@intentic/sandbox-contract 1.307.0 → 1.308.2

package/src/contracts/netdisk.contract.ts

@@ -1,15 +1,18 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { streamOf } from "../protocol/routes.js";
 import { IntenticLineSchema } from "../events/system-events.js";
 import { NetdiskIdParamSchema, NetdiskListSchema } from "../schemas/netdisk.js";
 import { OkSchema } from "../schemas/shared.js";
 
+// The agent's `netdisk` CLI mounts and unmounts these on the agent token.
+const netdiskRoute = procedure.meta({ agent: true });
+
 // A network disk is added as a `netdisk` capability; mounting and unmounting it happen through the routes here, called
 // by both the operator UI and the agent's `netdisk` CLI.
 // Every route reads mount state from the kernel, not daemon memory, so a disk unmounted from a shell and one unmounted
 // from a screen are the same event across a restart.
 export const netdiskContract = {
-    list: oc
+    list: netdiskRoute
         .route({
             method: "GET",
             path: "/netdisk",
@@ -20,7 +23,7 @@ export const netdiskContract = {
         .output(NetdiskListSchema),
     // Streamed: a mount can take seconds against a slow server and can fail with something a person has to read (a
     // refused password, an unreachable server behind a tunnel that is down).
-    mount: oc
+    mount: netdiskRoute
         .route({
             method: "POST",
             path: "/netdisk/{id}/mount",
@@ -30,7 +33,7 @@ export const netdiskContract = {
         })
         .input(NetdiskIdParamSchema)
         .output(streamOf(IntenticLineSchema)),
-    unmount: oc
+    unmount: netdiskRoute
         .route({
             method: "POST",
             path: "/netdisk/{id}/unmount",

package/src/contracts/panels.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { PanelRepoParamSchema, PanelsListSchema } from "../schemas/panels.js";
 import { OkSchema } from "../schemas/shared.js";
 
@@ -7,7 +7,7 @@ import { OkSchema } from "../schemas/shared.js";
 // on the global GET /system/terminals (the web app's one terminal panel); the interactive I/O is the
 // /system/terminal WebSocket.
 export const panelsContract = {
-    list: oc
+    list: procedure
         .route({
             method: "GET",
             path: "/panels",
@@ -15,7 +15,7 @@ export const panelsContract = {
             description: "Every repo with whether its dev server is up and what the sandbox worked out about its contents.",
         })
         .output(PanelsListSchema),
-    start: oc
+    start: procedure
         .route({
             method: "POST",
             path: "/panels/{repo}/start",
@@ -24,7 +24,7 @@ export const panelsContract = {
         })
         .input(PanelRepoParamSchema)
         .output(OkSchema),
-    stop: oc
+    stop: procedure
         .route({
             method: "POST",
             path: "/panels/{repo}/stop",

package/src/contracts/personas.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import {
     PersonaIdParamSchema,
     PersonaKitSchema,
@@ -15,7 +15,7 @@ import { OkSchema } from "../schemas/shared.js";
 // nothing, only a decision about existing accounts. The kit routes below edit its files (prompt, skills only its turns
 // reach) per verb, not one whole-kit PUT, so one skill's edit cannot delete another.
 export const personasContract = {
-    list: oc
+    list: procedure
         .route({
             method: "GET",
             path: "/personas",
@@ -23,9 +23,10 @@ export const personasContract = {
             description:
                 "Each persona with the connected accounts it speaks for, what a conversation wearing it is allowed to do, and where it works.",
         })
+        .meta({ guest: true })
         .output(PersonasListSchema),
     // Upsert by id, re-saving the same id edits that card.
-    save: oc
+    save: procedure
         .route({
             method: "POST",
             path: "/personas",
@@ -37,7 +38,7 @@ export const personasContract = {
         .output(OkSchema),
     // Never removes the account; an automation pinned to this id resolves as no accounts, and goes quiet.
     // Also deletes the persona's kit folder (prompt + skills), rather than leaving it orphaned on disk.
-    remove: oc
+    remove: procedure
         .route({
             method: "DELETE",
             path: "/personas/{id}",
@@ -52,7 +53,7 @@ export const personasContract = {
 
     // The kit: what this card is told, and the skills only it reaches.
 
