@pulse-compute/provider-fastly 1.0.0-beta.1 → 1.0.0-beta.10

package/src/build/schema-scalar-record.js

@@ -0,0 +1,41 @@
+'use strict';
+
+const { schemaHasScalarRecord } = require('@pulse-compute/wasm-contracts/schema-json/registry');
+
+function hasScalarRecords(plan) {
+  return (plan.schemas?.registry?.schemas || []).some(schema => schemaHasScalarRecord(schema.root));
+}
+
+// Both Fastly Native realizations validate handles before json-as sees them.
+function scalarRecordProjectionLines(node) {
+  const limits = node.limits;
+  return [
+    '  if (input.kind != PULSE_VALUE_OBJECT || (checkDuplicates && input.duplicateJsonKeys)) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 56, -1); return 0 }',
+    `  if (input.keys.length > ${limits.maxKeys}) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 56, -1); return 0 }`,
+    '  const keys = input.keys.slice().sort()',
+    '  const output = host_value_object()',
+    '  let bytes = 2',
+    '  for (let i = 0; i < keys.length; i++) {',
+    '    const key = keys[i]',
+    `    if (key.length > ${limits.maxKeyLength}) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 56, -1); return 0 }`,
+    '    const keyHandle = __pulse_fastly_string_value(key)',
+    '    const itemHandle = host_value_property(valueHandle, keyHandle)',
+    '    const item = __pulse_fastly_value(itemHandle)',
+    '    let size = 0',
+    '    if (item.kind == PULSE_VALUE_STRING) {',
+    `      if (item.text.length > ${limits.maxStringLength}) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 56, -1); return 0 }`,
+    '      size = __pulse_scalar_record_string_bytes(item.text)',
+    '    } else if (item.kind == PULSE_VALUE_NUMBER && isFinite(item.number)) {',
+    `      size = ${limits.numberBytes}`,
+    '    } else if (item.kind == PULSE_VALUE_BOOLEAN) size = item.boolean != 0 ? 4 : 5',
+    '    else if (item.kind == PULSE_VALUE_NULL) size = 4',
+    '    else { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 56, -1); return 0 }',
+    '    bytes += (i == 0 ? 0 : 1) + __pulse_scalar_record_string_bytes(key) + 1 + size',
+    `    if (bytes > ${limits.maxBytes}) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 56, -1); return 0 }`,
+    '    host_value_object_set(output, keyHandle, itemHandle)',
+    '  }',
+    '  return output'
+  ];
+}
+
+module.exports = { hasScalarRecords, scalarRecordProjectionLines };

package/src/build/time-native.js

@@ -0,0 +1,49 @@
+'use strict';
+
+// Provider-owned realtime sampling. The portable guest still suspends through
+// effect_begin; no clock import is exposed to application-authored code.
+function timeNativeSource(plan) {
+  if (!(plan.effects || []).some(effect => effect.kind === 'time.now')) return '';
+  return `
+function __pulse_time_pad(value: i32, width: i32): string {
+  let text = value.toString()
+  while (text.length < width) text = "0" + text
+  return text
+}
+function __pulse_time_iso(ms: u64): string {
+  // Gregorian civil date from whole days since the Unix epoch.
+  const z = <i32>(ms / 86400000) + 719468
+  const era = z / 146097
+  const doe = z - era * 146097
+  const yoe = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365
+  let year = yoe + era * 400
+  const doy = doe - (365 * yoe + yoe / 4 - yoe / 100)
+  const mp = (5 * doy + 2) / 153
+  const day = doy - (153 * mp + 2) / 5 + 1
+  const month = mp + (mp < 10 ? 3 : -9)
+  if (month <= 2) year += 1
+  const rest = <i32>(ms % 86400000)
+  return __pulse_time_pad(year, 4) + "-" + __pulse_time_pad(month, 2) + "-" + __pulse_time_pad(day, 2)
+    + "T" + __pulse_time_pad(rest / 3600000, 2) + ":" + __pulse_time_pad((rest / 60000) % 60, 2)
+    + ":" + __pulse_time_pad((rest / 1000) % 60, 2) + "." + __pulse_time_pad(rest % 1000, 3) + "Z"
+}
+function __pulse_fastly_time_begin(effectIndex: i32, payload: __PulseFastlyValue): void {
+  const out = new StaticArray<u64>(1)
+  const status = wasi_snapshot_preview1_clock_time_get(0, 1000000, changetype<usize>(out))
+  const result = host_value_object()
+  if (status != 0) {
+    host_value_object_set(result, __pulse_fastly_string_value("status"), __pulse_fastly_string_value("failed"))
+    host_value_object_set(result, __pulse_fastly_string_value("reason"), __pulse_fastly_string_value("unavailable"))
+  } else {
+    // Divide integer nanoseconds before conversion to f64 to retain millisecond precision.
+    const ms = unchecked(out[0]) / 1000000
+    host_value_object_set(result, __pulse_fastly_string_value("status"), __pulse_fastly_string_value("ok"))
+    host_value_object_set(result, __pulse_fastly_string_value("unixEpochMs"), host_value_number(<f64>ms))
+    host_value_object_set(result, __pulse_fastly_string_value("iso8601"), __pulse_fastly_string_value(__pulse_time_iso(ms)))
+  }
+  __pulse_fastly_ready_effect(effectIndex, result)
+}
+`;
+}
+
+module.exports = Object.freeze({ timeNativeSource });

