@pulse-compute/cli 0.0.0 → 1.0.0-beta.2

package/docs/packages/cli.md

@@ -0,0 +1,190 @@
+# `@pulse-compute/cli`
+
+`@pulse-compute/cli` owns the supported `pulse` command, project configuration types, project discovery, compilation workflow, local execution, and target builds.
+
+## Install and initialize
+
+The current repository CLI is a source candidate. Its conventional initializer
+depends on the public `@pulse-compute/pulse` package and is validated from both
+the checkout and the exact packed acceptance set:
+
+```bash
+pnpm pulse -- init ./my-app
+cd ./my-app
+npm install
+pulse doctor
+```
+
+`pulse init` writes a conventional `.pulse/config.ts` workspace, an async
+`Pulse` application root, a dedicated `tests/pulse.harness.ts`, strict
+TypeScript configuration, and exact source-candidate package versions. It does
+not run a package manager or perform hidden network work. Public npm
+availability is defined by the synchronized 18-package release manifest.
+
+## Daily workflow
+
+```bash
+pulse doctor
+pulse inspect
+pulse test
+pulse dev
+pulse compile
+pulse build
+```
+
+- `doctor` validates project, provider, dependencies, and external toolchain readiness.
+- `inspect` compiles and reports effects, continuations, schemas, event registrations/callsites, capabilities, target eligibility, and provider lowering without executing cases.
+- `test` executes configured request and explicit `kind: 'event'` cases through the provider-owned local conformance runtime.
+- `dev` runs a foreground local server and watches the project by default.
+- `compile` writes deterministic provider-neutral Pulse Wasm plus its native plan, generated AssemblyScript, WAT, and manifests.
+- `build` writes the configured target realization: Native profiles emit provider Wasm, while JavaScript profiles emit deterministic source packages. Eligible event projects also emit `event-catalog.json` and `event-inspection.json` beside the target output. Fastly JavaScript packages carry exact downstream compiler pins and deployment-candidate metadata.
+
+See the generated [CLI reference](../reference/cli.md) for every option, positional form, output, side effect, and exit behavior.
+
+## Project configuration
+
+```ts
+import { defineConfig } from '@pulse-compute/pulse'
+
+export default defineConfig((_scope) => ({
+  pulse: {
+    entry: 'src/index.ts',
+    tests: 'tests/pulse.harness.ts',
+    defaultProfile: 'local',
+    strict: true,
+  },
+  local: {
+    host: 'node',
+    target: 'native',
+    outDir: 'dist',
+    dev: { host: '127.0.0.1', port: 8787 },
+  },
+}))
+```
+
+The generated application imports `Pulse` from `@pulse-compute/pulse`, declares
+managed handlers `async`, and keeps deterministic request cases in the separate
+harness module. Workspace discovery starts from `.pulse/config.ts`.
+
+Harness event cases require the explicit `kind: 'event'` discriminant, one
+canonical input frame, and an ordered exact `expect.emitted` array. HTTP cases
+retain their existing shape and default behavior. There is no public `pulse
+event` command and `pulse dev` remains HTTP-only.
+
+The complete event workflow, queue, artifact, target, and diagnostic boundary
+is in [Static events and outbound emission](../guides/events.md).
+
+## Machine-readable contracts and shell completion
+
+The installed package exposes release-owned machine interfaces for editors, automation, validation, and documentation tooling:
+
+| Export or command | Contract |
+|---|---|
+| `pulse completion bash` | Bash completion generated from the public command specification. |
+| `pulse completion zsh` | Zsh completion generated from the same specification. |
+| `pulse completion fish` | Fish completion generated from the same specification. |
+| `@pulse-compute/cli/cli-spec.json` | Seven commands, public options, aliases, positional forms, provider restrictions, output modes, and completion metadata. |
+| `@pulse-compute/cli/project-config.schema.json` | JSON Schema bundle plus discovery, precedence, defaults, runtime rules, and provider configuration schemas. |
+| `@pulse-compute/cli/release-manifest.json` | Exact release, hosted-documentation routes, package tiers, supported entry points, and publication policy. |
+| `@pulse-compute/cli/documentation-versions.json` | Available documentation versions and the current `latest` target. |
+| `@pulse-compute/cli/project-config-schema` | Programmatic schema, defaults, structural validation, and reference metadata. |
+
+These files are generated from the same modules used by the parser, runtime configuration loader, package packer, and documentation release gate. See [Shell completion](../reference/shell-completion.md), the [CLI specification](../reference/cli-spec.json), the [project configuration schema](../reference/project-config.schema.json), and the [release manifest reference](../maintainers/release-manifest.md).
