@alpic-ai/api 0.0.0-staging.g82c532b → 0.0.0-staging.g83e6676

package/dist/index.d.mts

@@ -448,6 +448,7 @@ declare const contract: {
       }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
         NOT_FOUND: {};
         BAD_REQUEST: {};
+        FORBIDDEN: {};
       }>, Record<never, never>>;
     };
     get: {
@@ -663,6 +664,7 @@ declare const contract: {
       }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
         NOT_FOUND: {};
         BAD_REQUEST: {};
+        FORBIDDEN: {};
       }>, Record<never, never>>;
     };
     delete: {
@@ -938,6 +940,17 @@ declare const contract: {
 type RouterInput = InferContractRouterInputs<typeof contract>;
 type RouterOutput = InferContractRouterOutputs<typeof contract>;
 //#endregion
+//#region src/auth-scope.d.ts
+/** Credential scope required by an API route. */
+type AuthScope = "any" | "user";
+/** Accepts an API key or OAuth access token (default for most routes). */
+declare const AUTH_SCOPE_ANY = "any";
+/** Requires a user OAuth access token; API keys are not accepted. */
+declare const AUTH_SCOPE_USER = "user";
+type RouteAuthMeta = {
+  authScope?: AuthScope;
+};
+//#endregion
 //#region ../domains/src/platforms/schemas.d.ts
 declare const platformSchema: z.ZodEnum<{
   chatgpt: "chatgpt";
@@ -1017,4 +1030,4 @@ declare const serverFieldsSchema: z.ZodObject<{
   }, z.core.$strip>>>;
 }, z.core.$strip>;
 //#endregion
-export { ApiContext, PLATFORM_LABELS, type Platform, RouterInput, RouterOutput, Runtime, Transport, buildSettingsSchema, contract, createEnvironmentContractV1, deploymentStatusSchema, environmentVariableSchema, environmentVariablesSchema, playgroundExamplePromptSchema, playgroundHeaderSchema, runtimeSchema, serverFieldsSchema, transportSchema, updateEnvironmentVariableSchema };
+export { AUTH_SCOPE_ANY, AUTH_SCOPE_USER, ApiContext, AuthScope, PLATFORM_LABELS, type Platform, RouteAuthMeta, RouterInput, RouterOutput, Runtime, Transport, buildSettingsSchema, contract, createEnvironmentContractV1, deploymentStatusSchema, environmentVariableSchema, environmentVariablesSchema, playgroundExamplePromptSchema, playgroundHeaderSchema, runtimeSchema, serverFieldsSchema, transportSchema, updateEnvironmentVariableSchema };

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { z } from "zod";
 import * as z$1 from "zod/v4";
 import { oc } from "@orpc/contract";
 import ms from "ms";
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_@cfworker+json-schema@4.1.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
 /**
 * Reusable URL validation that disallows javascript: scheme
 */
@@ -369,6 +369,12 @@ const environmentSchema$1 = z.object({
 	updatedAt: z.coerce.date()
 });
 const environmentWithDomainsSchema = environmentSchema$1.extend({ domains: z.array(environmentDomainSchema) });
+z.object({
+	sessionReplayEnabled: z.boolean(),
+	collectRequestPayload: z.boolean(),
+	collectResponsePayload: z.boolean(),
+	collectErrorMessage: z.boolean()
+});
 z.object({
 	id: z.string(),
 	createdAt: z.coerce.date(),
@@ -578,6 +584,8 @@ const screenshotEntrySchema = z.object({
 }).describe("Each screenshot: the user prompt that produced it + the image URL.");
 /** Accepts either a valid email or URL. */
 const supportChannelSchema = z.string().refine((value) => z.email().safeParse(value).success || z.url().safeParse(value).success, { error: "Must be a valid email or URL" });
+/** A URL field whose error spells out that the scheme is required. */
+const urlField = z.url({ error: "Enter a full URL including https:// (e.g. https://example.com)" });
 const chatgptCategorySchema = z.enum([
 	"BUSINESS",
 	"COLLABORATION",
@@ -915,19 +923,19 @@ const chatgptSubmissionFormDataSchema = z.object({
 	description: chatgptDescriptionSchema.describe("Clear, engaging description highlighting what the app does and why people will love it. Appears publicly on the directory page. End it by naming the product categories or intents the app does NOT cover, so ChatGPT learns when not to route to it (define exclusions by absent categories or wrong intents, never by naming other brands)."),
