Public API and stability contract

This is the implemented pre-1.0 review inventory, not a claim that 1.0 has shipped. The machine-readable snapshot records every named export of all explicit package entry points, expanded wildcard declaration entry points (including files not re-exported by a barrel), and their reachable TypeScript declarations. Multiple entry points re-export the same symbol; the export count is not a count of unique APIs. Run npm run build then npm run api:check; intentional declaration changes require npm run api:snapshot and a review of the resulting diff. This conservative snapshot check is not a complete semantic proof of compatibility; consumer compilation and runtime tests remain necessary. External dependency declarations are not frozen by the snapshot.

Classification

The support policy owns the current classification matrix. The generated export inventory records reviewed per-symbol classifications. Before stable support, freeze and review candidate APIs, validate selected adapters and browser lifecycles, and collect operational and pilot evidence. Review telemetry, generators and other experimental areas individually; an exported name does not prove completeness.

There is no approved stable or newly deprecated surface yet. Existing deprecated APIs remain deprecated. Classification is conservative and source-based: maintainers must review the symbol inventory before changing stable-candidate to a 1.0 promise. Experimental surfaces may change in minor releases with migration notes; applications depending on them should pin and validate upgrades. Nothing is removed by this change.

Runtime and security semantics to retain through the freeze

• Node >=22.17.0, npm >=9. Packed imports and a strict TypeScript consumer are CI gates.
• Shared rate-limit stores require atomic increment(key, windowMs) at compile time and runtime. Return the reserved count and expiry in epoch milliseconds. Never emulate atomicity with separate read and write calls in a shared service.
• Tenant routing does not authorize a caller. Authenticate first; verified claims take precedence. Unresolved production tenants cannot silently use a shared DB.
• Credentialed/query-bearing requests and private, cookie-setting or varied responses bypass shared caching. Tenant and host variants remain separate.
• Local filesystem wrappers reject symlink escapes but are not an OS sandbox for arbitrary executable code. Isolate untrusted commands outside the host process.
• Generator methods that say unsupported/not implemented are not usable stable APIs; the unified page builder is not a complete SSR/SSG emitter.

For 1.x, reviewed stable APIs should preserve source and documented runtime compatibility in patches/minors. Intentional removals require a migration guide and a major release; announce deprecations before removal. Exact support duration and named maintainers remain approval gates, not inferred service-level commitments.