@pulse-compute/provider-fastly 1.0.0-beta.1 → 1.0.0-beta.11

package/src/build/host-extensions.js

@@ -0,0 +1,254 @@
+'use strict';
+
+// The provider owns the terminal service. Package selection and ABI admission
+// use the shared contribution contract; trusted source is not sandboxed.
+const contract = require('@pulse-compute/wasm-contracts/provider/toolchain').hostExtensions;
+const { CANONICAL_NATIVE_VALUE_TRANSFER_MAX_BYTES } = require('@pulse-compute/wasm-contracts/handler/canonical-native-runtime');
+const MAX_BACKEND_BYTES = Math.min(1024, CANONICAL_NATIVE_VALUE_TRANSFER_MAX_BYTES);
+const { STATES } = require('./response-authority.js');
+const ADMISSION = contract.normalizeAdmission({ version: contract.ADMISSION_VERSION,
+  protocols: [contract.VERSION], services: [contract.TERMINAL_SERVICE] });
+const TARGET = Object.freeze({ provider: 'fastly', target: 'native', targetId: 'fastly-compute-native', hostExtensions: ADMISSION });
+function fail(message, operation) { contract.fail('PLACEMENT', message, operation); }
+const matches = contract.matches;
+function validateBinding(effect, bindings = {}) {
+  const key = effect.resource?.value;
+  const backend = effect.resource?.kind === 'literal' && (bindings.backends || {})[key];
+  if (typeof key !== 'string' || typeof backend !== 'string' || !backend || backend.includes('\0') || Buffer.byteLength(backend) > MAX_BACKEND_BYTES)
+    contract.fail('BINDING', `${effect.package}.${effect.operation} requires a configured static backend binding.`, effect);
+  return backend;
+}
+function select(plan, options = {}) {
+  try { return selectPlan(plan, options); }
+  catch (error) {
+    if (error.code?.startsWith('PULSE_HOST_EXTENSION_') && plan.entry?.kind === 'router') {
+      const used = (plan.effects || []).filter(effect => effect.kind === 'host.extension');
+      const effect = used.find(effect => effect.package === error.detail?.package && effect.operation === error.detail?.operation) || used[0];
+      const entry = plan.routing?.entries?.find(entry => entry.stableId === effect?.routerEntryStableId);
+      const source = entry?.nativeBody?.source || plan.handlers?.find(handler => handler.id === effect?.routerEntryStableId)?.source || null;
+      // Lowered Router positions address generated dispatch text. Public errors
+      // must identify the authored handler and state the coarser source basis.
+      error.detail = Object.freeze({ ...error.detail, loc: source, sourceBasis: source ? 'authored-entry' : 'not-recorded' });
+    }
+    throw error;
+  }
+}
+function selectPlan(plan, options = {}) {
+  const effects = plan.effects || [];
+  const used = effects.filter(effect => effect.kind === 'host.extension');
+  if (!used.length) return [];
+  const reject = message => fail(message, used[0]);
+  // Reuse the canonical Router dispatcher and private terminal-route bodies.
+  // Admission bounds authored behavior; no new scheduler or package special case.
+  const routed = plan.entry?.kind === 'router';
+  if (used.length !== 1 || effects.length !== 1 || used[0].grouped || used[0].result?.mode !== 'return'
+    || used[0].declaredResult !== 'host-terminal'
+    || (plan.helpers || []).length || (plan.callables || []).length || (plan.stages || []).length
+    || options.bodyForwarding || options.bindings?.dynamicBackends || options.guestUnits?.length
+    || plan.packages?.application || plan.logging?.enabledStatements)
+    reject('only one direct terminal effect without surrounding effects or composition is admitted.');
+  const handlers = new Map((plan.handlers || []).map(handler => [handler.id, handler]));
+  const entries = plan.routing?.entries || [];
+  if (routed) {
+    if (!entries.length || entries.length !== handlers.size
+      || entries.some(entry => entry.kind !== 'route' || entry.nativeBody?.family !== 'terminal-route'
+        || !handlers.has(entry.stableId))
+      || used[0].routerEntryKind !== 'route' || !handlers.has(used[0].routerEntryStableId)
+      || !used[0].statementPath?.startsWith(`handlers.${used[0].routerEntryStableId}.body[`))
+      reject('terminal Router placement requires private route bodies without middleware or error composition.');
+  } else if (plan.entry?.kind !== 'handler' || handlers.size || entries.length
+    || !used[0].statementPath?.startsWith('entry.body[')) {
+    reject('terminal placement requires a plain HTTP handler or one selected Router route.');
+  }
+  const dispatcherLocals = new Set((plan.locals || []).filter(local => local.scopeId === 'entry').map(local => local.id));
+  function expression(value, dispatcher = false) {
+    if (!value || typeof value !== 'object') return;
+    if (dispatcher && value.kind === 'local' && dispatcherLocals.has(value.id)) return;
+    if (dispatcher && value.kind === 'undefined') return;
+    if (dispatcher && value.kind === 'assignment' && value.operator === '='
+      && value.target?.kind === 'local' && dispatcherLocals.has(value.target.id)) {
+      expression(value.value, true); return;
+    }
+    // Router exhaustion emits a literal status option; authored text siblings
+    // may use that same bounded response shape, without evaluating callbacks.
