@pulse-compute/provider-fastly 1.0.0-beta.1 → 1.0.0-beta.11

package/src/build/native-platform-capabilities.js

@@ -1,6 +1,23 @@
 'use strict';
 
+const { fetchHeadersSource } = require('./native-fetch-headers.js');
+
+const dynamicBackends = require('./native-dynamic-backends.js');
+
+const { scalarRecordProjectionLines } = require('./schema-scalar-record.js');
+const { hasJsonAdmission, tracksJsonDuplicates, schemaParserDepth, nestedJsonProjectionLines, schemaJsonAdmissionSource, schemaFetchJsonSource } = require('./schema-nested-json.js');
+const { nativeLoggingSource } = require('./native-stdio.js');
+const applicationErrors = require('./native-application-errors.js');
+const effectInvocations = require('./effect-invocations.js');
+const lifecycleBindings = require('./lifecycle.js');
+const hostExtensions = require('./host-extensions.js');
+const packageApplication = require('./package-native-application.js');
+const nativeValueBudget = require('./native-value-budget.js');
+const { schemaNeedsValueProjection } = require('@pulse-compute/wasm-contracts/schema-json/registry');
+
 const crypto = require('node:crypto');
+const { nativeStringAssembly, nativeStringFields, nativeStringConcat, nativeStringTrim, nativeStringIndex, needsNativeValueFailureGuard } = require('./native-string-values.js');
+const conditionalKv = require('./kv-native.js');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
@@ -12,6 +29,7 @@ const {
 } = require('@pulse-compute/wasm-contracts/package/package-contract');
 const {
   EXPERIMENTAL_NATIVE_SIZE_OPTIMIZATION,
+  prepareReportCapture,
   appendAssemblyScriptOptimizationArgs
 } = require('@pulse-compute/wasm-build-support/native-optimization');
 
@@ -77,6 +95,7 @@ function loadGuestToolchain() {
 
 const { resolveAsc } = loadBuildSupport();
 const { generateCanonicalNativeAssemblyScript } = loadNativeGenerator();
+const nativeHandleOwnership = require('./native-handle-ownership.js');
 const { pulseJwtAssemblyScriptSource } = loadJwtNativeSource();
 const {
   GUEST_LINK_STAGE_INVOCATION_VERSION,
@@ -89,25 +108,35 @@ const FASTLY_NATIVE_PLATFORM_CAPABILITIES_VERSION = 'pulse.fastly-native-platfor
 const FASTLY_NATIVE_PLATFORM_CAPABILITIES_GENERATOR_VERSION = 'pulse.fastly-native-platform-capabilities-generator.v1';
 const FASTLY_NATIVE_PLATFORM_CAPABILITIES_COMPILER_VERSION = 'pulse.fastly-native-platform-capabilities-compiler.v1';
 const FASTLY_NATIVE_PLATFORM_CAPABILITIES_ABI_VERSION = 1;
-const FASTLY_NATIVE_PLATFORM_CAPABILITIES_MAX_WASM_BYTES = 1024 * 1024;
+// Internal compilation budget, not a Fastly service limit. Keep a finite guard
+// while allowing composed applications beyond the original 1 MiB proof fixture.
+const { DEFAULT_FASTLY_MAX_WASM_BYTES, normalizeFastlyMaxWasmBytes, assertFastlyWasmBudget } = require('./wasm-budget.js');
+const FASTLY_NATIVE_PLATFORM_CAPABILITIES_MAX_WASM_BYTES = DEFAULT_FASTLY_MAX_WASM_BYTES;
 const FASTLY_NATIVE_PLATFORM_CAPABILITIES_BUFFER_BYTES = 65536;
 const FASTLY_NATIVE_SIZE_OPTIMIZATION = EXPERIMENTAL_NATIVE_SIZE_OPTIMIZATION;
 
 const FASTLY_NATIVE_PLATFORM_CAPABILITIES_IMPORTS = Object.freeze([
+  ...require('./native-body-forwarding.js').IMPORTS.map(key => Object.freeze(key.split(':'))),
+  ...conditionalKv.KV_IMPORTS.map((key) => Object.freeze(key.split(':'))),
+  ...require('./s3-native.js').S3_IMPORTS.map((key) => Object.freeze(key.split(':'))),
   Object.freeze(['fastly_abi', 'init']),
   Object.freeze(['fastly_http_req', 'body_downstream_get']),
   Object.freeze(['fastly_http_req', 'method_get']),
   Object.freeze(['fastly_http_req', 'uri_get']),
   Object.freeze(['fastly_http_req', 'header_value_get']),
+  Object.freeze(['fastly_http_req', 'header_names_get']),
+  Object.freeze(['fastly_http_req', 'header_values_get']),
   Object.freeze(['fastly_http_req', 'new']),
   Object.freeze(['fastly_http_req', 'method_set']),
   Object.freeze(['fastly_http_req', 'uri_set']),
   Object.freeze(['fastly_http_req', 'header_insert']),
+  Object.freeze(['fastly_http_req', 'header_append']),
   Object.freeze(['fastly_http_req', 'send_async']),
-  Object.freeze(['fastly_http_req', 'pending_req_wait']),
+  Object.freeze(['fastly_http_req', 'pending_req_wait_v2']),
   Object.freeze(['fastly_http_resp', 'new']),
   Object.freeze(['fastly_http_resp', 'header_append']),
   Object.freeze(['fastly_http_resp', 'header_value_get']),
+  Object.freeze(['fastly_http_resp', 'header_values_get']),
   Object.freeze(['fastly_http_resp', 'status_get']),
   Object.freeze(['fastly_http_resp', 'status_set']),
   Object.freeze(['fastly_http_resp', 'send_downstream']),
@@ -124,10 +153,15 @@ const FASTLY_NATIVE_PLATFORM_CAPABILITIES_IMPORTS = Object.freeze([
   Object.freeze(['fastly_kv_store', 'lookup_wait_v2']),
   Object.freeze(['fastly_kv_store', 'insert']),
   Object.freeze(['fastly_kv_store', 'insert_wait']),
+  Object.freeze(['fastly_kv_store', 'list']),
+  Object.freeze(['fastly_kv_store', 'list_wait']),
+  Object.freeze(['fastly_kv_store', 'delete']),
+  Object.freeze(['fastly_kv_store', 'delete_wait']),
   Object.freeze(['fastly_log', 'endpoint_get']),
   Object.freeze(['fastly_log', 'write']),
+  Object.freeze(['wasi_snapshot_preview1', 'fd_write']),
   Object.freeze(['wasi_snapshot_preview1', 'clock_time_get'])
-]);
+].filter(([module, name], index, entries) => entries.findIndex((item) => item[0] === module && item[1] === name) === index));
 
 const FASTLY_NATIVE_PLATFORM_CAPABILITIES_REQUIRED_IMPORTS = Object.freeze([
   Object.freeze(['fastly_abi', 'init']),
@@ -148,38 +182,70 @@ const FASTLY_NATIVE_PLATFORM_EFFECT_KIND = Object.freeze({
   'grip.publish': 8,
   'grip.broadcast': 9,
   'assets.lookup': 10,
-  'jwt.verify': 11
+  'jwt.verify': 11,
+  'jwt.sign': 20,
+  's3.head': 12,
+  's3.getText': 13,
+  's3.putText': 14,
+  's3.getBody': 21,
+  'kv.delete': 22,
+  'kv.list': 23,
+  'kv.getVersioned': 15,
+  'kv.insertIfAbsent': 16,
+  'kv.compareAndSwap': 17,
+  'time.now': 18,
+  'crypto.digestText': 19,
+  'host.extension': 24
 });
 
 const FASTLY_NATIVE_PLATFORM_CAPABILITIES_ALLOWED_IMPORTS = new Set([
+  'fastly_http_req:register_dynamic_backend',
   ...FASTLY_NATIVE_PLATFORM_CAPABILITIES_IMPORTS.map(([moduleName, name]) => `${moduleName}:${name}`)
 ]);
 
 const FASTLY_NATIVE_PLATFORM_EFFECT_KINDS = Object.freeze([
+  'host.extension',
+  'time.now',
+  'crypto.digestText',
   'fetch',
   'config.get',
   'secret.get',
   'kv.get',
   'kv.put',
+  ...conditionalKv.KV_CONDITIONAL_KINDS,
   'grip.channel',
   'grip.hold',
   'grip.publish',
   'grip.broadcast',
   'assets.lookup',
-  'jwt.verify'
+  'jwt.verify',
+  'jwt.sign',
+  's3.head',
+  's3.getText',
+  's3.putText',
+  's3.getBody'
 ]);
 
 const FASTLY_NATIVE_PLATFORM_CAPABILITY_KINDS = new Set([
+  'host.extension',
+  'time.now',
+  'crypto.digestText',
   'config.get',
   'secret.get',
   'kv.get',
   'kv.put',
+  ...conditionalKv.KV_CONDITIONAL_KINDS,
   'assets.lookup',
   'grip.channel',
   'grip.hold',
   'grip.publish',
   'grip.broadcast',
-  'jwt.verify'
+  'jwt.verify',
+  'jwt.sign',
+  's3.head',
+  's3.getText',
+  's3.putText',
+  's3.getBody'
 ]);
 
 class FastlyNativePlatformCapabilitiesError extends Error {
@@ -241,45 +307,38 @@ function packageFacts(_plan, options = {}) {
   });
 }
 
+function jwtVerificationAlgorithm(effect) {
+  return effect.resource.keyType === 'secret' ? 'HS256' : String(effect.resource.keyArtifactId).startsWith('pulse.jwt.rs256-key.') ? 'RS256' : 'ES256';
+}
+
 function selectedJwtCrypto(plan) {
-  const hasJwt = (plan.effects || []).some((effect) => effect.kind === 'jwt.verify');
-  if (!hasJwt) return undefined;
-  const algorithms = plan.crypto && Array.isArray(plan.crypto.algorithms)
-    ? plan.crypto.algorithms
-    : [];
-  if (algorithms.length !== 1) {
-    fail(
-      'Fastly Native JWT requires one exact crypto realization.',
-      'PULSE_FASTLY_NATIVE_JWT_CRYPTO_REALIZATION_INVALID',
-      { algorithms, automaticFallback: false }
-    );
-  }
-  const selected = algorithms[0];
-  const hs256 = selected.algorithm === 'HS256'
-    && selected.realization === 'guest-source:pulse-hmac-as'
-    && selected.implementation === 'pulse-hmac-as.v1'
-    && selected.kind === 'guest-source'
-    && selected.targetImplemented === true;
-  const es256 = selected.algorithm === 'ES256'
-    && selected.realization === 'guest-linked:pulse-es256-rustcrypto-p256'
-    && selected.implementation === 'rustcrypto.p256-0.13.2.ecdsa-0.16.9.sha2-0.10.9.v1'
-    && selected.kind === 'guest-linked'
-    && selected.targetImplemented === true;
-  if ((!hs256 && !es256) || selected.automaticFallback !== false) {
-    fail(
-      'Fastly Native JWT selected an unavailable or non-exact crypto realization.',
-      'PULSE_FASTLY_NATIVE_JWT_CRYPTO_REALIZATION_INVALID',
-      { selected, automaticFallback: false }
-    );
+  const effects = plan.effects || [];
+  const signing = effects.filter(effect => effect.kind === 'jwt.sign');
+  const verifies = effects.filter(effect => effect.kind === 'jwt.verify');
+  const required = new Set([
+    ...signing.map(effect => literalObjectField(inputExpression(effect, 'payload'), 'algorithm') === 'HS256' ? 'HMAC-SHA256' : literalObjectField(inputExpression(effect, 'payload'), 'algorithm')),
+    ...verifies.map(effect => jwtVerificationAlgorithm(effect))
+  ]);
+  if (!required.size) return undefined;
+  const definitions = {
+    'HMAC-SHA256': ['guest-source:pulse-hmac-as', 'pulse-hmac-as.v1', 'guest-source'],
+    HS256: ['guest-source:pulse-hmac-as', 'pulse-hmac-as.v1', 'guest-source'],
+    RS256: ['guest-linked:pulse-rs256-bearssl-i31', 'bearssl.0.6.rsa-i31.sha256.v1', 'guest-linked'],
+    ES256: ['guest-linked:pulse-es256-rustcrypto-p256', 'rustcrypto.p256-0.13.2.ecdsa-0.16.9.sha2-0.10.9.v1', 'guest-linked']
+  };
+  for (const algorithm of required) {
+    const selected = plan.crypto?.algorithms.find(entry => entry.algorithm === algorithm);
+    const expected = definitions[algorithm];
+    if (!expected || !selected || selected.realization !== expected[0] || selected.implementation !== expected[1]
+      || selected.kind !== expected[2] || selected.targetImplemented !== true || selected.automaticFallback !== false) {
+      fail('JWT requires its explicitly selected Crypto realization.', 'PULSE_FASTLY_NATIVE_JWT_CRYPTO_REALIZATION_INVALID');
+    }
   }
-  return Object.freeze({
-    algorithm: selected.algorithm,
-    realization: selected.realization,
-    implementation: selected.implementation,
-    kind: selected.kind,
-    guestUnitRequired: es256,
-    automaticFallback: false
-  });
+  const verificationAlgorithms = [...new Set(verifies.map(effect => jwtVerificationAlgorithm(effect)))];
+  if (verificationAlgorithms.length > 1) fail('Fastly Native JWT verification requires one exact algorithm.', 'PULSE_FASTLY_NATIVE_JWT_CRYPTO_REALIZATION_INVALID');
+  const algorithm = verificationAlgorithms[0] || (required.has('RS256') ? 'RS256' : required.has('ES256') ? 'ES256' : 'HMAC-SHA256');
+  return Object.freeze({ ...plan.crypto.algorithms.find(entry => entry.algorithm === algorithm),
+    guestUnitRequired: required.has('ES256') || required.has('RS256'), signingAlgorithms: signing.map(effect => literalObjectField(inputExpression(effect, 'payload'), 'algorithm')) });
 }
 
 function decodeP256Coordinate(value, artifactId, field) {
@@ -301,6 +360,26 @@ function decodeP256Coordinate(value, artifactId, field) {
   return bytes;
 }
 
+function normalizedRs256Jwk(value, artifactId) {
+  const invalid = () => fail('Invalid bounded RSA public key artifact.', 'PULSE_FASTLY_NATIVE_JWT_KEY_ARTIFACT_INVALID', { artifactId });
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).some(name => !['kty', 'n', 'e', 'alg', 'use', 'key_ops', 'kid'].includes(name))
+    || value.kty !== 'RSA' || value.alg !== undefined && value.alg !== 'RS256'
+    || value.use !== undefined && value.use !== 'sig'
+    || value.key_ops !== undefined && (!Array.isArray(value.key_ops) || value.key_ops.length !== 1 || value.key_ops[0] !== 'verify')
+    || value.kid !== undefined && (typeof value.kid !== 'string' || !value.kid.length || value.kid.includes('\0') || Buffer.byteLength(value.kid) > 256)) invalid();
+  const decode = (text, maximum) => {
+    if (typeof text !== 'string' || text.length > Math.ceil(maximum * 4 / 3) || !/^[A-Za-z0-9_-]+$/.test(text)) invalid();
+    const bytes = Buffer.from(text, 'base64url');
+    if (!bytes.length || bytes.length > maximum || bytes[0] === 0 || bytes.toString('base64url') !== text) invalid();
+    return bytes;
+  };
+  const n = decode(value.n, 512), e = decode(value.e, 4), k = n.length;
+  if (![256, 384, 512].includes(k) || n[0] < 128 || !(n[k-1] & 1) || e.readUIntBE(0, e.length) < 3 || !(e.at(-1) & 1)) invalid();
+  const bytes = Buffer.alloc(8+k); bytes.writeUInt32LE(k); n.copy(bytes, 4); e.copy(bytes, 8+k-e.length);
+  return Object.freeze({ kid: value.kid, bytes });
+}
+
 function normalizedEs256Jwk(value, artifactId) {
   if (
     !value
@@ -347,13 +426,14 @@ function resolveEs256KeyArtifacts(plan, facts) {
     }
     const artifactId = effect.resource.keyArtifactId;
     const artifact = artifacts.get(artifactId);
+    const algorithm = jwtVerificationAlgorithm(effect).toLowerCase();
     if (
       !artifact
-      || artifact.version !== 'pulse.jwt-es256-key-artifact.v1'
+      || artifact.version !== `pulse.jwt-${algorithm}-key-artifact.v1`
       || artifact.contractId !== 'pulse.jwt'
       || artifact.package !== '@pulse-compute/jwt'
-      || artifact.kind !== 'jwt-es256-static-public-key'
-      || artifact.mediaType !== 'application/vnd.pulse.jwt-es256-key+json'
+      || artifact.kind !== `jwt-${algorithm}-static-public-key`
+      || artifact.mediaType !== `application/vnd.pulse.jwt-${algorithm}-key+json`
       || artifact.id !== artifactId
       || artifact.materialHash !== sha256(stableStringify(artifact.data))
       || !artifact.data
@@ -379,7 +459,7 @@ function resolveEs256KeyArtifacts(plan, facts) {
         { effectId: effect.id, artifactId, keyCount: keys && keys.length }
       );
     }
-    const normalized = keys.map((key) => normalizedEs256Jwk(key, artifactId));
+    const normalized = keys.map((key) => algorithm === 'rs256' ? normalizedRs256Jwk(key, artifactId) : normalizedEs256Jwk(key, artifactId));
     const kids = normalized.map((key) => key.kid).filter((kid) => kid !== undefined);
     if (new Set(kids).size !== kids.length) {
       fail(
@@ -455,8 +535,71 @@ function es256KeyArtifactSource(records) {
   return lines.join('\n');
 }
 
+function jwtSigningCryptoCompositionSource(selected) {
+  const algorithms = selected?.signingAlgorithms || [];
+  const hs = algorithms.includes('HS256');
+  const es = algorithms.includes('ES256');
+  const rs = algorithms.includes('RS256');
+  return `function __pulse_fastly_jwt_crypto_sign(algorithm: string, key: Uint8Array, data: Uint8Array, output: Uint8Array): i32 {
+    ${hs ? `if (algorithm == "HS256") return pulse_crypto_hmac_sha256_bytes_v1(key.dataStart, key.length, data.dataStart, data.length, output.dataStart, output.length)` : ''}
+    ${rs ? `if (algorithm == "RS256") return __pulse_fastly_rs256(true, key, data, output)` : ''}
+    ${es ? `if (algorithm == "ES256") {
+      if (key.length != 96 || output.length != 64 || data.length > 16340) return -2
+      const pointer: usize = 524288
+      memory.fill(pointer, 0, 16640)
+      store<u32>(pointer, 0x32534550); store<u32>(pointer + 4, 2); store<u32>(pointer + 8, 64)
+      store<u32>(pointer + 12, (224 + data.length + 15) & ~15); store<u32>(pointer + 16, 1)
+      store<u32>(pointer + 24, 224); store<u32>(pointer + 28, data.length)
+      store<u32>(pointer + 32, 64); store<u32>(pointer + 36, 96)
+      store<u32>(pointer + 40, 160); store<u32>(pointer + 44, 64)
+      memory.copy(pointer + 64, key.dataStart, 96); memory.copy(pointer + 224, data.dataStart, data.length)
+      const status = __pulse_crypto_es256_sign_anchor(i32(pointer), 16640)
+      if (status == 1) memory.copy(output.dataStart, pointer + 160, 64)
+      memory.fill(pointer, 0, 16640); memory.fill(0, 0, 65536)
+      return status
+    }` : ''}
+    return -3
+  }`;
+}
+
 function jwtCryptoCompositionSource(selected) {
-  if (!selected) {
+  const rsa = selected && (selected.algorithm === 'RS256' || selected.signingAlgorithms?.includes('RS256'));
+  const helper = rsa ? rs256CompositionSource() : '';
+  return helper + jwtVerificationCompositionSource(selected);
+}
+
+function rs256CompositionSource() {
+  return `function __pulse_fastly_rs256(signing: bool, key: Uint8Array, data: Uint8Array, signature: Uint8Array): i32 {
+    if (key.length < 8 || data.length > 12288) return -2
+    const k = load<u32>(key.dataStart)
+    if ((k != 256 && k != 384 && k != 512) || signature.length != i32(k) || key.length != i32(signing ? 8 + k * 9 / 2 : 8 + k)) return -2
+    const pointer: usize = 524288
+    const output = (64 + key.length + 15) & ~15
+    const input = output + signature.length
+    memory.fill(pointer, 0, 16640)
+    store<u32>(pointer, 0x32534550); store<u32>(pointer + 4, 2); store<u32>(pointer + 8, 64)
+    store<u32>(pointer + 12, (input + data.length + 15) & ~15); store<u32>(pointer + 16, 2)
+    store<u32>(pointer + 24, input); store<u32>(pointer + 28, data.length)
+    store<u32>(pointer + 32, 64); store<u32>(pointer + 36, key.length)
+    store<u32>(pointer + 40, output); store<u32>(pointer + 44, k)
+    memory.copy(pointer + 64, key.dataStart, key.length); memory.copy(pointer + input, data.dataStart, data.length)
+    if (!signing) memory.copy(pointer + output, signature.dataStart, signature.length)
+    const status = signing ? __pulse_crypto_rs256_sign_anchor(i32(pointer), 16640) : __pulse_crypto_rs256_verify_anchor(i32(pointer), 16640)
+    if (signing && status == 1) memory.copy(signature.dataStart, pointer + output, signature.length)
+    memory.fill(pointer, 0, 16640); memory.fill(0, 0, 65536)
+    return status
+  }\n`;
+}
+
+function jwtVerificationCompositionSource(selected) {
+  if (selected?.algorithm === 'RS256') return `
+function __pulse_fastly_jwt_capture_signing_input(input: Uint8Array): void { __pulse_fastly_jwt_record_signing_input(input.byteLength, "") }
+function __pulse_fastly_jwt_crypto_verify(algorithm: string, key: Uint8Array, data: Uint8Array, signature: Uint8Array): i32 {
+  if (algorithm != "RS256") return -2
+  return __pulse_fastly_rs256(false, key, data, signature)
+}`;
+
+  if (!selected || selected.algorithm === 'HMAC-SHA256') {
     return [
       'function __pulse_fastly_jwt_capture_signing_input(input: Uint8Array): void { void input }',
       'function __pulse_fastly_jwt_crypto_verify(algorithm: string, key: Uint8Array, data: Uint8Array, signature: Uint8Array): i32 { void algorithm; void key; void data; void signature; return -3 }'
@@ -541,6 +684,7 @@ function fastlyGuestLinkedStartWrapperWat() {
 }
 
