@pulse-compute/provider-fastly 1.0.0-beta.1 → 1.0.0-beta.3

package/src/config-schema.json

@@ -1,6 +1,10 @@
 {
   "schemaVersion": "pulse.provider-fastly-config-schema.v1",
   "fields": {
+    "fastly.bindings.s3": {
+      "kind": "object",
+      "default": {}
+    },
     "fastly.configStore": {
       "kind": "string",
       "default": "pulse_config"

package/src/javascript/target-support-policy.js

@@ -16,6 +16,8 @@ function blockedRestriction(id, restriction) {
 
 function classifyFastlyJavascriptCapability(id, restrictions = {}) {
   const capability = String(id);
+  if (['kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap'].includes(capability)) return decision(capability, 'blocked', 'fastly-conditional-kv-incomplete', 'provider-fastly');
+  if (['s3.head', 's3.getText', 's3.putText'].includes(capability)) return decision(capability, 'blocked', 'fastly-javascript-s3-raw-headers-unavailable', 'provider-fastly');
   if (isJavascriptCoreCapability(capability)) {
     return decision(capability, 'eligible', 'fastly-request-router-runtime', 'provider-fastly');
   }
@@ -100,6 +102,8 @@ function classifyFastlyJavascriptCapability(id, restrictions = {}) {
 
 function classifyFastlyJavascriptProviderRequirement(id, restrictions = {}) {
   const requirement = String(id);
+  if (['kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap'].includes(requirement)) return decision(requirement, 'blocked', 'fastly-conditional-kv-incomplete', 'provider-fastly');
+  if (['s3.head', 's3.getText', 's3.putText'].includes(requirement)) return decision(requirement, 'blocked', 'fastly-javascript-s3-raw-headers-unavailable', 'provider-fastly');
   if (requirement === 'request' || ['response.json', 'response.text', 'response.custom'].includes(requirement)) {
     return decision(requirement, 'eligible', 'fastly-request-response-lifecycle', 'provider-fastly');
   }

package/src/provider-contract.js

@@ -13,9 +13,9 @@ const FASTLY_PROVIDER_DESCRIPTOR = canonical.normalizeDescriptor({
   localExecution: true,
   capabilities: [
     'request', 'response.json', 'response.text', 'response.custom', 'fetch',
-    'config.get', 'secret.get', 'kv.get', 'kv.put', 'assets.lookup',
+    'config.get', 'secret.get', 'kv.get', 'kv.put', 'kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap', 'assets.lookup',
     'grip.channel', 'grip.hold', 'grip.publish', 'grip.broadcast', 'jwt.verify',
-    'opaque.pass-through'
+    'opaque.pass-through', 's3.head', 's3.getText', 's3.putText'
   ],
   lowering: {
     request: 'fastly.compute.request',
@@ -27,12 +27,18 @@ const FASTLY_PROVIDER_DESCRIPTOR = canonical.normalizeDescriptor({
     'secret.get': 'fastly.secret-store.get',
     'kv.get': 'fastly.kv-store.get',
     'kv.put': 'fastly.kv-store.put',
+    'kv.getVersioned': 'fastly.native.kv-store.getVersioned',
+    'kv.insertIfAbsent': 'fastly.native.kv-store.insertIfAbsent',
+    'kv.compareAndSwap': 'fastly.native.kv-store.compareAndSwap',
     'assets.lookup': 'fastly.kv-store.assets.lookup',
     'grip.channel': 'fastly.fanout.channel',
     'grip.hold': 'fastly.fanout.hold',
     'grip.publish': 'fastly.fanout.publish',
     'grip.broadcast': 'fastly.grip.publish-control',
     'jwt.verify': 'fastly.native.jwt.verify',
+    's3.head': 'fastly.native.s3.head',
+    's3.getText': 'fastly.native.s3.getText',
+    's3.putText': 'fastly.native.s3.putText',
     'opaque.pass-through': 'fastly.response-body.stream'
   }
 });
@@ -53,6 +59,7 @@ function validateStaticBackendBindings(metadata = {}, bindings = {}) {
 }
 
 function createFastlyLoweringPlan(metadata, bindings = {}) {
+  require('./toolchain/s3.js').resolveFastlyS3(metadata.providerOperations || [], bindings.s3);
   validateStaticBackendBindings(metadata, bindings);
   return canonical.createProviderLoweringPlan(metadata, FASTLY_PROVIDER_DESCRIPTOR, {
     ...bindings,

