@pulse-compute/wasm-guest-link 1.0.0-beta.4 → 1.0.0-beta.6

package/README.md

@@ -7,9 +7,9 @@
 > **Supported entry points:** `None for application authors.`<br>
 > **Stability:** Internal first-party prebuilt guest-link interface synchronized with the compiler; no application-author or third-party guest compatibility guarantee.<br>
 > **npm:** [`@pulse-compute/wasm-guest-link`](https://www.npmjs.com/package/@pulse-compute/wasm-guest-link)<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.4/packages/implementation-packages/)
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.6/packages/implementation-packages/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.4` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.6` package policy.
 <!-- pulse-package-status:end -->
 
 Internal Pulse implementation package for connecting validated first-party core

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-compute/wasm-guest-link",
-  "version": "1.0.0-beta.4",
+  "version": "1.0.0-beta.6",
   "license": "Apache-2.0",
   "description": "Internal first-party guest-unit validation, materialization, core Wasm composition, optimization, and final audit for Pulse.",
   "type": "commonjs",
@@ -14,7 +14,7 @@
     "./toolchain": "./src/toolchain.js"
   },
   "dependencies": {
-    "@pulse-compute/wasm-contracts": "1.0.0-beta.4",
+    "@pulse-compute/wasm-contracts": "1.0.0-beta.6",
     "binaryen": "129.0.0-nightly.20260428"
   },
   "publishConfig": {
@@ -31,7 +31,7 @@
     "url": "git+https://github.com/pulse-compute/pulse.git",
     "directory": "wasm/packages/wasm-guest-link"
   },
-  "homepage": "https://pulsecompute.io/v1.0.0-beta.4/packages/implementation-packages/",
+  "homepage": "https://pulsecompute.io/v1.0.0-beta.6/packages/implementation-packages/",
   "bugs": {
     "url": "https://github.com/pulse-compute/pulse/issues"
   }

package/src/constants.js

@@ -99,27 +99,28 @@ const es256GuestUnit = Object.freeze({
   id: 'pulse.crypto.es256.rustcrypto-p256.v1',
   module: 'pulse_crypto_es256',
   owner: '@pulse-compute/crypto',
-  packageVersion: '1.0.0-beta.4',
-  abi: 'pulse.crypto.es256.verify.v1',
+  packageVersion: '1.0.0-beta.6',
+  abi: 'pulse.crypto.es256-rs256.verify-and-sign.v3',
   artifact: Object.freeze({
     file: 'prebuilt/es256-verifier.wasm',
-    bytes: 21009,
-    sha256: 'ee5ab1639cbe1be5a9510c01ab15a3569c0394818a9db98f3e0114ae829fff50'
+    bytes: 36378,
+    sha256: 'b1d09f10fddf7587cb9e87f959fa908457e076e207db078fc101390c70e4aecf'
   }),
   source: Object.freeze({
     directory: 'source',
-    treeSha256: '76c8cf985b2ed384d069f7ba0d7ff1c8513679ea7aec513e1a07a3eeaa3b7208'
+    treeSha256: '581fa765f228bd1a3ab6a40ee3cbb35a9d7a101e2839d32e36ececc94b66a741'
   }),
   toolchain: Object.freeze({
     rustc: '1.97.1 (8bab26f4f 2026-07-14)',
     cargo: '1.97.1 (c980f4866 2026-06-30)',
+    zig: '0.13.0',
     binaryen: binaryenVersion
   }),
   provenance: Object.freeze({
-    cargoLockSha256: '7aa8c6d72751653717a371147e71a546d8f21dfcd1cf698919563e79e2946cb4',
-    reconstructionCommandIdentity: 'pulse.crypto.es256.rustcrypto-build.v1',
+    cargoLockSha256: 'd5ecc12c9c846468686974aaed841156cc82ab8f876fec4d40b2baa29dff1551',
+    reconstructionCommandIdentity: 'pulse.crypto.es256-rs256.build.v3',
     buildScript: 'build.cjs',
-    buildScriptSha256: '9d9fe63de85c865467e204c4b078e392a913ee7018c3b8298f1b8689bdb36111',
+    buildScriptSha256: '85d99761b442ec3ea11af6496206f475c14e6c419b5aa89bbedc730d8b61e95d',
     optimizationPosture: 'native-size',
     binaryenWasmOptSha256: '1304eb38ad315a0d70d8427757f641c110d972468c126af645ef800b09c26e56',
     g0SourceDecision: '../../../../wasm/.test-results/jwt-g0/es256-source-decision.json',
@@ -147,6 +148,31 @@ const optimizationPostures = Object.freeze({
   ])
 });
 
