SDK v2 Phase 0: fold SDK into monorepo, ship the v2 contract

Radin committed … · root commit

⧉ba3ca2aa1673

Author

Radin · radin@coline.appAug 10, 2026 at 16:39

Committer

Radin · radin@coline.appAug 10, 2026 at 16:39

Parents

None (root commit)

SDK v2 Phase 0: fold SDK into monorepo, ship the v2 contract

Monorepo fold:
- Remove the packages/sdk submodule; vendor the v1 modules the platform
  actually uses into packages/sdk/src/legacy (manifest, ColineApp,
  contexts, hosted runtime) with the tree moved to src/tree and signing
  to src/server. The v1 public surface is preserved at the root export,
  so apps/web compiles unchanged. Unused v1 modules (REST client,
  generated OpenAPI types, webhooks router, dev server, message builder,
  OAuth helpers) are deleted, not carried.
- Source exports + transpilePackages replace the stale dist/ resolution
  (fresh clones now typecheck without a manual SDK build).
- @colineapp/ui and @colineapp/app-runtime skeletons per plan §5.2.

The v2 contract (@colineapp/sdk/v2):
- Manifest v2: permission vocabulary, surfaces with three tiers,
  namespaced file types and tools, commands, hosting default +
  per-capability overrides, network policy, notification channels,
  triggers, kairo config; strict schemas with cross-refinements.
- define* + two-artifact extraction: defineApp/defineTool/defineFileType/
  defineCommand carry metadata and handlers from one source; extraction
  emits the serializable manifest artifact (z.toJSONSchema for tool
  inputs) and runtime completeness is validated eagerly.
- Capability contract: coline.* interface types, the single operation
  descriptor table (permission + mutation class per operation), and the
  effect-ceiling gate — effect is an enforced runtime ceiling, not
  metadata (read tools cannot reach write capabilities).
- Protocol v2: signed envelope binding protocol version + delivery id
  into the HMAC (v1 signed only timestamp.body), constant-time
  comparison, fail-closed on unknown protocol majors.
- ColineReference formalized; Reference node added to the tree.

Unified runtime guard (apps/web):
- lib/apps/guard.ts: pure intersection core (install status, membership,
  manifest ∩ granted permissions, principal, effect ceiling).
- lib/apps/guard-loader.ts: DB assembly, v2-manifest-only with explicit
  re-registration error, closing the v1 gap where install grants were
  never enforced at runtime.

Verified: sdk typecheck + 63 tests green; ui/app-runtime typecheck green;
web typecheck green except pre-existing browser errors also on main;
lib/apps tests 26 passing (incl. 10 new guard tests); full-suite failures
are pre-existing on main; eslint clean on touched files.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>