@vapi-ai/mcp-server 0.0.10 → 0.1.0

package/README.md

@@ -1,13 +1,7 @@
 # Vapi MCP Server
 
-[![smithery badge](https://smithery.ai/badge/@VapiAI/vapi-mcp-server)](https://smithery.ai/server/@VapiAI/vapi-mcp-server)
-
 Build AI voice assistants and phone agents with [Vapi](https://vapi.ai) using the [Model Context Protocol](https://modelcontextprotocol.com/).
 
-<a href="https://glama.ai/mcp/servers/@VapiAI/mcp-server">
-  <img width="380" height="200" src="https://glama.ai/mcp/servers/@VapiAI/mcp-server/badge" alt="Vapi Server MCP server" />
-</a>
-
 ## Setup
 
 The MCP server requires a Vapi API key. Get one from the [Vapi dashboard](https://dashboard.vapi.ai/org/api-keys).
@@ -157,6 +151,24 @@ Connect to Vapi's hosted MCP server from any MCP client:
 
 ## Available Tools
 
+### Documentation
+| Tool | Description |
+|------|-------------|
+| `ask_vapi_docs` | Query the Fern docs MCP for current documentation passages and source URLs |
+
+`ask_vapi_docs({"question":"How do assistant hooks work?","topK":8})` forwards to
+`searchDocs` at `https://docs.vapi.ai/_mcp/server`. The result preserves Fern's
+content, source links and error flag. This endpoint currently returns passages
+for the calling agent to synthesize, rather than a generated answer. `topK`
+defaults to 8 (maximum 20). Each request owns its MCP connection, supports caller
+cancellation, times out after 30 seconds and closes the connection afterwards.
+
+This tool needs outbound HTTPS to the Fern endpoint. It makes no Vapi API calls
+and sends no Vapi credentials upstream. The server still requires `VAPI_TOKEN`
+at startup. Discovery through `tools/list` makes no network requests; upstream
+failures are returned as tool errors. No extra MCP connection is needed. Do not
+include secrets or private customer data in docs questions.
+
 ### Assistants
 | Tool | Description |
 |------|-------------|
@@ -186,6 +198,55 @@ Connect to Vapi's hosted MCP server from any MCP client:
 | `create_tool` | Create tool for API integration |
 | `update_tool` | Update tool |
 
+### Public Skills
+| Tool | Description |
+|------|-------------|
+| `search_skills` | Search public Vapi skills by keywords; omit `query` to browse |
+| `load_skill` | Read a skill's `SKILL.md` or a supporting file |
+
+For example, call `search_skills({"query":"simulations"})`, then
+`load_skill({"name":"simulations"})`. The load result includes a `files` list;
+read a supporting file with `load_skill({"name":"simulations","path":"references/example.md"})`,
+using an exact path from that list. Loading returns instructions for the current
+task; it does not install skills or run scripts.
+
+Skills come directly from the public [VapiAI/skills](https://github.com/VapiAI/skills)
+repository, including experimental skills. Discovery uses its GitHub tree rather
+than the proposed skills manifest. Each server caches a commit-pinned snapshot
+for five minutes, so file reads within that snapshot use the same revision. Search
+matches names, descriptions and instruction text; it returns at most `limit`
+results (default 10, maximum 30) and the total match count. `load_skill` returns
+one text file at a time, up to 512 KB, with its source URL and revision.
+
+The skills tools need outbound HTTPS to public GitHub. They make no Vapi API
+calls and send no Vapi credentials upstream. The server still requires
+`VAPI_TOKEN` at startup. Discovery through `tools/list` makes no network requests;
+upstream failures are returned as tool errors. No GitHub token is needed for this
+public content. GitHub's unauthenticated API rate limits apply.