+    if (routed && value.kind === 'object' && value.entries?.every(entry => entry.kind === 'property'
+      && entry.key?.kind === 'literal' && entry.key.value === 'status' && entry.value?.kind === 'literal'
+      && Number.isInteger(entry.value.value) && entry.value.value >= 100 && entry.value.value <= 599)) return;
+    if (!['literal', 'context-read', 'binary', 'intrinsic'].includes(value.kind)) reject('unsupported expression in the terminal proof.');
+    if (value.kind === 'context-read' && !['req.path', 'req.method', 'req.url'].includes(value.path.join('.'))) reject('request mutation/body/state is outside this proof.');
+    if (value.kind === 'intrinsic' && value.name !== 'response.text' && !(dispatcher && value.name === 'router.match'))
+      reject('only a plain text response control is admitted beside the handoff.');
+    for (const child of [value.left, value.right, ...(value.arguments || [])]) if (child) expression(child, dispatcher);
+  }
+  let occurrences = 0;
+  const calls = new Map();
+  function statements(body, owner) {
+    const dispatcher = routed && owner === 'entry';
+    for (const [index, statement] of body.entries()) {
+      if (statement.kind === 'if') { expression(statement.test, dispatcher); statements(statement.then, owner); statements(statement.else, owner); }
+      else if (statement.kind === 'return') {
+        if (statement.value?.kind !== 'intrinsic' || statement.value.name !== 'response.text') reject('Ordinary terminal branches must return a text response.');
+        expression(statement.value, dispatcher);
+      } else if (statement.kind === 'effect') {
+        if (dispatcher || statement.effectId !== used[0].id || statement.result?.mode !== 'return'
+          || (routed && owner !== used[0].routerEntryStableId)) reject('handoff must return directly from its selected route.');
+        occurrences++;
+      } else if (dispatcher && statement.kind === 'handler-call' && handlers.has(statement.handlerId)) {
+        calls.set(statement.handlerId, (calls.get(statement.handlerId) || 0) + 1);
+      } else if (dispatcher && statement.kind === 'local' && dispatcherLocals.has(statement.localId)) {
+        expression(statement.value, true);
+      } else if (dispatcher && statement.kind === 'expression') {
+        expression(statement.expression, true);
+      } else if (routed && !dispatcher && index === 0 && statement.kind === 'local'
+        && statement.name === `__pulse_router_transferred_${entries.find(entry => entry.stableId === owner)?.index}`
+        && handlers.get(owner)?.localIds.includes(statement.localId)
+        && statement.value?.kind === 'literal' && statement.value.value === false) {
+        // The canonical route body's private transfer flag, not an authored token.
+      } else reject('only bounded route dispatch, pure conditions, direct handoff and text responses are admitted.');
+    }
+  }
+  statements(plan.entry.body, 'entry');
+  for (const handler of handlers.values()) {
+    if (calls.get(handler.id) !== 1) reject('each terminal route requires exactly one dispatcher call.');
+    statements(handler.body, handler.id);
+  }
+  if (occurrences !== 1) reject('exactly one terminal handoff site is required.');
+  const effect = used[0];
+  const inputs = effect.inputs || [];
+  if (inputs.length !== 2 || inputs[0].name !== 'resource' || inputs[1].name !== 'payload'
+    || inputs[1].value?.kind !== 'object' || inputs[1].value.entries?.length !== 0
+    || inputs[0].value?.kind !== 'object' || inputs[0].value.entries?.length !== 2
+    || inputs[0].value.entries.some(entry => entry.kind !== 'property' || entry.key?.kind !== 'literal'
+      || !['kind', 'value'].includes(entry.key.value) || entry.value?.kind !== 'literal'
+      || entry.value.value !== effect.resource?.[entry.key.value])) reject('The terminal service accepts only a static resource and empty payload.');
+  const target = options.targetDescriptor ? { provider: 'fastly', ...options.targetDescriptor } : TARGET;
+  const [artifact] = contract.select(used, options.realizationArtifacts || [], target);
+  const data = artifact.data;
+  if (data.service !== contract.TERMINAL_SERVICE || data.imports.length !== 1
+    || JSON.stringify(data.imports[0].parameters) !== '["i32","i32","i32"]'
+    || JSON.stringify(data.imports[0].results) !== '["i32"]')
+    contract.fail('SIGNATURE', 'The terminal backend service requires (i32, i32, i32) -> i32.', effect);
+  const backend = validateBinding(effect, options.bindings || options);
+  return Object.freeze([Object.freeze({ artifact, effect, index: effects.indexOf(effect), backend })]);
+}
+// The terminal service uses driver-owned response authority and binds each
+// selected contribution to a slot: static per-effect data (effect index, ABI
+// entry, backend). Only one terminal handoff can win per request, so the
+// dynamic state (dispatching slot, token, ticket, settlement) is request-scoped.
+function slotSwitch(selected, slot, cases, fallback) {
+  return selected.map((item, n) => `if (${slot} == ${n}) ${cases(item, n)}`).join('\n  ') + `\n  ${fallback}`;
+}
+function source(selected) {
+  if (!selected.length) return '';
+  const contributed = [...new Map(selected.map(item => [item.artifact.id, item.artifact.data.source])).values()].join('\n');
+  return `
+${contributed}
+let __pulse_extension_status: i32 = -1
+let __pulse_extension_slot: i32 = -1
+let __pulse_extension_token: i32 = 0
+let __pulse_extension_invocation: i32 = 0
+let __pulse_extension_delivering: bool = false
+let __pulse_extension_settled: bool = false
+let __pulse_extension_handles_owned: bool = false
+function __pulse_extension_slot_of(effectIndex: i32): i32 {
+  ${selected.map((item, n) => `if (effectIndex == ${item.index}) return ${n}`).join('\n  ')}
+  return -1
+}
+function __pulse_extension_backend(slot: i32): ArrayBuffer {
+  ${slotSwitch(selected, 'slot', item => `return __pulse_fastly_utf8(${JSON.stringify(item.backend)})`, 'return new ArrayBuffer(0)')}
+}
+function __pulse_extension_call(slot: i32, request: i32, backend: ArrayBuffer): i32 {
+  ${slotSwitch(selected, 'slot', item => `return ${item.artifact.data.entry}(request, changetype<usize>(backend), backend.byteLength)`, 'return -1')}
+}
+function __pulse_extension_cleanup(): void {
+  // This service borrows the request handle. Status zero transfers downstream
+  // response authority, not ownership of these local request/body handles.
+  // Nonzero/trapped dispatch remains uncertain and is left to host teardown.
