@appport/sdk 1.1.19 → 1.1.20

package/vendor/@appport/core/dist/application-source.js

@@ -0,0 +1,186 @@
+/**
+ * Application Source Connections (F6)
+ *
+ * A source is an external repository that *implements* part of an application
+ * AppBoundry already owns. A source connection therefore:
+ *
+ *   - references an applicationId but never creates or redefines it,
+ *   - attests `appboundry.contract.json` against the authoritative fingerprint,
+ *   - declares implementation coverage that must be a subset of the contract,
+ *   - carries its own small lifecycle, distinct from the application lifecycle.
+ *
+ * Multiple sources per application, and multiple sources per capability, are
+ * first-class. None of them is a provider identity.
+ */
+import { randomUUID } from "node:crypto";
+import { verifySourceObservation } from "./source-verification.js";
+export class ApplicationSourceConflictError extends Error {
+    constructor(id) {
+        super(`Concurrent application source update rejected for "${id}"`);
+        this.name = "ApplicationSourceConflictError";
+    }
+}
+/** Reference in-memory authority, used where FeltDB is not available. */
+export class MemoryApplicationSourceStore {
+    #records = new Map();
+    async get(applicationId, sourceId) {
+        const found = this.#records.get(`${applicationId}:${sourceId}`);
+        return found && structuredClone(found);
+    }
+    async put(record, expectedSequence) {
+        const key = `${record.applicationId}:${record.id}`;
+        if (this.#records.get(key)?.sequence !== expectedSequence)
+            throw new ApplicationSourceConflictError(record.id);
+        this.#records.set(key, structuredClone(record));
+    }
+    async list(applicationId) {
+        return [...this.#records.values()]
+            .filter((record) => !applicationId || record.applicationId === applicationId)
+            .map((record) => structuredClone(record))
+            .sort((left, right) => left.id.localeCompare(right.id));
+    }
+}
+/**
+ * The authoritative contract of a registered application.
+ *
+ * AppBoundry owns the application identity and its contract; a source may only
+ * reference them. A retired application has no authoritative contract, so no
+ * source can attest one.
+ */
+export function registeredApplicationContract(registry) {
+    return {
+        async get(applicationId) {
+            const state = await registry.get(applicationId);
+            if (!state || state.status === "retired")
+                return undefined;
+            return { fingerprint: state.fingerprint, manifest: state.manifest };
+        }
+    };
+}
+/** A source is executable evidence only while it attests the current contract. */
+export function sourceIsEligible(source, authoritativeFingerprint) {
+    return source.status === "connected" && source.contractFingerprint === authoritativeFingerprint;
+}
+/**
+ * Establishes and maintains source connections against durable authority.
+ *
+ * Every transition is derived from verification evidence; no caller may assert
+ * a connected source directly.
+ */
+export class ApplicationSourceOperations {
+    store;
+    authority;
+    now;
+    constructor(store, authority, now = () => new Date().toISOString()) {
+        this.store = store;
+        this.authority = authority;
+        this.now = now;
+    }
+    /** Connect a new source: attest the contract, then derive coverage. */
+    async connect(applicationId, observation) {
+        const authoritative = await this.#authoritative(applicationId);
+        const at = this.now();
+        const verification = verifySourceObservation(applicationId, observation, authoritative, at);
+        const record = this.#record(`src_${randomUUID()}`, applicationId, verification, 1, at, at);
+        await this.store.put(record);
+        return record;
+    }
+    /**
+     * Re-attest an existing source, for example after a contract revision.
+     *
+     * The source identity is immutable: re-attestation may change the ref, the
+     * commit, the attested contract and the coverage, never the repository.
