@pulse-compute/provider-fastly 0.0.0 → 1.0.0-beta.2

package/src/toolchain/config.js

@@ -0,0 +1,131 @@
+'use strict';
+const { normalizeFastlyS3 } = require('./s3.js');
+
+function providerConfigError(code, message, detail) {
+  const error = new TypeError(message);
+  error.code = code;
+  error.detail = Object.freeze({ ...detail });
+  return error;
+}
+
+function normalizeStringMap(input, code) {
+  if (input === undefined) return Object.freeze({});
+  if (!input || typeof input !== 'object' || Array.isArray(input)) {
+    throw providerConfigError(code, 'Provider binding maps must be objects.', {
+      valueType: Array.isArray(input) ? 'array' : typeof input
+    });
+  }
+  return Object.freeze(Object.fromEntries(
+    Object.entries(input).map(([key, value]) => [String(key), String(value)])
+  ));
+}
+
+function normalizeFastlyProviderConfig(value) {
+  const input = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+  const bindings = input.bindings && typeof input.bindings === 'object' && !Array.isArray(input.bindings)
+    ? input.bindings
+    : {};
+  const local = input.local && typeof input.local === 'object' && !Array.isArray(input.local)
+    ? input.local
+    : {};
+  const gripInput = bindings.grip && typeof bindings.grip === 'object' && !Array.isArray(bindings.grip)
+    ? bindings.grip
+    : {};
+  return Object.freeze({
+    kind: 'fastly',
+    version: input.version ? String(input.version) : undefined,
+    bindings: Object.freeze({
+      configStore: String(bindings.configStore || 'pulse_config'),
+      secretStore: String(bindings.secretStore || 'pulse_secrets'),
+      kv: normalizeStringMap(bindings.kv, 'PULSE_FASTLY_KV_BINDINGS_INVALID'),
+      s3: normalizeFastlyS3(bindings.s3),
+      backends: normalizeStringMap(bindings.backends, 'PULSE_FASTLY_BACKEND_BINDINGS_INVALID'),
+      grip: Object.freeze({
+        fanoutBackend: gripInput.fanoutBackend === undefined ? undefined : String(gripInput.fanoutBackend),
+        publishEndpoint: gripInput.publishEndpoint === undefined ? undefined : String(gripInput.publishEndpoint),
+        publishUrl: gripInput.publishUrl === undefined ? undefined : String(gripInput.publishUrl),
+        publishBackend: gripInput.publishBackend === undefined ? undefined : String(gripInput.publishBackend),
+        authentication: gripInput.authentication === undefined ? undefined : Object.freeze({
+          scheme: String(gripInput.authentication && gripInput.authentication.scheme || 'bearer').toLowerCase(),
+          secretRef: String(gripInput.authentication && gripInput.authentication.secretRef || '')
+        }),
+        directHold: gripInput.directHold !== false
+      }),
+      dynamicBackends: bindings.dynamicBackends === true
+    }),
+    build: Object.freeze({
+      name: String(input.build && input.build.name || 'pulse-app'),
+      description: String(input.build && input.build.description || 'Pulse application'),
+      authors: Object.freeze(Array.isArray(input.build && input.build.authors) ? input.build.authors.map(String) : [])
+    }),
+    local: Object.freeze({ networkFetch: local.networkFetch === true }),
+    providerSpecificUserland: false
+  });
+}
+
+function fastlyProjectConfigDocument(config) {
+  return Object.freeze({
+    kind: 'fastly',
+    bindings: config.bindings,
+    build: config.build,
+    local: config.local,
+    providerSpecificUserland: false
+  });
+}
+
+function fastlyInitTemplate(name) {
+  return Object.freeze({
+    profileFragment: `    fastly: {
+      bindings: {
+        configStore: 'pulse_config',
+        secretStore: 'pulse_secrets',
+        kv: { sessions: 'sessions' },
+        dynamicBackends: false,
+      },
+      build: { name: '${name}' },
+    },
+`,
+    dependencies: Object.freeze({
+      '@pulse-compute/provider-fastly': require('../../package.json').version
+    })
+  });
+}
+
+const FASTLY_PROJECT_CONFIG_REFERENCE = Object.freeze({
+  sections: Object.freeze([
+    Object.freeze({
+      id: 'fastly',
+      title: 'Fastly provider options',
+      description: 'Options passed to fastly(...) from @pulse-compute/provider-fastly.'