 function validatePlanBoundary(plan, options = {}) {
+  require('./native-body-forwarding.js').validate(plan, options);
   if (!plan || typeof plan !== 'object') throw new TypeError('Fastly native platform capability realization requires a canonical native plan.');
   if (plan.version !== CANONICAL_NATIVE_PLAN_VERSION) {
     fail(`Fastly native platform capability realization requires ${CANONICAL_NATIVE_PLAN_VERSION}.`, 'PULSE_FASTLY_NATIVE_PLATFORM_CAPABILITIES_PLAN_VERSION_UNSUPPORTED', { version: plan.version });
@@ -548,6 +692,7 @@ function validatePlanBoundary(plan, options = {}) {
   if (!plan.ownership || plan.ownership.providerNeutral !== true || plan.ownership.javascriptRuntime !== false) {
     fail('Fastly native platform capability realization requires a provider-neutral plan without JavaScript runtime ownership.', 'PULSE_FASTLY_NATIVE_PLATFORM_CAPABILITIES_PLAN_OWNERSHIP_INVALID', { ownership: plan.ownership });
   }
+  const selectedExtensions = hostExtensions.select(plan, options);
   const effects = plan.effects || [];
   const unsupported = effects.filter((effect) => !FASTLY_NATIVE_PLATFORM_EFFECT_KINDS.includes(effect.kind));
   if (unsupported.length > 0) {
@@ -569,13 +714,17 @@ function validatePlanBoundary(plan, options = {}) {
       && effect.kind === 'assets.lookup';
     const jwt = effect.package === '@pulse-compute/jwt'
       && effect.contractId === 'pulse.jwt'
-      && effect.kind === 'jwt.verify'
-      && effect.operation === 'verify'
-      && effect.capability === 'jwt.verify';
-    return !grip && !assets && !jwt;
+      && ['verify', 'sign'].includes(effect.operation)
+      && effect.kind === `jwt.${effect.operation}` && effect.capability === effect.kind;
+    const s3 = effect.package === '@pulse-compute/s3' && effect.contractId === 'pulse.s3'
+      && ['head', 'getText', 'putText', 'getBody'].includes(effect.operation) && effect.kind === `s3.${effect.operation}` && effect.capability === effect.kind;
+    const digest = effect.package === '@pulse-compute/crypto' && effect.contractId === 'pulse.crypto'
+      && effect.operation === 'digestText' && effect.kind === 'crypto.digestText' && effect.capability === effect.kind;
+    const extension = effect.kind === 'host.extension' && selectedExtensions.some(item => hostExtensions.matches(effect, item.artifact));
+    return !grip && !assets && !jwt && !s3 && !digest && !extension;
   });
   if (unsupportedPackages.length > 0) {
-    fail('Fastly native realization only accepts the trusted first-party Assets, GRIP, and JWT package contracts.', 'PULSE_FASTLY_NATIVE_PLATFORM_PACKAGE_UNSUPPORTED', {
+    fail('Fastly native realization only accepts the trusted first-party Assets, GRIP, JWT, S3, and Crypto digest package contracts.', 'PULSE_FASTLY_NATIVE_PLATFORM_PACKAGE_UNSUPPORTED', {
       effects: unsupportedPackages.map((entry) => ({ id: entry.id, kind: entry.kind, package: entry.package, contractId: entry.contractId }))
     });
   }
@@ -589,15 +738,19 @@ function validatePlanBoundary(plan, options = {}) {
       && effect.kind === 'assets.lookup';
     const jwt = effect.package === '@pulse-compute/jwt'
       && effect.contractId === 'pulse.jwt'
-      && effect.kind === 'jwt.verify'
-      && effect.operation === 'verify'
-      && effect.capability === 'jwt.verify';
-    return !grip && !assets && !jwt;
+      && ['verify', 'sign'].includes(effect.operation)
+      && effect.kind === `jwt.${effect.operation}` && effect.capability === effect.kind;
+    const s3 = effect.package === '@pulse-compute/s3' && effect.contractId === 'pulse.s3'
+      && ['head', 'getText', 'putText', 'getBody'].includes(effect.operation) && effect.kind === `s3.${effect.operation}` && effect.capability === effect.kind;
+    const digest = effect.package === '@pulse-compute/crypto' && effect.contractId === 'pulse.crypto'
+      && effect.operation === 'digestText' && effect.kind === 'crypto.digestText' && effect.capability === effect.kind;
+    const extension = effect.kind === 'host.extension' && selectedExtensions.some(item => hostExtensions.matches(effect, item.artifact));
+    return !grip && !assets && !jwt && !s3 && !digest && !extension;
   });
   if (unsupportedDeclarations.length > 0) {
-    fail('Fastly native package realization is restricted to the Assets, GRIP, and JWT contracts.', 'PULSE_FASTLY_NATIVE_PLATFORM_PACKAGE_UNSUPPORTED', { effects: unsupportedDeclarations });
+    fail('Fastly native package realization is restricted to the Assets, GRIP, JWT, S3, and Crypto digest contracts.', 'PULSE_FASTLY_NATIVE_PLATFORM_PACKAGE_UNSUPPORTED', { effects: unsupportedDeclarations });
   }
-  for (const effect of effects.filter((entry) => entry.kind === 'jwt.verify')) {
+  for (const effect of effects.filter((entry) => ['jwt.verify', 'jwt.sign'].includes(entry.kind))) {
     const resource = effect.resource;
     const knownShape = resource
       && !Object.keys(resource)
@@ -612,7 +765,7 @@ function validatePlanBoundary(plan, options = {}) {
       && typeof resource.keyArtifactId === 'string'
       && resource.keyArtifactId.length > 0
       && resource.secretBinding === null;
-    if (!namedSecret && !staticPublicKey) {
+    if (!namedSecret && (!staticPublicKey || effect.kind === 'jwt.sign')) {
       fail('Fastly Native JWT requires one exact named-secret or bounded static public-key descriptor.', 'PULSE_FASTLY_NATIVE_JWT_KEY_DESCRIPTOR_INVALID', {
         effectId: effect.id,
         resource,
@@ -678,8 +831,8 @@ function resolveCapabilityBindings(plan, options = {}) {
   const effects = plan.effects || [];
   const hasConfig = effects.some((effect) => effect.kind === 'config.get');
   const hasSecret = effects.some((effect) => (
-    effect.kind === 'secret.get'
-    || (effect.kind === 'jwt.verify' && effect.resource && effect.resource.keyType === 'secret')
+    effect.kind === 'secret.get' || ['s3.head', 's3.getText', 's3.putText', 's3.getBody'].includes(effect.kind)
+    || (['jwt.verify', 'jwt.sign'].includes(effect.kind) && effect.resource && effect.resource.keyType === 'secret')
   ));
   const hasGripHold = effects.some((effect) => effect.kind === 'grip.hold');
   const hasGripBroadcast = effects.some((effect) => effect.kind === 'grip.broadcast');
@@ -703,8 +856,9 @@ function resolveCapabilityBindings(plan, options = {}) {
 
   const kv = [];
   for (const [index, effect] of effects.entries()) {
-    if (effect.kind !== 'kv.get' && effect.kind !== 'kv.put' && effect.kind !== 'assets.lookup') continue;
+    if (effect.kind !== 'kv.get' && effect.kind !== 'kv.put' && !conditionalKv.KV_CONDITIONAL_KINDS.includes(effect.kind) && effect.kind !== 'assets.lookup') continue;
     const packagePayload = inputExpression(effect, 'payload');
+    if (effect.kind === 'assets.lookup' && literalObjectField(packagePayload, 'embeddedId')) continue;
     const logical = effect.resource && effect.resource.kind === 'literal'
       && effect.kind !== 'assets.lookup'
       ? String(effect.resource.value)
@@ -715,6 +869,7 @@ function resolveCapabilityBindings(plan, options = {}) {
         resource: effect.resource
       });
     }
+    if (conditionalKv.KV_CONDITIONAL_KINDS.includes(effect.kind) && Buffer.byteLength(logical, 'utf8') > conditionalKv.KV_CONDITIONAL_LIMITS.namespaceBytes) fail('Conditional KV namespace exceeds its portable bound.', 'PULSE_FASTLY_NATIVE_KV_NAMESPACE_DYNAMIC');
     const physical = stringBinding(
       kvMap[logical],
       `Fastly KV binding for ${logical}`,
@@ -770,11 +925,11 @@ function resolveCapabilityBindings(plan, options = {}) {
       backend = byEffect[effect.id]
         || (origin && byOrigin[origin])
         || (effect.resource && effect.resource.value && byOrigin[effect.resource.value]);
-      if ((typeof backend !== 'string' || backend.trim() === '') && !origin) {
+      if ((typeof backend !== 'string' || backend.trim() === '') && !origin && source.dynamicBackends !== true) {
         const configured = [...new Set(Object.values(byOrigin).filter((value) => typeof value === 'string' && value.trim()).map((value) => value.trim()))];
         if (configured.length === 1) backend = configured[0];
       }
-      if (typeof backend !== 'string' || backend.trim() === '') {
+      if ((typeof backend !== 'string' || backend.trim() === '') && !(source.dynamicBackends === true && !(plan.capabilities || []).includes('request.body.forward'))) {
         fail(`Fastly native effect ${effect.id} has no static backend binding.`, 'PULSE_FASTLY_BACKEND_REQUIRED', {
           effectId: effect.id,
           effectIndex: index,
@@ -782,7 +937,7 @@ function resolveCapabilityBindings(plan, options = {}) {
           hint: `Provide bindings.backends[${JSON.stringify(origin || '<origin>')}] or an explicit effect backend.`
         });
       }
-      backend = backend.trim();
+      backend = typeof backend === 'string' ? backend.trim() : '';
     }
     const binding = Object.freeze({
       index,
@@ -791,6 +946,7 @@ function resolveCapabilityBindings(plan, options = {}) {
       origin,
       url,
       backend,
+      ...(!backend && effect.kind === 'fetch' ? { dynamic: true } : {}),
       ...(effect.kind === 'grip.broadcast' && gripSecretRef ? { authSecretRef: gripSecretRef } : {})
     });
     backends.push(binding);
@@ -799,8 +955,12 @@ function resolveCapabilityBindings(plan, options = {}) {
   }
 
   return Object.freeze({
+    maxDurationMs: require('@pulse-compute/runtime/host').normalizeRequestDuration(options.maxDurationMs),
+    bodyForwarding: require('../toolchain/body-forwarding.js').normalizeBodyForwarding(options.bodyForwarding, options.maxDurationMs),
+    ...(source.logEndpoint === undefined ? {} : { logEndpoint: require('../toolchain/logging.js').normalizeFastlyLogEndpoint(source.logEndpoint) }),
     configStore,
     secretStore,
+    s3: require('../toolchain/s3.js').resolveFastlyS3(effects.map((effect) => ({ ...effect, payload: Object.fromEntries(['contentType', 'method', 'range', 'ifNoneMatch'].map(name => [name, literalObjectField(inputExpression(effect, 'payload'), name) ?? undefined])) })), source.s3),
     kv: Object.freeze(kv),
     fetch: Object.freeze(fetch),
     backends: Object.freeze(backends),
@@ -834,7 +994,7 @@ function planRequiresFetchBodyRead(plan) {
     if (Array.isArray(value)) return value.some(visit);
     return Object.values(value).some(visit);
   }
-  return visit(plan.entry);
+  return visit(plan.entry) || visit(plan.handlers) || visit(plan.stages) || visit(plan.helpers);
 }
 
 function requiredImportsForPlan(plan, bindings) {
@@ -849,33 +1009,45 @@ function requiredImportsForPlan(plan, bindings) {
     'fastly_http_body:new',
     'fastly_http_body:write'
   ]);
+  if (bindings && bindings.maxDurationMs !== undefined) { keys.add('wasi_snapshot_preview1:clock_time_get'); keys.add('fastly_async_io:select'); }
   const kinds = new Set((plan.effects || []).map((effect) => effect.kind));
   if (kinds.has('fetch') || kinds.has('grip.publish') || kinds.has('grip.broadcast')) {
     for (const key of [
       'fastly_http_req:new', 'fastly_http_req:method_set', 'fastly_http_req:uri_set',
-      'fastly_http_req:header_insert', 'fastly_http_req:send_async', 'fastly_http_req:pending_req_wait'
+      'fastly_http_req:header_append', 'fastly_http_req:send_async', 'fastly_http_req:pending_req_wait_v2'
     ]) keys.add(key);
   }
+  if (bindings && dynamicBackends.active(bindings)) keys.add('fastly_http_req:register_dynamic_backend');
+  if (plan.effects.some(effect=>effect.fetchTiming)) keys.add('fastly_async_io:is_ready');
+  if (kinds.has('fetch')) for (const key of ['wasi_snapshot_preview1:clock_time_get', 'fastly_async_io:select', 'fastly_http_req:pending_req_poll_v2', 'fastly_http_resp:close', 'fastly_http_body:close']) keys.add(key);
   if (planRequiresFetchBodyRead(plan)) keys.add('fastly_http_body:read');
   if (kinds.has('config.get')) for (const key of ['fastly_config_store:open', 'fastly_config_store:get']) keys.add(key);
   const gripAuthenticationRequired = kinds.has('grip.broadcast')
     && (!bindings || Boolean(bindings.grip && bindings.grip.authentication));
   const jwtSecretRequired = (plan.effects || []).some((effect) => (
-    effect.kind === 'jwt.verify'
+    ['jwt.verify', 'jwt.sign'].includes(effect.kind)
     && effect.resource
     && effect.resource.keyType === 'secret'
   ));
   if (kinds.has('secret.get') || jwtSecretRequired || gripAuthenticationRequired) {
     for (const key of ['fastly_secret_store:open', 'fastly_secret_store:get', 'fastly_secret_store:plaintext']) keys.add(key);
   }
-  if (kinds.has('jwt.verify')) keys.add('wasi_snapshot_preview1:clock_time_get');
+  for (const kind of conditionalKv.KV_CONDITIONAL_KINDS) if (kinds.has(kind)) for (const key of conditionalKv.kvImports(kind)) keys.add(key);
+  if (kinds.has('jwt.verify') || kinds.has('jwt.sign') || kinds.has('time.now')) keys.add('wasi_snapshot_preview1:clock_time_get');
   if (kinds.has('kv.get') || kinds.has('kv.put') || kinds.has('assets.lookup')) keys.add('fastly_kv_store:open');
   if (kinds.has('kv.get') || kinds.has('assets.lookup')) for (const key of ['fastly_kv_store:lookup', 'fastly_kv_store:lookup_wait_v2', 'fastly_http_body:read']) keys.add(key);
   if (kinds.has('kv.put')) for (const key of ['fastly_kv_store:insert', 'fastly_kv_store:insert_wait']) keys.add(key);
   if (kinds.has('grip.hold')) keys.add('fastly_http_resp:header_append');
-  if (plan.logging && plan.logging.enabledStatements > 0) {
-    keys.add('fastly_log:endpoint_get');
-    keys.add('fastly_log:write');
+  if ((plan.logging && plan.logging.enabledStatements > 0) || ['fetch', 'grip.publish', 'grip.broadcast', 's3.head', 's3.getText', 's3.putText', 's3.getBody'].some(kind => kinds.has(kind))) {
+    if (bindings?.logEndpoint === undefined) keys.add('wasi_snapshot_preview1:fd_write');
+    else { keys.add('fastly_log:endpoint_get'); keys.add('fastly_log:write'); }
+  }
+  if (kinds.has('s3.head') || kinds.has('s3.getText') || kinds.has('s3.putText') || kinds.has('s3.getBody')) for (const key of require('./s3-native.js').S3_IMPORTS) keys.add(key);
+  if (require('./native-body-forwarding.js').enabled(plan)) {
+    keys.delete('fastly_http_req:header_append'); keys.add('fastly_http_req:header_insert');
+    keys.delete('fastly_http_req:send_async'); keys.delete('fastly_http_req:pending_req_wait_v2');
+    for (const key of require('./native-body-forwarding.js').IMPORTS) keys.add(key);
+    keys.add('fastly_http_body:read');
   }
   return Object.freeze([...keys].sort());
 }
@@ -887,15 +1059,40 @@ function stripPulseHostImports(source) {
     .join('\n');
 }
 
+function schemaTextEncodeIds(plan) {
+  // Keep the PS3 accounting/failure boundary and all unproved codec families.
+  if (nativeValueBudget.hasBoundedReadLoop(plan)) return [];
+  function closedText(node, depth = 0) {
+    if (depth > 16) return false;
+    if (node.kind === 'string' || node.kind === 'boolean') return true;
+    if (node.kind === 'nullable') return closedText(node.value, depth);
+    if (node.kind === 'array') return closedText(node.element, depth + 1);
+    return node.kind === 'object' && !node.additionalProperties
+      && node.fields.every(field => closedText(field.value, depth + 1));
+  }
+  return ((plan.schemas && plan.schemas.registry && plan.schemas.registry.schemas) || [])
+    .filter(schema => !schema.jsonLimits && schema.root.kind === 'object'
+      && schemaNeedsValueProjection(schema.root) && closedText(schema.root))
+    .map(schema => schema.id);
+}
+
 function generateSchemaRuntime(plan) {
   const registry = plan.schemas && plan.schemas.registry ? plan.schemas.registry : { schemas: [], maxBytes: FASTLY_NATIVE_PLATFORM_CAPABILITIES_BUFFER_BYTES, contentTypePolicy: 'accept-json-or-missing' };
   const schemas = registry.schemas || [];
+  const textEncodeIds = new Set(schemaTextEncodeIds(plan));
   const nodeLines = [];
+  const scalarProjectors = new Map();
+  const flatObjectProjectors = new Map();
+  const scalarKinds = ['string', 'boolean', 'i32', 'u32', 'f64', 'string-enum'];
   let nodeIndex = 0;
 
   function emitNode(schemaIndex, node) {
     const currentIndex = nodeIndex++;
     const functionName = `__pulse_fastly_schema_${schemaIndex}_${currentIndex}`;
+    const flatObject = node.kind === 'object' && !node.additionalProperties
+      && node.fields.every(field => scalarKinds.includes(field.value.kind));
+    // Locals belong to this function, so equivalent flat bodies need no node ID.
+    const localIndex = flatObject ? 'flat' : currentIndex;
     const child = node.kind === 'nullable'
       ? emitNode(schemaIndex, node.value)
       : node.kind === 'array'
@@ -904,30 +1101,43 @@ function generateSchemaRuntime(plan) {
     const fields = node.kind === 'object'
       ? node.fields.map((field) => Object.freeze({ field, apply: emitNode(schemaIndex, field.value) }))
       : [];
-    const body = [`function ${functionName}(valueHandle: i32): i32 {`, '  const input = __pulse_fastly_value(valueHandle)'];
+    const body = [`function ${functionName}(valueHandle: i32, checkDuplicates: bool): i32 {`, '  const input = __pulse_fastly_value(valueHandle)'];
     if (node.kind === 'nullable') {
       body.push('  if (input.kind == PULSE_VALUE_NULL) return valueHandle');
-      body.push(`  return ${child}(valueHandle)`);
+      body.push(`  return ${child}(valueHandle, checkDuplicates)`);
     } else if (node.kind === 'array') {
       body.push('  if (input.kind != PULSE_VALUE_ARRAY) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 52, -1); return 0 }');
       body.push('  const output = host_value_array()');
       body.push('  for (let index = 0; index < input.values.length; index += 1) {');
-      body.push(`    const item = ${child}(unchecked(input.values[index]))`);
+      body.push(`    const item = ${child}(unchecked(input.values[index]), checkDuplicates)`);
       body.push('    if (item <= 0) return 0');
       body.push('    host_value_array_push(output, item)');
       body.push('  }');
       body.push('  return output');
+    } else if (node.kind === 'json-value' || node.kind === 'json-object') {
+      body.push(...nestedJsonProjectionLines(node));
+    } else if (node.kind === 'scalar-record') {
+      body.push(...scalarRecordProjectionLines(node));
     } else if (node.kind === 'object') {
       body.push('  if (input.kind != PULSE_VALUE_OBJECT) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 50, -1); return 0 }');
+      if (node.additionalProperties) body.push('  if (checkDuplicates && input.duplicateJsonKeys) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 57, -1); return 0 }');
       body.push('  const output = host_value_object()');
       fields.forEach(({ field, apply }, fieldIndex) => {
-        body.push(`  const key_${currentIndex}_${fieldIndex} = __pulse_fastly_string_value(${quote(field.name)})`);
-        body.push(`  const field_${currentIndex}_${fieldIndex} = host_value_property(valueHandle, key_${currentIndex}_${fieldIndex})`);
-        body.push(`  if (__pulse_fastly_value(field_${currentIndex}_${fieldIndex}).kind == PULSE_VALUE_UNDEFINED) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 51, -1); return 0 }`);
-        body.push(`  const projected_${currentIndex}_${fieldIndex} = ${apply}(field_${currentIndex}_${fieldIndex})`);
-        body.push(`  if (projected_${currentIndex}_${fieldIndex} <= 0) return 0`);
-        body.push(`  host_value_object_set(output, key_${currentIndex}_${fieldIndex}, projected_${currentIndex}_${fieldIndex})`);
+        body.push(`  const key_${localIndex}_${fieldIndex} = __pulse_fastly_string_value(${quote(field.name)})`);
+        if (!field.required) body.push(`  if (__pulse_fastly_find(input, ${quote(field.name)}) >= 0) {`);
+        body.push(`  const field_${localIndex}_${fieldIndex} = host_value_property(valueHandle, key_${localIndex}_${fieldIndex})`);
+        body.push(`  if (__pulse_fastly_value(field_${localIndex}_${fieldIndex}).kind == PULSE_VALUE_UNDEFINED) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 51, -1); return 0 }`);
+        body.push(`  const projected_${localIndex}_${fieldIndex} = ${apply}(field_${localIndex}_${fieldIndex}, checkDuplicates)`);
+        body.push(`  if (projected_${localIndex}_${fieldIndex} <= 0) return 0`);
+        body.push(`  host_value_object_set(output, key_${localIndex}_${fieldIndex}, projected_${localIndex}_${fieldIndex})`);
+        if (!field.required) body.push('  }');
       });
+      if (node.additionalProperties) {
+        body.push('  for (let index = 0; index < input.keys.length; index++) {', '    const key = unchecked(input.keys[index])');
+        if (node.fields.length) body.push(`    if (${node.fields.map(field => `key == ${quote(field.name)}`).join(' || ')}) continue`);
+        body.push('    const item = __pulse_fastly_copy_json(unchecked(input.values[index]), checkDuplicates)',
+          '    if (item <= 0) return 0', '    host_value_object_set(output, __pulse_fastly_string_value(key), item)', '  }');
+      }
       body.push('  return output');
     } else if (node.kind === 'string') {
       body.push('  if (input.kind != PULSE_VALUE_STRING) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 52, -1); return 0 }');
@@ -952,6 +1162,32 @@ function generateSchemaRuntime(plan) {
       throw new TypeError(`Unsupported Fastly native schema node ${String(node.kind)}.`);
     }
     body.push('}', '');
+    // Only scalar validators preserve the original handle without allocating or
+    // calling child projectors. Compare the exact emitted body, including enum
+    // values/order and error stages.
+    if (scalarKinds.includes(node.kind)) {
+      const key = body.slice(1).join('\n');
+      const existing = scalarProjectors.get(key);
+      if (existing) return existing;
+      const sharedName = `__pulse_fastly_schema_scalar_${scalarProjectors.size}`;
+      scalarProjectors.set(key, sharedName);
+      body[0] = `function ${sharedName}(valueHandle: i32, checkDuplicates: bool): i32 {`;
+      nodeLines.push(...body);
+      return sharedName;
+    }
+    // Share code only after child scalar identities are resolved. Exact bodies
+    // retain field order, presence checks, validation and errors. Each call still
+    // allocates its own output; open/nested/nullable/array bodies remain separate.
+    if (flatObject) {
+      const key = body.slice(1).join('\n');
+      const existing = flatObjectProjectors.get(key);
+      if (existing) return existing;
+      const sharedName = `__pulse_fastly_schema_flat_object_${flatObjectProjectors.size}`;
+      flatObjectProjectors.set(key, sharedName);
+      body[0] = `function ${sharedName}(valueHandle: i32, checkDuplicates: bool): i32 {`;
+      nodeLines.push(...body);
+      return sharedName;
+    }
     nodeLines.push(...body);
     return functionName;
   }
@@ -961,17 +1197,23 @@ function generateSchemaRuntime(plan) {
     `const __PULSE_SCHEMA_MAX_BYTES: i32 = ${Number(registry.maxBytes || FASTLY_NATIVE_PLATFORM_CAPABILITIES_BUFFER_BYTES)}`,
     `const __PULSE_SCHEMA_REQUIRE_JSON: bool = ${registry.contentTypePolicy === 'require-json' ? 'true' : 'false'}`,
     '',
+    schemaJsonAdmissionSource(plan),
+    fetchHeadersSource(),
+    schemaFetchJsonSource(),
     ...nodeLines,
-    'function __pulse_fastly_schema_apply(schemaId: string, valueHandle: i32, encode: bool): i32 {',
+    `function __pulse_fastly_schema_apply(schemaId: string, valueHandle: i32, encode: bool${textEncodeIds.size ? ', textResult: bool = false' : ''}): i32 {`,
     '  if (schemaId.length == 0) return valueHandle'
   ];
   for (const [schemaIndex, schema] of schemas.entries()) {
     lines.push(`${schemaIndex === 0 ? '  if' : '  else if'} (schemaId == ${quote(schema.id)}) {`);
-    lines.push(`    const projected = ${roots[schemaIndex]}(valueHandle)`);
+    if (schema.jsonLimits) lines.push(`    if (__pulse_fastly_admit_bounded_value(valueHandle, __pulse_schema_json_limits_${schemaIndex}()).failure != 0) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 57, -1); return 0 }`);
+    lines.push(`    const projected = ${roots[schemaIndex]}(valueHandle, !encode)`);
     lines.push('    if (projected <= 0) return 0');
     lines.push('    const input = __pulse_fastly_json(projected, 0)');
     lines.push(`    const normalized = encode ? __pulse_schema_encode_${schemaIndex}(input) : __pulse_schema_decode_${schemaIndex}(input)`);
-    lines.push('    return __pulse_fastly_parse_json(normalized)');
+    if (textEncodeIds.has(schema.id)) lines.push('    if (textResult && encode) return __pulse_fastly_string_value(normalized)');
+    if (schema.jsonLimits) lines.push('    const output = __pulse_fastly_parse_json(normalized)', '    if (output > 0) __pulse_fastly_deep_freeze(output)', '    return output');
+    else lines.push('    return __pulse_fastly_parse_json(normalized)');
     lines.push('  }');
   }
   lines.push('  __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 55, -1)');
@@ -994,7 +1236,7 @@ function effectResultSource(plan, bindings) {
   lines.push(`function __pulse_fastly_secret_store(effectIndex: i32): string { return ${quote(bindings.secretStore)} }`, '');
   lines.push('function __pulse_fastly_jwt_secret_binding(effectIndex: i32): string {', '  switch (effectIndex) {');
   for (const [index, effect] of (plan.effects || []).entries()) {
-    if (effect.kind === 'jwt.verify' && effect.resource.keyType === 'secret') {
+    if (['jwt.verify', 'jwt.sign'].includes(effect.kind) && effect.resource.keyType === 'secret') {
       lines.push(`    case ${index}: return ${quote(effect.resource.secretBinding)}`);
     }
   }
@@ -1009,12 +1251,31 @@ function effectResultSource(plan, bindings) {
   for (const binding of bindings.grip.publish) lines.push(`    case ${binding.index}: return ${quote(binding.authSecretRef || '')}`);
   lines.push('    default: return ""', '  }', '}', '');
 
