@pulse-compute/provider-fastly 1.0.0-beta.1 → 1.0.0-beta.11

package/src/build/native-dynamic-backends.as.ts

@@ -0,0 +1,115 @@
+// Provider-owned, request-local dynamic backend policy. No optional timeout or
+// trust overrides: deadlines and certificate validation retain their owners.
+@external("fastly_http_req", "register_dynamic_backend")
+declare function __pulse_dynamic_register(name: usize, nameLength: i32, target: usize, targetLength: i32, mask: u32, config: usize): i32
+const __pulse_dynamic_origins = new Array<string>()
+const __pulse_dynamic_names = new Array<string>()
+let __pulse_dynamic_attempts: i32 = 0
+let __pulse_dynamic_status: i32 = 0
+let __pulse_dynamic_url: string = ""
+export function pulse_fastly_dynamic_backend_status(): i32 { return __pulse_dynamic_status }
+function __pulse_dynamic_clear(): void {
+  __pulse_dynamic_origins.length = 0; __pulse_dynamic_names.length = 0; __pulse_dynamic_url = ""
+}
+function __pulse_dynamic_invalid(index: i32): string {
+  __pulse_fastly_fail(PULSE_ERROR_VALUE, 273, index); return ""
+}
+function __pulse_dynamic_select(index: i32, url: string): string {
+  __pulse_dynamic_url = url
+  const fixed = __pulse_fastly_backend(index)
+  if (fixed.length > 0) return fixed
+  if (!__pulse_dynamic_check(index)) return ""
+  if (url.length > PULSE_FASTLY_BUFFER_BYTES) return __pulse_dynamic_invalid(index)
+  for (let i = 0; i < url.length; i++) {
+    const c = url.charCodeAt(i)
+    if (c <= 32 || c >= 127 || c == 92) return __pulse_dynamic_invalid(index)
+  }
+  const separator = url.indexOf("://")
+  if (separator < 0) return __pulse_dynamic_invalid(index)
+  const scheme = url.substring(0, separator).toLowerCase()
+  const tls = scheme == "https"
+  if (!tls && scheme != "http") return __pulse_dynamic_invalid(index)
+  const start = separator + 3
+  let end = start
+  while (end < url.length && url.charAt(end) != "/" && url.charAt(end) != "?" && url.charAt(end) != "#") end++
+  const authority = url.substring(start, end).toLowerCase()
+  if (authority.length == 0 || authority.length > 1024 || authority.indexOf("@") >= 0) return __pulse_dynamic_invalid(index)
+  const colon = authority.indexOf(":")
+  let hostname = colon < 0 ? authority : authority.substring(0, colon)
+  let port = tls ? 443 : 80
+  if (colon >= 0) {
+    const digits = authority.substring(colon + 1)
+    if (digits.length == 0 || digits.length > 5) return __pulse_dynamic_invalid(index)
+    port = 0
+    for (let i = 0; i < digits.length; i++) {
+      const c = digits.charCodeAt(i)
+      if (c < 48 || c > 57) return __pulse_dynamic_invalid(index)
+      port = port * 10 + c - 48
+    }
+    if (port < 1 || port > 65535) return __pulse_dynamic_invalid(index)
+  }
+  const dns = hostname.endsWith(".") ? hostname.substring(0, hostname.length - 1) : hostname
+  if (dns.length == 0 || dns.length > 253) return __pulse_dynamic_invalid(index)
+  const labels = dns.split(".")
+  let allNumeric = true
+  for (let i = 0; i < labels.length; i++) {
+    const label = unchecked(labels[i])
+    if (label.length == 0 || label.length > 63 || label.startsWith("xn--") || label.startsWith("-") || label.endsWith("-")) return __pulse_dynamic_invalid(index)
+    for (let j = 0; j < label.length; j++) {
+      const c = label.charCodeAt(j)
+      if (!((c >= 97 && c <= 122) || (c >= 48 && c <= 57) || c == 45)) return __pulse_dynamic_invalid(index)
+      if (c < 48 || c > 57) allNumeric = false
+    }
+  }
+  if (allNumeric) {
+    if (tls || hostname != dns || labels.length != 4) return __pulse_dynamic_invalid(index)
+    for (let i = 0; i < 4; i++) {
+      const label = unchecked(labels[i])
+      if (label.length > 3 || (label.length > 1 && label.startsWith("0"))) return __pulse_dynamic_invalid(index)
+      let octet = 0
+      for (let j = 0; j < label.length; j++) octet = octet * 10 + label.charCodeAt(j) - 48
+      if (octet > 255) return __pulse_dynamic_invalid(index)
+    }
+  } else {
+    // WHATWG numeric host aliases must not become a different DNS destination.
+    const last = unchecked(labels[labels.length - 1])
+    let numeric = true
+    for (let i = 0; i < last.length; i++) if (last.charCodeAt(i) < 48 || last.charCodeAt(i) > 57) numeric = false
+    if (numeric || last.startsWith("0x")) return __pulse_dynamic_invalid(index)
+  }
+  const host = hostname + (port == (tls ? 443 : 80) ? "" : ":" + port.toString())
+  const origin = scheme + "://" + host
+  let rest = url.substring(end)
+  const fragment = rest.indexOf("#")
+  if (fragment >= 0) rest = rest.substring(0, fragment)
+  if (!rest.startsWith("/")) rest = "/" + rest
+  __pulse_dynamic_url = origin + rest
+  if (__pulse_dynamic_url.length > PULSE_FASTLY_BUFFER_BYTES) return __pulse_dynamic_invalid(index)
+  const mapped = __pulse_dynamic_static(origin)
+  if (mapped.length > 0) return mapped
+  for (let i = 0; i < __pulse_dynamic_origins.length; i++) {
+    if (unchecked(__pulse_dynamic_origins[i]) == origin) return unchecked(__pulse_dynamic_names[i])
+  }
+  if (__pulse_dynamic_attempts >= 32) {
+    __pulse_fastly_fail(PULSE_ERROR_VALUE, 276, index); return ""
+  }
+  const name = "pulse-native-dynamic-" + (__pulse_dynamic_attempts++).toString()
