@intentic/sandbox-contract 1.337.0 → 1.338.0

package/src/contracts/device.contract.ts

@@ -8,6 +8,22 @@ import { LoopbackCatchEventSchema, LoopbackCatchSchema } from "../schemas/loopba
 import { OkSchema } from "../schemas/shared.js";
 import { ProjectDeliveryResultSchema, ProjectDeliverySchema } from "../schemas/project-delivery.js";
 import { DialLoopbackSchema, StageArtifactResultSchema, StageArtifactSchema } from "../schemas/device-artifacts.js";
+import {
+    KeyringCopiesSchema,
+    KeyringInboxItemSchema,
+    KeyringInboxResultSchema,
+    KeyringReleaseResultSchema,
+    KeyringSharesSchema,
+    KeyringSyncDeliverResultSchema,
+    KeyringSyncDeliverSchema,
+    KeyringSyncOutboxSchema,
+    KeyringSyncPairResultSchema,
+    KeyringSyncPairSchema,
+    KeyringSyncStateSchema,
+    KeyringTypeInputSchema,
+    KeyringTypeResultSchema,
+    SignedKeyringGrantSchema,
+} from "../schemas/keyring.js";
 
 // What a connected device can be asked, over the socket it opened; the machine is the oRPC server, the daemon the
 // client. No `.route()`: the procedure path is the address, not HTTP. Every input is strict (devices.ts says why). `mcp` stays opaque (`z.unknown()`) so a machine
@@ -46,4 +62,18 @@ export const deviceContract = {
     // the connection, or throws (nothing listening there, the switch is off). Advertised with `programs`; the machine
     // allows it when "Run commands" or "Run programs this sandbox sends" is on, either of which already reaches it.
     dialLoopback: oc.input(DialLoopbackSchema).output(z.object({ ok: z.literal(true) })),
+    // The keyring on this computer (schemas/keyring.ts), relayed: the machine passes each call to intentic-keyring over its
+    // local pipe and carries the answer back, ciphertext both ways where a value rides. Only the daemon calls these,
+    // never a tool, so no turn can reach the keyring by naming a procedure; sent only to an agent advertising `keyring`.
+    // `keyringShares` answers for the asking sandbox alone: the machine names it from the link the call came in on.
+    keyringShares: oc.output(KeyringSharesSchema),
+    keyringRelease: oc.input(SignedKeyringGrantSchema).output(KeyringReleaseResultSchema),
+    keyringType: oc.input(KeyringTypeInputSchema).output(KeyringTypeResultSchema),
+    keyringInbox: oc.input(KeyringInboxItemSchema).output(KeyringInboxResultSchema),
+    keyringCopies: oc.output(KeyringCopiesSchema),
+    // Keeping two of the owner's keyrings in step through this sandbox, which carries only what is sealed between them.
+    keyringSyncState: oc.output(KeyringSyncStateSchema),
+    keyringSyncPair: oc.input(KeyringSyncPairSchema).output(KeyringSyncPairResultSchema),
+    keyringSyncOutbox: oc.output(KeyringSyncOutboxSchema),
+    keyringSyncDeliver: oc.input(KeyringSyncDeliverSchema).output(KeyringSyncDeliverResultSchema),
 };

package/src/contracts/org.contract.ts

@@ -0,0 +1,19 @@
+import { procedure } from "../protocol/route-meta.js";
+import { OrgPolicyStateSchema } from "../schemas/organisation.js";
+
+// The organisation this sandbox belongs to, as the daemon enforces it (docs/architecture/organisations.md). The
+// platform hands the policy over the sandbox's own connect token; this is the editor's read of the copy that decides,
+// so the hub hides and locks what the daemon will refuse rather than what the platform last said. A guest may read it:
+// it names the organisation and which sections are held, nothing about anyone.
+export const orgContract = {
+    policy: procedure
+        .route({
+            method: "GET",
+            path: "/org/policy",
+            summary: "Which organisation manages this sandbox, and what it holds",
+            description:
+                "Unbound for a personal sandbox. For one an organisation manages: its policy as this sandbox enforces it, section by section, and when that edition arrived.",
+        })
+        .meta({ guest: true })
+        .output(OrgPolicyStateSchema),
+};

