@pulse-compute/provider-fastly 0.0.0 → 1.0.0-beta.2

package/src/build/s3-native.as.ts

@@ -0,0 +1,215 @@
+// Provider-owned lifecycle and host ABI. Protocol algorithms are S3-owned.
+@external('fastly_async_io', 'select') declare function __s3_select(handles: usize, count: i32, timeout: i32, done: usize): i32
+@external('fastly_http_req', 'pending_req_poll_v2') declare function __s3_poll(pending: i32, detail: usize, done: usize, response: usize, body: usize): i32
+@external('fastly_http_req', 'cache_override_set') declare function __s3_cache(request: i32, tag: i32, ttl: i32, swr: i32): i32
+@external('fastly_http_req', 'auto_decompress_response_set') declare function __s3_decompress(request: i32, encodings: i32): i32
+@external('fastly_http_req', 'close') declare function __s3_close_req(request: i32): i32
+@external('fastly_http_resp', 'close') declare function __s3_close_resp(response: i32): i32
+@external('fastly_http_body', 'close') declare function __s3_close_body(body: i32): i32
+@external('fastly_http_resp', 'header_names_get') declare function __s3_header_names(response: i32, buffer: usize, size: i32, cursor: i32, end: usize, written: usize): i32
+@external('fastly_http_resp', 'header_values_get') declare function __s3_header_values(response: i32, name: usize, length: i32, buffer: usize, size: i32, cursor: i32, end: usize, written: usize): i32
+
+class __PulseS3Binding {
+  contentType: string = ''; endpoint: string = ''; bucket: string = ''; region: string = ''; backend: string = '';
+  id: string = ''; secret: string = ''; token: string = ''; max: i32 = 32768; timeout: i32 = 10000;
+}
+@lazy const __s3_dispatched = new StaticArray<bool>(PULSE_FASTLY_EFFECT_COUNT)
+@lazy const __s3_sent_bytes = new StaticArray<i32>(PULSE_FASTLY_EFFECT_COUNT)
+@lazy const __s3_digests = new Array<string>(PULSE_FASTLY_EFFECT_COUNT).fill('')
+@lazy const __s3_deadlines = new StaticArray<i64>(PULSE_FASTLY_EFFECT_COUNT)
+function __s3_clock(id: i32): i64 {
+  const out = new StaticArray<i64>(1);
+  return wasi_snapshot_preview1_clock_time_get(id, 1000000, changetype<usize>(out)) == 0 ? out[0] : -1;
+}
+function __s3_remaining(index: i32): i32 {
+  const now = __s3_clock(1);
+  if (now < 0) return 0;
+  const ns = __s3_deadlines[index] - now;
+  return ns <= 0 ? 0 : i32((ns + 999999) / 1000000);
+}
+function __s3_set(object: i32, name: string, value: i32): void { host_value_object_set(object, __pulse_fastly_string_value(name), value) }
+function __s3_result(status: string, reason: string = '', http: i32 = 0): i32 {
+  const result = host_value_object(); __s3_set(result, 'status', __pulse_fastly_string_value(status));
+  if (reason.length) __s3_set(result, 'reason', __pulse_fastly_string_value(reason));
+  if (http > 0) { const value = new __PulseFastlyValue(); value.kind = PULSE_VALUE_NUMBER; value.number = f64(http); __s3_set(result, 'httpStatus', __pulse_fastly_put(value)); }
+  return result;
+}
+function __s3_failure(index: i32, reason: string, http: i32 = 0): i32 {
+  return __s3_result(__pulse_fastly_effect_kind(index) == 14 ? (__s3_dispatched[index] ? 'unknown' : 'not-stored') : 'failed', reason, http);
+}
+function __s3_fail(index: i32, reason: string): void { __pulse_fastly_ready_effect(index, __s3_failure(index, reason)) }
+function __s3_secret(store: i32, name: string): string | null {
+  const key = __pulse_s3_bytes(name), out = new StaticArray<i32>(1), size = new StaticArray<i32>(1), bytes = new Uint8Array(4096);
+  if (fastly_secret_store_get(store, key.dataStart, key.length, changetype<usize>(out)) != 0) return null;
+  const status = fastly_secret_store_plaintext(out[0], bytes.dataStart, bytes.length, changetype<usize>(size));
+  let result: string | null = null;
+  if (status == 0 && size[0] > 0 && size[0] <= bytes.length) {
+    const raw = bytes.subarray(0, size[0]);
+    if (__pulse_s3_utf8_valid(raw)) result = String.UTF8.decodeUnsafe(raw.dataStart, raw.length, false);
+  }
+  bytes.fill(0);
+  if (result !== null) __pulse_fastly_remember_secret(result);
+  return result;
+}
+function __s3_header(request: i32, name: string, value: string): bool {
+  const n = __pulse_s3_bytes(name), v = __pulse_s3_bytes(value);
+  return fastly_http_req_header_insert(request, n.dataStart, n.length, v.dataStart, v.length) == 0;
+}
+function __pulse_fastly_s3_begin(index: i32, outer: __PulseFastlyValue): void {
+  __s3_dispatched[index] = false; __s3_sent_bytes[index] = 0; __s3_digests[index] = '';
+  const put = __pulse_fastly_effect_kind(index) == 14;
+  const payload = __pulse_fastly_value(__pulse_fastly_payload_field(outer, 'invocation'));
+  const input = __pulse_fastly_value(__pulse_fastly_payload_field(payload, 'key'));
+  if (input.kind != PULSE_VALUE_STRING) { __s3_fail(index, 'invalid-key'); return; }
+  const encoded = __pulse_s3_key(input.text);
+  if (encoded === null) { __s3_fail(index, 'invalid-key'); return; }
+  // Package effect payloads and signed paths must not enter provider logs.