 	category: chatgptCategorySchema.describe("Category from the OpenAI taxonomy."),
 	developerName: z.string().describe("Developer name shown publicly on the app's directory page."),
-	companyUrl: z.url().describe("Your company's main website URL."),
+	companyUrl: urlField.describe("Your company's main website URL."),
 	supportChannel: supportChannelSchema.describe("Customer support URL or email address."),
-	privacyPolicyUrl: z.url().describe("URL to your privacy policy."),
-	termsOfServiceUrl: z.url().describe("URL to the app's terms of service."),
-	demoRecordingUrl: z.url().describe("URL to a video demonstrating the app, recorded via OpenAI Developer Mode. Cover all main use cases on web, iOS, and Android."),
+	privacyPolicyUrl: urlField.describe("URL to your privacy policy."),
+	termsOfServiceUrl: urlField.describe("URL to the app's terms of service."),
+	demoRecordingUrl: urlField.describe("URL to a video demonstrating the app, recorded via OpenAI Developer Mode. Cover all main use cases on web, iOS, and Android."),
 	appCommerceAndPurchasing: z.boolean().describe("Checkbox: 'My app links or directs users out of ChatGPT to make purchases.' Defaults to false. Verify the app does not offer digital goods."),
-	serverUrl: z.url().describe("URL of the MCP server."),
+	serverUrl: urlField.describe("URL of the MCP server."),
 	authentication: chatgptAuthenticationSchema.describe("OAuth 2.0 or No auth. OAuth configuration is auto-discovered from the MCP server's metadata."),
 	tools: z.array(toolDefinitionSchema).describe("List of tools exposed by the MCP server (auto-populated from the production server's manifest)."),
 	toolJustifications: z.array(chatgptToolJustificationSchema).describe("Per-tool justification of `readOnlyHint`, `openWorldHint`, and `destructiveHint` annotation values. One short, specific sentence per hint describing what the tool actually does."),
 	testCases: z.array(positiveTestCaseSchema).describe("At least 5 positive test cases. Each: Scenario, User prompt, Tool triggered, Expected output. Collectively cover the full capability across different flow stages (initial search or browse, market or locale handling, post-interaction detail, an action ChatGPT performs on the user's behalf, and a conversion or secondary tool) rather than five variations of the same first step."),
 	negativeTestCases: z.array(negativeTestCaseSchema).describe("3 negative test cases: prompts where the app should NOT trigger but the model might think it is relevant. These become production routing metadata that teaches ChatGPT when to stay silent, so pick tight near-misses: a product category the app does not carry, the right brand or domain but an intent the app does not serve, or a boundary with a sibling app."),
-	screenshots: z.array(screenshotEntrySchema).max(3).describe("In-app screenshots paired with the user prompt that produced them. Widget apps must show the widget UI; non-widget apps show the model response. Min 1, max 3 entries, all public. Images: 706px wide, 400–860px tall, PNG."),
+	screenshots: z.array(screenshotEntrySchema.extend({ prompt: z.string().max(75, { error: "Screenshot prompts are limited to 75 characters." }) })).max(3).describe("In-app screenshots paired with the user prompt that produced them (each prompt is 75 characters max). Widget apps must show the widget UI; non-widget apps show the model response. Min 1, max 3 entries, all public. Images: 706px wide, 400–860px tall, PNG."),
 	translations: z.array(chatgptTranslationSchema).describe("Per-locale translation of tagline + description. English (US) is the default."),
 	allowedCountries: chatgptAllowedCountriesSchema.describe("Availability: all supported countries, or an allow-list / block-list of specific ones (ISO alpha-2)."),
 	releaseNotes: z.string().describe("Publicly displayed on the app details page.")
