@pulse-compute/provider-fastly 1.0.0-beta.1 → 1.0.0-beta.2

package/src/build/native-platform-capabilities.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const crypto = require('node:crypto');
+const conditionalKv = require('./kv-native.js');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
@@ -94,6 +95,8 @@ const FASTLY_NATIVE_PLATFORM_CAPABILITIES_BUFFER_BYTES = 65536;
 const FASTLY_NATIVE_SIZE_OPTIMIZATION = EXPERIMENTAL_NATIVE_SIZE_OPTIMIZATION;
 
 const FASTLY_NATIVE_PLATFORM_CAPABILITIES_IMPORTS = Object.freeze([
+  ...conditionalKv.KV_IMPORTS.map((key) => Object.freeze(key.split(':'))),
+  ...require('./s3-native.js').S3_IMPORTS.map((key) => Object.freeze(key.split(':'))),
   Object.freeze(['fastly_abi', 'init']),
   Object.freeze(['fastly_http_req', 'body_downstream_get']),
   Object.freeze(['fastly_http_req', 'method_get']),
@@ -127,7 +130,7 @@ const FASTLY_NATIVE_PLATFORM_CAPABILITIES_IMPORTS = Object.freeze([
   Object.freeze(['fastly_log', 'endpoint_get']),
   Object.freeze(['fastly_log', 'write']),
   Object.freeze(['wasi_snapshot_preview1', 'clock_time_get'])
-]);
+].filter(([module, name], index, entries) => entries.findIndex((item) => item[0] === module && item[1] === name) === index));
 
 const FASTLY_NATIVE_PLATFORM_CAPABILITIES_REQUIRED_IMPORTS = Object.freeze([
   Object.freeze(['fastly_abi', 'init']),
@@ -148,7 +151,13 @@ const FASTLY_NATIVE_PLATFORM_EFFECT_KIND = Object.freeze({
   'grip.publish': 8,
   'grip.broadcast': 9,
   'assets.lookup': 10,
-  'jwt.verify': 11
+  'jwt.verify': 11,
+  's3.head': 12,
+  's3.getText': 13,
+  's3.putText': 14,
+  'kv.getVersioned': 15,
+  'kv.insertIfAbsent': 16,
+  'kv.compareAndSwap': 17
 });
 
 const FASTLY_NATIVE_PLATFORM_CAPABILITIES_ALLOWED_IMPORTS = new Set([
@@ -161,12 +170,16 @@ const FASTLY_NATIVE_PLATFORM_EFFECT_KINDS = Object.freeze([
   'secret.get',
   'kv.get',
   'kv.put',
+  ...conditionalKv.KV_CONDITIONAL_KINDS,
   'grip.channel',
   'grip.hold',
   'grip.publish',
   'grip.broadcast',
   'assets.lookup',
-  'jwt.verify'
+  'jwt.verify',
+  's3.head',
+  's3.getText',
+  's3.putText'
 ]);
 
 const FASTLY_NATIVE_PLATFORM_CAPABILITY_KINDS = new Set([
@@ -174,12 +187,16 @@ const FASTLY_NATIVE_PLATFORM_CAPABILITY_KINDS = new Set([
   'secret.get',
   'kv.get',
   'kv.put',
+  ...conditionalKv.KV_CONDITIONAL_KINDS,
   'assets.lookup',
   'grip.channel',
   'grip.hold',
   'grip.publish',
   'grip.broadcast',
-  'jwt.verify'
+  'jwt.verify',
+  's3.head',
+  's3.getText',
+  's3.putText'
 ]);
 
 class FastlyNativePlatformCapabilitiesError extends Error {
@@ -245,7 +262,7 @@ function selectedJwtCrypto(plan) {
   const hasJwt = (plan.effects || []).some((effect) => effect.kind === 'jwt.verify');
   if (!hasJwt) return undefined;
   const algorithms = plan.crypto && Array.isArray(plan.crypto.algorithms)
-    ? plan.crypto.algorithms
+    ? plan.crypto.algorithms.filter((entry) => ['HS256', 'ES256'].includes(entry.algorithm))
     : [];
   if (algorithms.length !== 1) {
     fail(
@@ -572,7 +589,9 @@ function validatePlanBoundary(plan, options = {}) {
       && effect.kind === 'jwt.verify'
       && effect.operation === 'verify'
       && effect.capability === 'jwt.verify';
-    return !grip && !assets && !jwt;
+    const s3 = effect.package === '@pulse-compute/s3' && effect.contractId === 'pulse.s3'
+      && ['head', 'getText', 'putText'].includes(effect.operation) && effect.kind === `s3.${effect.operation}` && effect.capability === effect.kind;
+    return !grip && !assets && !jwt && !s3;
   });
   if (unsupportedPackages.length > 0) {
     fail('Fastly native realization only accepts the trusted first-party Assets, GRIP, and JWT package contracts.', 'PULSE_FASTLY_NATIVE_PLATFORM_PACKAGE_UNSUPPORTED', {
@@ -592,7 +611,9 @@ function validatePlanBoundary(plan, options = {}) {
       && effect.kind === 'jwt.verify'
       && effect.operation === 'verify'
       && effect.capability === 'jwt.verify';
-    return !grip && !assets && !jwt;
+    const s3 = effect.package === '@pulse-compute/s3' && effect.contractId === 'pulse.s3'
+      && ['head', 'getText', 'putText'].includes(effect.operation) && effect.kind === `s3.${effect.operation}` && effect.capability === effect.kind;
+    return !grip && !assets && !jwt && !s3;
   });
   if (unsupportedDeclarations.length > 0) {
     fail('Fastly native package realization is restricted to the Assets, GRIP, and JWT contracts.', 'PULSE_FASTLY_NATIVE_PLATFORM_PACKAGE_UNSUPPORTED', { effects: unsupportedDeclarations });
@@ -678,7 +699,7 @@ function resolveCapabilityBindings(plan, options = {}) {
   const effects = plan.effects || [];
   const hasConfig = effects.some((effect) => effect.kind === 'config.get');
   const hasSecret = effects.some((effect) => (
-    effect.kind === 'secret.get'
+    effect.kind === 'secret.get' || ['s3.head', 's3.getText', 's3.putText'].includes(effect.kind)
     || (effect.kind === 'jwt.verify' && effect.resource && effect.resource.keyType === 'secret')
   ));
   const hasGripHold = effects.some((effect) => effect.kind === 'grip.hold');
@@ -703,7 +724,7 @@ function resolveCapabilityBindings(plan, options = {}) {
 
   const kv = [];
   for (const [index, effect] of effects.entries()) {
-    if (effect.kind !== 'kv.get' && effect.kind !== 'kv.put' && effect.kind !== 'assets.lookup') continue;
+    if (effect.kind !== 'kv.get' && effect.kind !== 'kv.put' && !conditionalKv.KV_CONDITIONAL_KINDS.includes(effect.kind) && effect.kind !== 'assets.lookup') continue;
