
127
+ error_uri: z$1.string().optional()
128
+ });
129
+ /**
130
+ * Optional version of SafeUrlSchema that allows empty string for retrocompatibility on tos_uri and logo_uri
131
+ */
132
+ const OptionalSafeUrlSchema = SafeUrlSchema.optional().or(z$1.literal("").transform(() => void 0));
133
+ /**
134
+ * RFC 7591 OAuth 2.0 Dynamic Client Registration metadata
135
+ */
136
+ const OAuthClientMetadataSchema = z$1.object({
137
+ redirect_uris: z$1.array(SafeUrlSchema),
138
+ token_endpoint_auth_method: z$1.string().optional(),
139
+ grant_types: z$1.array(z$1.string()).optional(),
140
+ response_types: z$1.array(z$1.string()).optional(),
141
+ client_name: z$1.string().optional(),
142
+ client_uri: SafeUrlSchema.optional(),
143
+ logo_uri: OptionalSafeUrlSchema,
144
+ scope: z$1.string().optional(),
145
+ contacts: z$1.array(z$1.string()).optional(),
146
+ tos_uri: OptionalSafeUrlSchema,
147
+ policy_uri: z$1.string().optional(),
148
+ jwks_uri: SafeUrlSchema.optional(),
149
+ jwks: z$1.any().optional(),
150
+ software_id: z$1.string().optional(),
151
+ software_version: z$1.string().optional(),
152
+ software_statement: z$1.string().optional()
153
+ }).strip();
154
+ /**
155
+ * RFC 7591 OAuth 2.0 Dynamic Client Registration client information
156
+ */
157
+ const OAuthClientInformationSchema = z$1.object({
158
+ client_id: z$1.string(),
159
+ client_secret: z$1.string().optional(),
160
+ client_id_issued_at: z$1.number().optional(),
161
+ client_secret_expires_at: z$1.number().optional()
162
+ }).strip();
163
+ OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);
164
+ z$1.object({
165
+ error: z$1.string(),
166
+ error_description: z$1.string().optional()
167
+ }).strip();
168
+ z$1.object({
169
+ token: z$1.string(),
170
+ token_type_hint: z$1.string().optional()
171
+ }).strip();
4
172
  const platformSchema = z.enum(["chatgpt", "claudeai"]);
5
173
  const PLATFORM_LABELS = {
6
174
  chatgpt: "ChatGPT",
@@ -71,6 +239,13 @@ const auditReportWithScreenshotsSchema = auditReportSchema.extend({ widgetScreen
71
239
  chatgpt: widgetScreenshotSchema.optional(),
72
240
  claudeai: widgetScreenshotSchema.optional()
73
241
  }) });
242
+ z.object({
243
+ id: z.string(),
244
+ environmentId: z.string(),
245
+ clientId: z.string(),
246
+ clientSecret: z.string(),
247
+ clientScopes: z.array(z.string())
248
+ });
74
249
  const deploymentStatusSchema$1 = z.enum([
75
250
  "ongoing",
76
251
  "deployed",
@@ -98,6 +273,74 @@ const deploymentSummarySchema = z.object({
98
273
  createdAt: z.coerce.date(),
99
274
  updatedAt: z.coerce.date()
100
275
  });
276
+ /**
277
+ * Public environment
278
+ *
279
+ * No OAuth metadata exposed.
280
+ */
281
+ const publicEnvironmentSchema = z.object({
282
+ isPublic: z.literal(true),
283
+ oAuthMetadata: z.undefined().optional()
284
+ });
285
+ /**
286
+ * Protected environment with an external resource metadata URL
287
+ *
288
+ * An external resource metadata URL is returned in the WWW-Authenticate header during the first 401 response.
289
+ * Everything that follows is handled outside of the MCP server scope.
290
+ */
291
+ const externalResourceMetadataEnvironmentSchema = z.object({
292
+ isPublic: z.literal(false),
293
+ oAuthMetadata: z.object({ externalResourceMetadataUrl: z.url() }),
294
+ scope: z.string().optional()
295
+ });
296
+ /**
297
+ * Protected environment with an external authorization server URL
298
+ *
299
+ * The server itself exposes the /.well-known/oauth-protected-resource endpoint.
300
+ * An external authorization server URL is returned when requesting the endpoint.
301
+ * Everything that follows is handled outside of the MCP server scope.
302
+ */
303
+ const externalAuthorizationServerEnvironmentSchema = z.object({
304
+ isPublic: z.literal(false),
305
+ oAuthMetadata: z.object({
306
+ externalAuthorizationServerUrl: z.url(),
307
+ resourceMetadata: OAuthProtectedResourceMetadataSchema.optional()
308
+ }),
309
+ scope: z.string().optional()
310
+ });
311
+ /**
312
+ * Standalone protected environment
313
+ *
314
+ * The server itself exposes the /.well-known/oauth-protected-resource endpoint.
315
+ * The server itself exposes the /.well-known/oauth-authorization-server endpoint.
316
+ */
317
+ const standaloneEnvironmentSchema = z.object({
318
+ isPublic: z.literal(false),
319
+ oAuthMetadata: z.object({
320
+ authorizationServerMetadata: z.union([OAuthMetadataSchema, OpenIdProviderDiscoveryMetadataSchema]),
321
+ resourceMetadata: OAuthProtectedResourceMetadataSchema.optional()
322
+ }),
323
+ scope: z.string().optional()
324
+ });
325
+ /**
326
+ * Protected environment without OAuth discovery
327
+ *
328
+ * The server enforces authentication but exposes no OAuth discovery metadata.
329
+ * Neither /.well-known/oauth-protected-resource nor /.well-known/oauth-authorization-server
330
+ * are advertised. Clients must obtain credentials out-of-band.
331
+ */
332
+ const protectedWithoutDiscoveryEnvironmentSchema = z.object({
333
+ isPublic: z.literal(false),
334
+ oAuthMetadata: z.strictObject({}),
335
+ scope: z.string().optional()
336
+ });
337
+ z.union([
338
+ publicEnvironmentSchema,
339
+ externalResourceMetadataEnvironmentSchema,
340
+ externalAuthorizationServerEnvironmentSchema,
341
+ standaloneEnvironmentSchema,
342
+ protectedWithoutDiscoveryEnvironmentSchema
343
+ ]);
101
344
  const allowedPlatformSchema = platformSchema;
102
345
  const environmentDomainSchema = z.object({
103
346
  domain: z.string(),
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@alpic-ai/api",
3
- "version": "0.0.0-staging.g3da6945",
3
+ "version": "0.0.0-staging.g430b4ff",
4
4
  "description": "Contract for the Alpic API",
5
5
  "type": "module",
6
6
  "main": "./dist/index.mjs",