+  const n = __pulse_fastly_utf8(name), target = __pulse_fastly_utf8(hostname + ":" + port.toString())
+  const h = __pulse_fastly_utf8(host), sni = __pulse_fastly_utf8(hostname)
+  const config = new StaticArray<u32>(27)
+  config[0] = <u32>changetype<usize>(h); config[1] = h.byteLength
+  let mask: u32 = 2
+  if (tls) {
+    mask |= 32 | 256 | 2048
+    config[7] = <u32>changetype<usize>(sni); config[8] = sni.byteLength
+    config[13] = <u32>changetype<usize>(sni); config[14] = sni.byteLength
+  }
+  if (!__pulse_dynamic_check(index)) return ""
+  __pulse_dynamic_status = __pulse_dynamic_register(changetype<usize>(n), n.byteLength, changetype<usize>(target), target.byteLength, mask, changetype<usize>(config))
+  if (!__pulse_dynamic_check(index)) return ""
+  if (__pulse_dynamic_status != 0) {
+    __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, __pulse_dynamic_status == 5 ? 274 : 275, index); return ""
+  }
+  __pulse_dynamic_origins.push(origin); __pulse_dynamic_names.push(name)
+  return name
+}

package/src/build/native-dynamic-backends.js

@@ -0,0 +1,52 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const policy = Object.freeze({
+  optIn: 'bindings.dynamicBackends', maxRegistrationAttempts: 32,
+  identity: 'canonical origin with derived Host/TLS policy; request-local',
+  precedence: 'effect backend, configured canonical origin, dynamic registration',
+  urls: 'absolute ASCII HTTP/HTTPS DNS; canonical IPv4 over HTTP; ports 1–65535; no credentials, IDNA or IPv6',
+  tls: 'platform trust; URL DNS hostname for certificate verification and SNI',
+  hostPrerequisite: 'Fastly Dynamic Backends service capability',
+  stages: Object.freeze({ invalidUrl: 273, unavailable: 274, registrationFailed: 275, attemptsExhausted: 276 })
+});
+function active(bindings) { return (Array.isArray(bindings) ? bindings : bindings.backends || []).some(b => b.dynamic === true); }
+function originMappings(origins) {
+  return Object.fromEntries(Object.entries(origins || {}).filter(([, name]) => typeof name === 'string' && name.trim()).map(([origin, name]) => [origin, name.trim()]).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
+}
+function describe(origins) { return Object.freeze({ ...policy, staticOrigins: Object.freeze(originMappings(origins)) }); }
+function runtimeSource(backends, platform, origins) {
+  if (!active(backends)) return '';
+  const mappings = Object.entries(originMappings(origins));
+  return fs.readFileSync(path.join(__dirname, 'native-dynamic-backends.as.ts'), 'utf8') + '\n'
+    + `function __pulse_dynamic_static(origin: string): string {\n${mappings.map(([origin, name]) => `  if (origin == ${JSON.stringify(origin)}) return ${JSON.stringify(name.trim())}`).join('\n')}\n  return ""\n}\n`
+    + `function __pulse_dynamic_check(index: i32): bool { return ${platform ? '__pulse_fetch_request_check(index) && __pulse_fetch_before_send(index)' : 'true'} }\n`;
+}
+function instrument(source, bindings, platform, origins) {
+  if (!active(bindings)) return source;
+  const replace = (before, after) => {
+    if (!source.includes(before)) throw new Error('Fastly dynamic backend boundary drift: ' + before.slice(0, 100));
+    source = source.replace(before, after);
+  };
+  if (platform) {
+    replace('__pulse_fastly_start_request(effectIndex, url, method, headers, body, __pulse_fastly_backend(effectIndex))',
+      'const backend = __pulse_dynamic_select(effectIndex, url); if (__pulse_fastly_last_error != 0) return; __pulse_fastly_start_request(effectIndex, __pulse_dynamic_url, method, headers, body, backend)');
+  } else {
+    replace('function host_effect_begin(effectIndex: i32, payload: i32): void {',
+      'function host_effect_begin(effectIndex: i32, payload: i32): void { if (__pulse_fastly_last_error != 0) return;');
+    replace('  const requestOut = __pulse_fastly_out_i32(); let status = fastly_http_req_new',
+      '  const backend = __pulse_dynamic_select(effectIndex, url); if (__pulse_fastly_last_error != 0) return;\n  const requestOut = __pulse_fastly_out_i32(); let status = fastly_http_req_new');
+    replace('const urlBytes = __pulse_fastly_utf8(url); status = fastly_http_req_uri_set',
+      'const urlBytes = __pulse_fastly_utf8(__pulse_dynamic_url); status = fastly_http_req_uri_set');
+    replace('const backend = __pulse_fastly_backend(effectIndex); if (backend.length == 0)', 'if (backend.length == 0)');
+  }
+  const entry = source.includes('export function pulse_fastly_handle(): void {') ? 'pulse_fastly_handle' : '_start';
+  replace(`export function ${entry}(): void {`, 'function __pulse_dynamic_start(): void {');
+  return source + '\n' + runtimeSource(bindings, platform, origins) + `\nexport function ${entry}(): void {
+  __pulse_dynamic_clear(); __pulse_dynamic_attempts = 0; __pulse_dynamic_status = 0
+  __pulse_dynamic_start()
+  __pulse_dynamic_clear()
+}\n`;
+}
+module.exports = { active, policy, describe, instrument };

package/src/build/native-fetch-accounting.as.ts

@@ -0,0 +1,133 @@
+// Fixed one-cohort adapter. The existing effect owner and scheduler retain all
+// dispatch/completion authority. Claims and retained text are never recycled.