+    })
+  ]),
+  fields: Object.freeze([
+    Object.freeze({ section: 'fastly', path: 'fastly.bindings.s3', type: 'Readonly<Record<string, S3Binding & { backend: string }>>', default: '`{}`', scope: 'Fastly Native S3', description: 'Maps logical names to fixed HTTPS endpoint, bucket, region, named static backend, accessKeyIdSecret, secretAccessKeySecret, optional sessionTokenSecret, maxTextBytes (1–32768, default 32768) and timeoutMs (1–30000, default 10000).', security: 'Credentials resolve through the configured Secret Store at execution. Dynamic backend authority and guest endpoint overrides are forbidden.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.configStore', type: 'string', default: '`pulse_config`', scope: 'Fastly config capability', description: 'Fastly Config Store resource name.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.secretStore', type: 'string', default: '`pulse_secrets`', scope: 'Fastly secret capability', description: 'Fastly Secret Store resource name.', security: 'The name is build metadata; secret values are never embedded by this option.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.kv', type: 'Readonly<Record<string, string>>', default: '`{}`', scope: 'Fastly KV capability', description: 'Maps logical ctx.kv names to Fastly KV Store resource names.', diagnostics: Object.freeze(['PULSE_FASTLY_KV_BINDINGS_INVALID']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.backends', type: 'Readonly<Record<string, string>>', default: '`{}`', scope: 'Fastly fetch capability', description: 'Maps static absolute origin URLs to named Fastly backends.', security: 'Prefer explicit backends over dynamic origin authority.', diagnostics: Object.freeze(['PULSE_FASTLY_BACKEND_BINDINGS_INVALID', 'PULSE_FASTLY_BACKEND_REQUIRED']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.dynamicBackends', type: 'boolean', default: '`false`', scope: 'Fastly fetch capability', description: 'Allows undeclared outbound origins to use dynamic backends.', security: 'Opt in deliberately because it broadens outbound authority.', diagnostics: Object.freeze(['PULSE_FASTLY_BACKEND_REQUIRED']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip', type: 'object', default: 'omitted', scope: 'Fastly GRIP capability', description: 'Provider-owned bindings used by package-owned GRIP compatibility and canonical broadcast effects.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip.fanoutBackend', type: 'string', default: 'omitted', scope: 'GRIP hold', description: 'Named Fastly Fanout backend.', diagnostics: Object.freeze(['PULSE_FASTLY_GRIP_FANOUT_BACKEND_REQUIRED']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip.publishEndpoint', type: 'string', default: 'omitted', scope: 'GRIP broadcast', description: 'Provider-owned absolute publish/control endpoint; distinct from public gateway and ingress URLs.', diagnostics: Object.freeze(['PULSE_FASTLY_GRIP_PUBLISH_BINDING_REQUIRED']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip.publishUrl', type: 'string', default: 'omitted', scope: 'GRIP publish', description: 'Absolute publish endpoint URL.', diagnostics: Object.freeze(['PULSE_FASTLY_GRIP_PUBLISH_BINDING_REQUIRED']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip.publishBackend', type: 'string', default: 'omitted', scope: 'GRIP broadcast/publish', description: 'Named backend for the provider publish endpoint.', diagnostics: Object.freeze(['PULSE_FASTLY_GRIP_PUBLISH_BINDING_REQUIRED']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip.authentication', type: 'object', default: 'omitted', scope: 'GRIP broadcast authentication', description: 'Authentication metadata containing references only; no credential value is accepted here.', security: 'Store the value in Fastly Secret Store and configure only secretRef.