@intentic/sandbox-contract 1.307.0 → 1.308.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentic/sandbox-contract",
-  "version": "1.307.0",
+  "version": "1.308.2",
   "description": "oRPC wire contract for the intentic sandbox daemon, shared by the daemon and its browser client",
   "license": "MIT",
   "type": "module",
@@ -218,10 +218,10 @@
     }
   },
   "dependencies": {
-    "@intentic/base": "1.307.0",
-    "@intentic/constants": "1.307.0",
-    "@intentic/extension-manifest": "1.307.0",
-    "@intentic/registry": "1.307.0",
+    "@intentic/base": "1.308.2",
+    "@intentic/constants": "1.308.2",
+    "@intentic/extension-manifest": "1.308.2",
+    "@intentic/registry": "1.308.2",
     "@orpc/contract": "1.14.13",
     "tslib": "2.8.1",
     "zod": "4.5.4"

package/src/contracts/accounts.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { NativeProviderParamSchema } from "../schemas/agent.js";
 import {
     AccountIdSchema,
@@ -18,7 +18,7 @@ import { OkSchema } from "../schemas/shared.js";
 // slice per provider. Distinct from the translator routes (subscriptions proxied through CLIProxyAPI): these
 // credentials live in this daemon's own auth tree, and no credential ever rides in an answer.
 export const accountsContract = {
-    start: oc
+    start: procedure
         .route({
             method: "POST",
             path: "/accounts/{provider}/login/start",
@@ -28,7 +28,7 @@ export const accountsContract = {
         })
         .input(NativeProviderParamSchema.extend(LoginRequestSchema.shape))
         .output(LoginStartSchema),
-    complete: oc
+    complete: procedure
         .route({
             method: "POST",
             path: "/accounts/{provider}/login/complete",
@@ -38,7 +38,7 @@ export const accountsContract = {
         })
         .input(NativeProviderParamSchema.extend(LoginCompleteSchema.shape))
         .output(LoginCompletedSchema),
-    cancel: oc
+    cancel: procedure
         .route({
             method: "POST",
             path: "/accounts/{provider}/login/cancel",
@@ -48,7 +48,7 @@ export const accountsContract = {
         .input(NativeProviderParamSchema.extend(LoginCancelSchema.shape))
         .output(OkSchema),
     // `force` re-measures before answering; a provider with nothing to measure accepts it and answers at once.
-    accounts: oc
+    accounts: procedure
         .route({
             method: "GET",
             path: "/accounts/{provider}",
@@ -58,7 +58,7 @@ export const accountsContract = {
         })
         .input(NativeProviderParamSchema.extend(AccountListQuerySchema.shape))
         .output(OauthAccountListSchema),
-    rename: oc
+    rename: procedure
         .route({
             method: "POST",
             path: "/accounts/{provider}/rename",
@@ -67,7 +67,7 @@ export const accountsContract = {
         })
         .input(NativeProviderParamSchema.extend(AccountRenameSchema.shape))
         .output(OauthAccountSchema),
-    disconnect: oc
+    disconnect: procedure
         .route({
             method: "POST",
             path: "/accounts/{provider}/disconnect",

package/src/contracts/activity.contract.ts

@@ -1,10 +1,10 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { ActivityListSchema, ActivityQuerySchema, ActivityStatusSchema } from "../schemas/activity.js";
 
 // The activity audit feed (provider-agnostic; Discord is the first source). Read-only by design,
 // events are appended daemon-side only, so the log stays a trustworthy record of what the agent did.
 export const activityContract = {
-    list: oc
+    list: procedure
         .route({
             method: "GET",
             path: "/activity",
@@ -14,7 +14,7 @@ export const activityContract = {
         })
         .input(ActivityQuerySchema)
         .output(ActivityListSchema),
-    status: oc
+    status: procedure
         .route({
             method: "GET",
             path: "/activity/status",

package/src/contracts/agent.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { streamOf } from "../protocol/routes.js";
 import { AgentCommandsQuerySchema, AgentCommandsSchema } from "../events/requests.js";
 import { AttachFrameSchema } from "../events/agent-events.js";
@@ -12,7 +12,7 @@ import { OkSchema } from "../schemas/shared.js";
 // (replay then live, no special stream for the initiator), `reply` un-parks it, `steer` injects a message, `stop`
 // hard-cancels it.
 export const agentContract = {
-    run: oc
+    run: procedure
         .route({
             method: "POST",
             path: "/agent",
@@ -20,9 +20,11 @@ export const agentContract = {
             description:
                 "Starts a turn and answers immediately with its id; the work runs inside the sandbox whether or not anybody stays connected. Watch it by attaching. Naming a conversation that does not exist yet opens it.",
         })
+        // Driving agents is the collaborator grant; what leaves the sandbox stays at the maintainer default.