package/src/contracts/privacy.contract.ts

@@ -8,6 +8,8 @@ import {
     PrivacyKnownSourceSchema,
     PrivacyKnownValueSchema,
     PrivacyLedgerEntrySchema,
+    PRIVACY_PREVIEW_MAX,
+    PrivacyPreviewSchema,
     PrivacyRevealSchema,
     PrivacyShieldPolicySchema,
     PrivacyShieldStatusSchema,
@@ -76,11 +78,21 @@ export const privacyContract = {
             path: "/privacy/dictionary",
             summary: "The name lists the shield finds names by",
             description:
-                "Every list the dictionary holds (first names, surnames, words that are names only beside other evidence, titles), how many words each has and where they come from. With a query, what the dictionary makes of it as a name, and for one word the listed words starting with it.",
+                "Every list the dictionary holds (first names, surnames, words that are names only beside other evidence, titles), the owner's own lists among them, whether each is switched on, how many words each has and where they come from. With a query, what the dictionary as the owner set it makes of it as a name, and for one word the listed words starting with it.",
         })
         .meta({ agent: true })
         .input(z.object({ query: z.string().max(100).optional().describe("A word, the start of one, or a full name.") }))
         .output(PrivacyDictionarySchema),
+    preview: procedure
+        .route({
+            method: "POST",
+            path: "/privacy/preview",
+            summary: "Try the shield on a text",
+            description:
+                "What the shield would mask in the text with the policy as saved (every detector, the name lists, the owner's own rules, the values the vault knows) and what found each. Nothing is given a token or kept, whatever the switch says.",
+        })
+        .input(z.object({ text: z.string().max(PRIVACY_PREVIEW_MAX) }))
+        .output(PrivacyPreviewSchema),
     sources: procedure
         .route({
             method: "GET",

package/src/contracts/secrets.contract.ts

@@ -15,6 +15,14 @@ import {
     SecretHostGuardSetSchema,
     SecretHostGuardsSchema,
     SecretKeysSchema,
+    SecretProgramGuardSetResultSchema,
+    SecretProgramGuardSetSchema,
+    SecretProgramGuardsSchema,
+    SecretTypeIntoResultSchema,
+    SecretTypeIntoSchema,
+    SandboxKeyringPairResultSchema,
+    SandboxKeyringPairSchema,
+    SandboxKeyringsSchema,
     SecretRevealSchema,
     SecretSetSchema,
 } from "../schemas/secrets.js";
@@ -143,6 +151,62 @@ export const secretsContract = {
         .meta({ agent: true })
         .input(SecretHostGuardSetSchema)
         .output(SecretHostGuardSetResultSchema),
+    // The program guard, the host guard's counterpart for typing into windows on the owner's computers (schemas/secrets.ts
+    // SecretProgramsSchema): read by the agent so a use aims where it may go; narrowing is anybody's, widening the owner's.
+    programs: secretRoute
+        .route({
+            method: "GET",
+            path: "/secrets/programs",
+            summary: "Which programs each secret may be typed into",
+            description:
+                "Every sandbox-held secret whose program list is set: the programs on the owner's computers and the phone apps it goes into unasked. A secret held in a computer's keyring carries its own list, shown on its inventory row. Names and programs only, never values.",
+        })
+        .meta({ agent: true })
+        .output(SecretProgramGuardsSchema),
+    setPrograms: secretRoute
+        .route({
+            method: "PUT",
+            path: "/secrets/programs/{subject}",
+            summary: "Set which programs a secret may be typed into",
+            description:
+                "Replaces one sandbox-held secret's program list. Taking programs away, or turning `anyField` off, is open to anybody who may use secrets; adding one is the owner's: from the agent it raises a card for the owner in the live conversation and waits. Refused for a secret a computer's keyring holds, whose list is changed on that computer.",
+        })
+        .meta({ agent: true })
+        .input(SecretProgramGuardSetSchema)
+        .output(SecretProgramGuardSetResultSchema),
+    // The owner's own Type into…, never the agent's: it types into whatever has focus, which only a person at that
+    // computer can aim.
+    typeInto: secretRoute
+        .route({
+            method: "POST",
+            path: "/secrets/type-into",
+            summary: "Type a secret into the focused window on one of your computers",
+            description:
+                "After a short countdown, types one secret into whatever has focus on the computer named, through its keyring, which checks the window and still asks there when the entry's share says to. Answers what it went into, never the value.",
+        })
+        .meta({ panel: false })
+        .input(SecretTypeIntoSchema)
+        .output(SecretTypeIntoResultSchema),
+    keyrings: secretRoute
+        .route({
+            method: "GET",
+            path: "/secrets/keyrings",
+            summary: "The keyrings on your computers",
+            description:
+                "Every connected computer with a keyring this sandbox can reach: whether it answers and is unlocked, how many of its entries are shared here, and whom it is paired with. Names and counts only, never values.",
+        })
+        .output(SandboxKeyringsSchema),
+    keyringPair: secretRoute
+        .route({
+            method: "POST",
+            path: "/secrets/keyrings/pair",
+            summary: "Pair the keyrings on two of your computers",
+            description:
+                "Asks each computer's keyring to pair with the other: each shows a prompt with both fingerprints, and only a yes on both pairs them. After that each keeps the other's entries in step, sealed between them and carried by this sandbox, which cannot open what it carries.",
+        })
+        .meta({ panel: false })
+        .input(SandboxKeyringPairSchema)
+        .output(SandboxKeyringPairResultSchema),
     // The credential gateway's say over one connection: how its credential reaches the agent, and what it may do there.
     policy: secretRoute
         .route({