+  __pulse_fastly_remember_secret(input.text);
+  const binding = __pulse_fastly_s3_binding(index), start = __s3_clock(1);
+  if (start < 0) { __s3_fail(index, 'configuration'); return; }
+  __s3_deadlines[index] = start + i64(binding.timeout) * 1000000;
+  let data = new Uint8Array(0);
+  if (put) {
+    const text = __pulse_fastly_value(__pulse_fastly_payload_field(payload, 'text'));
+    if (text.kind != PULSE_VALUE_STRING || !__pulse_s3_scalar(text.text)) { __s3_fail(index, 'invalid-text'); return; }
+    data = __pulse_s3_bytes(text.text);
+    if (data.length > binding.max) { __s3_fail(index, 'too-large'); return; }
+    __pulse_fastly_remember_secret(text.text);
+  }
+  const storeName = __pulse_s3_bytes(__pulse_fastly_secret_store(index)), store = new StaticArray<i32>(1);
+  if (fastly_secret_store_open(storeName.dataStart, storeName.length, changetype<usize>(store)) != 0) { __s3_fail(index, 'credentials'); return; }
+  const id = __s3_secret(store[0], binding.id), secret = __s3_secret(store[0], binding.secret);
+  const token = binding.token.length ? __s3_secret(store[0], binding.token) : '';
+  if (__s3_remaining(index) == 0) { __s3_fail(index, 'timeout'); return; }
+  if (id === null || secret === null || token === null || !__pulse_s3_credentials(id, secret, token)) { __s3_fail(index, 'credentials'); return; }
+  const method = put ? 'PUT' : __pulse_fastly_effect_kind(index) == 12 ? 'HEAD' : 'GET', path = '/' + binding.bucket + '/' + encoded;
+  const now = __s3_clock(0);
+  if (now < 0 || !__pulse_s3_date(now / 1000000000).length) { __s3_fail(index, 'configuration'); return; }
+  const signature = __pulse_s3_sign(method, path, binding.endpoint.slice(8), binding.region, id, secret, token, now / 1000000000, data, binding.contentType);
+  __s3_sent_bytes[index] = data.length; __s3_digests[index] = signature.digest;
+  __pulse_fastly_remember_secret(signature.digest);
+  __pulse_fastly_remember_secret(signature.authorization); __pulse_fastly_remember_secret(binding.endpoint + path);
+  if (__s3_remaining(index) == 0) { __s3_fail(index, 'timeout'); return; }
+  const request = new StaticArray<i32>(1), body = new StaticArray<i32>(1), pending = new StaticArray<i32>(1);
+  if (fastly_http_req_new(changetype<usize>(request)) != 0) { __s3_fail(index, 'transport'); return; }
+  const req = request[0], url = __pulse_s3_bytes(binding.endpoint + path), verb = __pulse_s3_bytes(method), backend = __pulse_s3_bytes(binding.backend);
+  let ok = fastly_http_req_uri_set(req, url.dataStart, url.length) == 0 && fastly_http_req_method_set(req, verb.dataStart, verb.length) == 0
+    && __s3_cache(req, 1, 0, 0) == 0 && __s3_decompress(req, 0) == 0
+    && __s3_header(req, 'host', binding.endpoint.slice(8)) && __s3_header(req, 'x-amz-date', signature.date)
+    && __s3_header(req, 'x-amz-content-sha256', signature.digest) && __s3_header(req, 'authorization', signature.authorization)
+    && __s3_header(req, 'accept-encoding', 'identity');
+  if (ok && put) ok = __s3_header(req, 'content-type', binding.contentType) && __s3_header(req, 'content-length', data.length.toString());
+  if (ok && token.length) ok = __s3_header(req, 'x-amz-security-token', token);
+  if (!ok || fastly_http_body_new(changetype<usize>(body)) != 0) { __s3_close_req(req); __s3_fail(index, 'transport'); return; }
+  let offset = 0; const written = new StaticArray<i32>(1);
+  while (offset < data.length) {
+    if (__s3_remaining(index) == 0) { __s3_close_req(req); __s3_close_body(body[0]); __s3_fail(index, 'timeout'); return; }
+    if (fastly_http_body_write(body[0], data.dataStart + offset, data.length - offset, 0, changetype<usize>(written)) != 0 || written[0] <= 0 || written[0] > data.length - offset) {
+      __s3_close_req(req); __s3_close_body(body[0]); __s3_fail(index, 'transport'); return;
+    }
+    offset += written[0];
+  }
+  if (__s3_remaining(index) == 0) { __s3_close_req(req); __s3_close_body(body[0]); __s3_fail(index, 'timeout'); return; }
+  __s3_dispatched[index] = true;
+  if (fastly_http_req_send_async(req, body[0], backend.dataStart, backend.length, changetype<usize>(pending)) != 0) {
+    __s3_close_req(req); __s3_close_body(body[0]); __s3_fail(index, 'transport'); return;
+  }
+  // send_async consumes request/body. Pending handles have no cancel hostcall.