+
+### Simulations
+
+| Tool | Description |
+|------|-------------|
+| `list_simulation_personalities` | List simulated callers |
+| `create_simulation_personality` | Create a simulated caller with a tester assistant |
+| `list_simulation_scenarios` | List tester scripts and evaluations |
+| `create_simulation_scenario` | Create a tester script and evaluations |
+| `list_simulations` | List scenario/personality pairs |
+| `create_simulation` | Pair a scenario with a personality |
+| `list_simulation_suites` | List groups of simulations |
+| `create_simulation_suite` | Group simulations into a suite |
+| `run_simulations` | Run simulations or suites against an assistant or squad |
+| `list_simulation_runs` | List runs and filter by status or target |
+| `get_simulation_run` | Get run status and item summaries |
+| `get_simulation_run_item` | Get a full item including transcript and results |
+
+The catalog contains 29 tools. Simulation lists default to 50 results.
+`get_simulation_run` returns the first 100 item summaries, with API pagination
+metadata in `itemsMetadata` and `itemsTruncated: true` when more items exist.
+Legacy array responses are also supported. Use `get_simulation_run_item` for
+the full details of a known item.
+
 ---
 
 ## Development
@@ -247,6 +308,91 @@ export VAPI_TOKEN=your_test_org_token_here
 npm run test:live:mutating
 ```
 
+### Input validation from OpenAPI
+
+All 21 parameterized MCP tools use imported OpenAPI constraints through
+Zod's experimental `z.fromJSONSchema()`, pinned to Zod 4.6.7. This covers
+assistant names/LLMs/voices/transcribers, call schedules and customer numbers,
+lookup/update IDs, function parameters, transfer destinations, HTTP methods,
+timeouts and retry plans, plus all 12 simulation tools. The four original list
+tools have local empty input schemas.
+
+`src/schemas/assistant-openapi.json` is the compact projection for the original
+tool surfaces (the filename is retained from the initial assistant cutover). It
+records the [public API spec](https://api.vapi.ai/api-json) source SHA-256 and
+includes the recursive JSON-schema definitions needed for function parameters
+and request bodies. Builds and installs use it without network access. Refresh
+explicitly with `npm run schemas:snapshot`, or pass a saved spec with
+`npm run schemas:snapshot -- /path/spec.json`.
+
+`src/schemas/simulation-openapi.json` bundles the full simulation DTOs and their
+referenced definitions from the same public spec. The same refresh command
+updates both snapshots. Simulation validation includes names, folder paths,
+UUIDs, instructions, evaluations, nested tester assistants and structured
+outputs. Scenario/suite `additionalFields` are validated after merging, so they
+cannot override an API constraint. Large nested assistant and structured-output
+objects have compact advertised envelopes; their full API contracts are checked
+at runtime. The shared summary projection omits long documentation and recursive
+definitions from simulation discovery. The 25-tool catalog is about 28 KB.
+No runtime schema fetch or
+`get_api_schema` tool is required.
+
+Simulation aliases remain local adapters: `run_simulations` takes exactly one
+assistant/squad target and at least one simulation/suite ID, then builds the API
+request. Integer iterations and integer page sizes of 1–100 are MCP policies;
+API iteration bounds and parameter formats come from the snapshot. The item
+lookup endpoint publishes plain strings for its IDs, so those are not assigned
+UUID constraints from a different endpoint.
+
+The shared normalizer also represents empty preset enums as always-failing
+branches and preserves property names such as `oneOf` and `default` when walking
+JSON Schema definitions.
+
+When upgrading `@vapi-ai/server-sdk`, refresh and review the bundled schema in
+the same PR, then run `npm run typecheck`, `npm test`, and `npm run test:package`.
+Check changes against the SDK's request types and the MCP adapters below. The
+public endpoint serves the current API spec, not a spec version tied to the SDK
+release, so refreshing does not by itself guarantee compatibility. Keep the
+reviewed schema bundled with the release; do not refresh it during installation
+or startup.
+
+The adapter documents published contract corrections: overlapping enum/string
+`oneOf` alternatives become `anyOf`; duplicate enum values and JavaScript regex
+delimiters are removed; the contradictory object/string-enum annotation on
+`BackoffPlan.type` is corrected. Provider variants reject undeclared fields.