+// Keep the pinned prebuilt recipe above unchanged. Composed final modules use
+// these bounded, layout-preserving passes before the existing final audit.
+const finalOptimizationPostures = Object.freeze({
+  'native-default': Object.freeze([
+    '--mvp-features',
+    '--merge-similar-functions',
+    '--one-caller-inline-max-function-size=64',
+    '--flexible-inline-max-function-size=0',
+    '--inline-max-combined-binary-size=1024',
+    '-Oz',
+    '--skip-pass=memory-packing',
+    '--strip-debug'
+  ]),
+  'native-size': Object.freeze([
+    '--mvp-features',
+    '--merge-similar-functions',
+    '--one-caller-inline-max-function-size=64',
+    '--flexible-inline-max-function-size=0',
+    '--inline-max-combined-binary-size=1024',
+    '-Oz',
+    '--skip-pass=memory-packing',
+    '--strip-debug'
+  ])
+});
+
 module.exports = Object.freeze({
   versions,
   binaryenVersion,
@@ -155,5 +181,6 @@ module.exports = Object.freeze({
   memoryAbiV2,
   es256FrameV2,
   es256GuestUnit,
-  optimizationPostures
+  optimizationPostures,
+  finalOptimizationPostures
 });

package/src/contracts.js

@@ -8,7 +8,7 @@ const {
   memoryAbiV2,
   es256FrameV2,
   es256GuestUnit,
-  optimizationPostures
+  finalOptimizationPostures
 } = require('./constants.js');
 const { fail } = require('./errors.js');
 const { assertRelativePath } = require('./files.js');
@@ -198,7 +198,12 @@ function manifestRelativePath(value, field) {
 }
 
 function exactValue(value, expected, field, code = diagnosticCodes.invalid) {
-  if (JSON.stringify(value) !== JSON.stringify(expected)) {
+  // JSON object member order is not part of the contract. The compiler writes
+  // sorted artifact JSON; retain array order and exact values when reloading it.
+  const canonical = item => JSON.stringify(item, (_key, nested) => plainObject(nested)
+    ? Object.fromEntries(Object.keys(nested).sort().map(key => [key, nested[key]]))
+    : nested);
+  if (canonical(value) !== canonical(expected)) {
     fail(code, `${field} does not match the reviewed ES256 guest contract.`, { expected, actual: value });
   }
   return value;
@@ -409,7 +414,7 @@ function normalizeGuestUnitManifestV2(input) {
   );
 
   exactKeys(input.toolchain, ['kind', 'target', 'locked', 'versions'], [], 'guest unit v2 toolchain');
-  exactKeys(input.toolchain.versions, ['rustc', 'cargo', 'binaryen'], [], 'guest unit v2 toolchain.versions');
+  exactKeys(input.toolchain.versions, ['rustc', 'cargo', 'zig', 'binaryen'], [], 'guest unit v2 toolchain.versions');
   const toolchain = Object.freeze({
     kind: string(input.toolchain.kind, 'guest unit v2 toolchain.kind'),
     target: string(input.toolchain.target, 'guest unit v2 toolchain.target'),
@@ -417,6 +422,7 @@ function normalizeGuestUnitManifestV2(input) {
     versions: Object.freeze({
       rustc: string(input.toolchain.versions.rustc, 'guest unit v2 rustc version'),
       cargo: string(input.toolchain.versions.cargo, 'guest unit v2 cargo version'),
+      zig: string(input.toolchain.versions.zig, 'guest unit v2 Zig version'),
       binaryen: string(input.toolchain.versions.binaryen, 'guest unit v2 Binaryen version')
     })
   });
@@ -449,17 +455,10 @@ function normalizeGuestUnitManifestV2(input) {
     })
   })]);
   exactValue(imports, expectedImports, 'guest unit v2 imports', diagnosticCodes.importMismatch);
-  const expectedExports = Object.freeze([Object.freeze({
-    name: es256FrameV2.export,
-    kind: 'function',
-    parameters: es256FrameV2.parameters,
-    results: es256FrameV2.results,
-    role: 'abi'
-  })]);
+  const expectedExports = Object.freeze(['pulse_crypto_es256_sign', 'pulse_crypto_es256_verify', 'pulse_crypto_rs256_sign', 'pulse_crypto_rs256_verify'].map(name => Object.freeze({
+    name, kind: 'function', parameters: es256FrameV2.parameters, results: es256FrameV2.results, role: 'abi'
+  })));
   exactValue(exports, expectedExports, 'guest unit v2 exports', diagnosticCodes.exportMismatch);
-  if (exports.filter((entry) => entry.role === 'abi').length !== 1) {
-    fail(diagnosticCodes.abiMismatch, 'Guest unit v2 must declare exactly one ABI function export.');
-  }
 