+  __pulse_fastly_pending[index] = pending[0]; __pulse_fastly_pending_mode[index] = PULSE_FASTLY_PENDING_ASYNC;
+}
+function __s3_wait_ready(index: i32, handle: i32): i32 {
+  const timeout = __s3_remaining(index); if (timeout == 0) return 0;
+  const handles = new StaticArray<i32>(1), done = new StaticArray<i32>(1); handles[0] = handle;
+  if (__s3_select(changetype<usize>(handles), 1, timeout, changetype<usize>(done)) != 0) return -1;
+  return done[0] == -1 || __s3_remaining(index) == 0 ? 0 : 1;
+}
+function __s3_list(buffer: Uint8Array, size: i32): Array<string> | null {
+  if (size < 0 || size > buffer.length || (size > 0 && buffer[size - 1] != 0)) return null;
+  const result = new Array<string>(); let start = 0;
+  for (let i = 0; i < size; i++) if (buffer[i] == 0) {
+    const bytes = buffer.subarray(start, i); if (!__pulse_s3_utf8_valid(bytes)) return null;
+    result.push(String.UTF8.decodeUnsafe(bytes.dataStart, bytes.length, false)); start = i + 1;
+  }
+  return result;
+}
+function __s3_read_response(index: i32, response: i32, body: i32, status: i32): i32 {
+  const put = __pulse_fastly_effect_kind(index) == 14;
+  const rejected = put && status >= 400 && status <= 499 && status != 408;
+  if (!put && status == 404) return __s3_result('not-found');
+  if (status != 200 && !rejected) return __s3_failure(index, __pulse_s3_status_reason(status), status);
+  const buffer = new Uint8Array(16384), end = new StaticArray<i64>(1), size = new StaticArray<i32>(1);
+  if (__s3_header_names(response, buffer.dataStart, buffer.length, 0, changetype<usize>(end), changetype<usize>(size)) != 0 || end[0] >= 0) return __s3_failure(index, 'protocol', status);
+  const names = __s3_list(buffer, size[0]); if (names === null) return __s3_failure(index, 'protocol', status);
+  let total = 0, length: f64 = -1; const seen = new Set<string>();
+  const result = __s3_result(put ? 'stored' : 'found');
+  for (let i = 0; i < names.length; i++) {
+    const rawName = names[i], name = rawName.toLowerCase(), bytes = __pulse_s3_bytes(rawName);
+    if (__s3_header_values(response, bytes.dataStart, bytes.length, buffer.dataStart, buffer.length, 0, changetype<usize>(end), changetype<usize>(size)) != 0 || end[0] >= 0) return __s3_failure(index, 'protocol', status);
+    const values = __s3_list(buffer, size[0]); if (values === null) return __s3_failure(index, 'protocol', status);
+    const selected = name == 'content-length' || name == 'content-type' || name == 'etag' || name == 'content-encoding';
+    if (selected && (seen.has(name) || values.length != 1)) return __s3_failure(index, 'protocol', status);
+    seen.add(name);
+    for (let v = 0; v < values.length; v++) {
+      const value = values[v], count = __pulse_s3_bytes(value).length;
+      total += bytes.length + count + 4; if (total > 16384) return __s3_failure(index, 'protocol', status);
+      if (!selected) continue;
+      if (count > 1024 || !__pulse_s3_scalar(value, true)) return __s3_failure(index, 'protocol', status);
+      if (name == 'content-encoding' && value.toLowerCase() != 'identity') return __s3_failure(index, 'protocol', status);
+      if (name == 'content-length') {
+        if (!value.length || (value.length > 1 && value.charCodeAt(0) == 48)) return __s3_failure(index, 'protocol', status);
+        length = 0;
+        for (let c = 0; c < value.length; c++) { const digit = value.charCodeAt(c) - 48; if (digit < 0 || digit > 9) return __s3_failure(index, 'protocol', status); length = length * 10 + digit; if (length > 9007199254740991) return __s3_failure(index, 'protocol', status); }
+      }
+      if (name == 'etag') { if (!value.length) return __s3_failure(index, 'protocol', status); __s3_set(result, 'etag', __pulse_fastly_string_value(value)); }
+      if (name == 'content-type' && !put) __s3_set(result, 'contentType', __pulse_fastly_string_value(value));
+    }
+  }
+  if (__s3_remaining(index) == 0) return __s3_failure(index, 'timeout', status);
+  const head = __pulse_fastly_effect_kind(index) == 12, binding = __pulse_fastly_s3_binding(index);
+  if (head && length < 0) return __s3_failure(index, 'protocol', status);
+  if (!head) {
+    const maximum = put && !rejected ? 0 : binding.max;
+    if (length > maximum) return __s3_failure(index, put ? 'protocol' : 'too-large', status);
+    const data = new Uint8Array(maximum + 1); let count = 0;
+    while (true) {
+      const ready = __s3_wait_ready(index, body);
+      if (ready <= 0) return __s3_failure(index, ready == 0 ? 'timeout' : 'transport', status);
+      if (fastly_http_body_read(body, data.dataStart + count, data.length - count, changetype<usize>(size)) != 0) return __s3_failure(index, 'protocol', status);
+      if (size[0] < 0 || size[0] > data.length - count) return __s3_failure(index, 'protocol', status);
+      if (size[0] == 0) break;
