@pulse-compute/provider-fastly 0.0.0 → 1.0.0-beta.10

package/src/toolchain/body-forwarding.js

@@ -0,0 +1,25 @@
+'use strict';
+
+const MAX_BODY_BYTES = 1048576;
+function forwardingError(message) {
+  const error = new TypeError(message);
+  error.code = 'PULSE_FASTLY_BODY_FORWARDING_INVALID';
+  return error;
+}
+function normalizeBodyForwarding(value, maxDurationMs) {
+  if (value === undefined) return undefined;
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).some(key => !['requestMaxBytes', 'responseMaxBytes'].includes(key))) {
+    throw forwardingError('fastly.bodyForwarding requires requestMaxBytes and responseMaxBytes.');
+  }
+  for (const key of ['requestMaxBytes', 'responseMaxBytes']) {
+    if (!Number.isInteger(value[key]) || value[key] < 1 || value[key] > MAX_BODY_BYTES) {
+      throw forwardingError(`fastly.bodyForwarding.${key} must be an integer from 1 to ${MAX_BODY_BYTES}.`);
+    }
+  }
+  if (!Number.isInteger(maxDurationMs) || maxDurationMs < 1 || maxDurationMs > 30000) {
+    throw forwardingError('fastly.bodyForwarding requires maxDurationMs from 1 to 30000.');
+  }
+  return Object.freeze({requestMaxBytes: value.requestMaxBytes, responseMaxBytes: value.responseMaxBytes});
+}
+module.exports = {normalizeBodyForwarding, forwardingError, MAX_BODY_BYTES};

package/src/toolchain/config.js

@@ -0,0 +1,144 @@
+'use strict';
+const { normalizeFastlyMaxWasmBytes } = require('../build/wasm-budget.js');
+const { normalizeFastlyS3 } = require('./s3.js');
+
+function providerConfigError(code, message, detail) {
+  const error = new TypeError(message);
+  error.code = code;
+  error.detail = Object.freeze({ ...detail });
+  return error;
+}
+
+function normalizeStringMap(input, code) {
+  if (input === undefined) return Object.freeze({});
+  if (!input || typeof input !== 'object' || Array.isArray(input)) {
+    throw providerConfigError(code, 'Provider binding maps must be objects.', {
+      valueType: Array.isArray(input) ? 'array' : typeof input
+    });
+  }
+  return Object.freeze(Object.fromEntries(
+    Object.entries(input).map(([key, value]) => [String(key), String(value)])
+  ));
+}
+
+function normalizeFastlyProviderConfig(value) {
+  const input = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+  const bindings = input.bindings && typeof input.bindings === 'object' && !Array.isArray(input.bindings)
+    ? input.bindings
+    : {};
+  const local = input.local && typeof input.local === 'object' && !Array.isArray(input.local)
+    ? input.local
+    : {};
+  const gripInput = bindings.grip && typeof bindings.grip === 'object' && !Array.isArray(bindings.grip)
+    ? bindings.grip
+    : {};
+  return Object.freeze({
+    kind: 'fastly',
+    bodyForwarding: require('./body-forwarding.js').normalizeBodyForwarding(input.bodyForwarding, input.maxDurationMs),
+    maxDurationMs: require('@pulse-compute/runtime/host').normalizeRequestDuration(input.maxDurationMs),
+    version: input.version ? String(input.version) : undefined,
+    bindings: Object.freeze({
+      ...(bindings.logEndpoint === undefined ? {} : { logEndpoint: require('./logging.js').normalizeFastlyLogEndpoint(bindings.logEndpoint) }),
+      configStore: String(bindings.configStore || 'pulse_config'),
+      secretStore: String(bindings.secretStore || 'pulse_secrets'),
+      kv: normalizeStringMap(bindings.kv, 'PULSE_FASTLY_KV_BINDINGS_INVALID'),
+      s3: normalizeFastlyS3(bindings.s3),
+      backends: normalizeStringMap(bindings.backends, 'PULSE_FASTLY_BACKEND_BINDINGS_INVALID'),
+      grip: Object.freeze({
+        fanoutBackend: gripInput.fanoutBackend === undefined ? undefined : String(gripInput.fanoutBackend),
+        publishEndpoint: gripInput.publishEndpoint === undefined ? undefined : String(gripInput.publishEndpoint),
+        publishUrl: gripInput.publishUrl === undefined ? undefined : String(gripInput.publishUrl),
+        publishBackend: gripInput.publishBackend === undefined ? undefined : String(gripInput.publishBackend),
+        authentication: gripInput.authentication === undefined ? undefined : Object.freeze({
+          scheme: String(gripInput.authentication && gripInput.authentication.scheme || 'bearer').toLowerCase(),
+          secretRef: String(gripInput.authentication && gripInput.authentication.secretRef || '')
+        }),
+        directHold: gripInput.directHold !== false
+      }),
+      dynamicBackends: bindings.dynamicBackends === true
+    }),
+    build: Object.freeze({
+      maxWasmBytes: normalizeFastlyMaxWasmBytes(input.build?.maxWasmBytes),
+      name: String(input.build && input.build.name || 'pulse-app'),
+      description: String(input.build && input.build.description || 'Pulse application'),
