colinesdk

Public

The Coline App SDK: apps, tools, file types and surfaces that run inside Coline workspaces, and public websites with Coline Sites. TypeScript, with an in-memory test workspace. MIT.

Store Wave A (0/8): compareAppSecurityContract — the shared security diff The single function that defines 'the consent contract expanded' (distribution plan review §2), consumed by the review queue's delta view, auto-update eligibility, and the admin re-consent dialog — one implementation, never three drifting copies. SDK (packages/sdk/src/manifest/compare.ts, exported from /v2): - Full delta: permissions ±, network hosts ±, tool effect changes, schedule changes, surface tier changes, webhook events ±, hosting changes (default, newly-external overrides, baseUrl moves). - requiresReconsent + human-readable reconsentReasons. Expansions only: removals never trigger. Covers the review's evil-allowlist case (same permission set, new host → reconsent), effect escalation, new tools above the app's previous ceiling, web-tier surface gains, external hosting gains, and backend baseUrl moves. tree→react is deliberately NOT reconsent (Coline-built, sandboxed, no network). - riskFlags for reviewers: wildcard hosts, gains external hosting, baseUrl moved, gains/many destructive tools, broad permission growth. - 10 tests (97 sdk total) — fixtures are real cross-refined manifests. Platform (apps/web/src/lib/apps/security-contract.ts): - compareVersionSecurityContract: resolves the latest APPROVED sibling version (approval is the security event, not publication) and diffs against it; v1 predecessors force reconsent as a protocol upgrade with the full contract shown. - compareManifestPair for the update sweep (pin vs candidate); null on non-v2 manifests, which callers must treat as reconsent-required. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>