     const packagePayload = inputExpression(effect, 'payload');
     const logical = effect.resource && effect.resource.kind === 'literal'
       && effect.kind !== 'assets.lookup'
@@ -715,6 +736,7 @@ function resolveCapabilityBindings(plan, options = {}) {
         resource: effect.resource
       });
     }
+    if (conditionalKv.KV_CONDITIONAL_KINDS.includes(effect.kind) && Buffer.byteLength(logical, 'utf8') > conditionalKv.KV_CONDITIONAL_LIMITS.namespaceBytes) fail('Conditional KV namespace exceeds its portable bound.', 'PULSE_FASTLY_NATIVE_KV_NAMESPACE_DYNAMIC');
     const physical = stringBinding(
       kvMap[logical],
       `Fastly KV binding for ${logical}`,
@@ -801,6 +823,7 @@ function resolveCapabilityBindings(plan, options = {}) {
   return Object.freeze({
     configStore,
     secretStore,
+    s3: require('../toolchain/s3.js').resolveFastlyS3(effects.map((effect) => ({ ...effect, payload: { contentType: literalObjectField(inputExpression(effect, 'payload'), 'contentType') || undefined } })), source.s3),
     kv: Object.freeze(kv),
     fetch: Object.freeze(fetch),
     backends: Object.freeze(backends),
@@ -868,6 +891,7 @@ function requiredImportsForPlan(plan, bindings) {
   if (kinds.has('secret.get') || jwtSecretRequired || gripAuthenticationRequired) {
     for (const key of ['fastly_secret_store:open', 'fastly_secret_store:get', 'fastly_secret_store:plaintext']) keys.add(key);
   }
+  for (const kind of conditionalKv.KV_CONDITIONAL_KINDS) if (kinds.has(kind)) for (const key of conditionalKv.kvImports(kind)) keys.add(key);
   if (kinds.has('jwt.verify')) keys.add('wasi_snapshot_preview1:clock_time_get');
   if (kinds.has('kv.get') || kinds.has('kv.put') || kinds.has('assets.lookup')) keys.add('fastly_kv_store:open');
   if (kinds.has('kv.get') || kinds.has('assets.lookup')) for (const key of ['fastly_kv_store:lookup', 'fastly_kv_store:lookup_wait_v2', 'fastly_http_body:read']) keys.add(key);
@@ -877,6 +901,7 @@ function requiredImportsForPlan(plan, bindings) {
     keys.add('fastly_log:endpoint_get');
     keys.add('fastly_log:write');
   }
+  if (kinds.has('s3.head') || kinds.has('s3.getText') || kinds.has('s3.putText')) for (const key of require('./s3-native.js').S3_IMPORTS) keys.add(key);
   return Object.freeze([...keys].sort());
 }
 
@@ -1014,7 +1039,7 @@ function effectResultSource(plan, bindings) {
   for (const [index, effect] of (plan.effects || []).entries()) {
     const result = effect.result || {};
     const decoder = result.decoder;
-    const waiter = effect.kind === 'fetch'
+    const waiter = conditionalKv.KV_CONDITIONAL_KINDS.includes(effect.kind) ? '__pulse_fastly_kv_conditional_wait' : ['s3.head', 's3.getText', 's3.putText'].includes(effect.kind) ? '__pulse_fastly_s3_wait' : effect.kind === 'fetch'
       ? '__pulse_fastly_wait_fetch'
       : effect.kind === 'grip.publish'
         ? '__pulse_fastly_wait_grip_publish'
@@ -1054,8 +1079,12 @@ function effectDispatchSource(plan) {
     'config.get': '__pulse_fastly_config_begin',
     'secret.get': '__pulse_fastly_secret_begin',
     'jwt.verify': '__pulse_fastly_jwt_begin',
+    's3.head': '__pulse_fastly_s3_begin',
+    's3.getText': '__pulse_fastly_s3_begin',
+    's3.putText': '__pulse_fastly_s3_begin',
     'kv.get': '__pulse_fastly_kv_get_begin',
     'kv.put': '__pulse_fastly_kv_put_begin',
+    ...Object.fromEntries(conditionalKv.KV_CONDITIONAL_KINDS.map(kind => [kind, '__pulse_fastly_kv_conditional_begin'])),
     'assets.lookup': '__pulse_fastly_assets_begin',
     'grip.channel': '__pulse_fastly_grip_channel_begin',
     'grip.hold': '__pulse_fastly_grip_hold_begin',
@@ -1255,11 +1284,14 @@ class __PulseJsonParser {
   source: string
   index: i32 = 0
   failed: bool = false
-  constructor(source: string) { this.source = source }
+  tooLarge: bool = false
+  entries: i32 = 0
+  constructor(source: string, public conditionalKv: bool = false) { this.source = source }
   skip(): void { while (this.index < this.source.length) { const c = this.source.charCodeAt(this.index); if (c != 32 && c != 9 && c != 10 && c != 13) return; this.index += 1 } }
   parse(): i32 { this.skip(); const value = this.value(0); this.skip(); if (this.index != this.source.length) this.failed = true; return this.failed ? 0 : value }
   value(depth: i32): i32 {
-    this.skip(); if (this.index >= this.source.length || depth > 64) { this.failed = true; return 0 }
+    this.skip(); if (this.conditionalKv && (depth > ${conditionalKv.KV_CONDITIONAL_LIMITS.depth + 1} || ++this.entries > ${conditionalKv.KV_CONDITIONAL_LIMITS.entries + 2})) { this.failed = true; this.tooLarge = true; return 0 }
+    if (this.index >= this.source.length || (!this.conditionalKv && depth > ${plan.effects.some(effect => conditionalKv.KV_CONDITIONAL_KINDS.includes(effect.kind)) ? 128 : 64})) { this.failed = true; return 0 }
     const c = this.source.charCodeAt(this.index)
     if (c == 34) return __pulse_fastly_string_value(this.string())
     if (c == 123) return this.object(depth + 1)
@@ -1271,37 +1303,43 @@ class __PulseJsonParser {
     this.failed = true; return 0
   }
   string(): string {
-    let output = ""; this.index += 1
-    while (this.index < this.source.length) {
-      let c = this.source.charCodeAt(this.index); this.index += 1
-      if (c == 34) return output
+    // Find a bounded span, then decode each UTF-16 unit once. Concatenating one
+    // character at a time exhausts stub/fixed memory on a valid maximum KV value.