+      count += size[0]; if (count > maximum) return __s3_failure(index, put ? 'protocol' : 'too-large', status);
+    }
+    if (length >= 0 && length != count) return __s3_failure(index, 'protocol', status);
+    if (put) {
+      if (__s3_remaining(index) == 0) return __s3_failure(index, 'timeout', status);
+      if (rejected) return __s3_result('not-stored', status == 401 || status == 403 ? 'not-authorized' : status == 429 ? 'throttled' : 'rejected', status);
+      const sent = new __PulseFastlyValue(); sent.kind = PULSE_VALUE_NUMBER; sent.number = f64(__s3_sent_bytes[index]);
+      __s3_set(result, 'byteLength', __pulse_fastly_put(sent));
+      __s3_set(result, 'sha256', __pulse_fastly_string_value(__s3_digests[index]));
+      return result;
+    }
+    length = f64(count); const raw = data.subarray(0, count), digest = __pulse_s3_hex(__pulse_s3_sha(raw));
+    if (!__pulse_s3_utf8_valid(raw)) return __s3_failure(index, 'invalid-utf8', status);
+    __s3_set(result, 'text', __pulse_fastly_string_value(String.UTF8.decodeUnsafe(raw.dataStart, raw.length, false)));
+    __s3_set(result, 'sha256', __pulse_fastly_string_value(digest));
+  }
+  if (__s3_remaining(index) == 0) return __s3_failure(index, 'timeout', status);
+  const sizeValue = new __PulseFastlyValue(); sizeValue.kind = PULSE_VALUE_NUMBER; sizeValue.number = length;
+  __s3_set(result, 'byteLength', __pulse_fastly_put(sizeValue)); return result;
+}
+function __pulse_fastly_s3_wait(index: i32): i32 {
+  if (__pulse_fastly_pending_mode[index] == PULSE_FASTLY_PENDING_READY) return __pulse_fastly_wait_ready(index);
+  const pending = __pulse_fastly_pending[index], detail = new StaticArray<i32>(4), done = new StaticArray<i32>(1);
+  const response = new StaticArray<i32>(1), body = new StaticArray<i32>(1), code = new StaticArray<i32>(1);
+  __pulse_fastly_pending_mode[index] = PULSE_FASTLY_PENDING_NONE; __pulse_fastly_pending[index] = 0;
+  while (true) {
+    const ready = __s3_wait_ready(index, pending);
+    if (ready <= 0) return __s3_failure(index, ready == 0 ? 'timeout' : 'transport');
+    if (__s3_poll(pending, changetype<usize>(detail), changetype<usize>(done), changetype<usize>(response), changetype<usize>(body)) != 0) return __s3_failure(index, 'transport');
+    if (done[0] != 0) break;
+  }
+  let result: i32;
+  if (fastly_http_resp_status_get(response[0], changetype<usize>(code)) != 0) result = __s3_failure(index, 'protocol');
+  else result = __s3_remaining(index) == 0 ? __s3_failure(index, 'timeout', code[0]) : __s3_read_response(index, response[0], body[0], code[0]);
+  __s3_close_body(body[0]); __s3_close_resp(response[0]); return result;
+}

package/src/build/s3-native.js

@@ -0,0 +1,30 @@
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const { pulseS3AssemblyScriptSource } = require('@pulse-compute/s3/pulsewasm-native');
+const S3_IMPORTS = Object.freeze([
+  'fastly_async_io:select', 'fastly_http_req:pending_req_poll_v2', 'fastly_http_req:cache_override_set',
+  'fastly_http_req:auto_decompress_response_set', 'fastly_http_req:close', 'fastly_http_resp:close', 'fastly_http_body:close',
+  'fastly_http_resp:header_names_get', 'fastly_http_resp:header_values_get', 'fastly_http_resp:status_get',
+  'fastly_http_req:new', 'fastly_http_req:method_set', 'fastly_http_req:uri_set', 'fastly_http_req:header_insert', 'fastly_http_req:send_async',
+  'fastly_http_body:new', 'fastly_http_body:read', 'fastly_http_body:write', 'fastly_secret_store:open', 'fastly_secret_store:get', 'fastly_secret_store:plaintext',
+  'wasi_snapshot_preview1:clock_time_get'
+]);
+function s3NativeSource(plan, bindings) {
+  if (!bindings.s3.length) return '';
+  const contribution = pulseS3AssemblyScriptSource();
+  for (const name of contribution.cryptoRequirements) {
+    const selected = plan.crypto && plan.crypto.algorithms.find((entry) => entry.algorithm === name);
+    if (!selected || selected.realization !== 'guest-source:pulse-hmac-as' || selected.implementation !== 'pulse-hmac-as.v1'
+      || selected.kind !== 'guest-source' || selected.targetImplemented !== true || selected.automaticFallback !== false) throw new TypeError('Fastly S3 requires its exact selected Native Crypto algorithms.');
+  }
+  const lines = ['function __pulse_fastly_s3_binding(index: i32): __PulseS3Binding {', 'const value = new __PulseS3Binding();', 'switch (index) {'];
+  for (const binding of bindings.s3) {
+    lines.push(`case ${binding.index}:`);
+    for (const [field, input] of Object.entries({ contentType: 'contentType', endpoint: 'endpoint', bucket: 'bucket', region: 'region', backend: 'backend', id: 'accessKeyIdSecret', secret: 'secretAccessKeySecret', token: 'sessionTokenSecret' })) lines.push(`value.${field} = ${JSON.stringify(binding[input] || '')};`);
+    lines.push(`value.max = ${binding.maxTextBytes}; value.timeout = ${binding.timeoutMs}; break;`);
+  }