package/src/events/requests.ts

@@ -68,7 +68,9 @@ export const ChildAgentAskSchema = ChildRunSchema.extend({
     message: z
         .string()
         .optional()
-        .describe("What the parent would say to it: the message it sends, or the answers it gives. Clipped for the request."),
+        .describe(
+            "What the parent would say to it: the prompt a described start opens on, the message it sends, or the answers it gives. Clipped for the request, with an ellipsis where it was cut.",
+        ),
     on: z.string().optional().describe('Which machine it runs on, when one is named: a runner, or "here" for this sandbox.'),
     proposed: ChildRunSchema.optional().describe(
         "What the agent asked to start it on, when the owner started it on something else instead. Present only once the request has settled that way.",

package/src/events/system-events.ts

@@ -51,6 +51,15 @@ export const HelloSchema = z.object({
     workspaceId: z.string(),
     routes: z.array(z.string()).optional(),
     shapes: z.record(z.string(), z.string()).optional(),
+    // The same two for the hand-written routes (`POST /workspace/upload-diff`), which are half the daemon's surface and
+    // used to be advertised nowhere: a call onto a raw route an older daemon predates could only come back as a bare
+    // 404. Their own fields rather than more entries in `routes`, which an older browser reads as proof that it is
+    // itself the stale side. Absent means a daemon from before this field, and no evidence either way.
+    // `rawFingerprints` is what `shapes` is for a procedure, under the name the rest of the code gives it.
+    rawRoutes: z.array(z.string()).optional(),
+    rawFingerprints: z.record(z.string(), z.string()).optional(),
+    // `<version>:<newest mtime of the compiled tree>`, as every release since 1.0.0 sends it. The version at its head
+    // is what the browser holds against the oldest daemon it supports (state/daemon-floor.ts), so it stays first.
     build: z.string().optional(),
     boot: BootProgressSchema.optional(),
     // A project sandbox's folder, workspace-relative (`my-app` for /work/my-app): the owner's own folder, synced live