+  if (!__pulse_extension_handles_owned || (__pulse_extension_slot >= 0 && __pulse_response_authority == ${STATES['outcome-unknown']})) return
+  __pulse_extension_handles_owned = false
+  const request = __pulse_fastly_request_handle, body = __pulse_fastly_request_body_handle
+  __pulse_fastly_request_handle = -1
+  __pulse_fastly_request_body_handle = -1
+  const requestStatus = __pulse_fetch_close_request(request)
+  const bodyStatus = __pulse_fetch_close_body(body)
+  if (requestStatus != 0 || bodyStatus != 0) __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 285, __pulse_extension_slot)
+}
+function __pulse_extension_begin(effectIndex: i32, payload: __PulseFastlyValue): void {
+  const slot = __pulse_extension_slot_of(effectIndex)
+  if (slot < 0 || __pulse_response_authority != ${STATES['owned']} || !__pulse_invocation_started || __pulse_invocation_closed || __pulse_fastly_last_error != 0 || unchecked(__pulse_invocation_tickets[effectIndex]) <= 0) { __pulse_fastly_fail(PULSE_ERROR_STATE, 280, effectIndex); return }
+  // One bounded backend encoding and one opaque token per admitted invocation.
+  const backend = __pulse_extension_backend(slot)
+  if (backend.byteLength > ${MAX_BACKEND_BYTES} || __pulse_extension_token != 0) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 280, effectIndex); return }
+  // Allocate before dispatch, while we still own downstream response authority.
+  const value = new __PulseFastlyValue()
+  value.kind = 9 // private provider completion token, never an authored value
+  __pulse_extension_token = __pulse_fastly_put(value)
+  if (__pulse_extension_token <= 0 || __pulse_fastly_last_error != 0) return
+  // Recheck the shared request budget immediately before crossing the ABI.
+  if (!__pulse_fetch_request_check(effectIndex) || __pulse_invocation_closed || __pulse_fastly_last_error != 0) return
+  __pulse_extension_invocation = unchecked(__pulse_invocation_tickets[effectIndex])
+  __pulse_extension_slot = slot
+  if (!__pulse_response_begin()) return
+  __pulse_extension_status = __pulse_extension_call(slot, __pulse_fastly_request_handle, backend)
+  if (__pulse_extension_status != 0) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 281, effectIndex); return }
+  __pulse_response_transferred()
+  __pulse_extension_cleanup()
+  if (!__pulse_fetch_request_check(effectIndex) || __pulse_invocation_closed || __pulse_fastly_last_error != 0) return
+  __pulse_fastly_ready_effect(effectIndex, __pulse_extension_token)
+}
+`;
+}
+// Typed contributions to the existing structural lifecycle emitter.
+// Bodies see parameters and module globals, never the caller's local variables.
+const OWNER = 'host-extension.terminal';
+function hooks(selected) {
+  if (!selected.length) return [];
+  const mine = (effect) => `__pulse_extension_slot_of(${effect}) >= 0`;
+  // The dispatched slot only; an undispatched terminal effect can never settle.
+  const dispatched = (effect) => `__pulse_extension_slot_of(${effect}) == __pulse_extension_slot`;
+  return [
+    { point: 'request.acquired', owner: OWNER, order: 0, body: '  __pulse_extension_handles_owned = true' },
+    // Authenticate the terminal value before the ordinary invocation consumes its
+    // ticket. A raw exported setter is not authority to complete this operation.
+    { point: 'effect.settle', owner: OWNER, order: 0, body: `  if (!(${mine('effect')})) return true
+  if (!(${dispatched('effect')}) || __pulse_response_authority != ${STATES['transferred']} || __pulse_extension_settled || ticket != __pulse_extension_invocation || result != __pulse_extension_token || result <= 0) {
+    __pulse_fastly_fail(PULSE_ERROR_STATE, 284, effect); return false
+  }
+  return true` },
+    { point: 'effect.deliver', owner: OWNER, order: 0,
+      before: `  __pulse_extension_delivering = ${mine('effect')}`,
+      after: `  __pulse_extension_delivering = false
+  if (${mine('effect')} && accepted == 1) __pulse_extension_settled = true` },
+    { point: 'effect.result', owner: OWNER, order: 0, body: `  if (!(${mine('effect')})) return true
+  if (!(${dispatched('effect')}) || !__pulse_extension_delivering || __pulse_response_authority != ${STATES['transferred']} || __pulse_extension_settled || result != __pulse_extension_token || __pulse_invocation_closed) {
+    __pulse_fastly_fail(PULSE_ERROR_STATE, 284, effect); return false
+  }
+  return true` },
+    { point: 'invocation.close', owner: OWNER, order: 0, body: `  __pulse_extension_cleanup()
+  __pulse_extension_token = 0
+  __pulse_extension_invocation = 0
+  __pulse_extension_delivering = false` },
+    { point: 'result.claim', owner: OWNER, order: 0, body: `  if (__pulse_response_authority == ${STATES['owned']}) return false
+  if (__pulse_response_authority != ${STATES['transferred']} || !__pulse_extension_settled || result != __pulse_extension_token || __pulse_extension_token <= 0) { __pulse_fastly_fail(PULSE_ERROR_STATE, 283, -1); return true }
+  __pulse_response_complete()
+  __pulse_extension_token = 0
+  return true` }
+  ];
+}
+function policy(selected, baseline) {
+  return contract.composeImportPolicy(baseline, selected.map(item => item.artifact));
+}
+function evidence(selected, lifecycle, importPolicy) {
+  if (!selected.length) return undefined;
+  return Object.freeze({ version: 'pulse.fastly-terminal-service.v1', service: contract.TERMINAL_SERVICE,
+    implementation: require('../provider-contract.js').FASTLY_PROVIDER_DESCRIPTOR.lowering['host.extension'],
+    contributions: importPolicy.contributions,
+    useSites: selected.map(({artifact,effect,index}) => ({ contributionId: artifact.id, effectId: effect.id, index,
+      source: effect.source || null })),
+    lifecycle: { executionVersion: lifecycle.plan.executionVersion, httpVersion: lifecycle.plan.httpVersion,
+      selectedPoints: lifecycle.plan.sites.map(site => ({ site: site.id, points: site.points.map(point => ({ point: point.point, kind: point.kind, contributions: point.contributions })) })),
+      coverage: 'selected-points; normal-return-only after/end/closed; no trap finalizer' },
+    limits: { backendBytes: MAX_BACKEND_BYTES, completionValues: 1 },
+    accounting: 'not-selected', importPolicy });
+}
+module.exports = { ADMISSION, TARGET, MAX_BACKEND_BYTES, validateBinding, select, matches, source, hooks, policy, evidence };

package/src/build/kv-native.as.ts

@@ -0,0 +1,331 @@
+// Fastly Native realization of the runtime-owned K1/K2 conditional KV contract.
