The Meckie SDK

Shared apps that do stuff — call APIs, read the files a user hands them, send notifications, wake up on a schedule. Same locked-down sandbox as every Meckie app; every power is declared up front, granted by the user, and certified by LastProtocol.

How it works

Your app stays a sandboxed page (sandbox="allow-scripts", CSP default-src 'none'). Capabilities are requests to the Meckie shell over postMessage — the shell acts on your app's behalf, only after the user grants each capability, only inside the scope your manifest declares. Your code never holds tokens, sockets, or file paths.

Capabilities

Capability	What your app can do
🌐 `net`	HTTPS requests to up to 8 exact domains you declare — proxied, quota'd, private hosts refused
📁 `files`	Read files the user picks or drops, save results back — never a browse-the-disk API
🔔 `notify`	Rate-limited notifications, attributed to your app
⏰ `schedule`	Wake up every N minutes (≥15) — in the shell or via signed webhook

A manifest is the whole story

{
  "schemaVersion": 2,
  "id": "weather-buddy",
  "name": "Weather Buddy",
  "version": "1.0.0",
  "entry": "index.html",
  "capabilities": {
    "net": { "domains": ["api.open-meteo.com"] }
  }
}

Zip that with your index.html and assets (≤40 files, ≤4MB) and upload from Dashboard → My Apps → 📦 Upload app. Local scripts, styles, and images get flattened into one self-contained bundle; external references are a hard error.

Trust, baked in

Declared = consented. Users see exactly the capabilities in your manifest, and grant them per-app.
The manifest is inside your app's content hash. Broaden it and the hash changes — re-review, re-consent. No silent privilege escalation.
LastProtocol certification gates marketplace listing, and revoked apps are pulled everywhere.
Moderated like everything else — safety scan, headless test-drive, all-ages content pass.

Dev mode

POST your zip to /api/apps/dev-install on your own Meckie and it lands straight on your launcher with a permanent 🧪 badge — no publish, no review queue, but the safety scan and test-drive still run, and the consent flow is the real one. Re-upload the same id to replace it in place.

Calling a capability

// ask the shell (the meckie-sdk.js helper wraps this)
parent.postMessage({ type: 'app_fetch', id: 'r1',
  url: 'https://api.open-meteo.com/v1/forecast?...', method: 'GET' }, '*');

// answer arrives as a message event
// { type: 'app_fetch_result', id: 'r1', ok: true, status: 200, body: '...' }

Grab the ready-made helper and a complete working example (weather-buddy) from the repo's examples/sdk-apps/ folder. Build your app so it still renders when a capability replies ok: false — in the public share viewer, net/notify/schedule are disabled with an install nudge.

Upload your first app →