+Spec defaults do not inject request fields; MCP defaults remain separate.
+For the original compact assistant tools, variants requiring fields outside
+the current interface remain excluded: custom
+voice, Neuphonic voice, custom transcriber, Speechmatics transcriber, and custom
+LLM. Adding their required fields needs an explicit interface extension.
+
+MCP wrappers preserve field aliases and sparse updates. URL checks and
+string-valued header maps remain explicit transport rules because the spec only
+describes a string/object. API-request header maps and SMS metadata retain legacy MCP representations;
+they are explicit compatibility adapters, not claimed to be full API DTO
+validation. SMS metadata is not described in the published DTO. Response summaries also remain
+local: they are transformed MCP representations, not raw API DTOs.
+
+Validation failures return `isError: true`, concise text and structured
+`validationError` details: tool name, issue code, field path, message and allowed
+choices where relevant. Errors select the supplied provider's union branch,
+include at most 12 issues and 8 allowed choices per issue, and indicate
+truncation. Submitted values and credential contents are not echoed. Agents
+should correct the listed fields and retry; a validation failure never invokes
+the API handler. Tests exercise this correction loop through a real MCP client.
+
+`tools/list` advertises a compact input summary derived from the same validators:
+field names, basic types, required fields, defaults, and short constraints. It
+omits provider/model catalogs, lengthy API documentation, and recursive schema
+definitions. The full OpenAPI-derived validator still runs before any API call;
+the advertised summary is intentionally broader. Catalog tests cap the
+original 13-tool list at 20 KB, the 12 simulation tools at 10 KB, and the complete
+25-tool list at 30 KB to prevent unexpected agent-context growth.
+
+`npm test` includes schema contract tests, independent Ajv parity cases, and
+validation-feedback tests. The existing live compatibility
+suites cover read-only resources and disposable assistants/custom tools.
+
 ---
 
 ## References

package/dist/knowledge/docs.d.ts

@@ -0,0 +1,96 @@
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+export declare const DOCS_MCP_URL = "https://docs.vapi.ai/_mcp/server";
+export declare function askVapiDocs(question: string, topK: number, signal?: AbortSignal, transport?: Transport): Promise<{
+    [x: string]: unknown;
+    content: ({
+        type: "text";
+        text: string;
+        annotations?: {
+            audience?: ("user" | "assistant")[] | undefined;
+            priority?: number | undefined;
+            lastModified?: string | undefined;
+        } | undefined;
+        _meta?: Record<string, unknown> | undefined;
+    } | {
+        type: "image";
+        data: string;
+        mimeType: string;
+        annotations?: {
+            audience?: ("user" | "assistant")[] | undefined;
+            priority?: number | undefined;
+            lastModified?: string | undefined;
+        } | undefined;
+        _meta?: Record<string, unknown> | undefined;
+    } | {
+        type: "audio";
+        data: string;
+        mimeType: string;
+        annotations?: {
+            audience?: ("user" | "assistant")[] | undefined;
