@pulse-compute/provider-fastly 1.0.0-beta.1 → 1.0.0-beta.10

package/src/build/native-request-body.js

@@ -0,0 +1,44 @@
+'use strict';
+
+function runtimeSource() {
+  return `
+let __pulse_request_body_failure: i32 = 0
+// Validate the bounded, assembled request bytes before any text projection.
+function __pulse_request_utf8_valid(bytes: Uint8Array): bool {
+  for (let i = 0; i < bytes.length;) {
+    const lead = bytes[i++]; if (lead < 128) continue;
+    let count = 0, minimum = 128, maximum = 191;
+    if (lead >= 194 && lead <= 223) count = 1;
+    else if (lead >= 224 && lead <= 239) { count = 2; if (lead == 224) minimum = 160; if (lead == 237) maximum = 159; }
+    else if (lead >= 240 && lead <= 244) { count = 3; if (lead == 240) minimum = 144; if (lead == 244) maximum = 143; }
+    else return false;
+    if (i + count > bytes.length || i32(bytes[i]) < minimum || i32(bytes[i]) > maximum) return false;
+    i++; for (let n = 1; n < count; n++, i++) if (bytes[i] < 128 || bytes[i] > 191) return false;
+  }
+  return true;
+}
+function __pulse_request_send_body_error(): bool {
+  if (__pulse_fastly_last_error != PULSE_ERROR_REQUEST_BODY) return false;
+  const output = new __PulseFastlyValue(); output.kind = PULSE_VALUE_RESPONSE;
+  output.status = __pulse_fastly_error_stage == 21 ? 413 : 400;
+  output.text = output.status == 413 ? "Payload Too Large" : "Bad Request";
+  output.headers.push(new __PulseFastlyHeader("content-type", "text/plain; charset=utf-8"));
+  __pulse_fastly_last_error = 0; __pulse_fastly_error_stage = 0; __pulse_fastly_error_effect = -1;
+  const status = __pulse_fastly_send_result(__pulse_fastly_put(output));
+  if (status != FASTLY_STATUS_OK) __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 104, -1);
+  return true;
+}
+`;
+}
+
+function instrument(source, applicationErrors) {
+  if (!applicationErrors) source = source.replace(/function (host_\w+)\(([^)]*)\): (i32|void) \{/g,
+    (declaration, _name, _args, result) => `${declaration} if (__pulse_fastly_last_error == PULSE_ERROR_REQUEST_BODY) return${result === 'void' ? '' : ' 0'};`);
+  // The existing terminal failure path also covers applications without an
+  // error handler. Request-budget instrumentation subsequently takes priority.
+  const marker = 'function __pulse_fastly_jwt_send_error(): void {';
+  if (!source.includes(marker)) throw new Error('Fastly request-body error boundary drift.');
+  return source.replace(marker, marker + ' if (__pulse_request_send_body_error()) return;');
+}
+
+module.exports = { runtimeSource, instrument };

