@intentic/sandbox-contract 1.306.0 → 1.308.0

package/src/contracts/git.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import {
     CommitResultSchema,
     CommitSchema,
@@ -52,7 +52,7 @@ import { OkSchema, RepoParamSchema } from "../schemas/shared.js";
 // root-relative dir, URL-encoded. Unknown {repo} throws NOT_FOUND, an escaping path throws BAD_REQUEST. `changes` is
 // the workspace-wide review set; commit/discard take optional `paths`.
 export const gitContract = {
-    changes: oc
+    changes: procedure
         .route({
             method: "GET",
             path: "/git/changes",
@@ -62,7 +62,7 @@ export const gitContract = {
         })
         .output(GitChangesSchema),
     // Read-only: repo list, commit log, lazy per-commit diff; commit/discard on the tree are a separate write path.
-    repos: oc
+    repos: procedure
         .route({
             method: "GET",
             path: "/git/repos",
@@ -72,7 +72,7 @@ export const gitContract = {
         })
         .output(GitReposSchema),
     // Same repos with the remote's host and `owner/name`; kept off `repos` since it costs a lookup per repo.
-    remoteRepos: oc
+    remoteRepos: procedure
         .route({
             method: "GET",
             path: "/git/remote-repos",
@@ -81,7 +81,7 @@ export const gitContract = {
                 "The same repo list, but with the forge host and `owner/name` each one's remote points at. Use it to recognise a workspace repo in a list of names that came from somewhere else, such as a set of pull requests. Costs a remote lookup per repo, which is why it is separate from the plain repo list.",
         })
         .output(GitRemoteReposSchema),
-    log: oc
+    log: procedure
         .route({
             method: "GET",
             path: "/git/{repo}/log",
@@ -91,7 +91,7 @@ export const gitContract = {
         })
         .input(GitLogQuerySchema)
         .output(GitLogSchema),
-    commitDiff: oc
+    commitDiff: procedure
         .route({
             method: "GET",
             path: "/git/{repo}/commit-diff",
@@ -101,7 +101,7 @@ export const gitContract = {
         })
         .input(GitCommitDiffQuerySchema)
         .output(GitCommitDiffSchema),
-    commitFileDiff: oc
+    commitFileDiff: procedure
         .route({
             method: "GET",
             path: "/git/{repo}/commit-file-diff",
@@ -113,7 +113,7 @@ export const gitContract = {
         .output(FileDiffSchema),
     // Non-destructive writes return Ok; HEAD-moving ops return a GitActionResult, a conflict is a value not 500.
     // `abort` is git's own `--abort`, the only way out of what `operation` reports; daemon verbs self-abort.
-    operation: oc
+    operation: procedure
         .route({
             method: "GET",
             path: "/git/{repo}/operation",
@@ -123,7 +123,7 @@ export const gitContract = {
         })
         .input(RepoParamSchema)
         .output(GitOperationStateSchema),
-    abort: oc
+    abort: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/abort",
@@ -134,7 +134,7 @@ export const gitContract = {
         .input(RepoParamSchema)
         .output(GitActionResultSchema),
     // Moves the branch ref via reflog; requires `previousSha` from the matching read as a concurrency token.
-    undoable: oc
+    undoable: procedure
         .route({
             method: "GET",
             path: "/git/{repo}/undo",
@@ -144,7 +144,7 @@ export const gitContract = {
         })
         .input(RepoParamSchema)
         .output(GitUndoStateSchema),
-    undo: oc
+    undo: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/undo",
@@ -155,7 +155,7 @@ export const gitContract = {
         .input(GitUndoSchema)
         .output(GitActionResultSchema),
     // A stash entry is a commit, read like the log/diff pair; only `drop` is unrecoverable and checkpoints first.
-    stashes: oc
+    stashes: procedure
         .route({
             method: "GET",
             path: "/git/{repo}/stashes",
@@ -165,7 +165,7 @@ export const gitContract = {
         })
         .input(RepoParamSchema)
         .output(StashListSchema),
-    stashDiff: oc
+    stashDiff: procedure
         .route({
             method: "GET",
             path: "/git/{repo}/stash-diff",
@@ -175,7 +175,7 @@ export const gitContract = {
         })
         .input(StashDiffQuerySchema)
         .output(GitCommitDiffSchema),
-    stashPush: oc
+    stashPush: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/stash",
@@ -185,7 +185,7 @@ export const gitContract = {
         })
         .input(StashPushSchema)
         .output(GitActionResultSchema),
-    stashApply: oc
+    stashApply: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/stash/apply",
@@ -195,7 +195,7 @@ export const gitContract = {
         })
         .input(StashApplySchema)
         .output(GitActionResultSchema),
-    stashDrop: oc
+    stashDrop: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/stash/drop",
@@ -205,7 +205,7 @@ export const gitContract = {
         })
         .input(StashRefParamSchema)
         .output(OkSchema),
-    createBranch: oc
+    createBranch: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/branch",
@@ -214,7 +214,7 @@ export const gitContract = {
         })
         .input(GitBranchCreateSchema)
         .output(OkSchema),
-    createTag: oc
+    createTag: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/tag",
@@ -223,7 +223,7 @@ export const gitContract = {
         })
         .input(GitTagCreateSchema)
         .output(OkSchema),
-    deleteTag: oc
+    deleteTag: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/tag/delete",
@@ -232,7 +232,7 @@ export const gitContract = {
         })
         .input(GitTagDeleteSchema)
         .output(OkSchema),
-    pushTag: oc
+    pushTag: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/tag/push",
@@ -242,7 +242,7 @@ export const gitContract = {
         })
         .input(GitTagPushSchema)
         .output(GitActionResultSchema),
-    checkout: oc
+    checkout: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/checkout",
@@ -252,7 +252,7 @@ export const gitContract = {
         })
         .input(GitCheckoutSchema)
         .output(GitActionResultSchema),
-    cherryPick: oc