+      authors: Object.freeze(Array.isArray(input.build && input.build.authors) ? input.build.authors.map(String) : [])
+    }),
+    local: Object.freeze({ networkFetch: local.networkFetch === true }),
+    providerSpecificUserland: false
+  });
+}
+
+function fastlyProjectConfigDocument(config) {
+  return Object.freeze({
+    kind: 'fastly',
+    bindings: config.bindings,
+    maxDurationMs: config.maxDurationMs,
+    bodyForwarding: config.bodyForwarding,
+    build: config.build,
+    local: config.local,
+    providerSpecificUserland: false
+  });
+}
+
+function fastlyInitTemplate(name) {
+  return Object.freeze({
+    profileFragment: `    fastly: {
+      bindings: {
+        configStore: 'pulse_config',
+        secretStore: 'pulse_secrets',
+        kv: { sessions: 'sessions' },
+        dynamicBackends: false,
+      },
+      build: { name: '${name}' },
+    },
+`,
+    dependencies: Object.freeze({
+      '@pulse-compute/provider-fastly': require('../../package.json').version
+    })
+  });
+}
+
+const FASTLY_PROJECT_CONFIG_REFERENCE = Object.freeze({
+  sections: Object.freeze([
+    Object.freeze({
+      id: 'fastly',
+      title: 'Fastly provider options',
+      description: 'Options passed to fastly(...) from @pulse-compute/provider-fastly.'
+    })
+  ]),
+  fields: Object.freeze([
+    Object.freeze({ section: 'fastly', path: 'fastly.logEndpoint', type: 'string', default: 'omitted (stdout)', scope: 'fastly() facade; conventional profiles use fastly.bindings.logEndpoint', description: 'One case-sensitive named production log stream, 1–255 UTF-8 bytes, excluding stdout, stderr, fst_managed_ names and control characters. Records above 65536 UTF-8 bytes are dropped. One lookup and at most one write per record; errors and zero/short writes are dropped without retry or stdout fallback. Host acceptance does not prove downstream delivery.', diagnostics: Object.freeze(['PULSE_FASTLY_LOG_ENDPOINT_INVALID']) }),
+    Object.freeze({section:'fastly',path:'fastly.bodyForwarding',type:'object',default:'omitted',scope:'experimental Fastly Native forwarding',description:'Opt in to one terminal opaque POST with inline req.body() and a static backend. Requires maxDurationMs and both byte limits. Final close hands queued delivery to Fastly; it is not a client receipt.',diagnostics:Object.freeze(['PULSE_FASTLY_BODY_FORWARDING_INVALID'])}),
+    ...['requestMaxBytes','responseMaxBytes'].map(name => Object.freeze({section:'fastly',path:`fastly.bodyForwarding.${name}`,type:'integer',allowed:'1–1048576',default:'required with bodyForwarding',scope:'experimental Fastly Native forwarding',description:'Independent actual-byte bound, including EOF verification; no unbounded default. Fixed 16 KiB raw scratch is reused across the sequential upload and response pumps.'})),
+    Object.freeze({section:'fastly',path:'fastly.maxWasmBytes',type:'integer',allowed:'positive safe integer',default:'4194304 (4 MiB)',scope:'fastly() facade',description:'Facade option projected to build.maxWasmBytes. Conventional profiles configure fastly.build.maxWasmBytes.'}),
+    Object.freeze({section:'fastly',path:'fastly.build.maxWasmBytes',type:'integer',allowed:'positive safe integer',default:'4194304 (4 MiB)',scope:'Native final Wasm artifact',description:'Inclusive byte budget checked for newly compiled and reused artifacts. Raising it does not increase runtime memory or change Fastly service limits. The fastly() facade accepts maxWasmBytes.'}),
+    Object.freeze({section:'fastly',path:'fastly.maxDurationMs',type:'integer',allowed:'1–30000',default:'omitted',scope:'HTTP request execution',description:'One provider-owned monotonic budget through buffered response handoff; expiry attempts 504 before headers commit and never asserts rollback of dispatched writes. No CPU preemption or post-handoff delivery guarantee.'}),
+    Object.freeze({ section: 'fastly', path: 'fastly.bindings.s3', type: 'Readonly<Record<string, S3Binding & { backend: string }>>', default: '`{}`', scope: 'Fastly Native S3', description: 'Maps logical names to fixed HTTPS endpoint, bucket, region, named static backend, accessKeyIdSecret, secretAccessKeySecret, optional sessionTokenSecret, maxTextBytes (1–2097152, default 32768) and timeoutMs (1–30000, default 10000).', security: 'Credentials resolve through the configured Secret Store at execution. Dynamic backend authority and guest endpoint overrides are forbidden.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.configStore', type: 'string', default: '`pulse_config`', scope: 'Fastly config capability', description: 'Fastly Config Store resource name.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.secretStore', type: 'string', default: '`pulse_secrets`', scope: 'Fastly secret capability', description: 'Fastly Secret Store resource name.', security: 'The name is build metadata; secret values are never embedded by this option.