+        .meta({ floor: "collaborator", guest: true, control: "editor" })
         .input(AgentTurnSchema)
         .output(StartedTurnSchema),
-    attach: oc
+    attach: procedure
         .route({
             method: "POST",
             path: "/agent/attach",
@@ -30,9 +32,11 @@ export const agentContract = {
             description:
                 "Streams everything the agent does: its words, the tools it reaches for, and the answers it gets. Give it the point you have already seen and it replays from there before going live, so a reload loses nothing. The window that started the turn holds no special claim, and any number of watchers on any number of devices see the same thing.",
         })
+        // Watching a live turn is reading, POST or not, so the read rung reaches it too.
+        .meta({ floor: "viewer", guest: true, stream: true, control: "read" })
         .input(AttachTurnSchema)
         .output(streamOf(AttachFrameSchema)),
-    reply: oc
+    reply: procedure
         .route({
             method: "POST",
             path: "/agent/reply",
@@ -40,9 +44,10 @@ export const agentContract = {
             description:
                 "Un-parks a turn that is waiting on you: approving a plan, choosing between options, or permitting a tool. The turn picks up where it stopped.",
         })
+        .meta({ floor: "collaborator", guest: true, control: "editor" })
         .input(AgentReplySchema)
         .output(OkSchema),
-    steer: oc
+    steer: procedure
         .route({
             method: "POST",
             path: "/agent/steer",
@@ -50,19 +55,21 @@ export const agentContract = {
             description:
                 "Slips a message into a turn already under way, without stopping it. This is how you redirect an agent mid-thought rather than waiting for it to finish being wrong.",
         })
+        .meta({ floor: "collaborator", guest: true })
         .input(SteerSchema)
         .output(OkSchema),
-    stop: oc
+    stop: procedure
         .route({
             method: "POST",
             path: "/agent/stop",
             summary: "Stop a turn now",
             description: "Cancels the running turn inside the sandbox. Whatever it had already written to disk stays written.",
         })
+        .meta({ floor: "collaborator", guest: true })
         .input(StopTurnSchema)
         .output(OkSchema),
     // NOT_FOUND when nothing is held (superseded, or the daemon restarted): the client should fall back to `run`.
-    resume: oc
+    resume: procedure
         .route({
             method: "POST",
             path: "/agent/resume",
@@ -70,10 +77,12 @@ export const agentContract = {
             description:
                 "Sends the same turn again when the model provider's allowance refused it, with everything it originally carried except who serves it: the caller may name a different provider, harness or account, which is the usual answer to a spent allowance. It repeats the request rather than adding a new message to the conversation, so pressing it twice costs nothing and the agent is never told to continue work it has not started.",
         })
+        // The same turn again with all it carried; refused, a collaborator's automation sticks at its first refusal.
+        .meta({ floor: "collaborator", guest: true })
         .input(ResumeTurnSchema)
         .output(StartedTurnSchema),
     // CONFLICT while a turn is running; NOT_FOUND when the message has no checkpoint.
-    rewind: oc
+    rewind: procedure
         .route({
             method: "POST",
             path: "/agent/rewind",
@@ -81,9 +90,10 @@ export const agentContract = {
             description:
                 "Puts the files back as they stood at that point, drops every message after it, and forgets what the model remembered, so the next thing you say starts from there cleanly. Refused while a turn is running, because a restore cannot overwrite files an agent is editing, and refused for a message with no saved state to return to.",
         })
+        .meta({ floor: "collaborator", guest: true })
         .input(RewindTurnSchema)
         .output(RewindResultSchema),
-    commands: oc
+    commands: procedure
         .route({
             method: "GET",
             path: "/agent/commands",
@@ -91,11 +101,12 @@ export const agentContract = {
             description:
                 "The commands a provider published the last time one of its turns ran, so a composer can offer them before this conversation has run anything. A running turn's own list wins over this one.",
         })
+        .meta({ guest: true })
         .input(AgentCommandsQuerySchema)
         .output(AgentCommandsSchema),
     // Never throws: no offer, no personas, no model, or a deadline are all "nothing chosen" with a reason; the composer
     // is waiting.