package/src/build/wasm-budget.js

@@ -0,0 +1,28 @@
+'use strict';
+
+const { fastlyConfigDefault } = require('../config-schema.js');
+const DEFAULT_FASTLY_MAX_WASM_BYTES = fastlyConfigDefault('fastly.build.maxWasmBytes');
+
+function normalizeFastlyMaxWasmBytes(value) {
+  if (value === undefined) return DEFAULT_FASTLY_MAX_WASM_BYTES;
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    const error = new TypeError('fastly.build.maxWasmBytes must be a positive safe integer byte count.');
+    error.code = 'PULSE_FASTLY_MAX_WASM_BYTES_INVALID';
+    throw error;
+  }
+  return value;
+}
+
+function assertFastlyWasmBudget(bytes, value) {
+  const maxBytes = normalizeFastlyMaxWasmBytes(value);
+  if (bytes > maxBytes) {
+    const error = new Error('Generated Fastly Native module exceeds the configured Pulse compilation budget.');
+    error.name = 'FastlyNativePlatformCapabilitiesError';
+    error.code = 'PULSE_FASTLY_NATIVE_PLATFORM_CAPABILITIES_WASM_TOO_LARGE';
+    error.detail = Object.freeze({ bytes, maxBytes });
+    throw error;
+  }
+  return maxBytes;
+}
+
+module.exports = Object.freeze({ DEFAULT_FASTLY_MAX_WASM_BYTES, normalizeFastlyMaxWasmBytes, assertFastlyWasmBudget });

package/src/config-api.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { normalizeFastlyLogEndpoint } = require('./toolchain/logging.js');
+const { normalizeFastlyMaxWasmBytes } = require('./build/wasm-budget.js');
 const { fastlyConfigDefault } = require('./config-schema.js');
 
 const FASTLY_PROVIDER_API_VERSION = 'pulse.provider-fastly-api.v2';
@@ -38,8 +40,11 @@ function fastly(options = {}) {
   const normalizedGrip = options.grip === undefined ? undefined : gripBindings(options.grip);
   return Object.freeze({
     kind: 'fastly',
+    ...(options.bodyForwarding === undefined ? {} : {bodyForwarding: require('./toolchain/body-forwarding.js').normalizeBodyForwarding(options.bodyForwarding, options.maxDurationMs)}),
+    ...(options.maxDurationMs === undefined ? {} : { maxDurationMs: require('@pulse-compute/runtime/host').normalizeRequestDuration(options.maxDurationMs) }),
     version: FASTLY_PROVIDER_API_VERSION,
     bindings: Object.freeze({
+      ...(options.logEndpoint === undefined ? {} : { logEndpoint: normalizeFastlyLogEndpoint(options.logEndpoint) }),
       configStore: String(options.configStore ?? fastlyConfigDefault('fastly.configStore')),
       secretStore: String(options.secretStore ?? fastlyConfigDefault('fastly.secretStore')),
       kv: stringMap(options.kv),
@@ -48,6 +53,7 @@ function fastly(options = {}) {
       dynamicBackends: options.dynamicBackends === undefined ? fastlyConfigDefault('fastly.dynamicBackends') : options.dynamicBackends === true
     }),
     build: Object.freeze({
+      maxWasmBytes: normalizeFastlyMaxWasmBytes(options.maxWasmBytes),
       name: String(options.name ?? fastlyConfigDefault('fastly.name')),
       description: String(options.description ?? fastlyConfigDefault('fastly.description')),
       authors: Object.freeze((Array.isArray(options.authors) ? options.authors : fastlyConfigDefault('fastly.authors')).map(String)),