-    kit: oc
+    kit: procedure
         .route({
             method: "GET",
             path: "/personas/{id}/kit",
@@ -63,7 +64,7 @@ export const personasContract = {
         .input(PersonaIdParamSchema)
         .output(PersonaKitSchema),
     // An empty prompt deletes the file rather than storing a blank; it then falls back to the sandbox's own prompt.
-    savePrompt: oc
+    savePrompt: procedure
         .route({
             method: "POST",
             path: "/personas/{id}/prompt",
@@ -73,7 +74,7 @@ export const personasContract = {
         })
         .input(PersonaPromptSchema)
         .output(OkSchema),
-    readSkill: oc
+    readSkill: procedure
         .route({
             method: "GET",
             path: "/personas/{id}/skills/read",
@@ -83,7 +84,7 @@ export const personasContract = {
         .input(PersonaSkillNameSchema)
         .output(PersonaSkillBodySchema),
     // Upsert by name, no enabled list to write: a kit skill is on exactly when its persona is worn.
-    saveSkill: oc
+    saveSkill: procedure
         .route({
             method: "POST",
             path: "/personas/{id}/skills",
@@ -93,7 +94,7 @@ export const personasContract = {
         })
         .input(PersonaSkillSchema)
         .output(OkSchema),
-    removeSkill: oc
+    removeSkill: procedure
         .route({
             method: "POST",
             path: "/personas/{id}/skills/remove",

package/src/contracts/ports.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { PortForwardResultSchema, PortParamSchema, PortsListSchema } from "../schemas/ports.js";
 import { OkSchema } from "../schemas/shared.js";
 
@@ -6,15 +6,17 @@ import { OkSchema } from "../schemas/shared.js";
 // schemas/ports.ts). `forward` is idempotent, re-forwarding a port returns its existing slot's URL; `unforward`
 // frees the slot immediately (the hostname keeps resolving, the proxy just stops mapping it).
 export const portsContract = {
-    list: oc
+    list: procedure
         .route({
             method: "GET",
             path: "/ports",
             summary: "What is listening inside the sandbox",
             description: "Every port something is answering on, and whether each one is reachable from outside.",
         })
+        // The desktop-sync watcher's poll, and the machine's check-in.
+        .meta({ sync: "poll" })
         .output(PortsListSchema),
-    forward: oc
+    forward: procedure
         .route({
             method: "POST",
             path: "/ports/forward",
@@ -24,7 +26,7 @@ export const portsContract = {
         })
         .input(PortParamSchema)
         .output(PortForwardResultSchema),
-    unforward: oc
+    unforward: procedure
         .route({
             method: "POST",
             path: "/ports/unforward",

package/src/contracts/prepush.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { z } from "zod";
 import { CommandRunSchema } from "../schemas/ci.js";
 import { OkSchema } from "../schemas/shared.js";
@@ -28,7 +28,7 @@ export const PrepushRunSchema = z
 // tmux window, so watching it is the terminal's job. `cancel` kills that window; the run settles as `cancelled`
 // and the push it was gating does not go.
 export const prepushContract = {
-    state: oc
+    state: procedure
         .route({
             method: "GET",
             path: "/prepush/state",
@@ -37,7 +37,7 @@ export const prepushContract = {
                 "The verdict, or the progress so far. Nothing is addressed by id here, because there is one working tree and so exactly one check.",
         })
         .output(CommandRunSchema),
-    run: oc
+    run: procedure
         .route({
             method: "POST",
             path: "/prepush/run",
@@ -47,7 +47,7 @@ export const prepushContract = {
         })
         .input(PrepushRunSchema)
         .output(OkSchema),
-    cancel: oc
+    cancel: procedure
         .route({
             method: "POST",
             path: "/prepush/cancel",