+            priority?: number | undefined;
+            lastModified?: string | undefined;
+        } | undefined;
+        _meta?: Record<string, unknown> | undefined;
+    } | {
+        type: "resource";
+        resource: {
+            uri: string;
+            text: string;
+            mimeType?: string | undefined;
+            _meta?: Record<string, unknown> | undefined;
+        } | {
+            uri: string;
+            blob: string;
+            mimeType?: string | undefined;
+            _meta?: Record<string, unknown> | undefined;
+        };
+        annotations?: {
+            audience?: ("user" | "assistant")[] | undefined;
+            priority?: number | undefined;
+            lastModified?: string | undefined;
+        } | undefined;
+        _meta?: Record<string, unknown> | undefined;
+    } | {
+        uri: string;
+        name: string;
+        type: "resource_link";
+        description?: string | undefined;
+        mimeType?: string | undefined;
+        size?: number | undefined;
+        annotations?: {
+            audience?: ("user" | "assistant")[] | undefined;
+            priority?: number | undefined;
+            lastModified?: string | undefined;
+        } | undefined;
+        _meta?: {
+            [x: string]: unknown;
+        } | undefined;
+        icons?: {
+            src: string;
+            mimeType?: string | undefined;
+            sizes?: string[] | undefined;
+            theme?: "light" | "dark" | undefined;
+        }[] | undefined;
+        title?: string | undefined;
+    })[];
+    _meta?: {
+        [x: string]: unknown;
+        progressToken?: string | number | undefined;
+        "io.modelcontextprotocol/related-task"?: {
+            taskId: string;
+        } | undefined;
+    } | undefined;
+    structuredContent?: Record<string, unknown> | undefined;
+    isError?: boolean | undefined;
+} | {
+    [x: string]: unknown;
+    toolResult: unknown;
+    _meta?: {
+        [x: string]: unknown;
+        progressToken?: string | number | undefined;
+        "io.modelcontextprotocol/related-task"?: {
+            taskId: string;
+        } | undefined;
+    } | undefined;
+}>;
+//# sourceMappingURL=docs.d.ts.map

package/dist/knowledge/docs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/knowledge/docs.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAE/E,eAAO,MAAM,YAAY,qCAAqC,CAAC;AAI/D,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,WAAW,EACpB,SAAS,GAAE,SAAoE;;;;;mBAW44f,CAAC;oBAA4B,CAAC;oBAAgE,CAAC;wBAAkD,CAAC;;aAAkE,CAAC;;;;;mBAA+J,CAAC;oBAA4B,CAAC;oBAAgE,CAAC;wBAAkD,CAAC;;aAAkE,CAAC;;;;;mBAA+J,CAAC;oBAA4B,CAAC;oBAAgE,CAAC;wBAAkD,CAAC;;aAAkE,CAAC;;;;;;oBAA8L,CAAC;iBAA2C,CAAC;;;;oBAA4I,CAAC;iBAA2C,CAAC;;mBAA6E,CAAC;oBAA4B,CAAC;oBAAgE,CAAC;wBAAkD,CAAC;;aAAkE,CAAC;;;;;mBAAkK,CAAC;gBAA0C,CAAC;YAAsC,CAAC;mBAA6C,CAAC;oBAA4B,CAAC;oBAAgE,CAAC;wBAAkD,CAAC;;aAAkE,CAAC;;;aAAsF,CAAC;;oBAAyD,CAAC;iBAA2C,CAAC;iBAA6C,CAAC;;aAA8E,CAAC;;;;qBAAiH,CAAC;8CAAiF,CAAC;;;;;;;;;;;qBAAgV,CAAC;8CAAiF,CAAC;;;;GADv/lB"}

package/dist/knowledge/docs.js

@@ -0,0 +1,16 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+export const DOCS_MCP_URL = 'https://docs.vapi.ai/_mcp/server';
+// A separate connection per request avoids sharing a failed session or leaking
+// concurrent calls across each other. No Vapi credentials are sent upstream.