package/src/index.ts

@@ -1,15 +1,16 @@
 import { getEventIteratorSchemaDetails, isContractProcedure } from "@orpc/contract";
 import type { z } from "zod";
+import { RAW_JSON_ROUTES } from "./protocol/raw/raw-json-routes.js";
 import { RAW_ROUTE_LIST } from "./protocol/raw/raw-routes.js";
 import type { ContractRoute } from "./protocol/routes.js";
-import { contractRoutes, requestPathFor, routeForProcedure, routeNameForRequest, routeShapes, servedRoute } from "./protocol/routes.js";
+import { contractRoutes, rawRouteFingerprintsOf, requestPathFor, routeForProcedure, routeNameForRequest, routeShapes, servedRoute } from "./protocol/routes.js";
 import { accountsContract } from "./contracts/accounts.contract.js";
 import { activityContract } from "./contracts/activity.contract.js";
 import { agentContract } from "./contracts/agent.contract.js";
 import { agentsContract } from "./contracts/agents.contract.js";
 import { approvalsContract } from "./contracts/approvals.contract.js";
-import { auditContract } from "./contracts/audit.contract.js";
 import { areasContract } from "./contracts/areas.contract.js";
+import { auditContract } from "./contracts/audit.contract.js";
 import { automationsContract } from "./contracts/automations.contract.js";
 import { capabilitiesContract } from "./contracts/capabilities.contract.js";
 import { choresContract } from "./contracts/chores.contract.js";
@@ -19,7 +20,6 @@ import { diffContract } from "./contracts/diff.contract.js";
 import { endpointsContract } from "./contracts/endpoints.contract.js";
 import { exitContract } from "./contracts/exit.contract.js";
 import { extensionsContract } from "./contracts/extensions.contract.js";
-import { personasContract } from "./contracts/personas.contract.js";
 import { gitContract } from "./contracts/git.contract.js";
 import { historyContract } from "./contracts/history.contract.js";
 import { intenticContract } from "./contracts/intentic.contract.js";
@@ -27,17 +27,20 @@ import { inventoryContract } from "./contracts/inventory.contract.js";
 import { issuesContract } from "./contracts/issues.contract.js";
 import { logsContract } from "./contracts/logs.contract.js";
 import { loopsContract } from "./contracts/loops.contract.js";
+import { needsContract } from "./contracts/needs.contract.js";
+import { netdiskContract } from "./contracts/netdisk.contract.js";
+import { offloadContract } from "./contracts/offload.contract.js";
+import { orgContract } from "./contracts/org.contract.js";
 import { pagesContract } from "./contracts/pages.contract.js";
 import { panelsContract } from "./contracts/panels.contract.js";
+import { personasContract } from "./contracts/personas.contract.js";
 import { portsContract } from "./contracts/ports.contract.js";
-import { runsContract } from "./contracts/runs.contract.js";
-import { publicContract } from "./contracts/public.contract.js";
-import { netdiskContract } from "./contracts/netdisk.contract.js";
+import { privacyContract } from "./contracts/privacy.contract.js";
 import { providersContract } from "./contracts/providers.contract.js";
+import { publicContract } from "./contracts/public.contract.js";
 import { pushContract } from "./contracts/push.contract.js";
-import { privacyContract } from "./contracts/privacy.contract.js";
+import { runsContract } from "./contracts/runs.contract.js";
 import { safetyContract } from "./contracts/safety.contract.js";
-import { needsContract } from "./contracts/needs.contract.js";
 import { secretsContract } from "./contracts/secrets.contract.js";
 import { sessionsContract } from "./contracts/sessions.contract.js";
 import { settingsContract } from "./contracts/settings.contract.js";
@@ -46,267 +49,12 @@ import { skillsContract } from "./contracts/skills.contract.js";
 import { systemContract } from "./contracts/system.contract.js";
 import { translatorContract } from "./contracts/translator.contract.js";
 import { usageContract } from "./contracts/usage.contract.js";
-import { offloadContract } from "./contracts/offload.contract.js";
 import { vpnContract } from "./contracts/vpn.contract.js";
 import { workflowsContract } from "./contracts/workflows.contract.js";
 import { workspaceContract } from "./contracts/workspace.contract.js";
 