+  lines.push('default: unreachable();', '}', 'return value;', '}');
+  return [contribution.source, fs.readFileSync(path.join(__dirname, 's3-native.as.ts'), 'utf8'), lines.join('\n')].join('\n');
+}
+module.exports = { S3_IMPORTS, s3NativeSource };

package/src/compiler/assets-package-out-parity-proof.js

@@ -0,0 +1,338 @@
+'use strict';
+
+function loadAssetsContracts() {
+  try {
+    return require('@pulse-compute/wasm-contracts/assets/contracts');
+  } catch (error) {
+    if (error && error.code === 'MODULE_NOT_FOUND' && String(error.message).includes('@pulse-compute/wasm-contracts')) {
+      return require('../../../../wasm/packages/contracts/src/assets/contracts.js');
+    }
+    throw error;
+  }
+}
+
+function loadDiagnostics() {
+  try {
+    return require('@pulse-compute/wasm-contracts/diagnostics');
+  } catch (error) {
+    if (error && error.code === 'MODULE_NOT_FOUND' && String(error.message).includes('@pulse-compute/wasm-contracts')) {
+      return require('../../../../wasm/packages/contracts/src/diagnostics.js');
+    }
+    throw error;
+  }
+}
+
+const assetsContracts = loadAssetsContracts();
+const { PACKAGE_VERSION, normalizeArtifact, normalizeDiagnostic } = loadDiagnostics();
+const { buildFastlyAssetsProviderProof } = require('./assets-provider-proof.js');
+const { buildFastlyAssetsProviderConfig } = require('../runtime/assets-provider.js');
+
+const phaseName = 'fastly-assets-package-out-parity-proof';
+
+function clone(value) {
+  if (Array.isArray(value)) return value.map(clone);
+  if (value && typeof value === 'object') return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, clone(entry)]));
+  return value;
+}
+
+function normalize(input) {
+  return input && input.artifact && typeof input.artifact === 'object' ? input.artifact : input;
+}
+
+function makeDiagnostic(code, message, severity = 'error', details) {
+  return normalizeDiagnostic({
+    phase: phaseName,
+    severity,
+    code,
+    message,
+    hint: details && details.hint,
+    details,
+    loc: { file: '<fastly-assets-package-out-parity-proof>' }
+  });
+}
+
+function check(name, passed, details, failures, diagnostics) {
+  const entry = { name, status: passed ? 'ok' : 'error', details: details || {} };
+  if (!passed) {
+    failures.push(entry);
+    diagnostics.push(makeDiagnostic(
+      assetsContracts.ASSETS_DIAGNOSTIC_CODES.FASTLY_PACKAGE_OUT_PARITY_SMOKE_FAILED,
+      `Fastly assets package-out parity check failed: ${name}.`,
+      'error',
+      { check: name, details: entry.details }
+    ));
+  }
+  return entry;
+}
+
+function checkByName(proof, needle) {
+  const checks = proof && proof.smoke && Array.isArray(proof.smoke.checks) ? proof.smoke.checks : [];
+  return checks.some((entry) => entry && String(entry.name || '').includes(needle) && entry.status === 'ok');
+}
+
+function summaryFlag(proof, name) {
+  return Boolean(proof && proof.summary && proof.summary[name] === true);
+}
+
+function packageOutDiscovered(packageOutProof) {
+  return Boolean(packageOutProof && (
+    packageOutProof.discoveredFromNodeModules === true ||
+    (packageOutProof.discovery && packageOutProof.discovery.discoveredFromNodeModules === true) ||
+    (packageOutProof.summary && packageOutProof.summary.discoveredFromNodeModules === true)
+  ));
+}
+
+function builderLoadedFromPackageOut(packageOutProof) {
+  const compilerBuilder = packageOutProof && packageOutProof.discovery && packageOutProof.discovery.compilerBuilder;
+  return Boolean(compilerBuilder &&
+    compilerBuilder.builderOwner === '@pulse-compute/assets' &&
+    String(compilerBuilder.entry || '').includes('node_modules/@pulse-compute/assets/pulsewasm.compiler.cjs'));
+}
+
+function packageOwnedLowerer(plan) {
+  const policy = plan && plan.policy || {};
+  return Boolean(plan &&
+    plan.npmPackage === '@pulse-compute/assets' &&
+    plan.lowerableSubpath === '@pulse-compute/assets' &&
+    policy.builderOwner === '@pulse-compute/assets' &&
+    policy.compilerOwnsPackageMapping === false);
+}
+
+function providerProofOrBuild(options, plan, diagnostics) {
+  const provided = normalize(options.fastlyAssetsProviderProof || options.providerProof);
+  if (provided) return { artifact: provided, diagnostics: [] };
+  if (!plan) return undefined;
+  const proof = buildFastlyAssetsProviderProof({
+    cwd: options.cwd,
+    generatedBy: options.generatedBy || PACKAGE_VERSION,
+    assetsLoweringPlan: plan,
+    resolvedConfig: options.resolvedConfig,
+    fastlyHostcallBinding: options.fastlyHostcallBinding,
+    fastlyAdapter: options.fastlyAdapter,
+    requestResultHeaders: options.requestResultHeaders,
+    streamingPassthrough: options.streamingPassthrough,
+    wasmHostAbi: options.wasmHostAbi
+  });
+  diagnostics.push(...(proof.diagnostics || []));
+  return proof;
+}
+
+function buildFastlyAssetsPackageOutParityProof(options = {}) {