package/src/config-schema.json

@@ -1,6 +1,10 @@
 {
   "schemaVersion": "pulse.provider-fastly-config-schema.v1",
   "fields": {
+    "fastly.bindings.s3": {
+      "kind": "object",
+      "default": {}
+    },
     "fastly.configStore": {
       "kind": "string",
       "default": "pulse_config"
@@ -68,6 +72,32 @@
     "fastly.local.networkFetch": {
       "kind": "boolean",
       "default": false
+    },
+    "fastly.maxDurationMs": {
+      "kind": "optional-number"
+    },
+    "fastly.build.maxWasmBytes": {
+      "kind": "positive-safe-integer",
+      "default": 4194304
+    },
+    "fastly.maxWasmBytes": {
+      "kind": "positive-safe-integer"
+    },
+    "fastly.bodyForwarding": {
+      "kind": "object"
+    },
+    "fastly.bodyForwarding.requestMaxBytes": {
+      "kind": "integer",
+      "minimum": 1,
+      "maximum": 1048576
+    },
+    "fastly.bodyForwarding.responseMaxBytes": {
+      "kind": "integer",
+      "minimum": 1,
+      "maximum": 1048576
+    },
+    "fastly.logEndpoint": {
+      "kind": "optional-string"
     }
   }
 }

package/src/index.ts

@@ -1,3 +1,7 @@
+const { normalizeFastlyLogEndpoint } = require('../src/toolchain/logging.js') as { normalizeFastlyLogEndpoint(value?: string): string | undefined };
+const { normalizeBodyForwarding } = require('../src/toolchain/body-forwarding.js') as { normalizeBodyForwarding(value: PulseFastlyBodyForwardingOptions | undefined, maxDurationMs?: number): PulseFastlyBodyForwardingOptions | undefined };
+const { normalizeFastlyMaxWasmBytes } = require('../src/build/wasm-budget.js') as { normalizeFastlyMaxWasmBytes(value?: number): number };
+const { normalizeRequestDuration } = require('@pulse-compute/runtime/host') as { normalizeRequestDuration(value?: number): number | undefined };
 import FASTLY_CONFIG_SCHEMA from './config-schema.json';
 
 type FastlySchemaRule = Readonly<{ kind: string; default?: unknown }>;
@@ -22,7 +26,19 @@ export interface PulseFastlyLocalOptions {
   readonly networkFetch?: boolean;
 }
 
+export interface PulseFastlyBodyForwardingOptions {
+  readonly requestMaxBytes: number;
+  readonly responseMaxBytes: number;
+}
+
 export interface PulseFastlyProviderOptions {
+  /** Inclusive final Native Wasm byte budget; default 4 MiB. */
+  readonly maxWasmBytes?: number;
+  readonly maxDurationMs?: number;
+  /** Experimental Native metered pump; final close hands delivery to Fastly. */
+  readonly bodyForwarding?: PulseFastlyBodyForwardingOptions;
+  /** Named production log stream; omitted preserves stdout. */
+  readonly logEndpoint?: string;
   readonly configStore?: string;
   readonly secretStore?: string;
   readonly kv?: Readonly<Record<string, string>>;
@@ -36,9 +52,13 @@ export interface PulseFastlyProviderOptions {
 }
 
 export interface PulseFastlyProviderConfig {
+  readonly maxDurationMs?: number;
+  /** Experimental Native metered pump; final close hands delivery to Fastly. */
+  readonly bodyForwarding?: PulseFastlyBodyForwardingOptions;
   readonly kind: 'fastly';
   readonly version: typeof FASTLY_PROVIDER_API_VERSION;
   readonly bindings: {
+    readonly logEndpoint?: string;
     readonly configStore: string;
     readonly secretStore: string;
     readonly kv: Readonly<Record<string, string>>;
@@ -57,6 +77,7 @@ export interface PulseFastlyProviderConfig {
     readonly dynamicBackends: boolean;
   };
   readonly build: {
+    readonly maxWasmBytes: number;
     readonly name: string;
     readonly description: string;
     readonly authors: readonly string[];
@@ -97,8 +118,11 @@ export function fastly(options: PulseFastlyProviderOptions = {}): PulseFastlyPro
   const normalizedGrip = options.grip === undefined ? undefined : gripBindings(options.grip);
   return Object.freeze({
     kind: 'fastly',
+    maxDurationMs: normalizeRequestDuration(options.maxDurationMs),
+    bodyForwarding: normalizeBodyForwarding(options.bodyForwarding, options.maxDurationMs),
     version: FASTLY_PROVIDER_API_VERSION,
     bindings: Object.freeze({
+      ...(options.logEndpoint === undefined ? {} : { logEndpoint: normalizeFastlyLogEndpoint(options.logEndpoint) }),
       configStore: String(options.configStore ?? fastlyDefaults['fastly.configStore']),
       secretStore: String(options.secretStore ?? fastlyDefaults['fastly.secretStore']),
       kv: stringMap(options.kv),
@@ -107,6 +131,7 @@ export function fastly(options: PulseFastlyProviderOptions = {}): PulseFastlyPro
       dynamicBackends: options.dynamicBackends === undefined ? Boolean(fastlyDefaults['fastly.dynamicBackends']) : options.dynamicBackends === true
     }),
     build: Object.freeze({
+      maxWasmBytes: normalizeFastlyMaxWasmBytes(options.maxWasmBytes),
       name: String(options.name ?? fastlyDefaults['fastly.name']),
       description: String(options.description ?? fastlyDefaults['fastly.description']),
       authors: Object.freeze((options.authors ?? (Array.isArray(fastlyDefaults['fastly.authors']) ? fastlyDefaults['fastly.authors'] : [])).map(String)),