package/src/build/native-request-headers.js

@@ -0,0 +1,93 @@
+'use strict';
+
+// Fastly's multi-value ABI returns NUL-delimited pages and an i64 next cursor
+// (-1 marks completion). See https://docs.rs/fastly/latest/src/fastly/abi.rs.html
+// Keep this independent of outbound response headers.
+function runtimeSource() {
+  return `
+@external("fastly_http_req", "header_names_get")
+declare function __pulse_request_header_names(handle: i32, buffer: usize, size: i32, cursor: i32, end: usize, written: usize): i32
+@external("fastly_http_req", "header_values_get")
+declare function __pulse_request_header_values(handle: i32, name: usize, length: i32, buffer: usize, size: i32, cursor: i32, end: usize, written: usize): i32
+let __pulse_request_headers_snapshot: i32 = 0
+let __pulse_request_headers_failed: bool = false
+let __pulse_request_headers_bytes: i32 = 0
+function __pulse_request_headers_fail(): void {
+  __pulse_request_headers_failed = true;
+  __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 24, -1);
+}
+function __pulse_request_header_list(name: string, names: bool): Array<string> {
+  const output = new Array<string>();
+  const buffer = new Uint8Array(PULSE_FASTLY_BUFFER_BYTES);
+  const end = new StaticArray<i64>(1), written = new StaticArray<i32>(1);
+  const key = __pulse_fastly_utf8(name);
+  let cursor: i64 = 0;
+  let bytes = 0;
+  for (let page = 0; page < 256; page++) {
+    end[0] = 0; written[0] = -1;
+    const status = names
+      ? __pulse_request_header_names(__pulse_fastly_request_handle, buffer.dataStart, buffer.length, i32(cursor), changetype<usize>(end), changetype<usize>(written))
+      : __pulse_request_header_values(__pulse_fastly_request_handle, changetype<usize>(key), key.byteLength, buffer.dataStart, buffer.length, i32(cursor), changetype<usize>(end), changetype<usize>(written));
+    const count = written[0], next = end[0];
+    if (status == FASTLY_STATUS_OK && count == 0 && cursor == 0 && next == 0) return output;
+    if (status != FASTLY_STATUS_OK || count < 0 || count > buffer.length
+      || (next != -1 && (next <= cursor || next > 4294967295 || count == 0))) {
+      __pulse_request_headers_fail(); return output;
+    }
+    bytes += count;
+    if (bytes > PULSE_FASTLY_BUFFER_BYTES) { __pulse_request_headers_fail(); return output; }
+    let start = 0;
+    for (let i = 0; i < count; i++) {
+      if (buffer[i] != 0) continue;
+      const size = i - start;
+      // Count name bytes once per returned pair, including both terminators.
+      if (!names) __pulse_request_headers_bytes += key.byteLength + size + 2;
+      if (output.length >= 256 || (names && size == 0) || __pulse_request_headers_bytes > PULSE_FASTLY_BUFFER_BYTES) {
+        __pulse_request_headers_fail(); return output;
+      }
+      output.push(String.UTF8.decodeUnsafe(buffer.dataStart + start, size, false));
+      start = i + 1;
+    }
+    if (start != count) { __pulse_request_headers_fail(); return output; }
+    if (next == -1) return output;
+    cursor = next;
+  }
+  __pulse_request_headers_fail(); return output;
+}
+function __pulse_request_headers_read(): i32 {
+  if (__pulse_request_headers_failed) { __pulse_request_headers_fail(); return 0; }
+  if (__pulse_request_headers_snapshot != 0) return __pulse_request_headers_snapshot;
+  const names = __pulse_request_header_list("", true);
+  if (__pulse_request_headers_failed) return 0;
+  const output = host_value_array();
+  let pairs = 0;
+  for (let n = 0; n < names.length; n++) {
+    const name = names[n].toLowerCase();
+    for (let previous = 0; previous < n; previous++) {
+      if (names[previous].toLowerCase() == name) { __pulse_request_headers_fail(); return 0; }
+    }
+    const values = __pulse_request_header_list(name, false);
+    if (__pulse_request_headers_failed) return 0;
+    if (values.length == 0 || pairs + values.length > 256) { __pulse_request_headers_fail(); return 0; }
+    pairs += values.length;
+    for (let v = 0; v < values.length; v++) {
+      const pair = host_value_array();
+      host_value_array_push(pair, __pulse_fastly_string_value(name));
+      host_value_array_push(pair, __pulse_fastly_string_value(values[v]));
+      host_value_array_push(output, pair);
+    }
+  }
+  __pulse_fastly_deep_freeze(output);
+  __pulse_request_headers_snapshot = output;
+  return output;
+}
+`;
+}
+
+function instrument(source, applicationErrors, used) {
+  if (applicationErrors || !used) return source;
+  return source.replace(/function (host_\w+)\(([^)]*)\): (i32|void) \{/g,
+    (declaration, _name, _args, result) => `${declaration} if (__pulse_request_headers_failed) return${result === 'void' ? '' : ' 0'};`);
+}
+
+module.exports = { runtimeSource, instrument };

package/src/build/native-send-error-detail.as.ts

@@ -0,0 +1,12 @@
+// Fastly wasm32 SendErrorDetail, pinned to Viceroy v0.21.1 / compute-at-edge-abi:
+// tag:u32 @0, mask:u32 @4, DNS rcode:u16 @8, DNS info:u16 @10,
+// TLS alert:u8 @12, H2 frame:u8 @13, padding @14..15, H2 code:u32 @16.
+// https://github.com/fastly/Viceroy/blob/ba6fb78c02b2f40b70f8c65ab86fa86c66f0641f/wasm_abi/compute-at-edge-abi/typenames.witx
+const __PULSE_SEND_ERROR_DETAIL_BYTES: i32 = 20
+const __PULSE_SEND_ERROR_DETAIL_WORDS: i32 = __PULSE_SEND_ERROR_DETAIL_BYTES / 4
+function __pulse_send_error_detail_reset(detail: usize): void {
+  memory.fill(detail, 0, __PULSE_SEND_ERROR_DETAIL_BYTES)
+  // Advertise storage for all known optional fields (bits 1..4); bit 0 is reserved.
+  // Diagnostics consume only returned fields authorized by both tag and mask.
+  store<u32>(detail + 4, 0x1e)
+}