+  // A config lookup has the same ready-result handoff at every static site.
+  // Keep the site indices in the switch; pass the active index through so the
+  // pending slot and any state error still belong to the original invocation.
+  const configSites = (plan.effects || []).flatMap((effect, index) => effect.kind === 'config.get' ? [index] : []);
+  if (configSites.length > 1) {
+    lines.push('function __pulse_fastly_resolve_config_get(effectIndex: i32): i32 {');
+    lines.push('  const response = __pulse_fastly_wait_ready(effectIndex)');
+    lines.push('  if (response <= 0) return 0');
+    lines.push('  return response');
+    lines.push('}', '');
+  }
+
   lines.push('function __pulse_fastly_resolve_effect(effectIndex: i32): i32 {');
   lines.push('  switch (effectIndex) {');
   for (const [index, effect] of (plan.effects || []).entries()) {
+    if (effect.kind === 'config.get' && configSites.length > 1) {
+      if (index === configSites[0]) {
+        for (const site of configSites) lines.push(`    case ${site}:`);
+        lines.push('      return __pulse_fastly_resolve_config_get(effectIndex)');
+      }
+      continue;
+    }
     const result = effect.result || {};
     const decoder = result.decoder;
-    const waiter = effect.kind === 'fetch'
+    const waiter = conditionalKv.KV_CONDITIONAL_KINDS.includes(effect.kind) ? '__pulse_fastly_kv_conditional_wait' : ['s3.head', 's3.getText', 's3.putText', 's3.getBody'].includes(effect.kind) ? '__pulse_fastly_s3_wait' : effect.kind === 'fetch'
       ? '__pulse_fastly_wait_fetch'
       : effect.kind === 'grip.publish'
         ? '__pulse_fastly_wait_grip_publish'
@@ -1050,21 +1311,31 @@ function effectResultSource(plan, bindings) {
 
 function effectDispatchSource(plan) {
   const handlerByKind = Object.freeze({
+    'time.now': '__pulse_fastly_time_begin',
+    'crypto.digestText': '__pulse_fastly_digest_begin',
     fetch: '__pulse_fastly_fetch_begin',
     'config.get': '__pulse_fastly_config_begin',
     'secret.get': '__pulse_fastly_secret_begin',
     'jwt.verify': '__pulse_fastly_jwt_begin',
+    'jwt.sign': '__pulse_fastly_jwt_sign_begin',
+    's3.head': '__pulse_fastly_s3_begin',
+    's3.getText': '__pulse_fastly_s3_begin',
+    's3.putText': '__pulse_fastly_s3_begin',
+    's3.getBody': '__pulse_fastly_s3_begin',
     'kv.get': '__pulse_fastly_kv_get_begin',
     'kv.put': '__pulse_fastly_kv_put_begin',
+    ...Object.fromEntries(conditionalKv.KV_CONDITIONAL_KINDS.map(kind => [kind, '__pulse_fastly_kv_conditional_begin'])),
     'assets.lookup': '__pulse_fastly_assets_begin',
     'grip.channel': '__pulse_fastly_grip_channel_begin',
     'grip.hold': '__pulse_fastly_grip_hold_begin',
     'grip.publish': '__pulse_fastly_grip_publish_begin',
-    'grip.broadcast': '__pulse_fastly_grip_publish_begin'
+    'grip.broadcast': '__pulse_fastly_grip_publish_begin',
+    'host.extension': '__pulse_extension_begin'
   });
   const kinds = [...new Set((plan.effects || []).map((effect) => effect.kind))];
   const lines = [
     'function host_effect_begin(effectIndex: i32, payload: i32): void {',
+    ...(needsNativeValueFailureGuard(plan) ? ['  if (__pulse_fastly_last_error != PULSE_ERROR_NONE) return'] : []),
     '  if (effectIndex < 0 || effectIndex >= PULSE_FASTLY_EFFECT_COUNT || unchecked(__pulse_fastly_pending_mode[effectIndex]) != PULSE_FASTLY_PENDING_NONE) { __pulse_fastly_fail(PULSE_ERROR_STATE, 46, effectIndex); return }',
     '  const payloadValue = __pulse_fastly_value(payload)',
     '  if (payloadValue.kind != PULSE_VALUE_OBJECT) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 47, effectIndex); return }',
@@ -1085,7 +1356,15 @@ function effectDispatchSource(plan) {
 }
 
 function fastlyRuntimeSource(plan, bindings, options = {}) {
+  const lifecycle = options.lifecycle;
+  const textEncodeIds = schemaTextEncodeIds(plan);
   const effectCount = (plan.effects || []).length;
+  const hasAssets = (plan.effects || []).some(effect => effect.kind === 'assets.lookup');
+  const assetBeginSource = hasAssets ? String.raw`function __pulse_fastly_assets_payload(payload: __PulseFastlyValue): __PulseFastlyValue { const value = __pulse_fastly_value(__pulse_fastly_payload_field(payload, "payload")); if (value.kind != PULSE_VALUE_OBJECT) __pulse_fastly_fail(PULSE_ERROR_VALUE, 146, -1); return value }
+function __pulse_fastly_assets_begin(effectIndex: i32, payload: __PulseFastlyValue): void { const value = __pulse_fastly_assets_payload(payload); if (__pulse_fastly_last_error != 0) return; if (__pulse_fastly_value(__pulse_fastly_payload_field(value, 'embeddedId')).kind != PULSE_VALUE_UNDEFINED) { __pulse_fastly_ready_effect(effectIndex, __pulse_fastly_embedded_asset(value)); return; } const store = __pulse_fastly_open_kv_store(effectIndex); if (__pulse_fastly_last_error != 0) return; const key = __pulse_fastly_string(__pulse_fastly_payload_field(value, "key")); const keyBytes = __pulse_fastly_utf8(key); const lookupOut = __pulse_fastly_out_i32(); const config = new StaticArray<i32>(1); const status = fastly_kv_store_lookup(store, changetype<usize>(keyBytes), keyBytes.byteLength, 0, changetype<usize>(config), changetype<usize>(lookupOut)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 147, effectIndex); return } unchecked(__pulse_fastly_pending[effectIndex] = __pulse_fastly_out_value(lookupOut)); unchecked(__pulse_fastly_pending_mode[effectIndex] = PULSE_FASTLY_PENDING_ASYNC) }` : '';
+  const assetResultSource = hasAssets ? String.raw`function __pulse_fastly_asset_content_type(key: string): string { const dot = key.lastIndexOf("."); const extension = dot < 0 ? "" : key.substring(dot + 1).toLowerCase(); if (extension == "css") return "text/css; charset=utf-8"; if (extension == "html") return "text/html; charset=utf-8"; if (extension == "js" || extension == "mjs") return "text/javascript; charset=utf-8"; if (extension == "json") return "application/json; charset=utf-8"; if (extension == "svg") return "image/svg+xml"; if (extension == "txt") return "text/plain; charset=utf-8"; if (extension == "webp") return "image/webp"; if (extension == "png") return "image/png"; if (extension == "jpg" || extension == "jpeg") return "image/jpeg"; if (extension == "gif") return "image/gif"; if (extension == "ico") return "image/x-icon"; return "application/octet-stream" }
+function __pulse_fastly_asset_text(text: string): string { const parser = new __PulseJsonParser(text); const parsed = parser.parse(); if (parser.failed || parsed <= 0) return text; const object = __pulse_fastly_value(parsed); if (object.kind != PULSE_VALUE_OBJECT) return text; const marker = __pulse_fastly_find(object, "__pulseKv"); const value = __pulse_fastly_find(object, "value"); if (marker < 0 || value < 0 || __pulse_fastly_number(unchecked(object.values[marker])) != 1.0) return text; return __pulse_fastly_string(unchecked(object.values[value])) }
+function __pulse_fastly_wait_assets(effectIndex: i32): i32 { if (__pulse_fastly_pending_mode[effectIndex] == PULSE_FASTLY_PENDING_READY) return __pulse_fastly_wait_ready(effectIndex); if (unchecked(__pulse_fastly_pending_mode[effectIndex]) != PULSE_FASTLY_PENDING_ASYNC) { __pulse_fastly_fail(PULSE_ERROR_STATE, 148, effectIndex); return 0 } const pending = unchecked(__pulse_fastly_pending[effectIndex]); const bodyOut = __pulse_fastly_out_i32(); const metadata = new Uint8Array(1); const written = __pulse_fastly_out_i32(); const generation = new StaticArray<i64>(1); const kvError = __pulse_fastly_out_i32(); const status = fastly_kv_store_lookup_wait_v2(pending, changetype<usize>(bodyOut), metadata.dataStart, 0, changetype<usize>(written), changetype<usize>(generation), changetype<usize>(kvError)); unchecked(__pulse_fastly_pending_mode[effectIndex] = PULSE_FASTLY_PENDING_NONE); unchecked(__pulse_fastly_pending[effectIndex] = 0); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 149, effectIndex); return 0 } const outer = __pulse_fastly_value(unchecked(__pulse_fastly_payloads[effectIndex])); const payload = __pulse_fastly_assets_payload(outer); if (__pulse_fastly_last_error != 0) return 0; const key = __pulse_fastly_string(__pulse_fastly_payload_field(payload, "key")); const output = new __PulseFastlyValue(); output.kind = PULSE_VALUE_RESPONSE; const errorCode = __pulse_fastly_out_value(kvError); output.status = errorCode == 3 ? 404 : 200; if (errorCode != 1 && errorCode != 3) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 150, effectIndex); return 0 } const headersHandle = __pulse_fastly_payload_field(payload, "headers"); const headers = __pulse_fastly_value(headersHandle); let hasContentType = false; if (headers.kind == PULSE_VALUE_OBJECT) { for (let i = 0; i < headers.keys.length; i += 1) { const name = unchecked(headers.keys[i]); if (name.toLowerCase() == "content-type") hasContentType = true; output.headers.push(new __PulseFastlyHeader(name, __pulse_fastly_string(unchecked(headers.values[i])))) } } if (!hasContentType) output.headers.push(new __PulseFastlyHeader("content-type", output.status == 200 ? __pulse_fastly_asset_content_type(key) : "text/plain; charset=utf-8")); const cacheHandle = __pulse_fastly_payload_field(payload, "cacheControl"); if (__pulse_fastly_value(cacheHandle).kind != PULSE_VALUE_UNDEFINED) output.headers.push(new __PulseFastlyHeader("cache-control", __pulse_fastly_string(cacheHandle))); const methodHandle = __pulse_fastly_payload_field(payload, "method"); const method = __pulse_fastly_value(methodHandle).kind == PULSE_VALUE_UNDEFINED ? "GET" : __pulse_fastly_string(methodHandle).toUpperCase(); if (output.status == 200 && method != "HEAD") { const text = __pulse_fastly_read_body(__pulse_fastly_out_value(bodyOut), effectIndex); if (__pulse_fastly_last_error != 0) return 0; output.text = __pulse_fastly_asset_text(text) } return __pulse_fastly_put(output) }` : '';
   const jwtCrypto = options.jwtCrypto || selectedJwtCrypto(plan);
   const es256KeyRecords = options.es256KeyRecords || Object.freeze([]);
   const jwtReality = options.jwtReality && options.jwtReality.enabled === true
@@ -1143,19 +1422,24 @@ function __pulse_fastly_jwt_attach_evidence(handle: i32): void {
   const value = __pulse_fastly_value(handle)
   if (value.kind == PULSE_VALUE_RESPONSE) __pulse_fastly_jwt_evidence_headers(value)
 }
-function __pulse_fastly_jwt_send_error(): void {
+`
+    : String.raw`
+function __pulse_fastly_jwt_attach_evidence(handle: i32): void { void handle }
+`;
+  // Keep the legacy hook name: body, fetch, header and deadline owners prepend
+  // their specific responses here. Every remaining fatal path needs a response,
+  // independently of whether JWT evidence was requested for this build.
+  const terminalErrorSource = `
+${lifecycle?.active ? `function __pulse_fastly_jwt_send_error(): void {\n${lifecycle.site('response-error')}\n  __pulse_fastly_jwt_send_error_impl()\n}\n` : ''}function ${lifecycle?.legacyName('__pulse_fastly_jwt_send_error') || '__pulse_fastly_jwt_send_error'}(): void {
   const output = new __PulseFastlyValue()
   output.kind = PULSE_VALUE_RESPONSE
-  output.status = 400
-  output.text = ""
+  output.status = ${jwtReality ? '__pulse_fastly_jwt_error != 0 ? 400 : 500' : '500'}
+  output.text = output.status == 400 ? "" : "Internal Server Error"
   output.headers.push(new __PulseFastlyHeader("content-type", "text/plain; charset=utf-8"))
-  __pulse_fastly_jwt_evidence_headers(output)
+  ${jwtReality ? 'if (__pulse_fastly_jwt_error != 0) __pulse_fastly_jwt_evidence_headers(output)' : ''}
+  // Do not clear the original failure or expose its detail in the response.
   __pulse_fastly_send_result(__pulse_fastly_put(output))
 }
-`
-    : String.raw`
-function __pulse_fastly_jwt_attach_evidence(handle: i32): void { void handle }
-function __pulse_fastly_jwt_send_error(): void {}
 `;
   const gripAuthentication = bindings.grip && bindings.grip.authentication;
   const gripSecretSource = gripAuthentication
@@ -1164,7 +1448,7 @@ function __pulse_fastly_jwt_send_error(): void {}
   const gripAuthorizationSource = gripAuthentication
     ? `const secret = __pulse_fastly_grip_secret(effectIndex, ${quote(gripAuthentication.secretRef)}); if (__pulse_fastly_last_error != 0) return; headers.keys.push("authorization"); headers.values.push(__pulse_fastly_string_value("Bearer " + secret));`
     : '';
-  return String.raw`
+  const source = String.raw`
 @external("fastly_abi", "init") declare function fastly_abi_init(version: i64): i32
 @external("fastly_http_req", "body_downstream_get") declare function fastly_http_req_body_downstream_get(requestOut: usize, bodyOut: usize): i32
 @external("fastly_http_req", "method_get") declare function fastly_http_req_method_get(handle: i32, buffer: usize, bufferLength: i32, writtenOut: usize): i32
@@ -1174,14 +1458,15 @@ function __pulse_fastly_jwt_send_error(): void {}
 @external("fastly_http_req", "method_set") declare function fastly_http_req_method_set(handle: i32, method: usize, methodLength: i32): i32
 @external("fastly_http_req", "uri_set") declare function fastly_http_req_uri_set(handle: i32, uri: usize, uriLength: i32): i32
 @external("fastly_http_req", "header_insert") declare function fastly_http_req_header_insert(handle: i32, name: usize, nameLength: i32, value: usize, valueLength: i32): i32
+@external("fastly_http_req", "header_append") declare function fastly_http_req_header_append(handle: i32, name: usize, nameLength: i32, value: usize, valueLength: i32): i32
 @external("fastly_http_req", "send_async") declare function fastly_http_req_send_async(handle: i32, body: i32, backend: usize, backendLength: i32, pendingOut: usize): i32
-@external("fastly_http_req", "pending_req_wait") declare function fastly_http_req_pending_req_wait(handle: i32, responseOut: usize, bodyOut: usize): i32
+@external("fastly_http_req", "pending_req_wait_v2") declare function fastly_http_req_pending_req_wait_v2(handle: i32, detail: usize, responseOut: usize, bodyOut: usize): i32
 @external("fastly_http_resp", "new") declare function fastly_http_resp_new(handleOut: usize): i32
 @external("fastly_http_resp", "header_append") declare function fastly_http_resp_header_append(handle: i32, name: usize, nameLength: i32, value: usize, valueLength: i32): i32
 @external("fastly_http_resp", "header_value_get") declare function fastly_http_resp_header_value_get(handle: i32, name: usize, nameLength: i32, value: usize, valueLength: i32, writtenOut: usize): i32
 @external("fastly_http_resp", "status_get") declare function fastly_http_resp_status_get(handle: i32, statusOut: usize): i32
 @external("fastly_http_resp", "status_set") declare function fastly_http_resp_status_set(handle: i32, status: i32): i32
-@external("fastly_http_resp", "send_downstream") declare function fastly_http_resp_send_downstream(handle: i32, body: i32, streaming: i32): i32
+@external("fastly_http_resp", "send_downstream") declare function ${lifecycle?.authority ? '__pulse_response_send_raw' : 'fastly_http_resp_send_downstream'}(handle: i32, body: i32, streaming: i32): i32
 @external("fastly_http_body", "new") declare function fastly_http_body_new(handleOut: usize): i32
 @external("fastly_http_body", "read") declare function fastly_http_body_read(handle: i32, buffer: usize, bufferLength: i32, readOut: usize): i32
 @external("fastly_http_body", "write") declare function fastly_http_body_write(handle: i32, buffer: usize, bufferLength: i32, end: i32, writtenOut: usize): i32
@@ -1195,8 +1480,11 @@ function __pulse_fastly_jwt_send_error(): void {}
 @external("fastly_kv_store", "lookup_wait_v2") declare function fastly_kv_store_lookup_wait_v2(handle: i32, bodyOut: usize, metadata: usize, metadataLength: i32, writtenOut: usize, generationOut: usize, kvErrorOut: usize): i32
 @external("fastly_kv_store", "insert") declare function fastly_kv_store_insert(store: i32, key: usize, keyLength: i32, body: i32, configMask: i32, config: usize, insertOut: usize): i32
 @external("fastly_kv_store", "insert_wait") declare function fastly_kv_store_insert_wait(handle: i32, kvErrorOut: usize): i32
-@external("fastly_log", "endpoint_get") declare function fastly_log_endpoint_get(name: usize, nameLength: i32, handleOut: usize): i32
-@external("fastly_log", "write") declare function fastly_log_write(handle: i32, message: usize, messageLength: i32, writtenOut: usize): i32
+@external("fastly_kv_store", "delete") declare function fastly_kv_store_delete(store: i32, key: usize, keyLength: i32, configMask: i32, config: usize, pendingOut: usize): i32
+@external("fastly_kv_store", "delete_wait") declare function fastly_kv_store_delete_wait(handle: i32, kvErrorOut: usize): i32
+@external("fastly_kv_store", "list") declare function fastly_kv_store_list(store: i32, configMask: i32, config: usize, pendingOut: usize): i32
+@external("fastly_kv_store", "list_wait") declare function fastly_kv_store_list_wait(handle: i32, bodyOut: usize, kvErrorOut: usize): i32
+${nativeLoggingSource(bindings.logEndpoint)}
 @external("wasi_snapshot_preview1", "clock_time_get") declare function wasi_snapshot_preview1_clock_time_get(clockId: i32, precision: i64, timeOut: usize): i32
 
 const PULSE_FASTLY_EFFECTS_ABI_VERSION: i64 = ${FASTLY_NATIVE_PLATFORM_CAPABILITIES_ABI_VERSION}
@@ -1233,20 +1521,43 @@ const PULSE_ERROR_SCHEMA: i32 = 1005
 const PULSE_ERROR_TRANSPORT: i32 = 1006
 const PULSE_ERROR_STATE: i32 = 1007
 const PULSE_ERROR_JWT: i32 = 1008
+const PULSE_ERROR_REQUEST_BODY: i32 = 1009
 