package/src/javascript/jwt-verifier.js

@@ -1,10 +1,12 @@
 'use strict';
 
 const {
+  normalizeJwtSignEffect,
   normalizeJwtVerifyEffect
 } = require('@pulse-compute/wasm-contracts/jwt/contracts');
 const {
   CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION,
+  CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION,
   CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION
 } = require('@pulse-compute/wasm-contracts/crypto/contracts');
 
@@ -16,6 +18,7 @@ const FASTLY_JAVASCRIPT_JWT_REALIZATIONS = Object.freeze({
     implementation: CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION,
     automaticFallback: false
   }),
+  RS256: Object.freeze({ algorithm: 'RS256', realization: 'runtime-builtin', implementation: CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION, automaticFallback: false }),
   ES256: Object.freeze({
     algorithm: 'ES256',
     realization: 'runtime-builtin',
@@ -83,12 +86,19 @@ function createFastlyJavascriptJwtVerify(options = {}) {
   return async function verifyFastlyJavascriptJwt(effect, execution) {
     const { jwtProvider, cryptoProvider } = await loadRuntimeModules();
     assertRequestActive(execution, jwtProvider);
-    const input = normalizeJwtVerifyEffect(effect);
-    if (execution && typeof execution.registerRedactionValue === 'function') {
+    const signing = effect.operation === 'sign';
+    const input = signing ? normalizeJwtSignEffect(effect) : normalizeJwtVerifyEffect(effect);
+    if (!signing && execution && typeof execution.registerRedactionValue === 'function') {
       execution.registerRedactionValue(input.token);
     }
     assertRequestActive(execution, jwtProvider);
-    const selectedCrypto = assertRuntimeBuiltin(cryptoProvider, jwtProvider);
+    const selectedCrypto = signing
+      ? (input.options.algorithm === 'RS256'
+        ? require('@pulse-compute/crypto/provider').bindJavascriptRs256Signer()
+        : input.options.algorithm === 'ES256'
+        ? require('@pulse-compute/crypto/provider').bindJavascriptEs256Signer()
+        : require('@pulse-compute/crypto/provider').bindJavascriptDigestMac(['HMAC-SHA256']))
+      : assertRuntimeBuiltin(cryptoProvider, jwtProvider);
     const host = {
       async captureWallClock() {
         assertRequestActive(execution, jwtProvider);
@@ -118,7 +128,7 @@ function createFastlyJavascriptJwtVerify(options = {}) {
         return result;
       };
     }
-    const result = await jwtProvider.verifyJwtWithCrypto(
+    const result = await (signing ? jwtProvider.signJwtWithCrypto : jwtProvider.verifyJwtWithCrypto)(
       input,
       Object.freeze(host),
       selectedCrypto

package/src/javascript/logging.js

@@ -1,8 +1,11 @@
 'use strict';
 
+const { normalizeFastlyLogEndpoint, MAX_LOG_BYTES } = require('../toolchain/logging.js');
+
 const FASTLY_JAVASCRIPT_LOGGING_VERSION = 'pulse.fastly-javascript-logging.v1';
 
 function createFastlyJavascriptLogEmitter(options = {}) {
+  const endpoint = normalizeFastlyLogEndpoint(options.logEndpoint);
   const output = options.console || globalThis.console;
   const methods = Object.freeze({
     1: 'error',
@@ -11,12 +14,18 @@ function createFastlyJavascriptLogEmitter(options = {}) {
     4: 'debug'
   });
   return function fastlyJavascriptLog(level, message, event) {
-    if (!output) return;
     const method = methods[Number(level)] || 'log';
+    const record = `[pulse][${event && event.name || method}] ${String(message)}`;
+    if (endpoint !== undefined) {
+      if (new TextEncoder().encode(record).byteLength > MAX_LOG_BYTES) return;
+      try { new options.Logger(endpoint).log(record); } catch { /* Best effort, no fallback or retry. */ }
+      return;
+    }
+    if (!output) return;
     const write = typeof output[method] === 'function'
       ? output[method]
       : (typeof output.log === 'function' ? output.log : undefined);
-    if (write) write.call(output, `[pulse][${event && event.name || method}] ${String(message)}`);
+    try { if (write) write.call(output, record); } catch { /* Logging does not change the HTTP outcome. */ }
   };
 }
 

