Module collaboration 

Toolkit-side collab client. The broker client (routes, transport, committed reads, signing, invocation updates, presence transport) is the collaboration crate, which a process that commits to a workspace links without the toolkit; it keeps its path here. What stays is the widget side: who is in the workspace as the toolkit shows them, and the content a view reads.

Modules

action_directory

An application’s action directory, without the toolkit: the ActionDirectorySnapshot a publication of resources and actions builds, the bounded pages of it the broker asks for (a level, a named resource, or the actions a search names) and the exact row it resolves before an invocation.

app_surface

Which app surface the changes an app makes are decided against.

approved_checks

Typed bounded jobs on an existing acknowledged record channel.

browser_service_sessions

Private, one-shot requests to the session’s services, on the app’s own route. These replies never enter the document, history or durable event queues.

channel_key

The routing key one connection names on the collaboration wire.

channel_live_activity

An app’s live activity — what it keeps showing outside its windows, a running timer — reached over its collaboration channel.

channel_settings

An app’s settings when the shell keeps them: its view of the session’s records, reached over the app’s collaboration channel.

commit_log

The action log: the index this endpoint builds as changes and commits arrive, answering which actions wrote a resource and which action a change belongs to.

commits

The workspace commits an endpoint has seen: one action, every unit it wrote, delivered all together or not at all.

document_routes

A document envelope as a route’s endpoint takes it in: the whole payload, checked against the route it arrived on, and the mutation it carries.

external_moderation

Bounded action-only moderation requests on acknowledged record channels.

file_clipboard

The local host’s Files clipboard. Offers are opaque, never path lists.

handoff

Handoff: what the shell and one application instance say to each other while that instance’s window moves to another workspace.

history_source

A document’s history below the toolkit: its steps (undo, redo, restore and checkpoints written into the document itself), the revert they are taken back by, and who wrote them.

invocation_scope

The invoker a delivered invocation runs for on this thread, and the one-shot replies the collaboration lanes answer an invocation with. The toolkit’s invocation scope (ui::invocation_scope) builds the door’s custody on these.

local_document_action

A local action observation as the collab client reports it: the published invocation and the exact execution it captured. These are not authorizations; the toolkit’s ui::local_document_action queues them.

local_identity

Who sits at this device, as far as undo attribution and history authors are concerned.

native_initial

Private native construction custody. It borrows the existing SDK worker; neither an environment value nor a data capture is a positive authority.

open_selected

Bounded navigation requests, never serialized source or edit authority.

owner_view

Session-local native owner-view control. Documents retain their normal CRDT routes; these messages carry presentation only and grant no focus or input.

participants

Remote participants (agents, collaborators) that hold their own view of a widget, and the retained topology collaboration sessions walk.

portable_storage

Hydrated, explicitly namespaced browser persistence. Durable writes are acknowledged by the host only after its backing transaction commits.

record

A record’s identity: what it is (RecordKind), which one it is (RecordId), what it references (RecordRef) and the checkout that names all three (RecordCheckout). The id travels on the collaboration wire and names a file on disk; the toolkit’s record store (ui::record) keeps the documents these name.

record_content

The content a record references: its lanes and stores are the collab client’s (collaboration::record_content); what a view reads of it, as arrivals, is the toolkit’s.

semantic_schema

The numbers a semantic checkpoint carries for the portable schemas a signed manifest can declare (continuity.semantic_schema). The tag says what the payload means, so a device that has not installed the app can still check its shape. They match ContinuitySemanticSchema::wire_tag in tilo-app-package.

state

A document and the history it keeps, below the toolkit: the primitive that writes a past state forward as a new change, which undo, redo and restore all write through.

write_attribution

Which of an app’s own live invocations its next writes belong to.

write_attribution_lane

The lane on which an app names the paths it is about to write for one of its own invocations, so the host can record the agent behind them (runtime_collab::write_attribution). It sends no actor: the host takes that from its own custody of the invocation.

Structs

BrokerActionCatalogueWire

BrokerActionSurface

One application connection’s exported actions, as the broker’s action catalogue lists them to an application.

CalibrationInfo

CalibrationMemberInfo

CalibrationMicrophoneInfo

One device’s microphone as a calibration candidate for a group.

CalibrationMicrophoneRun

CertifiedAgentIdentity

Explicit correlation supplied by owner-backed membership, never decoded from a participant label or an actor-id prefix.

CertifiedEndpointIdentity

Certified identity for a client connecting to an explicit collaboration endpoint rather than through a launcher-inherited identity service.