-    routeChat: oc
+    routeChat: procedure
         .route({
             method: "POST",
             path: "/agent/route-chat",
@@ -103,9 +114,11 @@ export const agentContract = {
             description:
                 "Reads a new chat's opening message once and answers whichever of two questions it still has: the model, effort and account that conversation should run on, from what is connected and still has allowance left, and which of this sandbox's personas should handle it. `model` and `persona` on the ask say which halves to answer, and only those are put to the model. Asked once per chat, on the message actually sent, and never again: every turn after it runs on what the chat is wearing, which you are free to change. Answers with nothing, and a reason, whenever it cannot choose — a chat is never held up by this.",
         })
+        // A read shaped as a POST, costing one model call the tier about to spend a whole turn may spend.
+        .meta({ floor: "collaborator" })
         .input(ChatRouteAskSchema)
         .output(ChatRouteSchema),
-    refusals: oc
+    refusals: procedure
         .route({
             method: "GET",
             path: "/agent/refusals",
@@ -113,5 +126,6 @@ export const agentContract = {
             description:
                 "What each model provider most recently refused and why. Read this alongside an account's usage: the usage says how full it was when last checked, this says whether it has since started turning work away.",
         })
+        .meta({ guest: true })
         .output(ProviderRefusalsSchema),
 };

package/src/contracts/agents.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { AgentToolChildrenSchema, AgentTranscriptSchema } from "../events/transcript.js";
 import {
     AgentArchiveSchema,
@@ -33,7 +33,7 @@ import { ConversationPromptSchema } from "../schemas/system-prompt.js";
 // `archive` is the non-destructive counterpart to `discard` (worktree committed, entry kept); `purge` is `discard`
 // applied to every already-archived agent.
 export const agentsContract = {
-    list: oc
+    list: procedure
         .route({
             method: "GET",
             path: "/agents",
@@ -41,8 +41,9 @@ export const agentsContract = {
             description:
                 "The fleet as the board draws it: each conversation with its title, what it is doing, when it last moved and whether anybody has read it since. Archived conversations are not in here.",
         })
+        .meta({ guest: true })
         .output(AgentsListSchema),
-    archived: oc
+    archived: procedure
         .route({
             method: "GET",
             path: "/agents/archived",
@@ -50,9 +51,10 @@ export const agentsContract = {
             description:
                 "The same shape as the live fleet, for the conversations somebody has decided are finished. Their work is kept, and any one of them can be brought back.",
         })
+        .meta({ guest: true })
         .output(AgentsListSchema),
     // Never-carded conversations (neither live nor archived) are `sessions.list`'s query, matching by the same rule.
-    search: oc
+    search: procedure
         .route({
             method: "GET",
             path: "/agents/search",
@@ -62,16 +64,17 @@ export const agentsContract = {
         })
         .input(AgentSearchQuerySchema)
         .output(AgentSearchResultSchema),
-    get: oc
+    get: procedure
         .route({
             method: "GET",
             path: "/agents/{id}",
             summary: "One conversation's card",
             description: "Everything the board shows for a single conversation: its title, state, working branch, unread marker and timestamps.",
         })
+        .meta({ guest: true })
         .input(AgentIdSchema)
         .output(AgentSummarySchema),
-    transcript: oc
+    transcript: procedure
         .route({
             method: "GET",
             path: "/agents/{id}/transcript",
@@ -79,9 +82,10 @@ export const agentsContract = {
             description:
                 "The most recent turns of one conversation, in order, including the tool calls and their results: what the chat replays and the next turn is seeded from. A page, not the whole record — pass the answer's `from` back as `before` to walk further back, until `more` reads false.",
         })
+        .meta({ guest: true })
         .input(AgentTranscriptQuerySchema)
         .output(AgentTranscriptSchema),
-    systemPrompt: oc
+    systemPrompt: procedure
         .route({
             method: "GET",
             path: "/agents/{id}/system-prompt",
@@ -91,7 +95,7 @@ export const agentsContract = {
         })
         .input(AgentIdSchema)
         .output(ConversationPromptSchema),
-    toolChildren: oc
+    toolChildren: procedure
         .route({
             method: "GET",
             path: "/agents/{id}/transcript/tools/{toolId}",
@@ -103,7 +107,7 @@ export const agentsContract = {
         .output(AgentToolChildrenSchema),
     // Also forgets the provider session, rewind-style, so the next fresh session reads the placed line as the agent's
     // own.