package/src/javascript/package-effects.js

@@ -15,10 +15,12 @@ function unavailable(effect = {}) {
 function createFastlyJavascriptPackageEffectCapabilities(options = {}) {
   const assetsLookup = options.assetsLookup;
   const gripBroadcast = options.gripBroadcast;
+  const digestText = require('@pulse-compute/crypto/provider').createJavascriptTextDigest(options);
   const jwtVerify = options.jwtVerify;
   return Object.freeze({
     version: FASTLY_JAVASCRIPT_PACKAGE_EFFECTS_VERSION,
     effect(effect, execution) {
+      if (effect && effect.contractId === 'pulse.crypto' && effect.operation === 'digestText') return digestText(effect, execution);
       if (effect && effect.contractId === 'pulse.assets' && effect.operation === 'lookup') {
         if (typeof assetsLookup !== 'function') return unavailable(effect);
         return assetsLookup(effect.payload, execution);
@@ -33,7 +35,7 @@ function createFastlyJavascriptPackageEffectCapabilities(options = {}) {
         }
         return gripBroadcast(effect.payload, execution);
       }
-      if (effect && effect.contractId === 'pulse.jwt' && effect.operation === 'verify') {
+      if (effect && effect.contractId === 'pulse.jwt' && ['verify', 'sign'].includes(effect.operation)) {
         if (typeof jwtVerify !== 'function') return unavailable(effect);
         return jwtVerify(effect, execution);
       }
@@ -49,7 +51,8 @@ function withFastlyPackageEffectCapabilities(capabilities, options = {}) {
     ...base,
     effect(effect, execution) {
       if (effect && (
-        effect.contractId === 'pulse.assets'
+        effect.contractId === 'pulse.crypto'
+        || effect.contractId === 'pulse.assets'
         || effect.contractId === 'pulse.grip'
         || effect.contractId === 'pulse.jwt'
       )) {

package/src/javascript/runtime-host.js

@@ -45,10 +45,10 @@ function createFastlyJavascriptCapabilities(options = {}) {
     : undefined;
   return withFastlyPackageEffectCapabilities(
     withFastlyFetchCapability(
-      withFastlyBindingCapabilities(options.capabilities, { ...options, bindingCapabilities }),
+      withFastlyBindingCapabilities({ time: () => runtimeHost.readWallTime(options.wallClock === undefined ? () => Date.now() : options.wallClock), ...options.capabilities }, { ...options, bindingCapabilities }),
       { ...options, fetchImplementation: options.fetchImplementation }
     ),
-    { assetsLookup, gripBroadcast, jwtVerify }
+    { assetsLookup, gripBroadcast, jwtVerify, digestSubtle: options.digestSubtle }
   );
 }
 
@@ -57,6 +57,9 @@ function requestHeaderPairs(request) {
 }
 
 async function executeFastlyJavascriptApplication(application, request, options = {}) {
+  if (options.maxDurationMs !== undefined || options.requestBudget !== undefined) {
+    throw new runtimeHost.PulseRuntimeContractError('PULSE_REQUEST_DURATION_UNSUPPORTED', 'Fastly JavaScript does not implement the request deadline; select Native.');
+  }
   const capabilities = options.effectAdapter === undefined
     ? createFastlyJavascriptCapabilities(options)
     : undefined;
@@ -77,12 +80,13 @@ async function executeFastlyJavascriptApplication(application, request, options
     maxKvValueBytes: options.maxKvValueBytes,
     maxKvValueDepth: options.maxKvValueDepth,
     maxKvValueEntries: options.maxKvValueEntries,
+    binaryResources: options.binaryResources,
     schemaCodecs: options.schemaCodecs,
     strict: options.strict === true,
     target: 'javascript',
     provider: 'fastly',
     reporting: options.reporting,
-    log: options.log || createFastlyJavascriptLogEmitter({ console: options.console }),
+    log: options.log || createFastlyJavascriptLogEmitter({ console: options.console, logEndpoint: options.bindings?.logEndpoint, Logger: options.apis?.Logger }),
     redactionValues: options.redactionValues,
     onLogObservation: options.onLogObservation,
     onJsonTrace: options.onJsonTrace,