+
+## Public entry points
+
+The supported package surface is:
+
+| Entry point | Intended use |
+|---|---|
+| `pulse` binary | Application and CI workflow. |
+| `@pulse-compute/cli` | `defineConfig`, project-config types, diagnostics helper, and programmatic workflow entry. |
+| `@pulse-compute/cli/workflow` | CLI parsing and execution integration. |
+| `@pulse-compute/cli/project-config` | Project discovery and normalization integration. |
+| `@pulse-compute/cli/project-execution` | Canonical doctor/inspect/test/dev/compile/build orchestration. |
+| `@pulse-compute/cli/diagnostics` | Stable public diagnostic descriptors and mappings. |
+
+Other files present in the tarball are not automatically public APIs.
+
+## JSON output
+
+Completed commands emit one JSON object with a trailing newline when `--json` is used. `pulse dev --json` emits newline-delimited event objects instead of one enclosing document. Supported events include `compiled`, `ready`, `reloaded`, `request`, `compile-error`, and `request-error`.
+
+Stable failures include a public diagnostic code, remediation, exit class, and exact-version documentation URL. See [Diagnostics and remediation](../reference/diagnostics.md).
+
+## Provider behavior
+
+The CLI supports `node`, `fastly`, and compile-only `none`. Node and Fastly each
+accept an explicit `native` or `javascript` execution target:
+
+- Node Native lowers to Pulse-owned Wasm and executes through the Node host.
+- Node JavaScript loads the reachable application graph and runs the live runtime and package implementations.
+- Fastly Native emits compact direct-host-ABI `bin/main.wasm`.
+- Fastly JavaScript emits a deterministic source/deployment package and a structurally deployable downstream runtime candidate.
+- `none` can inspect or compile canonical output but cannot serve or run tests.
+
+For projects with reachable event registrations or `ctx.emit` callsites, Node
+Native and Node JavaScript are eligible for the bounded reference workflow.
+`inspect`, `doctor`, compile/build manifests, and event inspection artifacts
+report the catalog, schema IDs, callsites, host requirements, and per-command
+target support. `none` remains useful for compile-only catalog inspection.
+Fastly Native and JavaScript fail closed with exact event-ingress or event-emit
+diagnostics; Pulse does not translate that plane through HTTP or GRIP and never
+changes targets automatically.
+
+`pulse compile` is provider-neutral regardless of the configured provider. It produces the portable Pulse-owned Wasm boundary directly; `pulse build` continues to own provider realization.
+
+Those provider IDs are configuration data, not command-layer implementation
+branches. The CLI consumes a neutral facade over the compiler-owned fixed
+registry; concrete provider imports, configuration policy, and target adapters
+remain outside the CLI package. Node retains a deliberate reference/smoke role
+for canonical Native behavior.
+
+Both JavaScript declarations satisfy full-target-support and report general
+availability. Project eligibility remains separate, and target selection never
+falls back automatically. Fastly JavaScript `test` and `dev` identify their
+execution mode as provider emulation; the offline candidate gate compiles a real
+Fastly JavaScript runtime artifact but performs no deployment or publication.
+
+Provider and target selection change realization, not handler APIs. See
+[Contracts and providers](../concepts/contracts-and-providers.md).
+
+## Installed documentation payload
+
+The CLI npm package ships:
+
+- this public documentation hierarchy;
+- the canonical API reference;
+- CLI, configuration, diagnostics, environment, release, and version references;
+- generated command/config/release machine interfaces and shell completions;
+- package and contributor guides;
+- ten complete lifecycle example projects plus the focused Entities candidate,
+  including static Router lowering and mixed HTTP/event authoring.
+
+This makes diagnostic links and package README links usable from an installed exact-version release rather than depending on monorepo paths.
+
+## Safety boundaries
+
+- Build output must remain a real descendant of the project root.
+- `--no-clean` does not disable traversal or symbolic-link safety checks.
+- Raw configured secrets are redacted from public JSON and diagnostics.
+- `dev` is a foreground process, not a hidden daemon.
+- Repository-only fixture/profile/task flags are excluded from installed help and the public reference.