package/src/build/native-stdio.js

@@ -0,0 +1,45 @@
+'use strict';
+
+// Shared by both Native emitters. Fastly's named logging endpoint ABI rejects
+// stdout/stderr; Compute stdio uses WASI fd_write with stdout descriptor 1.
+const nativeStdioSource = String.raw`
+@external("wasi_snapshot_preview1", "fd_write")
+declare function __pulse_fastly_fd_write(fd: i32, iovs: usize, count: i32, written: usize): i32
+
+function __pulse_fastly_write_stdout(bytes: ArrayBuffer): void {
+  const iov = new StaticArray<usize>(2)
+  unchecked(iov[0] = changetype<usize>(bytes))
+  unchecked(iov[1] = bytes.byteLength)
+  const written = new StaticArray<i32>(1)
+  // One best-effort attempt: errors, zero progress, and short writes never
+  // retry, spin, change the response, or disable subsequent log statements.
+  __pulse_fastly_fd_write(1, changetype<usize>(iov), 1, changetype<usize>(written))
+}
+`;
+
+function nativeLoggingSource(endpoint) {
+  const { normalizeFastlyLogEndpoint, MAX_LOG_BYTES } = require('../toolchain/logging.js');
+  const name = normalizeFastlyLogEndpoint(endpoint);
+  if (name === undefined) return nativeStdioSource;
+  return String.raw`
+@external("fastly_log", "endpoint_get")
+declare function __pulse_fastly_log_endpoint_get(name: usize, length: usize, handle: usize): i32
+@external("fastly_log", "write")
+declare function __pulse_fastly_log_write(handle: i32, message: usize, length: usize, written: usize): i32
+
+// Retain the shared emitter entry point; destination is selected at build time.
+function __pulse_fastly_write_stdout(bytes: ArrayBuffer): void {
+  if (bytes.byteLength > ${MAX_LOG_BYTES}) return
+  const name = String.UTF8.encode(${JSON.stringify(name)}, false)
+  const handle = new StaticArray<i32>(1)
+  unchecked(handle[0] = -1)
+  if (__pulse_fastly_log_endpoint_get(changetype<usize>(name), name.byteLength, changetype<usize>(handle)) != 0) return
+  if (unchecked(handle[0]) == -1) return
+  const written = new StaticArray<usize>(1)
+  // One best-effort write. No retry or fallback, including zero/short writes.
+  __pulse_fastly_log_write(unchecked(handle[0]), changetype<usize>(bytes), bytes.byteLength, changetype<usize>(written))
+}
+`;
+}
+
+module.exports = { nativeStdioSource, nativeLoggingSource };