package/src/javascript/source-package.js

@@ -153,6 +153,7 @@ function abortControllerCompatibilitySource() {
 function bootstrapSource(deployment, runtimeConfig) {
   return [
     "import { enforceExplicitBackends } from 'fastly:backend';",
+    "import { Logger } from 'fastly:logger';",
     "import { ConfigStore } from 'fastly:config-store';",
     "import { KVStore } from 'fastly:kv-store';",
     "import { SecretStore } from 'fastly:secret-store';",
@@ -165,7 +166,7 @@ function bootstrapSource(deployment, runtimeConfig) {
     'if (pulseRuntimeConfig.bindings.dynamicBackends !== true) enforceExplicitBackends();',
     'export const handler = createFastlyJavascriptHandler(application, {',
     '  ...pulseRuntimeConfig,',
-    '  apis: { ConfigStore, SecretStore, KVStore },',
+    '  apis: { ConfigStore, SecretStore, KVStore, Logger },',
     '  fetchImplementation: globalThis.fetch.bind(globalThis),',
     '  console: globalThis.console,',
     '  schemaCodecs',
@@ -332,6 +333,7 @@ function bundleFastlyJavascriptApplication(plan, projectRoot, schemaBundle, opti
         ]
       : ['const schemaCodecs = null;']),
     'const { createFastlyJavascriptHandler } = fastlyRuntime;',
+    ...(options.binaryResources ? [require('@pulse-compute/wasm-host-runtime/compiler/binary-resources').resourceJavascriptSource(options.binaryResources, 'application', 'resourceHost'), "import resourceHost from '@pulse-compute/runtime/host';"] : []),
     'export { application, createFastlyJavascriptHandler, schemaCodecs };',
     'export default application;',
     ''
@@ -501,7 +503,7 @@ function writeFastlyJavascriptSourcePackage(options = {}) {
   });
   const schemaBundle = options.schemaBundle;
   const schemaActive = Boolean(schemaBundle && schemaBundle.active);
-  const bundle = bundleFastlyJavascriptApplication(plan, projectRoot, schemaBundle);
+  const bundle = bundleFastlyJavascriptApplication(plan, projectRoot, schemaBundle, { binaryResources: options.binaryResources });
   const providerConfig = options.providerConfig || {};
   const providerBindings = providerConfig.bindings && typeof providerConfig.bindings === 'object'
     ? providerConfig.bindings

package/src/javascript/target-support-policy.js

@@ -16,6 +16,11 @@ function blockedRestriction(id, restriction) {
 
 function classifyFastlyJavascriptCapability(id, restrictions = {}) {
   const capability = String(id);
+  if (capability === 'request.body.transform') return decision(capability, 'blocked', 'fastly-body-transform-unavailable', 'provider-fastly');
+  if (capability === 'request.body.forward' || capability === 'req.body') return decision(capability, 'blocked', 'fastly-incoming-body-forwarding-unavailable', 'provider-fastly');
+  if (capability === 'crypto.digestText') return decision(capability, 'eligible', 'fastly-javascript-crypto-sha256-runtime-builtin', 'provider-fastly');
+  if (['kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap', 'kv.list', 'kv.delete'].includes(capability)) return decision(capability, 'blocked', 'fastly-conditional-kv-incomplete', 'provider-fastly');
+  if (['s3.head', 's3.getText', 's3.putText', 's3.getBody'].includes(capability)) return decision(capability, 'blocked', 'fastly-javascript-s3-raw-headers-unavailable', 'provider-fastly');
   if (isJavascriptCoreCapability(capability)) {
     return decision(capability, 'eligible', 'fastly-request-router-runtime', 'provider-fastly');
   }
@@ -79,9 +84,11 @@ function classifyFastlyJavascriptCapability(id, restrictions = {}) {
     return decision(capability, 'eligible', 'fastly-javascript-provider-wall-clock-authority', 'provider-fastly');
   }
   if (
-    capability === 'jwt.verify'
+    capability === 'jwt.sign'
+    || capability === 'jwt.verify'
     || capability === 'jwt.verify.hs256'
     || capability === 'jwt.verify.es256'
+    || capability === 'jwt.verify.rs256'
   ) {
     return blockedRestriction(capability, restrictions.jwt)
       || decision(capability, 'eligible', 'fastly-javascript-jwt-crypto-runtime-builtin', 'provider-fastly');
@@ -100,6 +107,9 @@ function classifyFastlyJavascriptCapability(id, restrictions = {}) {
 