-export { accountsContract } from "./contracts/accounts.contract.js";
-export { activityContract } from "./contracts/activity.contract.js";
-export { auditContract } from "./contracts/audit.contract.js";
-export { agentContract } from "./contracts/agent.contract.js";
-export { agentsContract } from "./contracts/agents.contract.js";
-export { approvalsContract } from "./contracts/approvals.contract.js";
-export { areasContract } from "./contracts/areas.contract.js";
-export { automationsContract } from "./contracts/automations.contract.js";
-export { capabilitiesContract } from "./contracts/capabilities.contract.js";
-export { choresContract } from "./contracts/chores.contract.js";
-export { ciContract } from "./contracts/ci.contract.js";
-export { complianceContract } from "./contracts/compliance.contract.js";
-export {
-    endpointsContract,
-    type HostModelServer,
-    HostModelServerSchema,
-    type HostModelServers,
-    HostModelServersSchema,
-    LocalModelFitSchema,
-    type LocalModelFitResponse,
-    type LocalModelPrefetch,
-    LocalModelPrefetchSchema,
-    type TrialHealth,
-    TrialStatusSchema,
-    type TrialStatusResponse,
-} from "./contracts/endpoints.contract.js";
-export { exitContract } from "./contracts/exit.contract.js";
-export { extensionsContract } from "./contracts/extensions.contract.js";
-export { personasContract } from "./contracts/personas.contract.js";
-export { diffContract } from "./contracts/diff.contract.js";
-export { gitContract } from "./contracts/git.contract.js";
-export { historyContract } from "./contracts/history.contract.js";
-// Not part of `sandboxContract` below: spoken over a device's WebSocket, with the machine implementing it.
-export { deviceContract } from "./contracts/device.contract.js";
-// Same inversion, spoken over a browser extension's socket, with the extension implementing it.
-export { webextContract } from "./contracts/webext.contract.js";
-// Same inversion, spoken over a phone app's socket as JSON-RPC (protocol/doors/phone-protocol.ts), with the app implementing it.
-export { phoneContract } from "./contracts/phone.contract.js";
-// Same inversion again: spoken over a runner's WebSocket, with the runner implementing it.
-export { runnerContract } from "./contracts/runner.contract.js";
-export { intenticContract } from "./contracts/intentic.contract.js";
-export { inventoryContract } from "./contracts/inventory.contract.js";
-export { issuesContract } from "./contracts/issues.contract.js";
-export { logsContract } from "./contracts/logs.contract.js";
-export { CONNECT_TOKEN_HEADER, EXTENSION_TOKEN_HEADER, REQUEST_ID_HEADER } from "./protocol/headers.js";
-export * from "./protocol/edge-verdict.js";
-export * from "./protocol/vitals.js";
-export { loopsContract } from "./contracts/loops.contract.js";
-export { panelsContract } from "./contracts/panels.contract.js";
-export { portsContract } from "./contracts/ports.contract.js";
-export { runsContract } from "./contracts/runs.contract.js";
-export { pagesContract, PageAppCallResultSchema, PageAppCallSchema, PageErrorsResultSchema, PageErrorsSchema } from "./contracts/pages.contract.js";
-export { publicContract } from "./contracts/public.contract.js";
-export { providersContract, type RunnableProviders, RunnableProvidersSchema } from "./contracts/providers.contract.js";
-export { pushContract } from "./contracts/push.contract.js";
-export { privacyContract } from "./contracts/privacy.contract.js";
-export { safetyContract } from "./contracts/safety.contract.js";
-export { needsContract } from "./contracts/needs.contract.js";
-export { secretsContract } from "./contracts/secrets.contract.js";
-export { sessionsContract } from "./contracts/sessions.contract.js";
-export { settingsContract } from "./contracts/settings.contract.js";
-export { shareContract } from "./contracts/share.contract.js";
-export { skillsContract } from "./contracts/skills.contract.js";
-export { systemContract } from "./contracts/system.contract.js";
-export { translatorContract } from "./contracts/translator.contract.js";
-export { type PlanLimitsHeld, type PlanLimitsRefreshed, PlanLimitsRefreshedSchema, usageContract } from "./contracts/usage.contract.js";
-export { netdiskContract } from "./contracts/netdisk.contract.js";
-export { offloadContract } from "./contracts/offload.contract.js";
-export { vpnContract } from "./contracts/vpn.contract.js";
-export { workflowsContract } from "./contracts/workflows.contract.js";
-export { workspaceContract } from "./contracts/workspace.contract.js";
-export * from "./events/agent-events.js";
-export * from "./events/agent-ui.js";
-export * from "./events/agent-words.js";
-export * from "./events/requests.js";
-export * from "./events/resume.js";
-export * from "./events/sandbox-notice.js";
-export * from "./events/system-events.js";
-export * from "./events/transcript.js";
-export * from "./events/land-breakage.js";
-export * from "./events/land-conflict.js";
-export * from "./events/verify-nudge.js";
-export * from "./events/errands.js";
-export * from "./events/need-wake.js";
-export * from "./events/watch-wake.js";
-export * from "./policy/request-status.js";
-export * from "./events/child-run.js";
-export * from "./policy/turned-away.js";
-export * from "./text/mentions.js";
-export * from "./text/pages.js";
-export * from "./text/transcript-page.js";
-export * from "./protocol/sse.js";
-export * from "./protocol/routes.js";
-export { type ControlReach, defaultFloor, type RouteAccess, type RouteMeta, routeAccess } from "./protocol/route-meta.js";
-export { RAW_ROUTE_LIST, RAW_ROUTES, type RawRouteKey, type RawRouteParams, rawRoutePath, rawRouteUrl } from "./protocol/raw/raw-routes.js";
-export * from "./protocol/raw/raw-json-routes.js";
-export { fillRoutePath, type RoutePathParams } from "./protocol/raw/route-path.js";
-export { tunnelBulkRoutes } from "./protocol/tunnel-bulk.js";
-export type { SandboxCallInput, SandboxGroup, SandboxHandlerInput, SandboxHandlerOutput, SandboxProcedure } from "./protocol/procedure-types.js";
-export * from "./policy/control-scopes.js";
 // The container's directory layout, re-exported since extensions can't import @intentic/constants directly.
 export { HISTORY_ROOT, HOST_STATE_ROOT, STATE_DIR, WORKSPACE_ROOT } from "@intentic/constants";
-export * from "./state/workspace-state.js";
-export * from "./state/runtime-state.js";
-export * from "./state/state-portability.js";
-export * from "./state/history-state.js";
-export * from "./state/fix-stance.js";
-export * from "./state/landed-commit.js";