+     */
+    async reattest(applicationId, sourceId, observation) {
+        const current = await this.#required(applicationId, sourceId);
+        if (current.status === "disconnected")
+            throw new Error("A disconnected source must be reconnected as a new source");
+        if (current.repositoryIdentity !== observation.repositoryIdentity)
+            throw new Error("Re-attestation cannot change source identity");
+        const authoritative = await this.#authoritative(applicationId);
+        const at = this.now();
+        const verification = verifySourceObservation(applicationId, observation, authoritative, at);
+        const next = this.#record(sourceId, applicationId, verification, current.sequence + 1, current.createdAt, at);
+        await this.store.put(next, current.sequence);
+        return next;
+    }
+    /** Remove a source from implementation eligibility; history stays intact. */
+    async disconnect(applicationId, sourceId) {
+        const current = await this.#required(applicationId, sourceId);
+        if (current.status === "disconnected")
+            return current;
+        const at = this.now();
+        const next = { ...current, status: "disconnected", sequence: current.sequence + 1, disconnectedAt: at };
+        await this.store.put(next, current.sequence);
+        return next;
+    }
+    /**
+     * Mark attestations of superseded contract revisions stale.
+     *
+     * A contract revision never silently promotes an old attestation: the source
+     * must reconnect/re-attest before it is eligible again.
+     */
+    async refresh(applicationId) {
+        const authoritative = await this.#authoritative(applicationId);
+        const refreshed = [];
+        for (const source of await this.store.list(applicationId)) {
+            if (source.status !== "connected" || source.contractFingerprint === authoritative.fingerprint) {
+                refreshed.push(source);
+                continue;
+            }
+            const next = {
+                ...source,
+                status: "stale",
+                sequence: source.sequence + 1,
+                reasons: [`CONTRACT_MISMATCH: attested ${source.contractFingerprint} but the authoritative contract is ${authoritative.fingerprint}`]
+            };
+            await this.store.put(next, source.sequence);
+            refreshed.push(next);
+        }
+        return refreshed;
+    }
+    /** Sources that may currently supply an implementation. */
+    async eligible(applicationId) {
+        const authoritative = await this.#authoritative(applicationId);
+        return (await this.store.list(applicationId)).filter((source) => sourceIsEligible(source, authoritative.fingerprint));
+    }
+    get = (applicationId, sourceId) => this.store.get(applicationId, sourceId);
+    list = (applicationId) => this.store.list(applicationId);
+    #record(id, applicationId, verification, sequence, createdAt, at) {
+        const status = verification.verified ? "connected" : "failed";
+        return {
+            id,
+            applicationId,
+            sourceType: "repository",
+            repositoryIdentity: verification.repositoryIdentity,
+            ...(verification.ref ? { ref: verification.ref } : {}),
+            ...(verification.verifiedCommitSha ? { verifiedCommitSha: verification.verifiedCommitSha } : {}),
+            contractFingerprint: verification.attestation?.observedFingerprint ?? "",
+            ...(verification.contract ? { contractRevision: verification.contract.contractRevision } : {}),
+            // A source that failed attestation carries no coverage: an unattested
+            // repository must never become an eligible implementation.