+let __fetch_ra: PulseResourceLedger | null = null;
+let __fca_origin:i64 = 0;
+let __fca_clock_failed:bool = false;
+let __fca_reaped:bool = false;
+const __fca_io:usize = memory.data(32);
+const __fca_exit:usize = memory.data(64);
+function __fca_ns(slot:i32):u32 { return slot == 0 ? 1 : slot == 2 ? 4 : slot == 3 || slot == 5 ? 2 : 3; }
+function __fca_now():u64 {
+  if (__fca_clock_failed) return PRL_SAFE + 1;
+  const now = __request_clock();
+  if (now < __fca_origin || __request_expired) { __fca_clock_failed = true; return PRL_SAFE + 1; }
+  if (now >= __request_deadline) __request_expired = true;
+  return u64(now - __fca_origin);
+}
+function __fca_work():bool { return __fca_ok(__fca_now() < __FCA_DURATION); }
+function __fca_ok(ok:bool):bool {
+  if (!ok) __pulse_fastly_fail(PULSE_ERROR_HOSTCALL,272,0);
+  return ok;
+}
+function __fca_start():bool {
+  if (__fetch_ra !== null || __request_deadline < 0 || __request_last_clock < 0
+    || __pulse_invocation_count != 1 || __pulse_invocation_tickets[0] != 1) return __fca_ok(false);
+  __fca_origin = __request_deadline - i64(__FCA_DURATION);
+  const l = new PulseResourceLedger(1,__FCA_RECORDS,7,__FCA_BACKING,7,1,__FCA_DURATION,__FCA_STORAGE);
+  __fetch_ra = l;
+  if (!l.begin(1,__fca_now(),5,2,1,true)) return __fca_ok(false);
+  for (let i=0;i<7;i++) if (!l.stageRecord(1,1,__fca_ns(i),1,i>=5?3:1,0)) return __fca_ok(false);
+  if (!l.stageRecord(1,2,0,1,1,100) || !l.stageRecord(1,2,0,1,1,__FCA_ENCODING)
+    || !l.stageRecord(1,2,0,1,1,__FCA_READER) || !l.stageRecord(1,2,0,1,3,64)
+    || !l.stageRecord(1,3,0,1,1,0)
+    /*FCA_HEADER_STAGE*/ || !l.commit(1,__fca_now())) return __fca_ok(false);
+  for (let i=0;i<__FCA_RECORDS;i++) if (l.reservedSlot(i)!=i || l.reservedGeneration(i)!=1) return __fca_ok(false);
+  return __fca_ok(l.consume(1,7,1,1,100,false,__fca_now())
+    && l.consume(1,8,1,1,__FCA_ENCODING,false,__fca_now())
+    && l.consume(1,9,1,1,__FCA_READER,false,__fca_now())
+    /*FCA_HEADER_CONSUME*/);
+}
+function __fca_acquire(slot:i32):bool {
+  return __fetch_ra !== null && __fca_ok(__fetch_ra!.beginAcquire(1,slot,1,__fca_ns(slot),1,slot>=5,__fca_now()));
+}
+function __fca_acquired(slot:i32,status:i32,handle:i32):i32 {
+  const l=__fetch_ra!;
+  if(status==0) __fca_ok(l.acquired(1,slot,1,__fca_ns(slot),1,u32(handle)));
+  else l.noAcquisition(1,slot,1,__fca_ns(slot),1,false);
+  return status;
+}
+function __fca_new(slot:i32,out:usize):i32 {
+  if(!__fca_acquire(slot)) return 1;
+  const ns=__fca_ns(slot);
+  const status=ns==1?fastly_http_req_new(out):ns==2?fastly_http_resp_new(out):fastly_http_body_new(out);
+  return __fca_acquired(slot,status,load<i32>(out));
+}
+function __fca_dispose(slot:i32):i32 {
+  if(__fetch_ra===null) return 1;
+  const l=__fetch_ra!,ns=__fca_ns(slot);
+  if(l.bank[slot*8+5]!=PRL_LIVE || !l.beginDispose(1,slot,1,ns,1,__fca_now())) return 1;
+  const handle=i32(l.bank[slot*8+6]);
+  const status=ns==1?__pulse_fetch_close_request(handle):ns==2?__pulse_fetch_close_response(handle):__pulse_fetch_close_body(handle);
+  l.disposed(1,slot,1,ns,1,status==0); return status;
+}
+function __fca_dispatch(request:i32,body:i32,backend:usize,length:i32,out:usize):i32 {
+  if(!__fca_acquire(2)||!__fca_acquire(3)||!__fca_acquire(4)) return 1;
+  const l=__fetch_ra!;
+  if(!l.beginDispose(1,0,1,1,1,__fca_now())||!l.beginDispose(1,1,1,3,1,__fca_now())) return 1;
+  const status=fastly_http_req_send_async(request,body,backend,length,out);
+  l.disposed(1,0,1,1,1,status==0); l.disposed(1,1,1,3,1,status==0);
+  return __fca_acquired(2,status,load<i32>(out));
+}
+function __fca_poll(handle:i32,detail:usize,done:usize,response:usize,body:usize):i32 {
+  const l=__fetch_ra!;
+  if(l.bank[2*8+5]!=PRL_LIVE || __fca_now()>=__FCA_DURATION) return 1;
+  const status=__pulse_fetch_poll(handle,detail,done,response,body), ready=load<i32>(done);
+  if(status!=0 || (ready!=0 && ready!=1)) {
+    l.uncertain(1,2,1,4,1); l.noAcquisition(1,3,1,2,1,false); l.noAcquisition(1,4,1,3,1,false);
+    return status==0?2:status;
+  }
+  if(ready==1) {
+    l.transferred(1,2,1,4,1);
+    __fca_acquired(3,0,load<i32>(response)); __fca_acquired(4,0,load<i32>(body));
+  }
+  return 0;
+}
+function __fca_cleanup(final:bool=false):void {
+  if(__fetch_ra===null) return;
+  const l=__fetch_ra!;
+  l.close(1);
+  if(!__fca_reaped && l.bank[2*8+5]==PRL_LIVE) {
+    __fca_reaped=true;
+    if(l.cleanupStep(1,false,__fca_now())) {
+      __pulse_send_error_detail_reset(__fca_io); store<i32>(__fca_io+20,0);
+      __fca_poll(i32(l.bank[2*8+6]),__fca_io,__fca_io+20,__fca_io+24,__fca_io+28);
+    }
+  }
+  for(let i=0;i<7;i++) {
+    const state=l.bank[i*8+5];
+    if(state==PRL_RESERVED && (i<5||final)) l.unused(1,i,1,__fca_ns(i),1);
+    else if(state==PRL_LIVE && i!=2) __fca_dispose(i);
+  }
+}
+function __fca_error():bool {
+  if(__fetch_ra===null) return false;
+  const l=__fetch_ra!;
+  // Capture the primary driver failure before cleanup or protected delivery.
+  const status=__request_expired || __pulse_fastly_error_stage==271 ? 504
+    : __pulse_fastly_last_error==PULSE_ERROR_TRANSPORT ? 502 : 500;
+  if(l.primary==0) l.fail(1,u32(status));
+  __fca_cleanup();
+  if(!__pulse_response_owned() || !l.consume(1,10,1,1,64,true,__fca_now())) return true;
+  if(__fca_new(5,__fca_io+24)!=0) return true;
+  const response=load<i32>(__fca_io+24);
+  if(__fca_new(6,__fca_io+28)!=0) return true;
+  const body=load<i32>(__fca_io+28);
+  if(__fca_now()>=__FCA_DURATION || fastly_http_resp_status_set(response,status)!=0) return true;
+  const header='content-typetext/plain; charset=utf-8';
+  for(let i=0;i<header.length;i++) store<u8>(__fca_exit+i,u8(header.charCodeAt(i)));
+  if(__fca_now()>=__FCA_DURATION || fastly_http_resp_header_append(response,__fca_exit,12,__fca_exit+12,header.length-12)!=0) return true;
+  const text=status==504?'Gateway Timeout':status==502?'Bad Gateway':'Internal Server Error';
+  for(let i=0;i<text.length;i++) store<u8>(__fca_exit+i,u8(text.charCodeAt(i)));
+  let offset=0;
+  while(offset<text.length) {
+    if(__fca_now()>=__FCA_DURATION) return true;
+    const result=fastly_http_body_write(body,__fca_exit+offset,text.length-offset,0,__fca_io+20);
+    const written=load<i32>(__fca_io+20);
+    if(result!=0 || written<=0 || written>text.length-offset) return true;
+    offset+=written;
+  }
+  if(!l.beginDispose(1,5,1,2,1,__fca_now()) || !l.beginDispose(1,6,1,3,1,__fca_now())) return true;
+  const sent=fastly_http_resp_send_downstream(response,body,0);
+  l.disposed(1,5,1,2,1,sent==0); l.disposed(1,6,1,3,1,sent==0);
+  return true;
+}

package/src/build/native-fetch-accounting.js

@@ -0,0 +1,84 @@
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const {resourceAdmission: admission} = require('@pulse-compute/wasm-contracts/provider/toolchain');
+const {resourceLedgerSource} = require('@pulse-compute/wasm-runtime-core-as/compiler/canonical-native');
+const fixed = (id, bytes) => ({id, kind: 'fixed', bytes, copies: 1});
+function profile(plan, bindings, headerBufferBytes) {
+  // Prove one visit and one decode from the canonical control tree, not merely
+  // the number of static effect sites. No authored accounting configuration.