+export async function askVapiDocs(question, topK, signal, transport = new StreamableHTTPClientTransport(new URL(DOCS_MCP_URL))) {
+    const client = new Client({ name: 'vapi-mcp-docs', version: '1.0.0' });
+    const options = { signal: AbortSignal.any([AbortSignal.timeout(30_000), ...(signal ? [signal] : [])]), timeout: 30_000 };
+    try {
+        await client.connect(transport, options);
+        return await client.callTool({ name: 'searchDocs', arguments: { query: question, topK } }, undefined, options);
+    }
+    finally {
+        await client.close().catch(() => undefined);
+    }
+}

package/dist/knowledge/skills.d.ts

@@ -0,0 +1,28 @@
+export declare class PublicSkills {
+    private readonly fetcher;
+    private cached?;
+    constructor(fetcher?: typeof fetch);
+    private read;
+    private snapshot;
+    private content;
+    private skill;
+    search(query: string, limit: number): Promise<{
+        repository: string;
+        revision: string;
+        total: number;
+        skills: {
+            name: string;
+            description: string;
+            sourceUrl: string;
+        }[];
+    }>;
+    load(name: string, path: string): Promise<{
+        name: string;
+        path: string;
+        revision: string;
+        sourceUrl: string;
+        content: string;
+        files: string[];
+    }>;
+}
+//# sourceMappingURL=skills.d.ts.map

package/dist/knowledge/skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/knowledge/skills.ts"],"names":[],"mappings":"AAwBA,qBAAa,YAAY;IAGX,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,OAAO,CAAC,MAAM,CAAC,CAAoD;gBAEtC,OAAO,GAAE,OAAO,KAAa;YAE5C,IAAI;IA6BlB,OAAO,CAAC,QAAQ;IAiBhB,OAAO,CAAC,OAAO;YAWD,KAAK;IAQb,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;IAyBnC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;;;;;;;;CAatC"}

package/dist/knowledge/skills.js

@@ -0,0 +1,131 @@
+import { parse } from 'yaml';
+import { z } from 'zod';
+const REPOSITORY = 'https://github.com/VapiAI/skills';
+const API = 'https://api.github.com/repos/VapiAI/skills';
+const RAW = 'https://raw.githubusercontent.com/VapiAI/skills';
+const CACHE_MS = 5 * 60_000;
+const TEXT_FILE = /\.(md|txt|json|ya?ml|py|[cm]?js|ts|sh|rst|toml)$/i;
+const commitSchema = z.object({ sha: z.string().regex(/^[a-f0-9]{40}$/) });
+const treeSchema = z.object({
+    truncated: z.literal(false),
+    tree: z.array(z.object({ path: z.string(), type: z.string(), mode: z.string() })),
+});
+// Each MCP server has its own bounded-lifetime snapshot. Rejected fetches are
+// evicted so an upstream outage doesn't poison later calls.
+export class PublicSkills {
+    fetcher;
+    cached;
+    constructor(fetcher = fetch) {
+        this.fetcher = fetcher;
+    }
+    async read(url, maxBytes = 512_000) {
+        const response = await this.fetcher(url, {
+            signal: AbortSignal.timeout(15_000),
+            redirect: 'error',
+            headers: { Accept: 'application/vnd.github+json', 'User-Agent': 'vapi-mcp-server' },
+        });
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new Error(`Public skills request failed (HTTP ${response.status}). Retry later.`);
+        }
+        if (!response.body)
+            throw new Error('Public skills returned an empty response.');
+        const reader = response.body.getReader();
+        const chunks = [];
+        let size = 0;
+        try {
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                size += value.byteLength;
+                if (size > maxBytes)
+                    throw new Error('Public skills response exceeds the supported size.');
+                chunks.push(value);
+            }
+        }
+        finally {
+            await reader.cancel().catch(() => undefined);
+            reader.releaseLock();
+        }
+        return Buffer.concat(chunks).toString('utf8');
+    }
+    snapshot() {
+        if (this.cached && this.cached.expiresAt > Date.now())
+            return this.cached.promise;
+        const promise = (async () => {
+            // Pin file reads to one commit so SKILL.md and its references agree even
+            // when the public repository changes between requests.