package/src/build/native-string-values.js

@@ -0,0 +1,143 @@
+'use strict';
+
+// Array<string>.join uses repeated concatenation at AssemblyScript shrink >= 1.
+// Own the count/allocate/copy path so stub-runtime allocation stays linear at
+// every optimization level. Copy UTF-16 bytes without decoding or coercion.
+const nativeStringAssembly = `
+function __pulse_fastly_string_bytes(length: i64): i32 {
+  if (length < 0 || length > i64(String.MAX_LENGTH)) {
+    __pulse_fastly_fail(PULSE_ERROR_VALUE, 57, -1); return -1
+  }
+  return i32(length * 2)
+}
+function __pulse_fastly_join_strings(parts: Array<string>): string {
+  // Both array and string lengths are bounded i32 values: their product fits
+  // in i64. Validate before narrowing or allocating the UTF-16 byte length.
+  let length: i64 = 0
+  for (let i = 0; i < parts.length; i++) length += i64(unchecked(parts[i]).length)
+  const bytes = __pulse_fastly_string_bytes(length)
+  if (bytes <= 0) return ""
+  if (parts.length == 1) return unchecked(parts[0])
+  const result = changetype<string>(__new(usize(bytes), idof<string>()))
+  let cursor = changetype<usize>(result)
+  for (let i = 0; i < parts.length; i++) {
+    const part = unchecked(parts[i])
+    const size = usize(part.length) * 2
+    memory.copy(cursor, changetype<usize>(part), size)
+    cursor += size
+  }
+  return result
+}
+`;
+
+// Store concatenation as shared, immutable prefixes instead of retaining a flat
+// copy for every intermediate. Direct object edges preserve live rope children.
+// This changes representation only: coercion happens at the original operation,
+// and aliases keep their original string even after a later append.
+const nativeStringFields = `
+  textLeaf: string = ""
+  textLeft: __PulseFastlyValue | null = null
+  textRight: __PulseFastlyValue | null = null
+  textLength: i32 = 0
+  get text(): string {
+    if (this.textLeft === null) return this.textLeaf
+    const pending = new Array<__PulseFastlyValue>()
+    const parts = new Array<string>()
+    pending.push(this)
+    while (pending.length > 0) {
+      const node = pending.pop()
+      if (node.textLeft === null) parts.push(node.textLeaf)
+      else { pending.push(node.textRight!); pending.push(node.textLeft!) }
+    }
+    this.textLeaf = __pulse_fastly_join_strings(parts)
+    this.textLeft = null
+    this.textRight = null
+    return this.textLeaf
+  }
+  set text(value: string) {
+    this.textLeaf = value
+    this.textLength = value.length
+    this.textLeft = null
+    this.textRight = null
+  }
+`;
+const nativeStringConcat = `
+function __pulse_fastly_concat(leftHandle: i32, rightHandle: i32): i32 {
+  let left = __pulse_fastly_value(leftHandle)
+  let right = __pulse_fastly_value(rightHandle)
+  // Snapshot non-string coercions now; a referenced object can change later.
+  if (left.kind != PULSE_VALUE_STRING) {
+    leftHandle = __pulse_fastly_string_value(__pulse_fastly_string(leftHandle))
+    left = __pulse_fastly_value(leftHandle)
+  }
+  if (right.kind != PULSE_VALUE_STRING) {
+    rightHandle = __pulse_fastly_string_value(__pulse_fastly_string(rightHandle))
+    right = __pulse_fastly_value(rightHandle)
+  }
+  if (left.textLength == 0) return rightHandle
+  if (right.textLength == 0) return leftHandle
+  const length = i64(left.textLength) + i64(right.textLength)
+  if (length > String.MAX_LENGTH) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 57, -1); return 0 }
+  const value = new __PulseFastlyValue()
+  value.kind = PULSE_VALUE_STRING
+  value.textLength = i32(length)
+  value.textLeft = left
+  value.textRight = right
+  return __pulse_fastly_put(value)
+}
+`;
+
+// ECMAScript WhiteSpace + LineTerminator code units. Keep this explicit rather
+// than inheriting the AssemblyScript library's Unicode whitespace policy.
+const nativeStringTrim = `
+function __pulse_fastly_trim_space(code: i32): bool {
+  return (code >= 9 && code <= 13) || code == 32 || code == 160 || code == 5760
+    || (code >= 8192 && code <= 8202) || code == 8232 || code == 8233
+    || code == 8239 || code == 8287 || code == 12288 || code == 65279
+}
+function host_value_string_trim(handle: i32): i32 {
+  const value = __pulse_fastly_value(handle)
+  if (value.kind != PULSE_VALUE_STRING) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 56, -1); return 0 }
+  let start = 0
+  let end = value.text.length
+  while (start < end && __pulse_fastly_trim_space(value.text.charCodeAt(start))) start += 1
+  while (end > start && __pulse_fastly_trim_space(value.text.charCodeAt(end - 1))) end -= 1
+  return __pulse_fastly_string_value(value.text.substring(start, end))
+}
+`;
+
+// Indexed reads expose one UTF-16 code unit, including an isolated surrogate.
+// Validate property spelling before converting to i32: "01", fractions,
+// negative indices and nonnumeric keys are ordinary missing properties.
+const nativeStringIndex = `
+function __pulse_fastly_string_index(value: __PulseFastlyValue, keyHandle: i32): i32 {
+  const key = __pulse_fastly_value(keyHandle)
+  if (key.kind == PULSE_VALUE_STRING && key.text == "length") return host_value_number(value.textLength)
+  if (key.kind != PULSE_VALUE_NUMBER && key.kind != PULSE_VALUE_STRING) return host_value_undefined()
+  const index = __pulse_fastly_number(keyHandle)
+  if (!(index >= 0 && index < value.textLength)) return host_value_undefined()
+  const position = i32(index)
+  if (index != f64(position)) return host_value_undefined()
+  if (key.kind == PULSE_VALUE_STRING && key.text != position.toString()) return host_value_undefined()
+  let node = value
+  let offset = position
+  while (node.textLeft !== null) {
+    const left = node.textLeft!
+    if (offset < left.textLength) node = left
+    else { offset -= left.textLength; node = node.textRight! }
+  }
+  return __pulse_fastly_string_value(node.textLeaf.charAt(offset))
+}
+`;
+
+function needsNativeValueFailureGuard(plan) {
+  if ((plan.schemas?.references || []).some(entry => ['value-encode', 'text-decode'].includes(entry.usage))) return true;
+  function containsValueOperation(node) {
+    if (!node || typeof node !== 'object') return false;
+    if (node.kind === 'pure-loop' || (node.kind === 'method-call' && node.method === 'string.trim')) return true;
+    return Object.values(node).some(containsValueOperation);
+  }
+  return containsValueOperation(plan.entry?.body) || containsValueOperation(plan.handlers) || containsValueOperation(plan.stages) || containsValueOperation(plan.helpers) || containsValueOperation(plan.effects);
+}
+
+module.exports = { nativeStringAssembly, nativeStringFields, nativeStringConcat, nativeStringTrim, nativeStringIndex, needsNativeValueFailureGuard };