+  const body = plan.entry?.body, effect = plan.effects[0];
+  const decoder = effect?.decoder;
+  if (plan.entry?.kind !== 'handler' || plan.handlers.length || plan.routing || plan.packages?.application
+    || plan.effects.length !== 1 || effect.kind !== 'fetch' || effect.grouped || !['text','json'].includes(decoder)
+    || body?.length !== 2 || body[0].kind !== 'effect' || body[0].effectId !== effect.id
+    || body[1].kind !== 'return' || body[1].value?.name !== 'response.' + decoder
+    || body[1].value.arguments.length !== 1 || body[1].value.arguments[0].kind !== 'local'
+    || body[1].value.arguments[0].id !== effect.result?.localId) return null;
+  const init = effect.inputs.find(x => x.name === 'init')?.value;
+  const url = effect.inputs.find(x => x.name === 'url')?.value;
+  const uniqueKeys = object => object?.kind === 'object'
+    && object.entries.every(x => x.kind === 'property' && x.key?.kind === 'literal' && typeof x.key.value === 'string')
+    && new Set(object.entries.map(x => x.key.value)).size === object.entries.length;
+  const field = name => init?.entries?.find(x => x.key?.value === name)?.value;
+  const timeout = field('timeoutMs'), headers = field('headers');
+  const backend = bindings.backends.find(x => x.index === 0)?.backend;
+  const bound = plan.schemas?.registry?.maxBytes;
+  if (url?.kind !== 'literal' || typeof url.value !== 'string' || !uniqueKeys(init)
+    || init.entries.some(x => !['timeoutMs','headers'].includes(x.key?.value))
+    || timeout?.kind !== 'literal' || !Number.isSafeInteger(timeout.value) || timeout.value <= 0
+    || (headers && (!uniqueKeys(headers) || headers.entries.some(x => x.key?.kind !== 'literal'
+      || typeof x.key.value !== 'string' || x.value?.kind !== 'literal' || typeof x.value.value !== 'string')))
+    || typeof backend !== 'string' || !backend || bindings.dynamicBackends
+    || !Number.isInteger(bindings.maxDurationMs) || bindings.maxDurationMs < 1 || bindings.maxDurationMs > 30000
+    || !Number.isInteger(bound) || bound <= 0 || bound > 1073741823) return null;
+  const realization = `fastly.native.fetch-${decoder}.single-v1`;
+  const requireJson = decoder === 'json' && plan.schemas.registry.contentTypePolicy === 'require-json';
+  // The header reader owns C bytes, key encoding and ABI outputs. AS 0.28.18
+  // decodeUnsafe allocates 2N bytes; toLowerCase allocates 4N before shrinking.
+  // The first value has N <= C-1 bytes because the list is NUL-terminated.
+  if (requireJson && (!Number.isInteger(headerBufferBytes) || headerBufferBytes < 1
+    || headerBufferBytes > 2147483647)) throw new TypeError('Unproved JSON header backing');
+  const headerBytes = requireJson ? 7 * headerBufferBytes + 18 : 0;
+  const encodingBytes = 3 + Buffer.byteLength(url.value) + Buffer.byteLength(backend)
+    + (headers?.entries || []).reduce((n,h) => n + Buffer.byteLength(h.key.value) + Buffer.byteLength(h.value.value), 0);
+  // 12 request outputs + 40 scheduler outputs + 8 clock + 8 reused body-wait
+  // outputs + 32 cleanup/exit outputs. Reader payload backing is 3B+5.
+  const scratchBytes = 100, readerBytes = 3 * bound + 5;
+  const work = {handles:[{namespace:'http.request',count:1},{namespace:'http.body',count:2},
+    {namespace:'http.pending',count:1},{namespace:'http.response',count:1}],
+    allocations:[fixed('scratch',scratchBytes),fixed('encoding',encodingBytes),fixed('reader',readerBytes),
+      ...(requireJson ? [fixed('json-content-type',headerBytes)] : [])],records:1,cleanupSteps:0};
+  const cleanup = {handles:[],allocations:[],records:0,cleanupSteps:5};
+  const exit = {handles:[{namespace:'http.response',count:1},{namespace:'http.body',count:1}],
+    allocations:[fixed('error-text',64)],records:0,cleanupSteps:2};
+  const required = {handles:7,backingBytes:scratchBytes+encodingBytes+readerBytes+headerBytes+64,records:12+(requireJson?1:0),cleanupSteps:7,effects:1};
+  const result = admission.createPlan({version:admission.VERSION,realization,
+    selected:[{site:effect.id,count:1,profile:{version:admission.PROFILE_VERSION,owner:'provider-fastly',
+      operation:'single-fetch-'+decoder,realization,effects:1,work,cleanup,
+      exclusions:['incoming-request-context','application-values','diagnostic-storage','driver-identity-storage','successful-downstream-response','allocator-metadata',
+        ...(decoder === 'json' ? ['json-parser-and-schema-materialization'] : [])]}}],
+    exit,occupied:Object.fromEntries(admission.DIMENSIONS.map(k=>[k,0])),limits:required});
+  if (!result.admitted || Object.keys(required).some(k => result.required[k] !== required[k])) throw new Error('Fetch resource inventory drift');
+  return Object.freeze({...result,encodingBytes,readerBytes,scratchBytes,headerBytes,storageBytes:1024+128*required.records,
+    ...(requireJson ? {headerAdmission:{bufferBytes:headerBufferBytes,backingBytes:headerBytes}} : {}),
+    durationNs:bindings.maxDurationMs*1000000,selection:'canonical-single-get-'+decoder,
+    executionIdentity:'private-single-invocation-wasm-instance',
+    unprofiled:'other-fetch-shapes-repetition-groups-dynamic-inputs-and-javascript'});
+}
+function hooks(selected) {
+  if (!selected) return [];
+  const owner = 'fetch-accounting', order = 20;
+  return [
+    {point:'response.error',owner,order,body:'  return __fca_error()'},
+    {point:'invocation.end',owner,order,body:'  __fca_cleanup(true)'}
+  ];
+}
+function source(selected) {
+  if (!selected) return '';
+  return resourceLedgerSource(true) + `\nconst __FCA_RECORDS:i32=${selected.required.records};\nconst __FCA_STORAGE:u32=${selected.storageBytes};\nconst __FCA_HEADER:u64=${selected.headerBytes};\nconst __FCA_BACKING:u64=${selected.required.backingBytes};\nconst __FCA_ENCODING:u64=${selected.encodingBytes};\nconst __FCA_READER:u64=${selected.readerBytes};\nconst __FCA_DURATION:u64=${selected.durationNs};\n`
+    + fs.readFileSync(path.join(__dirname,'native-fetch-accounting.as.ts'),'utf8')
+      .replace('/*FCA_HEADER_STAGE*/', selected.headerBytes ? '|| !l.stageRecord(1,2,0,1,1,__FCA_HEADER)' : '')
+      .replace('/*FCA_HEADER_CONSUME*/', selected.headerBytes ? '&& l.consume(1,12,1,1,__FCA_HEADER,false,__fca_now())' : '');
+}
+module.exports = {profile,hooks,source};

package/src/build/native-fetch-bounds.js

@@ -0,0 +1,47 @@
+'use strict';
+// Provider-local proof over canonical values. Unknown is not a zero allowance.