+            coveredCapabilities: verification.verified ? verification.coverage.covered : [],
+            rejectedCapabilities: verification.coverage.undeclared,
+            status,
+            sequence,
+            createdAt,
+            ...(verification.verified ? { verifiedAt: at } : {}),
+            ...(verification.attestation ? { attestation: verification.attestation } : {}),
+            failures: verification.failures,
+            reasons: verification.reasons
+        };
+    }
+    async #authoritative(applicationId) {
+        const authoritative = await this.authority.get(applicationId);
+        if (!authoritative)
+            throw new Error(`Unknown application "${applicationId}"`);
+        return authoritative;
+    }
+    async #required(applicationId, sourceId) {
+        const found = await this.store.get(applicationId, sourceId);
+        if (!found)
+            throw new Error(`Unknown application source "${sourceId}"`);
+        return found;
+    }
+}
+//# sourceMappingURL=application-source.js.map

package/vendor/@appport/core/dist/application-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-source.js","sourceRoot":"","sources":["../src/application-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,uBAAuB,EAA6F,MAAM,0BAA0B,CAAC;AAoC9J,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD,YAAY,EAAU;QACpB,KAAK,CAAC,sDAAsD,EAAE,GAAG,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED,yEAAyE;AACzE,MAAM,OAAO,4BAA4B;IAC9B,QAAQ,GAAG,IAAI,GAAG,EAAuC,CAAC;IACnE,KAAK,CAAC,GAAG,CAAC,aAAqB,EAAE,QAAgB;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,aAAa,IAAI,QAAQ,EAAE,CAAC,CAAC;QAChE,OAAO,KAAK,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,MAAmC,EAAE,gBAAyB;QACtE,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,KAAK,gBAAgB;YAAE,MAAM,IAAI,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/G,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,aAAsB;QAC/B,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;aAC/B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,KAAK,aAAa,CAAC;aAC5E,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;aACxC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAE7C;IACC,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,aAAqB;YAC7B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC3D,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAC9B,MAAmC,EACnC,wBAAgC;IAEhC,OAAO,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,mBAAmB,KAAK,wBAAwB,CAAC;AAClG,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA2B;IAEnB;IACA;IACA;IAHnB,YACmB,KAA6B,EAC7B,SAA2C,EAC3C,MAAoB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAFlD,UAAK,GAAL,KAAK,CAAwB;QAC7B,cAAS,GAAT,SAAS,CAAkC;QAC3C,QAAG,GAAH,GAAG,CAA+C;IAClE,CAAC;IAEJ,uEAAuE;IACvE,KAAK,CAAC,OAAO,CAAC,aAAqB,EAAE,WAAwC;QAC3E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,YAAY,GAAG,uBAAuB,CAAC,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,UAAU,EAAE,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3F,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,aAAqB,EAAE,QAAgB,EAAE,WAAwC;QAC9F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACpH,IAAI,OAAO,CAAC,kBAAkB,KAAK,WAAW,CAAC,kBAAkB;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACnI,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,YAAY,GAAG,uBAAuB,CAAC,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC9G,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,UAAU,CAAC,aAAqB,EAAE,QAAgB;QACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc;YAAE,OAAO,OAAO,CAAC;QACtD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,GAAgC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;QACrI,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,aAAqB;QACjC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAkC,EAAE,CAAC;QACpD,KAAK,MAAM,MAAM,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,mBAAmB,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;gBAC9F,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAgC;gBACxC,GAAG,MAAM;gBACT,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC;gBAC7B,OAAO,EAAE,CAAC,+BAA+B,MAAM,CAAC,mBAAmB,sCAAsC,aAAa,CAAC,WAAW,EAAE,CAAC;aACtI,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,QAAQ,CAAC,aAAqB;QAClC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QAC/D,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;IACxH,CAAC;IAED,GAAG,GAAG,CAAC,aAAqB,EAAE,QAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC3F,IAAI,GAAG,CAAC,aAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAElE,OAAO,CACL,EAAU,EACV,aAAqB,EACrB,YAAgC,EAChC,QAAgB,EAChB,SAAiB,EACjB,EAAU;QAEV,MAAM,MAAM,GAA4B,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvF,OAAO;YACL,EAAE;YACF,aAAa;YACb,UAAU,EAAE,YAAY;YACxB,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,mBAAmB,EAAE,YAAY,CAAC,WAAW,EAAE,mBAAmB,IAAI,EAAE;YACxE,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,sEAAsE;YACtE,2DAA2D;YAC3D,mBAAmB,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YAC/E,oBAAoB,EAAE,YAAY,CAAC,QAAQ,CAAC,UAAU;YACtD,MAAM;YACN,QAAQ;YACR,SAAS;YACT,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,aAAqB;QACxC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,aAAa,GAAG,CAAC,CAAC;QAC9E,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,aAAqB,EAAE,QAAgB;QACrD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,GAAG,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/vendor/@appport/core/dist/application.d.ts