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.kv', type: 'Readonly<Record<string, string>>', default: '`{}`', scope: 'Fastly KV capability', description: 'Maps logical ctx.kv names to Fastly KV Store resource names.', diagnostics: Object.freeze(['PULSE_FASTLY_KV_BINDINGS_INVALID']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.backends', type: 'Readonly<Record<string, string>>', default: '`{}`', scope: 'Fastly fetch capability', description: 'Maps static absolute origin URLs to named Fastly backends.', security: 'Prefer explicit backends over dynamic origin authority.', diagnostics: Object.freeze(['PULSE_FASTLY_BACKEND_BINDINGS_INVALID', 'PULSE_FASTLY_BACKEND_REQUIRED']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.dynamicBackends', type: 'boolean', default: '`false`', scope: 'Fastly fetch capability', description: 'Allows undeclared outbound origins to use dynamic backends.', security: 'Opt in deliberately because it broadens outbound authority.', diagnostics: Object.freeze(['PULSE_FASTLY_BACKEND_REQUIRED']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip', type: 'object', default: 'omitted', scope: 'Fastly GRIP capability', description: 'Provider-owned bindings used by package-owned GRIP compatibility and canonical broadcast effects.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip.fanoutBackend', type: 'string', default: 'omitted', scope: 'GRIP hold', description: 'Named Fastly Fanout backend.', diagnostics: Object.freeze(['PULSE_FASTLY_GRIP_FANOUT_BACKEND_REQUIRED']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip.publishEndpoint', type: 'string', default: 'omitted', scope: 'GRIP broadcast', description: 'Provider-owned absolute publish/control endpoint; distinct from public gateway and ingress URLs.', diagnostics: Object.freeze(['PULSE_FASTLY_GRIP_PUBLISH_BINDING_REQUIRED']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip.publishUrl', type: 'string', default: 'omitted', scope: 'GRIP publish', description: 'Absolute publish endpoint URL.', diagnostics: Object.freeze(['PULSE_FASTLY_GRIP_PUBLISH_BINDING_REQUIRED']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip.publishBackend', type: 'string', default: 'omitted', scope: 'GRIP broadcast/publish', description: 'Named backend for the provider publish endpoint.', diagnostics: Object.freeze(['PULSE_FASTLY_GRIP_PUBLISH_BINDING_REQUIRED']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip.authentication', type: 'object', default: 'omitted', scope: 'GRIP broadcast authentication', description: 'Authentication metadata containing references only; no credential value is accepted here.', security: 'Store the value in Fastly Secret Store and configure only secretRef.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip.authentication.scheme', type: "'bearer'", default: '`bearer`', scope: 'GRIP broadcast authentication', description: 'Provider authentication scheme.', diagnostics: Object.freeze(['PULSE_FASTLY_NATIVE_GRIP_AUTH_SCHEME_UNSUPPORTED']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip.authentication.secretRef', type: 'string', default: 'omitted', scope: 'GRIP broadcast authentication', description: 'Named Fastly Secret Store key used for the bearer token.', security: 'The secret value is resolved only at request execution and is redacted from traces.', diagnostics: Object.freeze(['PULSE_FASTLY_NATIVE_GRIP_SECRET_REFERENCE_MISSING']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip.directHold', type: 'boolean', default: '`true`', scope: 'GRIP hold', description: 'Enables the direct host-owned hold response realization.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.name', type: 'string', default: '`pulse-app`', scope: 'Fastly package metadata', description: 'Generated Fastly package name.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.description', type: 'string', default: '`Pulse application`', scope: 'Fastly package metadata', description: 'Generated Fastly package description.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.authors', type: 'readonly string[]', default: '`[]`', scope: 'Fastly package metadata', description: 'Generated Fastly package authors.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.local', type: 'object', default: '`{}`', scope: 'local Fastly conformance', description: 'Local-only behavior; it does not alter the deployed target.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.local.networkFetch', type: 'boolean', default: '`false`', scope: 'local Fastly fetch realization', description: 'Allows unmatched local Fastly fetches to use the network.', precedence: '`dev.networkFetch` overrides this value when explicitly set.', security: 'Keep disabled for deterministic tests and offline development.' })