+- Fastly external execution is delegated to the Fastly CLI; the reality gate may pass an inspected Viceroy path, but Pulse does not launch Viceroy directly.
+
+## Related documentation
+
+- [Getting started](../getting-started.md)
+- [Project lifecycle](../guides/project-lifecycle.md)
+- [Static events and outbound emission](../guides/events.md)
+- [Provider and target compatibility](../reference/compatibility-matrix.md)
+- [Managed handler TypeScript and JavaScript](../reference/handler-authoring.md)
+- [Node build and execution](../guides/deploying-node.md)
+- [Fastly deployment candidates](../guides/deploying-fastly.md)
+- [CLI reference](../reference/cli.md)
+- [Shell completion](../reference/shell-completion.md)
+- [Project configuration](../reference/project-config.md)
+- [Release manifest and package policy](../maintainers/release-manifest.md)
+- [Documentation versioning](../maintainers/documentation-versioning.md)
+- [Environment-variable reference](../reference/environment.md)
+- [Release acceptance](../maintainers/release-acceptance.md)

package/docs/packages/crypto.md

@@ -0,0 +1,78 @@
+# `@pulse-compute/crypto`
+
+`@pulse-compute/crypto` provides bounded, provider-neutral cryptographic
+verification for Pulse applications and first-party capability packages.
+
+```bash
+npm install @pulse-compute/crypto@1.0.0-beta.2
+```
+
+## Verification surface
+
+Applications may import the package root and request MAC or signature
+verification. Inputs are explicit bytes; the package does not perform ambient
+string encoding or expose backend objects.
+
+```ts
+import { crypto } from '@pulse-compute/crypto'
+
+const result = await crypto.mac.verify({
+  algorithm: 'HS256',
+  key: {
+    type: 'hmac-key-bytes',
+    bytes: secretBytes,
+  },
+  data: messageBytes,
+  tag: authenticatorBytes,
+})
+```
+
+The result is one frozen status:
+
+- `valid`
+- `invalid-authenticator`
+- `invalid-key`
+- `invalid-input`
+- `realization-failure`
+
+HS256 accepts bounded key, data, and authenticator bytes. ES256 accepts an
+exact P-256 public point, the original signing input bytes, and an exact JOSE
+signature. Neither algorithm retries another realization after failure.
+
+## Profiles and realization
+
+Profiles declare the exact algorithms a project may use:
+
+```ts
+export default {
+  prod: {
+    crypto: ['HS256', 'ES256'],
+  },
+}
+```
+
+Planning proves that reachable demand is covered by the selected profile and
+target capability. JavaScript providers use their selected Web Crypto
+realization. Native compilation links the selected first-party guest
+realization. Target probing and automatic fallback are prohibited.
+
+## Boundary
+
+Native capability packages can also select `SHA-256` and `HMAC-SHA256` for
+internal byte output. Their exact `guest-source:pulse-hmac-as` realization uses
+32-byte output, at most 32 KiB of data and 8 KiB of HMAC key material. Crypto owns
+a reusable, wiped host staging frame. These operations are separate from JWT's
+32-byte minimum HMAC verification key; the application verification API retains
+its existing limits. JavaScript byte-output realization is not implemented yet.
+
+The package root is the supported application contract. Native integration,
+guest provenance, and realization records are toolchain-owned surfaces. JWT
+owns compact-JWS parsing, key selection, and claims semantics; this package
+owns normalized cryptographic verification.
+
+## Related material
+
+- [JWT verification](./jwt.md)
+- [Project configuration](../reference/project-config.md)
+- [Provider and target compatibility](../reference/compatibility-matrix.md)
+- [Package-owned lowering](../concepts/package-owned-lowering.md)

package/docs/packages/entities.md

@@ -0,0 +1,129 @@
+# `@pulse-compute/entities`
+
+`@pulse-compute/entities` provides bounded, statically declared, schema-bound
+operations through the first-party JSON-RPC adapter.