package/src/build/native-transport-details.as.ts

@@ -0,0 +1,84 @@
+// Fixed scalar-only host provenance. Never retain pointers, URLs, headers or bodies.
+class __PulseTransportDetail {
+  phase: string = ''
+  status: u32 = 0
+  tag: i64 = -1
+  mask: i64 = -1
+  kind: string = 'unavailable'
+  dnsRcode: i32 = -1
+  dnsInfo: i32 = -1
+  tlsAlert: i32 = -1
+  h2Frame: i32 = -1
+  h2Code: i64 = -1
+}
+@lazy const __pulse_transport_slots = new StaticArray<__PulseTransportDetail | null>(PULSE_FASTLY_EFFECT_COUNT)
+let __pulse_transport_error: __PulseTransportDetail | null = null
+function __pulse_transport_kind(tag: u32): string {
+  switch (tag) {
+    case 1: return 'ok'
+    case 2: return 'dns_timeout'
+    case 3: return 'dns_error'
+    case 4: return 'destination_not_found'
+    case 5: return 'destination_unavailable'
+    case 6: return 'destination_ip_unroutable'
+    case 7: return 'connection_refused'
+    case 8: return 'connection_terminated'
+    case 9: return 'connection_timeout'
+    case 10: return 'connection_limit_reached'
+    case 11: return 'tls_certificate_error'
+    case 12: return 'tls_configuration_error'
+    case 13: return 'http_incomplete_response'
+    case 14: return 'http_response_header_section_too_large'
+    case 15: return 'http_response_body_too_large'
+    case 16: return 'http_response_timeout'
+    case 17: return 'http_response_status_invalid'
+    case 18: return 'http_upgrade_failed'
+    case 19: return 'http_protocol_error'
+    case 20: return 'http_request_cache_key_invalid'
+    case 21: return 'http_request_uri_invalid'
+    case 22: return 'internal_error'
+    case 23: return 'tls_alert_received'
+    case 24: return 'tls_protocol_error'
+    case 25: return 'h2_error'
+    default: return 'unknown'
+  }
+}
+function __pulse_transport_integer(value: i64): string { return value < 0 ? 'null' : value.toString() }
+function __pulse_transport_capture(index: i32, status: i32, phase: string, ptr: usize = 0): void {
+  const d = new __PulseTransportDetail(); d.status = u32(status); d.phase = phase;
+  // Uninitialized means no host detail, even if stale/unknown mask bits exist.
+  if (ptr != 0 && load<u32>(ptr) != 0) {
+    const tag = load<u32>(ptr), mask = load<u32>(ptr + 4);
+    d.tag = i64(tag); d.mask = i64(mask); d.kind = __pulse_transport_kind(tag);
+    if (tag == 3) {
+      if ((mask & 2) != 0) d.dnsRcode = load<u16>(ptr + 8);
+      if ((mask & 4) != 0) d.dnsInfo = load<u16>(ptr + 10);
+    }
+    if (tag == 23 && (mask & 8) != 0) d.tlsAlert = load<u8>(ptr + 12);
+    if (tag == 25 && (mask & 16) != 0) { d.h2Frame = load<u8>(ptr + 13); d.h2Code = i64(load<u32>(ptr + 16)); }
+  }
+  if (index >= 0 && index < PULSE_FASTLY_EFFECT_COUNT) __pulse_transport_slots[index] = d;
+  // One bounded best-effort diagnostic through the configured existing log sink.
+  // Only fixed enum strings and unsigned integers enter this record (<512 bytes).
+  const text = '[pulse:error] {"event":"pulse.transport","provider":"fastly","phase":"' + d.phase
+    + '","status":' + d.status.toString() + ',"tag":' + __pulse_transport_integer(d.tag)
+    + ',"mask":' + __pulse_transport_integer(d.mask) + ',"kind":"' + d.kind
+    + '","dnsRcode":' + __pulse_transport_integer(d.dnsRcode) + ',"dnsInfo":' + __pulse_transport_integer(d.dnsInfo)
+    + ',"tlsAlert":' + __pulse_transport_integer(d.tlsAlert) + ',"h2Frame":' + __pulse_transport_integer(d.h2Frame)
+    + ',"h2Code":' + __pulse_transport_integer(d.h2Code) + '}\n';
+  __pulse_fastly_write_stdout(String.UTF8.encode(text, false));
+}
+function __pulse_transport_field(result: i32, key: string, value: i64): void {
+  host_value_object_set(result, __pulse_fastly_string_value(key), value < 0 ? host_value_null() : host_value_number(f64(value)));
+}
+function __pulse_transport_value(d: __PulseTransportDetail): i32 {
+  const result = host_value_object();
+  host_value_object_set(result, __pulse_fastly_string_value('provider'), __pulse_fastly_string_value('fastly'));
+  host_value_object_set(result, __pulse_fastly_string_value('phase'), __pulse_fastly_string_value(d.phase));
+  host_value_object_set(result, __pulse_fastly_string_value('kind'), __pulse_fastly_string_value(d.kind));
+  __pulse_transport_field(result, 'status', i64(d.status)); __pulse_transport_field(result, 'tag', d.tag);
+  __pulse_transport_field(result, 'mask', d.mask); __pulse_transport_field(result, 'dnsRcode', d.dnsRcode);
+  __pulse_transport_field(result, 'dnsInfo', d.dnsInfo); __pulse_transport_field(result, 'tlsAlert', d.tlsAlert);
+  __pulse_transport_field(result, 'h2Frame', d.h2Frame); __pulse_transport_field(result, 'h2Code', d.h2Code);
+  return result;
+}