+  ])
+});
+
+module.exports = Object.freeze({
+  normalizeFastlyProviderConfig,
+  fastlyProjectConfigDocument,
+  fastlyInitTemplate,
+  FASTLY_PROJECT_CONFIG_REFERENCE
+});

package/src/toolchain/index.js

@@ -0,0 +1,386 @@
+'use strict';
+
+const path = require('node:path');
+const {
+  PROVIDER_DRIVER_VERSION,
+  PROVIDER_TARGET_RESULT_VERSION,
+  PROVIDER_PACKAGING_AUDIT_VERSION,
+  defineProviderToolchain,
+  defineProviderDriver,
+  normalizeProviderTargetResult,
+  normalizeProviderJavascriptPackageResult
+} = require('@pulse-compute/wasm-contracts/provider/toolchain');
+const { defineFinalWasmPolicy, FINAL_WASM_POLICY_VERSION } = require('@pulse-compute/wasm-contracts/provider/final-wasm-policy');
+const { defineCryptoTargetCapabilities } = require('@pulse-compute/wasm-contracts/crypto/contracts');
+const nativeRuntime = require('@pulse-compute/wasm-contracts/handler/canonical-native-runtime');
+const fastlyRuntime = require('../runtime/canonical-api-runtime.js');
+const { writeFastlyCanonicalTarget, inspectFastlyCanonicalTarget } = require('../build/canonical-target.js');
+const { FASTLY_NATIVE_PLATFORM_CAPABILITIES_IMPORTS } = require('../build/native-platform-capabilities.js');
+const { FASTLY_PROVIDER_DESCRIPTOR, createFastlyLoweringPlan } = require('../provider-contract.js');
+const { FASTLY_JAVASCRIPT_TARGET_DESCRIPTOR } = require('../javascript/target.js');
+const { FASTLY_JAVASCRIPT_TARGET_SUPPORT_DECLARATION } = require('../javascript/support.js');
+const {
+  classifyFastlyJavascriptCapability,
+  classifyFastlyJavascriptProviderRequirement,
+  fastlyJavascriptProjectRestrictions
+} = require('../javascript/target-support-policy.js');
+const fastlyJavascriptTestRuntime = require('../javascript/test-runtime.js');
+const fastlyJavascriptLocalLoader = require('../javascript/local-loader.js');
+const { writeFastlyJavascriptSourcePackage } = require('../javascript/source-package.js');
+const {
+  normalizeFastlyProviderConfig,
+  fastlyProjectConfigDocument,
+  fastlyInitTemplate,
+  FASTLY_PROJECT_CONFIG_REFERENCE
+} = require('./config.js');
+const packageManifest = require('../../package.json');
+
+const reportingTargetCapability = Object.freeze({
+  supported: true,
+  default: 'info',
+  levels: Object.freeze(['off', 'error', 'warn', 'info', 'debug']),
+  destinations: Object.freeze(['stdout', 'configured-named-endpoint'])
+});
+
+const fastlyFinalWasmPolicy = defineFinalWasmPolicy({
+  version: FINAL_WASM_POLICY_VERSION,
+  descriptorOwner: packageManifest.name,
+  toolchainVersion: 'pulse.provider-toolchain.v1',
+  descriptorIdentity: 'fastly-compute-native',
+  permittedImports: FASTLY_NATIVE_PLATFORM_CAPABILITIES_IMPORTS
+    .map(([module, name]) => ({ module, name, kind: 'function' })),
+  requiredExports: nativeRuntime.CANONICAL_NATIVE_EXPORTS.map(([name, second]) => ({
+    name,
+    kind: second === 'memory' ? 'memory' : 'function'
+  }))
+});
+
+function adjustPackages(packages, restrictions) {
+  return packages.map((entry) => {
+    if (!entry.required) return entry;
+    const packageRestriction = entry.contractId === 'pulse.assets'
+      ? restrictions.assets
+      : (entry.contractId === 'pulse.grip' ? restrictions.grip : null);
+    if (!packageRestriction) return entry;
+    return Object.freeze({
+      ...entry,
+      status: 'blocked',
+      reasonId: packageRestriction.reasonId,
+      owner: packageRestriction.owner
+    });
+  });
+}
+
+function createDriver() {
+  return defineProviderDriver({
+    version: PROVIDER_DRIVER_VERSION,
+    id: 'fastly',
+    descriptor: FASTLY_PROVIDER_DESCRIPTOR,
+    executable: true,
+    localExecution: true,
+    deployable: true,
+    deploymentValidated: false,
+    sourcePackage: true,
+    compiledWasm: true,
+    defaultBuildMode: 'native-provider',
+    sourceOnlySupported: false,
+    targetSupport: Object.freeze({ javascript: FASTLY_JAVASCRIPT_TARGET_SUPPORT_DECLARATION }),
+    normalizeConfig: normalizeFastlyProviderConfig,
+    defaultLocalNetworkFetch: false,
+    projectConfigDocument: fastlyProjectConfigDocument,
+    configReference: FASTLY_PROJECT_CONFIG_REFERENCE,
+    initTemplate: fastlyInitTemplate,
+    javascript: Object.freeze({
+      kind: 'provider-bundled',
+      localEmulation: true,
+      buildTimeLoader: true,
+      localExecutionMode: fastlyJavascriptTestRuntime.FASTLY_JAVASCRIPT_LOCAL_EXECUTION_MODE,
+      realityRunner: 'fastly compute serve',
+      targetSupportPolicy: Object.freeze({
+          providerId: 'fastly',
+          declaration: FASTLY_JAVASCRIPT_TARGET_SUPPORT_DECLARATION,