package/src/contracts/providers.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { z } from "zod";
 import { NativeProviderParamSchema } from "../schemas/agent.js";
 import { ModelsSchema } from "../schemas/providers/provider-oauth.js";
@@ -33,7 +33,7 @@ export type RunnableProviders = z.infer<typeof RunnableProvidersSchema>;
 // their own route (endpoints.contract.ts): they are user-created and unbounded, and a missing one is NOT_FOUND, not an
 // empty catalog.
 export const providersContract = {
-    list: oc
+    list: procedure
         .route({
             method: "GET",
             path: "/providers",
@@ -41,9 +41,10 @@ export const providersContract = {
             description:
                 "The installed ACP agents and model endpoints, which are the providers this sandbox adds to the fixed native list. A read for anyone who may watch or drive a turn: it names what a message can be addressed to, not what credential stands behind it.",
         })
+        .meta({ guest: true })
         .output(RunnableProvidersSchema),
     // Never empty: live discovery with a persisted/seed floor; order is the provider's own, not re-ranked.
-    models: oc
+    models: procedure
         .route({
             method: "GET",
             path: "/providers/{provider}/models",
@@ -51,6 +52,7 @@ export const providersContract = {
             description:
                 "Every model this provider serves and which one it defaults to. Never empty: it is discovered live with a stored list behind it. The order is the provider's own preference and is not rearranged here.",
         })
+        .meta({ guest: true })
         .input(NativeProviderParamSchema)
         .output(ModelsSchema),
 };

package/src/contracts/public.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { PublicListSchema, PublishResultSchema, PublishSchema, UnpublishSchema } from "../schemas/public.js";
 import { OkSchema } from "../schemas/shared.js";
 
@@ -9,7 +9,7 @@ import { OkSchema } from "../schemas/shared.js";
 // unauthenticated `public-<slot>` hostname, and a second, authenticated way in would just be the workspace file
 // API with extra steps.
 export const publicContract = {
-    list: oc
+    list: procedure
         .route({
             method: "GET",
             path: "/public",
@@ -18,7 +18,7 @@ export const publicContract = {
                 "Everything currently in the outbox and the address it answers on. There is no call to read a published file back: it is served openly to anyone with the link, which is the entire point of having put it there.",
         })
         .output(PublicListSchema),
-    publish: oc
+    publish: procedure
         .route({
             method: "POST",
             path: "/public/publish",
@@ -28,7 +28,7 @@ export const publicContract = {
         })
         .input(PublishSchema)
         .output(PublishResultSchema),
-    unpublish: oc
+    unpublish: procedure
         .route({
             method: "POST",
             path: "/public/unpublish",

package/src/contracts/push.contract.ts

@@ -1,7 +1,10 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { PushChannelIdSchema, PushChannelSchema, PushConfigQuerySchema, PushConfigSchema, PushTestSchema } from "../schemas/push.js";
 import { OkSchema } from "../schemas/shared.js";
 
+// A member's own devices, which no control token reaches.
+const pushRoute = procedure.meta({ control: "never" });
+
 // Push notifications for this sandbox. The daemon owns the VAPID keypair and the channel list (see
 // push/push-store.ts for why the key lives on the history volume), and sends on the three moments where the
 // operator's attention is genuinely wanted: a turn finished, the agent is blocked on an answer, and an
@@ -12,7 +15,7 @@ import { OkSchema } from "../schemas/shared.js";
 // (device permission, service-worker or shell registration, the daemon's key, the push service itself), a
 // button that proves the whole chain end-to-end is worth more than any amount of status rendering.
 export const pushContract = {
-    config: oc
+    config: pushRoute
         .route({
             method: "GET",
             path: "/push/config",
@@ -21,7 +24,7 @@ export const pushContract = {
         })
         .input(PushConfigQuerySchema)
         .output(PushConfigSchema),
-    subscribe: oc
+    subscribe: pushRoute
         .route({
             method: "POST",
             path: "/push/subscribe",
@@ -29,18 +32,21 @@ export const pushContract = {
             description:
                 "Registers one device. The sandbox only interrupts you on the three moments where attention is genuinely wanted: a turn has finished, the agent is stuck on a question, and something is waiting for approval.",
         })
+        // A member's own device notifications.
+        .meta({ floor: "collaborator" })
         .input(PushChannelSchema)
         .output(OkSchema),
-    unsubscribe: oc
+    unsubscribe: pushRoute
         .route({
             method: "POST",
             path: "/push/unsubscribe",
             summary: "Stop notifying a device",
             description: "Removes one registered device. Others keep receiving.",
         })
+        .meta({ floor: "collaborator" })
         .input(PushChannelIdSchema)
         .output(OkSchema),
-    test: oc
+    test: pushRoute
         .route({
             method: "POST",
             path: "/push/test",
@@ -48,5 +54,6 @@ export const pushContract = {
             description:
                 "Proves the whole chain end to end. Worth having, because there are four separate places a notification can be lost that nobody can inspect from the outside: the device's permission, its registration, the sandbox's key, and the delivery service.",
         })
+        .meta({ floor: "collaborator" })
         .output(PushTestSchema),
 };