 class __PulseFastlyValue {
+  ${tracksJsonDuplicates(plan) ? 'duplicateJsonKeys: bool = false' : ''}
   kind: i32 = PULSE_VALUE_UNDEFINED
   boolean: i32 = 0
   number: f64 = 0.0
-  text: string = ""
-  keys: Array<string> = new Array<string>()
-  values: Array<i32> = new Array<i32>()
+${nativeStringFields}
+  // Scalar handles do not need collection backing stores.
+  private keysStorage: Array<string> | null = null
+  get keys(): Array<string> {
+    if (this.keysStorage === null) this.keysStorage = new Array<string>()
+    return this.keysStorage!
+  }
+  // Scalar handles do not need collection backing stores.
+  private valuesStorage: Array<i32> | null = null
+  get values(): Array<i32> {
+    if (this.valuesStorage === null) this.valuesStorage = new Array<i32>()
+    return this.valuesStorage!
+  }
   responseHandle: i32 = 0
   bodyHandle: i32 = 0
+${options.fetchAccounting?.selection === 'canonical-fetch-cohorts' ? '  fetchHeaders: Array<__FCA_Header> | null = null;\n  fetchJsonType: i32 = 0;' : ''}
   bodyLoaded: i32 = 0
+  s3Body: bool = false
+  s3Deadline: i64 = 0
+  s3Length: i32 = 0
   status: i32 = 200
-  headers: Array<__PulseFastlyHeader> = new Array<__PulseFastlyHeader>()
+  // Scalar handles do not need collection backing stores.
+  private headersStorage: Array<__PulseFastlyHeader> | null = null
+  get headers(): Array<__PulseFastlyHeader> {
+    if (this.headersStorage === null) this.headersStorage = new Array<__PulseFastlyHeader>()
+    return this.headersStorage!
+  }
+  binaryBody: Uint8Array | null = null
   immutable: bool = false
+${nativeHandleOwnership.fields(options.handleTracing)}
 }
 class __PulseFastlyHeader {
   constructor(public name: string, public value: string) {}
@@ -1255,11 +1566,14 @@ class __PulseJsonParser {
   source: string
   index: i32 = 0
   failed: bool = false
-  constructor(source: string) { this.source = source }
+  tooLarge: bool = false
+  entries: i32 = 0
+  constructor(source: string, public conditionalKv: bool = false) { this.source = source }
   skip(): void { while (this.index < this.source.length) { const c = this.source.charCodeAt(this.index); if (c != 32 && c != 9 && c != 10 && c != 13) return; this.index += 1 } }
   parse(): i32 { this.skip(); const value = this.value(0); this.skip(); if (this.index != this.source.length) this.failed = true; return this.failed ? 0 : value }
   value(depth: i32): i32 {
-    this.skip(); if (this.index >= this.source.length || depth > 64) { this.failed = true; return 0 }
+    this.skip(); if (this.conditionalKv && (depth > ${conditionalKv.KV_CONDITIONAL_LIMITS.depth + 1} || ++this.entries > ${conditionalKv.KV_CONDITIONAL_LIMITS.entries + 2})) { this.failed = true; this.tooLarge = true; return 0 }
+    if (this.index >= this.source.length || (!this.conditionalKv && depth > ${schemaParserDepth(plan, plan.effects.some(effect => conditionalKv.KV_CONDITIONAL_KINDS.includes(effect.kind)) ? 128 : 64)})) { this.failed = true; return 0 }
     const c = this.source.charCodeAt(this.index)
     if (c == 34) return __pulse_fastly_string_value(this.string())
     if (c == 123) return this.object(depth + 1)
@@ -1271,37 +1585,47 @@ class __PulseJsonParser {
     this.failed = true; return 0
   }
   string(): string {
-    let output = ""; this.index += 1
-    while (this.index < this.source.length) {
-      let c = this.source.charCodeAt(this.index); this.index += 1
-      if (c == 34) return output
+    // Find a bounded span, then decode each UTF-16 unit once. Concatenating one
+    // character at a time exhausts stub/fixed memory on a valid maximum KV value.
+    const start = this.index + 1; let end = start; let plain = true;
+    while (end < this.source.length) {
+      const c = this.source.charCodeAt(end);
+      if (c == 34) break;
+      if (c == 92) { plain = false; end += 1; }
+      else if (c < 32) plain = false;
+      end += 1;
+    }
+    if (end >= this.source.length) { this.failed = true; return "" }
+    // A validated span needs one owned string, without a temporary UTF-16 array.
+    // Keep escaped and malformed spans on the existing decoder path.
+    if (plain) { this.index = end + 1; return this.source.substring(start, end); }
+    const output = new Uint16Array(end - start); let count = 0; this.index = start;
+    while (this.index < end) {
+      let c = this.source.charCodeAt(this.index++);
       if (c == 92) {
-        if (this.index >= this.source.length) { this.failed = true; return "" }
-        c = this.source.charCodeAt(this.index); this.index += 1
-        if (c == 34 || c == 92 || c == 47) output += String.fromCharCode(c)
-        else if (c == 98) output += String.fromCharCode(8)
-        else if (c == 102) output += String.fromCharCode(12)
-        else if (c == 110) output += "\n"
-        else if (c == 114) output += "\r"
-        else if (c == 116) output += "\t"
+        if (this.index >= end) { this.failed = true; return "" }
+        c = this.source.charCodeAt(this.index++);
+        if (c == 34 || c == 92 || c == 47) {}
+        else if (c == 98) c = 8;
+        else if (c == 102) c = 12;
+        else if (c == 110) c = 10;
+        else if (c == 114) c = 13;
+        else if (c == 116) c = 9;
         else if (c == 117) {
-          if (this.index + 4 > this.source.length) { this.failed = true; return "" }
-          let code = 0
-          for (let digitIndex = 0; digitIndex < 4; digitIndex += 1) {
-            const digitCode = this.source.charCodeAt(this.index + digitIndex)
-            let digit = -1
-            if (digitCode >= 48 && digitCode <= 57) digit = digitCode - 48
-            else if (digitCode >= 65 && digitCode <= 70) digit = digitCode - 55
-            else if (digitCode >= 97 && digitCode <= 102) digit = digitCode - 87
+          if (this.index + 4 > end) { this.failed = true; return "" }
+          c = 0;
+          for (let i = 0; i < 4; i++) {
+            const d = this.source.charCodeAt(this.index++);
+            const digit = d >= 48 && d <= 57 ? d - 48 : d >= 65 && d <= 70 ? d - 55 : d >= 97 && d <= 102 ? d - 87 : -1;
             if (digit < 0) { this.failed = true; return "" }
-            code = (code << 4) | digit
+            c = (c << 4) | digit;
           }
-          this.index += 4; output += String.fromCharCode(code)
         } else { this.failed = true; return "" }
       } else if (c < 32) { this.failed = true; return "" }
-      else output += String.fromCharCode(c)
+      output[count++] = u16(c);
     }
-    this.failed = true; return ""
+    this.index = end + 1;
+    return String.UTF16.decodeUnsafe(output.dataStart, count * 2);
   }
   numberValue(): i32 {
     const start = this.index
@@ -1350,7 +1674,9 @@ class __PulseJsonParser {
     while (!this.failed) {
       this.skip(); if (this.index >= this.source.length || this.source.charCodeAt(this.index) != 34) { this.failed = true; break }
       const key = this.string(); this.skip()
+      if (this.conditionalKv && __pulse_fastly_find(__pulse_fastly_value(output), key) >= 0) { this.failed = true; break }
       if (this.index >= this.source.length || this.source.charCodeAt(this.index) != 58) { this.failed = true; break }
+      ${tracksJsonDuplicates(plan) ? 'if (__pulse_fastly_find(__pulse_fastly_value(output), key) >= 0) __pulse_fastly_value(output).duplicateJsonKeys = true' : ''}
       this.index += 1; host_value_object_set(output, __pulse_fastly_string_value(key), this.value(depth)); this.skip()
       if (this.index >= this.source.length) { this.failed = true; break }
       const c = this.source.charCodeAt(this.index); this.index += 1
@@ -1364,13 +1690,20 @@ class __PulseJsonParser {
 const PULSE_FASTLY_PENDING_NONE: i32 = 0
 const PULSE_FASTLY_PENDING_ASYNC: i32 = 1
 const PULSE_FASTLY_PENDING_READY: i32 = 2
-@lazy const __pulse_fastly_values = new Array<__PulseFastlyValue>()
+${nativeHandleOwnership.tableSource(options.handleTracing)}
+// Primitive handles have value semantics. Bounded caches keep admitted scalar
+// validation loops from retaining a fresh boxed value for every iteration.
+@lazy const __pulse_fastly_scalar_handles = new StaticArray<i32>(4)
+@lazy const __pulse_fastly_integer_handles = new StaticArray<i32>(65536)
+@lazy const __pulse_fastly_character_handles = new StaticArray<i32>(65537)
+@lazy const __pulse_fastly_literal_handles = new Map<string, i32>()
 @lazy const __pulse_fastly_pending = new StaticArray<i32>(PULSE_FASTLY_EFFECT_COUNT)
 @lazy const __pulse_fastly_pending_mode = new StaticArray<i32>(PULSE_FASTLY_EFFECT_COUNT)
 @lazy const __pulse_fastly_payloads = new StaticArray<i32>(PULSE_FASTLY_EFFECT_COUNT)
 @lazy const __pulse_fastly_ready = new StaticArray<i32>(PULSE_FASTLY_EFFECT_COUNT)
 @lazy const __pulse_fastly_grip_channels = new Array<string>()
 @lazy const __pulse_fastly_redactions = new Array<string>()
+@lazy const __pulse_fastly_field_redactions = new Array<string>()
 let __pulse_fastly_request_handle: i32 = 0
 let __pulse_fastly_request_body_handle: i32 = 0
 let __pulse_fastly_request_method: string = ""
@@ -1381,7 +1714,6 @@ let __pulse_fastly_request_body_loaded: i32 = 0
 let __pulse_fastly_last_error: i32 = 0
 let __pulse_fastly_error_stage: i32 = 0
 let __pulse_fastly_error_effect: i32 = -1
-let __pulse_fastly_log_handle: i32 = -1
 let __pulse_fastly_jwt_error: i32 = 0
 let __pulse_fastly_jwt_secret_calls: i32 = 0
 let __pulse_fastly_jwt_crypto_calls: i32 = 0
@@ -1398,57 +1730,168 @@ function __pulse_fastly_out_i32(): StaticArray<i32> { return new StaticArray<i32
 function __pulse_fastly_out_value(out: StaticArray<i32>): i32 { return load<i32>(changetype<usize>(out)) }
 function __pulse_fastly_utf8(value: string): ArrayBuffer { return String.UTF8.encode(value, false) }
 function __pulse_fastly_decode(buffer: Uint8Array, length: i32): string { return String.UTF8.decodeUnsafe(buffer.dataStart, length, false) }
-function __pulse_fastly_put(value: __PulseFastlyValue): i32 { __pulse_fastly_values.push(value); return __pulse_fastly_values.length }
-function __pulse_fastly_value(handle: i32): __PulseFastlyValue { if (handle <= 0 || handle > __pulse_fastly_values.length) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 1, -1); return new __PulseFastlyValue() } return unchecked(__pulse_fastly_values[handle - 1]) }
+${nativeStringAssembly}
+${nativeStringConcat}
+${nativeStringTrim}
+${nativeStringIndex}
 function __pulse_fastly_deep_freeze(handle: i32): void { const value = __pulse_fastly_value(handle); if (value.immutable) return; value.immutable = true; if (value.kind == PULSE_VALUE_ARRAY || value.kind == PULSE_VALUE_OBJECT) for (let index = 0; index < value.values.length; index += 1) __pulse_fastly_deep_freeze(unchecked(value.values[index])) }
-function __pulse_fastly_string_value(value: string): i32 { const item = new __PulseFastlyValue(); item.kind = PULSE_VALUE_STRING; item.text = value; return __pulse_fastly_put(item) }
+function __pulse_fastly_string_value(value: string): i32 {
+  const index = value.length == 0 ? 65536 : value.length == 1 ? value.charCodeAt(0) : -1;
+  if (index >= 0) { const cached = unchecked(__pulse_fastly_character_handles[index]); if (cached != 0) return cached }
+  const item = new __PulseFastlyValue(); item.kind = PULSE_VALUE_STRING; item.text = value;
+  const handle = __pulse_fastly_put(item);
+  if (index >= 0) { unchecked(__pulse_fastly_character_handles[index] = handle); ${options.handleTracing ? 'if (handle != 0) __pulse_handle_cache_roots.push(handle);' : ''} }
+  return handle
+}
 function __pulse_fastly_find(object: __PulseFastlyValue, key: string): i32 { for (let i = 0; i < object.keys.length; i += 1) if (unchecked(object.keys[i]) == key) return i; return -1 }
 function __pulse_fastly_number_string(value: f64): string { if (value >= -9007199254740991.0 && value <= 9007199254740991.0 && Math.floor(value) == value) return i64(value).toString(); return value.toString() }
 function __pulse_fastly_string(handle: i32): string { const value = __pulse_fastly_value(handle); if (value.kind == PULSE_VALUE_STRING) return value.text; if (value.kind == PULSE_VALUE_NUMBER) return __pulse_fastly_number_string(value.number); if (value.kind == PULSE_VALUE_BOOLEAN) return value.boolean != 0 ? "true" : "false"; if (value.kind == PULSE_VALUE_NULL) return "null"; if (value.kind == PULSE_VALUE_UNDEFINED) return "undefined"; return __pulse_fastly_json(handle, 0) }
-function __pulse_fastly_remember_secret(value: string): string { if (value.length == 0) return value; for (let i = 0; i < __pulse_fastly_redactions.length; i += 1) if (unchecked(__pulse_fastly_redactions[i]) == value) return value; __pulse_fastly_redactions.push(value); return value }
+function __pulse_fastly_remember_secret(value: string, field: bool = false): string { if (value.length == 0) return value; const values = field ? __pulse_fastly_field_redactions : __pulse_fastly_redactions; for (let i = 0; i < values.length; i += 1) if (unchecked(values[i]) == value) return value; values.push(value); return value }
 function __pulse_fastly_replace_secret(input: string, secret: string): string { if (secret.length == 0) return input; let source = input; let output = ""; while (true) { const index = source.indexOf(secret); if (index < 0) return output + source; output += source.substring(0, index) + "<redacted>"; source = source.substring(index + secret.length) } }
-function __pulse_fastly_redact(input: string): string { let output = input; for (let i = 0; i < __pulse_fastly_redactions.length; i += 1) output = __pulse_fastly_replace_secret(output, unchecked(__pulse_fastly_redactions[i])); return output }
-function host_log(level: i32, messageHandle: i32): void { let endpoint = __pulse_fastly_log_handle; if (endpoint == -2) return; if (endpoint == -1) { const name = __pulse_fastly_utf8("stdout"); const out = __pulse_fastly_out_i32(); if (fastly_log_endpoint_get(changetype<usize>(name), name.byteLength, changetype<usize>(out)) != FASTLY_STATUS_OK) { __pulse_fastly_log_handle = -2; return } endpoint = __pulse_fastly_out_value(out); __pulse_fastly_log_handle = endpoint } let label = "unknown"; if (level == 1) label = "error"; else if (level == 2) label = "warn"; else if (level == 3) label = "info"; else if (level == 4) label = "debug"; const bytes = __pulse_fastly_utf8("[pulse:" + label + "] " + __pulse_fastly_redact(__pulse_fastly_string(messageHandle)) + "\n"); const written = __pulse_fastly_out_i32(); fastly_log_write(endpoint, changetype<usize>(bytes), bytes.byteLength, changetype<usize>(written)) }
+// Walk complete JSON string tokens, including escaped quotes. Substring matching
+// a quoted field would still corrupt an unrelated token such as "prefix\\\"id".
+function __pulse_fastly_redact_fields(input: string): string {
+  if (__pulse_fastly_field_redactions.length == 0) return input;
+  let output = "", start = 0, cursor = 0;
+  while (cursor < input.length) {
+    if (input.charCodeAt(cursor) != 34) { cursor += 1; continue; }
+    const begin = cursor++;
+    while (cursor < input.length) {
+      const code = input.charCodeAt(cursor++);
+      if (code == 92 && cursor < input.length) cursor += 1;
+      else if (code == 34) break;
+    }
+    const token = input.substring(begin, cursor);
+    for (let i = 0; i < __pulse_fastly_field_redactions.length; i += 1) {
+      if (token != unchecked(__pulse_fastly_field_redactions[i])) continue;
+      output += input.substring(start, begin) + __pulse_fastly_quote("<redacted>");
+      start = cursor; break;
+    }
+  }
+  return output + input.substring(start);
+}
+function __pulse_fastly_redact(input: string): string { let output = __pulse_fastly_redact_fields(input); for (let i = 0; i < __pulse_fastly_redactions.length; i += 1) output = __pulse_fastly_replace_secret(output, unchecked(__pulse_fastly_redactions[i])); return output }
+function host_log(level: i32, messageHandle: i32): void { let label = "unknown"; if (level == 1) label = "error"; else if (level == 2) label = "warn"; else if (level == 3) label = "info"; else if (level == 4) label = "debug"; const bytes = __pulse_fastly_utf8("[pulse:" + label + "] " + __pulse_fastly_redact(__pulse_fastly_string(messageHandle)) + "\n"); __pulse_fastly_write_stdout(bytes) }
 function __pulse_fastly_number(handle: i32): f64 { const value = __pulse_fastly_value(handle); if (value.kind == PULSE_VALUE_NUMBER) return value.number; if (value.kind == PULSE_VALUE_BOOLEAN) return value.boolean != 0 ? 1.0 : 0.0; if (value.kind == PULSE_VALUE_STRING) return F64.parseFloat(value.text); return 0.0 }
 function __pulse_fastly_hex(value: i32): string { return String.fromCharCode(value < 10 ? 48 + value : 87 + value) }
-function __pulse_fastly_quote(value: string): string { let out = "\""; for (let i = 0; i < value.length; i += 1) { const c = value.charCodeAt(i); if (c == 34) out += "\\\""; else if (c == 92) out += "\\\\"; else if (c == 8) out += "\\b"; else if (c == 9) out += "\\t"; else if (c == 10) out += "\\n"; else if (c == 12) out += "\\f"; else if (c == 13) out += "\\r"; else if (c < 32) out += "\\u00" + __pulse_fastly_hex((c >> 4) & 15) + __pulse_fastly_hex(c & 15); else out += String.fromCharCode(c) } return out + "\"" }
-function __pulse_fastly_json(handle: i32, depth: i32): string {
-  if (depth > 64) { __pulse_fastly_fail(PULSE_ERROR_JSON, 2, -1); return "null" }
+function __pulse_fastly_is_unpaired(value: string, i: i32): bool {
+  const c = value.charCodeAt(i);
+  if (c >= 0xd800 && c <= 0xdbff) return i + 1 >= value.length || value.charCodeAt(i + 1) < 0xdc00 || value.charCodeAt(i + 1) > 0xdfff;
+  if (c >= 0xdc00 && c <= 0xdfff) return i == 0 || value.charCodeAt(i - 1) < 0xd800 || value.charCodeAt(i - 1) > 0xdbff;
+  return false;
+}
+function __pulse_fastly_quote(value: string): string {
+  // Count once and write UTF-16 units once. Repeated concatenation can allocate
+  // gigabytes for a valid bounded string when every byte needs JSON escaping.
+  let size = 2;
+  for (let i = 0; i < value.length; i++) {
+    const c = value.charCodeAt(i);
+    size += c == 34 || c == 92 || c == 8 || c == 9 || c == 10 || c == 12 || c == 13 ? 2 : (c < 32 || __pulse_fastly_is_unpaired(value, i)) ? 6 : 1;
+  }
+  const out = new Uint16Array(size); let cursor = 0; out[cursor++] = 34;
+  for (let i = 0; i < value.length; i++) {
+    const c = value.charCodeAt(i);
+    if (c == 34 || c == 92) { out[cursor++] = 92; out[cursor++] = u16(c); }
+    else if (c == 8 || c == 9 || c == 10 || c == 12 || c == 13) {
+      out[cursor++] = 92; out[cursor++] = c == 8 ? 98 : c == 9 ? 116 : c == 10 ? 110 : c == 12 ? 102 : 114;
+    } else if (c < 32 || __pulse_fastly_is_unpaired(value, i)) {
+      out[cursor++] = 92; out[cursor++] = 117;
+      out[cursor++] = u16('0123456789abcdef'.charCodeAt((c >> 12) & 15)); out[cursor++] = u16('0123456789abcdef'.charCodeAt((c >> 8) & 15));
+      out[cursor++] = u16('0123456789abcdef'.charCodeAt((c >> 4) & 15)); out[cursor++] = u16('0123456789abcdef'.charCodeAt(c & 15));
+    } else out[cursor++] = u16(c);
+  }
+  out[cursor] = 34;
+  return String.UTF16.decodeUnsafe(out.dataStart, out.byteLength);
+}
+function __pulse_fastly_json_parts(handle: i32, depth: i32, parts: Array<string>): void {
+  if (depth > ${schemaParserDepth(plan, plan.effects.some(effect => conditionalKv.KV_CONDITIONAL_KINDS.includes(effect.kind)) ? 128 : 64)}) { __pulse_fastly_fail(PULSE_ERROR_JSON, 2, -1); parts.push("null"); return }
   const value = __pulse_fastly_value(handle)
-  if (value.kind == PULSE_VALUE_UNDEFINED || value.kind == PULSE_VALUE_NULL) return "null"
-  if (value.kind == PULSE_VALUE_BOOLEAN) return value.boolean != 0 ? "true" : "false"
-  if (value.kind == PULSE_VALUE_NUMBER) return __pulse_fastly_number_string(value.number)
-  if (value.kind == PULSE_VALUE_STRING) return __pulse_fastly_quote(value.text)
-  if (value.kind == PULSE_VALUE_ARRAY) { let out = "["; for (let i = 0; i < value.values.length; i += 1) { if (i > 0) out += ","; out += __pulse_fastly_json(unchecked(value.values[i]), depth + 1) } return out + "]" }
-  if (value.kind == PULSE_VALUE_OBJECT) { let out = "{"; for (let i = 0; i < value.keys.length; i += 1) { if (i > 0) out += ","; out += __pulse_fastly_quote(unchecked(value.keys[i])) + ":" + __pulse_fastly_json(unchecked(value.values[i]), depth + 1) } return out + "}" }
-  return "null"
+  if (value.kind == PULSE_VALUE_BOOLEAN) { parts.push(value.boolean != 0 ? "true" : "false"); return }
+  if (value.kind == PULSE_VALUE_NUMBER) { parts.push(__pulse_fastly_number_string(value.number)); return }
+  if (value.kind == PULSE_VALUE_STRING) { parts.push(__pulse_fastly_quote(value.text)); return }
+  if (value.kind == PULSE_VALUE_ARRAY) { parts.push("["); for (let i = 0; i < value.values.length; i += 1) { if (i > 0) parts.push(","); __pulse_fastly_json_parts(unchecked(value.values[i]), depth + 1, parts) } parts.push("]"); return }
+  if (value.kind == PULSE_VALUE_OBJECT) { parts.push("{"); for (let i = 0; i < value.keys.length; i += 1) { if (i > 0) parts.push(","); parts.push(__pulse_fastly_quote(unchecked(value.keys[i]))); parts.push(":"); __pulse_fastly_json_parts(unchecked(value.values[i]), depth + 1, parts) } parts.push("}"); return }
+  parts.push("null")
+}
+function __pulse_fastly_json(handle: i32, depth: i32): string {
+  // Join once, avoiding a complete copy of a multi-MiB leaf at every ancestor
+  // and at every following member in the response or effect result.
+  const parts = new Array<string>(); __pulse_fastly_json_parts(handle, depth, parts);
+  return __pulse_fastly_join_strings(parts)
 }
 function __pulse_fastly_parse_json(text: string): i32 { const parser = new __PulseJsonParser(text); const value = parser.parse(); if (parser.failed || value <= 0) { __pulse_fastly_fail(PULSE_ERROR_JSON, 3, -1); return 0 } return value }
 function __pulse_fastly_path(uri: string): string { let start = 0; const scheme = uri.indexOf("://"); if (scheme >= 0) { const slash = uri.indexOf("/", scheme + 3); start = slash >= 0 ? slash : uri.length } let end = uri.length; const query = uri.indexOf("?", start); if (query >= 0 && query < end) end = query; const fragment = uri.indexOf("#", start); if (fragment >= 0 && fragment < end) end = fragment; return start >= end ? "/" : uri.substring(start, end) }
-function __pulse_fastly_read_req_string(kind: i32): string { const buffer = new Uint8Array(PULSE_FASTLY_BUFFER_BYTES); const written = __pulse_fastly_out_i32(); const status = kind == 0 ? fastly_http_req_method_get(__pulse_fastly_request_handle, buffer.dataStart, PULSE_FASTLY_BUFFER_BYTES, changetype<usize>(written)) : fastly_http_req_uri_get(__pulse_fastly_request_handle, buffer.dataStart, PULSE_FASTLY_BUFFER_BYTES, changetype<usize>(written)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 10 + kind, -1); return "" } return __pulse_fastly_decode(buffer, __pulse_fastly_out_value(written)) }
-function __pulse_fastly_read_body(handle: i32, effectIndex: i32): string { let out = ""; let total = 0; while (true) { const buffer = new Uint8Array(PULSE_FASTLY_BUFFER_BYTES); const read = __pulse_fastly_out_i32(); const status = fastly_http_body_read(handle, buffer.dataStart, PULSE_FASTLY_BUFFER_BYTES, changetype<usize>(read)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 20, effectIndex); return "" } const count = __pulse_fastly_out_value(read); if (count <= 0) return out; total += count; if (total > __PULSE_SCHEMA_MAX_BYTES && __PULSE_SCHEMA_MAX_BYTES > 0) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 21, effectIndex); return "" } out += __pulse_fastly_decode(buffer, count) } }
-function __pulse_fastly_request_header_text(name: string): string { const nameBytes = __pulse_fastly_utf8(name); const buffer = new Uint8Array(PULSE_FASTLY_BUFFER_BYTES); const written = __pulse_fastly_out_i32(); const status = fastly_http_req_header_value_get(__pulse_fastly_request_handle, changetype<usize>(nameBytes), nameBytes.byteLength, buffer.dataStart, PULSE_FASTLY_BUFFER_BYTES, changetype<usize>(written)); if (status == FASTLY_STATUS_NONE) return ""; if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 22, -1); return "" } return __pulse_fastly_decode(buffer, __pulse_fastly_out_value(written)) }
-function __pulse_fastly_fetch_header_text(responseHandle: i32, name: string): string { const nameBytes = __pulse_fastly_utf8(name); const buffer = new Uint8Array(PULSE_FASTLY_BUFFER_BYTES); const written = __pulse_fastly_out_i32(); const status = fastly_http_resp_header_value_get(responseHandle, changetype<usize>(nameBytes), nameBytes.byteLength, buffer.dataStart, PULSE_FASTLY_BUFFER_BYTES, changetype<usize>(written)); if (status == FASTLY_STATUS_NONE) return ""; if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 23, -1); return "" } return __pulse_fastly_decode(buffer, __pulse_fastly_out_value(written)) }
+function __pulse_fastly_read_req_string(kind: i32): string { const buffer = new Uint8Array(PULSE_FASTLY_BUFFER_BYTES); const written = __pulse_fastly_out_i32(); const status = kind == 0 ? fastly_http_req_method_get(__pulse_fastly_request_handle, buffer.dataStart, PULSE_FASTLY_BUFFER_BYTES, changetype<usize>(written)) : fastly_http_req_uri_get(__pulse_fastly_request_handle, buffer.dataStart, PULSE_FASTLY_BUFFER_BYTES, changetype<usize>(written)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 10 + kind, -1); return "" } ${options.fetchAccounting?.selection === 'canonical-fetch-cohorts' ? 'if (__pulse_fastly_out_value(written)<0 || __pulse_fastly_out_value(written)>buffer.byteLength) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL,10+kind,-1);return ""; }' : ''} return __pulse_fastly_decode(buffer, __pulse_fastly_out_value(written)) }
+function __pulse_fastly_read_body(handle: i32, effectIndex: i32, requestText: bool = false): string {
+  // One retained input allocation, including a byte to distinguish exact-limit
+  // EOF from overflow. Short reads never allocate another chunk or prefix.
+  if (__PULSE_SCHEMA_MAX_BYTES <= 0 || __PULSE_SCHEMA_MAX_BYTES > 1073741823) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 21, effectIndex); return "" }
+  const bytes = new Uint8Array(__PULSE_SCHEMA_MAX_BYTES + 1), read = __pulse_fastly_out_i32();
+  let total = 0;
+  while (true) {
+    if (!__pulse_fastly_body_read_ready(handle, effectIndex)) return "";
+    const capacity = min<i32>(PULSE_FASTLY_BUFFER_BYTES, bytes.length - total);
+    const status = fastly_http_body_read(handle, bytes.dataStart + total, capacity, changetype<usize>(read));
+    if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 20, effectIndex); return "" }
+    const count = __pulse_fastly_out_value(read);
+    if (count < 0 || count > capacity) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 20, effectIndex); return "" }
+    if (!count) break;
+    total += count;
+    if (total > __PULSE_SCHEMA_MAX_BYTES) { __pulse_fastly_fail(requestText ? PULSE_ERROR_REQUEST_BODY : PULSE_ERROR_SCHEMA, 21, effectIndex); return "" }
+  }
+  // UTF-8 scalars may straddle host read chunks. Decode the bounded body once.
+  if (requestText && !__pulse_request_utf8_valid(bytes, total)) { __pulse_fastly_fail(PULSE_ERROR_REQUEST_BODY, 24, effectIndex); return "" }
+  return __pulse_fastly_decode(bytes, total);
+}
+function __pulse_fastly_body_read_ready(handle: i32, effectIndex: i32): bool { return true }
+function __pulse_fastly_request_header_text(name: string): string { const value = __pulse_header_lookup(__pulse_fastly_request_handle, name, false); return value === null ? "" : value }
+function __pulse_fastly_fetch_header_text(responseHandle: i32, name: string): string { const value = __pulse_header_lookup(responseHandle, name, true); return value === null ? "" : value }
 function __pulse_fastly_fetch_body(value: __PulseFastlyValue): string { if (value.bodyLoaded == 0) { value.text = __pulse_fastly_read_body(value.bodyHandle, -1); value.bodyLoaded = 1 } return value.text }
 