+          context: fastlyJavascriptProjectRestrictions,
+          classifyCapability: classifyFastlyJavascriptCapability,
+          classifyProviderRequirement(id, _compilerCapabilities, restrictions) {
+            return classifyFastlyJavascriptProviderRequirement(id, restrictions);
+          },
+          packageOptions: Object.freeze({
+            suppliedCoreOwner: 'runtime',
+            packageResolutionReasonId: 'fastly-esbuild-package-resolution-planned',
+            packageResolutionOwner: 'provider-fastly',
+            packageRuntimeOwner: 'provider-fastly'
+          }),
+          adjustPackages,
+          commandOptions: Object.freeze({ projectScopedBuild: true })
+      }),
+      loadApplication(plan, options) {
+        return fastlyJavascriptLocalLoader.loadFastlyJavascriptLocalApplication(plan, {
+          projectRoot: options.projectRoot,
+          schemaBundle: options.schemaBundle
+        });
+      },
+      writeSourcePackage(invocation) {
+        return normalizeProviderJavascriptPackageResult(writeFastlyJavascriptSourcePackage({
+          plan: invocation.applicationPlan,
+          projectRoot: invocation.project.root,
+          outDir: invocation.project.outDir,
+          schemaBundle: invocation.javascript.schemaBundle,
+          binaryResources: invocation.javascript.binaryResources,
+          providerConfig: invocation.providerConfig,
+          reporting: invocation.javascript.reporting,
+          strict: invocation.javascript.strict,
+          maxStructuredBodyBytes: invocation.javascript.maxStructuredBodyBytes,
+          targetSupport: invocation.javascript.targetSupport
+        }), { provider: 'fastly' });
+      },
+      describeSourcePackage(sourcePackage, context) {
+        return Object.freeze({
+          deploymentCandidate: true,
+          downstreamJavascriptRuntimeWasm: true,
+          application: Object.freeze({
+            entry: path.relative(context.outDir, sourcePackage.paths.entry).replace(/\\/g, '/'),
+            modules: context.plan.graph.modules.filter((entry) => entry.runtime).length,
+            bundledApplication: path.relative(context.outDir, sourcePackage.paths.bundledApplication).replace(/\\/g, '/'),
+            deployment: path.basename(sourcePackage.paths.deployment),
+            deploymentCandidate: path.basename(sourcePackage.paths.deploymentCandidate),
+            fastlyToml: path.basename(sourcePackage.paths.fastlyToml),
+            buildConfig: path.basename(sourcePackage.paths.buildConfig),
+            bundledInputs: sourcePackage.manifest.summary.bundledInputs
+          }),
+          files: Object.freeze({
+            bundledApplication: sourcePackage.paths.bundledApplication,
+            deployment: sourcePackage.paths.deployment,
+            deploymentCandidate: sourcePackage.paths.deploymentCandidate,
+            fastlyToml: sourcePackage.paths.fastlyToml,
+            buildConfig: sourcePackage.paths.buildConfig
+          })
+        });
+      },
+      executeTestCase(application, testCase, options) {
+        return fastlyJavascriptTestRuntime.executeFastlyJavascriptTestCase(application, testCase, options);
+      },
+      createLocalEnvironment: fastlyJavascriptTestRuntime.createFastlyJavascriptLocalEnvironment,
+      createTestRequest: fastlyJavascriptTestRuntime.createFastlyJavascriptTestRequest,
+      executeLocalRequest: fastlyJavascriptTestRuntime.executeFastlyJavascriptLocalRequest
+    }),
+    targets: Object.freeze({
+      native: Object.freeze({
+        version: 'pulse.provider-target-descriptor.v1',
+        target: 'native',
+        targetId: 'fastly-compute-native',
+        runtimeClass: 'native',
+        status: 'supported',
+        capabilities: Object.freeze([
+          's3.head', 's3.getText', 's3.getBody',
+          'kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap', 'kv.list', 'kv.delete',
+          'jwt.verify',
+          'jwt.sign',
+          'jwt.verify.hs256',
+          'jwt.verify.es256',
+          'jwt.verify.rs256',
+          'secret.get',
+          'time.wall-clock'
+        ]),
+        keyTypes: Object.freeze(['secret', 'jwk', 'jwks']),
+        realizations: Object.freeze([
+          Object.freeze({
+            kind: 'package-native-application',
+            contractId: 'pulse.entities',
+            implementation: 'pulse.package-native-application.v1',
+            implemented: true,
+            automaticFallback: false
+          }),
+          Object.freeze({
+            kind: 'package-native-application',
+            contractId: 'pulse.mcp',
+            implementation: 'pulse.package-native-application.v2',
+            implemented: true,
+            automaticFallback: false
+          }),