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip.authentication.scheme', type: "'bearer'", default: '`bearer`', scope: 'GRIP broadcast authentication', description: 'Provider authentication scheme.', diagnostics: Object.freeze(['PULSE_FASTLY_NATIVE_GRIP_AUTH_SCHEME_UNSUPPORTED']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip.authentication.secretRef', type: 'string', default: 'omitted', scope: 'GRIP broadcast authentication', description: 'Named Fastly Secret Store key used for the bearer token.', security: 'The secret value is resolved only at request execution and is redacted from traces.', diagnostics: Object.freeze(['PULSE_FASTLY_NATIVE_GRIP_SECRET_REFERENCE_MISSING']) }),
+    Object.freeze({ section: 'fastly', path: 'fastly.grip.directHold', type: 'boolean', default: '`true`', scope: 'GRIP hold', description: 'Enables the direct host-owned hold response realization.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.name', type: 'string', default: '`pulse-app`', scope: 'Fastly package metadata', description: 'Generated Fastly package name.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.description', type: 'string', default: '`Pulse application`', scope: 'Fastly package metadata', description: 'Generated Fastly package description.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.authors', type: 'readonly string[]', default: '`[]`', scope: 'Fastly package metadata', description: 'Generated Fastly package authors.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.local', type: 'object', default: '`{}`', scope: 'local Fastly conformance', description: 'Local-only behavior; it does not alter the deployed target.' }),
+    Object.freeze({ section: 'fastly', path: 'fastly.local.networkFetch', type: 'boolean', default: '`false`', scope: 'local Fastly fetch realization', description: 'Allows unmatched local Fastly fetches to use the network.', precedence: '`dev.networkFetch` overrides this value when explicitly set.', security: 'Keep disabled for deterministic tests and offline development.' })
+  ])
+});
+
+module.exports = Object.freeze({
+  normalizeFastlyProviderConfig,
+  fastlyProjectConfigDocument,
+  fastlyInitTemplate,
+  FASTLY_PROJECT_CONFIG_REFERENCE
+});

package/src/toolchain/index.js

@@ -0,0 +1,345 @@
+'use strict';
+
+const path = require('node:path');
+const {
+  PROVIDER_DRIVER_VERSION,
+  PROVIDER_TARGET_RESULT_VERSION,
+  PROVIDER_PACKAGING_AUDIT_VERSION,
+  defineProviderToolchain,
+  defineProviderDriver,
+  normalizeProviderTargetResult,
+  normalizeProviderJavascriptPackageResult
+} = require('@pulse-compute/wasm-contracts/provider/toolchain');
+const { defineFinalWasmPolicy, FINAL_WASM_POLICY_VERSION } = require('@pulse-compute/wasm-contracts/provider/final-wasm-policy');
+const { defineCryptoTargetCapabilities } = require('@pulse-compute/wasm-contracts/crypto/contracts');
+const nativeRuntime = require('@pulse-compute/wasm-contracts/handler/canonical-native-runtime');
+const fastlyRuntime = require('../runtime/canonical-api-runtime.js');
+const { writeFastlyCanonicalTarget, inspectFastlyCanonicalTarget } = require('../build/canonical-target.js');
+const { FASTLY_NATIVE_PLATFORM_CAPABILITIES_IMPORTS } = require('../build/native-platform-capabilities.js');
+const { FASTLY_PROVIDER_DESCRIPTOR, createFastlyLoweringPlan } = require('../provider-contract.js');
+const { FASTLY_JAVASCRIPT_TARGET_DESCRIPTOR } = require('../javascript/target.js');
+const { FASTLY_JAVASCRIPT_TARGET_SUPPORT_DECLARATION } = require('../javascript/support.js');
+const {
+  classifyFastlyJavascriptCapability,
+  classifyFastlyJavascriptProviderRequirement,
+  fastlyJavascriptProjectRestrictions
+} = require('../javascript/target-support-policy.js');
+const fastlyJavascriptTestRuntime = require('../javascript/test-runtime.js');
+const fastlyJavascriptLocalLoader = require('../javascript/local-loader.js');
+const { writeFastlyJavascriptSourcePackage } = require('../javascript/source-package.js');