-function host_value_undefined(): i32 { const item = new __PulseFastlyValue(); item.kind = PULSE_VALUE_UNDEFINED; return __pulse_fastly_put(item) }
-function host_value_null(): i32 { const item = new __PulseFastlyValue(); item.kind = PULSE_VALUE_NULL; return __pulse_fastly_put(item) }
-function host_value_boolean(value: i32): i32 { const item = new __PulseFastlyValue(); item.kind = PULSE_VALUE_BOOLEAN; item.boolean = value != 0 ? 1 : 0; return __pulse_fastly_put(item) }
-function host_value_number(value: f64): i32 { const item = new __PulseFastlyValue(); item.kind = PULSE_VALUE_NUMBER; item.number = value; return __pulse_fastly_put(item) }
-function host_value_string(pointer: i32, length: i32): i32 { return __pulse_fastly_string_value(changetype<string>(pointer)) }
+function __pulse_fastly_scalar(kind: i32, boolean: i32, slot: i32): i32 {
+  const cached = unchecked(__pulse_fastly_scalar_handles[slot]); if (cached != 0) return cached;
+  const item = new __PulseFastlyValue(); item.kind = kind; item.boolean = boolean;
+  const handle = __pulse_fastly_put(item); unchecked(__pulse_fastly_scalar_handles[slot] = handle); ${options.handleTracing ? 'if (handle != 0) __pulse_handle_cache_roots.push(handle);' : ''} return handle
+}
+function host_value_undefined(): i32 { return __pulse_fastly_scalar(PULSE_VALUE_UNDEFINED, 0, 0) }
+function host_value_null(): i32 { return __pulse_fastly_scalar(PULSE_VALUE_NULL, 0, 1) }
+function host_value_boolean(value: i32): i32 { return __pulse_fastly_scalar(PULSE_VALUE_BOOLEAN, value != 0 ? 1 : 0, value != 0 ? 3 : 2) }
+${plan.callables?.length || plan.binaryResources || plan.numericWorkspaces?.length ? require('./native-binary-resources.js').source() : ''}
+function host_value_number(value: f64): i32 {
+  // Preserve negative zero, NaN, infinities and nonintegral values exactly.
+  const cacheable = value >= 0 && value < 65536 && Math.floor(value) == value && (value != 0 || 1.0 / value > 0);
+  const index = cacheable ? i32(value) : -1;
+  if (index >= 0) { const cached = unchecked(__pulse_fastly_integer_handles[index]); if (cached != 0) return cached }
+  const item = new __PulseFastlyValue(); item.kind = PULSE_VALUE_NUMBER; item.number = value;
+  const handle = __pulse_fastly_put(item); if (index >= 0) { unchecked(__pulse_fastly_integer_handles[index] = handle); ${options.handleTracing ? 'if (handle != 0) __pulse_handle_cache_roots.push(handle);' : ''} } return handle
+}
+function host_value_string(pointer: i32, length: i32): i32 {
+  const text = changetype<string>(pointer);
+  if (text.length > 1 && text.length <= 128 && __pulse_fastly_literal_handles.has(text)) return __pulse_fastly_literal_handles.get(text);
+  const handle = __pulse_fastly_string_value(text);
+  if (text.length > 1 && text.length <= 128 && __pulse_fastly_literal_handles.size < 1024) { __pulse_fastly_literal_handles.set(text, handle); ${options.handleTracing ? 'if (handle != 0) __pulse_handle_cache_roots.push(handle);' : ''} }
+  return handle
+}
+function host_effect_collection_count(handle: i32, max: i32, stateIndex: i32): i32 {
+  const input = __pulse_fastly_value(handle)
+  if (__pulse_fastly_last_error != 0 || input.kind != PULSE_VALUE_ARRAY || max < 1 || max > 32) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 173, -1); return -1 }
+  if (input.values.length > max) { __pulse_fastly_fail(PULSE_ERROR_STATE, 172, -1); return -1 }
+  if (__pulse_invocation_count + input.values.length > PULSE_FASTLY_MAX_EFFECT_INVOCATIONS) { __pulse_fastly_fail(PULSE_ERROR_STATE, 170, -1); return -1 }
+  return input.values.length
+}
 function host_value_array(): i32 { const item = new __PulseFastlyValue(); item.kind = PULSE_VALUE_ARRAY; return __pulse_fastly_put(item) }
 function host_value_array_push(target: i32, value: i32): void { const item = __pulse_fastly_value(target); if (item.kind != PULSE_VALUE_ARRAY || item.immutable) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 30, -1); return } item.values.push(value) }
 function host_value_array_spread(target: i32, source: i32): void { const from = __pulse_fastly_value(source); if (from.kind != PULSE_VALUE_ARRAY) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 31, -1); return } for (let i = 0; i < from.values.length; i += 1) host_value_array_push(target, unchecked(from.values[i])) }
 function host_value_object(): i32 { const item = new __PulseFastlyValue(); item.kind = PULSE_VALUE_OBJECT; return __pulse_fastly_put(item) }
 function host_value_object_set(target: i32, keyHandle: i32, value: i32): void { const item = __pulse_fastly_value(target); if (item.kind != PULSE_VALUE_OBJECT || item.immutable) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 32, -1); return } const key = __pulse_fastly_string(keyHandle); const index = __pulse_fastly_find(item, key); if (index >= 0) unchecked(item.values[index] = value); else { item.keys.push(key); item.values.push(value) } }
 function host_value_object_spread(target: i32, source: i32): void { const from = __pulse_fastly_value(source); if (from.kind != PULSE_VALUE_OBJECT) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 33, -1); return } for (let i = 0; i < from.keys.length; i += 1) host_value_object_set(target, __pulse_fastly_string_value(unchecked(from.keys[i])), unchecked(from.values[i])) }
-function host_value_property(target: i32, keyHandle: i32): i32 { const item = __pulse_fastly_value(target); const key = __pulse_fastly_string(keyHandle); if (item.kind == PULSE_VALUE_OBJECT) { const index = __pulse_fastly_find(item, key); return index >= 0 ? unchecked(item.values[index]) : host_value_undefined() } if (item.kind == PULSE_VALUE_FETCH && key == "status") { const out = __pulse_fastly_out_i32(); const status = fastly_http_resp_status_get(item.responseHandle, changetype<usize>(out)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 34, -1); return 0 } return host_value_number(__pulse_fastly_out_value(out)) } if ((item.kind == PULSE_VALUE_STRING || item.kind == PULSE_VALUE_ARRAY) && key == "length") return host_value_number(item.kind == PULSE_VALUE_STRING ? item.text.length : item.values.length); return host_value_undefined() }
+function host_value_property(target: i32, keyHandle: i32): i32 { const item = __pulse_fastly_value(target); const key = __pulse_fastly_string(keyHandle); if (item.kind == PULSE_VALUE_OBJECT) { const index = __pulse_fastly_find(item, key); return index >= 0 ? unchecked(item.values[index]) : host_value_undefined() } if (item.kind == PULSE_VALUE_FETCH && key == "status") { ${options.fetchAccounting?.selection === 'canonical-fetch-cohorts' ? 'return __fca_status(item);' : ''} const out = __pulse_fastly_out_i32(); const status = fastly_http_resp_status_get(item.responseHandle, changetype<usize>(out)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 34, -1); return 0 } return host_value_number(__pulse_fastly_out_value(out)) } if ((item.kind == PULSE_VALUE_STRING || item.kind == PULSE_VALUE_ARRAY) && key == "length") return host_value_number(item.kind == PULSE_VALUE_STRING ? item.textLength : item.values.length); return host_value_undefined() }
 function host_value_property_set(target: i32, key: i32, value: i32): i32 { host_value_object_set(target, key, value); return value }
-function host_value_element(target: i32, keyHandle: i32): i32 { const item = __pulse_fastly_value(target); if (item.kind == PULSE_VALUE_ARRAY) { const index = i32(__pulse_fastly_number(keyHandle)); return index >= 0 && index < item.values.length ? unchecked(item.values[index]) : host_value_undefined() } return host_value_property(target, keyHandle) }
+function host_value_element(target: i32, keyHandle: i32): i32 { const item = __pulse_fastly_value(target); if (item.kind == PULSE_VALUE_STRING) return __pulse_fastly_string_index(item, keyHandle); if (item.kind == PULSE_VALUE_ARRAY) { const index = i32(__pulse_fastly_number(keyHandle)); return index >= 0 && index < item.values.length ? unchecked(item.values[index]) : host_value_undefined() } return host_value_property(target, keyHandle) }
 function host_value_element_set(target: i32, keyHandle: i32, value: i32): i32 { const item = __pulse_fastly_value(target); if (item.immutable) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 35, -1); return 0 } if (item.kind == PULSE_VALUE_ARRAY) { const index = i32(__pulse_fastly_number(keyHandle)); if (index < 0) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 35, -1); return 0 } while (item.values.length <= index) item.values.push(host_value_undefined()); unchecked(item.values[index] = value); return value } return host_value_property_set(target, keyHandle, value) }
-function host_value_truthy(handle: i32): i32 { const value = __pulse_fastly_value(handle); if (value.kind == PULSE_VALUE_UNDEFINED || value.kind == PULSE_VALUE_NULL) return 0; if (value.kind == PULSE_VALUE_BOOLEAN) return value.boolean; if (value.kind == PULSE_VALUE_NUMBER) return value.number != 0.0 && !isNaN(value.number) ? 1 : 0; if (value.kind == PULSE_VALUE_STRING) return value.text.length > 0 ? 1 : 0; return 1 }
+function host_value_truthy(handle: i32): i32 { const value = __pulse_fastly_value(handle); if (value.kind == PULSE_VALUE_UNDEFINED || value.kind == PULSE_VALUE_NULL) return 0; if (value.kind == PULSE_VALUE_BOOLEAN) return value.boolean; if (value.kind == PULSE_VALUE_NUMBER) return value.number != 0.0 && !isNaN(value.number) ? 1 : 0; if (value.kind == PULSE_VALUE_STRING) return value.textLength > 0 ? 1 : 0; return 1 }
 function host_value_nullish(handle: i32): i32 { const kind = __pulse_fastly_value(handle).kind; return kind == PULSE_VALUE_UNDEFINED || kind == PULSE_VALUE_NULL ? 1 : 0 }
-function host_value_binary(operator: i32, leftHandle: i32, rightHandle: i32): i32 { const left = __pulse_fastly_value(leftHandle); const right = __pulse_fastly_value(rightHandle); if (operator == 0 || operator == 2) { let equal = false; if (left.kind == right.kind) { if (left.kind == PULSE_VALUE_UNDEFINED || left.kind == PULSE_VALUE_NULL) equal = true; else if (left.kind == PULSE_VALUE_BOOLEAN) equal = left.boolean == right.boolean; else if (left.kind == PULSE_VALUE_NUMBER) equal = left.number == right.number; else if (left.kind == PULSE_VALUE_STRING) equal = left.text == right.text; else equal = leftHandle == rightHandle } return host_value_boolean(equal ? 1 : 0) } if (operator == 1 || operator == 3) { const result = host_value_binary(operator == 1 ? 0 : 2, leftHandle, rightHandle); return host_value_boolean(host_value_truthy(result) == 0 ? 1 : 0) } if (operator == 8) { if (left.kind == PULSE_VALUE_STRING || right.kind == PULSE_VALUE_STRING) return __pulse_fastly_string_value(__pulse_fastly_string(leftHandle) + __pulse_fastly_string(rightHandle)); return host_value_number(__pulse_fastly_number(leftHandle) + __pulse_fastly_number(rightHandle)) } if (operator == 4) return host_value_boolean(__pulse_fastly_number(leftHandle) < __pulse_fastly_number(rightHandle) ? 1 : 0); if (operator == 5) return host_value_boolean(__pulse_fastly_number(leftHandle) <= __pulse_fastly_number(rightHandle) ? 1 : 0); if (operator == 6) return host_value_boolean(__pulse_fastly_number(leftHandle) > __pulse_fastly_number(rightHandle) ? 1 : 0); if (operator == 7) return host_value_boolean(__pulse_fastly_number(leftHandle) >= __pulse_fastly_number(rightHandle) ? 1 : 0); if (operator == 9) return host_value_number(__pulse_fastly_number(leftHandle) - __pulse_fastly_number(rightHandle)); if (operator == 10) return host_value_number(__pulse_fastly_number(leftHandle) * __pulse_fastly_number(rightHandle)); if (operator == 11) return host_value_number(__pulse_fastly_number(leftHandle) / __pulse_fastly_number(rightHandle)); if (operator == 14) return host_value_truthy(leftHandle) != 0 ? rightHandle : leftHandle; if (operator == 15) return host_value_truthy(leftHandle) != 0 ? leftHandle : rightHandle; if (operator == 16) return host_value_nullish(leftHandle) == 0 ? leftHandle : rightHandle; __pulse_fastly_fail(PULSE_ERROR_UNSUPPORTED, 36, -1); return 0 }
+function host_value_binary(operator: i32, leftHandle: i32, rightHandle: i32): i32 { const left = __pulse_fastly_value(leftHandle); const right = __pulse_fastly_value(rightHandle); if (operator == 0 || operator == 2) { let equal = false; if (left.kind == right.kind) { if (left.kind == PULSE_VALUE_UNDEFINED || left.kind == PULSE_VALUE_NULL) equal = true; else if (left.kind == PULSE_VALUE_BOOLEAN) equal = left.boolean == right.boolean; else if (left.kind == PULSE_VALUE_NUMBER) equal = left.number == right.number; else if (left.kind == PULSE_VALUE_STRING) equal = left.text == right.text; else equal = leftHandle == rightHandle } return host_value_boolean(equal ? 1 : 0) } if (operator == 1 || operator == 3) { const result = host_value_binary(operator == 1 ? 0 : 2, leftHandle, rightHandle); return host_value_boolean(host_value_truthy(result) == 0 ? 1 : 0) } if (operator == 8) { if (left.kind == PULSE_VALUE_STRING || right.kind == PULSE_VALUE_STRING) return __pulse_fastly_concat(leftHandle, rightHandle); return host_value_number(__pulse_fastly_number(leftHandle) + __pulse_fastly_number(rightHandle)) } if (left.kind == PULSE_VALUE_STRING && right.kind == PULSE_VALUE_STRING) { if (operator == 4) return host_value_boolean(left.text < right.text ? 1 : 0); if (operator == 5) return host_value_boolean(left.text <= right.text ? 1 : 0); if (operator == 6) return host_value_boolean(left.text > right.text ? 1 : 0); if (operator == 7) return host_value_boolean(left.text >= right.text ? 1 : 0); } if (operator == 4) return host_value_boolean(__pulse_fastly_number(leftHandle) < __pulse_fastly_number(rightHandle) ? 1 : 0); if (operator == 5) return host_value_boolean(__pulse_fastly_number(leftHandle) <= __pulse_fastly_number(rightHandle) ? 1 : 0); if (operator == 6) return host_value_boolean(__pulse_fastly_number(leftHandle) > __pulse_fastly_number(rightHandle) ? 1 : 0); if (operator == 7) return host_value_boolean(__pulse_fastly_number(leftHandle) >= __pulse_fastly_number(rightHandle) ? 1 : 0); if (operator == 9) return host_value_number(__pulse_fastly_number(leftHandle) - __pulse_fastly_number(rightHandle)); if (operator == 10) return host_value_number(__pulse_fastly_number(leftHandle) * __pulse_fastly_number(rightHandle)); if (operator == 11) return host_value_number(__pulse_fastly_number(leftHandle) / __pulse_fastly_number(rightHandle)); if (operator == 12) return host_value_number(__pulse_fastly_number(leftHandle) % __pulse_fastly_number(rightHandle)); if (operator == 14) return host_value_truthy(leftHandle) != 0 ? rightHandle : leftHandle; if (operator == 15) return host_value_truthy(leftHandle) != 0 ? leftHandle : rightHandle; if (operator == 16) return host_value_nullish(leftHandle) == 0 ? leftHandle : rightHandle; __pulse_fastly_fail(PULSE_ERROR_UNSUPPORTED, 36, -1); return 0 }
 function host_value_unary(operator: i32, handle: i32): i32 { if (operator == 0) return host_value_boolean(host_value_truthy(handle) == 0 ? 1 : 0); if (operator == 1) return host_value_number(__pulse_fastly_number(handle)); if (operator == 2) return host_value_number(-__pulse_fastly_number(handle)); if (operator == 5) return host_value_undefined(); __pulse_fastly_fail(PULSE_ERROR_UNSUPPORTED, 37, -1); return 0 }
 