+            const { sha } = commitSchema.parse(JSON.parse(await this.read(`${API}/commits/main`)));
+            const tree = treeSchema.parse(JSON.parse(await this.read(`${API}/git/trees/${sha}?recursive=1`, 2_000_000)));
+            const files = new Set(tree.tree.filter(entry => entry.type === 'blob' && ['100644', '100755'].includes(entry.mode)).map(entry => entry.path));
+            const names = [...files].filter(path => /^[a-z0-9]+(?:-[a-z0-9]+)*\/SKILL\.md$/.test(path)).map(path => path.split('/')[0]).sort();
+            if (!names.length)
+                throw new Error('No public Vapi skills were found. Retry later.');
+            return { revision: sha, files, names, contents: new Map() };
+        })();
+        this.cached = { expiresAt: Date.now() + CACHE_MS, promise };
+        void promise.catch(() => { if (this.cached?.promise === promise)
+            this.cached = undefined; });
+        return promise;
+    }
+    content(snapshot, path) {
+        const cached = snapshot.contents.get(path);
+        if (cached)
+            return cached;
+        const encodedPath = path.split('/').map(encodeURIComponent).join('/');
+        const promise = this.read(`${RAW}/${snapshot.revision}/${encodedPath}`);
+        if (snapshot.contents.size >= 100)
+            snapshot.contents.delete(snapshot.contents.keys().next().value);
+        snapshot.contents.set(path, promise);
+        void promise.catch(() => snapshot.contents.delete(path));
+        return promise;
+    }
+    async skill(snapshot, name) {
+        const content = await this.content(snapshot, `${name}/SKILL.md`);
+        const frontmatter = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(content);
+        if (!frontmatter)
+            throw new Error(`Invalid frontmatter for public skill ${name}.`);
+        const metadata = z.object({ name: z.literal(name), description: z.string().min(1) }).parse(parse(frontmatter[1]));
+        return { name, description: metadata.description, content };
+    }
+    async search(query, limit) {
+        const snapshot = await this.snapshot();
+        const skills = [];
+        // Limit concurrent public requests when warming a new snapshot.
+        for (let index = 0; index < snapshot.names.length; index += 4) {
+            skills.push(...await Promise.all(snapshot.names.slice(index, index + 4).map(name => this.skill(snapshot, name))));
+        }
+        const terms = [...new Set(query.toLowerCase().match(/[\p{L}\p{N}]+/gu) ?? [])];
+        const matches = skills.map(skill => ({
+            skill,
+            score: terms.reduce((score, term) => score +
+                (skill.name.includes(term) ? 5 : 0) +
+                (skill.description.toLowerCase().includes(term) ? 3 : 0) +
+                (skill.content.toLowerCase().includes(term) ? 1 : 0), 0),
+        })).filter(({ score }) => !terms.length || score > 0)
+            .sort((a, b) => b.score - a.score || a.skill.name.localeCompare(b.skill.name));
+        return {
+            repository: REPOSITORY, revision: snapshot.revision, total: matches.length,
+            skills: matches.slice(0, limit).map(({ skill }) => ({
+                name: skill.name, description: skill.description,
+                sourceUrl: `${REPOSITORY}/blob/${snapshot.revision}/${skill.name}/SKILL.md`,
+            })),
+        };
+    }
+    async load(name, path) {
+        const snapshot = await this.snapshot();
+        if (!snapshot.names.includes(name))
+            throw new Error(`Unknown public skill. Use search_skills to find a skill name.`);
+        const files = [...snapshot.files].filter(file => file.startsWith(`${name}/`) && TEXT_FILE.test(file)).map(file => file.slice(name.length + 1)).sort();
+        // Exact tree membership, not URL/path normalization, bounds reads to this
+        // skill and excludes traversal, URLs, symlinks and binary assets.