package/src/build/native-value-budget.js

@@ -0,0 +1,90 @@
+'use strict';
+
+const { CANONICAL_NATIVE_READ_LOOP_MEMORY: policy, hasBoundedReadLoop } = require('@pulse-compute/wasm-contracts/handler/canonical-native-runtime');
+
+function runtimeSource(limits = policy) {
+  return `
+let __pulse_memory_bytes: i64 = 0
+let __pulse_memory_values: i64 = 0
+let __pulse_memory_failed: bool = false
+function __pulse_memory_charge(values: i64, bytes: i64): void {
+  if (__pulse_memory_failed) unreachable()
+  if (values > ${limits.maxValues} - __pulse_memory_values || bytes > ${limits.maxBytes} - __pulse_memory_bytes) {
+    __pulse_memory_failed = true
+    __pulse_fastly_fail(1010, values > ${limits.maxValues} - __pulse_memory_values ? 173 : 172, -1)
+    __pulse_invocation_close()
+    unreachable()
+  }
+  __pulse_memory_values += values
+  __pulse_memory_bytes += bytes
+}
+function __pulse_memory_value_push(target: Array<i32>, value: i32): void {
+  __pulse_memory_charge(1, ${limits.edgeBytes})
+  target.push(value)
+}
+function __pulse_memory_key_push(target: Array<string>, value: string): void {
+  __pulse_memory_charge(1, ${limits.edgeBytes} + i64(value.length) * 2)
+  target.push(value)
+}
+function __pulse_memory_header_push(target: Array<__PulseFastlyHeader>, value: __PulseFastlyHeader): void {
+  __pulse_memory_charge(1, ${limits.valueBytes} + i64(value.name.length + value.value.length) * 2)
+  target.push(value)
+}
+export function pulse_fastly_memory_bytes(): i64 { return __pulse_memory_bytes }
+export function pulse_fastly_memory_values(): i64 { return __pulse_memory_values }
+`;
+}
+
+// These helpers are private to proven regions in an unlinked read-loop plan.
+// Cache admissions use the original operations, so later boxed code sees the
+// same cache and charges. Uncached numbers pay at each original evaluation;
+// only their physical materialization is delayed until a region exit.
+function numericRegionSource() {
+  return `
+function __pulse_numeric_cacheable(value: f64): bool {
+  return value >= 0 && value < 65536 && Math.floor(value) == value && (value != 0 || 1.0 / value > 0)
+}
+function __pulse_numeric_charge_number(value: f64): f64 {
+  __pulse_memory_charge(0, 0)
+  if (__pulse_numeric_cacheable(value)) host_value_number(value)
+  else __pulse_memory_charge(1, ${policy.valueBytes})
+  return value
+}
+function __pulse_numeric_charge_boolean(value: bool): bool {
+  __pulse_memory_charge(0, 0)
+  host_value_boolean(value ? 1 : 0)
+  return value
+}
+function __pulse_numeric_truthy(value: f64): bool { return value != 0.0 && !isNaN(value) }
+function __pulse_numeric_box(value: f64): i32 {
+  __pulse_memory_charge(0, 0)
+  if (__pulse_numeric_cacheable(value)) return host_value_number(value)
+  const item = new __PulseFastlyValue(); item.kind = PULSE_VALUE_NUMBER; item.number = value
+  // Already charged at the original expression, never a general put bypass.
+  __pulse_fastly_values.push(item)
+  return __pulse_fastly_values.length
+}
+`;
+}
+
+function instrument(source, plan) {
+  if (!plan.callables?.length && !hasBoundedReadLoop(plan)) return source;
+  function insert(needle, extra) {
+    if (source.split(needle).length !== 2) throw new Error('Native value budget instrumentation mismatch: ' + needle);
+    source = source.replace(needle, needle + extra);
+  }
+  // Text assignments include lazy fetch bodies and response bodies as well as
+  // strings. Ropes reserve their eventual flat size before materialization.
+  insert('\n  set text(value: string) {', '\n    __pulse_memory_charge(0, i64(value.length) * 2)');
+  insert('\nfunction __pulse_fastly_put(value: __PulseFastlyValue): i32 {',
+    ` __pulse_memory_charge(1, ${policy.valueBytes} + (value.textLeft === null ? 0 : i64(value.textLength) * 2));`);
+  const helpers = { keys: 'key', values: 'value', headers: 'header' };
+  // Skip quoted data and comments: authored text can contain source-like text.
+  const tokens = /("(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\/\/[^\n]*|\/\*[\s\S]*?\*\/)|\b([A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*)\.(keys|values|headers)\.push\(/g;
+  source = source.replace(tokens, (match, quoted, object, field) => quoted || `__pulse_memory_${helpers[field]}_push(${object}.${field}, `);
+  const code = source.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\/\/[^\n]*|\/\*[\s\S]*?\*\//g, '');
+  if (/\.(keys|values|headers)\.push\(/.test(code)) throw new Error('Unmetered Native container growth.');
+  return source + runtimeSource();
+}
+
+module.exports = { policy, hasBoundedReadLoop, runtimeSource, numericRegionSource, instrument };