-export * from "./state/fix-attempt-plan.js";
-// Provider vocabulary bottom-up: agent-runtimes, provider-specs, agent-catalog; three modules since the dependency
-// points one way.
-export * from "./models/agent-runtimes.js";
-export * from "./models/provider-specs.js";
-export * from "./models/agent-catalog.js";
-export * from "./policy/capability-env.js";
-export * from "./policy/command-classes.js";
-export * from "./policy/command-run.js";
-export * from "./policy/device-programs.js";
-export * from "./policy/sandbox-power.js";
-export * from "./policy/safety-policy.js";
-export * from "./policy/reserved-servers.js";
-export * from "./policy/credential-material.js";
-export * from "./policy/capability-secrets.js";
-export * from "./policy/secret-hosts.js";
-export * from "./ids/conversation-ids.js";
-export * from "./text/documents.js";
-export * from "./protocol/doors/host-protocol.js";
-export * from "./protocol/doors/webext-protocol.js";
-export * from "./protocol/doors/webext-links.js";
-export * from "./protocol/doors/phone-protocol.js";
-export * from "./protocol/doors/phone-links.js";
-export * from "./protocol/doors/runner-protocol.js";
-export * from "./protocol/doors/listener-protocol.js";
-export * from "./protocol/container-requirements.js";
-export * from "./ids/hostnames.js";
-export { SANDBOX_ID } from "./ids/sandbox-id.js";
-export * from "./ids/project-dir.js";
-export * from "./policy/overlay-lint.js";
-export * from "./models/model-label.js";
-export * from "./models/model-order.js";
-export * from "./models/model-offer.js";
-export * from "./models/model-pins.js";
-export * from "./models/model-roles.js";
-export * from "./models/model-setups.js";
-export * from "./models/plan-pools.js";
-export * from "./text/path-refs.js";
-export * from "./text/archives.js";
-export * from "./policy/output-fields.js";
-export * from "./policy/approvals-execution.js";
-export * from "./policy/message-limits.js";
-// Wire shapes, one module per subject area, mirroring `contracts/`; a `{param}` in the route path merges into the same
-// flat object, split back into path/body/query. `schemas/internal.ts` is absent: it's vocabulary, not a wire shape.
-export * from "./schemas/activity.js";
-export * from "./schemas/audit.js";
-export * from "./schemas/agent.js";
-export * from "./schemas/areas.js";
-export * from "./policy/fence-paths.js";
-export * from "./policy/persona-home.js";
-export * from "./schemas/agents.js";
-export * from "./schemas/speaker.js";
-export * from "./schemas/speech.js";
-export * from "./schemas/voice.js";
-export * from "./schemas/approvals.js";
-export * from "./schemas/automations.js";
-export * from "./schemas/agents-list.js";
-export * from "./schemas/capabilities.js";
-export * from "./schemas/chat-route.js";
-export * from "./schemas/ci.js";
-export * from "./schemas/providers/claude-gate.js";
-export * from "./schemas/codebase-health.js";
-export * from "./schemas/context-trim.js";
-export * from "./schemas/devices.js";
-export * from "./schemas/device-swaps.js";
-export * from "./schemas/intentic-os.js";
-export * from "./schemas/project-delivery.js";
-export * from "./schemas/device-artifacts.js";
-export * from "./schemas/run-targets.js";
-export * from "./schemas/engines.js";
-export * from "./schemas/environment.js";
-export * from "./schemas/exit.js";
-export * from "./schemas/extension-updates.js";
-export * from "./schemas/providers/fast-mode.js";
-export * from "./schemas/diff.js";
-export * from "./schemas/git/git.js";
-export * from "./schemas/git/git-scope.js";
-export * from "./schemas/git/git-history.js";
-export * from "./schemas/history.js";
-export * from "./schemas/hosts.js";
-export * from "./schemas/loopback-catch.js";
-export * from "./schemas/peer-enrollment.js";
-export * from "./schemas/intentic.js";
-export * from "./schemas/inventory.js";
-export * from "./schemas/issues.js";
-export * from "./schemas/logs.js";
-export * from "./schemas/loops.js";
-export * from "./schemas/maintenance.js";
-export * from "./schemas/marketplace.js";
-export * from "./schemas/members.js";
-export * from "./schemas/metrics.js";
-export * from "./schemas/panels.js";
-export * from "./schemas/personas.js";
-export * from "./schemas/privacy.js";
-export * from "./schemas/providers/plan-limits.js";
-export * from "./schemas/providers/handoff.js";
-export * from "./schemas/platform-link.js";
-export * from "./schemas/project-bring-back.js";
-export * from "./schemas/ports.js";
-export * from "./schemas/providers/provider-oauth.js";
-export * from "./schemas/providers/provider-subscriptions.js";
-export * from "./schemas/public.js";
-export * from "./schemas/push.js";
-export * from "./schemas/git/remote-refs.js";
-export * from "./schemas/needs.js";
-export * from "./schemas/secrets.js";
-export * from "./schemas/netdisk.js";
-export * from "./schemas/sessions.js";
-export * from "./schemas/settings.js";
-export * from "./schemas/data-protection.js";
-export * from "./schemas/ai-literacy.js";
-export * from "./schemas/compliance.js";
-export * from "./schemas/settings-history.js";
-export * from "./schemas/share.js";
-export * from "./schemas/shared.js";
-export * from "./schemas/short-codes.js";
-export * from "./schemas/system-prompt.js";
-export * from "./schemas/system.js";
-export * from "./schemas/state-plan.js";
-export * from "./schemas/restart-intent.js";
-export * from "./schemas/updates.js";
-export * from "./schemas/terminal.js";
-export * from "./schemas/turn-break.js";
-export * from "./schemas/keep-warm.js";
-export * from "./schemas/providers/usage.js";
-export * from "./schemas/vpn.js";
-export * from "./schemas/offload.js";
-export * from "./schemas/webext.js";
-export * from "./schemas/phone.js";
-export * from "./schemas/workflows.js";
-export * from "./schemas/workspace/workspace-graph.js";
-export * from "./schemas/workspace/workspace-repos.js";
-export * from "./schemas/workspace/workspace-search.js";
-export * from "./schemas/workspace/workspace-setup.js";
-export * from "./schemas/workspace/workspace-tree.js";
-export * from "./schemas/workspace/workspace-upload.js";
-export * from "./state/arrival.js";
-export * from "./state/definition.js";
-export * from "./policy/search-globs.js";
-export * from "./state/starter.js";
-export * from "./text/title.js";
-export * from "./state/update-probation.js";
-export * from "./state/versions.js";
-export * from "./text/model-answer.js";
-export * from "./text/shell-regions.js";
-export * from "./text/workflow-faults.js";
-export * from "./text/emoji.js";
-export * from "./time/zone.js";
 