+    cherryPick: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/cherry-pick",
@@ -262,7 +262,7 @@ export const gitContract = {
         })
         .input(GitCommitActionSchema)
         .output(GitActionResultSchema),
-    revert: oc
+    revert: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/revert",
@@ -272,7 +272,7 @@ export const gitContract = {
         })
         .input(GitCommitActionSchema)
         .output(GitActionResultSchema),
-    drop: oc
+    drop: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/drop",
@@ -282,7 +282,7 @@ export const gitContract = {
         })
         .input(GitCommitActionSchema)
         .output(GitActionResultSchema),
-    merge: oc
+    merge: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/merge",
@@ -292,7 +292,7 @@ export const gitContract = {
         })
         .input(GitCommitActionSchema)
         .output(GitActionResultSchema),
-    rebase: oc
+    rebase: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/rebase",
@@ -302,7 +302,7 @@ export const gitContract = {
         })
         .input(GitCommitActionSchema)
         .output(GitActionResultSchema),
-    reset: oc
+    reset: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/reset",
@@ -312,7 +312,7 @@ export const gitContract = {
         })
         .input(GitResetSchema)
         .output(GitActionResultSchema),
-    fileDiff: oc
+    fileDiff: procedure
         .route({
             method: "GET",
             path: "/git/{repo}/file-diff",
@@ -322,7 +322,7 @@ export const gitContract = {
         })
         .input(GitFileDiffQuerySchema)
         .output(FileDiffSchema),
-    status: oc
+    status: procedure
         .route({
             method: "GET",
             path: "/git/{repo}/status",
@@ -332,7 +332,7 @@ export const gitContract = {
         })
         .input(RepoParamSchema)
         .output(GitStatusSchema),
-    commit: oc
+    commit: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/commit",
@@ -342,7 +342,7 @@ export const gitContract = {
         })
         .input(CommitSchema)
         .output(CommitResultSchema),
-    discard: oc
+    discard: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/discard",
@@ -353,7 +353,7 @@ export const gitContract = {
         .input(DiscardSchema)
         .output(OkSchema),
     // Take a scope, not a path list, so it covers files the caller never enumerated; the worktree is untouched.
-    stage: oc
+    stage: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/stage",
@@ -363,7 +363,7 @@ export const gitContract = {
         })
         .input(GitIndexMoveSchema)
         .output(OkSchema),
-    unstage: oc
+    unstage: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/unstage",
@@ -374,7 +374,7 @@ export const gitContract = {
         .input(GitIndexMoveSchema)
         .output(OkSchema),
     // `branches` includes per-branch ahead/behind, so the switcher renders sync state without a call per branch.
-    branches: oc
+    branches: procedure
         .route({
             method: "GET",
             path: "/git/{repo}/branches",
@@ -384,7 +384,7 @@ export const gitContract = {
         })
         .input(RepoParamSchema)
         .output(GitBranchesSchema),
-    createBranchAt: oc
+    createBranchAt: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/branches",
@@ -394,7 +394,7 @@ export const gitContract = {
         })
         .input(GitBranchCreateAtSchema)
         .output(OkSchema),
-    deleteBranch: oc
+    deleteBranch: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/branches/delete",
@@ -405,7 +405,7 @@ export const gitContract = {
         .input(GitBranchDeleteSchema)
         .output(OkSchema),
     // Reflects the last fetch, not a live check; writes below report a GitActionResult, not a throw, on failure.
-    remote: oc
+    remote: procedure
         .route({
             method: "GET",
             path: "/git/{repo}/remote",
@@ -415,7 +415,7 @@ export const gitContract = {
         })
         .input(RepoParamSchema)
         .output(GitRemoteStateSchema),
-    fetch: oc
+    fetch: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/fetch",
@@ -425,7 +425,7 @@ export const gitContract = {
         })
         .input(RepoParamSchema)
         .output(GitActionResultSchema),
-    pull: oc
+    pull: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/pull",
@@ -436,7 +436,7 @@ export const gitContract = {
         .input(RepoParamSchema)
         .output(GitActionResultSchema),
     // Starts the push and returns at once; poll `pushState` for the verdict, since it runs the pre-push hook.
-    push: oc
+    push: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/push",
@@ -446,7 +446,7 @@ export const gitContract = {
         })
         .input(PushSchema)
         .output(OkSchema),
-    pushState: oc
+    pushState: procedure
         .route({
             method: "GET",
             path: "/git/{repo}/push",
@@ -456,7 +456,7 @@ export const gitContract = {
         })
         .input(RepoParamSchema)
         .output(PushRunSchema),
-    pushCancel: oc
+    pushCancel: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/push/cancel",
@@ -465,7 +465,7 @@ export const gitContract = {
         })
         .input(RepoParamSchema)
         .output(OkSchema),
-    files: oc
+    files: procedure
         .route({
             method: "GET",
             path: "/git/{repo}/files",
@@ -475,7 +475,7 @@ export const gitContract = {
         })
         .input(RepoParamSchema)
         .output(GitFilesSchema),
-    readFile: oc
+    readFile: procedure
         .route({
             method: "GET",
             path: "/git/{repo}/file",
@@ -484,7 +484,7 @@ export const gitContract = {
         })
         .input(GitFileQuerySchema)
         .output(GitFileSchema),
-    writeFile: oc
+    writeFile: procedure
         .route({
             method: "PUT",
             path: "/git/{repo}/file",
@@ -495,7 +495,7 @@ export const gitContract = {
         .input(GitFileWriteSchema)
         .output(OkSchema),
     // Writes, commits only this path, and pushes in one call; no remote, no credentials, wrong branch are reported.
-    publishFile: oc
+    publishFile: procedure
         .route({
             method: "POST",
             path: "/git/{repo}/publish-file",