+// Limits are generated from runtime/host. No SDK or unconditional CAS fallback.
+@external('fastly_async_io', 'select') declare function __kv_select(handles: usize, count: i32, timeout: i32, ready: usize): i32
+@external('fastly_http_body', 'close') declare function __kv_close(body: i32): i32
+
+@lazy const __kv_deadline = new StaticArray<i64>(PULSE_FASTLY_EFFECT_COUNT)
+@lazy const __kv_dispatched = new StaticArray<bool>(PULSE_FASTLY_EFFECT_COUNT)
+@lazy const __kv_list_limits = new StaticArray<i32>(PULSE_FASTLY_EFFECT_COUNT)
+@lazy const __kv_list_prefixes = new Array<string>(PULSE_FASTLY_EFFECT_COUNT).fill('')
+let __kv_request_deadline: i64 = -1;
+// Host embedding seam, in monotonic nanoseconds; never exposed through ctx.
+export function pulse_fastly_kv_request_deadline(deadline: i64): void { __kv_request_deadline = deadline; }
+function __kv_clock(): i64 {
+  const out = new StaticArray<i64>(1);
+  return wasi_snapshot_preview1_clock_time_get(1, 1, changetype<usize>(out)) == 0 ? out[0] : -1;
+}
+function __kv_remaining(index: i32): i32 {
+  const now = __kv_clock();
+  if (now < 0) return -1;
+  const remaining = __kv_deadline[index] - now;
+  return remaining <= 0 ? 0 : i32((remaining + 999999) / 1000000);
+}
+function __kv_set(result: i32, key: string, value: i32): void { host_value_object_set(result, __pulse_fastly_string_value(key), value); }
+function __kv_result(status: string, reason: string = ''): i32 {
+  const result = host_value_object(); __kv_set(result, 'status', __pulse_fastly_string_value(status));
+  if (reason.length) __kv_set(result, 'reason', __pulse_fastly_string_value(reason));
+  return result;
+}
+function __kv_failure(index: i32, reason: string): i32 {
+  const kind = __pulse_fastly_effect_kind(index);
+  return __kv_result(kind == 15 || kind == 23 ? 'failed' : __kv_dispatched[index] ? 'unknown' : kind == 22 ? 'not-deleted' : 'not-stored', reason);
+}
+function __kv_fail(index: i32, reason: string): void { __pulse_fastly_ready_effect(index, __kv_failure(index, reason)); }
+function __kv_expired(index: i32): bool {
+  const remaining = __kv_remaining(index);
+  if (remaining > 0) return false;
+  __kv_fail(index, remaining == 0 ? 'timeout' : 'unavailable'); return true;
+}
+// select readiness guarantees the corresponding I/O action will not block.
+// Zero timeout means infinity in this ABI, so it must never be passed.
+function __kv_ready(index: i32, handle: i32): i32 {
+  const remaining = __kv_remaining(index); if (remaining <= 0) return remaining;
+  const handles = new StaticArray<i32>(1), out = new StaticArray<i32>(1);
+  handles[0] = handle; out[0] = -1;
+  if (__kv_select(changetype<usize>(handles), 1, remaining, changetype<usize>(out)) != 0) return -1;
+  const after = __kv_remaining(index); if (after <= 0) return after;
+  return out[0] == 0 ? 1 : out[0] == -1 ? 0 : -2;
+}
+function __kv_ready_failure(index: i32, ready: i32): i32 { return __kv_failure(index, ready == 0 ? 'timeout' : ready == -2 ? 'protocol' : 'transport'); }
+function __kv_key(text: string): bool {
+  if (text == ' ' || text == '\ufffe' || text == '\uffff') return false;
+  if (!text.length || text.length > __KV_keyBytes || String.UTF8.byteLength(text) > __KV_keyBytes) return false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i);
+    if (c < 32 || (c >= 127 && c <= 159)) return false;
+    if (c >= 0xd800 && c <= 0xdbff) { if (++i >= text.length) return false; const next = text.charCodeAt(i); if (next < 0xdc00 || next > 0xdfff) return false; }
+    else if (c >= 0xdc00 && c <= 0xdfff) return false;
+  }
+  // Fastly's exact-key restrictions; never normalize an application key.
+  return text != '.' && text != '..' && !text.startsWith('.well-known/acme-challenge')
+    && text.indexOf('./') < 0 && !text.endsWith('/.') && !text.endsWith('/..')
+    && text.indexOf('#') < 0 && text.indexOf('?') < 0 && text.indexOf('^') < 0
+    && text.indexOf('|') < 0 && text.indexOf(';') < 0 && text.indexOf('\n') < 0 && text.indexOf('\r') < 0;
+}
+function __kv_list_text(text: string, max: i32, empty: bool = false): bool {
+  if ((!empty && !text.length) || text.length > max || String.UTF8.byteLength(text) > max) return false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i);
+    if (c < 32 || (c >= 127 && c <= 159)) return false;
+    if (c >= 0xd800 && c <= 0xdbff) { if (++i >= text.length) return false; const next = text.charCodeAt(i); if (next < 0xdc00 || next > 0xdfff) return false; }
+    else if (c >= 0xdc00 && c <= 0xdfff) return false;
+  }
+  return true;
+}
+// ABI config: mode:u32, cursor:ptr/len, limit:u32, prefix:ptr/len.
+// Strong is the explicit provider mode; it does not establish a page snapshot.