+          Object.freeze({
+            kind: 'crypto-composed',
+            realization: 'guest-source:pulse-hmac-as',
+            implementation: 'pulse-hmac-as.v1',
+            algorithms: Object.freeze(['HS256']),
+            keyTypes: Object.freeze(['secret']),
+            implemented: true,
+            status: 'implemented-e2',
+            semanticOwner: '@pulse-compute/crypto',
+            guestUnitRequired: false,
+            portable: true,
+            automaticFallback: false
+          }),
+          Object.freeze({
+            kind: 'crypto-composed',
+            realization: 'guest-linked:pulse-es256-rustcrypto-p256',
+            implementation: 'rustcrypto.p256-0.13.2.ecdsa-0.16.9.sha2-0.10.9.v1',
+            algorithms: Object.freeze(['ES256']),
+            keyTypes: Object.freeze(['jwk', 'jwks']),
+            implemented: true,
+            status: 'implemented-g4',
+            semanticOwner: '@pulse-compute/crypto',
+            guestUnitRequired: true,
+            portable: true,
+            automaticFallback: false
+          }),
+          Object.freeze({
+            kind: 'crypto-composed',
+            realization: 'guest-linked:pulse-rs256-bearssl-i31',
+            implementation: 'bearssl.0.6.rsa-i31.sha256.v1',
+            algorithms: Object.freeze(['RS256']),
+            keyTypes: Object.freeze(['jwk', 'jwks']),
+            implemented: true,
+            status: 'implemented-g4',
+            semanticOwner: '@pulse-compute/crypto',
+            guestUnitRequired: true,
+            portable: true,
+            automaticFallback: false
+          })
+        ]),
+        jwt: Object.freeze({
+          status: 'implemented-e2',
+          realization: 'guest-source:pulse-hmac-as',
+          implementation: 'pulse-hmac-as.v1',
+          packageSource: 'pulse-jwt-as',
+          providerAuthorities: Object.freeze([
+            'request',
+            'secret',
+            'wall-clock',
+            'schema',
+            'error-transport'
+          ]),
+          automaticFallback: false
+        }),
+        automaticFallback: false,
+        crypto: defineCryptoTargetCapabilities({
+          target: 'native',
+          algorithms: [...['SHA-256', 'HMAC-SHA256'].map((algorithm) => ({ algorithm, realization: 'guest-source:pulse-hmac-as', implemented: true, status: 'implemented-o2' })), {
+            algorithm: 'HS256',
+            realization: 'guest-source:pulse-hmac-as',
+            implemented: true,
+            status: 'implemented-c3'
+          }, {
+            algorithm: 'ES256',
+            realization: 'guest-linked:pulse-es256-rustcrypto-p256',
+            implemented: true,
+            status: 'implemented-g4'
+          }, {
+            algorithm: 'RS256',
+            realization: 'guest-linked:pulse-rs256-bearssl-i31',
+            implemented: true,
+            status: 'implemented-g4'
+          }]
+        }),
+        finalWasmPolicy: fastlyFinalWasmPolicy,
+        reporting: reportingTargetCapability,
+        commands: Object.freeze({ compile: true, inspect: true, doctor: true, build: true, test: true, dev: true })
+      }),
+      javascript: FASTLY_JAVASCRIPT_TARGET_DESCRIPTOR
+    }),
+    execute: fastlyRuntime.executeCanonicalProgram,
+    prepareNativeExecution: require('./native-execution.js').prepareFastlyNativeExecution,
+    createLoweringPlan(metadata, providerConfig = {}) {
+      return createFastlyLoweringPlan(metadata, providerConfig.bindings || {}, providerConfig);
+    },
+    inspectRealization(invocation) {
+      const realization = inspectFastlyCanonicalTarget({
+        plan: invocation.applicationPlan,
+        providerPlan: invocation.providerPlan,
+        providerConfig: invocation.providerConfig,
+        projectRoot: invocation.project.root,
+        profile: invocation.project.profile,
+        targetDescriptor: invocation.selectedTarget,
+        synchronizedPackages: invocation.synchronizedPackages,
+        realizationArtifacts: invocation.nativeArtifact.realizationArtifacts,
+        guestUnits: invocation.nativeArtifact.guestUnits,
+        nativeOptimization: invocation.optimization,
+        elideJsonCacheArena: invocation.nativeArtifact.manifest.elideJsonCacheArena === true,
+        emitWat: invocation.nativeArtifact.manifest.wat?.emitted === true,
+        compileTimeoutMs: invocation.timeoutMs
+      });
+      const { native, ...publicRealization } = realization;
+      return normalizeProviderTargetResult({
+        version: PROVIDER_TARGET_RESULT_VERSION,
+        action: 'inspect-native',
+        provider: 'fastly',
+        target: 'native',
+        status: 'inspected',
+        automaticFallback: false,
+        files: Object.freeze({}),