+  const cwd = options.cwd || process.cwd();
+  const generatedBy = options.generatedBy || PACKAGE_VERSION;
+  const plan = normalize(options.assetsLoweringPlan || options.plan);
+  const sidecarPlan = normalize(options.assetsCompiledWasmSidecarPlan || options.sidecarPlan);
+  const packageOutProof = normalize(options.assetsPackageOutDiscoveryProof || options.packageOutDiscoveryProof || options.packageOutProof);
+  const nodeCompiledProof = normalize(options.nodeCompiledWasmAssetsLifecycleProof || options.nodeProof);
+  const diagnostics = [];
+  const failures = [];
+  const checks = [];
+
+  if (!plan) {
+    diagnostics.push(makeDiagnostic(
+      assetsContracts.ASSETS_DIAGNOSTIC_CODES.FASTLY_PACKAGE_OUT_PARITY_PLAN_REQUIRED,
+      'Fastly assets package-out parity proof requires assets-lowering-plan.json.',
+      'error',
+      { sourceArtifact: assetsContracts.ASSETS_LOWERING_PLAN_VERSION }
+    ));
+  }
+  if (!sidecarPlan) {
+    diagnostics.push(makeDiagnostic(
+      assetsContracts.ASSETS_DIAGNOSTIC_CODES.SIDECAR_FILE_MISSING,
+      'Fastly assets package-out parity proof requires assets-compiled-wasm-sidecar-plan.json so compiled-Wasm readiness can be classified honestly.',
+      'error',
+      { sourceArtifact: assetsContracts.ASSETS_COMPILED_WASM_SIDECAR_PLAN_ARTIFACT }
+    ));
+  }
+  const sidecarPackageOut = sidecarPlan && sidecarPlan.packageOut ? sidecarPlan.packageOut : undefined;
+  if (!packageOutProof && !(sidecarPackageOut && sidecarPackageOut.discoveredFromNodeModules === true && sidecarPackageOut.builderLoadedFromNodeModules === true)) {
+    diagnostics.push(makeDiagnostic(
+      assetsContracts.ASSETS_DIAGNOSTIC_CODES.FASTLY_PACKAGE_OUT_PARITY_PLAN_REQUIRED,
+      'Fastly assets package-out parity proof requires assets-package-out-discovery-proof.json or sidecar package-out evidence to prove packaged @pulse-compute/assets discovery.',
+      'error',
+      { sourceArtifact: assetsContracts.ASSETS_PACKAGE_OUT_DISCOVERY_PROOF_ARTIFACT }
+    ));
+  }
+
+  const fastlyProviderProof = providerProofOrBuild(options, plan, diagnostics);
+  const providerProofArtifact = fastlyProviderProof && normalize(fastlyProviderProof);
+  const providerConfig = options.providerConfig || (providerProofArtifact && providerProofArtifact.providerConfig) || buildFastlyAssetsProviderConfig({ plan, resolvedConfig: options.resolvedConfig });
+
+  const packageOwnedLoweringConsumed = packageOwnedLowerer(plan);
+  const discoveredFromPackagedAssets = packageOutDiscovered(packageOutProof) || Boolean(sidecarPackageOut && sidecarPackageOut.discoveredFromNodeModules === true);
+  const packageBuilderLoaded = builderLoadedFromPackageOut(packageOutProof) || Boolean(sidecarPackageOut && sidecarPackageOut.builderLoadedFromNodeModules === true);
+  const symbolicStoreConfigValidated = Boolean(providerConfig && providerConfig.provider === 'fastly' && providerConfig.symbolicRefsOnly === true && Array.isArray(providerConfig.stores) && providerConfig.stores.length > 0 && providerConfig.stores.every((store) => String(store.endpointRef || '').startsWith('$config:') && String(store.bucketRef || '').startsWith('$config:') && String(store.keyRef || '').startsWith('$secret:')));
+  const getMappingValidated = summaryFlag(providerProofArtifact, 'getTextValidated');
+  const headMappingValidated = summaryFlag(providerProofArtifact, 'headValidated');
+  const headersValidated = checkByName(providerProofArtifact, 'headers/status pass through') || Boolean(providerProofArtifact && providerProofArtifact.payloadModes && providerProofArtifact.payloadModes.headerPassThrough && providerProofArtifact.payloadModes.headerPassThrough.status === 'implemented-now');
+  const cacheControlValidated = checkByName(providerProofArtifact, 'cache-control policy is preserved');
+  const notFoundPolicyValidated = summaryFlag(providerProofArtifact, 'notFoundValidated');
+  const binaryBodyReserved = summaryFlag(providerProofArtifact, 'binaryReservedValidated') || Boolean(providerProofArtifact && providerProofArtifact.payloadModes && providerProofArtifact.payloadModes.binaryBodyBufferResponse && providerProofArtifact.payloadModes.binaryBodyBufferResponse.status === 'reserved-with-diagnostic');
+  const streamProviderProofImplemented = Boolean(providerProofArtifact && providerProofArtifact.payloadModes && providerProofArtifact.payloadModes.streamPassThroughResponse && providerProofArtifact.payloadModes.streamPassThroughResponse.status === 'implemented-fastly-proof');
+  const terminalSidecarPlanned = Boolean(sidecarPlan && sidecarPlan.summary && sidecarPlan.summary.terminalAssetResponseEffectPlanned === true);
+  const sidecarPackaged = Boolean((sidecarPlan && sidecarPlan.summary && sidecarPlan.summary.packageOutSidecarValidated === true) || (sidecarPackageOut && sidecarPackageOut.discoveredFromNodeModules === true && sidecarPackageOut.sidecarFile));