+    const start = this.index + 1; let end = start;
+    while (end < this.source.length) {
+      const c = this.source.charCodeAt(end);
+      if (c == 34) break;
+      if (c == 92) end += 1;
+      end += 1;
+    }
+    if (end >= this.source.length) { this.failed = true; return "" }
+    const output = new Uint16Array(end - start); let count = 0; this.index = start;
+    while (this.index < end) {
+      let c = this.source.charCodeAt(this.index++);
       if (c == 92) {
-        if (this.index >= this.source.length) { this.failed = true; return "" }
-        c = this.source.charCodeAt(this.index); this.index += 1
-        if (c == 34 || c == 92 || c == 47) output += String.fromCharCode(c)
-        else if (c == 98) output += String.fromCharCode(8)
-        else if (c == 102) output += String.fromCharCode(12)
-        else if (c == 110) output += "\n"
-        else if (c == 114) output += "\r"
-        else if (c == 116) output += "\t"
+        if (this.index >= end) { this.failed = true; return "" }
+        c = this.source.charCodeAt(this.index++);
+        if (c == 34 || c == 92 || c == 47) {}
+        else if (c == 98) c = 8;
+        else if (c == 102) c = 12;
+        else if (c == 110) c = 10;
+        else if (c == 114) c = 13;
+        else if (c == 116) c = 9;
         else if (c == 117) {
-          if (this.index + 4 > this.source.length) { this.failed = true; return "" }
-          let code = 0
-          for (let digitIndex = 0; digitIndex < 4; digitIndex += 1) {
-            const digitCode = this.source.charCodeAt(this.index + digitIndex)
-            let digit = -1
-            if (digitCode >= 48 && digitCode <= 57) digit = digitCode - 48
-            else if (digitCode >= 65 && digitCode <= 70) digit = digitCode - 55
-            else if (digitCode >= 97 && digitCode <= 102) digit = digitCode - 87
+          if (this.index + 4 > end) { this.failed = true; return "" }
+          c = 0;
+          for (let i = 0; i < 4; i++) {
+            const d = this.source.charCodeAt(this.index++);
+            const digit = d >= 48 && d <= 57 ? d - 48 : d >= 65 && d <= 70 ? d - 55 : d >= 97 && d <= 102 ? d - 87 : -1;
             if (digit < 0) { this.failed = true; return "" }
-            code = (code << 4) | digit
+            c = (c << 4) | digit;
           }
-          this.index += 4; output += String.fromCharCode(code)
         } else { this.failed = true; return "" }
       } else if (c < 32) { this.failed = true; return "" }
-      else output += String.fromCharCode(c)
+      output[count++] = u16(c);
     }
-    this.failed = true; return ""
+    this.index = end + 1;
+    return String.UTF16.decodeUnsafe(output.dataStart, count * 2);
   }
   numberValue(): i32 {
     const start = this.index
@@ -1350,6 +1388,7 @@ class __PulseJsonParser {
     while (!this.failed) {
       this.skip(); if (this.index >= this.source.length || this.source.charCodeAt(this.index) != 34) { this.failed = true; break }
       const key = this.string(); this.skip()
+      if (this.conditionalKv && __pulse_fastly_find(__pulse_fastly_value(output), key) >= 0) { this.failed = true; break }
       if (this.index >= this.source.length || this.source.charCodeAt(this.index) != 58) { this.failed = true; break }
       this.index += 1; host_value_object_set(output, __pulse_fastly_string_value(key), this.value(depth)); this.skip()
       if (this.index >= this.source.length) { this.failed = true; break }
@@ -1411,9 +1450,37 @@ function __pulse_fastly_redact(input: string): string { let output = input; for
 function host_log(level: i32, messageHandle: i32): void { let endpoint = __pulse_fastly_log_handle; if (endpoint == -2) return; if (endpoint == -1) { const name = __pulse_fastly_utf8("stdout"); const out = __pulse_fastly_out_i32(); if (fastly_log_endpoint_get(changetype<usize>(name), name.byteLength, changetype<usize>(out)) != FASTLY_STATUS_OK) { __pulse_fastly_log_handle = -2; return } endpoint = __pulse_fastly_out_value(out); __pulse_fastly_log_handle = endpoint } let label = "unknown"; if (level == 1) label = "error"; else if (level == 2) label = "warn"; else if (level == 3) label = "info"; else if (level == 4) label = "debug"; const bytes = __pulse_fastly_utf8("[pulse:" + label + "] " + __pulse_fastly_redact(__pulse_fastly_string(messageHandle)) + "\n"); const written = __pulse_fastly_out_i32(); fastly_log_write(endpoint, changetype<usize>(bytes), bytes.byteLength, changetype<usize>(written)) }
 function __pulse_fastly_number(handle: i32): f64 { const value = __pulse_fastly_value(handle); if (value.kind == PULSE_VALUE_NUMBER) return value.number; if (value.kind == PULSE_VALUE_BOOLEAN) return value.boolean != 0 ? 1.0 : 0.0; if (value.kind == PULSE_VALUE_STRING) return F64.parseFloat(value.text); return 0.0 }
 function __pulse_fastly_hex(value: i32): string { return String.fromCharCode(value < 10 ? 48 + value : 87 + value) }
-function __pulse_fastly_quote(value: string): string { let out = "\""; for (let i = 0; i < value.length; i += 1) { const c = value.charCodeAt(i); if (c == 34) out += "\\\""; else if (c == 92) out += "\\\\"; else if (c == 8) out += "\\b"; else if (c == 9) out += "\\t"; else if (c == 10) out += "\\n"; else if (c == 12) out += "\\f"; else if (c == 13) out += "\\r"; else if (c < 32) out += "\\u00" + __pulse_fastly_hex((c >> 4) & 15) + __pulse_fastly_hex(c & 15); else out += String.fromCharCode(c) } return out + "\"" }
+function __pulse_fastly_is_unpaired(value: string, i: i32): bool {
+  const c = value.charCodeAt(i);
+  if (c >= 0xd800 && c <= 0xdbff) return i + 1 >= value.length || value.charCodeAt(i + 1) < 0xdc00 || value.charCodeAt(i + 1) > 0xdfff;
+  if (c >= 0xdc00 && c <= 0xdfff) return i == 0 || value.charCodeAt(i - 1) < 0xd800 || value.charCodeAt(i - 1) > 0xdbff;
+  return false;
+}
+function __pulse_fastly_quote(value: string): string {
+  // Count once and write UTF-16 units once. Repeated concatenation can allocate
+  // gigabytes for a valid bounded string when every byte needs JSON escaping.