+function __kv_list_config(index: i32, payload: __PulseFastlyValue, config: StaticArray<i32>): i32 {
+  const options = __pulse_fastly_value(__pulse_fastly_payload_field(payload, 'options'));
+  if (options.kind != PULSE_VALUE_OBJECT) return -1;
+  for (let i = 0; i < options.keys.length; i++) if (options.keys[i] != 'limit' && options.keys[i] != 'prefix' && options.keys[i] != 'cursor') return -1;
+  const limit = __pulse_fastly_value(__pulse_fastly_payload_field(options, 'limit'));
+  if (limit.kind != PULSE_VALUE_NUMBER || !isFinite(limit.number) || limit.number < 1 || limit.number > __KV_listLimit || Math.floor(limit.number) != limit.number) return -1;
+  config[3] = i32(limit.number); __kv_list_limits[index] = config[3]; __kv_list_prefixes[index] = '';
+  let mask = 4;
+  const prefix = __pulse_fastly_value(__pulse_fastly_payload_field(options, 'prefix'));
+  if (prefix.kind != PULSE_VALUE_UNDEFINED) {
+    if (prefix.kind != PULSE_VALUE_STRING || !__kv_list_text(prefix.text, __KV_keyBytes, true)) return -1;
+    __kv_private(prefix.text); __kv_list_prefixes[index] = prefix.text;
+    if (prefix.text.length) mask |= 8;
+  }
+  const cursor = __pulse_fastly_value(__pulse_fastly_payload_field(options, 'cursor'));
+  if (cursor.kind != PULSE_VALUE_UNDEFINED) {
+    if (cursor.kind != PULSE_VALUE_STRING || !__kv_list_text(cursor.text, __KV_cursorBytes)) return -2;
+    __kv_private(cursor.text);
+    mask |= 2;
+  }
+  return mask;
+}
+function __kv_token_valid(token: string): bool {
+  if (token.length != 29 || !token.startsWith('fastly-kv-v1:')) return false;
+  for (let i = 13; i < 29; i++) { const c = token.charCodeAt(i); if (!(c >= 48 && c <= 57) && !(c >= 97 && c <= 102)) return false; }
+  return true;
+}
+function __kv_generation(token: string): u64 {
+  let value: u64 = 0;
+  for (let i = 13; i < 29; i++) { const c = token.charCodeAt(i); value = (value << 4) | u64(c <= 57 ? c - 48 : c - 87); }
+  return value;
+}
+function __kv_token(value: u64): string {
+  let text = 'fastly-kv-v1:';
+  for (let i = 15; i >= 0; i--) text += '0123456789abcdef'.charAt(i32((value >> (i * 4)) & 15));
+  return text;
+}
+function __kv_number(value: f64): string {
+  const text = __pulse_fastly_number_string(value);
+  // AS prints a trailing .0 for large integral f64s; JSON.stringify does not.
+  // Count the portable serialized value budget, including this boundary case.
+  return text.endsWith('.0') ? text.substring(0, text.length - 2) : text;
+}
+// Object field names are complete quoted tokens, not substring secrets: a field
+// named "id" must not corrupt "considered", "invalidAcks", or numeric metrics.
+// Values, lookup keys and generations retain raw and JSON-escaped protection.
+function __kv_private(text: string, field: bool = false): string {
+  const encoded = __pulse_fastly_quote(text);
+  if (field) __pulse_fastly_remember_secret(encoded, true);
+  else {
+    __pulse_fastly_remember_secret(text);
+    __pulse_fastly_remember_secret(encoded.substring(1, encoded.length - 1));
+  }
+  return encoded;
+}
+class __KvEncoder {
+  reason: string = ''; entries: i32 = 0; bytes: i32 = 0;
+  seen: Set<i32> = new Set<i32>(); parts: Array<string> | null;
+  // Reads need the same validation and redaction walk, but no serialized output.
+  constructor(materialize: bool = true) { this.parts = materialize ? new Array<string>() : null; }
+  add(text: string): void { this.bytes += String.UTF8.byteLength(text); if (this.bytes > __KV_valueBytes) this.reason = 'too-large'; else if (this.parts !== null) this.parts!.push(text); }
+  visit(handle: i32, depth: i32 = 0): void {
+    if (this.reason.length) return;
+    if (++this.entries > __KV_entries || depth > __KV_depth) { this.reason = 'too-large'; return; }
+    const value = __pulse_fastly_value(handle);
+    if (value.kind == PULSE_VALUE_NULL) this.add('null');
+    else if (value.kind == PULSE_VALUE_BOOLEAN) this.add(value.boolean ? 'true' : 'false');
+    else if (value.kind == PULSE_VALUE_STRING) this.add(__kv_private(value.text));
+    else if (value.kind == PULSE_VALUE_NUMBER) { if (!isFinite(value.number)) this.reason = 'invalid-value'; else this.add(value.number == 0 ? '0' : __kv_number(value.number)); }
+    else if (value.kind == PULSE_VALUE_ARRAY || value.kind == PULSE_VALUE_OBJECT) {
+      if (this.seen.has(handle)) { this.reason = 'invalid-value'; return; } this.seen.add(handle);
+      const object = value.kind == PULSE_VALUE_OBJECT; this.add(object ? '{' : '[');
+      for (let i = 0; i < value.values.length && !this.reason.length; i++) {
+        if (i) this.add(',');
+        if (object) this.add(__kv_private(value.keys[i], true) + ':');
+        this.visit(value.values[i], depth + 1);
+      }
+      this.add(object ? '}' : ']');
+    } else this.reason = 'invalid-value';
+  }
+  encode(handle: i32): string { this.visit(handle); return this.reason.length ? '' : this.parts!.join(''); }
+}
+function __pulse_fastly_kv_conditional_begin(index: i32, payload: __PulseFastlyValue): void {
+  __kv_dispatched[index] = false;
+  const start = __kv_clock(); if (start < 0) { __kv_fail(index, 'unavailable'); return; }
+  __kv_deadline[index] = start + i64(__KV_timeoutMs) * 1000000;
+  if (__kv_request_deadline >= 0 && __kv_request_deadline < __kv_deadline[index]) __kv_deadline[index] = __kv_request_deadline;
+  const kind = __pulse_fastly_effect_kind(index), key = __pulse_fastly_value(__pulse_fastly_payload_field(payload, 'key'));
+  let listConfig: StaticArray<i32> | null = null;
+  let listMask = 0;
+  if (__KV_HAS_LIST && kind == 23) {
+    listConfig = new StaticArray<i32>(6);
+    listMask = __kv_list_config(index, payload, listConfig!);
+    if (listMask < 0) { __kv_fail(index, listMask == -2 ? 'invalid-cursor' : 'invalid-options'); return; }
+  } else {
+    if (key.kind != PULSE_VALUE_STRING || !__kv_key(key.text)) { __kv_fail(index, 'invalid-key'); return; }
+    __kv_private(key.text);
+  }
+  let generation: u64 = 0;
+  if (kind == 17) {
+    const token = __pulse_fastly_value(__pulse_fastly_payload_field(payload, 'generation'));
+    if (token.kind != PULSE_VALUE_STRING || !__kv_token_valid(token.text)) { __kv_fail(index, 'invalid-generation'); return; }
+    __kv_private(token.text); generation = __kv_generation(token.text);
+  }
+  let wire = '';
+  if (__KV_HAS_WRITE && (kind == 16 || kind == 17)) {
+    const encoder = new __KvEncoder(); const json = encoder.encode(__pulse_fastly_payload_field(payload, 'value'));
+    if (encoder.reason.length) { __kv_fail(index, encoder.reason); return; }
+    // Immutable string snapshot exists before any binding/body/dispatch hostcall.