+  const nodeCompiledReferenceImplemented = Boolean(nodeCompiledProof && nodeCompiledProof.compiledWasmLowering === true && nodeCompiledProof.compiledWasmRuntimeBehaviorImplemented === true);
+
+  checks.push(check('package_owned_lowering_consumed', packageOwnedLoweringConsumed, { package: plan && plan.npmPackage, lowerableSubpath: plan && plan.lowerableSubpath, policy: plan && plan.policy }, failures, diagnostics));
+  checks.push(check('packaged_assets_discovered_from_node_modules', discoveredFromPackagedAssets && packageBuilderLoaded, { discoveredFromNodeModules: discoveredFromPackagedAssets, packageBuilderLoaded, compilerBuilder: packageOutProof && packageOutProof.discovery && packageOutProof.discovery.compilerBuilder }, failures, diagnostics));
+  checks.push(check('symbolic_fastly_store_config_validated', symbolicStoreConfigValidated, { providerConfig }, failures, diagnostics));
+  checks.push(check('get_mapping_validated', getMappingValidated, { summary: providerProofArtifact && providerProofArtifact.summary }, failures, diagnostics));
+  checks.push(check('head_mapping_validated', headMappingValidated, { summary: providerProofArtifact && providerProofArtifact.summary }, failures, diagnostics));
+  checks.push(check('headers_validated', headersValidated, { headerPassThrough: providerProofArtifact && providerProofArtifact.payloadModes && providerProofArtifact.payloadModes.headerPassThrough }, failures, diagnostics));
+  checks.push(check('cache_control_validated', cacheControlValidated, { checks: providerProofArtifact && providerProofArtifact.smoke && providerProofArtifact.smoke.checks }, failures, diagnostics));
+  checks.push(check('not_found_policy_validated', notFoundPolicyValidated, { summary: providerProofArtifact && providerProofArtifact.summary }, failures, diagnostics));
+  checks.push(check('sidecar_readiness_classified', terminalSidecarPlanned && sidecarPackaged, { terminalAssetResponseEffectPlanned: terminalSidecarPlanned, packageOutSidecarValidated: sidecarPackaged, summary: sidecarPlan && sidecarPlan.summary }, failures, diagnostics));
+  checks.push(check('binary_body_reserved', binaryBodyReserved, { binaryBodyBufferResponse: providerProofArtifact && providerProofArtifact.payloadModes && providerProofArtifact.payloadModes.binaryBodyBufferResponse }, failures, diagnostics));
+  checks.push(check('no_external_fastly_service_required', Boolean(providerProofArtifact && providerProofArtifact.scope && providerProofArtifact.scope.configSecretRefs === 'symbolic-only') && providerProofArtifact.proofMode === 'direct-fastly-provider-smoke-connected-to-lowering-plan', { proofMode: providerProofArtifact && providerProofArtifact.proofMode, scope: providerProofArtifact && providerProofArtifact.scope }, failures, diagnostics));
+
+  diagnostics.push(makeDiagnostic(
+    assetsContracts.ASSETS_DIAGNOSTIC_CODES.FASTLY_ASSETS_COMPILED_WASM_PLAN_ONLY,
+    'Fastly compiled-Wasm assets terminal response execution is explicitly plan-only until a provider-owned compiled-Wasm Fastly bridge is wired.',
+    'warning',
+    { compiledWasmAssetsReadiness: 'plan-only', nodeReferenceCompiledLifecycleImplemented: nodeCompiledReferenceImplemented }
+  ));
+
+  const errorDiagnostics = diagnostics.filter((entry) => (entry.severity || 'error') === 'error');
+  const artifact = normalizeArtifact({
+    version: assetsContracts.ASSETS_FASTLY_PACKAGE_OUT_PARITY_PROOF_VERSION,
+    generatedBy,
+    phase: '50',
+    artifact: assetsContracts.ASSETS_FASTLY_PACKAGE_OUT_PARITY_PROOF_ARTIFACT,
+    contractId: assetsContracts.ASSETS_CONTRACT_ID,
+    status: errorDiagnostics.length === 0 ? 'ok' : 'error',
+    provider: 'fastly',
+    providerPackage: '@pulse-compute/provider-fastly',
+    package: '@pulse-compute/assets',
+    lowerableSubpath: plan && plan.lowerableSubpath || '@pulse-compute/assets',
+    sourceAssetsLoweringPlanVersion: plan && plan.version,
+    sourceAssetsCompiledWasmSidecarPlanVersion: sidecarPlan && sidecarPlan.version,
+    sourcePackageOutDiscoveryProofVersion: packageOutProof && packageOutProof.version,
+    sourceFastlyAssetsProviderProofVersion: providerProofArtifact && providerProofArtifact.version,
+    sourceNodeCompiledWasmAssetsLifecycleProofVersion: nodeCompiledProof && nodeCompiledProof.version,
+    packageOwnedLoweringConsumed,
+    discoveredFromPackagedAssets,
+    symbolicStoreConfigValidated,
+    getMappingValidated,
+    headMappingValidated,
+    headersValidated,
+    cacheControlValidated,
+    notFoundPolicyValidated,
+    compiledWasmAssetsReadiness: 'plan-only',
+    compiledWasmPlanOnlyDiagnostic: assetsContracts.ASSETS_DIAGNOSTIC_CODES.FASTLY_ASSETS_COMPILED_WASM_PLAN_ONLY,
+    binaryBodyReserved,
+    streamBodyReadiness: streamProviderProofImplemented ? 'provider-proof-implemented-compiled-wasm-plan-only' : 'plan-only',
+    noExternalFastlyServiceRequired: true,