+        if (!files.includes(path))
+            throw new Error('Unknown skill file. Load SKILL.md to see the available files.');
+        return {
+            name, path, revision: snapshot.revision,
+            sourceUrl: `${REPOSITORY}/blob/${snapshot.revision}/${name}/${path}`,
+            content: await this.content(snapshot, `${name}/${path}`), files,
+        };
+    }
+}

package/dist/schemas/assistant-openapi.d.ts

@@ -0,0 +1,31 @@
+import { z } from 'zod';
+type JsonSchema = z.core.JSONSchema.JSONSchema;
+export declare const requiredToolConfigurations: string[];
+export declare const functionRequiresName: boolean;
+export declare function inputContract(value: unknown, schemaMap?: boolean): unknown;
+export declare function providerContract(field: 'voice' | 'transcriber' | 'llm'): JsonSchema;
+export declare const providersRequiringExpandedInputs: {
+    [k: string]: string[];
+};
+type VoiceConfiguration = {
+    provider: string;
+    voiceId: string;
+    model?: string;
+};
+type TranscriberConfiguration = {
+    provider: string;
+    model?: string;
+};
+export declare const VoiceInputSchema: z.ZodType<VoiceConfiguration>;
+export declare const TranscriberInputSchema: z.ZodType<TranscriberConfiguration>;
+export declare const CreateAssistantNameSchema: z.ZodType<string>;
+export declare const UpdateAssistantNameSchema: z.ZodType<string>;
+export declare const LLMInputSchema: z.ZodType<{
+    provider: string;
+    model?: string;
+}>;
+export declare function fieldContract(name: string): JsonSchema;
+export declare function apiField<T = unknown>(name: string, overrides?: Partial<JsonSchema>): z.ZodType<T>;
+export declare function apiObjectField<T = Record<string, unknown>>(name: string): z.ZodType<T>;
+export {};
+//# sourceMappingURL=assistant-openapi.d.ts.map

package/dist/schemas/assistant-openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assistant-openapi.d.ts","sourceRoot":"","sources":["../../src/schemas/assistant-openapi.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,KAAK,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;AAkB/C,eAAO,MAAM,0BAA0B,UAAsC,CAAC;AAC9E,eAAO,MAAM,oBAAoB,SAAgC,CAAC;AAKlE,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,UAAQ,GAAG,OAAO,CAiCxE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,GAAG,KAAK,GAAG,UAAU,CAanF;AAID,eAAO,MAAM,gCAAgC;;CAI5C,CAAC;AAEF,KAAK,kBAAkB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAChF,KAAK,wBAAwB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAIrE,eAAO,MAAM,gBAAgB,EAAoF,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAC/I,eAAO,MAAM,sBAAsB,EAA0F,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;AACjK,eAAO,MAAM,yBAAyB,EAA+E,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AACvI,eAAO,MAAM,yBAAyB,EAA+E,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAEvI,eAAO,MAAM,cAAc,EAAkF,CAAC,CAAC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE7J,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAKtD;AAED,wBAAgB,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,OAAO,CAAC,UAAU,CAAM,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAErG;AAED,wBAAgB,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAKtF"}

package/dist/schemas/assistant-openapi.js

@@ -0,0 +1,87 @@
+import { readFileSync } from 'node:fs';
+import { z } from 'zod';
+const snapshot = JSON.parse(readFileSync(new URL('./assistant-openapi.json', import.meta.url), 'utf8'));
+export const requiredToolConfigurations = snapshot.requiredToolConfigurations;
+export const functionRequiresName = snapshot.functionRequiresName;
+// The published spec uses overlapping oneOf [enum, string] branches for preset
+// IDs and model names. The API accepts both. Change only this recognizable
+// pattern, leaving discriminated/exclusive unions intact.
+export function inputContract(value, schemaMap = false) {
+    if (Array.isArray(value))
+        return value.map(item => inputContract(item));
+    if (!value || typeof value !== 'object')
+        return value;
+    const schema = value;
+    // Property names such as oneOf/default are user-defined keys in schema maps,
+    // rather than JSON Schema keywords. Preserve them and normalize their values.
+    if (schemaMap)
+        return Object.fromEntries(Object.entries(schema).map(([key, nested]) => [key, inputContract(nested)]));
+    // An empty published preset enum denotes no preset values. Represent that
+    // branch as an always-failing schema so it remains valid JSON Schema.
+    if (Array.isArray(schema.enum) && schema.enum.length === 0)
+        return { not: {} };
+    const alternatives = Array.isArray(schema.oneOf) ? schema.oneOf : undefined;
+    const overlap = alternatives?.some(branch => branch.type === 'string' &&
+        Object.keys(branch).every(key => ['type', 'title', 'description'].includes(key))) &&
+        alternatives.some(branch => branch.type === 'string' && Array.isArray(branch.enum));
+    return Object.fromEntries(Object.entries(schema)
+        // OpenAPI defaults are annotations; preserve omitted input fields and let
+        // the API apply its defaults rather than materializing them in requests.