package/src/build/package-native-application.js

@@ -0,0 +1,114 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const {
+  CANONICAL_NATIVE_IMPORT_NAMES,
+  CANONICAL_NATIVE_VALUE_TRANSFER_MAX_BYTES
+} = require('@pulse-compute/wasm-contracts/handler/canonical-native-runtime');
+
+function enabled(plan) { return Boolean(plan.packages && plan.packages.application); }
+
+// The package owns request dispatch, codecs and continuations. This adapter only
+// binds its canonical host imports to the same Fastly runtime as ordinary handlers.
+function portable(plan) {
+  const application = plan.packages.application;
+  if (!['pulse.entities', 'pulse.mcp'].includes(application.contractId)
+    || !['pulse.package-native-application.v1', 'pulse.package-native-application.v2'].includes(application.version)
+    || application.effectFailure !== 'package-completion'
+    || application.automaticFallback !== false
+    || crypto.createHash('sha256').update(application.source).digest('hex') !== application.sourceHash) {
+    throw new Error('Unsupported or invalid Fastly package Native application.');
+  }
+  const source = application.source.replace(
+    /^@external\("pulse_host", "([a-z_]+)"\) declare function (\w+)\(([^)]*)\): (i32|f64|void)$/gm,
+    (_declaration, name, symbol, parameters, result) => {
+      if (!CANONICAL_NATIVE_IMPORT_NAMES.includes(name)) throw new Error('Unsupported package host import: ' + name);
+      const args = parameters ? parameters.split(',').map(parameter => parameter.trim().split(':')[0]).join(', ') : '';
+      if (name === 'package_http_version') return `function ${symbol}(): i32 { return 1 }`;
+      if (name === 'value_json') return `function ${symbol}(${parameters}): i32 {
+  // A failed request read must reach the provider's terminal error response,
+  // without trapping JSON.parse<string> in the guest first.
+  if (${args} <= 0) return changetype<i32>('""')
+  const text = __pulse_fastly_json(${args}, 0)
+  if (String.UTF8.byteLength(text) > ${CANONICAL_NATIVE_VALUE_TRANSFER_MAX_BYTES}) {
+    __pulse_fastly_fail(PULSE_ERROR_VALUE, 172, -1); return changetype<i32>('null')
+  }
+  return changetype<i32>(text)
+}`;
+      const guard = name === 'log' ? `if (${args.split(',')[0]} <= 0 || ${args.split(',')[0]} > ${Number(plan.logging.reporting.level)}) return; ` : '';
+      return `function ${symbol}(${parameters}): ${result} { ${guard}${result === 'void' ? '' : 'return '}host_${name}(${args}) }`;
+    }
+  );
+  if (source.includes('@external("pulse_host",')) throw new Error('Unbound package Native host import.');
+  const codecs = (plan.schemas?.registry?.schemas || []).map((_schema, index) => `
+function __pulse_schema_decode_${index}(input: string): string { return changetype<string>(pulse_schema_decode(${index}, changetype<i32>(input))) }
+function __pulse_schema_encode_${index}(input: string): string { return changetype<string>(pulse_schema_encode(${index}, changetype<i32>(input))) }`).join('\n');
+  return { ...application, source: source + codecs + `\nconst __pulse_application_plan_hash: string = ${JSON.stringify(plan.planHash)}\n` };
+}
+
+function runtimeSource() {
+  return `
+const __pulse_package_failed = new StaticArray<i32>(PULSE_FASTLY_EFFECT_COUNT)
+function __pulse_package_take_effect_failure(): bool {
+  const code = __pulse_fastly_last_error
+  // Deadlines, invalid lifecycle transitions and request/body failures remain
+  // provider-terminal. Only an admitted effect's operational failure is framed.