+    actualNetworkFetch: false,
+    policy: {
+      compilerOrchestratesOnly: true,
+      packageOwnsLoweringSurface: true,
+      packageOwnedLowererConsumed: packageOwnedLoweringConsumed,
+      providerOwnsFastlyBehavior: true,
+      noExternalFastlyServiceRequired: true,
+      packageOutFixtureRequired: true,
+      monorepoAssetsSourcePathRequired: false,
+      compiledWasmAssetsReadiness: 'plan-only',
+      directProviderProofFallback: false,
+      symbolicStoreConfigOnly: true,
+      objectStoreMutationApis: false,
+      uploads: false,
+      invalidation: false,
+      binaryBody: false,
+      streamProviderProofImplemented,
+      streamCompiledWasmReadiness: 'plan-only'
+    },
+    packageOut: {
+      packagePacked: Boolean(packageOutProof && packageOutProof.checks && packageOutProof.checks.packagePacked),
+      discoveredFromNodeModules: discoveredFromPackagedAssets,
+      compilerBuilderLoadedFromNodeModules: packageBuilderLoaded,
+      packageTarballIncludesManifest: Boolean(packageOutProof && packageOutProof.checks && packageOutProof.checks.packageTarballIncludesManifest),
+      packageTarballIncludesCompilerBuilder: Boolean(packageOutProof && packageOutProof.checks && packageOutProof.checks.packageTarballIncludesCompilerBuilder),
+      packageTarballIncludesPulseWasmFacade: Boolean(packageOutProof && packageOutProof.checks && packageOutProof.checks.packageTarballIncludesPulseWasmFacade),
+      packageTarballIncludesSidecar: Boolean(packageOutProof && packageOutProof.checks && packageOutProof.checks.packageTarballIncludesSidecar),
+      monorepoSourcePathRequired: false,
+      npmRegistryRequired: false
+    },
+    fastly: {
+      providerConfig: clone(providerConfig),
+      providerProof: providerProofArtifact ? {
+        version: providerProofArtifact.version,
+        status: providerProofArtifact.status,
+        proofMode: providerProofArtifact.proofMode,
+        summary: clone(providerProofArtifact.summary),
+        payloadModes: clone(providerProofArtifact.payloadModes)
+      } : undefined,
+      symbolicStoreConfig: {
+        validated: symbolicStoreConfigValidated,
+        configStore: providerConfig && providerConfig.configStore,
+        secretStore: providerConfig && providerConfig.secretStore,
+        stores: providerConfig && providerConfig.stores
+      },
+      mapping: {
+        get: getMappingValidated,
+        head: headMappingValidated,
+        headers: headersValidated,
+        cacheControl: cacheControlValidated,
+        notFound: notFoundPolicyValidated
+      }
+    },
+    compiledWasm: {
+      sidecarDeclared: Boolean(sidecarPlan && sidecarPlan.summary && sidecarPlan.summary.sidecarDeclared),
+      sidecarFileExists: Boolean(sidecarPlan && sidecarPlan.summary && sidecarPlan.summary.sidecarFileExists),
+      sidecarSymbolsValidated: Boolean(sidecarPlan && sidecarPlan.summary && sidecarPlan.summary.sidecarSymbolsValidated),
+      terminalAssetResponseEffectPlanned: terminalSidecarPlanned,
+      nodeReferenceImplemented: nodeCompiledReferenceImplemented,
+      fastlyReadiness: 'plan-only',
+      diagnostic: assetsContracts.ASSETS_DIAGNOSTIC_CODES.FASTLY_ASSETS_COMPILED_WASM_PLAN_ONLY,
+      asyncAwait: false,
+      promises: false,
+      asyncify: false
+    },
+    unsupported: {
+      binaryBodyReserved,
+      streamBodyReadiness: streamProviderProofImplemented ? 'provider-proof-implemented-compiled-wasm-plan-only' : 'plan-only',
+      uploads: false,
+      mutationApis: false,
+      invalidation: false,
+      externalFastlyService: false
+    },
+    smoke: {
+      checks,
+      failedChecks: failures
+    },
+    diagnostics,
+    summary: {
+      packageOwnedLoweringConsumed,
+      discoveredFromPackagedAssets,
+      symbolicStoreConfigValidated,
+      getMappingValidated,
+      headMappingValidated,
+      headersValidated,
+      cacheControlValidated,
+      notFoundPolicyValidated,
+      compiledWasmAssetsReadiness: 'plan-only',
+      compiledWasmPlanOnlyDiagnostic: assetsContracts.ASSETS_DIAGNOSTIC_CODES.FASTLY_ASSETS_COMPILED_WASM_PLAN_ONLY,
+      binaryBodyReserved,
+      streamBodyReadiness: streamProviderProofImplemented ? 'provider-proof-implemented-compiled-wasm-plan-only' : 'plan-only',
+      noExternalFastlyServiceRequired: true,
+      actualNetworkFetch: false,
+      checks: checks.length,
+      failedChecks: failures.length,
+      diagnostics: diagnostics.length,
+      warnings: diagnostics.filter((entry) => (entry.severity || 'error') === 'warning').length,
+      errors: errorDiagnostics.length
+    }
+  }, cwd);
+
+  return {
+    artifact,
+    diagnostics,
+    providerProof: fastlyProviderProof,
+    failures,
+    hasErrors: errorDiagnostics.length > 0
+  };
+}
+
+module.exports = {
+  phaseName,
+  buildFastlyAssetsPackageOutParityProof
+};