-    place: oc
+    place: procedure
         .route({
             method: "POST",
             path: "/agents/{id}/place",
@@ -113,7 +117,7 @@ export const agentsContract = {
         })
         .input(AgentPlaceSchema)
         .output(OkSchema),
-    rename: oc
+    rename: procedure
         .route({
             method: "POST",
             path: "/agents/{id}/rename",
@@ -121,9 +125,10 @@ export const agentsContract = {
             description:
                 "Sets the title a person chose, replacing the one that was generated. Allowed while the conversation is working, and it does not count as activity.",
         })
+        .meta({ floor: "collaborator", guest: true })
         .input(AgentRenameSchema)
         .output(AgentSummarySchema),
-    autoLand: oc
+    autoLand: procedure
         .route({
             method: "POST",
             path: "/agents/{id}/auto-land",
@@ -135,7 +140,7 @@ export const agentsContract = {
         .output(AgentSummarySchema),
     // Legal for a workspace conversation too (unlike autoLand): an outage kills a main-tree chat just as readily.
     // Also offered on the card, not just in chat: a limit reopens hours later, so the decider is usually at a board.
-    breakPolicy: oc
+    breakPolicy: procedure
         .route({
             method: "POST",
             path: "/agents/{id}/break-policy",
@@ -143,9 +148,10 @@ export const agentsContract = {
             description:
                 "One answer per ending — a spent usage limit, a provider outage, a turn that stopped short — overriding the sandbox-wide policy for one conversation; clear it to follow the default again. The answers are mutually exclusive by construction, so nothing here can arm two automations over the same wall. Every ending starts at `wait` unless asked otherwise, because a re-run spends the user's own allowance on a turn they sent once.",
         })
+        .meta({ floor: "collaborator" })
         .input(AgentBreakPolicySchema)
         .output(AgentSummarySchema),
-    seen: oc
+    seen: procedure
         .route({
             method: "POST",
             path: "/agents/{id}/seen",
@@ -153,10 +159,11 @@ export const agentsContract = {
             description:
                 "Stamps the read marker behind the unread badge on one card. Allowed while the conversation is working, and reading never counts as activity.",
         })
+        .meta({ floor: "collaborator", guest: true })
         .input(AgentIdSchema)
         .output(AgentSummarySchema),
     // A finer-grained ask (watch this, not that) goes through the chat, not a per-watch id here.
-    stopWatching: oc
+    stopWatching: procedure
         .route({
             method: "POST",
             path: "/agents/{id}/stop-watching",
@@ -166,15 +173,16 @@ export const agentsContract = {
         })
         .input(AgentStopWatchingSchema)
         .output(AgentSummarySchema),
-    seenAll: oc
+    seenAll: procedure
         .route({
             method: "POST",
             path: "/agents/seen",
             summary: "Mark every conversation read",
             description: "Clears the unread badge across the whole fleet at once, and hands the refreshed list back.",
         })
+        .meta({ floor: "collaborator", guest: true })
         .output(AgentsListSchema),
-    diff: oc
+    diff: procedure
         .route({
             method: "GET",
             path: "/agents/{id}/diff",
@@ -186,7 +194,7 @@ export const agentsContract = {
         .output(AgentChangesSchema),
     // Costs a `git log` per repo: ask only once `diff` reports something absorbed. Reading a file here reuses
     // `fileDiff`.