 function classifyFastlyJavascriptProviderRequirement(id, restrictions = {}) {
   const requirement = String(id);
+  if (requirement === 'crypto.digestText') return decision(requirement, 'eligible', 'fastly-javascript-crypto-sha256-runtime-builtin', 'provider-fastly');
+  if (['kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap', 'kv.list', 'kv.delete'].includes(requirement)) return decision(requirement, 'blocked', 'fastly-conditional-kv-incomplete', 'provider-fastly');
+  if (['s3.head', 's3.getText', 's3.putText', 's3.getBody'].includes(requirement)) return decision(requirement, 'blocked', 'fastly-javascript-s3-raw-headers-unavailable', 'provider-fastly');
   if (requirement === 'request' || ['response.json', 'response.text', 'response.custom'].includes(requirement)) {
     return decision(requirement, 'eligible', 'fastly-request-response-lifecycle', 'provider-fastly');
   }
@@ -141,9 +151,11 @@ function classifyFastlyJavascriptProviderRequirement(id, restrictions = {}) {
     return decision(requirement, 'eligible', 'fastly-javascript-provider-wall-clock-authority', 'provider-fastly');
   }
   if (
-    requirement === 'jwt.verify'
+    requirement === 'jwt.sign'
+    || requirement === 'jwt.verify'
     || requirement === 'jwt.verify.hs256'
     || requirement === 'jwt.verify.es256'
+    || requirement === 'jwt.verify.rs256'
   ) {
     return blockedRestriction(requirement, restrictions.jwt)
       || decision(requirement, 'eligible', 'fastly-javascript-jwt-crypto-runtime-builtin', 'provider-fastly');
@@ -165,6 +177,11 @@ function restriction(reasonId, configuration) {
 }
 
 function fastlyJavascriptProjectRestrictions(compiled, project) {
+  if (project.providerConfig?.maxDurationMs !== undefined) {
+    const error = new TypeError('fastly.maxDurationMs requires the Native target; Fastly JavaScript does not implement the request deadline.');
+    error.code = 'PULSE_REQUEST_DURATION_UNSUPPORTED';
+    throw error;
+  }
   const bindings = project.providerConfig && project.providerConfig.bindings || {};
   const backends = bindings.backends && typeof bindings.backends === 'object' ? bindings.backends : {};
   const kv = bindings.kv && typeof bindings.kv === 'object' ? bindings.kv : {};
@@ -177,7 +194,7 @@ function fastlyJavascriptProjectRestrictions(compiled, project) {
   const secretSites = sites.filter((entry) => entry.kind === 'secret.get');
   const jwtSites = sites.filter((entry) => (
     entry.contractId === 'pulse.jwt'
-    && (entry.operation === 'verify' || entry.kind === 'jwt.verify')
+    && (['verify', 'sign'].includes(entry.operation) || ['jwt.verify', 'jwt.sign'].includes(entry.kind))
   ));
   const output = {};
 

package/src/javascript/target.js

@@ -14,6 +14,16 @@ const FASTLY_JAVASCRIPT_TARGET_DESCRIPTOR = normalizeJavascriptTargetDescriptor(
   crypto: defineCryptoTargetCapabilities({
     target: 'javascript',
     algorithms: [{
+      algorithm: 'HMAC-SHA256',
+      realization: 'runtime-builtin',
+      implemented: true,
+      status: 'implemented-jwt-sign'
+    }, {
+      algorithm: 'SHA-256',
+      realization: 'runtime-builtin',
+      implemented: true,
+      status: 'implemented-d1'
+    }, {
       algorithm: 'HS256',
       realization: 'runtime-builtin',
       implemented: true,
@@ -23,6 +33,11 @@ const FASTLY_JAVASCRIPT_TARGET_DESCRIPTOR = normalizeJavascriptTargetDescriptor(
       realization: 'runtime-builtin',
       implemented: true,
       status: 'implemented-h4'
+    }, {
+      algorithm: 'RS256',
+      realization: 'runtime-builtin',
+      implemented: true,
+      status: 'implemented-h4'
     }]
   }),
   capabilities: {
@@ -45,7 +60,7 @@ const FASTLY_JAVASCRIPT_TARGET_DESCRIPTOR = normalizeJavascriptTargetDescriptor(
       kv: true,
       parallel: true
     },
-    packages: ['pulse.assets', 'pulse.grip', 'pulse.jwt'],
+    packages: ['pulse.assets', 'pulse.crypto', 'pulse.grip', 'pulse.jwt'],
     restrictions: {
       fetch: 'origin-backend-map-or-dynamic-opt-in',
       kv: 'logical-store-map-required',
@@ -57,6 +72,7 @@ const FASTLY_JAVASCRIPT_TARGET_DESCRIPTOR = normalizeJavascriptTargetDescriptor(
     supported: true,
     default: 'info',
     levels: ['off', 'error', 'warn', 'info', 'debug'],
+    destinations: ['stdout', 'configured-named-endpoint'],
     destination: 'provider-owned',
     betaDefault: 'stdio-log-tail'
   },