+  let size = 2;
+  for (let i = 0; i < value.length; i++) {
+    const c = value.charCodeAt(i);
+    size += c == 34 || c == 92 || c == 8 || c == 9 || c == 10 || c == 12 || c == 13 ? 2 : (c < 32 || __pulse_fastly_is_unpaired(value, i)) ? 6 : 1;
+  }
+  const out = new Uint16Array(size); let cursor = 0; out[cursor++] = 34;
+  for (let i = 0; i < value.length; i++) {
+    const c = value.charCodeAt(i);
+    if (c == 34 || c == 92) { out[cursor++] = 92; out[cursor++] = u16(c); }
+    else if (c == 8 || c == 9 || c == 10 || c == 12 || c == 13) {
+      out[cursor++] = 92; out[cursor++] = c == 8 ? 98 : c == 9 ? 116 : c == 10 ? 110 : c == 12 ? 102 : 114;
+    } else if (c < 32 || __pulse_fastly_is_unpaired(value, i)) {
+      out[cursor++] = 92; out[cursor++] = 117;
+      out[cursor++] = u16('0123456789abcdef'.charCodeAt((c >> 12) & 15)); out[cursor++] = u16('0123456789abcdef'.charCodeAt((c >> 8) & 15));
+      out[cursor++] = u16('0123456789abcdef'.charCodeAt((c >> 4) & 15)); out[cursor++] = u16('0123456789abcdef'.charCodeAt(c & 15));
+    } else out[cursor++] = u16(c);
+  }
+  out[cursor] = 34;
+  return String.UTF16.decodeUnsafe(out.dataStart, out.byteLength);
+}
 function __pulse_fastly_json(handle: i32, depth: i32): string {
-  if (depth > 64) { __pulse_fastly_fail(PULSE_ERROR_JSON, 2, -1); return "null" }
+  if (depth > ${plan.effects.some(effect => conditionalKv.KV_CONDITIONAL_KINDS.includes(effect.kind)) ? 128 : 64}) { __pulse_fastly_fail(PULSE_ERROR_JSON, 2, -1); return "null" }
   const value = __pulse_fastly_value(handle)
   if (value.kind == PULSE_VALUE_UNDEFINED || value.kind == PULSE_VALUE_NULL) return "null"
   if (value.kind == PULSE_VALUE_BOOLEAN) return value.boolean != 0 ? "true" : "false"
@@ -1426,7 +1493,24 @@ function __pulse_fastly_json(handle: i32, depth: i32): string {
 function __pulse_fastly_parse_json(text: string): i32 { const parser = new __PulseJsonParser(text); const value = parser.parse(); if (parser.failed || value <= 0) { __pulse_fastly_fail(PULSE_ERROR_JSON, 3, -1); return 0 } return value }
 function __pulse_fastly_path(uri: string): string { let start = 0; const scheme = uri.indexOf("://"); if (scheme >= 0) { const slash = uri.indexOf("/", scheme + 3); start = slash >= 0 ? slash : uri.length } let end = uri.length; const query = uri.indexOf("?", start); if (query >= 0 && query < end) end = query; const fragment = uri.indexOf("#", start); if (fragment >= 0 && fragment < end) end = fragment; return start >= end ? "/" : uri.substring(start, end) }
 function __pulse_fastly_read_req_string(kind: i32): string { const buffer = new Uint8Array(PULSE_FASTLY_BUFFER_BYTES); const written = __pulse_fastly_out_i32(); const status = kind == 0 ? fastly_http_req_method_get(__pulse_fastly_request_handle, buffer.dataStart, PULSE_FASTLY_BUFFER_BYTES, changetype<usize>(written)) : fastly_http_req_uri_get(__pulse_fastly_request_handle, buffer.dataStart, PULSE_FASTLY_BUFFER_BYTES, changetype<usize>(written)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 10 + kind, -1); return "" } return __pulse_fastly_decode(buffer, __pulse_fastly_out_value(written)) }
-function __pulse_fastly_read_body(handle: i32, effectIndex: i32): string { let out = ""; let total = 0; while (true) { const buffer = new Uint8Array(PULSE_FASTLY_BUFFER_BYTES); const read = __pulse_fastly_out_i32(); const status = fastly_http_body_read(handle, buffer.dataStart, PULSE_FASTLY_BUFFER_BYTES, changetype<usize>(read)); if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 20, effectIndex); return "" } const count = __pulse_fastly_out_value(read); if (count <= 0) return out; total += count; if (total > __PULSE_SCHEMA_MAX_BYTES && __PULSE_SCHEMA_MAX_BYTES > 0) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 21, effectIndex); return "" } out += __pulse_fastly_decode(buffer, count) } }
+function __pulse_fastly_read_body(handle: i32, effectIndex: i32): string {
+  const chunks = new Array<Uint8Array>(); let total = 0;
+  while (true) {
+    const buffer = new Uint8Array(PULSE_FASTLY_BUFFER_BYTES), read = __pulse_fastly_out_i32();
+    const status = fastly_http_body_read(handle, buffer.dataStart, buffer.length, changetype<usize>(read));
+    if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 20, effectIndex); return "" }
+    const count = __pulse_fastly_out_value(read);
+    if (count < 0 || count > buffer.length) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 20, effectIndex); return "" }
+    if (!count) break;
+    total += count;
+    if (total > __PULSE_SCHEMA_MAX_BYTES && __PULSE_SCHEMA_MAX_BYTES > 0) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 21, effectIndex); return "" }
+    chunks.push(buffer.subarray(0, count));
+  }
+  // UTF-8 scalars may straddle host read chunks. Decode the bounded body once.