+const {
+  normalizeFastlyProviderConfig,
+  fastlyProjectConfigDocument,
+  fastlyInitTemplate,
+  FASTLY_PROJECT_CONFIG_REFERENCE
+} = require('./config.js');
+const packageManifest = require('../../package.json');
+
+const reportingTargetCapability = Object.freeze({
+  supported: true,
+  default: 'info',
+  levels: Object.freeze(['off', 'error', 'warn', 'info', 'debug'])
+});
+
+const fastlyFinalWasmPolicy = defineFinalWasmPolicy({
+  version: FINAL_WASM_POLICY_VERSION,
+  descriptorOwner: packageManifest.name,
+  toolchainVersion: 'pulse.provider-toolchain.v1',
+  descriptorIdentity: 'fastly-compute-native',
+  permittedImports: FASTLY_NATIVE_PLATFORM_CAPABILITIES_IMPORTS
+    .map(([module, name]) => ({ module, name, kind: 'function' })),
+  requiredExports: nativeRuntime.CANONICAL_NATIVE_EXPORTS.map(([name, second]) => ({
+    name,
+    kind: second === 'memory' ? 'memory' : 'function'
+  }))
+});
+
+function adjustPackages(packages, restrictions) {
+  return packages.map((entry) => {
+    if (!entry.required) return entry;
+    const packageRestriction = entry.contractId === 'pulse.assets'
+      ? restrictions.assets
+      : (entry.contractId === 'pulse.grip' ? restrictions.grip : null);
+    if (!packageRestriction) return entry;
+    return Object.freeze({
+      ...entry,
+      status: 'blocked',
+      reasonId: packageRestriction.reasonId,
+      owner: packageRestriction.owner
+    });
+  });
+}
+
+function createDriver() {
+  return defineProviderDriver({
+    version: PROVIDER_DRIVER_VERSION,
+    id: 'fastly',
+    descriptor: FASTLY_PROVIDER_DESCRIPTOR,
+    executable: true,
+    localExecution: true,
+    deployable: true,
+    deploymentValidated: false,
+    sourcePackage: true,
+    compiledWasm: true,
+    defaultBuildMode: 'native-provider',
+    sourceOnlySupported: false,
+    targetSupport: Object.freeze({ javascript: FASTLY_JAVASCRIPT_TARGET_SUPPORT_DECLARATION }),
+    normalizeConfig: normalizeFastlyProviderConfig,
+    defaultLocalNetworkFetch: false,
+    projectConfigDocument: fastlyProjectConfigDocument,
+    configReference: FASTLY_PROJECT_CONFIG_REFERENCE,
+    initTemplate: fastlyInitTemplate,
+    javascript: Object.freeze({
+      kind: 'provider-bundled',
+      localEmulation: true,
+      buildTimeLoader: true,
+      localExecutionMode: fastlyJavascriptTestRuntime.FASTLY_JAVASCRIPT_LOCAL_EXECUTION_MODE,
+      realityRunner: 'fastly compute serve',
+      targetSupportPolicy: Object.freeze({
+          providerId: 'fastly',
+          declaration: FASTLY_JAVASCRIPT_TARGET_SUPPORT_DECLARATION,
+          context: fastlyJavascriptProjectRestrictions,
+          classifyCapability: classifyFastlyJavascriptCapability,
+          classifyProviderRequirement(id, _compilerCapabilities, restrictions) {
+            return classifyFastlyJavascriptProviderRequirement(id, restrictions);
+          },
+          packageOptions: Object.freeze({
+            suppliedCoreOwner: 'runtime',
+            packageResolutionReasonId: 'fastly-esbuild-package-resolution-planned',
+            packageResolutionOwner: 'provider-fastly',
+            packageRuntimeOwner: 'provider-fastly'
+          }),
+          adjustPackages,
+          commandOptions: Object.freeze({ projectScopedBuild: true })
+      }),
+      loadApplication(plan, options) {
+        return fastlyJavascriptLocalLoader.loadFastlyJavascriptLocalApplication(plan, {
+          projectRoot: options.projectRoot,
+          schemaBundle: options.schemaBundle
+        });
+      },
+      writeSourcePackage(invocation) {
+        return normalizeProviderJavascriptPackageResult(writeFastlyJavascriptSourcePackage({
+          plan: invocation.applicationPlan,
+          projectRoot: invocation.project.root,
+          outDir: invocation.project.outDir,
+          schemaBundle: invocation.javascript.schemaBundle,
+          providerConfig: invocation.providerConfig,
