@appport/core

The capability runtime: registry, dispatch pipeline, validation, sessions, events, streams, operations and telemetry.

Core knows nothing about HTTP, WebSocket, IPC, or any storage engine.

import { createApplication, defineCapability, defineEvent } from "@appport/core";
import { s } from "@appport/schema";

const application = createApplication({
  application: { id: "com.example.docs", name: "Docs", version: "1.0.0" },
  capabilities: [documentsSave],
  events: [documentsChanged],
  authorizer: permissionAuthorizer()
});

const response = await application.handleRequest(envelope, { session, transport: "http" });

The pipeline

receive -> validate -> authorize -> execute -> serialize -> respond

Authorization always runs before privileged logic. Input is validated before authorization, so policies see well-formed input. Output is validated too, so a handler cannot silently break its published contract.

What the runtime provides

• Registry and manifest — the application's contract, rendered as JSON Schema.
• Application registration — define an application, verify it, and register for durable tracking with identity, manifest, fingerprint, and verification state.
• Events — at-most-once publication, with payload validation.
• Streams — async iterables or context.createStream(), with cancellation.
• Sessions — transport-neutral, pluggable storage.
• Idempotency — replayed responses for capabilities that declare support.
• Concurrency — parallel, serialized, or keyed(field).
• Timeouts — per capability and per request, clamped by the server.
• Operations — operations.status, operations.cancel, operations.events for work that outlives a request.
• Telemetry — identifiers and outcomes, never credentials or payloads.
• Sanitization — production errors carry no stack traces, paths or secrets.

The reserved appport.manifest and appport.ping capabilities are registered automatically, so discovery works identically on transports that have no URLs.

Application Registration (PR20)

Define, verify, and register applications for durable tracking:

import { defineApplication, ApplicationRegistry, MemoryApplicationStateStore } from "@appport/core";

// 1. Define an application (PR18)
const application = defineApplication({
  identity: { id: "invoicing", name: "Invoicing", version: "1.0.0" },
  provides: [invoiceCreate, invoiceSend],
  requires: [{ name: "payments.charge", version: 1 }],
  implementations: { "invoice.create@1": createImpl, "invoice.send@1": sendImpl }
});

// 2. Verify the application (PR19)
const verification = application.verify();
if (!verification.ready) throw new Error("Application verification failed");

// 3. Get the canonical manifest and fingerprint (PR19)
const manifest = application.manifest();
const fingerprint = application.fingerprint();

// 4. Register for durable tracking (PR20)
const store = new MemoryApplicationStateStore();
const registry = new ApplicationRegistry(store);

const registered = await registry.register({
  identity: application.identity,
  manifest,
  fingerprint,
  verification
});

// Tracked application state with identity, manifest, fingerprint, verification
console.log(registered.id, registered.status, registered.revision);

The registered application state is portable and contains no implementation details — only the contract, identity, verification state, and lifecycle.