 function host_request_method(): i32 { return __pulse_fastly_string_value(__pulse_fastly_request_method) }
@@ -1459,13 +1902,36 @@ function __pulse_router_param_text(path: string, pattern: string, name: string):
 function host_router_match(path: i32, pattern: i32): i32 { return host_value_boolean(__pulse_router_match_text(__pulse_fastly_string(path), __pulse_fastly_string(pattern)) ? 1 : 0) }
 function host_router_param(path: i32, pattern: i32, name: i32): i32 { const value = __pulse_router_param_text(__pulse_fastly_string(path), __pulse_fastly_string(pattern), __pulse_fastly_string(name)); return value === null ? host_value_undefined() : __pulse_fastly_string_value(value) }
 function host_request_path(): i32 { return __pulse_fastly_string_value(__pulse_fastly_request_path) }
-function host_request_headers(): i32 { return host_value_object() }
-function host_request_header(name: i32): i32 { const value = __pulse_fastly_request_header_text(__pulse_fastly_string(name)); return value.length == 0 ? host_value_undefined() : __pulse_fastly_string_value(value) }
-function host_request_text(): i32 { if (__pulse_fastly_request_body_loaded == 0) { __pulse_fastly_request_body = __pulse_fastly_read_body(__pulse_fastly_request_body_handle, -1); __pulse_fastly_request_body_loaded = 1 } return __pulse_fastly_string_value(__pulse_fastly_request_body) }
-function host_request_json(schema: i32): i32 { const parsed = __pulse_fastly_parse_json(__pulse_fastly_string(host_request_text())); if (parsed <= 0) return 0; const schemaValue = __pulse_fastly_value(schema); return schemaValue.kind == PULSE_VALUE_STRING ? __pulse_fastly_schema_apply(schemaValue.text, parsed, false) : parsed }
+function host_request_headers(): i32 { return __pulse_request_headers_read() }
+function host_request_header(name: i32): i32 { const value = __pulse_header_lookup(__pulse_fastly_request_handle, __pulse_fastly_string(name), false); return value === null ? host_value_undefined() : __pulse_fastly_string_value(value) }
+function host_request_text(): i32 { if (__pulse_request_body_failure != 0) { __pulse_fastly_fail(PULSE_ERROR_REQUEST_BODY, __pulse_request_body_failure, -1); return 0 } if (__pulse_fastly_request_body_loaded == 0) { __pulse_fastly_request_body = __pulse_fastly_read_body(__pulse_fastly_request_body_handle, -1, true); __pulse_fastly_request_body_loaded = 1; if (__pulse_fastly_last_error == PULSE_ERROR_REQUEST_BODY) __pulse_request_body_failure = __pulse_fastly_error_stage } if (__pulse_fastly_last_error != 0) return 0; return __pulse_fastly_string_value(__pulse_fastly_request_body) }
+function host_request_json(schema: i32): i32 { const parsed = ${hasJsonAdmission(plan) ? '__pulse_fastly_schema_parse_json(__pulse_fastly_string(host_request_text()), schema)' : '__pulse_fastly_parse_json(__pulse_fastly_string(host_request_text()))'}; if (parsed <= 0) return 0; const schemaValue = __pulse_fastly_value(schema); return schemaValue.kind == PULSE_VALUE_STRING ? __pulse_fastly_schema_apply(schemaValue.text, parsed, false) : parsed }
 function __pulse_fastly_headers_from_options(options: __PulseFastlyValue, output: __PulseFastlyValue): void { const index = __pulse_fastly_find(options, "headers"); if (index < 0) return; const headers = __pulse_fastly_value(unchecked(options.values[index])); if (headers.kind == PULSE_VALUE_OBJECT) { for (let i = 0; i < headers.keys.length; i += 1) { const name = unchecked(headers.keys[i]); const value = __pulse_fastly_value(unchecked(headers.values[i])); if (value.kind == PULSE_VALUE_ARRAY) { for (let j = 0; j < value.values.length; j += 1) output.headers.push(new __PulseFastlyHeader(name, __pulse_fastly_string(unchecked(value.values[j])))) } else output.headers.push(new __PulseFastlyHeader(name, __pulse_fastly_string(unchecked(headers.values[i])))) } return } if (headers.kind == PULSE_VALUE_ARRAY) { for (let i = 0; i < headers.values.length; i += 1) { const pair = __pulse_fastly_value(unchecked(headers.values[i])); if (pair.kind != PULSE_VALUE_ARRAY || pair.values.length < 2) continue; output.headers.push(new __PulseFastlyHeader(__pulse_fastly_string(unchecked(pair.values[0])), __pulse_fastly_string(unchecked(pair.values[1])))) } } }
 function __pulse_fastly_response(value: i32, optionsHandle: i32, json: bool): i32 { const output = new __PulseFastlyValue(); output.kind = PULSE_VALUE_RESPONSE; output.status = 200; const options = __pulse_fastly_value(optionsHandle); let bodyValue = value; if (options.kind == PULSE_VALUE_OBJECT) { const statusIndex = __pulse_fastly_find(options, "status"); if (statusIndex >= 0) output.status = i32(__pulse_fastly_number(unchecked(options.values[statusIndex]))); const schemaIndex = __pulse_fastly_find(options, "schema"); if (json && schemaIndex >= 0) { bodyValue = __pulse_fastly_schema_apply(__pulse_fastly_string(unchecked(options.values[schemaIndex])), value, true); if (bodyValue <= 0) return 0 } __pulse_fastly_headers_from_options(options, output) } output.text = json ? __pulse_fastly_json(bodyValue, 0) : __pulse_fastly_string(value); let hasContentType = false; for (let i = 0; i < output.headers.length; i += 1) if (unchecked(output.headers[i]).name.toLowerCase() == "content-type") hasContentType = true; if (!hasContentType) output.headers.push(new __PulseFastlyHeader("content-type", json ? "application/json; charset=utf-8" : "text/plain; charset=utf-8")); return __pulse_fastly_put(output) }
 function host_response_json(value: i32, options: i32): i32 { return __pulse_fastly_response(value, options, true) }
+function host_schema_decode(text: i32, schema: i32): i32 {
+  const id = __pulse_fastly_value(schema)
+  if (id.kind != PULSE_VALUE_STRING || id.text.length == 0) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 55, -1); return 0 }
+  const input = __pulse_fastly_value(text)
+  if (input.kind != PULSE_VALUE_STRING) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 52, -1); return 0 }
+  if (String.UTF8.byteLength(input.text) > __PULSE_SCHEMA_MAX_BYTES) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 21, -1); return 0 }
+  const parsed = ${hasJsonAdmission(plan) ? '__pulse_fastly_schema_parse_json(input.text, schema)' : '__pulse_fastly_parse_json(input.text)'}
+  if (parsed <= 0) return 0
+  const decoded = __pulse_fastly_schema_apply(id.text, parsed, false)
+  if (decoded <= 0) return 0
+  __pulse_fastly_deep_freeze(decoded)
+  return decoded
+}
+function host_schema_encode(value: i32, schema: i32): i32 {
+  const id = __pulse_fastly_value(schema)
+  if (id.kind != PULSE_VALUE_STRING || id.text.length == 0) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 55, -1); return 0 }
+  ${textEncodeIds.length ? `const textResult = ${textEncodeIds.map(id => `id.text == ${quote(id)}`).join(' || ')}
+  const projected = __pulse_fastly_schema_apply(id.text, value, true, textResult)` : 'const projected = __pulse_fastly_schema_apply(id.text, value, true)'}
+  if (projected <= 0) return 0
+  const text = ${textEncodeIds.length ? 'textResult ? __pulse_fastly_string(projected) : ' : ''}__pulse_fastly_json(projected, 0)
+  if (String.UTF8.byteLength(text) > __PULSE_SCHEMA_MAX_BYTES) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 21, -1); return 0 }
+  return ${textEncodeIds.length ? 'textResult ? projected : ' : ''}__pulse_fastly_string_value(text)
+}
 function host_response_text(value: i32, options: i32): i32 { return __pulse_fastly_response(value, options, false) }
 function host_response_custom(specHandle: i32): i32 { const spec = __pulse_fastly_value(specHandle); if (spec.kind != PULSE_VALUE_OBJECT) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 40, -1); return 0 } const output = new __PulseFastlyValue(); output.kind = PULSE_VALUE_RESPONSE; output.status = 200; const statusIndex = __pulse_fastly_find(spec, "status"); if (statusIndex >= 0) output.status = i32(__pulse_fastly_number(unchecked(spec.values[statusIndex]))); const bodyIndex = __pulse_fastly_find(spec, "body"); if (bodyIndex >= 0) output.text = __pulse_fastly_string(unchecked(spec.values[bodyIndex])); __pulse_fastly_headers_from_options(spec, output); return __pulse_fastly_put(output) }
 function __pulse_fastly_grip_frame_channels(options: __PulseFastlyValue, output: __PulseFastlyValue): bool { const channelsIndex = __pulse_fastly_find(options, "channels"); const channelIndex = __pulse_fastly_find(options, "channel"); let count = 0; if (channelsIndex >= 0) { const channels = __pulse_fastly_value(unchecked(options.values[channelsIndex])); if (channels.kind != PULSE_VALUE_ARRAY) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 133, -1); return false } for (let i = 0; i < channels.values.length; i += 1) { const channel = __pulse_fastly_string(unchecked(channels.values[i])).trim(); if (channel.length == 0 || channel.indexOf(",") >= 0 || channel.indexOf("\r") >= 0 || channel.indexOf("\n") >= 0) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 134, -1); return false } output.headers.push(new __PulseFastlyHeader("Grip-Channel", channel)); count += 1 } } else if (channelIndex >= 0) { const channel = __pulse_fastly_string(unchecked(options.values[channelIndex])).trim(); if (channel.length == 0 || channel.indexOf(",") >= 0 || channel.indexOf("\r") >= 0 || channel.indexOf("\n") >= 0) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 134, -1); return false } output.headers.push(new __PulseFastlyHeader("Grip-Channel", channel)); count = 1 } if (count == 0) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 135, -1); return false } return true }
@@ -1475,8 +1941,8 @@ function host_grip_subscribe(responseHandle: i32, optionsHandle: i32): i32 { con
 function host_grip_handoff(optionsHandle: i32): i32 { const options = __pulse_fastly_value(optionsHandle); if (options.kind != PULSE_VALUE_OBJECT) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 139, -1); return 0 } const output = new __PulseFastlyValue(); output.kind = PULSE_VALUE_RESPONSE; output.status = 200; const statusIndex = __pulse_fastly_find(options, "status"); if (statusIndex >= 0) output.status = i32(__pulse_fastly_number(unchecked(options.values[statusIndex]))); const bodyIndex = __pulse_fastly_find(options, "body"); if (bodyIndex >= 0) output.text = __pulse_fastly_string(unchecked(options.values[bodyIndex])); __pulse_fastly_headers_from_options(options, output); let hasContentType = false; for (let i = 0; i < output.headers.length; i += 1) if (unchecked(output.headers[i]).name.toLowerCase() == "content-type") hasContentType = true; if (!hasContentType) output.headers.push(new __PulseFastlyHeader("Content-Type", "application/websocket-events")); return __pulse_fastly_grip_frame(options, output) ? __pulse_fastly_put(output) : 0 }
 function host_kv_namespace(name: i32): i32 { return name }
 function host_fetch_text(responseHandle: i32): i32 { const response = __pulse_fastly_value(responseHandle); if (response.kind != PULSE_VALUE_FETCH) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 42, -1); return 0 } return __pulse_fastly_string_value(__pulse_fastly_fetch_body(response)) }
-function host_fetch_json(responseHandle: i32, schemaHandle: i32): i32 { const response = __pulse_fastly_value(responseHandle); if (response.kind != PULSE_VALUE_FETCH) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 43, -1); return 0 } if (__PULSE_SCHEMA_REQUIRE_JSON) { const contentType = __pulse_fastly_fetch_header_text(response.responseHandle, "content-type"); if (contentType.length == 0 || contentType.toLowerCase().indexOf("json") < 0) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 44, -1); return 0 } } const parsed = __pulse_fastly_parse_json(__pulse_fastly_fetch_body(response)); if (parsed <= 0) return 0; const schema = __pulse_fastly_value(schemaHandle); return schema.kind == PULSE_VALUE_STRING ? __pulse_fastly_schema_apply(schema.text, parsed, false) : parsed }
-function host_fetch_header(responseHandle: i32, nameHandle: i32): i32 { const response = __pulse_fastly_value(responseHandle); if (response.kind != PULSE_VALUE_FETCH) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 45, -1); return 0 } const value = __pulse_fastly_fetch_header_text(response.responseHandle, __pulse_fastly_string(nameHandle)); return value.length == 0 ? host_value_undefined() : __pulse_fastly_string_value(value) }
+function host_fetch_json(responseHandle: i32, schemaHandle: i32): i32 { const response = __pulse_fastly_value(responseHandle); if (response.kind != PULSE_VALUE_FETCH) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 43, -1); return 0 } if (__PULSE_SCHEMA_REQUIRE_JSON) { ${options.fetchAccounting?.selection === 'canonical-fetch-cohorts' ? 'if (!__fca_json_type(response)) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA,44,-1); return 0; }' : `${options.fetchAccounting?.selection === 'canonical-single-get-json' ? 'if (!__fca_work()) return 0;' : ''} const contentType = __pulse_fastly_fetch_header_text(response.responseHandle, "content-type"); if (contentType.length == 0 || contentType.toLowerCase().indexOf("json") < 0) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 44, -1); return 0 }`} } const parsed = ${hasJsonAdmission(plan) ? '__pulse_fastly_schema_parse_json(__pulse_fastly_fetch_body(response), schemaHandle)' : '__pulse_fastly_parse_json(__pulse_fastly_fetch_body(response))'}; if (parsed <= 0) return 0; const schema = __pulse_fastly_value(schemaHandle); return schema.kind == PULSE_VALUE_STRING ? __pulse_fastly_schema_apply(schema.text, parsed, false) : parsed }
+function host_fetch_header(responseHandle: i32, nameHandle: i32): i32 { const response = __pulse_fastly_value(responseHandle); if (response.kind != PULSE_VALUE_FETCH) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 45, -1); return 0 } const value = ${options.fetchAccounting?.selection === 'canonical-fetch-cohorts' ? '__fca_header(response, __pulse_fastly_string(nameHandle))' : '__pulse_header_lookup(response.responseHandle, __pulse_fastly_string(nameHandle), true)'}; return value === null ? host_value_undefined() : __pulse_fastly_string_value(value) }
 function __pulse_fastly_payload_field(payload: __PulseFastlyValue, name: string): i32 { const index = __pulse_fastly_find(payload, name); return index < 0 ? host_value_undefined() : unchecked(payload.values[index]) }
 function __pulse_fastly_ready_effect(effectIndex: i32, handle: i32): void { unchecked(__pulse_fastly_ready[effectIndex] = handle); unchecked(__pulse_fastly_pending_mode[effectIndex] = PULSE_FASTLY_PENDING_READY) }
 function __pulse_fastly_open_config_store(effectIndex: i32): i32 { const nameBytes = __pulse_fastly_utf8(__pulse_fastly_config_store(effectIndex)); const out = __pulse_fastly_out_i32(); const status = fastly_config_store_open(changetype<usize>(nameBytes), nameBytes.byteLength, changetype<usize>(out)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 110, effectIndex); return 0 } return __pulse_fastly_out_value(out) }
@@ -1496,12 +1962,12 @@ function __pulse_fastly_jwt_record_verified(): void { __pulse_fastly_jwt_verifie
 function __pulse_fastly_jwt_record_signing_input(bytes: i32, digest: string): void { __pulse_fastly_jwt_signing_input_bytes = bytes; __pulse_fastly_jwt_signing_input_sha256 = digest }
 function __pulse_fastly_jwt_capture_clock(effectIndex: i32): f64 { __pulse_fastly_jwt_clock_calls += 1; __pulse_fastly_jwt_event_order += "C"; const out = new StaticArray<i64>(1); const status = wasi_snapshot_preview1_clock_time_get(0, 1, changetype<usize>(out)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 226, effectIndex); return NaN } ${jwtClockOverride ? `return ${jwtClockOverride}` : 'return f64(load<i64>(changetype<usize>(out))) / 1000000000.0'} }
 function __pulse_fastly_jwt_validate_schema(effectIndex: i32, schemaId: string, claimsHandle: i32): i32 { __pulse_fastly_jwt_schema_calls += 1; __pulse_fastly_jwt_event_order += "H"; if (__pulse_fastly_jwt_case_id() == "claims-schema-failure-after-registered-claims") return 0; return __pulse_fastly_schema_apply(schemaId, claimsHandle, false) }
+function __pulse_fastly_jwt_sign_begin(effectIndex: i32, payload: __PulseFastlyValue): void { const result = pulse_jwt_fastly_sign(effectIndex, unchecked(__pulse_fastly_payloads[effectIndex])); if (result > 0 && __pulse_fastly_last_error == 0) __pulse_fastly_ready_effect(effectIndex, result) }
 function __pulse_fastly_jwt_begin(effectIndex: i32, payload: __PulseFastlyValue): void { const result = pulse_jwt_fastly_verify(effectIndex, unchecked(__pulse_fastly_payloads[effectIndex])); if (result > 0 && __pulse_fastly_last_error == 0) __pulse_fastly_ready_effect(effectIndex, result) }
-function __pulse_fastly_start_request(effectIndex: i32, url: string, method: string, headers: __PulseFastlyValue, body: string, backend: string): void { const requestOut = __pulse_fastly_out_i32(); let status = fastly_http_req_new(changetype<usize>(requestOut)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 70, effectIndex); return } const requestHandle = __pulse_fastly_out_value(requestOut); const bodyOut = __pulse_fastly_out_i32(); status = fastly_http_body_new(changetype<usize>(bodyOut)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 71, effectIndex); return } const bodyHandle = __pulse_fastly_out_value(bodyOut); const methodBytes = __pulse_fastly_utf8(method); status = fastly_http_req_method_set(requestHandle, changetype<usize>(methodBytes), methodBytes.byteLength); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 72, effectIndex); return } const urlBytes = __pulse_fastly_utf8(url); status = fastly_http_req_uri_set(requestHandle, changetype<usize>(urlBytes), urlBytes.byteLength); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 73, effectIndex); return } if (headers.kind == PULSE_VALUE_OBJECT) { for (let i = 0; i < headers.keys.length; i += 1) { const nameBytes = __pulse_fastly_utf8(unchecked(headers.keys[i])); const valueBytes = __pulse_fastly_utf8(__pulse_fastly_string(unchecked(headers.values[i]))); status = fastly_http_req_header_insert(requestHandle, changetype<usize>(nameBytes), nameBytes.byteLength, changetype<usize>(valueBytes), valueBytes.byteLength); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 74, effectIndex); return } } } if (body.length > 0) { status = __pulse_fastly_write_body(bodyHandle, body); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 75, effectIndex); return } } if (backend.length == 0) { __pulse_fastly_fail(PULSE_ERROR_STATE, 76, effectIndex); return } const backendBytes = __pulse_fastly_utf8(backend); const pendingOut = __pulse_fastly_out_i32(); status = fastly_http_req_send_async(requestHandle, bodyHandle, changetype<usize>(backendBytes), backendBytes.byteLength, changetype<usize>(pendingOut)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_TRANSPORT, 77, effectIndex); return } unchecked(__pulse_fastly_pending[effectIndex] = __pulse_fastly_out_value(pendingOut)); unchecked(__pulse_fastly_pending_mode[effectIndex] = PULSE_FASTLY_PENDING_ASYNC) }
-function __pulse_fastly_fetch_begin(effectIndex: i32, payload: __PulseFastlyValue): void { const urlIndex = __pulse_fastly_find(payload, "url"); if (urlIndex < 0) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 48, effectIndex); return } const url = __pulse_fastly_string(unchecked(payload.values[urlIndex])); const initIndex = __pulse_fastly_find(payload, "init"); const init = initIndex >= 0 ? __pulse_fastly_value(unchecked(payload.values[initIndex])) : new __PulseFastlyValue(); let method = "GET"; let body = ""; let headers = new __PulseFastlyValue(); headers.kind = PULSE_VALUE_OBJECT; if (init.kind == PULSE_VALUE_OBJECT) { const methodIndex = __pulse_fastly_find(init, "method"); if (methodIndex >= 0) method = __pulse_fastly_string(unchecked(init.values[methodIndex])).toUpperCase(); const headersIndex = __pulse_fastly_find(init, "headers"); if (headersIndex >= 0) headers = __pulse_fastly_value(unchecked(init.values[headersIndex])); const bodyIndex = __pulse_fastly_find(init, "body"); const jsonIndex = __pulse_fastly_find(init, "json"); if (bodyIndex >= 0) { const bodyValue = unchecked(init.values[bodyIndex]); const bodyObject = __pulse_fastly_value(bodyValue); body = bodyObject.kind == PULSE_VALUE_STRING ? bodyObject.text : __pulse_fastly_json(bodyValue, 0) } else if (jsonIndex >= 0) { body = __pulse_fastly_json(unchecked(init.values[jsonIndex]), 0); let hasContentType = false; for (let i = 0; i < headers.keys.length; i += 1) if (unchecked(headers.keys[i]).toLowerCase() == "content-type") hasContentType = true; if (!hasContentType) { headers.keys.push("content-type"); headers.values.push(__pulse_fastly_string_value("application/json; charset=utf-8")) } } } __pulse_fastly_start_request(effectIndex, url, method, headers, body, __pulse_fastly_backend(effectIndex)) }
+function __pulse_fastly_start_request(effectIndex: i32, url: string, method: string, headers: __PulseFastlyValue, body: string, backend: string): void { __pulse_transport_slots[effectIndex] = null; const requestOut = __pulse_fastly_out_i32(); let status = ${options.fetchAccounting ? '__fca_new(0,' : 'fastly_http_req_new('}changetype<usize>(requestOut)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 70, effectIndex); return } const requestHandle = __pulse_fastly_out_value(requestOut); const bodyOut = __pulse_fastly_out_i32(); status = ${options.fetchAccounting ? '__fca_new(1,' : 'fastly_http_body_new('}changetype<usize>(bodyOut)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 71, effectIndex); return } const bodyHandle = __pulse_fastly_out_value(bodyOut); const methodBytes = __pulse_fastly_utf8(method); ${options.fetchAccounting ? 'if (!__fca_work()) return;' : ''} status = fastly_http_req_method_set(requestHandle, changetype<usize>(methodBytes), methodBytes.byteLength); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 72, effectIndex); return } const urlBytes = __pulse_fastly_utf8(url); ${options.fetchAccounting ? 'if (!__fca_work()) return;' : ''} status = fastly_http_req_uri_set(requestHandle, changetype<usize>(urlBytes), urlBytes.byteLength); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 73, effectIndex); return } if (headers.kind == PULSE_VALUE_OBJECT) { for (let i = 0; i < headers.keys.length; i += 1) { const nameBytes = __pulse_fastly_utf8(unchecked(headers.keys[i])); const valueBytes = __pulse_fastly_utf8(__pulse_fastly_string(unchecked(headers.values[i]))); ${options.fetchAccounting ? 'if (!__fca_work()) return;' : ''} status = fastly_http_req_header_append(requestHandle, changetype<usize>(nameBytes), nameBytes.byteLength, changetype<usize>(valueBytes), valueBytes.byteLength); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 74, effectIndex); return } } } if (body.length > 0) { status = ${options.fetchAccounting?.selection === 'canonical-fetch-cohorts' ? '__fca_write' : '__pulse_fastly_write_body'}(bodyHandle, body); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 75, effectIndex); return } } if (backend.length == 0) { __pulse_fastly_fail(PULSE_ERROR_STATE, 76, effectIndex); return } const backendBytes = __pulse_fastly_utf8(backend); const pendingOut = __pulse_fastly_out_i32(); status = ${options.fetchAccounting ? '__fca_dispatch' : 'fastly_http_req_send_async'}(requestHandle, bodyHandle, changetype<usize>(backendBytes), backendBytes.byteLength, changetype<usize>(pendingOut)); if (status != FASTLY_STATUS_OK) { ${options.fetchAccounting ? '__fca_cleanup();' : '__pulse_fetch_close_request(requestHandle); __pulse_fetch_close_body(bodyHandle);'} __pulse_transport_capture(effectIndex, status, 'send'); __pulse_fetch_fail(status, 77, effectIndex); return } unchecked(__pulse_fastly_pending[effectIndex] = __pulse_fastly_out_value(pendingOut)); unchecked(__pulse_fastly_pending_mode[effectIndex] = PULSE_FASTLY_PENDING_ASYNC) }
+function __pulse_fastly_fetch_begin(effectIndex: i32, payload: __PulseFastlyValue): void { ${options.fetchAccounting ? options.fetchAccounting.selection === 'canonical-fetch-cohorts' ? 'if (!__fca_start(effectIndex)) return;' : 'if (!__fca_start()) return;' : ''} const urlIndex = __pulse_fastly_find(payload, "url"); if (urlIndex < 0) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 48, effectIndex); return } const url = __pulse_fastly_string(unchecked(payload.values[urlIndex])); const initIndex = __pulse_fastly_find(payload, "init"); const init = initIndex >= 0 ? __pulse_fastly_value(unchecked(payload.values[initIndex])) : new __PulseFastlyValue(); let method = "GET"; let body = ""; let headers = new __PulseFastlyValue(); headers.kind = PULSE_VALUE_OBJECT; if (init.kind == PULSE_VALUE_OBJECT) { const methodIndex = __pulse_fastly_find(init, "method"); if (methodIndex >= 0) method = __pulse_fastly_string(unchecked(init.values[methodIndex])).toUpperCase(); const headersIndex = __pulse_fastly_find(init, "headers"); if (headersIndex >= 0) headers = __pulse_fastly_value(unchecked(init.values[headersIndex])); headers = __pulse_fastly_fetch_headers(headers, effectIndex); if (__pulse_fastly_last_error != 0) return; const bodyIndex = __pulse_fastly_find(init, "body"); const jsonIndex = __pulse_fastly_find(init, "json"); if (bodyIndex >= 0) { const bodyValue = unchecked(init.values[bodyIndex]); const bodyObject = __pulse_fastly_value(bodyValue); body = bodyObject.kind == PULSE_VALUE_STRING ? bodyObject.text : __pulse_fastly_json(bodyValue, 0) } else if (jsonIndex >= 0) { body = __pulse_fastly_fetch_json_body(init, unchecked(init.values[jsonIndex])); if (__pulse_fastly_last_error != 0) return; headers = __pulse_fastly_fetch_json_headers(headers) } } __pulse_fastly_start_request(effectIndex, url, method, headers, body, __pulse_fastly_backend(effectIndex)) }
 function __pulse_fastly_kv_get_begin(effectIndex: i32, payload: __PulseFastlyValue): void { const store = __pulse_fastly_open_kv_store(effectIndex); if (__pulse_fastly_last_error != 0) return; const key = __pulse_fastly_string(__pulse_fastly_payload_field(payload, "key")); const keyBytes = __pulse_fastly_utf8(key); const lookupOut = __pulse_fastly_out_i32(); const config = new StaticArray<i32>(1); const status = fastly_kv_store_lookup(store, changetype<usize>(keyBytes), keyBytes.byteLength, 0, changetype<usize>(config), changetype<usize>(lookupOut)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 116, effectIndex); return } unchecked(__pulse_fastly_pending[effectIndex] = __pulse_fastly_out_value(lookupOut)); unchecked(__pulse_fastly_pending_mode[effectIndex] = PULSE_FASTLY_PENDING_ASYNC) }
-function __pulse_fastly_assets_payload(payload: __PulseFastlyValue): __PulseFastlyValue { const value = __pulse_fastly_value(__pulse_fastly_payload_field(payload, "payload")); if (value.kind != PULSE_VALUE_OBJECT) __pulse_fastly_fail(PULSE_ERROR_VALUE, 146, -1); return value }
-function __pulse_fastly_assets_begin(effectIndex: i32, payload: __PulseFastlyValue): void { const value = __pulse_fastly_assets_payload(payload); if (__pulse_fastly_last_error != 0) return; const store = __pulse_fastly_open_kv_store(effectIndex); if (__pulse_fastly_last_error != 0) return; const key = __pulse_fastly_string(__pulse_fastly_payload_field(value, "key")); const keyBytes = __pulse_fastly_utf8(key); const lookupOut = __pulse_fastly_out_i32(); const config = new StaticArray<i32>(1); const status = fastly_kv_store_lookup(store, changetype<usize>(keyBytes), keyBytes.byteLength, 0, changetype<usize>(config), changetype<usize>(lookupOut)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 147, effectIndex); return } unchecked(__pulse_fastly_pending[effectIndex] = __pulse_fastly_out_value(lookupOut)); unchecked(__pulse_fastly_pending_mode[effectIndex] = PULSE_FASTLY_PENDING_ASYNC) }
+${assetBeginSource}
 function __pulse_fastly_kv_put_begin(effectIndex: i32, payload: __PulseFastlyValue): void { const store = __pulse_fastly_open_kv_store(effectIndex); if (__pulse_fastly_last_error != 0) return; const key = __pulse_fastly_string(__pulse_fastly_payload_field(payload, "key")); const value = __pulse_fastly_payload_field(payload, "value"); const bodyOut = __pulse_fastly_out_i32(); let status = fastly_http_body_new(changetype<usize>(bodyOut)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 117, effectIndex); return } const body = __pulse_fastly_out_value(bodyOut); status = __pulse_fastly_write_body(body, "{\"__pulseKv\":1,\"value\":" + __pulse_fastly_json(value, 0) + "}"); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 118, effectIndex); return } const keyBytes = __pulse_fastly_utf8(key); const insertOut = __pulse_fastly_out_i32(); const config = new StaticArray<i64>(4); status = fastly_kv_store_insert(store, changetype<usize>(keyBytes), keyBytes.byteLength, body, 0, changetype<usize>(config), changetype<usize>(insertOut)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 119, effectIndex); return } unchecked(__pulse_fastly_pending[effectIndex] = __pulse_fastly_out_value(insertOut)); unchecked(__pulse_fastly_pending_mode[effectIndex] = PULSE_FASTLY_PENDING_ASYNC) }
 function __pulse_fastly_grip_add_channel(channel: string): void { if (channel.length == 0) return; for (let i = 0; i < __pulse_fastly_grip_channels.length; i += 1) if (unchecked(__pulse_fastly_grip_channels[i]) == channel) return; __pulse_fastly_grip_channels.push(channel) }
 function __pulse_fastly_grip_payload(payload: __PulseFastlyValue): __PulseFastlyValue { return __pulse_fastly_value(__pulse_fastly_payload_field(payload, "payload")) }
@@ -1510,27 +1976,32 @@ function __pulse_fastly_grip_hold_begin(effectIndex: i32, payload: __PulseFastly
 ${gripSecretSource}
 function __pulse_fastly_grip_publish_begin(effectIndex: i32, payload: __PulseFastlyValue): void { const valueHandle = __pulse_fastly_payload_field(payload, "payload"); const value = __pulse_fastly_value(valueHandle); if (value.kind != PULSE_VALUE_OBJECT) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 122, effectIndex); return } const headers = new __PulseFastlyValue(); headers.kind = PULSE_VALUE_OBJECT; headers.keys.push("content-type"); headers.values.push(__pulse_fastly_string_value("application/json; charset=utf-8")); headers.keys.push("accept"); headers.values.push(__pulse_fastly_string_value("application/json")); ${gripAuthorizationSource} const body = __pulse_fastly_json(valueHandle, 0); if (String.UTF8.encode(body, false).byteLength > PULSE_FASTLY_BUFFER_BYTES) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 145, effectIndex); return } __pulse_fastly_start_request(effectIndex, __pulse_fastly_grip_publish_url(effectIndex), "POST", headers, body, __pulse_fastly_backend(effectIndex)) }
 ${effectDispatchSource(plan)}
-function __pulse_fastly_wait_fetch(effectIndex: i32): i32 { if (unchecked(__pulse_fastly_pending_mode[effectIndex]) != PULSE_FASTLY_PENDING_ASYNC) { __pulse_fastly_fail(PULSE_ERROR_STATE, 80, effectIndex); return 0 } const pending = unchecked(__pulse_fastly_pending[effectIndex]); const responseOut = __pulse_fastly_out_i32(); const bodyOut = __pulse_fastly_out_i32(); const status = fastly_http_req_pending_req_wait(pending, changetype<usize>(responseOut), changetype<usize>(bodyOut)); unchecked(__pulse_fastly_pending_mode[effectIndex] = PULSE_FASTLY_PENDING_NONE); unchecked(__pulse_fastly_pending[effectIndex] = 0); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_TRANSPORT, 81, effectIndex); return 0 } const value = new __PulseFastlyValue(); value.kind = PULSE_VALUE_FETCH; value.responseHandle = __pulse_fastly_out_value(responseOut); value.bodyHandle = __pulse_fastly_out_value(bodyOut); return __pulse_fastly_put(value) }
+function __pulse_fastly_wait_fetch(effectIndex: i32): i32 { if (unchecked(__pulse_fastly_pending_mode[effectIndex]) != PULSE_FASTLY_PENDING_ASYNC) { __pulse_fastly_fail(PULSE_ERROR_STATE, 80, effectIndex); return 0 } const pending = unchecked(__pulse_fastly_pending[effectIndex]); const responseOut = __pulse_fastly_out_i32(); const bodyOut = __pulse_fastly_out_i32(); const detail = new StaticArray<i32>(__PULSE_SEND_ERROR_DETAIL_WORDS); __pulse_send_error_detail_reset(changetype<usize>(detail)); const status = fastly_http_req_pending_req_wait_v2(pending, changetype<usize>(detail), changetype<usize>(responseOut), changetype<usize>(bodyOut)); unchecked(__pulse_fastly_pending_mode[effectIndex] = PULSE_FASTLY_PENDING_NONE); unchecked(__pulse_fastly_pending[effectIndex] = 0); if (status != FASTLY_STATUS_OK) { __pulse_transport_capture(effectIndex, status, 'wait', changetype<usize>(detail)); __pulse_fetch_fail(status, 81, effectIndex); return 0 } const value = new __PulseFastlyValue(); value.kind = PULSE_VALUE_FETCH; value.responseHandle = __pulse_fastly_out_value(responseOut); value.bodyHandle = __pulse_fastly_out_value(bodyOut); return __pulse_fastly_put(value) }
 function __pulse_fastly_wait_grip_publish(effectIndex: i32): i32 { const responseHandle = __pulse_fastly_wait_fetch(effectIndex); if (responseHandle <= 0) return 0; const response = __pulse_fastly_value(responseHandle); if (response.kind != PULSE_VALUE_FETCH) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 129, effectIndex); return 0 } const statusOut = __pulse_fastly_out_i32(); const statusCall = fastly_http_resp_status_get(response.responseHandle, changetype<usize>(statusOut)); if (statusCall != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 130, effectIndex); return 0 } const originStatus = __pulse_fastly_out_value(statusOut); if (originStatus < 200 || originStatus > 299) { __pulse_fastly_fail(PULSE_ERROR_TRANSPORT, 131, effectIndex); return 0 } const outer = __pulse_fastly_value(unchecked(__pulse_fastly_payloads[effectIndex])); const publicationHandle = __pulse_fastly_payload_field(outer, "payload"); const publication = __pulse_fastly_value(publicationHandle); if (publication.kind != PULSE_VALUE_OBJECT) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 132, effectIndex); return 0 } const receipt = host_value_object(); host_value_object_set(receipt, __pulse_fastly_string_value("published"), host_value_boolean(1)); for (let i = 0; i < publication.keys.length; i += 1) host_value_object_set(receipt, __pulse_fastly_string_value(unchecked(publication.keys[i])), unchecked(publication.values[i])); const options = host_value_object(); host_value_object_set(options, __pulse_fastly_string_value("status"), host_value_number(202.0)); return host_response_json(receipt, options) }
 function __pulse_fastly_wait_grip_broadcast(effectIndex: i32): i32 { const responseHandle = __pulse_fastly_wait_fetch(effectIndex); if (responseHandle <= 0) return 0; const response = __pulse_fastly_value(responseHandle); if (response.kind != PULSE_VALUE_FETCH) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 142, effectIndex); return 0 } const statusOut = __pulse_fastly_out_i32(); const statusCall = fastly_http_resp_status_get(response.responseHandle, changetype<usize>(statusOut)); if (statusCall != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 143, effectIndex); return 0 } const originStatus = __pulse_fastly_out_value(statusOut); if (originStatus < 200 || originStatus > 299) { __pulse_fastly_fail(PULSE_ERROR_TRANSPORT, 144, effectIndex); return 0 } const receipt = host_value_object(); host_value_object_set(receipt, __pulse_fastly_string_value("accepted"), host_value_boolean(1)); host_value_object_set(receipt, __pulse_fastly_string_value("status"), host_value_number(f64(originStatus))); return receipt }
 function __pulse_fastly_wait_ready(effectIndex: i32): i32 { if (unchecked(__pulse_fastly_pending_mode[effectIndex]) != PULSE_FASTLY_PENDING_READY) { __pulse_fastly_fail(PULSE_ERROR_STATE, 124, effectIndex); return 0 } const value = unchecked(__pulse_fastly_ready[effectIndex]); unchecked(__pulse_fastly_pending_mode[effectIndex] = PULSE_FASTLY_PENDING_NONE); unchecked(__pulse_fastly_pending[effectIndex] = 0); unchecked(__pulse_fastly_ready[effectIndex] = 0); return value }
 function __pulse_fastly_wait_kv_get(effectIndex: i32): i32 { if (unchecked(__pulse_fastly_pending_mode[effectIndex]) == PULSE_FASTLY_PENDING_READY) return __pulse_fastly_wait_ready(effectIndex); if (unchecked(__pulse_fastly_pending_mode[effectIndex]) != PULSE_FASTLY_PENDING_ASYNC) { __pulse_fastly_fail(PULSE_ERROR_STATE, 125, effectIndex); return 0 } const pending = unchecked(__pulse_fastly_pending[effectIndex]); const bodyOut = __pulse_fastly_out_i32(); const metadata = new Uint8Array(1); const written = __pulse_fastly_out_i32(); const generation = new StaticArray<i64>(1); const kvError = __pulse_fastly_out_i32(); const status = fastly_kv_store_lookup_wait_v2(pending, changetype<usize>(bodyOut), metadata.dataStart, 0, changetype<usize>(written), changetype<usize>(generation), changetype<usize>(kvError)); unchecked(__pulse_fastly_pending_mode[effectIndex] = PULSE_FASTLY_PENDING_NONE); unchecked(__pulse_fastly_pending[effectIndex] = 0); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 125, effectIndex); return 0 } const errorCode = __pulse_fastly_out_value(kvError); if (errorCode == 3) return host_value_undefined(); if (errorCode != 1) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 128, effectIndex); return 0 } const text = __pulse_fastly_read_body(__pulse_fastly_out_value(bodyOut), effectIndex); if (__pulse_fastly_last_error != 0) return 0; const parser = new __PulseJsonParser(text); const parsed = parser.parse(); if (parser.failed || parsed <= 0) return __pulse_fastly_string_value(text); const object = __pulse_fastly_value(parsed); if (object.kind == PULSE_VALUE_OBJECT) { const marker = __pulse_fastly_find(object, "__pulseKv"); const value = __pulse_fastly_find(object, "value"); if (marker >= 0 && value >= 0 && __pulse_fastly_number(unchecked(object.values[marker])) == 1.0) return unchecked(object.values[value]) } return parsed }
-function __pulse_fastly_asset_content_type(key: string): string { const dot = key.lastIndexOf("."); const extension = dot < 0 ? "" : key.substring(dot + 1).toLowerCase(); if (extension == "css") return "text/css; charset=utf-8"; if (extension == "html") return "text/html; charset=utf-8"; if (extension == "js" || extension == "mjs") return "text/javascript; charset=utf-8"; if (extension == "json") return "application/json; charset=utf-8"; if (extension == "svg") return "image/svg+xml"; if (extension == "txt") return "text/plain; charset=utf-8"; if (extension == "webp") return "image/webp"; if (extension == "png") return "image/png"; if (extension == "jpg" || extension == "jpeg") return "image/jpeg"; if (extension == "gif") return "image/gif"; if (extension == "ico") return "image/x-icon"; return "application/octet-stream" }
-function __pulse_fastly_asset_text(text: string): string { const parser = new __PulseJsonParser(text); const parsed = parser.parse(); if (parser.failed || parsed <= 0) return text; const object = __pulse_fastly_value(parsed); if (object.kind != PULSE_VALUE_OBJECT) return text; const marker = __pulse_fastly_find(object, "__pulseKv"); const value = __pulse_fastly_find(object, "value"); if (marker < 0 || value < 0 || __pulse_fastly_number(unchecked(object.values[marker])) != 1.0) return text; return __pulse_fastly_string(unchecked(object.values[value])) }
-function __pulse_fastly_wait_assets(effectIndex: i32): i32 { if (unchecked(__pulse_fastly_pending_mode[effectIndex]) != PULSE_FASTLY_PENDING_ASYNC) { __pulse_fastly_fail(PULSE_ERROR_STATE, 148, effectIndex); return 0 } const pending = unchecked(__pulse_fastly_pending[effectIndex]); const bodyOut = __pulse_fastly_out_i32(); const metadata = new Uint8Array(1); const written = __pulse_fastly_out_i32(); const generation = new StaticArray<i64>(1); const kvError = __pulse_fastly_out_i32(); const status = fastly_kv_store_lookup_wait_v2(pending, changetype<usize>(bodyOut), metadata.dataStart, 0, changetype<usize>(written), changetype<usize>(generation), changetype<usize>(kvError)); unchecked(__pulse_fastly_pending_mode[effectIndex] = PULSE_FASTLY_PENDING_NONE); unchecked(__pulse_fastly_pending[effectIndex] = 0); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 149, effectIndex); return 0 } const outer = __pulse_fastly_value(unchecked(__pulse_fastly_payloads[effectIndex])); const payload = __pulse_fastly_assets_payload(outer); if (__pulse_fastly_last_error != 0) return 0; const key = __pulse_fastly_string(__pulse_fastly_payload_field(payload, "key")); const output = new __PulseFastlyValue(); output.kind = PULSE_VALUE_RESPONSE; const errorCode = __pulse_fastly_out_value(kvError); output.status = errorCode == 3 ? 404 : 200; if (errorCode != 1 && errorCode != 3) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 150, effectIndex); return 0 } const headersHandle = __pulse_fastly_payload_field(payload, "headers"); const headers = __pulse_fastly_value(headersHandle); let hasContentType = false; if (headers.kind == PULSE_VALUE_OBJECT) { for (let i = 0; i < headers.keys.length; i += 1) { const name = unchecked(headers.keys[i]); if (name.toLowerCase() == "content-type") hasContentType = true; output.headers.push(new __PulseFastlyHeader(name, __pulse_fastly_string(unchecked(headers.values[i])))) } } if (!hasContentType) output.headers.push(new __PulseFastlyHeader("content-type", output.status == 200 ? __pulse_fastly_asset_content_type(key) : "text/plain; charset=utf-8")); const cacheHandle = __pulse_fastly_payload_field(payload, "cacheControl"); if (__pulse_fastly_value(cacheHandle).kind != PULSE_VALUE_UNDEFINED) output.headers.push(new __PulseFastlyHeader("cache-control", __pulse_fastly_string(cacheHandle))); const methodHandle = __pulse_fastly_payload_field(payload, "method"); const method = __pulse_fastly_value(methodHandle).kind == PULSE_VALUE_UNDEFINED ? "GET" : __pulse_fastly_string(methodHandle).toUpperCase(); if (output.status == 200 && method != "HEAD") { const text = __pulse_fastly_read_body(__pulse_fastly_out_value(bodyOut), effectIndex); if (__pulse_fastly_last_error != 0) return 0; output.text = __pulse_fastly_asset_text(text) } return __pulse_fastly_put(output) }
+${assetResultSource}
 function __pulse_fastly_wait_kv_put(effectIndex: i32): i32 { if (unchecked(__pulse_fastly_pending_mode[effectIndex]) != PULSE_FASTLY_PENDING_ASYNC) { __pulse_fastly_fail(PULSE_ERROR_STATE, 126, effectIndex); return 0 } const pending = unchecked(__pulse_fastly_pending[effectIndex]); const kvError = __pulse_fastly_out_i32(); const status = fastly_kv_store_insert_wait(pending, changetype<usize>(kvError)); unchecked(__pulse_fastly_pending_mode[effectIndex] = PULSE_FASTLY_PENDING_NONE); unchecked(__pulse_fastly_pending[effectIndex] = 0); if (status != FASTLY_STATUS_OK || __pulse_fastly_out_value(kvError) != 1) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 127, effectIndex); return 0 } return host_value_boolean(1) }
 function __pulse_fastly_write_body(bodyHandle: i32, value: string): i32 { const bytes = __pulse_fastly_utf8(value); let offset = 0; while (offset < bytes.byteLength) { const written = __pulse_fastly_out_i32(); const status = fastly_http_body_write(bodyHandle, changetype<usize>(bytes) + offset, bytes.byteLength - offset, 0, changetype<usize>(written)); if (status != FASTLY_STATUS_OK) return status; const count = __pulse_fastly_out_value(written); if (count <= 0) return 1; offset += count } return FASTLY_STATUS_OK }
-function __pulse_fastly_send_result(handle: i32): i32 { const value = __pulse_fastly_value(handle); if (value.kind == PULSE_VALUE_FETCH) return fastly_http_resp_send_downstream(value.responseHandle, value.bodyHandle, 0); if (value.kind != PULSE_VALUE_RESPONSE) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 90, -1); return PULSE_ERROR_VALUE } const responseOut = __pulse_fastly_out_i32(); let status = fastly_http_resp_new(changetype<usize>(responseOut)); if (status != FASTLY_STATUS_OK) return status; const responseHandle = __pulse_fastly_out_value(responseOut); const bodyOut = __pulse_fastly_out_i32(); status = fastly_http_body_new(changetype<usize>(bodyOut)); if (status != FASTLY_STATUS_OK) return status; const bodyHandle = __pulse_fastly_out_value(bodyOut); status = fastly_http_resp_status_set(responseHandle, value.status); if (status != FASTLY_STATUS_OK) return status; for (let i = 0; i < value.headers.length; i += 1) { const header = unchecked(value.headers[i]); const nameBytes = __pulse_fastly_utf8(header.name); const valueBytes = __pulse_fastly_utf8(header.value); status = fastly_http_resp_header_append(responseHandle, changetype<usize>(nameBytes), nameBytes.byteLength, changetype<usize>(valueBytes), valueBytes.byteLength); if (status != FASTLY_STATUS_OK) return status } status = __pulse_fastly_write_body(bodyHandle, value.text); if (status != FASTLY_STATUS_OK) return status; return fastly_http_resp_send_downstream(responseHandle, bodyHandle, 0) }
+${lifecycle?.active ? `function __pulse_fastly_send_result(handle: i32): i32 {\n${lifecycle.site('response-send')}\n  return __pulse_fastly_send_result_impl(handle)\n}\n` : ''}function ${lifecycle?.legacyName('__pulse_fastly_send_result') || '__pulse_fastly_send_result'}(handle: i32): i32 { const value = __pulse_fastly_value(handle); ${bindings.s3.length ? 'if (value.s3Body) return __s3_send_body(value);' : ''} if (value.kind == PULSE_VALUE_FETCH) return ${options.fetchAccounting?.selection === 'canonical-fetch-cohorts' ? '__fca_transfer(value.responseHandle, value.bodyHandle)' : 'fastly_http_resp_send_downstream(value.responseHandle, value.bodyHandle, 0)'}; if (value.kind != PULSE_VALUE_RESPONSE) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 90, -1); return PULSE_ERROR_VALUE } const responseOut = __pulse_fastly_out_i32(); let status = fastly_http_resp_new(changetype<usize>(responseOut)); if (status != FASTLY_STATUS_OK) return status; const responseHandle = __pulse_fastly_out_value(responseOut); const bodyOut = __pulse_fastly_out_i32(); status = fastly_http_body_new(changetype<usize>(bodyOut)); if (status != FASTLY_STATUS_OK) return status; const bodyHandle = __pulse_fastly_out_value(bodyOut); status = fastly_http_resp_status_set(responseHandle, value.status); if (status != FASTLY_STATUS_OK) return status; for (let i = 0; i < value.headers.length; i += 1) { const header = unchecked(value.headers[i]); const nameBytes = __pulse_fastly_utf8(header.name); const valueBytes = __pulse_fastly_utf8(header.value); status = fastly_http_resp_header_append(responseHandle, changetype<usize>(nameBytes), nameBytes.byteLength, changetype<usize>(valueBytes), valueBytes.byteLength); if (status != FASTLY_STATUS_OK) return status } status = __pulse_fastly_write_body(bodyHandle, value.text); if (status != FASTLY_STATUS_OK) return status; return fastly_http_resp_send_downstream(responseHandle, bodyHandle, 0) }
 