+          reporting: invocation.javascript.reporting,
+          strict: invocation.javascript.strict,
+          maxStructuredBodyBytes: invocation.javascript.maxStructuredBodyBytes,
+          targetSupport: invocation.javascript.targetSupport
+        }), { provider: 'fastly' });
+      },
+      describeSourcePackage(sourcePackage, context) {
+        return Object.freeze({
+          deploymentCandidate: true,
+          downstreamJavascriptRuntimeWasm: true,
+          application: Object.freeze({
+            entry: path.relative(context.outDir, sourcePackage.paths.entry).replace(/\\/g, '/'),
+            modules: context.plan.graph.modules.filter((entry) => entry.runtime).length,
+            bundledApplication: path.relative(context.outDir, sourcePackage.paths.bundledApplication).replace(/\\/g, '/'),
+            deployment: path.basename(sourcePackage.paths.deployment),
+            deploymentCandidate: path.basename(sourcePackage.paths.deploymentCandidate),
+            fastlyToml: path.basename(sourcePackage.paths.fastlyToml),
+            buildConfig: path.basename(sourcePackage.paths.buildConfig),
+            bundledInputs: sourcePackage.manifest.summary.bundledInputs
+          }),
+          files: Object.freeze({
+            bundledApplication: sourcePackage.paths.bundledApplication,
+            deployment: sourcePackage.paths.deployment,
+            deploymentCandidate: sourcePackage.paths.deploymentCandidate,
+            fastlyToml: sourcePackage.paths.fastlyToml,
+            buildConfig: sourcePackage.paths.buildConfig
+          })
+        });
+      },
+      executeTestCase(application, testCase, options) {
+        return fastlyJavascriptTestRuntime.executeFastlyJavascriptTestCase(application, testCase, options);
+      },
+      createLocalEnvironment: fastlyJavascriptTestRuntime.createFastlyJavascriptLocalEnvironment,
+      createTestRequest: fastlyJavascriptTestRuntime.createFastlyJavascriptTestRequest,
+      executeLocalRequest: fastlyJavascriptTestRuntime.executeFastlyJavascriptLocalRequest
+    }),
+    targets: Object.freeze({
+      native: Object.freeze({
+        version: 'pulse.provider-target-descriptor.v1',
+        target: 'native',
+        targetId: 'fastly-compute-native',
+        runtimeClass: 'native',
+        status: 'supported',
+        capabilities: Object.freeze([
+          's3.head', 's3.getText',
+          'kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap',
+          'jwt.verify',
+          'jwt.verify.hs256',
+          'jwt.verify.es256',
+          'secret.get',
+          'time.wall-clock'
+        ]),
+        keyTypes: Object.freeze(['secret', 'jwk', 'jwks']),
+        realizations: Object.freeze([
+          Object.freeze({
+            kind: 'crypto-composed',
+            realization: 'guest-source:pulse-hmac-as',
+            implementation: 'pulse-hmac-as.v1',
+            algorithms: Object.freeze(['HS256']),
+            keyTypes: Object.freeze(['secret']),
+            implemented: true,
+            status: 'implemented-e2',
+            semanticOwner: '@pulse-compute/crypto',
+            guestUnitRequired: false,
+            portable: true,
+            automaticFallback: false
+          }),
+          Object.freeze({
+            kind: 'crypto-composed',
+            realization: 'guest-linked:pulse-es256-rustcrypto-p256',
+            implementation: 'rustcrypto.p256-0.13.2.ecdsa-0.16.9.sha2-0.10.9.v1',
+            algorithms: Object.freeze(['ES256']),
+            keyTypes: Object.freeze(['jwk', 'jwks']),
+            implemented: true,
+            status: 'implemented-g4',
+            semanticOwner: '@pulse-compute/crypto',
+            guestUnitRequired: true,
+            portable: true,
+            automaticFallback: false
+          })
+        ]),
+        jwt: Object.freeze({
+          status: 'implemented-e2',