+
+```bash
+npm install @pulse-compute/entities@1.0.0-beta.2
+```
+
+## Declare an entity router
+
+```ts
+import { EntityRouter, jsonRpc } from '@pulse-compute/entities'
+
+const rpc = new EntityRouter({
+  adapter: jsonRpc({ namedParamsOnly: true }),
+})
+
+rpc.on('customer.lookup', {
+  input: 'tools.CustomerLookupInput',
+  output: 'tools.CustomerLookupOutput',
+  metadata: {
+    title: 'Look up customer',
+    description: 'Returns one customer from the governed directory backend.',
+  },
+}, lookupCustomer)
+
+export default function handler(ctx: unknown) {
+  return rpc.handle(ctx as never)
+}
+```
+
+`input` and `output` are literal schema IDs declared by the selected Pulse
+project, or `null`. A `null` input passes `undefined` to the handler; a `null`
+output requires `undefined` and becomes JSON `null`. Metadata must be bounded,
+static JSON. Handlers must be resolvable named references and may use the same
+governed `ctx` effects as ordinary managed handlers.
+
+The compiler recognizes a deliberately narrow static form: one module-level
+router, an inline first-party adapter declaration, standalone module-level
+registrations, and one terminal request binding. It rejects aliases, dynamic
+names, computed schema IDs, conditional registration, chained registration,
+and multiple request-body owners.
+
+## JSON-RPC behavior
+
+The first adapter accepts JSON-RPC 2.0 request objects and named object params.
+It does not accept batches or positional params. It selects an entity before
+schema decoding, invokes the handler once, validates output, and emits stable
+JSON-RPC failures without application exception details.
+
+| Input | HTTP result | JSON-RPC result |
+|---|---:|---|
+| Valid request with `id` | `200` | `result` or a stable `error` with the same `id` |
+| Notification without `id` | `204` | Empty body after synchronous completion |
+| Unknown method | `200` | `-32601` / `Method not found` |
+| Invalid params or schema input | `200` | `-32602` / `Invalid params` |
+| Handler or output failure | `200` | `-32603` / `Internal error` |
+| Malformed JSON | `200` | `-32700` / `Parse error` |
+
+`acceptEmptyObjectForNoInput: true` additionally permits `{}` for an operation
+whose input is `null`. `namedParamsOnly` can only be `true` in this contract.
+
+## Inspect and release evidence
+
+Inspect the static declaration and run the focused candidate proof from this
+source checkout:
+
+```bash
+pulse inspect
+node wasm/scripts/run-wasm-tests.cjs --task entities-orchestration-demo --no-report
+```
+
+`pulse inspect` reports the entity plan, deterministic catalog, schema linkage,
+redacted handler effects, and target evidence. A successful build writes:
+
+- `entities-catalog.json`: protocol-neutral discovery metadata;
+- `entities-inspection.json`: declarations, handler identities/effects, and
+  eligibility/measured-execution evidence.
+
+Both artifacts are static and checkout-independent. They intentionally omit
+request/runtime values, request IDs, raw payloads, resolved secrets, and
+provider objects. Consumers such as a tools facade should project discovery
+from the catalog and invoke a governed adapter boundary; they should not gain a
+direct handler or runtime-registry API.
+
+## Target status
+
+| Mode | Beta evidence | Important boundary |
+|---|---|---|
+| Node JavaScript | Measured execution | Package JavaScript runtime |
+| Fastly JavaScript | Measured with Viceroy 0.20.1 | Provider JavaScript package/runtime |
+| Node Native | Measured execution | Package-owned Native source |
+| Fastly Native | Measured with Viceroy 0.20.1 | Explicit provider-owned adapter; not the ordinary project build path |
+
+Native remains `provider-dependent`, and every target keeps automatic fallback
+disabled. The complete matrix is in [Provider and target compatibility](../reference/compatibility-matrix.md).
+
+## Diagnostics
+
+These codes are package-owned entries in the synchronized Beta diagnostic
+catalog.