+// Input materialization remains with the existing value/schema owners; this
+// proves the strings and serializer copies consumed by the fetch service.
+function create(plan,C,B){
+  const locals=new Map(),effects=new Map();let mutable=false;
+  const walk=(v,fn)=>{if(!v||typeof v!=='object')return;if(Array.isArray(v)){v.forEach(x=>walk(x,fn));return;}fn(v);Object.values(v).forEach(x=>walk(x,fn));};
+  walk(plan.entry,scan);walk(plan.handlers,scan);walk(plan.helpers,scan);walk(plan.stages,scan);
+  function scan(v){if(v.kind==='local'&&v.declaration==='const'&&v.value)locals.set(v.localId,v.value);if(/assign|update/.test(v.kind||'')||v.kind==='method-call'&&['push','pop','shift','unshift','splice'].includes(v.method))mutable=true;}
+  for(const e of plan.effects)if(e.kind==='fetch'&&e.result?.localId&&e.result.valueKind!=='fetch-response'&&e.decoder==='text')effects.set(e.result.localId,{chars:B,bytes:3*B});
+  function string(v,seen=new Set()){
+    if(!v)return null;
+    if(v.kind==='literal'&&typeof v.value==='string')return{chars:v.value.length,bytes:Buffer.byteLength(v.value)};
+    if(v.kind==='local'){
+      if(mutable)return null;
+      if(effects.has(v.id))return effects.get(v.id);
+      if(seen.has(v.id))return null;seen=new Set(seen);seen.add(v.id);return string(locals.get(v.id),seen);
+    }
+    if(v.kind==='context-read'&&v.path?.[0]==='req'&&['method','url','path'].includes(v.path[1]))return{chars:C,bytes:3*C};
+    if(v.kind==='intrinsic'&&v.name==='request.header')return{chars:C,bytes:3*C};
+    if(v.kind==='intrinsic'&&v.name==='request.text')return{chars:B,bytes:3*B};
+    if(v.kind==='method-call'&&v.receiver?.valueKind==='fetch-response'&&v.method==='text')return{chars:B,bytes:3*B};
+    if(v.kind==='binary'&&['+','||','??'].includes(v.operator)){
+      const a=string(v.left,seen),b=string(v.right,seen);if(!a||!b)return null;
+      return v.operator==='+'?{chars:a.chars+b.chars,bytes:a.bytes+b.bytes}:{chars:Math.max(a.chars,b.chars),bytes:Math.max(a.bytes,b.bytes)};
+    }
+    return null;
+  }
+  function json(v,seen=new Set()){
+    if(!v)return null;
+    if(v.kind==='local'){
+      if(mutable||seen.has(v.id))return null;seen=new Set(seen);seen.add(v.id);return json(locals.get(v.id),seen);
+    }
+    const s=string(v,seen);if(s)return{chars:6*s.chars+2,nodes:1,numbers:0};
+    if(v.kind==='literal'&&(v.value===null||typeof v.value==='boolean'))return{chars:5,nodes:1,numbers:0};
+    if(v.kind==='literal'&&typeof v.value==='number')return{chars:32,nodes:1,numbers:1};
+    let children;
+    if(v.kind==='array')children=v.items;
+    else if(v.kind==='object'&&v.entries.every(e=>e.kind==='property'&&e.key?.kind==='literal'&&typeof e.key.value==='string'))children=v.entries.flatMap(e=>[e.key,e.value]);
+    else return null;
+    if(!Array.isArray(children))return null;
+    const parts=children.map(x=>json(x,seen));if(parts.some(x=>!x))return null;
+    return parts.reduce((a,b)=>({chars:a.chars+b.chars+1,nodes:a.nodes+b.nodes,numbers:a.numbers+b.numbers}),{chars:2,nodes:1,numbers:0});
+  }
+  return{string,json};
+}
+module.exports={create};

package/src/build/native-fetch-cohorts.as.ts

@@ -0,0 +1,126 @@
+// One immutable invocation partition per existing driver ticket. No recycling,
+// second effect counter, or scheduling authority is introduced here.