+        build: null,
+        realization: publicRealization,
+        packaging: null
+      });
+    },
+    writeTarget(invocation) {
+      const inspected = inspectFastlyCanonicalTarget({
+        plan: invocation.applicationPlan,
+        providerPlan: invocation.providerPlan,
+        providerConfig: invocation.providerConfig,
+        projectRoot: invocation.project.root,
+        profile: invocation.project.profile,
+        targetDescriptor: invocation.selectedTarget,
+        synchronizedPackages: invocation.synchronizedPackages,
+        realizationArtifacts: invocation.nativeArtifact.realizationArtifacts,
+        guestUnits: invocation.nativeArtifact.guestUnits,
+        nativeOptimization: invocation.optimization,
+        elideJsonCacheArena: invocation.nativeArtifact.manifest.elideJsonCacheArena === true,
+        emitWat: invocation.nativeArtifact.manifest.wat?.emitted === true,
+        compileTimeoutMs: invocation.timeoutMs
+      });
+      const providerBuild = writeFastlyCanonicalTarget({
+        outDir: invocation.project.outDir,
+        plan: invocation.applicationPlan,
+        providerPlan: invocation.providerPlan,
+        native: inspected.native,
+        providerConfig: invocation.providerConfig,
+        bindings: invocation.providerConfig.bindings,
+        projectRoot: invocation.project.root,
+        profile: invocation.project.profile,
+        targetDescriptor: invocation.selectedTarget,
+        synchronizedPackages: invocation.synchronizedPackages
+      });
+      const { native, ...publicRealization } = inspected;
+      const audit = native.guestLink && native.guestLink.audit;
+      return normalizeProviderTargetResult({
+        version: PROVIDER_TARGET_RESULT_VERSION,
+        action: 'write-native',
+        provider: 'fastly',
+        target: 'native',
+        status: 'built',
+        automaticFallback: false,
+        files: Object.freeze({
+          provider: providerBuild.providerFile,
+          providerEntry: providerBuild.entryFile,
+          providerBuild: providerBuild.buildFile,
+          providerWasm: providerBuild.wasmFile,
+          providerWat: providerBuild.watFile,
+          providerNativePlan: providerBuild.nativePlanFile,
+          providerNativeManifest: providerBuild.nativeManifestFile,
+          fastlyToml: providerBuild.fastlyTomlFile,
+          providerPackage: providerBuild.packageFile,
+          providerSourceEntry: providerBuild.sourceEntryFile
+        }),
+        build: { ...providerBuild.build, reportAttribution: native.reportAttribution, buildObservation: native.buildObservation },
+        realization: publicRealization,
+        packaging: audit ? Object.freeze({
+          version: PROVIDER_PACKAGING_AUDIT_VERSION,
+          artifactSha256: providerBuild.build.wasm.sha256,
+          auditedSha256: audit.artifact.sha256,
+          authorized: native.guestLink.providerPackaging.authorized === true
+        }) : null
+      });
+    },
+    executionOptions(providerConfig = {}, values = {}) {
+      return { ...values, maxDurationMs: providerConfig.maxDurationMs, bindings: providerConfig.bindings };
+    }
+  });
+}
+
+module.exports = defineProviderToolchain({
+  version: 'pulse.provider-toolchain.v1',
+  id: 'fastly',
+  packageName: packageManifest.name,
+  packageVersion: packageManifest.version,
+  createDriver
+});

package/src/toolchain/logging.js

@@ -0,0 +1,18 @@
+'use strict';
+
+const MAX_LOG_BYTES = 65536;
+
+function normalizeFastlyLogEndpoint(value) {
+  if (value === undefined) return undefined;
+  if (typeof value !== 'string' || !value || value.length > 255 || value.trim() !== value
+      || new TextEncoder().encode(value).byteLength > 255 || /[\u0000-\u001f\u007f]/u.test(value)
+      || /[\ud800-\udfff]/u.test(value.replace(/[\ud800-\udbff][\udc00-\udfff]/g, ''))
+      || /^(?:stdout$|stderr$|fst_managed_)/i.test(value)) {
+    const error = new TypeError('Fastly logEndpoint must be a non-reserved endpoint name of 1–255 UTF-8 bytes without control characters or surrounding whitespace.');
+    error.code = 'PULSE_FASTLY_LOG_ENDPOINT_INVALID';
+    throw error;
+  }
+  return value;
+}
+
+module.exports = { normalizeFastlyLogEndpoint, MAX_LOG_BYTES };

package/src/toolchain/native-execution.js

@@ -0,0 +1,78 @@
+'use strict';
+
+const { inspectFastlyCanonicalTarget } = require('../build/canonical-target.js');
+const { executeFastlyNativePlatformCapabilities } = require('../testing/native-platform-capabilities-host.js');
+const { createConditionalKvAuthority } = require('../testing/conditional-kv-host.js');
+
+// Execute the provider artifact against the existing fixture ABI. This is local
+// conformance evidence, never Viceroy or deployed Fastly acceptance.