 ${jwtEvidenceSource}
+${terminalErrorSource}
 ${es256KeyArtifactSource(es256KeyRecords)}
 ${jwtCryptoCompositionSource(jwtCrypto)}
+${jwtSigningCryptoCompositionSource(jwtCrypto)}
 ${generateSchemaRuntime(plan)}
 ${effectResultSource(plan, bindings)}
 `;
+  if (!hasAssets) return source;
+  const writer = 'status = __pulse_fastly_write_body(bodyHandle, value.text);';
+  if (!source.includes(writer)) throw new Error('Embedded asset response writer boundary drift.');
+  return source.replace(writer, 'status = value.binaryBody !== null ? __pulse_fastly_write_binary(bodyHandle, value.binaryBody!) : __pulse_fastly_write_body(bodyHandle, value.text);');
 }
 
 function driverSource(plan, options = {}) {
+  const lifecycle = options.lifecycle;
   const entryName = options.guestLinked === true
     ? 'pulse_fastly_handle'
     : '_start';
@@ -1544,33 +2015,41 @@ export function pulse_fastly_jwt_crypto_calls(): i32 { return __pulse_fastly_jwt
 export function pulse_fastly_jwt_clock_calls(): i32 { return __pulse_fastly_jwt_clock_calls }
 export function pulse_fastly_jwt_schema_calls(): i32 { return __pulse_fastly_jwt_schema_calls }
 export function ${entryName}(): void {
+  if (__pulse_invocation_started) { __pulse_fastly_fail(PULSE_ERROR_STATE, 171, -1); return }
+  __pulse_invocation_started = true
+  __pulse_fastly_run_invocation()
+${lifecycle?.site('invocation-end') ? lifecycle.site('invocation-end') + '\n' : ''}  ${plan.effects.some(e => e.kind === 's3.getBody') ? '__s3_close_bodies()' : ''}
+  __pulse_invocation_close()
+}
+function __pulse_fastly_run_invocation(): void {
   __pulse_fastly_last_error = fastly_abi_init(PULSE_FASTLY_EFFECTS_ABI_VERSION)
   if (__pulse_fastly_last_error != FASTLY_STATUS_OK) { __pulse_fastly_jwt_send_error(); return }
   const handles = new StaticArray<i32>(2)
-  const downstreamStatus = fastly_http_req_body_downstream_get(changetype<usize>(handles), changetype<usize>(handles) + 4)
+  const downstreamStatus = ${options.resourceAccounting ? '__fra_incoming' : 'fastly_http_req_body_downstream_get'}(changetype<usize>(handles), changetype<usize>(handles) + 4)
   if (downstreamStatus != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 100, -1); __pulse_fastly_jwt_send_error(); return }
   __pulse_fastly_request_handle = load<i32>(changetype<usize>(handles))
   __pulse_fastly_request_body_handle = load<i32>(changetype<usize>(handles) + 4)
-  __pulse_fastly_request_method = __pulse_fastly_read_req_string(0)
+${lifecycle?.site('request-acquired') ? lifecycle.site('request-acquired') + '\n' : ''}  __pulse_fastly_request_method = __pulse_fastly_read_req_string(0)
   if (__pulse_fastly_last_error != 0) { __pulse_fastly_jwt_send_error(); return }
   __pulse_fastly_request_url = __pulse_fastly_read_req_string(1)
   if (__pulse_fastly_last_error != 0) { __pulse_fastly_jwt_send_error(); return }
   __pulse_fastly_request_path = __pulse_fastly_path(__pulse_fastly_request_url)
   let runStatus = pulse_start()
-  while (runStatus == 1 && __pulse_fastly_last_error == 0) {
+${packageApplication.enabled(plan) ? packageApplication.driverLoop() : applicationErrors.settlementEnabled(plan) ? applicationErrors.driverLoop(plan) : `  while (runStatus == 1 && __pulse_fastly_last_error == 0) {
     for (let effectIndex = 0; effectIndex < PULSE_FASTLY_EFFECT_COUNT; effectIndex += 1) {
       if (unchecked(__pulse_fastly_pending_mode[effectIndex]) == PULSE_FASTLY_PENDING_NONE) continue
+      const invocation = unchecked(__pulse_invocation_tickets[effectIndex])
       const result = __pulse_fastly_resolve_effect(effectIndex)
       if (result <= 0 || __pulse_fastly_last_error != 0) { __pulse_fastly_jwt_send_error(); return }
-      if (pulse_set_effect_result(effectIndex, result) != 1) { __pulse_fastly_fail(PULSE_ERROR_STATE, 101, effectIndex); __pulse_fastly_jwt_send_error(); return }
+      if (__pulse_invocation_settle(effectIndex, invocation, result) != 1) { __pulse_fastly_fail(PULSE_ERROR_STATE, 101, effectIndex); __pulse_fastly_jwt_send_error(); return }
     }
     runStatus = pulse_resume()
-  }
+  }`}
   if (__pulse_fastly_last_error != 0) { __pulse_fastly_jwt_send_error(); return }
   if (runStatus != 0) { __pulse_fastly_fail(PULSE_ERROR_STATE, 102, -1); __pulse_fastly_jwt_send_error(); return }
   const result = pulse_result_handle()
   if (result <= 0) { __pulse_fastly_fail(PULSE_ERROR_STATE, 103, -1); __pulse_fastly_jwt_send_error(); return }
-  __pulse_fastly_jwt_attach_evidence(result)
+${lifecycle?.site('result-claim') ? lifecycle.site('result-claim') + '\n' : ''}  __pulse_fastly_jwt_attach_evidence(result)
   const sendStatus = __pulse_fastly_send_result(result)
   if (sendStatus != FASTLY_STATUS_OK) __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 104, -1)
 }
@@ -1578,9 +2057,10 @@ export function ${entryName}(): void {
 }
 