package/src/contracts/history.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { FileDiffSchema, SnapshotDiffSchema, SnapshotFileDiffQuerySchema, SnapshotIdSchema, SnapshotsListSchema } from "../schemas/history.js";
 import { OkSchema } from "../schemas/shared.js";
 
@@ -6,7 +6,7 @@ import { OkSchema } from "../schemas/shared.js";
 // the previous visible checkpoint (everything that happened since it, hidden interval captures included); an
 // unknown id is a handler-thrown NOT_FOUND.
 export const historyContract = {
-    list: oc
+    list: procedure
         .route({
             method: "GET",
             path: "/history/snapshots",
@@ -15,7 +15,7 @@ export const historyContract = {
                 "The saved states of the whole workspace, taken automatically as work happens. This is the timeline behind undoing a change that was never committed.",
         })
         .output(SnapshotsListSchema),
-    diff: oc
+    diff: procedure
         .route({
             method: "GET",
             path: "/history/diff",
@@ -24,7 +24,7 @@ export const historyContract = {
         })
         .input(SnapshotIdSchema)
         .output(SnapshotDiffSchema),
-    fileDiff: oc
+    fileDiff: procedure
         .route({
             method: "GET",
             path: "/history/file-diff",
@@ -33,7 +33,7 @@ export const historyContract = {
         })
         .input(SnapshotFileDiffQuerySchema)
         .output(FileDiffSchema),
-    restore: oc
+    restore: procedure
         .route({
             method: "POST",
             path: "/history/restore",