+function prepareFastlyNativeExecution(invocation) {
+  const bindings = invocation.providerConfig.bindings;
+  const { native } = inspectFastlyCanonicalTarget({
+    plan: invocation.applicationPlan,
+    providerConfig: invocation.providerConfig,
+    projectRoot: invocation.project.root,
+    profile: invocation.project.profile,
+    targetDescriptor: invocation.selectedTarget,
+    synchronizedPackages: invocation.synchronizedPackages,
+    realizationArtifacts: invocation.nativeArtifact.realizationArtifacts,
+    guestUnits: invocation.nativeArtifact.guestUnits,
+    nativeOptimization: invocation.optimization,
+    elideJsonCacheArena: invocation.nativeArtifact.manifest.elideJsonCacheArena === true,
+    emitWat: invocation.nativeArtifact.manifest.wat?.emitted === true,
+    compileTimeoutMs: invocation.timeoutMs || undefined
+  });
+  const evidence = Object.freeze({
+    kind: 'fastly-native-fixture-abi',
+    provider: 'fastly',
+    target: 'fastly-compute-native',
+    wasmSha256: native.manifest.wasm.sha256,
+    providerRealityValidated: false,
+    effectObservations: 'unavailable'
+  });
+  return (options = {}) => {
+    if (options.liveFetch === true) throw new TypeError('Fastly Native fixture execution cannot perform live fetches.');
+    const kvStores = {};
+    for (const [logical, physical] of Object.entries(bindings.kv || {})) {
+      kvStores[physical] = { ...kvStores[physical], ...(options.kv && options.kv[logical] || {}) };
+    }
+    const authority = createConditionalKvAuthority();
+    for (const [store, values] of Object.entries(kvStores)) {
+      authority.stores.set(store, new Map());
+      for (const [key, value] of Object.entries(values)) {
+        authority.seed(store, key, Buffer.from(JSON.stringify({ __pulseKv: 1, value })));
+      }
+    }
+    const execution = executeFastlyNativePlatformCapabilities(native, {
+      request: options.request,
+      fixtures: options.fetches,
+      configStore: bindings.configStore,
+      config: options.config,
+      secretStore: bindings.secretStore,
+      secrets: options.secrets,
+      kvStores,
+      conditionalKv: { authority }
+    });
+    const contentType = execution.response.headers.find(([name]) => name.toLowerCase() === 'content-type');
+    const type = String(contentType && contentType[1] || '').toLowerCase();
+    return Object.freeze({
+      response: Object.freeze({
+        ...execution.response,
+        kind: type.includes('application/json') || type.includes('+json') ? 'json' : type.startsWith('text/') ? 'text' : 'response',
+        // Forwarding filters origin metadata into a new response handle, so
+        // its streamed payload remains opaque even though origin is false.
+        // Pre-commit errors use ordinary non-streaming structured responses.
+        bodyClass: execution.response.origin === true
+          || (native.plan.capabilities.includes('request.body.forward') && execution.response.streaming === 1)
+          ? 'opaque' : 'structured'
+      }),
+      // The fixture ABI has hostcall traces, not canonical continuation telemetry.
+      effectCount: null,
+      continuations: Object.freeze([]),
+      resolutionOrder: Object.freeze([]),
+      evidence
+    });
+  };
+}
+
+module.exports = { prepareFastlyNativeExecution };