-    history: oc
+    history: procedure
         .route({
             method: "GET",
             path: "/agents/{id}/history",
@@ -196,7 +204,7 @@ export const agentsContract = {
         })
         .input(AgentIdSchema)
         .output(AgentHistorySchema),
-    fileDiff: oc
+    fileDiff: procedure
         .route({
             method: "GET",
             path: "/agents/{id}/{repo}/file-diff",
@@ -207,7 +215,7 @@ export const agentsContract = {
         .output(FileDiffSchema),
     // Stages rather than commits: the next capture commits it like the rest of the work, with nothing to unwind if the
     // conversation's next turn moves it.
-    includeScratch: oc
+    includeScratch: procedure
         .route({
             method: "POST",
             path: "/agents/{id}/scratch/include",
@@ -217,7 +225,7 @@ export const agentsContract = {
         })
         .input(AgentScratchSchema)
         .output(OkSchema),
-    deleteScratch: oc
+    deleteScratch: procedure
         .route({
             method: "POST",
             path: "/agents/{id}/scratch/delete",
@@ -227,7 +235,7 @@ export const agentsContract = {
         })
         .input(AgentScratchSchema)
         .output(OkSchema),
-    land: oc
+    land: procedure
         .route({
             method: "POST",
             path: "/agents/{id}/land",
@@ -235,10 +243,12 @@ export const agentsContract = {
             description:
                 "Brings the conversation's branches into the main tree, one repo at a time. A conflict is reported rather than raised and nothing is lost when it fails. Refused while a turn is running, and refused for a conversation that works directly in the shared tree, which has nothing to merge.",
         })
+        // The irreversible press a program may hold, kept to its own rung apart from the work.
+        .meta({ control: "land" })
         .input(AgentLandSchema)
         .output(LandResultSchema),
     // Stamps `AgentSummarySchema.landRequested` with the caller's identity.
-    requestLand: oc
+    requestLand: procedure
         .route({
             method: "POST",
             path: "/agents/{id}/request-land",
@@ -246,11 +256,13 @@ export const agentsContract = {
             description:
                 "For a collaborator who is not allowed to merge: marks the conversation as waiting for review, with who asked. The request shows on every maintainer's board and clears when somebody merges or discards it.",
         })
+        // A collaborator's landings are only requests.
+        .meta({ floor: "collaborator" })
         .input(AgentIdSchema)
         .output(AgentSummarySchema),
     // Sets `AgentSummarySchema.owner`. Who may: the current owner (handing over), a maintainer or the sandbox owner
     // (taking over), and anyone at the driving tier when nobody owns it yet (claiming).
-    assign: oc
+    assign: procedure
         .route({
             method: "POST",
             path: "/agents/{id}/assign",
@@ -258,11 +270,12 @@ export const agentsContract = {
             description:
                 "Hands a conversation to a member: its owner is who answers its questions and who a reviewer asks about its work. Its owner may hand it to anyone; a maintainer may reassign any conversation; one nobody owns may be claimed by anyone allowed to drive agents. Refused for an address that is not a member's. Nothing about the conversation's own work changes.",
         })
+        // Changing hands is driving, not shipping; the route itself decides whose hands may do it.
+        .meta({ floor: "collaborator" })
         .input(AgentAssignSchema)
         .output(AgentSummarySchema),
-    // Floored at viewer (auth/role-floor.ts), unlike every other write here: marking a conversation is expression, not
-    // operating authority.
-    react: oc
+    // Floored at viewer, unlike every other write here: marking a conversation is expression, not operating authority.