+
+| Code or family | Meaning | Remediation |
+|---|---|---|
+| `PULSE_ENTITIES_ADAPTER_STATIC_REQUIRED` | Router/adapter declaration is not the supported static form. | Construct one module-level `const` router with inline `adapter: jsonRpc(...)`. |
+| `PULSE_ENTITIES_ADAPTER_UNSUPPORTED` | The adapter is not the first-party JSON-RPC adapter. | Use `jsonRpc()`; third-party adapter authoring is not open. |
+| `PULSE_ENTITIES_ADAPTER_OPTIONS_INVALID` | Adapter options are unknown or dynamic. | Use literal `namedParamsOnly: true` and an optional literal boolean `acceptEmptyObjectForNoInput`. |
+| `PULSE_ENTITIES_DISCRIMINATOR_STATIC_REQUIRED`, `..._INVALID`, `..._DUPLICATE` | An operation name is dynamic, malformed, or repeated. | Use one unique bounded string literal per router. |
+| `PULSE_ENTITIES_SCHEMA_MISSING`, `..._ID_INVALID` | `input`/`output` is absent or not a declared literal schema ID/`null`. | Declare both fields and synchronize the project schema registry. |
+| `PULSE_ENTITIES_HANDLER_UNRESOLVED`, `..._INVALID` | The handler is not a resolvable named function. | Pass a named module-level function reference. |
+| `PULSE_ENTITIES_REGISTRATION_UNSUPPORTED` | Registration is conditional, nested, chained, or otherwise dynamic. | Use standalone module-level `rpc.on(...)` statements. |
+| `PULSE_ENTITIES_BINDING_UNSUPPORTED` | The request binding is not one terminal `return rpc.handle(ctx)`. | Return the call directly from the request handler. |
+| `PULSE_ENTITIES_BODY_CONSUMER_CONFLICT` | Another owner also consumes the request body. | Give the entity adapter exclusive ownership of the request body. |
+| `PULSE_ENTITIES_METADATA_INVALID`, `PULSE_ENTITIES_LIMIT_INVALID`, `PULSE_ENTITIES_LIMIT_EXCEEDED` | Static metadata or bounded data exceeds the contract. | Reduce or correct the declaration; limits are package-owned and not app-configurable. |
+| `PULSE_ENTITIES_TARGET_INELIGIBLE` | The chosen provider/target cannot realize the declaration. | Select an evidenced mode or supply the separately governed provider integration. Never rely on fallback. |
+
+Malformed envelopes can additionally produce bounded scanner codes such as
+`PULSE_ENTITIES_JSON_MALFORMED`, `PULSE_ENTITIES_JSON_TOO_DEEP`,
+`PULSE_ENTITIES_ENVELOPE_TOO_LARGE`, and
+`PULSE_ENTITIES_PAYLOAD_TOO_LARGE`. Clients receive only the stable JSON-RPC
+mapping, while provider observability records a redacted failure category.
+
+## Related material
+
+- [Entity engine, adapters, and facades](../concepts/entities-and-adapters.md)
+- [Canonical API](../../API.md#entities-api)
+- [Entities lowering maintainer reference](../contributing/entities-lowering.md)
+- [Executable Entities tools example](../../examples/10-entities-tools/)

package/docs/packages/grip.md

@@ -0,0 +1,82 @@
+# `@pulse-compute/grip`
+
+`@pulse-compute/grip` provides stateless HTTP framing for an external GRIP/Fanout gateway. Pulse does not own WebSocket objects, connection registries, backpressure, reconnect behavior, or connection-length continuations. The gateway owns the open connection; Pulse classifies requests, returns subscription or handoff instructions, and emits outbound broadcast effects.
+
+## Install
+
+```bash
+npm install @pulse-compute/grip@1.0.0-beta.2
+```
+
+## Package-root API
+
+```ts
+import { Router } from '@pulse-compute/runtime'
+import { grip } from '@pulse-compute/grip'
+
+const app = new Router()
+
+app.get('/events/:accountId', async (ctx) => {
+  const channel = `account:${ctx.param('accountId')}`
+
+  if (grip.isWebSocket(ctx.req)) {
+    return grip.handoff({ channel })
+  }
+
+  return grip.subscribe(
+    new Response(null, { status: 200 }),
+    { channel, mode: 'stream' },
+  )
+})
+
+app.post('/publish/:accountId', async (ctx) => {
+  const data = await ctx.req.json()
+  await grip.broadcast(ctx, {
+    channel: `account:${ctx.param('accountId')}`,
+    data,
+  })
+  return ctx.json({ accepted: true }, { status: 202 })
+})
+
+export default app
+```
+
+The root API separates pure HTTP behavior from provider interaction:
+
+- `grip.isWebSocket(request)` — pure request classification;
+- `grip.subscribe(response, options)` — pure response decoration with GRIP subscription headers;
+- `grip.handoff(options)` — pure HTTP response construction for gateway handoff;
+- `grip.broadcast(ctx, message)` — request-bound outbound effect, directly awaitable and valid inside `ctx.parallel({ ... })`.
+
+## Realization boundary
+
+The canonical root has bounded JavaScript and Native framing realization.