+  if (__pulse_fastly_error_stage == 260 || __pulse_fastly_error_stage == 261) return false
+  if (code != PULSE_ERROR_HOSTCALL && code != PULSE_ERROR_TRANSPORT
+    && code != PULSE_ERROR_JSON && code != PULSE_ERROR_SCHEMA && code != PULSE_ERROR_VALUE) return false
+  __pulse_fastly_last_error = 0; __pulse_fastly_error_stage = 0; __pulse_fastly_error_effect = -1
+  return true
+}
+function host_effect_begin(effectIndex: i32, payload: i32): void {
+  if (__pulse_fastly_last_error != 0) return
+  __pulse_package_effect_begin(effectIndex, payload)
+  if (__pulse_package_take_effect_failure()) unchecked(__pulse_package_failed[effectIndex] = 1)
+}
+`;
+}
+
+function instrument(source) {
+  const signature = 'function host_effect_begin(effectIndex: i32, payload: i32): void {';
+  if (!source.includes(signature)) throw new Error('Fastly package effect admission boundary drift.');
+  return source.replace(signature, 'function __pulse_package_effect_begin(effectIndex: i32, payload: i32): void {') + runtimeSource();
+}
+
+function driverLoop() {
+  return `  while (runStatus == 1 && __pulse_fastly_last_error == 0) {
+    for (let effectIndex = 0; effectIndex < PULSE_FASTLY_EFFECT_COUNT; effectIndex += 1) {
+      const invocation = unchecked(__pulse_invocation_tickets[effectIndex])
+      if (invocation == 0) continue
+      let failed = unchecked(__pulse_package_failed[effectIndex]) != 0
+      unchecked(__pulse_package_failed[effectIndex] = 0)
+      let result = failed ? 0 : __pulse_fastly_resolve_effect(effectIndex)
+      if (__pulse_package_take_effect_failure()) { failed = true; result = 0 }
+      if (__pulse_fastly_last_error != 0) { __pulse_fastly_jwt_send_error(); return }
+      if (!failed && result <= 0) { __pulse_fastly_fail(PULSE_ERROR_STATE, 101, effectIndex); __pulse_fastly_jwt_send_error(); return }
+      if (__pulse_invocation_settle(effectIndex, invocation, result) != 1 || __pulse_fastly_last_error != 0) {
+        __pulse_fastly_fail(PULSE_ERROR_STATE, 101, effectIndex); __pulse_fastly_jwt_send_error(); return
+      }
+    }
+    runStatus = pulse_resume()
+  }`;
+}
+
+function terminalFailure(source, plan) {
+  if (plan.packages?.application?.terminalFailure !== 'package-http-v1') return source;
+  const helper = `
+function __pulse_package_http_failure_send(kind: i32): void {
+  __request_error_response = true;
+  __pulse_fastly_last_error = 0; __pulse_fastly_error_stage = 0; __pulse_fastly_error_effect = -1;
+  const value = JSON.parse<JSON.Value>(changetype<string>(pulse_package_http_failure(kind)))
+  const response = host_response_custom(__pulse_package_value(value))
+  __pulse_fastly_send_result(response)
+}
+`;
+  const bodyMarker = '  output.status = __pulse_fastly_error_stage == 21 ? 413 : 400;';
+  if (!source.includes(bodyMarker)) throw new Error('Package HTTP body completion boundary drift');
+  source = source.replace(bodyMarker, '  const kind = __pulse_fastly_error_stage == 21 ? 2 : 3; __pulse_package_http_failure_send(kind); return true;\n' + bodyMarker);
+  const timeoutMarker = 'function __request_send_timeout(): void {';
+  if (!source.includes(timeoutMarker)) throw new Error('Package HTTP deadline completion boundary drift');
+  source = source.replace(timeoutMarker, timeoutMarker + '\n  __pulse_package_http_failure_send(1); return;');
+  return source + helper;
+}
+module.exports = { enabled, portable, instrument, driverLoop, terminalFailure };