+          realization: 'guest-source:pulse-hmac-as',
+          implementation: 'pulse-hmac-as.v1',
+          packageSource: 'pulse-jwt-as',
+          providerAuthorities: Object.freeze([
+            'request',
+            'secret',
+            'wall-clock',
+            'schema',
+            'error-transport'
+          ]),
+          automaticFallback: false
+        }),
+        automaticFallback: false,
+        crypto: defineCryptoTargetCapabilities({
+          target: 'native',
+          algorithms: [...['SHA-256', 'HMAC-SHA256'].map((algorithm) => ({ algorithm, realization: 'guest-source:pulse-hmac-as', implemented: true, status: 'implemented-o2' })), {
+            algorithm: 'HS256',
+            realization: 'guest-source:pulse-hmac-as',
+            implemented: true,
+            status: 'implemented-c3'
+          }, {
+            algorithm: 'ES256',
+            realization: 'guest-linked:pulse-es256-rustcrypto-p256',
+            implemented: true,
+            status: 'implemented-g4'
+          }]
+        }),
+        finalWasmPolicy: fastlyFinalWasmPolicy,
+        reporting: reportingTargetCapability,
+        commands: Object.freeze({ compile: true, inspect: true, doctor: true, build: true, test: true, dev: true })
+      }),
+      javascript: FASTLY_JAVASCRIPT_TARGET_DESCRIPTOR
+    }),
+    execute: fastlyRuntime.executeCanonicalProgram,
+    createLoweringPlan(metadata, providerConfig = {}) {
+      return createFastlyLoweringPlan(metadata, providerConfig.bindings || {});
+    },
+    inspectRealization(invocation) {
+      const realization = inspectFastlyCanonicalTarget({
+        plan: invocation.applicationPlan,
+        providerPlan: invocation.providerPlan,
+        providerConfig: invocation.providerConfig,
+        projectRoot: invocation.project.root,
+        profile: invocation.project.profile,
+        targetDescriptor: invocation.selectedTarget,
+        synchronizedPackages: invocation.synchronizedPackages,
+        realizationArtifacts: invocation.nativeArtifact.realizationArtifacts,
+        guestUnits: invocation.nativeArtifact.guestUnits,
+        nativeOptimization: invocation.optimization,
+        compileTimeoutMs: invocation.timeoutMs
+      });
+      const { native, ...publicRealization } = realization;
+      return normalizeProviderTargetResult({
+        version: PROVIDER_TARGET_RESULT_VERSION,
+        action: 'inspect-native',
+        provider: 'fastly',
+        target: 'native',
+        status: 'inspected',
+        automaticFallback: false,
+        files: Object.freeze({}),
+        build: null,
+        realization: publicRealization,
+        packaging: null
+      });
+    },
+    writeTarget(invocation) {
+      const inspected = inspectFastlyCanonicalTarget({
+        plan: invocation.applicationPlan,
+        providerPlan: invocation.providerPlan,
+        providerConfig: invocation.providerConfig,
+        projectRoot: invocation.project.root,
+        profile: invocation.project.profile,
+        targetDescriptor: invocation.selectedTarget,
+        synchronizedPackages: invocation.synchronizedPackages,
+        realizationArtifacts: invocation.nativeArtifact.realizationArtifacts,
+        guestUnits: invocation.nativeArtifact.guestUnits,
+        nativeOptimization: invocation.optimization,
+        compileTimeoutMs: invocation.timeoutMs
+      });
+      const providerBuild = writeFastlyCanonicalTarget({
+        outDir: invocation.project.outDir,
+        plan: invocation.applicationPlan,
+        providerPlan: invocation.providerPlan,
+        native: inspected.native,
+        providerConfig: invocation.providerConfig,
+        bindings: invocation.providerConfig.bindings,
+        projectRoot: invocation.project.root,
+        profile: invocation.project.profile,
+        targetDescriptor: invocation.selectedTarget,