package/src/contracts/safety.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { SafetyLogEntrySchema, SafetyPolicySchema } from "../policy/safety-policy.js";
 import { OkSchema } from "../schemas/shared.js";
 import { z } from "zod";
@@ -7,7 +7,7 @@ import { z } from "zod";
 // the policy is a document edited at human speed, the log changes on its own mid-turn. The policy travels as text,
 // never parsed, since its reader is a model, not a parser.
 export const safetyContract = {
-    policy: oc
+    policy: procedure
         .route({
             method: "GET",
             path: "/safety/policy",
@@ -16,7 +16,7 @@ export const safetyContract = {
                 "The document that decides when an agent stops to ask you before running something. Prose, not settings: it is read by the model that judges each command. When nobody has written one, this is the text the product ships with, and it describes the behaviour a fresh sandbox already has.",
         })
         .output(SafetyPolicySchema),
-    setPolicy: oc
+    setPolicy: procedure
         .route({
             method: "POST",
             path: "/safety/policy",
@@ -27,7 +27,7 @@ export const safetyContract = {
         .input(z.object({ text: z.string().describe("The policy, as you want it written.") }))
         .output(OkSchema),
     // Verdicts teach the owner which policy line to add next; answers why you weren't asked about something.
-    log: oc
+    log: procedure
         .route({
             method: "GET",
             path: "/safety/log",

package/src/contracts/secrets.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import {
     CredentialGateSchema,
     CredentialGuardSubjectParamSchema,
@@ -13,11 +13,14 @@ import {
 } from "../schemas/secrets.js";
 import { OkSchema } from "../schemas/shared.js";
 