+  const bytes = new Uint8Array(total); let offset = 0;
+  for (let i = 0; i < chunks.length; i++) { bytes.set(chunks[i], offset); offset += chunks[i].length; }
+  return __pulse_fastly_decode(bytes, total);
+}
 function __pulse_fastly_request_header_text(name: string): string { const nameBytes = __pulse_fastly_utf8(name); const buffer = new Uint8Array(PULSE_FASTLY_BUFFER_BYTES); const written = __pulse_fastly_out_i32(); const status = fastly_http_req_header_value_get(__pulse_fastly_request_handle, changetype<usize>(nameBytes), nameBytes.byteLength, buffer.dataStart, PULSE_FASTLY_BUFFER_BYTES, changetype<usize>(written)); if (status == FASTLY_STATUS_NONE) return ""; if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 22, -1); return "" } return __pulse_fastly_decode(buffer, __pulse_fastly_out_value(written)) }
 function __pulse_fastly_fetch_header_text(responseHandle: i32, name: string): string { const nameBytes = __pulse_fastly_utf8(name); const buffer = new Uint8Array(PULSE_FASTLY_BUFFER_BYTES); const written = __pulse_fastly_out_i32(); const status = fastly_http_resp_header_value_get(responseHandle, changetype<usize>(nameBytes), nameBytes.byteLength, buffer.dataStart, PULSE_FASTLY_BUFFER_BYTES, changetype<usize>(written)); if (status == FASTLY_STATUS_NONE) return ""; if (status != FASTLY_STATUS_OK) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 23, -1); return "" } return __pulse_fastly_decode(buffer, __pulse_fastly_out_value(written)) }
 function __pulse_fastly_fetch_body(value: __PulseFastlyValue): string { if (value.bodyLoaded == 0) { value.text = __pulse_fastly_read_body(value.bodyHandle, -1); value.bodyLoaded = 1 } return value.text }
@@ -1592,6 +1676,7 @@ function capabilityImports(effect) {
       'wasi_snapshot_preview1.clock_time_get'
     ];
   }
+  if (conditionalKv.KV_CONDITIONAL_KINDS.includes(effect.kind)) return conditionalKv.kvImports(effect.kind).map(key => key.replace(':', '.'));
   if (effect.kind === 'kv.get') return ['fastly_kv_store.open', 'fastly_kv_store.lookup', 'fastly_kv_store.lookup_wait_v2', 'fastly_http_body.read'];
   if (effect.kind === 'kv.put') return ['fastly_kv_store.open', 'fastly_kv_store.insert', 'fastly_kv_store.insert_wait', 'fastly_http_body.new', 'fastly_http_body.write'];
   if (effect.kind === 'assets.lookup') return ['fastly_kv_store.open', 'fastly_kv_store.lookup', 'fastly_kv_store.lookup_wait_v2', 'fastly_http_body.read'];
@@ -1649,6 +1734,8 @@ function generateFastlyNativePlatformCapabilitiesAssemblyScript(plan, options =
       es256KeyRecords
     }),
     jwtSource ? jwtSource.source : '',
+    require('./s3-native.js').s3NativeSource(plan, bindings),
+    conditionalKv.kvNativeSource(plan),
     portableSource,
     driverSource(plan, { guestLinked: facts.guestUnits.length > 0 }),
     ''
@@ -1720,8 +1807,8 @@ function generateFastlyNativePlatformCapabilitiesAssemblyScript(plan, options =
       providerNeutralInput: true,
       javascriptRuntime: false,
       jsComputeRuntime: false,
-      wasi: hasJwt ? 'clock_time_get only' : false,
-      effects: 'fetch, config.get, secret.get, kv.get, kv.put, assets.lookup, grip.channel, grip.hold, grip.publish, grip.broadcast, jwt.verify',
+      wasi: hasJwt || bindings.s3.length || plan.effects.some(effect => conditionalKv.KV_CONDITIONAL_KINDS.includes(effect.kind)) ? 'clock_time_get only' : false,
+      effects: FASTLY_NATIVE_PLATFORM_EFFECT_KINDS.join(', '),
       continuations: true,
       groupedEffects: 'existing fetch start-before-wait ordering remains intact',
       config: 'Fastly Config Store open/get with undefined for missing values',
@@ -1729,7 +1816,7 @@ function generateFastlyNativePlatformCapabilitiesAssemblyScript(plan, options =
       jwt: hasJwt
         ? `package-owned compact-JWS and registered-claim semantics composed with ${jwtCrypto.realization}; provider-owned request, clock, schema, and transport`
         : 'inactive',
-      kv: 'Fastly KV Store async lookup/insert with Pulse JSON envelope compatibility',
+      kv: 'Fastly KV Store async lookup/insert; conditional operations preserve u64 generations, bounded readiness, strict Pulse envelopes and uncertain dispatch',
       assets: 'Fastly KV Store lookup with provider-owned content type, cache headers, and GET/HEAD body ownership',
       grip: 'canonical stateless framing plus bound, secret-referenced broadcast HTTP realization and stable acknowledgement',
       logging: 'best-effort redacted writes to the provider-owned stdout logging endpoint',

package/src/build/s3-native.as.ts

@@ -0,0 +1,215 @@
+// Provider-owned lifecycle and host ABI. Protocol algorithms are S3-owned.
+@external('fastly_async_io', 'select') declare function __s3_select(handles: usize, count: i32, timeout: i32, done: usize): i32
+@external('fastly_http_req', 'pending_req_poll_v2') declare function __s3_poll(pending: i32, detail: usize, done: usize, response: usize, body: usize): i32
+@external('fastly_http_req', 'cache_override_set') declare function __s3_cache(request: i32, tag: i32, ttl: i32, swr: i32): i32
+@external('fastly_http_req', 'auto_decompress_response_set') declare function __s3_decompress(request: i32, encodings: i32): i32
+@external('fastly_http_req', 'close') declare function __s3_close_req(request: i32): i32
+@external('fastly_http_resp', 'close') declare function __s3_close_resp(response: i32): i32
+@external('fastly_http_body', 'close') declare function __s3_close_body(body: i32): i32
+@external('fastly_http_resp', 'header_names_get') declare function __s3_header_names(response: i32, buffer: usize, size: i32, cursor: i32, end: usize, written: usize): i32
+@external('fastly_http_resp', 'header_values_get') declare function __s3_header_values(response: i32, name: usize, length: i32, buffer: usize, size: i32, cursor: i32, end: usize, written: usize): i32
+
+class __PulseS3Binding {
+  contentType: string = ''; endpoint: string = ''; bucket: string = ''; region: string = ''; backend: string = '';
+  id: string = ''; secret: string = ''; token: string = ''; max: i32 = 32768; timeout: i32 = 10000;
+}
+@lazy const __s3_dispatched = new StaticArray<bool>(PULSE_FASTLY_EFFECT_COUNT)
+@lazy const __s3_sent_bytes = new StaticArray<i32>(PULSE_FASTLY_EFFECT_COUNT)
+@lazy const __s3_digests = new Array<string>(PULSE_FASTLY_EFFECT_COUNT).fill('')
+@lazy const __s3_deadlines = new StaticArray<i64>(PULSE_FASTLY_EFFECT_COUNT)
+function __s3_clock(id: i32): i64 {
+  const out = new StaticArray<i64>(1);
+  return wasi_snapshot_preview1_clock_time_get(id, 1000000, changetype<usize>(out)) == 0 ? out[0] : -1;
+}
+function __s3_remaining(index: i32): i32 {
+  const now = __s3_clock(1);
+  if (now < 0) return 0;
+  const ns = __s3_deadlines[index] - now;
+  return ns <= 0 ? 0 : i32((ns + 999999) / 1000000);
+}
+function __s3_set(object: i32, name: string, value: i32): void { host_value_object_set(object, __pulse_fastly_string_value(name), value) }
