colinesdk

Public

The Coline App SDK: apps, tools, file types and surfaces that run inside Coline workspaces, and public websites with Coline Sites. TypeScript, with an in-memory test workspace. MIT.

Ops Wave D2: the reserved capabilities become real realtime (plan §D2): - AppInstallRoom DO on apps/realtime (app room per install, /apps/rooms/{installId}/ws|broadcast, wrangler v7 migration): internal-secret broadcast, app-install token claims verified against the room's installId, bounded payloads. - coline.realtime.publish capability op (realtime.subscribe permission, write-classed — read-ceilinged render contexts can't spam) publishes to the app's OWN room only; the room name derives from authenticated claims, never arguments. - Tier-2 subscribe: the HOST owns the socket (the sandbox has no network) — AppSandbox mints a scoped 1h token, connects with backoff, and forwards events over a new 'realtime' bridge message; guest-side subscribe() is a local registry with wildcard support. Connected only when the install granted realtime.subscribe. pickers: file + member pickers are now host-rendered — the guest asks for 'a file'/'a member' and receives only the picked id; the workspace browser and roster never enter the sandbox. Reuses DriveFilePicker + a new member picker dialog. ai.generate: wired to the background model gateway — apps never pick models or see keys. Every call meters through the execution log (one source of truth for quota AND billing attribution); per-install daily quota (APP_AI_DAILY_QUOTA, default 200) fails closed. events.emit: durable ambient events, enforced app-key namespacing so apps can never forge platform events; fan-out rides the EXISTING v1 delivery pipeline (retry + dead-letter) to every workspace app subscribed to the event — cross-app eventing on harvested infra — plus a mirror into the emitter's live room. commands.register: installed apps' declared commands surface in the workspace search dialog ('App commands' section, permission-gated), executing tool targets through the SAME dispatch + guard + execution log as every invocation. SDK: realtime.publish op + typed publish/subscribe/emit surfaces; testing fakes updated; 97 sdk + 9 bridge tests green. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>