+        synchronizedPackages: invocation.synchronizedPackages
+      });
+      const { native, ...publicRealization } = inspected;
+      const audit = native.guestLink && native.guestLink.audit;
+      return normalizeProviderTargetResult({
+        version: PROVIDER_TARGET_RESULT_VERSION,
+        action: 'write-native',
+        provider: 'fastly',
+        target: 'native',
+        status: 'built',
+        automaticFallback: false,
+        files: Object.freeze({
+          provider: providerBuild.providerFile,
+          providerEntry: providerBuild.entryFile,
+          providerBuild: providerBuild.buildFile,
+          providerWasm: providerBuild.wasmFile,
+          providerWat: providerBuild.watFile,
+          providerNativePlan: providerBuild.nativePlanFile,
+          providerNativeManifest: providerBuild.nativeManifestFile,
+          fastlyToml: providerBuild.fastlyTomlFile,
+          providerPackage: providerBuild.packageFile,
+          providerSourceEntry: providerBuild.sourceEntryFile
+        }),
+        build: providerBuild.build,
+        realization: publicRealization,
+        packaging: audit ? Object.freeze({
+          version: PROVIDER_PACKAGING_AUDIT_VERSION,
+          artifactSha256: providerBuild.build.wasm.sha256,
+          auditedSha256: audit.artifact.sha256,
+          authorized: native.guestLink.providerPackaging.authorized === true
+        }) : null
+      });
+    },
+    executionOptions(providerConfig = {}, values = {}) {
+      return { ...values, bindings: providerConfig.bindings };
+    }
+  });
+}
+
+module.exports = defineProviderToolchain({
+  version: 'pulse.provider-toolchain.v1',
+  id: 'fastly',
+  packageName: packageManifest.name,
+  packageVersion: packageManifest.version,
+  createDriver
+});

package/src/toolchain/s3.js

@@ -0,0 +1,26 @@
+'use strict';
+const { normalizeBinding, namePattern } = require('@pulse-compute/s3/provider');
+function normalizeFastlyS3(input = {}) {
+  if (!input || typeof input !== 'object' || Array.isArray(input) || ![Object.prototype, null].includes(Object.getPrototypeOf(input))) throw new TypeError('Fastly S3 bindings must be a map.');
+  for (const key of Reflect.ownKeys(input)) {
+    const field = Object.getOwnPropertyDescriptor(input, key);
+    if (typeof key !== 'string' || !field.enumerable || !Object.hasOwn(field, 'value')) throw new TypeError('Fastly S3 bindings require data properties.');
+  }
+  return Object.freeze(Object.fromEntries(Object.entries(input).map(([name, value]) => {
+    if (!namePattern.test(name) || !value || typeof value !== 'object' || ![Object.prototype, null].includes(Object.getPrototypeOf(value))
+      || Reflect.ownKeys(value).some((key) => { const field = Object.getOwnPropertyDescriptor(value, key); return typeof key !== 'string' || !field.enumerable || !Object.hasOwn(field, 'value'); })) throw new TypeError('Fastly S3 binding is invalid.');
+    const { backend, ...binding } = value;
+    if (typeof backend !== 'string' || !namePattern.test(backend)) throw new TypeError('Fastly S3 requires a named static backend.');
+    return [name, Object.freeze({ ...normalizeBinding(binding), backend })];
+  })));
+}
+function resolveFastlyS3(effects, input) {
+  const configured = normalizeFastlyS3(input);
+  return Object.freeze(effects.flatMap((effect, index) => {
+    if (!['s3.head', 's3.getText', 's3.putText'].includes(effect.kind)) return [];
+    const name = effect.resource && effect.resource.binding;
+    if (!Object.hasOwn(configured, name)) throw new TypeError('The required Fastly S3 binding is missing.');
+    return [Object.freeze({ index, ...configured[name], contentType: effect.operation === 'putText' ? require('@pulse-compute/s3/provider').normalizePutOptions({ contentType: effect.payload && effect.payload.contentType }).contentType : '' })];
+  }));
+}
+module.exports = { normalizeFastlyS3, resolveFastlyS3 };