+Configured Node and Fastly providers realize `grip.broadcast`; a missing publish
+capability fails with a stable capability-required diagnostic rather than
+falling back or taking ownership of a connection. Native options and messages
+must use supported static shapes, and unsupported expressions fail at the exact
+source boundary.
+
+The publish/control endpoint, named backend, authentication, and optional
+trusted-proxy verification are provider-owned configuration. Public gateway
+URLs and ingress routes are separate. Configuration stores only secret
+references; values remain inside the shared secret/redaction boundary.
+
+Cross-target conformance covers framing, cancellation, bounds,
+acknowledgements, redaction, and deterministic Node/Fastly provider artifacts.
+This bounded realization is included in both generally available JavaScript
+targets.
+
+## Compatibility Native facade
+
+`@pulse-compute/grip/pulsewasm` remains a compatibility surface for the Native
+`channel`, `hold`, and `publish` contract. It is not the recommended API for
+new applications and is not evidence that Pulse owns WebSocket lifecycle. See
+[Compatibility imports and migration](../guides/compatibility-imports.md).
+
+## Related documentation
+
+- [GRIP and Fanout guide](../guides/grip.md)
+- [Contracts and providers](../concepts/contracts-and-providers.md)
+- [Package-owned lowering](../concepts/package-owned-lowering.md)
+- [Diagnostics](../reference/diagnostics.md)

package/docs/packages/implementation-packages.md

@@ -0,0 +1,122 @@
+# Implementation packages
+
+<!-- Generated by wasm/scripts/sync-reference-docs.cjs. Edit the source catalog, not this file. -->
+
+These packages are synchronized parts of the release set for compiler, provider, runtime, and package-lowering maintainers. They are not application-author SDKs.
+
+The package status and supported entry-point lists below come from the synchronized Pulse 1.0.0-beta.2 release policy.
+
+## `@pulse-compute/wasm-build-support`
+
+Pulse release-set and compiler maintainers.
+
+- **npm:** [`@pulse-compute/wasm-build-support`](https://www.npmjs.com/package/@pulse-compute/wasm-build-support)
+- **Install directly:** No for application projects; it is installed transitively where required.
+- **Stability:** Internal release-set interface; exported modules may change with compiler implementation needs.
+
+### Supported entry points
+
+- `None for application authors.`
+
+## `@pulse-compute/wasm-compiler`
+
+Pulse compiler and release maintainers.
+
+- **npm:** [`@pulse-compute/wasm-compiler`](https://www.npmjs.com/package/@pulse-compute/wasm-compiler)
+- **Install directly:** No for application projects; use the pulse CLI.
+- **Stability:** Internal compiler interface; no application-author compatibility guarantee.
+- **Canonical replacement:** `@pulse-compute/cli`
+
+### Supported entry points
+
+- `None for application authors.`
+
+## `@pulse-compute/wasm-guest-link`
+
+Pulse compiler, release, and first-party guest-unit maintainers.
+
+- **npm:** [`@pulse-compute/wasm-guest-link`](https://www.npmjs.com/package/@pulse-compute/wasm-guest-link)
+- **Install directly:** No for application projects; it is an internal synchronized compiler dependency.
+- **Stability:** Internal first-party prebuilt guest-link interface synchronized with the compiler; no application-author or third-party guest compatibility guarantee.
+
+### Supported entry points
+
+- `None for application authors.`
+
+## `@pulse-compute/wasm-contracts`
+
+Pulse compiler, runtime, provider, and package-lowering maintainers.
+
+- **npm:** [`@pulse-compute/wasm-contracts`](https://www.npmjs.com/package/@pulse-compute/wasm-contracts)
+- **Install directly:** Provider toolchain authors may install it for the versioned bootstrap contract; application projects receive it transitively.
+- **Stability:** The provider toolchain contract is versioned and supported for the Beta; other protocol and proof interfaces remain internal.
+
+### Supported entry points
+
+- `@pulse-compute/wasm-contracts/provider/toolchain`
+
+## `@pulse-compute/wasm-host-runtime`
+
+Pulse host-runtime and provider maintainers.
+
+- **npm:** [`@pulse-compute/wasm-host-runtime`](https://www.npmjs.com/package/@pulse-compute/wasm-host-runtime)
+- **Install directly:** No for application projects; it is installed transitively.
+- **Stability:** Internal compiler/runtime interface synchronized with this release set.