+    wire = '{"__pulseKv":1,"value":' + json + '}';
+    if (String.UTF8.byteLength(wire) > __KV_wireBytes) { __kv_fail(index, 'too-large'); return; }
+  }
+  if (__kv_expired(index)) return;
+  const name = __pulse_fastly_utf8(__pulse_fastly_kv_store(index)), storeHandle = new StaticArray<i32>(1);
+  if (fastly_kv_store_open(changetype<usize>(name), name.byteLength, changetype<usize>(storeHandle)) != 0) { __kv_fail(index, 'configuration'); return; }
+  if (__kv_expired(index)) return;
+  const keyBytes = __pulse_fastly_utf8(key.text), pending = new StaticArray<i32>(1); let status: i32;
+  if (__KV_HAS_LIST && kind == 23) {
+    const options = __pulse_fastly_value(__pulse_fastly_payload_field(payload, 'options'));
+    const prefixBytes = __pulse_fastly_utf8(__kv_list_prefixes[index]);
+    const cursor = __pulse_fastly_value(__pulse_fastly_payload_field(options, 'cursor'));
+    const cursorBytes = __pulse_fastly_utf8(cursor.kind == PULSE_VALUE_STRING ? cursor.text : '');
+    listConfig![1] = i32(changetype<usize>(cursorBytes)); listConfig![2] = cursorBytes.byteLength;
+    listConfig![4] = i32(changetype<usize>(prefixBytes)); listConfig![5] = prefixBytes.byteLength;
+    status = fastly_kv_store_list(storeHandle[0], listMask, changetype<usize>(listConfig!), changetype<usize>(pending));
+  } else if (__KV_HAS_DELETE && kind == 22) {
+    const config = new StaticArray<i32>(1);
+    __kv_dispatched[index] = true;
+    status = fastly_kv_store_delete(storeHandle[0], changetype<usize>(keyBytes), keyBytes.byteLength, 0, changetype<usize>(config), changetype<usize>(pending));
+  } else if (__KV_HAS_READ && kind == 15) {
+    const config = new StaticArray<i32>(1);
+    status = fastly_kv_store_lookup(storeHandle[0], changetype<usize>(keyBytes), keyBytes.byteLength, 0, changetype<usize>(config), changetype<usize>(pending));
+  } else if (__KV_HAS_WRITE) {
+    const body = new StaticArray<i32>(1), written = new StaticArray<i32>(1);
+    if (fastly_http_body_new(changetype<usize>(body)) != 0) { __kv_fail(index, 'transport'); return; }
+    if (__kv_expired(index)) { __kv_close(body[0]); return; }
+    const bytes = __pulse_fastly_utf8(wire);
+    status = fastly_http_body_write(body[0], changetype<usize>(bytes), bytes.byteLength, 0, changetype<usize>(written));
+    if (status != 0 || written[0] != bytes.byteLength) { __kv_close(body[0]); __kv_fail(index, status != 0 ? 'transport' : 'protocol'); return; }
+    if (__kv_expired(index)) { __kv_close(body[0]); return; }
+    const config = new StaticArray<u64>(4); // 32 zeroed bytes, including padding.
+    if (kind == 16) store<u32>(changetype<usize>(config), 1);
+    else store<u64>(changetype<usize>(config) + 24, generation);
+    __kv_dispatched[index] = true; // Entry is the conservative mutation boundary.
+    status = fastly_kv_store_insert(storeHandle[0], changetype<usize>(keyBytes), keyBytes.byteLength, body[0], kind == 17 ? 32 : 0, changetype<usize>(config), changetype<usize>(pending));
+    // Insert takes ownership on success. On error the body may already be consumed;
+    // best-effort close cannot turn uncertain acceptance into rejection.
+    if (status != 0) __kv_close(body[0]);
+  } else { __kv_fail(index, 'protocol'); return; }
+  if (status != 0) { __kv_fail(index, kind == 23 && status == 2 && (listMask & 2) != 0 ? 'invalid-cursor' : 'transport'); return; }
+  __pulse_fastly_pending[index] = pending[0]; __pulse_fastly_pending_mode[index] = PULSE_FASTLY_PENDING_ASYNC;
+}
+function __kv_utf8(data: Uint8Array, length: i32): bool {
+  for (let i = 0; i < length;) {
+    const c = data[i++]; if (c <= 127) continue;
+    const count = c >= 194 && c <= 223 ? 1 : c >= 224 && c <= 239 ? 2 : c >= 240 && c <= 244 ? 3 : -1;
+    if (count < 0 || i + count > length) return false;
+    const second = data[i];
+    if ((c == 224 && second < 160) || (c == 237 && second > 159) || (c == 240 && second < 144) || (c == 244 && second > 143)) return false;
+    for (let j = 0; j < count; j++) { const next = data[i++]; if (next < 128 || next > 191) return false; }
+  }
+  return true;
+}
+// Each read is synchronous through owned-string decoding and parsing. Parallel
+// effects enter their waits serially; no result or pending hostcall owns this
+// scratch buffer. Only the written prefix is inspected, including after errors.