+function __s3_result(status: string, reason: string = '', http: i32 = 0): i32 {
+  const result = host_value_object(); __s3_set(result, 'status', __pulse_fastly_string_value(status));
+  if (reason.length) __s3_set(result, 'reason', __pulse_fastly_string_value(reason));
+  if (http > 0) { const value = new __PulseFastlyValue(); value.kind = PULSE_VALUE_NUMBER; value.number = f64(http); __s3_set(result, 'httpStatus', __pulse_fastly_put(value)); }
+  return result;
+}
+function __s3_failure(index: i32, reason: string, http: i32 = 0): i32 {
+  return __s3_result(__pulse_fastly_effect_kind(index) == 14 ? (__s3_dispatched[index] ? 'unknown' : 'not-stored') : 'failed', reason, http);
+}
+function __s3_fail(index: i32, reason: string): void { __pulse_fastly_ready_effect(index, __s3_failure(index, reason)) }
+function __s3_secret(store: i32, name: string): string | null {
+  const key = __pulse_s3_bytes(name), out = new StaticArray<i32>(1), size = new StaticArray<i32>(1), bytes = new Uint8Array(4096);
+  if (fastly_secret_store_get(store, key.dataStart, key.length, changetype<usize>(out)) != 0) return null;
+  const status = fastly_secret_store_plaintext(out[0], bytes.dataStart, bytes.length, changetype<usize>(size));
+  let result: string | null = null;
+  if (status == 0 && size[0] > 0 && size[0] <= bytes.length) {
+    const raw = bytes.subarray(0, size[0]);
+    if (__pulse_s3_utf8_valid(raw)) result = String.UTF8.decodeUnsafe(raw.dataStart, raw.length, false);
+  }
+  bytes.fill(0);
+  if (result !== null) __pulse_fastly_remember_secret(result);
+  return result;
+}
+function __s3_header(request: i32, name: string, value: string): bool {
+  const n = __pulse_s3_bytes(name), v = __pulse_s3_bytes(value);
+  return fastly_http_req_header_insert(request, n.dataStart, n.length, v.dataStart, v.length) == 0;
+}
+function __pulse_fastly_s3_begin(index: i32, outer: __PulseFastlyValue): void {
+  __s3_dispatched[index] = false; __s3_sent_bytes[index] = 0; __s3_digests[index] = '';
+  const put = __pulse_fastly_effect_kind(index) == 14;
+  const payload = __pulse_fastly_value(__pulse_fastly_payload_field(outer, 'invocation'));
+  const input = __pulse_fastly_value(__pulse_fastly_payload_field(payload, 'key'));
+  if (input.kind != PULSE_VALUE_STRING) { __s3_fail(index, 'invalid-key'); return; }
+  const encoded = __pulse_s3_key(input.text);
+  if (encoded === null) { __s3_fail(index, 'invalid-key'); return; }
+  // Package effect payloads and signed paths must not enter provider logs.
+  __pulse_fastly_remember_secret(input.text);
+  const binding = __pulse_fastly_s3_binding(index), start = __s3_clock(1);
+  if (start < 0) { __s3_fail(index, 'configuration'); return; }
+  __s3_deadlines[index] = start + i64(binding.timeout) * 1000000;
+  let data = new Uint8Array(0);
+  if (put) {
+    const text = __pulse_fastly_value(__pulse_fastly_payload_field(payload, 'text'));
+    if (text.kind != PULSE_VALUE_STRING || !__pulse_s3_scalar(text.text)) { __s3_fail(index, 'invalid-text'); return; }
+    data = __pulse_s3_bytes(text.text);
+    if (data.length > binding.max) { __s3_fail(index, 'too-large'); return; }
+    __pulse_fastly_remember_secret(text.text);
+  }
+  const storeName = __pulse_s3_bytes(__pulse_fastly_secret_store(index)), store = new StaticArray<i32>(1);
+  if (fastly_secret_store_open(storeName.dataStart, storeName.length, changetype<usize>(store)) != 0) { __s3_fail(index, 'credentials'); return; }
+  const id = __s3_secret(store[0], binding.id), secret = __s3_secret(store[0], binding.secret);
+  const token = binding.token.length ? __s3_secret(store[0], binding.token) : '';
+  if (__s3_remaining(index) == 0) { __s3_fail(index, 'timeout'); return; }
+  if (id === null || secret === null || token === null || !__pulse_s3_credentials(id, secret, token)) { __s3_fail(index, 'credentials'); return; }
+  const method = put ? 'PUT' : __pulse_fastly_effect_kind(index) == 12 ? 'HEAD' : 'GET', path = '/' + binding.bucket + '/' + encoded;
+  const now = __s3_clock(0);
+  if (now < 0 || !__pulse_s3_date(now / 1000000000).length) { __s3_fail(index, 'configuration'); return; }
+  const signature = __pulse_s3_sign(method, path, binding.endpoint.slice(8), binding.region, id, secret, token, now / 1000000000, data, binding.contentType);
+  __s3_sent_bytes[index] = data.length; __s3_digests[index] = signature.digest;
+  __pulse_fastly_remember_secret(signature.digest);
+  __pulse_fastly_remember_secret(signature.authorization); __pulse_fastly_remember_secret(binding.endpoint + path);
+  if (__s3_remaining(index) == 0) { __s3_fail(index, 'timeout'); return; }
+  const request = new StaticArray<i32>(1), body = new StaticArray<i32>(1), pending = new StaticArray<i32>(1);
+  if (fastly_http_req_new(changetype<usize>(request)) != 0) { __s3_fail(index, 'transport'); return; }
+  const req = request[0], url = __pulse_s3_bytes(binding.endpoint + path), verb = __pulse_s3_bytes(method), backend = __pulse_s3_bytes(binding.backend);
+  let ok = fastly_http_req_uri_set(req, url.dataStart, url.length) == 0 && fastly_http_req_method_set(req, verb.dataStart, verb.length) == 0
+    && __s3_cache(req, 1, 0, 0) == 0 && __s3_decompress(req, 0) == 0
+    && __s3_header(req, 'host', binding.endpoint.slice(8)) && __s3_header(req, 'x-amz-date', signature.date)
+    && __s3_header(req, 'x-amz-content-sha256', signature.digest) && __s3_header(req, 'authorization', signature.authorization)
+    && __s3_header(req, 'accept-encoding', 'identity');
+  if (ok && put) ok = __s3_header(req, 'content-type', binding.contentType) && __s3_header(req, 'content-length', data.length.toString());
+  if (ok && token.length) ok = __s3_header(req, 'x-amz-security-token', token);
+  if (!ok || fastly_http_body_new(changetype<usize>(body)) != 0) { __s3_close_req(req); __s3_fail(index, 'transport'); return; }
+  let offset = 0; const written = new StaticArray<i32>(1);
+  while (offset < data.length) {
+    if (__s3_remaining(index) == 0) { __s3_close_req(req); __s3_close_body(body[0]); __s3_fail(index, 'timeout'); return; }
+    if (fastly_http_body_write(body[0], data.dataStart + offset, data.length - offset, 0, changetype<usize>(written)) != 0 || written[0] <= 0 || written[0] > data.length - offset) {
+      __s3_close_req(req); __s3_close_body(body[0]); __s3_fail(index, 'transport'); return;
+    }
+    offset += written[0];
+  }
+  if (__s3_remaining(index) == 0) { __s3_close_req(req); __s3_close_body(body[0]); __s3_fail(index, 'timeout'); return; }
+  __s3_dispatched[index] = true;
+  if (fastly_http_req_send_async(req, body[0], backend.dataStart, backend.length, changetype<usize>(pending)) != 0) {
+    __s3_close_req(req); __s3_close_body(body[0]); __s3_fail(index, 'transport'); return;
+  }
+  // send_async consumes request/body. Pending handles have no cancel hostcall.