@@ -0,0 +1,124 @@
+import { type AppEventEnvelope, type AppPortManifest, type AppRequest, type AppResponse, type AppStreamRequest, type ApplicationDescriptor, type MaterializationDeclaration, type Principal, type Session, type TransportDescriptor } from "../../protocol/dist/index.d.ts";
+import { type Authorizer } from "../../authorization/dist/index.d.ts";
+import type { AnyCapability, AnyEvent, CapabilityDefinition, EventDefinition } from "./capability.js";
+import { CapabilityRegistry } from "./registry.js";
+import { EventBus, type EventFilter, type EventListener, type Unsubscribe } from "./events.js";
+import { type EmitEventInput, type Logger } from "./context.js";
+import { type SessionStore } from "./sessions.js";
+import { type IdempotencyStore } from "./idempotency.js";
+import { type TelemetrySink } from "./telemetry.js";
+import { type RuntimeMode } from "./sanitize.js";
+import type { VerificationResult } from "./assembly.js";
+export declare const DEFAULT_TIMEOUT_MS = 30000;
+export declare const DEFAULT_MAX_TIMEOUT_MS = 120000;
+export interface ApplicationOptions {
+    application: ApplicationDescriptor;
+    capabilities?: ReadonlyArray<AnyCapability>;
+    events?: ReadonlyArray<AnyEvent>;
+    /** Defaults to allow-all, which is only appropriate locally (§37, §38). */
+    authorizer?: Authorizer;
+    sessions?: SessionStore;
+    idempotency?: IdempotencyStore;
+    telemetry?: TelemetrySink;
+    logger?: Logger;
+    /** Controls error sanitization and output validation (§16, §49). */
+    mode?: RuntimeMode;
+    defaultTimeoutMs?: number;
+    maxTimeoutMs?: number;
+    /** Validate handler output. Defaults to true in development, true in production too. */
+    validateOutput?: boolean;
+    /** Application services made available on the handler context. */
+    services?: Record<string, unknown>;
+    /** Optional storage handle surfaced as `context.db` (§10, §66). */
+    db?: unknown;
+    /** Transports advertised in the manifest (§40). */
+    transports?: TransportDescriptor[];
+    /** Protocol declaration of supported materialization targets; AppPort does not select or execute them. */
+    materialization?: MaterializationDeclaration;
+    extensions?: string[];
+    /**
+     * Registers the reserved `appport.manifest` and `appport.ping` capabilities so
+     * discovery works on transports without URLs. Defaults to true.
+     */
+    builtins?: boolean;
+}
+/** Per-request inputs supplied by the transport layer. */
+export interface DispatchOptions {
+    session?: Session;
+    principal?: Principal;
+    /** Transport kind, recorded for telemetry only — never for trust (§52). */
+    transport?: string;
+    /** External abort (connection closed, client cancelled). */
+    signal?: AbortSignal;
+}
+/** A running stream capability invocation. */
+export interface StreamExecution {
+    readonly streamId: string;
+    readonly requestId: string;
+    /** Validated chunks. Throws {@link AppPortError} on failure. */
+    readonly chunks: AsyncIterable<unknown>;
+    /** Requests best-effort termination of the underlying operation (§21). */
+    cancel(reason?: string): void;
+}
+/**
+ * The AppPort capability runtime.
+ *
+ * It owns the dispatch pipeline described in §48 — receive, validate,
+ * authorize, execute, serialize, respond — and knows nothing about transports.
+ * Servers and transports feed it envelopes and carry the results.
+ */
+export declare class AppPortApplication {
+    #private;
+    readonly registry: CapabilityRegistry;
+    readonly bus: EventBus;
+    readonly descriptor: ApplicationDescriptor;
+    readonly sessions: SessionStore;
+    readonly logger: Logger;
+    readonly mode: RuntimeMode;
+    constructor(options: ApplicationOptions);
+    /** Registers a capability after construction. */
+    capability<Input, Output>(definition: CapabilityDefinition<Input, Output>): this;
+    /** Registers an event definition after construction. */
+    event<Payload>(definition: EventDefinition<Payload>): this;
+    /** Advertises an additional transport in the manifest (§40). */
+    advertiseTransport(descriptor: TransportDescriptor): this;
+    manifest(): AppPortManifest;
+    /**
+     * Verifies the application assembly for coherence and completeness (PR18).
