@aletheia-dev/app-sdk

Write Aletheia apps in TypeScript. An app is a WebAssembly module a tenant installs: a manifest (what it needs and offers), actions a workflow calls, and optionally a webhook handler and a hand-off to a vendor's SDK. The platform runs the module in a sandbox bound to one tenant's call, with the host functions ctx.http, ctx.hmac, ctx.documents.read and ctx.log; secrets are named, never read.

import { z } from 'zod';
import { defineApp, defineManifest } from '@aletheia-dev/app-sdk';

export const manifest = defineManifest({
  name: 'acme-screening',
  version: '0.1.0',
  configSchema: z.object({ threshold: z.number().min(0).max(1).default(0.85) }),
  secrets: ['apiKey'],
  hosts: ['api.acme.example'],
  actions: {
    screen: {
      input: z.object({ name: z.string().min(1) }),
      output: z.object({ hit: z.boolean() }),
      timeoutMs: 10_000,
      idempotent: true,
    },
  },
});

export default defineApp({
  manifest,
  actions: {
    screen(input, ctx) {
      const response = ctx.http({
        method: 'POST',
        url: 'https://api.acme.example/v1/screen',
        headers: { authorization: `Bearer ${ctx.secret('apiKey')}` },
        body: { json: { name: input.name } },
      });
      const { score } = response.json() as { score: number };
      return { hit: score >= ctx.config.threshold };
    },
  },
});

aletheia-app build bundles the entry with esbuild and compiles it with extism-js (it needs extism-js and binaryen's wasm-merge and wasm-opt: EXTISM_JS and BINARYEN_BIN name them, or they are found on PATH) into dist/app.wasm, with dist/app.json beside it. @aletheia-dev/app-sdk/testing runs the built module through the real host in your tests, with a local vendor stub, secrets and documents.