package/src/contracts/intentic.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { streamOf } from "../protocol/routes.js";
 import { IntenticLineSchema } from "../events/system-events.js";
 import { IntenticRunSchema } from "../schemas/intentic.js";
@@ -7,7 +7,7 @@ import { OkSchema } from "../schemas/shared.js";
 // Run the in-sandbox intentic CLI (resolve/plan/apply/deployments/…) and stream its ndjson lines as they
 // arrive, so the UI sees live progress. A non-zero exit surfaces as a thrown error once the stream ends.
 export const intenticContract = {
-    run: oc
+    run: procedure
         .route({
             method: "POST",
             path: "/intentic",
@@ -19,7 +19,7 @@ export const intenticContract = {
         .output(streamOf(IntenticLineSchema)),
     // Launch the minutes-long apply → adopt reconcile as a one-shot tmux job (session panel-infra-apply) and
     // return immediately, progress is followed by attaching the terminal, not by holding this request open.
-    apply: oc
+    apply: procedure
         .route({
             method: "POST",
             path: "/intentic/apply",
@@ -32,7 +32,7 @@ export const intenticContract = {
     // renders as text, persisted to a durable file so the UI shows per-resource progress that survives a page
     // refresh. Replays from the run's {kind:"start"} then follows live, closing on {kind:"exit"}. GET, like
     // /events, because it takes no input; reuses the loose IntenticLine shape so no new schema is needed.
-    applyEvents: oc
+    applyEvents: procedure
         .route({
             method: "GET",
             path: "/intentic/apply/events",
@@ -40,5 +40,6 @@ export const intenticContract = {
             description:
                 "The same progress the terminal shows, as structured events, kept on disk so a page refresh does not lose it. It replays from the start of the run and then follows live, closing when the run ends.",
         })
+        .meta({ stream: true })
         .output(streamOf(IntenticLineSchema)),
 };

package/src/contracts/inventory.contract.ts

@@ -1,11 +1,11 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { AddInventoryInputSchema, InventoryListSchema, InventoryNameParamSchema } from "../schemas/inventory.js";
 
 // The i.have.* / i.want.service entries in deploy.config.ts's managed region. add/remove rewrite the region and
 // commit it (mirroring an agent edit) and return the full updated list so the UI re-renders from one response.
 // Deploy-target hosts self-register out-of-band via the daemon's plain /enroll route (connect-host script).
 export const inventoryContract = {
-    list: oc
+    list: procedure
         .route({
             method: "GET",
             path: "/inventory",
@@ -13,7 +13,7 @@ export const inventoryContract = {
             description: "What the deployment configuration says this setup owns and what it wants provisioned.",
         })
         .output(InventoryListSchema),
-    add: oc
+    add: procedure
         .route({
             method: "POST",
             path: "/inventory",
@@ -23,7 +23,7 @@ export const inventoryContract = {
         })
         .input(AddInventoryInputSchema)
         .output(InventoryListSchema),
-    remove: oc
+    remove: procedure
         .route({
             method: "DELETE",
             path: "/inventory/{name}",

package/src/contracts/issues.contract.ts

@@ -1,10 +1,10 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { IssueIdParamSchema, IssueInstallsSchema, IssueIntakeIdParamSchema, IssuesListSchema, IssueStatusInputSchema } from "../schemas/issues.js";
 import { OkSchema } from "../schemas/shared.js";
 