CollaborationManager

Collaborator

CommitAuthor

Who made an action: the authenticated principal that invoked it, and the device that signed it.

CommitPart

One unit an action wrote: which app’s record, and the hashes of the changes it made there.

CommittedDocument

A disposable capture from the actual admitted SDK channel. It cannot be constructed by an application. Its ACK opens only this route generation.

ContinuationMetadata

Inert, app-owned resume projection sent only to the local shell.

DocumentHistory

Lazy history paging state for every artifact the app has seen.

DocumentPublicationReceipt

Completion of the document prefix preceding one publication barrier.

ExportedAction

One inert operation an application exports, without execution authority.

HostSessionConnector

A one-shot host handoff factory, evaluated on the SDK worker’s LocalSet.

NativeJoin

The wait for a joining manager’s primary route (CollaborationManager::join_native), made on a thread of its own: a window whose record is not on this device yet builds once the route is joined, from the workspace’s committed history. Its outcome is an event (Self::when_done); no clock decides it. The window’s thread shows the window’s loading state meanwhile and builds the window once it is told (Self::finish).

NearbyDestinationHandle

A short-lived shell capability naming one receiver destination for one authenticated Files connection. Applications never receive its host path.

NearbyTargetHandle

A short-lived shell capability naming one picker target. It carries no cryptographic peer identity and has no authority outside the authenticated app connection that received it.

NearbyTransferDestination

Path-free receiver destination projected from this Files instance’s current writable grants.

NearbyTransferHandle

A short-lived shell capability naming one transfer for one authenticated Files connection. It is never the transport’s global transfer identity.

NearbyTransferSnapshot

NearbyTransferStatus

Bounded status projection. Paths and file contents are absent: receiver UI needs a portable display name, exact peer and byte progress.

NearbyTransferTarget

A certified personal-device target safe to show in an application picker.

NetworkWakeStatus

Bounded local observations; no field claims verified physical recovery.

PrimaryRouteWitness

Successful primary-route metadata; an epoch invalidates cursors even when the same route is re-announced. This is not an application-mintable credential.

RouteSpec

An explicit typed collaboration route.

SessionResource

One the session’s published resources (sound, displays, the person’s settings), as the app’s UI thread reaches it: the reading it stands at, each later reading, and the actions that change it.

SessionServices

A surface app’s connection to its session’s services: the same connection every app reaches its session through, held by a process that shows a window placed by the session and joins no workspace of its own.

SpeakerDeviceInfo

SpeakerEndpointInfo

SpeakerGroupInfo

SpeakerMemberInfo

SpeakerMemberSpec

SpeakerSnapshot

SpeakerTrimInfo

A member’s calibration correction in display units.

SurfaceDelta

A change to a connection’s published surface.

SurfacePublication

What the broker holds of one connection’s surface, as the publisher last sent it.

SurfaceTable

A connection’s surface as the broker holds it: the shapes and templates its resources name, and the resources in the order they were first published.

UnitMutation

One unit and what changed in it, as the publisher of a pass holds it.

WorkspaceCommit

One signed action across every unit it wrote.

Enums

ActionDirectoryRequest

A broker directory request awaiting main-thread authority. This crosses threads as inert strings and budgets only; no widget reference or Cap’n Proto handle ever leaves the UI/collaboration boundary.

CalibrationMemberState

CalibrationMicrophoneState

What one microphone contributed to a run.

CalibrationPhaseInfo

ChannelAccessState

What an endpoint’s route can do with content, as apps see it.

CollabRequest

CollabSendError

Why a request did not reach the collaboration transport.

CollaborationState

Where a manager’s connection stands, as the UI shows it.

DisplayOrigin

The host distinguishes local UI intent from continuation of a published action. A published id is resolved only against broker-retained original custody.

DocumentMutation

Meaning of a signed document payload. Keeping this tag inside [SignedOp::payload] makes snapshot-vs-incremental part of the bytes the device signs without changing the persisted SignedOp layout.

DocumentPublicationError

Failure to complete a prefix of document publications.

ExportedInput

What one exported action’s invocation must carry, as it crosses the wire — the transport-side twin of tilo_actions::InputSpec, which says what kind of text it collects rather than whether it names content.

JoinHold

What holds up a primary route’s join, as the broker reports it while the join is pending (CollaborationManager::join_hold).

MicrophoneStatus

Whether one device’s microphone can listen while a group is calibrated.

NativeConnection

Which connection a native launch’s manager joins its workspace on.

NativeLaunchError

Why a native launch’s manager could not join its workspace.