+@lazy let __kv_read_buffer: Uint8Array | null = null;
+function __kv_read(index: i32, body: i32, generation: u64): i32 {
+  const isList = __KV_HAS_LIST && __pulse_fastly_effect_kind(index) == 23, max = isList ? __KV_envelopeBytes : __KV_wireBytes;
+  if (__kv_read_buffer === null || __kv_read_buffer!.length < max + 1) __kv_read_buffer = new Uint8Array(max + 1);
+  const buffer = __kv_read_buffer!, written = new StaticArray<i32>(1); let count = 0;
+  while (true) {
+    const ready = __kv_ready(index, body); if (ready <= 0) return __kv_ready_failure(index, ready);
+    written[0] = 0;
+    if (fastly_http_body_read(body, buffer.dataStart + count, max + 1 - count, changetype<usize>(written)) != 0) return __kv_failure(index, 'transport');
+    if (written[0] < 0 || written[0] > max + 1 - count) return __kv_failure(index, 'protocol');
+    if (!written[0]) break;
+    count += written[0]; if (count > max) return __kv_failure(index, 'too-large');
+  }
+  if (!__kv_utf8(buffer, count)) return __kv_failure(index, 'protocol');
+  const parser = new __PulseJsonParser(String.UTF8.decodeUnsafe(buffer.dataStart, count, false), true), parsed = parser.parse();
+  if (parser.failed || parsed <= 0) return __kv_failure(index, parser.tooLarge ? 'too-large' : 'protocol');
+  const outer = __pulse_fastly_value(parsed);
+  if (isList) return __kv_list_result(index, outer);
+  if (outer.kind != PULSE_VALUE_OBJECT || outer.keys.length != 2 || __pulse_fastly_find(outer, '__pulseKv') < 0 || __pulse_fastly_find(outer, 'value') < 0) return __kv_failure(index, 'protocol');
+  const marker = __pulse_fastly_value(__pulse_fastly_payload_field(outer, '__pulseKv'));
+  if (marker.kind != PULSE_VALUE_NUMBER || marker.number != 1) return __kv_failure(index, 'protocol');
+  const value = __pulse_fastly_payload_field(outer, 'value'), encoder = new __KvEncoder(false); encoder.visit(value);
+  if (encoder.reason.length) return __kv_failure(index, encoder.reason);
+  const remaining = __kv_remaining(index); if (remaining <= 0) return __kv_failure(index, remaining == 0 ? 'timeout' : 'unavailable');
+  const result = __kv_result('found'), token = __kv_token(generation); __kv_private(token);
+  __kv_set(result, 'generation', __pulse_fastly_string_value(token)); __kv_set(result, 'value', value);
+  __pulse_fastly_deep_freeze(result); return result;
+}
+function __kv_list_result(index: i32, outer: __PulseFastlyValue): i32 {
+  if (outer.kind != PULSE_VALUE_OBJECT || outer.keys.length != 2 || __pulse_fastly_find(outer, 'data') < 0 || __pulse_fastly_find(outer, 'meta') < 0) return __kv_failure(index, 'protocol');
+  const data = __pulse_fastly_value(__pulse_fastly_payload_field(outer, 'data')), meta = __pulse_fastly_value(__pulse_fastly_payload_field(outer, 'meta'));
+  if (data.kind != PULSE_VALUE_ARRAY || data.values.length > __kv_list_limits[index] || meta.kind != PULSE_VALUE_OBJECT) return __kv_failure(index, 'protocol');
+  for (let i = 0; i < meta.keys.length; i++) if (meta.keys[i] != 'limit' && meta.keys[i] != 'prefix' && meta.keys[i] != 'next_cursor' && meta.keys[i] != 'consistency') return __kv_failure(index, 'protocol');
+  const limit = __pulse_fastly_value(__pulse_fastly_payload_field(meta, 'limit'));
+  if (limit.kind != PULSE_VALUE_NUMBER || limit.number != __kv_list_limits[index]) return __kv_failure(index, 'protocol');
+  const prefix = __pulse_fastly_value(__pulse_fastly_payload_field(meta, 'prefix'));
+  if (prefix.kind != PULSE_VALUE_UNDEFINED && prefix.kind != PULSE_VALUE_NULL && (prefix.kind != PULSE_VALUE_STRING || prefix.text != __kv_list_prefixes[index])) return __kv_failure(index, 'protocol');
+  const consistency = __pulse_fastly_value(__pulse_fastly_payload_field(meta, 'consistency'));
+  if (consistency.kind != PULSE_VALUE_UNDEFINED && consistency.kind != PULSE_VALUE_NULL && (consistency.kind != PULSE_VALUE_STRING || consistency.text != 'strong')) return __kv_failure(index, 'protocol');
+  const keys = host_value_array(), seen = new Set<string>();
+  for (let i = 0; i < data.values.length; i++) {
+    const key = __pulse_fastly_value(data.values[i]);
+    if (key.kind != PULSE_VALUE_STRING || !__kv_list_text(key.text, __KV_keyBytes) || !key.text.startsWith(__kv_list_prefixes[index]) || seen.has(key.text)) return __kv_failure(index, 'protocol');
+    seen.add(key.text); __kv_private(key.text); host_value_array_push(keys, data.values[i]);
+  }
+  const cursor = __pulse_fastly_value(__pulse_fastly_payload_field(meta, 'next_cursor'));
+  if (cursor.kind != PULSE_VALUE_UNDEFINED && cursor.kind != PULSE_VALUE_NULL && (cursor.kind != PULSE_VALUE_STRING || !__kv_list_text(cursor.text, __KV_cursorBytes))) return __kv_failure(index, 'protocol');
+  if (cursor.kind == PULSE_VALUE_STRING) __kv_private(cursor.text);
+  const remaining = __kv_remaining(index); if (remaining <= 0) return __kv_failure(index, remaining == 0 ? 'timeout' : 'unavailable');
+  const result = __kv_result('listed'); __kv_set(result, 'keys', keys);
+  __kv_set(result, 'cursor', cursor.kind == PULSE_VALUE_STRING ? __pulse_fastly_string_value(cursor.text) : host_value_null());
+  return result;
+}
+function __kv_wait(index: i32): i32 {
+  if (__pulse_fastly_pending_mode[index] == PULSE_FASTLY_PENDING_READY) return __pulse_fastly_wait_ready(index);
+  const pending = __pulse_fastly_pending[index];
+  __pulse_fastly_pending_mode[index] = PULSE_FASTLY_PENDING_NONE; __pulse_fastly_pending[index] = 0; __pulse_fastly_payloads[index] = 0;
+  // No KV cancel hostcall exists. An expired pending handle is left to invocation
+  // teardown; never call an unready wait just to drain it, and never retry.