 /* The issues inbox: bug reports that arrived from the owner's own sites and apps, grouped by fingerprint. */
 export const issuesContract = {
-    list: oc
+    list: procedure
         .route({
             method: "GET",
             path: "/issues",
@@ -12,7 +12,7 @@ export const issuesContract = {
             description: "Everything that has crashed or been written in, grouped so a crash that hit a thousand people is one row with a count.",
         })
         .output(IssuesListSchema),
-    status: oc
+    status: procedure
         .route({
             method: "POST",
             path: "/issues/{id}/status",
@@ -21,7 +21,7 @@ export const issuesContract = {
         })
         .input(IssueStatusInputSchema)
         .output(OkSchema),
-    investigate: oc
+    investigate: procedure
         .route({
             method: "POST",
             path: "/issues/{id}/investigate",
@@ -31,7 +31,7 @@ export const issuesContract = {
         })
         .input(IssueIdParamSchema)
         .output(OkSchema),
-    remove: oc
+    remove: procedure
         .route({
             method: "DELETE",
             path: "/issues/{id}",
@@ -40,7 +40,7 @@ export const issuesContract = {
         })
         .input(IssueIdParamSchema)
         .output(OkSchema),
-    installs: oc
+    installs: procedure
         .route({
             method: "GET",
             path: "/issues/installs/{automationId}",

package/src/contracts/logs.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import {
     ClientDiagnosticsAcceptedSchema,
     ClientDiagnosticsReportSchema,
@@ -7,10 +7,13 @@ import {
     LogsListSchema,
 } from "../schemas/logs.js";
 
+// Daemon logs are the operator's diagnostic, not a stakeholder's feed, and no token's.
+const logRoute = procedure.meta({ floor: "maintainer", control: "never" });
+
 // Daemon-owned debug logs (historyRoot/logs): terminal captures, CLI run logs, daemon.log; read-only, since only the
 // daemon/tmux write them. `report` is the one write, since the browser is the only witness to its own crashes.
 export const logsContract = {
-    list: oc
+    list: logRoute
         .route({
             method: "GET",
             path: "/logs",
@@ -19,7 +22,7 @@ export const logsContract = {
                 "Every log file the daemon owns: captured terminal output, command runs, and the daemon's own log. Read-only, because only the sandbox writes them.",
         })
         .output(LogsListSchema),
-    read: oc
+    read: logRoute
         .route({
             method: "GET",
             path: "/logs/file",
@@ -29,7 +32,8 @@ export const logsContract = {
         .input(LogReadQuerySchema)
         .output(LogReadSchema),
     // The one write route; lands in its own file, never daemon.log, floored at viewer role for a crashed page.
-    report: oc
+    report: procedure
+        .meta({ floor: "viewer", control: "never" })
         .route({
             method: "POST",
             path: "/logs/client",

package/src/contracts/loops.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import {
     LoopDesignIdParamSchema,
     LoopDesignSaveSchema,
@@ -16,7 +16,7 @@ import { OkSchema } from "../schemas/shared.js";
 // with the design's fields. `start` acks at once and runs detached; the record comes back, not the outcome.
 export const loopsContract = {
     // Kept after the loop ends: the iteration history is the answer to why it stopped when it did.
-    list: oc
+    list: procedure
         .route({
             method: "GET",
             path: "/loops",
@@ -26,7 +26,7 @@ export const loopsContract = {
         })
         .output(LoopsListSchema),
     // Rejects an already-looping conversation; a fresh conversation id opens it, like a first turn.
-    start: oc
+    start: procedure
         .route({
             method: "POST",
             path: "/loops",
@@ -37,7 +37,7 @@ export const loopsContract = {
         .input(LoopSchema)
         .output(LoopRecordSchema),
     // Stops future rounds only; the round in flight keeps going. Use /agent/stop to kill it too.
-    stop: oc
+    stop: procedure
         .route({
             method: "POST",
             path: "/loops/{conversationId}/stop",
@@ -49,7 +49,7 @@ export const loopsContract = {
         .output(OkSchema),
 
     // A saved loop is the same loop with its goal left blank, not a separate feature.
-    designs: oc
+    designs: procedure
         .route({
             method: "GET",
             path: "/loops/designs",
@@ -59,7 +59,7 @@ export const loopsContract = {
         })
         .output(LoopDesignsListSchema),
     // Names create vs replace explicitly, rather than upserting; refuses a design with nothing to produce or check.
-    saveDesign: oc
+    saveDesign: procedure
         .route({
             method: "POST",
             path: "/loops/designs",
@@ -70,7 +70,7 @@ export const loopsContract = {
         .input(LoopDesignSaveSchema)
         .output(LoopDesignSchema),
     // Deleting a design does not stop a loop running from it; it already copied the fields it needed.
-    removeDesign: oc
+    removeDesign: procedure
         .route({
             method: "DELETE",
             path: "/loops/designs/{id}",