+    react: procedure
         .route({
             method: "POST",
             path: "/agents/{id}/react",
@@ -270,9 +283,10 @@ export const agentsContract = {
             description:
                 "Puts your mark on a conversation, or takes it back. Everyone sharing the sandbox sees it, with who left it, which is what makes it worth more than a private bookmark. One mark per person per emoji; nothing about the conversation's own work changes.",
         })
+        .meta({ floor: "viewer", guest: true })
         .input(AgentReactSchema)
         .output(AgentSummarySchema),
-    discard: oc
+    discard: procedure
         .route({
             method: "POST",
             path: "/agents/{id}/discard",
@@ -280,9 +294,10 @@ export const agentsContract = {
             description:
                 "Deletes the conversation's working copies, its branches and its entry. Nothing is kept. Refused while a turn is running, and refused for a conversation working in the shared tree.",
         })
+        .meta({ control: "land" })
         .input(AgentIdSchema)
         .output(OkSchema),
-    archive: oc
+    archive: procedure
         .route({
             method: "POST",
             path: "/agents/archive",
@@ -290,9 +305,10 @@ export const agentsContract = {
             description:
                 "The gentle counterpart to discarding. Commits whatever the conversation still has in progress onto its own branch, releases its working copy, and keeps the entry and the record. Its scratch is not committed and goes with the copy. It leaves the live fleet and joins the archive. Refused for a conversation that is running.",
         })
+        .meta({ floor: "collaborator", guest: true })
         .input(AgentArchiveSchema)
         .output(AgentsArchivedSchema),
-    unarchive: oc
+    unarchive: procedure
         .route({
             method: "POST",
             path: "/agents/unarchive",
@@ -300,9 +316,10 @@ export const agentsContract = {
             description:
                 "Returns archived conversations to the live fleet. The next turn picks up a fresh working copy from the branch that was kept.",
         })
+        .meta({ floor: "collaborator", guest: true })
         .input(AgentIdsSchema)
         .output(AgentsMovedSchema),
-    purge: oc
+    purge: procedure
         .route({
             method: "POST",
             path: "/agents/purge",
@@ -310,5 +327,6 @@ export const agentsContract = {
             description:
                 "Discards every conversation already in the archive: working copies, branches and entries. The whole archive rather than a chosen few, because the archive is the pile somebody has already decided is over. A teardown that fails on one conversation leaves that one behind instead of taking the rest down with it.",
         })
+        .meta({ control: "land" })
         .output(AgentsRemovedSchema),
 };

package/src/contracts/approvals.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { ApprovalIdParamSchema, ApprovalsListSchema, ApprovalSummarySchema } from "../schemas/approvals.js";
 import { OkSchema } from "../schemas/shared.js";
 
@@ -7,7 +7,7 @@ import { OkSchema } from "../schemas/shared.js";
 // edit / reschedule / retry (all a plain re-post with a field changed, like the automations enabled toggle),
 // `remove` is reject. The verbs are the same whatever the kind, which is the point of one queue.
 export const approvalsContract = {
-    list: oc
+    list: procedure
         .route({
             method: "GET",
             path: "/approvals",
@@ -16,7 +16,7 @@ export const approvalsContract = {
                 "Everything an agent has prepared and would like to do: posts to publish, actions to carry out. Nothing here has happened yet.",
         })
         .output(ApprovalsListSchema),
-    upsert: oc
+    upsert: procedure
         .route({
             method: "POST",
             path: "/approvals",
@@ -25,7 +25,7 @@ export const approvalsContract = {
         })
         .input(ApprovalSummarySchema)
         .output(OkSchema),
-    remove: oc
+    remove: procedure
         .route({
             method: "DELETE",
             path: "/approvals/{id}",

package/src/contracts/areas.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { OkSchema } from "../schemas/shared.js";
 import { AreaIdParamSchema, AreaSchema, AreasListSchema } from "../schemas/areas.js";
 
@@ -7,7 +7,7 @@ import { AreaIdParamSchema, AreaSchema, AreasListSchema } from "../schemas/areas
 // which is the one decision a revokable grant must not make, so the two writes below are owner-gated in-route the way
 // the roster is.
 export const areasContract = {
-    list: oc
+    list: procedure
         .route({
             method: "GET",
             path: "/areas",
@@ -15,9 +15,10 @@ export const areasContract = {
             description:
                 "Each area with the folders it admits. Access is granted in these rather than in folder lists per person, so widening what a team sees is one edit here instead of one edit per member.",
         })
+        .meta({ guest: true })
         .output(AreasListSchema),
     // Upsert by id, re-saving the same id edits that area.
-    save: oc
+    save: procedure
         .route({
             method: "POST",
             path: "/areas",
@@ -29,7 +30,7 @@ export const areasContract = {
         .output(OkSchema),
     // Refused while anyone still holds it: a member row pointing at an area that no longer exists would either fail
     // open (everything) or fail shut (nothing), and neither is a decision anybody made.
-    remove: oc
+    remove: procedure
         .route({
             method: "DELETE",
             path: "/areas/{id}",