+
+### Supported entry points
+
+- `None for application authors.`
+
+## `@pulse-compute/wasm-library-kit`
+
+Pulse package-lowering and compiler maintainers.
+
+- **npm:** [`@pulse-compute/wasm-library-kit`](https://www.npmjs.com/package/@pulse-compute/wasm-library-kit)
+- **Install directly:** No for application projects; it is installed transitively.
+- **Stability:** Internal package-lowering interface synchronized with this release set.
+
+### Supported entry points
+
+- `None for application authors.`
+
+## `@pulse-compute/provider-node`
+
+Pulse canonical Node provider and compiler maintainers.
+
+- **npm:** [`@pulse-compute/provider-node`](https://www.npmjs.com/package/@pulse-compute/provider-node)
+- **Install directly:** No for application projects; select provider: node through the CLI.
+- **Stability:** The listed built-in toolchain entry is synchronized with the Beta bootstrap contract; other canonical Node provider interfaces remain internal.
+- **Canonical replacement:** `provider: 'node' through @pulse-compute/cli`
+
+### Supported entry points
+
+- `@pulse-compute/provider-node/toolchain`
+
+## `@pulse-compute/wasm-runtime-core-as`
+
+Pulse AssemblyScript runtime-core and compiler maintainers.
+
+- **npm:** [`@pulse-compute/wasm-runtime-core-as`](https://www.npmjs.com/package/@pulse-compute/wasm-runtime-core-as)
+- **Install directly:** No for application projects; it is installed transitively.
+- **Stability:** Internal code-generation interface synchronized with this release set.
+
+### Supported entry points
+
+- `None for application authors.`
+
+## `@pulse-compute/wasm-schema-json`
+
+Pulse schema compiler and runtime maintainers.
+
+- **npm:** [`@pulse-compute/wasm-schema-json`](https://www.npmjs.com/package/@pulse-compute/wasm-schema-json)
+- **Install directly:** No for application projects; declare schemas in the selected .pulse/config.ts profile.
+- **Stability:** Internal schema compiler interface synchronized with this release set.
+- **Canonical replacement:** `schemas in .pulse/config.ts through the Pulse project workflow`
+
+### Supported entry points
+
+- `None for application authors.`
+
+## Support boundary
+
+Only the entry points explicitly listed above carry the stated release promise. Exported implementation subpaths are not promoted into application-author APIs merely because npm can resolve them.

package/docs/packages/jwt.md

@@ -0,0 +1,55 @@
+# `@pulse-compute/jwt`
+
+`@pulse-compute/jwt` provides bounded, provider-neutral JWT verification for
+Pulse handlers.
+
+```bash
+npm install @pulse-compute/jwt@1.0.0-beta.2
+```
+
+## Verify a bearer token
+
+```ts
+import { jwt } from '@pulse-compute/jwt'
+
+const verified = await jwt.verify(
+  ctx,
+  jwt.bearer(ctx.req),
+  {
+    algorithms: ['HS256'],
+    key: { type: 'secret', binding: 'JWT_SECRET' },
+    issuer: 'https://issuer.example',
+    audience: 'pulse-api',
+  },
+)
+```
+
+The provider resolves request-owned secret material and passes bounded bytes to
+`@pulse-compute/crypto`. JWT authenticates the compact JWS before exposing
+claims, captures one wall-clock instant after authenticity, evaluates
+registered claims, and then applies an optional runtime schema. Results are
+detached and deeply frozen.
+
+## Algorithms and keys
+
+The Beta supports HS256 and ES256 verification. ES256 accepts inline public
+P-256 JWKs or static JWKS values with at most 16 entries. Key selection is
+deterministic and fails closed for duplicate, missing, ambiguous, or unknown
+identities.
+
+RS256, EdDSA, signing, remote discovery, custom crypto providers, and automatic
+fallback are not part of this release.
+
+## Boundary
+
+JWT verifies identity claims; it does not authorize application or host
+behavior. The package root is the supported application contract. Provider,
+compiler, and Native lowering exports are first-party integration surfaces and
+are not application APIs.
+
+## Related material
+
+- [Crypto verification](./crypto.md)
+- [Project configuration](../reference/project-config.md)
+- [Provider and target compatibility](../reference/compatibility-matrix.md)
+- [Package-owned lowering](../concepts/package-owned-lowering.md)