+let __fetch_ra:PulseResourceLedger|null=null;
+let __fca_origin:i64=0;
+let __fca_clock_failed:bool=false;
+let __fca_frame:i32=0;
+const __fca_reaped=new StaticArray<bool>(__FCA_COUNT);
+const __fca_io:usize=memory.data(32);
+const __fca_exit:usize=memory.data(64);
+function __fca_slot(local:i32):i32{return local>=5?__FCA_HANDLES-2+local-5:__fca_frame*5+local;}
+function __fca_ns(slot:i32):u32{return slot==__FCA_HANDLES-2?2:slot==__FCA_HANDLES-1?3:slot%5==0?1:slot%5==2?4:slot%5==3?2:3;}
+function __fca_now():u64{
+  if(__fca_clock_failed)return PRL_SAFE+1;
+  const now=__request_clock();
+  if(now<__fca_origin||__request_expired){__fca_clock_failed=true;return PRL_SAFE+1;}
+  if(now>=__request_deadline)__request_expired=true;
+  return u64(now-__fca_origin);
+}
+function __fca_ok(ok:bool):bool{if(!ok)__pulse_fastly_fail(PULSE_ERROR_HOSTCALL,272,-1);return ok;}
+function __fca_work():bool{return __fca_ok(__fca_now()<__FCA_DURATION);}
+function __fca_start(index:i32):bool{
+  const ticket=__pulse_invocation_tickets[index];
+  if(ticket<=0||ticket>__FCA_COUNT||ticket!=__pulse_invocation_count)return __fca_ok(false);
+  __fca_frame=ticket-1;
+  if(__fetch_ra!==null)return __fca_work();
+  if(__request_deadline<0||__request_last_clock<0)return __fca_ok(false);
+  __fca_origin=__request_deadline-i64(__FCA_DURATION);
+  const l=new PulseResourceLedger(1,__FCA_RECORDS,__FCA_HANDLES,__FCA_BACKING,5*__FCA_COUNT+2,__FCA_COUNT,__FCA_DURATION,__FCA_STORAGE);__fetch_ra=l;
+  if(!l.begin(1,__fca_now(),5*__FCA_COUNT,2,__FCA_COUNT,true))return __fca_ok(false);
+  for(let i=0;i<__FCA_HANDLES;i++)if(!l.stageRecord(1,1,__fca_ns(i),1,i>=__FCA_HANDLES-2?3:1,0))return __fca_ok(false);
+  if(!l.stageRecord(1,2,0,1,1,__FCA_SCRATCH)||!l.stageRecord(1,2,0,1,1,__FCA_ENCODING)||!l.stageRecord(1,2,0,1,1,__FCA_READER)||!l.stageRecord(1,2,0,1,3,64)||!l.stageRecord(1,3,0,1,1,0)||!l.commit(1,__fca_now()))return __fca_ok(false);
+  for(let i=0;i<__FCA_RECORDS;i++)if(l.reservedSlot(i)!=i||l.reservedGeneration(i)!=1)return __fca_ok(false);
+  return __fca_ok(l.consume(1,__FCA_HANDLES,1,1,__FCA_SCRATCH,false,__fca_now())&&l.consume(1,__FCA_HANDLES+1,1,1,__FCA_ENCODING,false,__fca_now())&&l.consume(1,__FCA_HANDLES+2,1,1,__FCA_READER,false,__fca_now()));
+}
+function __fca_acquire(local:i32):bool{const s=__fca_slot(local);return __fetch_ra!==null&&__fca_ok(__fetch_ra!.beginAcquire(1,s,1,__fca_ns(s),1,local>=5,__fca_now()));}
+function __fca_acquired(local:i32,status:i32,handle:i32):i32{const l=__fetch_ra!,s=__fca_slot(local);if(status==0)__fca_ok(l.acquired(1,s,1,__fca_ns(s),1,u32(handle)));else l.noAcquisition(1,s,1,__fca_ns(s),1,false);return status;}
+function __fca_new(local:i32,out:usize):i32{if(!__fca_acquire(local))return 1;const ns=__fca_ns(__fca_slot(local));return __fca_acquired(local,ns==1?fastly_http_req_new(out):ns==2?fastly_http_resp_new(out):fastly_http_body_new(out),load<i32>(out));}
+function __fca_dispose_slot(s:i32):i32{
+  if(__fetch_ra===null)return 1;const l=__fetch_ra!,ns=__fca_ns(s);
+  if(l.bank[s*8+5]!=PRL_LIVE||!l.beginDispose(1,s,1,ns,1,__fca_now()))return 1;
+  const h=i32(l.bank[s*8+6]);const status=ns==1?__pulse_fetch_close_request(h):ns==2?__pulse_fetch_close_response(h):__pulse_fetch_close_body(h);l.disposed(1,s,1,ns,1,status==0);return status;
+}
+function __fca_dispose(local:i32):i32{return __fca_dispose_slot(__fca_slot(local));}
+function __fca_dispatch(request:i32,body:i32,backend:usize,length:i32,out:usize):i32{
+  if(!__fca_acquire(2)||!__fca_acquire(3)||!__fca_acquire(4))return 1;
+  const l=__fetch_ra!,b=__fca_frame*5;
+  if(!l.beginDispose(1,b,1,1,1,__fca_now())||!l.beginDispose(1,b+1,1,3,1,__fca_now()))return 1;
+  const status=fastly_http_req_send_async(request,body,backend,length,out);
+  l.disposed(1,b,1,1,1,status==0);l.disposed(1,b+1,1,3,1,status==0);return __fca_acquired(2,status,load<i32>(out));
+}
+function __fca_find(handle:i32,local:i32):bool{
+  if(__fetch_ra===null)return false;const l=__fetch_ra!;
+  for(let i=0;i<__FCA_COUNT;i++){const s=(i*5+local)*8;if(l.bank[s+5]==PRL_LIVE&&l.bank[s+6]==u32(handle)){__fca_frame=i;return true;}}
+  return false;
+}
+function __fca_poll(handle:i32,detail:usize,done:usize,response:usize,body:usize):i32{
+  if(!__fca_find(handle,2)||__fca_now()>=__FCA_DURATION)return 1;
+  const l=__fetch_ra!,b=__fca_frame*5;
+  const status=__pulse_fetch_poll(handle,detail,done,response,body),ready=load<i32>(done);
+  if(status!=0||(ready!=0&&ready!=1)){l.uncertain(1,b+2,1,4,1);l.noAcquisition(1,b+3,1,2,1,false);l.noAcquisition(1,b+4,1,3,1,false);return status==0?2:status;}
+  if(ready==1){l.transferred(1,b+2,1,4,1);__fca_acquired(3,0,load<i32>(response));__fca_acquired(4,0,load<i32>(body));}return 0;
+}
+function __fca_unreaped():i32{if(__fetch_ra===null)return 0;let n=0;for(let i=0;i<__FCA_COUNT;i++){const s=__fetch_ra!.bank[(i*5+2)*8+5];if(s!=PRL_FREE&&s!=PRL_RESERVED)n++;}return n;}
+function __fca_cleanup(final:bool=false):void{
+  if(__fetch_ra===null)return;const l=__fetch_ra!;l.close(1);
+  for(let i=0;i<__FCA_COUNT;i++)if(!__fca_reaped[i]&&l.bank[(i*5+2)*8+5]==PRL_LIVE){__fca_reaped[i]=true;if(l.cleanupStep(1,false,__fca_now())){__pulse_send_error_detail_reset(__fca_io);store<i32>(__fca_io+20,0);__fca_poll(i32(l.bank[(i*5+2)*8+6]),__fca_io,__fca_io+20,__fca_io+24,__fca_io+28);}}
+  for(let s=0;s<__FCA_HANDLES;s++){const state=l.bank[s*8+5];if(state==PRL_RESERVED&&(s<__FCA_HANDLES-2||final))l.unused(1,s,1,__fca_ns(s),1);else if(state==PRL_LIVE&&__fca_ns(s)!=4)__fca_dispose_slot(s);}
+}
+function __fca_transfer(response:i32,body:i32):i32{
+  if(!__fca_find(response,3)||!__fca_work())return 1;
+  const l=__fetch_ra!,b=__fca_frame*5;
+  if(l.bank[(b+4)*8+6]!=u32(body)||!l.beginDispose(1,b+3,1,2,1,__fca_now())||!l.beginDispose(1,b+4,1,3,1,__fca_now()))return 1;
+  const status=fastly_http_resp_send_downstream(response,body,0);l.disposed(1,b+3,1,2,1,status==0);l.disposed(1,b+4,1,3,1,status==0);return status;
+}
+function __fca_write(body:i32,value:string):i32{
+  const bytes=__pulse_fastly_utf8(value);let offset=0;