+// Credentials are the operating tier's, reads included: maintainer is the highest revokable grant, and no token's.
+const secretRoute = procedure.meta({ floor: "maintainer", control: "never" });
+
 // User-supplied secrets, in the gitignored desired-state/.env; `apply` reloads them, no restart. `inventory` aggregates
 // every store (never values) and always answers; the rest refuse until desired-state is scaffolded. `reveal` alone
 // returns a value, owner-only, POST so the key avoids the URL.
 export const secretsContract = {
-    set: oc
+    set: secretRoute
         .route({
             method: "POST",
             path: "/secrets",
@@ -27,7 +30,7 @@ export const secretsContract = {
         })
         .input(SecretSetSchema)
         .output(OkSchema),
-    list: oc
+    list: secretRoute
         .route({
             method: "GET",
             path: "/secrets",
@@ -35,7 +38,7 @@ export const secretsContract = {
             description: "Which secrets exist here. Names only, never values.",
         })
         .output(SecretKeysSchema),
-    remove: oc
+    remove: secretRoute
         .route({
             method: "DELETE",
             path: "/secrets/{key}",
@@ -44,7 +47,7 @@ export const secretsContract = {
         })
         .input(SecretKeyParamSchema)
         .output(OkSchema),
-    inventory: oc
+    inventory: secretRoute
         .route({
             method: "GET",
             path: "/secrets/inventory",
@@ -53,7 +56,7 @@ export const secretsContract = {
                 "One view across all the places secrets live here: what exists, where it came from and whether it is working. Never any values. This one always answers, even before there is a store to write to.",
         })
         .output(SecretInventorySchema),
-    reveal: oc
+    reveal: secretRoute
         .route({
             method: "POST",
             path: "/secrets/reveal",
@@ -64,7 +67,7 @@ export const secretsContract = {
         .input(SecretKeyParamSchema)
         .output(SecretRevealSchema),
     // Gate policy lives off the workspace, not in agent-editable `.intentic/config/`, so agents can't hold the key.
-    gates: oc
+    gates: secretRoute
         .route({
             method: "GET",
             path: "/secrets/gates",
@@ -72,8 +75,10 @@ export const secretsContract = {
             description:
                 "What is gated and who may release it. Names and addresses only, never values, and the agent may read it too: knowing a credential needs Bob is what stops it concluding the account is simply not connected.",
         })
+        // The `secrets` CLI's names-only reads and its ask, on the agent token; never a value.
+        .meta({ agent: true })
         .output(CredentialGatesSchema),
-    setGate: oc
+    setGate: secretRoute
         .route({
             method: "PUT",
             path: "/secrets/gates/{subject}",
@@ -83,7 +88,7 @@ export const secretsContract = {
         })
         .input(CredentialGateSchema)
         .output(OkSchema),
-    removeGate: oc
+    removeGate: secretRoute
         .route({
             method: "DELETE",
             path: "/secrets/gates/{subject}",
@@ -92,7 +97,7 @@ export const secretsContract = {
         })
         .input(CredentialGuardSubjectParamSchema)
         .output(OkSchema),
-    request: oc
+    request: secretRoute
         .route({
             method: "POST",
             path: "/secrets/request",
@@ -100,6 +105,7 @@ export const secretsContract = {
             description:
                 "Raises the release card in the live conversation and waits for one of the people named on it. Refused, rather than held, when there is nobody to ask: an unattended turn, no live conversation, or a click with no verified identity behind it.",
         })
+        .meta({ agent: true })
         .input(CredentialRequestSchema)
         .output(CredentialGrantSchema),
 };

package/src/contracts/sessions.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { z } from "zod";
 import { SessionTranscriptSchema } from "../events/transcript.js";
 import { SessionIdParamSchema, SessionsListSchema } from "../schemas/sessions.js";
@@ -12,7 +12,7 @@ import { SessionIdParamSchema, SessionsListSchema } from "../schemas/sessions.js
 // not matter, and the two routes answer one query together (the board lists these rows under its own cards), so
 // a switch either of them ignored would show as one field returning two different match sets.
 export const sessionsContract = {
-    list: oc
+    list: procedure
         .route({
             method: "GET",
             path: "/sessions",
@@ -20,15 +20,18 @@ export const sessionsContract = {
             description:
                 "Summaries for a history menu, filtered when you pass a search. Covers conversations that worked in their own private copies too, so nothing is hidden just because it happened on a branch.",
         })
+        // The editor bridge's slice: the transcripts of the conversation it drives.
+        .meta({ control: "editor" })
         .input(z.object({ query: z.string().optional(), caseSensitive: z.stringbool().optional() }))
         .output(SessionsListSchema),
-    get: oc
+    get: procedure
         .route({
             method: "GET",
             path: "/sessions/{id}",
             summary: "Read one past conversation",
             description: "The full record of a single conversation, restored for display.",
         })
+        .meta({ control: "editor" })
         .input(SessionIdParamSchema)
         .output(SessionTranscriptSchema),
 };