+  __pulse_fastly_pending[index] = pending[0]; __pulse_fastly_pending_mode[index] = PULSE_FASTLY_PENDING_ASYNC;
+}
+function __s3_wait_ready(index: i32, handle: i32): i32 {
+  const timeout = __s3_remaining(index); if (timeout == 0) return 0;
+  const handles = new StaticArray<i32>(1), done = new StaticArray<i32>(1); handles[0] = handle;
+  if (__s3_select(changetype<usize>(handles), 1, timeout, changetype<usize>(done)) != 0) return -1;
+  return done[0] == -1 || __s3_remaining(index) == 0 ? 0 : 1;
+}
+function __s3_list(buffer: Uint8Array, size: i32): Array<string> | null {
+  if (size < 0 || size > buffer.length || (size > 0 && buffer[size - 1] != 0)) return null;
+  const result = new Array<string>(); let start = 0;
+  for (let i = 0; i < size; i++) if (buffer[i] == 0) {
+    const bytes = buffer.subarray(start, i); if (!__pulse_s3_utf8_valid(bytes)) return null;
+    result.push(String.UTF8.decodeUnsafe(bytes.dataStart, bytes.length, false)); start = i + 1;
+  }
+  return result;
+}
+function __s3_read_response(index: i32, response: i32, body: i32, status: i32): i32 {
+  const put = __pulse_fastly_effect_kind(index) == 14;
+  const rejected = put && status >= 400 && status <= 499 && status != 408;
+  if (!put && status == 404) return __s3_result('not-found');
+  if (status != 200 && !rejected) return __s3_failure(index, __pulse_s3_status_reason(status), status);
+  const buffer = new Uint8Array(16384), end = new StaticArray<i64>(1), size = new StaticArray<i32>(1);
+  if (__s3_header_names(response, buffer.dataStart, buffer.length, 0, changetype<usize>(end), changetype<usize>(size)) != 0 || end[0] >= 0) return __s3_failure(index, 'protocol', status);
+  const names = __s3_list(buffer, size[0]); if (names === null) return __s3_failure(index, 'protocol', status);
+  let total = 0, length: f64 = -1; const seen = new Set<string>();
+  const result = __s3_result(put ? 'stored' : 'found');
+  for (let i = 0; i < names.length; i++) {
+    const rawName = names[i], name = rawName.toLowerCase(), bytes = __pulse_s3_bytes(rawName);
+    if (__s3_header_values(response, bytes.dataStart, bytes.length, buffer.dataStart, buffer.length, 0, changetype<usize>(end), changetype<usize>(size)) != 0 || end[0] >= 0) return __s3_failure(index, 'protocol', status);
+    const values = __s3_list(buffer, size[0]); if (values === null) return __s3_failure(index, 'protocol', status);
+    const selected = name == 'content-length' || name == 'content-type' || name == 'etag' || name == 'content-encoding';
+    if (selected && (seen.has(name) || values.length != 1)) return __s3_failure(index, 'protocol', status);
+    seen.add(name);
+    for (let v = 0; v < values.length; v++) {
+      const value = values[v], count = __pulse_s3_bytes(value).length;
+      total += bytes.length + count + 4; if (total > 16384) return __s3_failure(index, 'protocol', status);
+      if (!selected) continue;
+      if (count > 1024 || !__pulse_s3_scalar(value, true)) return __s3_failure(index, 'protocol', status);
+      if (name == 'content-encoding' && value.toLowerCase() != 'identity') return __s3_failure(index, 'protocol', status);
+      if (name == 'content-length') {
+        if (!value.length || (value.length > 1 && value.charCodeAt(0) == 48)) return __s3_failure(index, 'protocol', status);
+        length = 0;
+        for (let c = 0; c < value.length; c++) { const digit = value.charCodeAt(c) - 48; if (digit < 0 || digit > 9) return __s3_failure(index, 'protocol', status); length = length * 10 + digit; if (length > 9007199254740991) return __s3_failure(index, 'protocol', status); }
+      }
+      if (name == 'etag') { if (!value.length) return __s3_failure(index, 'protocol', status); __s3_set(result, 'etag', __pulse_fastly_string_value(value)); }
+      if (name == 'content-type' && !put) __s3_set(result, 'contentType', __pulse_fastly_string_value(value));
+    }
+  }
+  if (__s3_remaining(index) == 0) return __s3_failure(index, 'timeout', status);
+  const head = __pulse_fastly_effect_kind(index) == 12, binding = __pulse_fastly_s3_binding(index);
+  if (head && length < 0) return __s3_failure(index, 'protocol', status);
+  if (!head) {
+    const maximum = put && !rejected ? 0 : binding.max;
+    if (length > maximum) return __s3_failure(index, put ? 'protocol' : 'too-large', status);
+    const data = new Uint8Array(maximum + 1); let count = 0;
+    while (true) {
+      const ready = __s3_wait_ready(index, body);
+      if (ready <= 0) return __s3_failure(index, ready == 0 ? 'timeout' : 'transport', status);
+      if (fastly_http_body_read(body, data.dataStart + count, data.length - count, changetype<usize>(size)) != 0) return __s3_failure(index, 'protocol', status);
+      if (size[0] < 0 || size[0] > data.length - count) return __s3_failure(index, 'protocol', status);
+      if (size[0] == 0) break;
+      count += size[0]; if (count > maximum) return __s3_failure(index, put ? 'protocol' : 'too-large', status);
+    }