+        .filter(([key]) => key !== 'default')
+        .map(([key, nested]) => [
+        key === 'oneOf' && overlap ? 'anyOf' : key,
+        // Some published voice IDs repeat in enum arrays. Deduplication changes
+        // no accepted values and keeps the result valid JSON Schema for Ajv.
+        key === 'enum' && Array.isArray(nested) ? [...new Set(nested)]
+            // Published name patterns include JavaScript /.../ delimiters, while
+            // JSON Schema pattern expects the regex source without delimiters.
+            : key === 'pattern' && typeof nested === 'string' && nested.startsWith('/') && nested.endsWith('/') ? nested.slice(1, -1)
+                // BackoffPlan.type is published as object with a string enum. Keep the
+                // enum's actual value type; the incompatible type annotation is a spec defect.
+                : key === 'type' && nested === 'object' && Array.isArray(schema.enum) && schema.enum.every(v => typeof v === 'string') ? 'string'
+                    : ['properties', 'definitions', '$defs', 'patternProperties', 'dependentSchemas'].includes(key) ? inputContract(nested, true)
+                        : ['allOf', 'anyOf', 'oneOf', 'not', 'items', 'additionalProperties', 'contains', 'if', 'then', 'else'].includes(key) ? inputContract(nested)
+                            : nested,
+    ]));
+}
+export function providerContract(field) {
+    const supported = snapshot[field].filter(definition => definition.required.every(key => key in definition.properties));
+    return {
+        oneOf: supported.map(definition => ({
+            type: 'object',
+            required: definition.required,
+            properties: inputContract(definition.properties, true),
+            // API DTOs reject undeclared provider fields. In particular, a provider
+            // without a model property must reject model, not silently accept it.
+            additionalProperties: false,
+        })),
+    };
+}
+// Providers requiring fields outside the existing compact MCP surface stay
+// unsupported, rather than having those API-required fields silently dropped.
+export const providersRequiringExpandedInputs = Object.fromEntries(['voice', 'transcriber', 'llm'].map(field => [field, snapshot[field]
+        .filter(definition => definition.required.some(key => !(key in definition.properties)))
+        .map(definition => definition.name)]));
+// fromJSONSchema validates at runtime but intentionally returns an untyped
+// ZodType. These types describe the projected fields, not a second validator.
+export const VoiceInputSchema = z.fromJSONSchema(providerContract('voice'), { defaultTarget: 'openapi-3.0' });
+export const TranscriberInputSchema = z.fromJSONSchema(providerContract('transcriber'), { defaultTarget: 'openapi-3.0' });
+export const CreateAssistantNameSchema = z.fromJSONSchema(snapshot.name.create, { defaultTarget: 'openapi-3.0' });
+export const UpdateAssistantNameSchema = z.fromJSONSchema(snapshot.name.update, { defaultTarget: 'openapi-3.0' });
+export const LLMInputSchema = z.fromJSONSchema(providerContract('llm'), { defaultTarget: 'openapi-3.0' });
+export function fieldContract(name) {
+    const field = snapshot.fields[name];
+    if (!field)
+        throw new Error(`Unknown API input field: ${name}`);
+    return JSON.parse(JSON.stringify(inputContract({ ...field, definitions: snapshot.definitions }), (key, value) => key === '$ref' && typeof value === 'string' ? value.replace('#/components/schemas/', '#/definitions/') : value));
+}
+export function apiField(name, overrides = {}) {
+    return z.fromJSONSchema({ ...fieldContract(name), ...overrides }, { defaultTarget: 'openapi-3.0' });
+}
+export function apiObjectField(name) {
+    const schema = apiField(name);
+    if (!(schema instanceof z.ZodObject))
+        throw new Error(`${name} is no longer an object schema`);
+    // Preserve the existing MCP policy of stripping unknown envelope fields.
+    return schema.strip();
+}