package/src/contracts/settings.contract.ts

@@ -1,5 +1,5 @@
 import { FIELD_NOTES_FILE } from "@intentic/constants";
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import {
     BuiltinPromptSchema,
     BuiltinPromptTextSchema,
@@ -20,15 +20,16 @@ import { DayWindowQuerySchema } from "../schemas/providers/usage.js";
 // overwrites whole. `savings` measures each token-reduction mechanism's worth over the same UTC day window the spend
 // ledger takes. `builtinPrompt` returns a built-in prompt's actual text to show or fork.
 export const settingsContract = {
-    get: oc
+    get: procedure
         .route({
             method: "GET",
             path: "/settings",
             summary: "How this sandbox is configured",
             description: "Every setting that governs how agents behave here, with the defaults filled in for anything nobody has chosen.",
         })
+        .meta({ guest: true })
         .output(SandboxSettingsSchema),
-    set: oc
+    set: procedure
         .route({
             method: "POST",
             path: "/settings",
@@ -37,7 +38,7 @@ export const settingsContract = {
         })
         .input(SandboxSettingsSchema)
         .output(OkSchema),
-    savings: oc
+    savings: procedure
         .route({
             method: "GET",
             path: "/settings/savings",
@@ -47,7 +48,7 @@ export const settingsContract = {
         })
         .input(DayWindowQuerySchema)
         .output(SavingsReportSchema),
-    builtinPrompt: oc
+    builtinPrompt: procedure
         .route({
             method: "GET",
             path: "/settings/system-prompt/{base}",
@@ -58,7 +59,7 @@ export const settingsContract = {
         .input(BuiltinPromptSchema)
         .output(BuiltinPromptTextSchema),
     // Own route, not a settings field: a firing isn't an edit, so it shouldn't cost a settings write.
-    firings: oc
+    firings: procedure
         .route({
             method: "GET",
             path: "/settings/rule-firings",
@@ -69,7 +70,7 @@ export const settingsContract = {
         .output(RuleFiringsSchema),
     // Read off the repositories themselves, not out of the settings file: the declaration is a tracked file in each
     // repository, and only the owner's answer to it lives here.
-    repoChecks: oc
+    repoChecks: procedure
         .route({
             method: "GET",
             path: "/settings/repo-checks",
@@ -79,7 +80,7 @@ export const settingsContract = {
         .output(RepoChecksListSchema),
     // Read off the file and the automation store rather than the settings manifest: nothing here is a choice anyone
     // made, so storing it would only give it a second place to be wrong.
-    fieldNotes: oc
+    fieldNotes: procedure
         .route({
             method: "GET",
             path: "/settings/field-notes",
@@ -91,7 +92,7 @@ export const settingsContract = {
     // browser offers the zone it is in; the daemon takes it only if nobody has chosen one. Folding it into the
     // whole-object `set` would mean the second machine to open the workspace silently moved every schedule to its own
     // clock, and an owner in Warsaw would find their chores on a colleague's Tokyo hours.
-    adoptTimezone: oc
+    adoptTimezone: procedure
         .route({
             method: "POST",
             path: "/settings/timezone",
@@ -101,7 +102,7 @@ export const settingsContract = {
         })
         .input(TimezoneOfferSchema)
         .output(TimezoneStateSchema),
-    adoptRepoChecks: oc
+    adoptRepoChecks: procedure
         .route({
             method: "POST",
             path: "/settings/repo-checks/adopt",

package/src/contracts/share.contract.ts

@@ -1,4 +1,4 @@
-import { oc } from "@orpc/contract";
+import { procedure } from "../protocol/route-meta.js";
 import { ShareCreateSchema, SharedConversationSchema, ShareListSchema, ShareRemoveSchema, ShareUpdateSchema } from "../schemas/share.js";
 import { OkSchema } from "../schemas/shared.js";
 
@@ -6,7 +6,7 @@ import { OkSchema } from "../schemas/shared.js";
 // `public` copies bytes at a workspace path. No route reads a share back, the page itself is the read, on the
 // unauthenticated `public-<slot>` hostname.
 export const shareContract = {
-    list: oc
+    list: procedure
         .route({
             method: "GET",
             path: "/share",
@@ -16,7 +16,7 @@ export const shareContract = {
         })
         .output(ShareListSchema),
     // Answers with the row it just wrote, link included, so the dialog can show the address without re-listing.
-    create: oc
+    create: procedure
         .route({
             method: "POST",
             path: "/share",
@@ -27,7 +27,7 @@ export const shareContract = {
         .input(ShareCreateSchema)
         .output(SharedConversationSchema),
     // Re-render an existing share from the conversation as it stands now. Same id, same link, new snapshot.
-    update: oc
+    update: procedure
         .route({
             method: "POST",
             path: "/share/update",
@@ -36,7 +36,7 @@ export const shareContract = {
         })
         .input(ShareUpdateSchema)
         .output(SharedConversationSchema),
-    remove: oc
+    remove: procedure
         .route({
             method: "POST",
             path: "/share/remove",