+     *
+     * Checks:
+     * - All capabilities in the registry are structurally valid
+     * - All capabilities have implementations (explicit, definition-bound, or handler)
+     * - No orphan or duplicate implementations
+     *
+     * Returns a VerificationResult with ready state and detailed issues.
+     *
+     * NOTE: This runtime verification accepts both explicit implementations
+     * and legacy handlers (PR17) for backward compatibility.
+     *
+     * CRITICAL: Verification never executes business logic. It is purely structural.
+     */
+    verify(): VerificationResult;
+    /** Subscribes to application events (§18). */
+    subscribe(filter: EventFilter | string, listener: EventListener, subscriptionId?: string): Unsubscribe;
+    /** Publishes an application event outside of a capability handler. */
+    emit(input: EmitEventInput, options?: {
+        traceId?: string;
+    }): Promise<AppEventEnvelope>;
+    /**
+     * Executes a request capability and produces a response envelope.
+     * Never throws for application-level failures: every outcome is an envelope.
+     */
+    handleRequest(request: AppRequest, options?: DispatchOptions): Promise<AppResponse>;
+    /**
+     * Starts a stream capability. Protocol errors that occur before the first
+     * chunk are thrown so the transport can answer with an error response rather
+     * than an empty stream.
+     */
+    handleStreamRequest(request: AppStreamRequest, options?: DispatchOptions): Promise<StreamExecution>;
+    /** Releases every stream and subscription. */
+    close(): Promise<void>;
+}
+/** Creates an {@link AppPortApplication}. */
+export declare function createApplication(options: ApplicationOptions): AppPortApplication;
+//# sourceMappingURL=application.d.ts.map

package/vendor/@appport/core/dist/application.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application.d.ts","sourceRoot":"","sources":["../src/application.ts"],"names":[],"mappings":"AAAA,OAAO,EAUL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAG1B,KAAK,0BAA0B,EAC/B,KAAK,SAAS,EAEd,KAAK,OAAO,EACZ,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,MAAM,EACZ,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAuC,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAuB,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAG7E,eAAO,MAAM,kBAAkB,QAAS,CAAC;AACzC,eAAO,MAAM,sBAAsB,SAAU,CAAC;AAE9C,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,qBAAqB,CAAC;IACnC,YAAY,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wFAAwF;IACxF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,mEAAmE;IACnE,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,mDAAmD;IACnD,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACnC,0GAA0G;IAC1G,eAAe,CAAC,EAAE,0BAA0B,CAAC;IAC7C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,8CAA8C;AAC9C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,0EAA0E;IAC1E,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAOD;;;;;;GAMG;AACH,qBAAa,kBAAkB;;IAC7B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;gBAkBf,OAAO,EAAE,kBAAkB;IA4BvC,iDAAiD;IACjD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI;IAKhF,wDAAwD;IACxD,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,IAAI;IAK1D,gEAAgE;IAChE,kBAAkB,CAAC,UAAU,EAAE,mBAAmB,GAAG,IAAI;IASzD,QAAQ,IAAI,eAAe;IAS3B;;;;;;;;;;;;;;OAcG;IACH,MAAM,IAAI,kBAAkB;IA6B5B,8CAA8C;IAC9C,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,WAAW;IAItG,sEAAsE;IAChE,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiChG;;;OAGG;IACG,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,WAAW,CAAC;IAsG7F;;;;OAIG;IACG,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;IA2F7G,8CAA8C;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA0M7B;AAQD,6CAA6C;AAC7C,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,kBAAkB,CAEjF"}