   exactKeys(input.memory, ['identity', 'import', 'owner'], [], 'guest unit v2 memory');
   exactValue(input.memory, {
@@ -715,10 +714,10 @@ function normalizeGuestUnitPlanV1(input) {
   const directory = assertRelativePath(input.materialization.directory, 'guest unit plan materialization.directory');
   if (
     workspace !== '.pulse/guests'
-    || directory !== `${workspace}/${unit.id}/${unit.artifactSha256}`
+    || directory !== `${workspace}/${unit.id}/${unit.artifactSha256}/${unit.manifestSha256}`
     || input.materialization.artifact !== 'unit.wasm'
     || input.materialization.manifest !== 'unit.json'
-    || input.materialization.contentAddress !== 'artifact-sha256'
+    || input.materialization.contentAddress !== 'artifact-and-manifest-sha256'
     || input.materialization.generated !== true
     || input.materialization.authoritative !== false
   ) {
@@ -762,7 +761,7 @@ function normalizeGuestUnitPlanV1(input) {
       directory,
       artifact: 'unit.wasm',
       manifest: 'unit.json',
-      contentAddress: 'artifact-sha256',
+      contentAddress: 'artifact-and-manifest-sha256',
       generated: true,
       authoritative: false
     }),
@@ -921,10 +920,10 @@ function normalizeGuestUnitPlanV2(input) {
   );
   if (
     workspace !== '.pulse/guests'
-    || directory !== `${workspace}/${unit.id}/${unit.artifact.sha256}`
+    || directory !== `${workspace}/${unit.id}/${unit.artifact.sha256}/${unit.manifestSha256}`
     || input.materialization.artifact !== 'unit.wasm'
     || input.materialization.manifest !== 'unit.json'
-    || input.materialization.contentAddress !== 'artifact-sha256'
+    || input.materialization.contentAddress !== 'artifact-and-manifest-sha256'
     || input.materialization.generated !== true
     || input.materialization.authoritative !== false
   ) {
@@ -1003,7 +1002,7 @@ function normalizeGuestUnitPlanV2(input) {
       directory,
       artifact: 'unit.wasm',
       manifest: 'unit.json',
-      contentAddress: 'artifact-sha256',
+      contentAddress: 'artifact-and-manifest-sha256',
       generated: true,
       authoritative: false
     }),
@@ -1128,7 +1127,7 @@ function assertPlanMatchesManifest(plan, manifest) {
 }
 
 function optimizationArguments(posture) {
-  const args = optimizationPostures[posture];
+  const args = finalOptimizationPostures[posture];
   if (!args) fail(diagnosticCodes.optimizationFailed, `Unsupported guest-link optimization posture ${posture}.`);
   return args;
 }

package/src/materialize.js

@@ -127,12 +127,12 @@ function assertGuestBinary(manifest, inspection) {
         type: 'i32',
         initializer: { instruction: 'i32.const', value: contract.layout.rustStack.endExclusive }
       })
-      || inspection.instructions.globalSet !== 64
-      || inspection.instructions.store !== 500
+      || inspection.instructions.globalSet !== 104
+      || inspection.instructions.store !== 823
     ) {
       fail(
         diagnosticCodes.memoryMismatch,
-        `Guest unit ${manifest.id} binary does not match the reviewed stack-only mutable-state posture.`
+        `Guest unit ${manifest.id} binary does not match the reviewed stack and bounded-signature-output posture.`
       );
     }
   }
@@ -156,9 +156,9 @@ function assertGuestBinary(manifest, inspection) {
     }))) !== JSON.stringify([{
       memoryIndex: 0,
       offset: 131072,
-      endExclusive: 131656,
-      bytes: 584,
-      sha256: '231fcd9a2fc4e8190c8b96c9f89708b8039ea1b801cc564e32fbc14ff44e53ee'
+      endExclusive: 131722,
+      bytes: 650,
+      sha256: 'a33fcc685d2bb0bbbaa4678207d5c4ab2698f41ed7694be4fe0ba590e93d98ce'
     }])
   ) {
     fail(diagnosticCodes.memoryMismatch, `Guest unit ${manifest.id} static data does not match the reviewed layout.`);

package/src/pipeline.js

@@ -208,7 +208,7 @@ function assertPrimaryAndOwner(plan, manifest, primary, owner) {
     kind: entry.kind,
     type: { parameters: entry.parameters, results: entry.results }
   }));
-  if (!equal(guestImports.map(surfaceImport), expectedGuestImports)) {
+  if (!equal(sortedSurface(guestImports.map(surfaceImport)), sortedSurface(expectedGuestImports))) {
     fail(diagnosticCodes.abiMismatch, 'Primary guest imports do not exactly match the selected guest ABI.');
   }
   const memoryImports = primary.imports.filter((entry) => entry.kind === 'memory');

package/src/stage.js

@@ -364,10 +364,10 @@ function makeGuestUnitPlan(selection, resolved, facts, primaryBytes) {
     targetPolicy,
     materialization: {
       workspace: '.pulse/guests',
-      directory: `.pulse/guests/${manifest.id}/${manifest.artifact.sha256}`,
+      directory: `.pulse/guests/${manifest.id}/${manifest.artifact.sha256}/${resolved.manifestSha256}`,
       artifact: 'unit.wasm',
       manifest: 'unit.json',
-      contentAddress: 'artifact-sha256',
+      contentAddress: 'artifact-and-manifest-sha256',
       generated: true,
       authoritative: false
     },