 function capabilityImports(effect) {
+  if (effect.kind === 'time.now') return ['wasi_snapshot_preview1.clock_time_get'];
   if (effect.kind === 'config.get') return ['fastly_config_store.open', 'fastly_config_store.get'];
   if (effect.kind === 'secret.get') return ['fastly_secret_store.open', 'fastly_secret_store.get', 'fastly_secret_store.plaintext'];
-  if (effect.kind === 'jwt.verify') {
+  if (['jwt.verify', 'jwt.sign'].includes(effect.kind)) {
     return [
       ...(effect.resource && effect.resource.keyType === 'secret'
         ? [
@@ -1592,6 +2072,7 @@ function capabilityImports(effect) {
       'wasi_snapshot_preview1.clock_time_get'
     ];
   }
+  if (conditionalKv.KV_CONDITIONAL_KINDS.includes(effect.kind)) return conditionalKv.kvImports(effect.kind).map(key => key.replace(':', '.'));
   if (effect.kind === 'kv.get') return ['fastly_kv_store.open', 'fastly_kv_store.lookup', 'fastly_kv_store.lookup_wait_v2', 'fastly_http_body.read'];
   if (effect.kind === 'kv.put') return ['fastly_kv_store.open', 'fastly_kv_store.insert', 'fastly_kv_store.insert_wait', 'fastly_http_body.new', 'fastly_http_body.write'];
   if (effect.kind === 'assets.lookup') return ['fastly_kv_store.open', 'fastly_kv_store.lookup', 'fastly_kv_store.lookup_wait_v2', 'fastly_http_body.read'];
@@ -1599,7 +2080,7 @@ function capabilityImports(effect) {
     return [
       'fastly_http_req.new',
       'fastly_http_req.send_async',
-      'fastly_http_req.pending_req_wait',
+      'fastly_http_req.pending_req_wait_v2',
       ...(effect.kind === 'grip.broadcast' ? ['fastly_secret_store.open', 'fastly_secret_store.get', 'fastly_secret_store.plaintext'] : [])
     ];
   }
@@ -1611,7 +2092,7 @@ function generateFastlyNativePlatformCapabilitiesAssemblyScript(plan, options =
   validatePlanBoundary(plan, options);
   const facts = packageFacts(plan, options);
   const jwtCrypto = selectedJwtCrypto(plan);
-  const es256KeyRecords = jwtCrypto && jwtCrypto.algorithm === 'ES256'
+  const es256KeyRecords = jwtCrypto && ['ES256', 'RS256'].includes(jwtCrypto.algorithm)
     ? resolveEs256KeyArtifacts(plan, facts)
     : Object.freeze([]);
   if (jwtCrypto && jwtCrypto.guestUnitRequired && facts.guestUnits.length !== 1) {
@@ -1634,25 +2115,89 @@ function generateFastlyNativePlatformCapabilitiesAssemblyScript(plan, options =
       }
     );
   }
+  const packageDuration = plan.packages?.application?.requestLimits?.maxDurationMs;
+  if (packageDuration !== undefined) options = { ...options, maxDurationMs: Math.min(options.maxDurationMs ?? packageDuration, packageDuration) };
   const bindings = resolveCapabilityBindings(plan, options);
-  const portable = generateCanonicalNativeAssemblyScript(plan, options);
+  const selectedExtensions = hostExtensions.select(plan, options);
+  const extensionPolicy = selectedExtensions.length ? hostExtensions.policy(selectedExtensions,
+    (options.targetDescriptor?.finalWasmPolicy?.permittedImports || FASTLY_NATIVE_PLATFORM_CAPABILITIES_IMPORTS.map(([module, name]) => ({ module, name, kind: 'function' })))) : undefined;
+  const forwardingAccounting = require('./native-forwarding-accounting.js').profile(plan, bindings);
+  const fetchAccounting = require('./native-fetch-accounting.js').profile(plan, bindings, FASTLY_NATIVE_PLATFORM_CAPABILITIES_BUFFER_BYTES)
+    || require('./native-fetch-cohorts.js').profile(plan, bindings, FASTLY_NATIVE_PLATFORM_CAPABILITIES_BUFFER_BYTES);
+  const resourceAccounting = forwardingAccounting || fetchAccounting;
+  // Trusted provider-internal services, never a project/package hook API.
+  const lifecycle = lifecycleBindings.create(plan, bindings, [...require('./native-fetch-accounting.js').hooks(fetchAccounting), ...hostExtensions.hooks(selectedExtensions), ...(options.lifecycleServices || [])]);
+  // Keep final provider eligibility authoritative over the portable artifact
+  // and caller options. Only the selected crypto guest uses the linked policy;
+  // that policy excludes active codecs regardless of JSON arena configuration.
+  const numericRegions = facts.guestUnits.length === 0 ? 'fastly-numeric-regions-v2'
+    : jwtCrypto && jwtCrypto.guestUnitRequired ? 'fastly-linked-numeric-regions-v1' : undefined;
+  const portable = packageApplication.enabled(plan) ? packageApplication.portable(plan) : generateCanonicalNativeAssemblyScript(plan, {
+    ...options, numericRegions, lifecycle,
+    handleOwnership: facts.guestUnits.length === 0 ? 'fastly-handle-tracing-v1' : undefined
+  });
+  nativeHandleOwnership.validateRoots(plan, portable.manifest);
   const portableSource = stripPulseHostImports(portable.source);
   const hasJwt = (plan.effects || []).some((effect) => effect.kind === 'jwt.verify');
-  const jwtSource = hasJwt ? pulseJwtAssemblyScriptSource() : undefined;
-  const source = [
+  const hasSign = plan.effects.some(effect => effect.kind === 'jwt.sign');
+  const jwtSource = hasJwt || hasSign ? pulseJwtAssemblyScriptSource({ includeSigning: hasSign }) : undefined;
+  let source = [
     '/* Generated by Pulse Pass98 Fastly native platform capability compiler. */',
     'export function __pulse_fastly_abort(message: string | null, fileName: string | null = null, line: u32 = 0, column: u32 = 0): void { unreachable() }',
     '',
     fastlyRuntimeSource(plan, bindings, {
-      ...options,
+      ...options, lifecycle, fetchAccounting,
+      handleTracing: portable.manifest.handleOwnership?.enabled === true,
       jwtCrypto,
       es256KeyRecords
     }),
     jwtSource ? jwtSource.source : '',
+    ...(selectedExtensions.length ? [hostExtensions.source(selectedExtensions)] : []),
+    ((plan.effects || []).some(effect => ['fetch', 'grip.publish', 'grip.broadcast'].includes(effect.kind)) || bindings.s3.length > 0)
+      ? fs.readFileSync(path.join(__dirname, 'native-send-error-detail.as.ts'), 'utf8') : '',
+    require('./s3-native.js').s3NativeSource(plan, bindings),
+    plan.effects.some(e => e.kind === 'assets.lookup') ? require('@pulse-compute/wasm-contracts/assets/contracts').embeddedNativeSource() + fs.readFileSync(path.join(__dirname, 'embedded-assets.as.ts'), 'utf8') : '',
+    require('./time-native.js').timeNativeSource(plan),
+    require('./digest-native.js').digestNativeSource(plan),
+    conditionalKv.kvNativeSource(plan),
+    require('./native-request-body.js').runtimeSource(),
+    require('./native-request-headers.js').runtimeSource(),
+    require('./native-header-lookup.js').runtimeSource(),
+    fs.readFileSync(path.join(__dirname, 'native-transport-details.as.ts'), 'utf8'),
+    require('./native-fetch-errors.js').runtimeSource(dynamicBackends.active(bindings)),
+    require('./native-fetch-deadlines.js').runtimeSource(plan, fetchAccounting),
+    applicationErrors.settlementEnabled(plan) ? applicationErrors.runtimeSource(plan) : '',
+    effectInvocations.runtimeSource({ packageCompletion: packageApplication.enabled(plan), lifecycle }),
+    ...(portable.manifest.numericRegions?.accounting === 'fastly-read-loop-v1' && portable.manifest.numericRegions.regions.length > 0
+      ? [nativeValueBudget.numericRegionSource()] : []),
     portableSource,
-    driverSource(plan, { guestLinked: facts.guestUnits.length > 0 }),
+    nativeHandleOwnership.providerSource(plan, portable.manifest.handleOwnership?.enabled === true),
+    driverSource(plan, { guestLinked: facts.guestUnits.length > 0, lifecycle, resourceAccounting: forwardingAccounting }),
+    ...(forwardingAccounting ? [require('./native-forwarding-accounting.js').source(forwardingAccounting)] : []),
+    ...(fetchAccounting ? [require(fetchAccounting.selection === 'canonical-fetch-cohorts' ? './native-fetch-cohorts.js' : './native-fetch-accounting.js').source(fetchAccounting)] : []),
     ''
   ].join('\n');
+  if (applicationErrors.settlementEnabled(plan)) source = applicationErrors.instrument(source);
+  source = require('./native-request-headers.js').instrument(source, applicationErrors.enabled(plan), /\bhost_request_headers\(/.test(portableSource));
+  source = require('./native-header-lookup.js').instrument(source, lifecycle);
+  source = require('./native-fetch-errors.js').instrument(source, lifecycle);
+  source = require('./native-fetch-deadlines.js').instrument(source, plan, fetchAccounting);
+  source = require('./native-request-body.js').instrument(source, applicationErrors.enabled(plan), lifecycle);
+  if (packageApplication.enabled(plan)) source = packageApplication.instrument(source);
+  source = effectInvocations.instrument(source);
+  source = require('./request-budget.js').instrumentRequestBudget(source, bindings.maxDurationMs, plan, lifecycle, fetchAccounting);
+  source = packageApplication.terminalFailure(source, plan);
+  source = nativeValueBudget.instrument(source, plan);
+  source = require('./native-body-forwarding.js').instrument(source, plan, bindings);
+  source = dynamicBackends.instrument(source, bindings, true, (options.bindings || options).backends);
+  // Forwarding owns a specialized terminal fetch implementation. Admission
+  // above rejects outcome/timing options; generic fetch anchors do not exist here.
+  if (!require('./native-body-forwarding.js').enabled(plan)) {
+    source = require('./native-fetch-outcomes.js').instrument(source, plan);
+    source = require('./native-fetch-timing.js').instrument(source, plan);
+  }
+  lifecycle.assertSites();
+  if (lifecycle.supportSource) source += '\n' + lifecycle.supportSource;
   const effectKinds = Object.freeze((plan.effects || []).reduce((output, effect) => {
     output[effect.kind] = (output[effect.kind] || 0) + 1;
     return output;
@@ -1664,9 +2209,10 @@ function generateFastlyNativePlatformCapabilitiesAssemblyScript(plan, options =
     capability: effect.capability,
     package: effect.package,
     contractId: effect.contractId,
-    imports: Object.freeze(capabilityImports(effect))
+    imports: Object.freeze([...capabilityImports(effect), ...(bindings.backends.some(b => b.index === index && b.dynamic) ? ['fastly_http_req.register_dynamic_backend'] : [])])
   })));
   const manifest = Object.freeze({
+    ...(resourceAccounting ? { resourceAccounting } : {}),
     version: FASTLY_NATIVE_PLATFORM_CAPABILITIES_VERSION,
     generatorVersion: FASTLY_NATIVE_PLATFORM_CAPABILITIES_GENERATOR_VERSION,
     abiVersion: FASTLY_NATIVE_PLATFORM_CAPABILITIES_ABI_VERSION,
@@ -1676,10 +2222,23 @@ function generateFastlyNativePlatformCapabilitiesAssemblyScript(plan, options =
     portableGeneratorVersion: portable.version,
     portableSourceHash: portable.sourceHash,
     schemaCodecs: portable.manifest.schemaCodecs,
+    ...(portable.manifest.numericRegions ? { numericRegions: portable.manifest.numericRegions } : {}),
+    handleOwnership: portable.manifest.handleOwnership ? Object.freeze({ ...portable.manifest.handleOwnership,
+      providerRoots: portable.manifest.handleOwnership.enabled ? Object.freeze(nativeHandleOwnership.providerRoots(plan)) : Object.freeze([])
+    }) : Object.freeze({
+      policy: null, enabled: false,
+      reason: packageApplication.enabled(plan) ? 'package-owned-emitter' : 'linked-runtime',
+      roots: Object.freeze([]), checkpoints: 'none'
+    }),
+    handlerBodies: portable.manifest.handlerBodies,
+    ...(portable.manifest.reportOwnership ? { reportOwnership: portable.manifest.reportOwnership } : {}),
+    dispatcher: portable.manifest.dispatcher,
+    stages: portable.manifest.stages,
+    helperBodies: portable.manifest.helperBodies,
     crypto: portable.manifest.crypto,
     jwt: jwtSource
       ? Object.freeze({
-          status: jwtCrypto && jwtCrypto.algorithm === 'ES256'
+          status: jwtCrypto && ['ES256', 'RS256'].includes(jwtCrypto.algorithm)
             ? 'implemented-g4'
             : 'implemented-e2',
           package: jwtSource.owner,
@@ -1698,13 +2257,19 @@ function generateFastlyNativePlatformCapabilitiesAssemblyScript(plan, options =
         })
       : Object.freeze({ status: 'inactive' }),
     effectCount: (plan.effects || []).length,
+    effectInvocations: effectInvocations.policy,
+    ...(lifecycle.active ? { lifecycle: lifecycle.plan } : {}),
+    ...(selectedExtensions.length ? { hostExtensions: hostExtensions.evidence(selectedExtensions, lifecycle, extensionPolicy) } : {}),
     effectKinds,
     continuationCount: (plan.continuations || []).length,
     groupedContinuationCount: (plan.continuations || []).filter((entry) => (entry.effectIds || []).length > 1).length,
     bindings,
     backends: bindings.backends,
     capabilityDiagnostics,
-    allowedImports: FASTLY_NATIVE_PLATFORM_CAPABILITIES_IMPORTS,
+    ...(dynamicBackends.active(bindings) ? { dynamicBackends: dynamicBackends.describe((options.bindings || options).backends) } : {}),
+    allowedImports: dynamicBackends.active(bindings)
+      ? Object.freeze([...FASTLY_NATIVE_PLATFORM_CAPABILITIES_IMPORTS, Object.freeze(['fastly_http_req', 'register_dynamic_backend'])])
+      : FASTLY_NATIVE_PLATFORM_CAPABILITIES_IMPORTS,
     requiredImports: requiredImportsForPlan(plan, bindings),
     requiredExports: Object.freeze([
       '_start',
@@ -1712,27 +2277,30 @@ function generateFastlyNativePlatformCapabilitiesAssemblyScript(plan, options =
       'pulse_fastly_error_stage',
       'pulse_fastly_error_effect',
       'pulse_plan_hash_ptr',
-      'pulse_plan_hash_length'
+      'pulse_plan_hash_length',
+      ...(bindings.maxDurationMs === undefined ? [] : ['pulse_fastly_request_expired'])
     ]),
     policy: Object.freeze({
+      ...(dynamicBackends.active(bindings) ? { dynamicBackends: dynamicBackends.describe((options.bindings || options).backends) } : {}),
+      ...(nativeValueBudget.hasBoundedReadLoop(plan) ? { readLoopMemory: nativeValueBudget.policy } : {}),
       nativeFastly: true,
       provider: 'fastly',
       providerNeutralInput: true,
       javascriptRuntime: false,
       jsComputeRuntime: false,
-      wasi: hasJwt ? 'clock_time_get only' : false,
-      effects: 'fetch, config.get, secret.get, kv.get, kv.put, assets.lookup, grip.channel, grip.hold, grip.publish, grip.broadcast, jwt.verify',
+      wasi: requiredImportsForPlan(plan, bindings).filter(key => key.startsWith('wasi_snapshot_preview1:')).map(key => key.split(':')[1]).join(', ').replace(/(.+)/, '$1 only') || false,
+      effects: FASTLY_NATIVE_PLATFORM_EFFECT_KINDS.join(', '),
       continuations: true,
       groupedEffects: 'existing fetch start-before-wait ordering remains intact',
       config: 'Fastly Config Store open/get with undefined for missing values',
       secrets: 'Fastly Secret Store open/get/plaintext; proof traces redact plaintext values',
-      jwt: hasJwt
-        ? `package-owned compact-JWS and registered-claim semantics composed with ${jwtCrypto.realization}; provider-owned request, clock, schema, and transport`
+      jwt: hasJwt || hasSign
+        ? `package-owned compact-JWS, registered-claim, and bounded issuance semantics composed with ${jwtCrypto.realization}; provider-owned request, secret, clock, schema, and transport`
         : 'inactive',
-      kv: 'Fastly KV Store async lookup/insert with Pulse JSON envelope compatibility',
+      kv: 'Fastly KV Store async lookup/insert/delete and one bounded list page with opaque cursor; conditional operations preserve u64 generations, bounded readiness, strict Pulse envelopes and uncertain dispatch',
       assets: 'Fastly KV Store lookup with provider-owned content type, cache headers, and GET/HEAD body ownership',
       grip: 'canonical stateless framing plus bound, secret-referenced broadcast HTTP realization and stable acknowledgement',
-      logging: 'best-effort redacted writes to the provider-owned stdout logging endpoint',
+      logging: bindings.logEndpoint === undefined ? 'best-effort redacted WASI fd_write to stdout (descriptor 1), one attempt per statement' : 'best-effort named fastly_log endpoint; one lookup and at most one write per statement, 65536 UTF-8 byte maximum, no retries or stdout fallback; downstream delivery unverified',
       schemas: 'fetch JSON decode and structured response encode',
       opaqueResponse: 'origin fetch response/body handles and direct GRIP hold responses pass through without JavaScript runtime ownership',
       transportErrors: 'host status failures remain distinct from HTTP response status',
@@ -1763,13 +2331,16 @@ function generateFastlyNativePlatformCapabilitiesAssemblyScript(plan, options =
   });
 }
 
-function inspectFastlyNativePlatformCapabilitiesWasm(input) {
+function inspectFastlyNativePlatformCapabilitiesWasm(input, options = {}) {
   const bytes = Buffer.isBuffer(input) ? input : fs.readFileSync(path.resolve(input));
+  assertFastlyWasmBudget(bytes.length, options.maxWasmBytes);
   if (!WebAssembly.validate(bytes)) fail('Generated Fastly native platform capabilities module is not valid WebAssembly.', 'PULSE_FASTLY_NATIVE_PLATFORM_CAPABILITIES_WASM_INVALID');
   const module = new WebAssembly.Module(bytes);
   const imports = WebAssembly.Module.imports(module).map((entry) => Object.freeze({ module: entry.module, name: entry.name, kind: entry.kind }));
   const exports = WebAssembly.Module.exports(module).map((entry) => Object.freeze({ name: entry.name, kind: entry.kind }));
-  const unexpected = imports.filter((entry) => !FASTLY_NATIVE_PLATFORM_CAPABILITIES_ALLOWED_IMPORTS.has(`${entry.module}:${entry.name}`));
+  const permitted = options.extensionPolicy ? new Set(options.extensionPolicy.permittedImports.map(entry => `${entry.module}:${entry.name}:${entry.kind}`)) : null;
+  if (options.extensionPolicy) require('@pulse-compute/wasm-contracts/provider/toolchain').hostExtensions.auditWasm(bytes, options.extensionPolicy);
+  const unexpected = imports.filter((entry) => permitted ? !permitted.has(`${entry.module}:${entry.name}:${entry.kind}`) : entry.kind !== 'function' || !FASTLY_NATIVE_PLATFORM_CAPABILITIES_ALLOWED_IMPORTS.has(`${entry.module}:${entry.name}`));
   if (unexpected.length > 0) fail('Generated Fastly native platform capabilities module imports functions outside the Pass98 ABI.', 'PULSE_FASTLY_NATIVE_PLATFORM_CAPABILITIES_IMPORT_UNSUPPORTED', { unexpected, imports });
   const forbidden = imports.filter((entry) => /pulse_host|js[_-]?compute/i.test(`${entry.module}:${entry.name}`));
   if (forbidden.length > 0) fail('Generated Fastly native platform capabilities module imports a forbidden runtime.', 'PULSE_FASTLY_NATIVE_PLATFORM_CAPABILITIES_RUNTIME_FORBIDDEN', { forbidden });
@@ -1780,7 +2351,6 @@ function inspectFastlyNativePlatformCapabilitiesWasm(input) {
   const requiredExports = ['_start', 'memory', 'pulse_fastly_last_error', 'pulse_fastly_error_stage', 'pulse_fastly_error_effect', 'pulse_start', 'pulse_resume', 'pulse_set_effect_result', 'pulse_result_handle'];
   const missingExports = requiredExports.filter((name) => !exportNames.has(name));
   if (missingExports.length > 0) fail('Generated Fastly native platform capabilities module is missing required exports.', 'PULSE_FASTLY_NATIVE_PLATFORM_CAPABILITIES_EXPORT_MISSING', { missingExports, exports });
-  if (bytes.length > FASTLY_NATIVE_PLATFORM_CAPABILITIES_MAX_WASM_BYTES) fail('Generated Fastly native platform capabilities module exceeds the Pass98 size ceiling.', 'PULSE_FASTLY_NATIVE_PLATFORM_CAPABILITIES_WASM_TOO_LARGE', { bytes: bytes.length, maxBytes: FASTLY_NATIVE_PLATFORM_CAPABILITIES_MAX_WASM_BYTES });
   return Object.freeze({
     valid: true,
     bytes: bytes.length,
@@ -1793,6 +2363,7 @@ function inspectFastlyNativePlatformCapabilitiesWasm(input) {
 }
 
 function compileFastlyNativePlatformCapabilitiesPlan(plan, options = {}) {
+  const maxWasmBytes = normalizeFastlyMaxWasmBytes(options.maxWasmBytes);
   const generated = generateFastlyNativePlatformCapabilitiesAssemblyScript(plan, options);
   const cwd = path.resolve(options.cwd || process.cwd());
   const compilerFallback = path.resolve(__dirname, '..', '..', '..', '..', 'wasm', 'packages', 'compiler');
@@ -1825,6 +2396,8 @@ function compileFastlyNativePlatformCapabilitiesPlan(plan, options = {}) {
     }
     jsonAs = Object.freeze({ transform, dependencyRoot, version: packageJson.version });
   }
+  if (options.emitWat !== undefined && typeof options.emitWat !== 'boolean') throw new TypeError('emitWat must be a boolean.');
+  const emitWat = options.emitWat === true;
   const stagingDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pulse-fastly-native-platform-'));
   const requestedOutDir = options.outDir ? path.resolve(options.outDir) : undefined;
   const outputDir = requestedOutDir || stagingDir;
@@ -1832,6 +2405,7 @@ function compileFastlyNativePlatformCapabilitiesPlan(plan, options = {}) {
   const sourceFile = path.join(stagingDir, 'fastly-native-platform-capabilities.as.ts');
   const wasmFile = path.join(outputDir, options.wasmFile || 'fastly-native-platform-capabilities.wasm');
   const watFile = path.join(outputDir, options.watFile || 'fastly-native-platform-capabilities.wat');
+  if (!emitWat) fs.rmSync(watFile, { force: true });
   const guestLinked = generated.guestUnits.length > 0;
   // asc resolves custom runtimes like module names and appends ".ts".
   const fixedMemoryRuntimeModule = path.join(__dirname, 'fixed-memory-runtime.as');
@@ -1848,14 +2422,17 @@ function compileFastlyNativePlatformCapabilitiesPlan(plan, options = {}) {
       asc.script,
       path.basename(sourceFile),
       '--outFile', assemblyScriptWasmFile,
-      '--textFile', assemblyScriptWatFile,
       '--runtime', guestLinked
         ? fixedMemoryRuntimeModule
         : (schemaCodecsActive ? 'incremental' : 'stub'),
       '--noAssert',
       '--optimize'
     ];
-    const optimization = appendAssemblyScriptOptimizationArgs(args, nativeOptimization);
+    if (emitWat) args.push('--textFile', assemblyScriptWatFile);
+    const optimization = appendAssemblyScriptOptimizationArgs(args, nativeOptimization, { guestLinked });
+    if (!guestLinked && (plan.callables?.length || nativeValueBudget.hasBoundedReadLoop(plan) || plan.effects.some(effect => effect.kind === 'crypto.digestText' || effect.kind.startsWith('s3.')))) {
+      args.push('--maximumMemory', String(nativeValueBudget.policy.maximumMemoryPages));
+    }
     if (generated.guestUnits.length > 0) {
       args.push(
         '--disable', 'bulk-memory',
@@ -1878,17 +2455,20 @@ function compileFastlyNativePlatformCapabilitiesPlan(plan, options = {}) {
         '--path', jsonAs.dependencyRoot
       );
     }
-    const startedAt = Date.now();
+    require('@pulse-compute/wasm-build-support/native-optimization').appendJsonCacheArenaArgs(args, options.elideJsonCacheArena, schemaCodecsActive);
+    const readReportCapture = options.reportCapture === false ? () => null : prepareReportCapture(args, stagingDir, generated.manifest,
+      require(path.join(asc.packageRoot, 'package.json')).version, 'fastly-native-platform-capabilities.as/');
+    const startedAt = process.hrtime.bigint();
     const result = spawnSync(asc.executable, args, {
       cwd: stagingDir,
       encoding: 'utf8',
       maxBuffer: 64 * 1024 * 1024,
       timeout: Number(options.timeoutMs || 180000),
       env: schemaCodecsActive
-        ? { ...process.env, JSON_STRICT: 'true', JSON_USE_FAST_PATH: '0' }
+        ? { ...process.env, JSON_STRICT: 'true', JSON_USE_FAST_PATH: '0', JSON_MODE: 'NAIVE' }
         : process.env
     });
-    const assemblyScriptDurationMs = Date.now() - startedAt;
+    const assemblyScriptDurationMs = Math.round(Number(process.hrtime.bigint() - startedAt) / 1e6);
     if (result.error || result.status !== 0 || !fs.existsSync(assemblyScriptWasmFile)) {
       fail('AssemblyScript failed to compile the Fastly native platform capabilities module.', 'PULSE_FASTLY_NATIVE_PLATFORM_CAPABILITIES_ASC_FAILED', {
         status: result.status,
@@ -1932,7 +2512,7 @@ function compileFastlyNativePlatformCapabilitiesPlan(plan, options = {}) {
           failureMessage: 'Fastly Native start wrapper composition failed.'
         }
       );
-      runGuestTool(
+      if (emitWat) runGuestTool(
         'wasm-dis',
         [wasmFile, '--mvp-features', '-o', watFile],
         {
@@ -1962,7 +2542,7 @@ function compileFastlyNativePlatformCapabilitiesPlan(plan, options = {}) {
       });
     }
     const primaryWasm = fs.readFileSync(wasmFile);
-    const primaryWat = fs.existsSync(watFile) ? fs.readFileSync(watFile, 'utf8') : '';
+    const primaryWat = emitWat ? fs.readFileSync(watFile, 'utf8') : '';
     const primaryArtifact = Object.freeze({
       bytes: primaryWasm.length,
       sha256: sha256(primaryWasm)
@@ -1995,7 +2575,8 @@ function compileFastlyNativePlatformCapabilitiesPlan(plan, options = {}) {
       realization = Object.freeze({
         ...realization,
         wasm: stageResult.wasm,
-        wat: stageResult.wat,
+        // Required guest-link disassembly audits remain enabled.
+        wat: emitWat ? stageResult.wat : '',
         guestUnits: stageResult.guestUnits,
         guestLink: Object.freeze({
           version: stageResult.version,
@@ -2013,23 +2594,28 @@ function compileFastlyNativePlatformCapabilitiesPlan(plan, options = {}) {
     const wat = realization.wat;
     if (requestedOutDir && generated.guestUnits.length > 0) {
       fs.writeFileSync(wasmFile, wasm);
-      fs.writeFileSync(watFile, wat, 'utf8');
+      if (emitWat) fs.writeFileSync(watFile, wat, 'utf8');
     }
-    const inspection = inspectFastlyNativePlatformCapabilitiesWasm(wasm);
+    const inspection = inspectFastlyNativePlatformCapabilitiesWasm(wasm, { maxWasmBytes, extensionPolicy: generated.manifest.hostExtensions?.importPolicy });
     const imported = new Set(inspection.imports.map((entry) => `${entry.module}:${entry.name}`));
     const requiredImports = requiredImportsForPlan(plan, generated.bindings);
     const missingRequiredImports = requiredImports.filter((key) => !imported.has(key));
     if (missingRequiredImports.length > 0) fail('Generated Fastly native platform capabilities module is missing plan-required host imports.', 'PULSE_FASTLY_NATIVE_PLATFORM_CAPABILITIES_IMPORT_MISSING', { missingRequiredImports, imports: inspection.imports, requiredImports });
     const manifest = Object.freeze({
       ...generated.manifest,
+      ...(generated.manifest.hostExtensions ? { hostExtensions: Object.freeze({ ...generated.manifest.hostExtensions,
+        finalWasmSha256: inspection.sha256,
+        observedImports: require('@pulse-compute/wasm-contracts/provider/toolchain').hostExtensions.auditWasm(wasm, generated.manifest.hostExtensions.importPolicy).observedImports }) } : {}),
       compilerVersion: FASTLY_NATIVE_PLATFORM_CAPABILITIES_COMPILER_VERSION,
       assemblyScript: Object.freeze({ package: 'assemblyscript', version: require(path.join(asc.packageRoot, 'package.json')).version }),
       jsonAs: jsonAs
-        ? Object.freeze({ package: 'json-as', version: jsonAs.version, transform: true, strict: true })
+        ? Object.freeze({ package: 'json-as', version: jsonAs.version, transform: true, strict: true, mode: 'NAIVE', fastPath: false, elideDisabledCacheArena: options.elideJsonCacheArena === true })
         : undefined,
       optimization,
       wasm: Object.freeze({ bytes: inspection.bytes, sha256: inspection.sha256, magic: inspection.magic }),
-      wat: Object.freeze({ bytes: Buffer.byteLength(wat), sha256: sha256(wat) }),
+      wat: Object.freeze(emitWat
+        ? { emitted: true, bytes: Buffer.byteLength(wat), sha256: sha256(wat) }
+        : { emitted: false, bytes: 0, sha256: null }),
       importModules: inspection.importModules,
       imports: inspection.imports,
       requiredImports,
@@ -2043,10 +2629,17 @@ function compileFastlyNativePlatformCapabilitiesPlan(plan, options = {}) {
         providerPackaging: realization.guestLink.providerPackaging
       } : {})
     });
-    const durationMs = Date.now() - startedAt;
+    const durationMs = Math.round(Number(process.hrtime.bigint() - startedAt) / 1e6);
     return Object.freeze({
       version: FASTLY_NATIVE_PLATFORM_CAPABILITIES_VERSION,
       compilerVersion: FASTLY_NATIVE_PLATFORM_CAPABILITIES_COMPILER_VERSION,
+      reportAttribution: readReportCapture(wasm),
+      buildObservation: require('@pulse-compute/wasm-build-support/native-optimization').observeAssemblyScript(args, {
+        version: require(path.join(asc.packageRoot, 'package.json')).version,
+        assemblyScriptRoot: asc.packageRoot, timeoutMs: Number(options.timeoutMs || 180000),
+        compilerVersion: FASTLY_NATIVE_PLATFORM_CAPABILITIES_COMPILER_VERSION,
+        durationMs: assemblyScriptDurationMs, jsonAsVersion: jsonAs && jsonAs.version
+      }),
       plan,
       generated,
       source: generated.source,
@@ -2062,7 +2655,7 @@ function compileFastlyNativePlatformCapabilitiesPlan(plan, options = {}) {
       assemblyScriptDurationMs,
       primaryArtifact,
       startWrapper,
-      output: requestedOutDir ? Object.freeze({ outDir: outputDir, wasmFile, watFile }) : undefined
+      output: requestedOutDir ? Object.freeze({ outDir: outputDir, wasmFile, watFile: emitWat ? watFile : null }) : undefined
     });
   } finally {
     fs.rmSync(stagingDir, { recursive: true, force: true });
@@ -2080,10 +2673,12 @@ function writeFastlyNativePlatformCapabilitiesModule(compiled, outDir, options =
   const manifestFile = path.join(target, options.manifestFile || 'fastly-native-platform-capabilities-manifest.json');
   fs.writeFileSync(sourceFile, compiled.source, 'utf8');
   fs.writeFileSync(wasmFile, compiled.wasm);
-  fs.writeFileSync(watFile, compiled.wat, 'utf8');
+  const emitWat = compiled.manifest.wat.emitted !== false;
+  if (emitWat) fs.writeFileSync(watFile, compiled.wat, 'utf8');
+  else fs.rmSync(watFile, { force: true });
   fs.writeFileSync(planFile, `${stableStringify(compiled.plan, 2)}\n`, 'utf8');
   fs.writeFileSync(manifestFile, `${stableStringify(compiled.manifest, 2)}\n`, 'utf8');
-  return Object.freeze({ target, sourceFile, wasmFile, watFile, planFile, manifestFile, manifest: compiled.manifest });
+  return Object.freeze({ target, sourceFile, wasmFile, watFile: emitWat ? watFile : null, planFile, manifestFile, manifest: compiled.manifest });
 }
 
 module.exports = Object.freeze({