+    if (length >= 0 && length != count) return __s3_failure(index, 'protocol', status);
+    if (put) {
+      if (__s3_remaining(index) == 0) return __s3_failure(index, 'timeout', status);
+      if (rejected) return __s3_result('not-stored', status == 401 || status == 403 ? 'not-authorized' : status == 429 ? 'throttled' : 'rejected', status);
+      const sent = new __PulseFastlyValue(); sent.kind = PULSE_VALUE_NUMBER; sent.number = f64(__s3_sent_bytes[index]);
+      __s3_set(result, 'byteLength', __pulse_fastly_put(sent));
+      __s3_set(result, 'sha256', __pulse_fastly_string_value(__s3_digests[index]));
+      return result;
+    }
+    length = f64(count); const raw = data.subarray(0, count), digest = __pulse_s3_hex(__pulse_s3_sha(raw));
+    if (!__pulse_s3_utf8_valid(raw)) return __s3_failure(index, 'invalid-utf8', status);
+    __s3_set(result, 'text', __pulse_fastly_string_value(String.UTF8.decodeUnsafe(raw.dataStart, raw.length, false)));
+    __s3_set(result, 'sha256', __pulse_fastly_string_value(digest));
+  }
+  if (__s3_remaining(index) == 0) return __s3_failure(index, 'timeout', status);
+  const sizeValue = new __PulseFastlyValue(); sizeValue.kind = PULSE_VALUE_NUMBER; sizeValue.number = length;
+  __s3_set(result, 'byteLength', __pulse_fastly_put(sizeValue)); return result;
+}
+function __pulse_fastly_s3_wait(index: i32): i32 {
+  if (__pulse_fastly_pending_mode[index] == PULSE_FASTLY_PENDING_READY) return __pulse_fastly_wait_ready(index);
+  const pending = __pulse_fastly_pending[index], detail = new StaticArray<i32>(4), done = new StaticArray<i32>(1);
+  const response = new StaticArray<i32>(1), body = new StaticArray<i32>(1), code = new StaticArray<i32>(1);
+  __pulse_fastly_pending_mode[index] = PULSE_FASTLY_PENDING_NONE; __pulse_fastly_pending[index] = 0;
+  while (true) {
+    const ready = __s3_wait_ready(index, pending);
+    if (ready <= 0) return __s3_failure(index, ready == 0 ? 'timeout' : 'transport');
+    if (__s3_poll(pending, changetype<usize>(detail), changetype<usize>(done), changetype<usize>(response), changetype<usize>(body)) != 0) return __s3_failure(index, 'transport');
+    if (done[0] != 0) break;
+  }
+  let result: i32;
+  if (fastly_http_resp_status_get(response[0], changetype<usize>(code)) != 0) result = __s3_failure(index, 'protocol');
+  else result = __s3_remaining(index) == 0 ? __s3_failure(index, 'timeout', code[0]) : __s3_read_response(index, response[0], body[0], code[0]);
+  __s3_close_body(body[0]); __s3_close_resp(response[0]); return result;
+}

package/src/build/s3-native.js

@@ -0,0 +1,30 @@
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const { pulseS3AssemblyScriptSource } = require('@pulse-compute/s3/pulsewasm-native');
+const S3_IMPORTS = Object.freeze([
+  'fastly_async_io:select', 'fastly_http_req:pending_req_poll_v2', 'fastly_http_req:cache_override_set',
+  'fastly_http_req:auto_decompress_response_set', 'fastly_http_req:close', 'fastly_http_resp:close', 'fastly_http_body:close',
+  'fastly_http_resp:header_names_get', 'fastly_http_resp:header_values_get', 'fastly_http_resp:status_get',
+  'fastly_http_req:new', 'fastly_http_req:method_set', 'fastly_http_req:uri_set', 'fastly_http_req:header_insert', 'fastly_http_req:send_async',
+  'fastly_http_body:new', 'fastly_http_body:read', 'fastly_http_body:write', 'fastly_secret_store:open', 'fastly_secret_store:get', 'fastly_secret_store:plaintext',
+  'wasi_snapshot_preview1:clock_time_get'
+]);
+function s3NativeSource(plan, bindings) {
+  if (!bindings.s3.length) return '';
+  const contribution = pulseS3AssemblyScriptSource();
+  for (const name of contribution.cryptoRequirements) {
+    const selected = plan.crypto && plan.crypto.algorithms.find((entry) => entry.algorithm === name);
+    if (!selected || selected.realization !== 'guest-source:pulse-hmac-as' || selected.implementation !== 'pulse-hmac-as.v1'
+      || selected.kind !== 'guest-source' || selected.targetImplemented !== true || selected.automaticFallback !== false) throw new TypeError('Fastly S3 requires its exact selected Native Crypto algorithms.');
+  }
+  const lines = ['function __pulse_fastly_s3_binding(index: i32): __PulseS3Binding {', 'const value = new __PulseS3Binding();', 'switch (index) {'];
+  for (const binding of bindings.s3) {
+    lines.push(`case ${binding.index}:`);
+    for (const [field, input] of Object.entries({ contentType: 'contentType', endpoint: 'endpoint', bucket: 'bucket', region: 'region', backend: 'backend', id: 'accessKeyIdSecret', secret: 'secretAccessKeySecret', token: 'sessionTokenSecret' })) lines.push(`value.${field} = ${JSON.stringify(binding[input] || '')};`);
+    lines.push(`value.max = ${binding.maxTextBytes}; value.timeout = ${binding.timeoutMs}; break;`);
+  }
+  lines.push('default: unreachable();', '}', 'return value;', '}');
+  return [contribution.source, fs.readFileSync(path.join(__dirname, 's3-native.as.ts'), 'utf8'), lines.join('\n')].join('\n');
+}
+module.exports = { S3_IMPORTS, s3NativeSource };