 // The aggregated contract; implemented server-side by per-domain route factories, consumed by the browser's typed oRPC
 // client. Mounted at the sandbox root, alongside plain Hono routes like /health and /workspace/raw.
@@ -316,8 +64,8 @@ export const sandboxContract = {
     agent: agentContract,
     agents: agentsContract,
     approvals: approvalsContract,
-    audit: auditContract,
     areas: areasContract,
+    audit: auditContract,
     automations: automationsContract,
     capabilities: capabilitiesContract,
     chores: choresContract,
@@ -325,39 +73,40 @@ export const sandboxContract = {
     compliance: complianceContract,
     diff: diffContract,
     endpoints: endpointsContract,
+    exit: exitContract,
     extensions: extensionsContract,
-    personas: personasContract,
-    privacy: privacyContract,
-    safety: safetyContract,
-    sessions: sessionsContract,
-    settings: settingsContract,
-    share: shareContract,
-    skills: skillsContract,
-    intentic: intenticContract,
     git: gitContract,
     history: historyContract,
-    workspace: workspaceContract,
+    intentic: intenticContract,
     inventory: inventoryContract,
     issues: issuesContract,
     logs: logsContract,
     loops: loopsContract,
+    needs: needsContract,
+    netdisk: netdiskContract,
+    offload: offloadContract,
+    org: orgContract,
     pages: pagesContract,
     panels: panelsContract,
+    personas: personasContract,
     ports: portsContract,
-    runs: runsContract,
-    public: publicContract,
+    privacy: privacyContract,
     providers: providersContract,
+    public: publicContract,
     push: pushContract,
-    needs: needsContract,
+    runs: runsContract,
+    safety: safetyContract,
     secrets: secretsContract,
+    sessions: sessionsContract,
+    settings: settingsContract,
+    share: shareContract,
+    skills: skillsContract,
     system: systemContract,
     translator: translatorContract,
     usage: usageContract,
     vpn: vpnContract,
-    offload: offloadContract,
-    exit: exitContract,
-    netdisk: netdiskContract,
     workflows: workflowsContract,
+    workspace: workspaceContract,
 };
 