package/src/javascript/test-runtime.js

@@ -331,6 +331,7 @@ async function executeFastlyJavascriptLocalRequest(application, request, options
     maxRequestBodyBytes: options.maxRequestBodyBytes ?? options.maxBodyBytes,
     maxFetchBodyBytes: options.maxFetchBodyBytes ?? options.maxBodyBytes,
     maxStructuredBodyBytes: options.maxStructuredBodyBytes,
+    binaryResources: options.binaryResources,
     schemaCodecs: options.schemaCodecs,
     strict: options.strict === true,
     reporting: options.reporting,

package/src/provider-contract.js

@@ -12,27 +12,40 @@ const FASTLY_PROVIDER_DESCRIPTOR = canonical.normalizeDescriptor({
   deployable: true,
   localExecution: true,
   capabilities: [
-    'request', 'response.json', 'response.text', 'response.custom', 'fetch',
-    'config.get', 'secret.get', 'kv.get', 'kv.put', 'assets.lookup',
-    'grip.channel', 'grip.hold', 'grip.publish', 'grip.broadcast', 'jwt.verify',
-    'opaque.pass-through'
+    'request', 'request.body.forward', 'response.json', 'response.text', 'response.custom', 'fetch',
+    'time.wall-clock', 'crypto.digestText', 'config.get', 'secret.get', 'kv.get', 'kv.put', 'kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap', 'kv.list', 'kv.delete', 'assets.lookup',
+    'grip.channel', 'grip.hold', 'grip.publish', 'grip.broadcast', 'jwt.verify', 'jwt.sign',
+    'opaque.pass-through', 's3.head', 's3.getText', 's3.putText', 's3.getBody'
   ],
   lowering: {
     request: 'fastly.compute.request',
+    'request.body.forward': 'fastly.native.body-forwarding',
     'response.json': 'fastly.compute.response.json',
     'response.text': 'fastly.compute.response.text',
     'response.custom': 'fastly.compute.response.custom',
     fetch: 'fastly.backend.fetch',
+    'time.wall-clock': 'wasi.clock_time_get.realtime',
+    'crypto.digestText': 'pulse.crypto.guest-source.sha256',
     'config.get': 'fastly.config-store.get',
     'secret.get': 'fastly.secret-store.get',
     'kv.get': 'fastly.kv-store.get',
     'kv.put': 'fastly.kv-store.put',
+    'kv.list': 'fastly.native.kv-store.list',
+    'kv.delete': 'fastly.native.kv-store.delete',
+    'kv.getVersioned': 'fastly.native.kv-store.getVersioned',
+    'kv.insertIfAbsent': 'fastly.native.kv-store.insertIfAbsent',
+    'kv.compareAndSwap': 'fastly.native.kv-store.compareAndSwap',
     'assets.lookup': 'fastly.kv-store.assets.lookup',
     'grip.channel': 'fastly.fanout.channel',
     'grip.hold': 'fastly.fanout.hold',
     'grip.publish': 'fastly.fanout.publish',
     'grip.broadcast': 'fastly.grip.publish-control',
     'jwt.verify': 'fastly.native.jwt.verify',
+    'jwt.sign': 'fastly.native.jwt.sign',
+    's3.head': 'fastly.native.s3.head',
+    's3.getText': 'fastly.native.s3.getText',
+    's3.getBody': 'fastly.native.s3.getBody',
+    's3.putText': 'fastly.native.s3.putText',
     'opaque.pass-through': 'fastly.response-body.stream'
   }
 });
@@ -52,9 +65,12 @@ function validateStaticBackendBindings(metadata = {}, bindings = {}) {
   }
 }
 
-function createFastlyLoweringPlan(metadata, bindings = {}) {
+function createFastlyLoweringPlan(metadata, bindings = {}, options = {}) {
+  const forwarding = require('./toolchain/body-forwarding.js').normalizeBodyForwarding(options.bodyForwarding, options.maxDurationMs);
+  const descriptor = forwarding ? FASTLY_PROVIDER_DESCRIPTOR : {...FASTLY_PROVIDER_DESCRIPTOR, capabilities: FASTLY_PROVIDER_DESCRIPTOR.capabilities.filter(id => id !== 'request.body.forward')};
+  require('./toolchain/s3.js').resolveFastlyS3(metadata.providerOperations || [], bindings.s3);
   validateStaticBackendBindings(metadata, bindings);
-  return canonical.createProviderLoweringPlan(metadata, FASTLY_PROVIDER_DESCRIPTOR, {
+  return canonical.createProviderLoweringPlan(metadata, descriptor, {
     ...bindings,
     grip: bindings.grip || 'fastly-fanout'
   });