@@ -1158,6 +1166,7 @@ claudeSubmissionFormDataSchema.pick({
 const submissionMetaFieldsSchema = z.object({
 	id: z.string(),
 	environmentId: z.string(),
+	auditId: z.string().nullable(),
 	createdAt: z.coerce.date(),
 	updatedAt: z.coerce.date()
 });
@@ -1194,6 +1203,12 @@ z.object({
 	partnerDiscount: partnerDiscountSchema.nullable()
 });
 //#endregion
+//#region src/auth-scope.ts
+/** Accepts an API key or OAuth access token (default for most routes). */
+const AUTH_SCOPE_ANY = "any";
+/** Requires a user OAuth access token; API keys are not accepted. */
+const AUTH_SCOPE_USER = "user";
+//#endregion
 //#region src/schemas.ts
 const RESERVED_KEYS = [
 	"_HANDLER",
@@ -1422,7 +1437,8 @@ const createProjectContractV1 = oc.route({
 	successDescription: "The project has been created successfully"
 }).errors({
 	NOT_FOUND: {},
-	BAD_REQUEST: {}
+	BAD_REQUEST: {},
+	FORBIDDEN: {}
 }).input(z.object({
 	teamId: z.string().optional(),
 	name: z.string().trim().min(1).max(100),
@@ -1528,7 +1544,8 @@ const updateProjectContractV1 = oc.route({
 	successDescription: "The project has been updated successfully"
 }).errors({
 	NOT_FOUND: {},
-	BAD_REQUEST: {}
+	BAD_REQUEST: {},
+	FORBIDDEN: {}
 }).input(z.object({
 	projectId: z.string().describe("The ID of the project"),
 	name: z.string().min(1).max(100).optional().describe("The new name for the project"),
@@ -1731,7 +1748,7 @@ const getTunnelTicketContractV1 = oc.route({
 	description: "Get a signed ticket for establishing a tunnel connection. Requires user authentication (API keys are not supported).",
 	tags: ["tunnels"],
 	successDescription: "The tunnel ticket"
-}).errors({ FORBIDDEN: {} }).output(z.object({
+}).meta({ authScope: AUTH_SCOPE_USER }).errors({ FORBIDDEN: {} }).output(z.object({
 	subdomain: z.string().describe("The subdomain assigned to the user"),
 	ticket: z.string().describe("The signed tunnel ticket"),
 	tunnelHost: z.string().describe("The tunnel host to connect to")
@@ -1885,4 +1902,4 @@ const contract = {
 	}
 };
 //#endregion
-export { PLATFORM_LABELS, buildSettingsSchema, contract, createEnvironmentContractV1, deploymentStatusSchema, environmentVariableSchema, environmentVariablesSchema, playgroundExamplePromptSchema, playgroundHeaderSchema, runtimeSchema, serverFieldsSchema, transportSchema, updateEnvironmentVariableSchema };
+export { AUTH_SCOPE_ANY, AUTH_SCOPE_USER, PLATFORM_LABELS, buildSettingsSchema, contract, createEnvironmentContractV1, deploymentStatusSchema, environmentVariableSchema, environmentVariablesSchema, playgroundExamplePromptSchema, playgroundHeaderSchema, runtimeSchema, serverFieldsSchema, transportSchema, updateEnvironmentVariableSchema };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alpic-ai/api",
-  "version": "0.0.0-staging.g82c532b",
+  "version": "0.0.0-staging.g83e6676",
   "description": "Contract for the Alpic API",
   "type": "module",
   "main": "./dist/index.mjs",
@@ -17,19 +17,19 @@
   "author": "Alpic",
   "license": "ISC",
   "dependencies": {
-    "@orpc/contract": "^1.14.4",
+    "@orpc/contract": "^1.14.6",
     "ms": "^2.1.3",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@orpc/openapi": "^1.14.4",
-    "@orpc/zod": "^1.14.4",
+    "@orpc/openapi": "^1.14.6",
+    "@orpc/zod": "^1.14.6",
     "@total-typescript/tsconfig": "^1.0.4",
     "@types/ms": "^2.1.0",
     "shx": "^0.4.0",
-    "tsdown": "^0.22.1",
+    "tsdown": "^0.22.3",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.8",
+    "vitest": "^4.1.9",
     "@alpic-ai/domains": "0.0.0"
   },
   "scripts": {