+  while(offset<bytes.byteLength){if(!__fca_work())return 1;store<i32>(__fca_io+20,0);const status=fastly_http_body_write(body,changetype<usize>(bytes)+offset,bytes.byteLength-offset,0,__fca_io+20),n=load<i32>(__fca_io+20);if(status!=0)return status;if(n<=0||n>bytes.byteLength-offset)return 1;offset+=n;}return 0;
+}
+class __FCA_Header{ name:string;value:string|null;constructor(name:string,value:string|null){this.name=name;this.value=value;} }
+function __fca_header(response:__PulseFastlyValue,name:string):string|null{
+  if(response.fetchHeaders===null)response.fetchHeaders=new Array<__FCA_Header>();
+  for(let i=0;i<response.fetchHeaders!.length;i++){const h=response.fetchHeaders![i];if(h.name==name)return h.value;}
+  if(__fca_header_id(name)<0||!__fca_find(response.responseHandle,3)||!__fca_work()){__fca_ok(false);return null;}
+  const value=__pulse_header_lookup(response.responseHandle,name,true);response.fetchHeaders!.push(new __FCA_Header(name,value));return value;
+}
+function __fca_json_type(response:__PulseFastlyValue):bool{
+  if(response.fetchJsonType==0){const value=__fca_header(response,'content-type');response.fetchJsonType=value!==null&&value!.length>0&&value!.toLowerCase().indexOf('json')>=0?1:-1;}
+  return response.fetchJsonType==1;
+}
+function __fca_status(response:__PulseFastlyValue):i32{
+  if(!__fca_find(response.responseHandle,3)||!__fca_work())return 0;
+  if(fastly_http_resp_status_get(response.responseHandle,__fca_io+20)!=0){__pulse_fastly_fail(PULSE_ERROR_HOSTCALL,34,-1);return 0;}
+  return host_value_number(load<i32>(__fca_io+20));
+}
+function __fca_error():bool {
+  if(__fetch_ra===null) return false;
+  const l=__fetch_ra!;
+  // Capture the primary driver failure before cleanup or protected delivery.
+  const status=__request_expired || __pulse_fastly_error_stage==271 ? 504
+    : __pulse_fastly_last_error==PULSE_ERROR_TRANSPORT ? 502 : 500;
+  if(l.primary==0) l.fail(1,u32(status));
+  __fca_cleanup();
+  if(!__pulse_response_owned() || !l.consume(1,__FCA_HANDLES+3,1,1,64,true,__fca_now())) return true;
+  if(__fca_new(5,__fca_io+24)!=0) return true;
+  const response=load<i32>(__fca_io+24);
+  if(__fca_new(6,__fca_io+28)!=0) return true;
+  const body=load<i32>(__fca_io+28);
+  if(__fca_now()>=__FCA_DURATION || fastly_http_resp_status_set(response,status)!=0) return true;
+  const header='content-typetext/plain; charset=utf-8';
+  for(let i=0;i<header.length;i++) store<u8>(__fca_exit+i,u8(header.charCodeAt(i)));
+  if(__fca_now()>=__FCA_DURATION || fastly_http_resp_header_append(response,__fca_exit,12,__fca_exit+12,header.length-12)!=0) return true;
+  const text=status==504?'Gateway Timeout':status==502?'Bad Gateway':'Internal Server Error';
+  for(let i=0;i<text.length;i++) store<u8>(__fca_exit+i,u8(text.charCodeAt(i)));
+  let offset=0;
+  while(offset<text.length) {
+    if(__fca_now()>=__FCA_DURATION) return true;
+    const result=fastly_http_body_write(body,__fca_exit+offset,text.length-offset,0,__fca_io+20);
+    const written=load<i32>(__fca_io+20);
+    if(result!=0 || written<=0 || written>text.length-offset) return true;
+    offset+=written;
+  }
+  if(!l.beginDispose(1,__FCA_HANDLES-2,1,2,1,__fca_now()) || !l.beginDispose(1,__FCA_HANDLES-1,1,3,1,__fca_now())) return true;
+  const sent=fastly_http_resp_send_downstream(response,body,0);
+  l.disposed(1,__FCA_HANDLES-2,1,2,1,sent==0); l.disposed(1,__FCA_HANDLES-1,1,3,1,sent==0);
+  return true;
+}

package/src/build/native-fetch-cohorts.js

@@ -0,0 +1,65 @@
+'use strict';
+const fs=require('node:fs'),path=require('node:path');
+const {resourceAdmission:admission}=require('@pulse-compute/wasm-contracts/provider/toolchain');
+const {resourceLedgerSource}=require('@pulse-compute/wasm-runtime-core-as/compiler/canonical-native');
+const {CANONICAL_EFFECT_INVOCATION_POLICY:policy}=require('@pulse-compute/wasm-contracts/handler/canonical-runtime');
+function profile(plan,bindings,C){
+  if(!plan.effects.length || plan.effects.some(e=>e.kind!=='fetch') || plan.capabilities.includes('request.body.forward')
+    || plan.packages?.application || plan.callables?.length || plan.routing?.entries?.some(e=>e.kind==='error') || bindings.dynamicBackends
+    || !Number.isInteger(bindings.maxDurationMs)||bindings.maxDurationMs<1||bindings.maxDurationMs>30000)return null;
+  const B=plan.schemas?.registry?.maxBytes;
+  if(!Number.isInteger(B)||B<1||B>1073741823||!Number.isInteger(C)||C<9||C>1073741823)return null;
+  const fields=o=>o?.kind==='object'&&o.entries.every(e=>e.kind==='property'&&e.key?.kind==='literal'&&typeof e.key.value==='string')&&new Set(o.entries.map(e=>e.key.value)).size===o.entries.length?new Map(o.entries.map(e=>[e.key.value,e.value])):null;
+  const proof=require('./native-fetch-bounds.js').create(plan,C,B);
+  let encoding=0,caseBytes=0;
+  const literal=value=>({kind:'literal',value});
+  for(let i=0;i<plan.effects.length;i++){
+    const e=plan.effects[i],url=e.inputs.find(x=>x.name==='url')?.value,init=e.inputs.find(x=>x.name==='init')?.value;
+    const f=init&&init.kind!=='undefined'?fields(init):new Map(),backend=bindings.backends.find(b=>b.index===i)?.backend;
+    if(!f||[...f.keys()].some(k=>!['method','body','json','headers','timeoutMs'].includes(k))||!backend)return null;
+    const u=proof.string(url),method=proof.string(f.get('method')||literal('GET'));
+    if(!u||!method)return null;
+    const headers=f.has('headers')?fields(f.get('headers')):new Map();if(!headers)return null;
+    const values=[...headers.values()].map(v=>proof.string(v));if(values.some(v=>!v))return null;
+    const timeout=f.get('timeoutMs');if(timeout&&(timeout.kind!=='literal'||!Number.isSafeInteger(timeout.value)||timeout.value<=0))return null;
+    let body=proof.string(f.get('body')||literal('')),materialization=f.has('body')&&f.get('body').kind!=='literal'?128:0,extraHeader=0;
+    const json=f.has('body')&&!body?f.get('body'):!f.has('body')&&f.has('json')?f.get('json'):null;
+    if(json){const j=proof.json(json);if(!j)return null;body={chars:j.chars,bytes:3*j.chars};
+      // Quote buffers + quoted strings + final join, geometric parts-array
+      // growth, and a conservative pinned numeric formatter allowance.