 // Every route in this build, and the names advertised on the hello frame; bound here, not in routes.ts, to avoid a
@@ -373,6 +122,19 @@ export const SANDBOX_ROUTE_NAMES: readonly string[] = SANDBOX_ROUTES.map((route)
 let fingerprints: Readonly<Record<string, string>> | undefined;
 export const sandboxRouteFingerprints = (): Readonly<Record<string, string>> => (fingerprints ??= routeShapes(sandboxContract));
 
+// The hand-written routes beside the procedures, advertised on their own field of the hello frame rather than mixed
+// into `routes`: a browser older than this build reads an unknown name in `routes` as evidence that IT is the stale
+// side, and every raw name arriving there at once would have had it say so on every connection. Absent, as from every
+// daemon before the field, means no evidence — the same "assume it answers" an unknown route surface gets.
+export const RAW_ROUTE_NAMES: readonly string[] = RAW_ROUTE_LIST.map((route) => route.name);
+
+// Each raw JSON route's shape, memoised like the procedures' for the same reason: the walk turns every schema into JSON
+// Schema, which is startup time a browser should only spend when it has a disagreement to explain. The routes that
+// carry no schemas at all (a WebSocket upgrade, a byte stream) are named above but fingerprinted nowhere, and an
+// unfingerprinted route is compared on nothing.
+let rawFingerprints: Readonly<Record<string, string>> | undefined;
+export const rawRouteFingerprints = (): Readonly<Record<string, string>> => (rawFingerprints ??= rawRouteFingerprintsOf(RAW_JSON_ROUTES));
+
 // The contract route a concrete browser request belongs to, bound to this build's route table.
 export const sandboxRouteName = (method: string, pathWithQuery: string): string | undefined =>
     routeNameForRequest(SANDBOX_ROUTES, method, pathWithQuery);

package/src/policy/identity-assertion.ts

@@ -1,4 +1,5 @@
 import { createPrivateKey, createPublicKey, randomBytes, sign as edSign, verify as edVerify } from "node:crypto";
+import { parseJsonWith } from "@intentic/base/json";
 import { z } from "zod";
 import { SANDBOX_ID } from "../ids/tunnel-ids.js";
 
@@ -92,14 +93,7 @@ const AssertionPayloadSchema = z.object({
     jti: z.string().min(16),
 });
 
-const parsePayload = (payload: Buffer): z.infer<typeof AssertionPayloadSchema> | undefined => {
-    try {
-        return AssertionPayloadSchema.safeParse(JSON.parse(payload.toString("utf8"))).data;
-    } catch {
-        // allow(silent-catch): a payload that is not JSON is an invalid assertion, which undefined is how this says.
-        return undefined;
-    }
-};
+const parsePayload = (payload: Buffer): z.infer<typeof AssertionPayloadSchema> | undefined => parseJsonWith(payload.toString("utf8"), AssertionPayloadSchema);
 
 // Verifies an assertion against the platform's public key at nowMs; undefined for any way of being invalid (wrong
 // prefix, bad signature, malformed claim, expired, issued in the future, living longer than the daemon allows). The