NearbyTransferCommand

Commands accepted by the shell-owned Nearby Send authority. source_path is raw Unix path bytes so a valid file never becomes inaccessible merely because its name is not UTF-8. The broker accepts Send only from the certified Files application and revalidates the exact target and source.

NearbyTransferDirection

NearbyTransferPhase

NearbyTransferReply

PortableWifiSecurity

Portable Wi-Fi authentication modes understood by the sealed personal secret bridge. Enterprise identity/certificate state is intentionally not representable here.

PresencePayload

SdkCustody

The custody types only this toolkit’s endpoint mints: the committed captures its collaboration events carry.

SpeakerCommand

SpeakerMemberStatus

Where one member of a group stands right now.

SpeakerPlaybackInfo

A session playing on the group right now, most urgent state first.

SpeakerReply

SpeakerRoleSpec

What one member contributes, in wire form.

TransportCommand

Everything the manager asks of its transport.

TransportError

Why a transport refused a command.

TransportStatus

Liveness of a transport as the owner sees it this frame.

WifiContinuityCommand

WifiContinuityReply

Constants

CURRENT_CONNECTION_PEER_ID

Reserved invokePublishedAction.peerId meaning “the application connection making this request”. Live broker peer ids are allocated from zero upward; the broker never assigns this sentinel.

HISTORY_PAGE_SIZE

Ops per history page. Large enough that a scroll gesture rarely waits, small enough to keep each page’s decrypt and apply well under a frame.

HISTORY_PREFETCH_MARGIN

Prefetch when a view is within this many loaded ops of the oldest one.

MAX_SPEAKER_NAME_CHARS

ROUTE_JOIN_FAILED

How an app’s error begins when it could not join its collaboration route and stopped. The shell recognises it in a failed launch’s output to say why the app did not open.

SESSION_RUNTIME_SUPPORTED

Whether this host supports the local session runtime transport. This describes transport availability, not an inherited capability or permission.

Traits

CollabTransport

A synchronous, poll-driven collaboration transport. See the module documentation for the contract every implementation upholds.

DocumentCustody

Host-local original contributor custody a document change carries to the transport, never serialized on the wire. The toolkit’s invocation scope mints it (ui::invocation_scope::DocumentAuthorization); the transport checks it against the change it is about to sign.

PeerTransport

Transport adapters must authenticate ordinary peer joins and verify inbound envelopes before publishing events. Installing this adapter grants no model, action, HostContext, or storage authority. Queue failures are fail-closed.

Functions

colour_from_packed

The colour a roster row’s packed 0x00RRGGBB names: the presence hue nearest it, None for 0 or a grey.

continuation_restore_env

The launcher-only resume payload the host passed this window ([crate::host::HostIdentity::continuity_resume]).

display_control

Ask the native host to inspect or change its display transaction. Call off the frame thread; the existing bridge and response wait remain bounded.

install_channel_settings

Make the shell’s records this process’s settings from the start of its launch, when the launcher handed it the shell’s collaboration service. A setting the app reads or writes while it builds its window, before its collaboration manager connects, is then the shell’s: a write waits in the channel’s outbox and the primary route’s join sends it, in the order it was made. Installed only when the manager was built, an early write went to the sandbox’s own settings file and was lost.

local_app_id

The application’s authenticated durable route (falling back to its signed package id, then QUICK_APP_ID for dev). Read from the same place the channel key is built, so what an app publishes can’t disagree with its connection.

local_cluster_id

The workspace this process collaborates in. Exposed so presence scopes from the same source routing uses, rather than a derivation that could drift.

local_user_id

The person sitting at this machine. Actions are stamped with this so undo can tell collaborators apart (see [crate::state::State::undo_as]): the id must be stable across a document’s life and distinct between people, or one person’s Ctrl+Z reverts another’s work.

presence_handle_env

The presence handle announced on Hello. TILO_PRESENCE_HANDLE wins, then TILO_USER_ID; absent both, the broker’s synthetic name.

speaker_command

Ask the shell’s speaker-group authority over the launcher-authenticated Settings route. Run it off the frame thread; a lost broker times out into an ordinary unavailable result.

wifi_continuity_command

Invoke the shell’s launcher-authenticated, sealed Wi-Fi continuity path. Callers should run this off the frame thread; the bounded timeout turns a lost broker into an ordinary unavailable result.

Type Aliases

CollabEvent

One event this endpoint receives, carrying the toolkit’s own custody types. The vocabulary is defined in [runtime_collab::event], which the session’s brokers share.

EndpointChannelKeys

Where an endpoint with no identity service asks for its routes’ channel keys, as an identity service answers them: the record’s workspace, its app, the record, and the key generation the route holds.