+  const ready = __kv_ready(index, pending); if (ready <= 0) return __kv_ready_failure(index, ready);
+  const error = new StaticArray<i32>(1), kind = __pulse_fastly_effect_kind(index);
+  if ((__KV_HAS_WRITE || __KV_HAS_DELETE) && kind != 15 && kind != 23) {
+    const status = __KV_HAS_DELETE && kind == 22 ? fastly_kv_store_delete_wait(pending, changetype<usize>(error)) : __KV_HAS_WRITE ? fastly_kv_store_insert_wait(pending, changetype<usize>(error)) : 1;
+    if (status != 0) return __kv_failure(index, 'transport');
+    const remaining = __kv_remaining(index); if (remaining <= 0) return __kv_failure(index, remaining == 0 ? 'timeout' : 'unavailable');
+    if (kind == 22 && (error[0] == 1 || error[0] == 3)) return __kv_result(error[0] == 1 ? 'deleted' : 'not-found');
+    if (error[0] == 1) return __kv_result('stored');
+    if (kind != 22 && (error[0] == 4 || (error[0] == 3 && kind == 17))) return __kv_result('conflict');
+    if (error[0] == 2 || error[0] == 5 || error[0] == 7) return __kv_result(kind == 22 ? 'not-deleted' : 'not-stored', error[0] == 2 ? 'rejected' : error[0] == 5 ? 'too-large' : 'throttled');
+    return __kv_failure(index, error[0] == 6 ? 'unavailable' : 'protocol');
+  }
+  const body = new StaticArray<i32>(1), metadata = new Uint8Array(2000), written = new StaticArray<i32>(1), generation = new StaticArray<u64>(1);
+  const status = __KV_HAS_LIST && kind == 23 ? fastly_kv_store_list_wait(pending, changetype<usize>(body), changetype<usize>(error)) : __KV_HAS_READ ? fastly_kv_store_lookup_wait_v2(pending, changetype<usize>(body), metadata.dataStart, metadata.length, changetype<usize>(written), changetype<usize>(generation), changetype<usize>(error)) : 1;
+  if (status != 0) return __kv_failure(index, 'transport');
+  if (error[0] != 1) {
+    const remaining = __kv_remaining(index); if (remaining <= 0) return __kv_failure(index, remaining == 0 ? 'timeout' : 'unavailable');
+    if (error[0] == 3 && kind == 15) return __kv_result('not-found');
+    if (error[0] == 2 && kind == 23) return __kv_failure(index, 'invalid-cursor');
+    return __kv_failure(index, error[0] == 5 ? 'too-large' : error[0] == 6 ? 'unavailable' : error[0] == 7 ? 'throttled' : 'protocol');
+  }
+  const result = written[0] < 0 || written[0] > metadata.length ? __kv_failure(index, 'protocol') : __kv_read(index, body[0], generation[0]);
+  __kv_close(body[0]); return result;
+}
+
+function __pulse_fastly_kv_conditional_wait(index: i32): i32 {
+  const result = __kv_wait(index);
+  if (__KV_HAS_LIST) { __kv_list_prefixes[index] = ''; __kv_list_limits[index] = 0; }
+  __pulse_fastly_deep_freeze(result); return result;
+}

package/src/build/kv-native.js

@@ -0,0 +1,27 @@
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const { KV_CONDITIONAL_KINDS, KV_CONDITIONAL_LIMITS } = require('@pulse-compute/runtime/host');
+
+const KV_IMPORTS = Object.freeze([
+  'fastly_async_io:select', 'fastly_http_body:close', 'wasi_snapshot_preview1:clock_time_get',
+  'fastly_kv_store:open'
+]);
+function kvImports(kind) {
+  if (kind === 'kv.list') return [...KV_IMPORTS, 'fastly_kv_store:list', 'fastly_kv_store:list_wait', 'fastly_http_body:read'];
+  if (kind === 'kv.delete') return [...KV_IMPORTS.filter(key => key !== 'fastly_http_body:close'), 'fastly_kv_store:delete', 'fastly_kv_store:delete_wait'];
+  return [...KV_IMPORTS, ...(kind === 'kv.getVersioned'
+    ? ['fastly_kv_store:lookup', 'fastly_kv_store:lookup_wait_v2', 'fastly_http_body:read']
+    : ['fastly_kv_store:insert', 'fastly_kv_store:insert_wait', 'fastly_http_body:new', 'fastly_http_body:write'])];
+}
+function kvNativeSource(plan) {
+  if (!plan.effects.some(effect => KV_CONDITIONAL_KINDS.includes(effect.kind))) return '';
+  const limits = Object.entries(KV_CONDITIONAL_LIMITS).map(([key, value]) => `const __KV_${key}: i32 = ${value};`).join('\n');
+  const kinds = new Set(plan.effects.map(effect => effect.kind));
+  const selection = `const __KV_HAS_READ: bool = ${kinds.has('kv.getVersioned')};
+const __KV_HAS_WRITE: bool = ${kinds.has('kv.insertIfAbsent') || kinds.has('kv.compareAndSwap')};
+const __KV_HAS_LIST: bool = ${kinds.has('kv.list')};
+const __KV_HAS_DELETE: bool = ${kinds.has('kv.delete')};`;
+  return limits + '\n' + selection + '\n' + fs.readFileSync(path.join(__dirname, 'kv-native.as.ts'), 'utf8');
+}
+module.exports = { KV_CONDITIONAL_KINDS, KV_CONDITIONAL_LIMITS, KV_IMPORTS, kvImports, kvNativeSource };