+      materialization=8*j.chars+128*j.nodes+128+1024*j.numbers;
+      if(f.has('json')){extraHeader=Buffer.byteLength('content-typeapplication/json; charset=utf-8');materialization+=[...headers.keys()].reduce((n,k)=>n+4*k.length,0);}
+    }
+    if(!body)return null;
+    encoding=Math.max(encoding,u.bytes+Buffer.byteLength(backend)+(f.has('method')?9*method.chars:3)+body.bytes+extraHeader+[...headers.keys()].reduce((n,k)=>n+Buffer.byteLength(k),0)+values.reduce((n,v)=>n+v.bytes,0));
+    caseBytes=Math.max(caseBytes,(f.has('method')?6*method.chars:0)+materialization);
+  }
+  const headerNames=new Set(plan.schemas.registry.contentTypePolicy==='require-json'?['content-type']:[]);
+  let repeated=false,unsupported=false;
+  function visit(v){if(!v||typeof v!=='object')return;if(Array.isArray(v)){v.forEach(visit);return;}
+    if(/loop|while|for|map/.test(v.kind||'')||['helper-call','stage-call'].includes(v.kind))repeated=true;
+    if(v.kind==='method-call'&&v.receiver?.valueKind==='fetch-response'&&v.method==='header'){
+      const name=v.arguments?.[0];if(name?.kind!=='literal'||typeof name.value!=='string')unsupported=true;else headerNames.add(name.value);
+    }
+    Object.values(v).forEach(visit);
+  }
+  visit(plan.entry);visit(plan.handlers);visit(plan.helpers);visit(plan.stages);if(unsupported)return null;
+  const count=Math.min(policy.defaultMaxEffects,repeated?policy.defaultMaxEffects:plan.effects.length),header=[...headerNames].sort();
+  // Each response owns one cached decode per admitted name. Lowercase admission
+  // is also cached; repeated aliases never allocate another fetch-service copy.
+  const headerBytes=header.reduce((n,k)=>n+3*C+Buffer.byteLength(k)+11+(k==='content-type'?4*(C-1):0),0)+(header.length?48*header.length+32:0);
+  const scratch=12*count+(36+4*plan.effects.length)*count+52+count;
+  const backing=scratch+count*(encoding+caseBytes+3*B+5+headerBytes)+64;
+  const handles=5*count+2,records=handles+5,steps=5*count+2;
+  if(!Number.isSafeInteger(backing)||backing>9007199254740991)return null;
+  const fixed=(id,bytes)=>({id,kind:'fixed',bytes,copies:1});
+  const work={handles:[{namespace:'http.request',count},{namespace:'http.body',count:2*count},{namespace:'http.pending',count},{namespace:'http.response',count}],allocations:[fixed('service-scratch',scratch),fixed('encodings',count*(encoding+caseBytes)),fixed('reader-and-headers',count*(3*B+5+headerBytes))],records:1,cleanupSteps:0};
+  const exit={handles:[{namespace:'http.response',count:1},{namespace:'http.body',count:1}],allocations:[fixed('error-text',64)],records:0,cleanupSteps:2};
+  const limits={handles,backingBytes:backing,records,cleanupSteps:steps,effects:count};
+  const realization='fastly.native.fetch.cohorts-v1';
+  const result=admission.createPlan({version:admission.VERSION,realization,selected:[{site:'fetch-invocation',count:1,profile:{version:admission.PROFILE_VERSION,owner:'provider-fastly',operation:'bounded-fetch-invocation',realization,effects:count,work,cleanup:{handles:[],allocations:[],records:0,cleanupSteps:5*count},exclusions:['application-values','json-parser-and-schema-materialization','incoming-request-context','diagnostic-storage','driver-identity-storage','successful-downstream-response','allocator-metadata']}}],exit,occupied:Object.fromEntries(admission.DIMENSIONS.map(k=>[k,0])),limits});
+  if(!result.admitted||admission.DIMENSIONS.some(k=>result.required[k]!==limits[k]))throw Error('Fetch cohort profile drift');
+  return Object.freeze({...result,selection:'canonical-fetch-cohorts',executionIdentity:'private-single-invocation-wasm-instance',unprofiled:'unproved-inputs-dynamic-backends-mixed-capabilities-error-recovery-application-packages-child-graphs-and-other-targets',count,headerNames:header,headerBytes,scratchBytes:scratch,encodingBytes:count*(encoding+caseBytes),readerBytes:count*(3*B+5+headerBytes),storageBytes:1024+128*records,durationNs:bindings.maxDurationMs*1000000});
+}
+function source(p){return resourceLedgerSource(true)+`\nconst __FCA_COUNT:i32=${p.count};\nconst __FCA_HANDLES:i32=${p.required.handles};\nconst __FCA_RECORDS:i32=${p.required.records};\nconst __FCA_BACKING:u64=${p.required.backingBytes};\nconst __FCA_STORAGE:u32=${p.storageBytes};\nconst __FCA_DURATION:u64=${p.durationNs};\nconst __FCA_SCRATCH:u64=${p.scratchBytes};\nconst __FCA_ENCODING:u64=${p.encodingBytes};\nconst __FCA_READER:u64=${p.readerBytes};\nfunction __fca_header_id(name:string):i32 { ${p.headerNames.map((s,i)=>`if(name==${JSON.stringify(s)})return ${i};`).join('')} return -1; }\n`+fs.readFileSync(path.join(__dirname,'native-fetch-cohorts.as.ts'),'utf8');}
+module.exports={profile,source};