package/src/runtime/canonical-api-runtime.js

@@ -337,6 +337,10 @@ function createFastlyProviderAdapter(baseOptions = {}) {
   return Object.freeze({
     id: 'fastly',
     version: CANONICAL_FASTLY_RUNTIME_VERSION,
+    // This legacy JavaScript fixture surface has no Native KV host ABI. Keep
+    // that absence pre-dispatch/configuration, rather than pretending a failed
+    // fixture dispatch might have mutated storage. Real K3 evidence runs Wasm.
+    prepareConditionalKv() { return undefined; },
     async dispatchEffect(effect, executionOptions = {}) {
       const state = stateFor(executionOptions);
       if (effect.kind === 'fetch') return dispatchFetch(effect, executionOptions);

package/src/testing/conditional-kv-host.js

@@ -0,0 +1,109 @@
+'use strict';
+
+// Injected ABI authority for real generated Wasm evidence, never a service adapter.
+// Raw persisted bytes and u64 generations remain independent of the Pulse codec.
+function createConditionalKvAuthority() {
+  const stores = new Map(); let next = 1n;
+  return {
+    stores,
+    seed(store, key, wire, generation = next++) {
+      if (!stores.has(store)) stores.set(store, new Map());
+      stores.get(store).set(key, { wire: Buffer.from(wire), generation: BigInt(generation) });
+    },
+    get(store, key) { return stores.get(store)?.get(key); },
+    apply(store, key, wire, mode, condition) {
+      const values = stores.get(store), current = values.get(key);
+      if (mode === 1 && current || condition !== undefined && (!current || current.generation !== condition)) return 4;
+      while (next === current?.generation) next++;
+      this.seed(store, key, wire, next++); return 1;
+    }
+  };
+}
+
+function attachConditionalKvHost(imports, host, options) {
+  const { view, writeU32, writeU64, readBytes, readUtf8, alloc, bodies, bodyBytes, trace, now, advance } = host;
+  const authority = options.authority, stores = new Map(), pending = new Map(), bodyFixtures = new Map();
+  let sendingResponse = false;
+  const newResponse = imports.fastly_http_resp.new;
+  imports.fastly_http_resp.new = (...args) => { sendingResponse = true; return newResponse(...args); };
+  const call = (stage, detail = {}) => {
+    const fault = typeof options.onCall === 'function' ? options.onCall(stage, detail) || {} : {};
+    advance(Number(fault.delayMs || 0));
+    trace.push({ module: 'pulse_kv_evidence', name: stage, hostStatus: fault.status ?? 0, ...(fault.kvError === undefined ? {} : { kvError: fault.kvError }) });
+    return fault;
+  };
+  imports.fastly_kv_store = {
+    open(ptr, len, out) {
+      const name = readUtf8(ptr, len), fault = call('open', { store: name });
+      if (fault.status) return fault.status;
+      if (!authority.stores.has(name)) return 10;
+      const handle = alloc('kvStore'); stores.set(handle, name); writeU32(out, handle); return 0;
+    },
+    lookup(store, ptr, len, mask, config, out) {
+      const name = stores.get(store), key = readUtf8(ptr, len), fault = call('lookup', { store: name, key, mask, config: readBytes(config, 4) });
+      if (fault.status) return fault.status;
+      const item = fault.observation || authority.get(name, key);
+      const handle = alloc('kvLookup'); pending.set(handle, { kind: 'lookup', item, readyAt: now() + Number(fault.readyDelayMs || 0), fault });
+      writeU32(out, handle); return 0;
+    },
+    lookup_wait_v2(handle, body, meta, capacity, written, generation, error) {
+      const item = pending.get(handle); if (!item || item.readyAt > now()) throw new Error('KV lookup wait called before readiness.');
+      pending.delete(handle); const fault = call('lookup_wait_v2', { capacity, observation: item.item });
+      writeU32(error, fault.kvError ?? (item.item ? 1 : 3)); writeU64(generation, fault.generation ?? item.item?.generation ?? 0n);
+      writeU32(written, fault.metadataLength ?? 0);
+      if (fault.status) return fault.status;
+      if ((fault.kvError ?? (item.item ? 1 : 3)) !== 1) return 0;
+      const handleOut = alloc('body'); const bytes = Buffer.from(fault.wire || item.item.wire);
+      bodies.set(handleOut, { bytes, readOffset: 0, writes: [], readyAt: now() + Number(fault.bodyDelayMs || 0) });
+      bodyFixtures.set(handleOut, fault); writeU32(body, handleOut); return 0;
+    },
+    insert(store, ptr, len, body, mask, config, out) {
+      const name = stores.get(store), key = readUtf8(ptr, len), wire = Buffer.from(bodyBytes(body));
+      const mode = view().getUint32(config, true), condition = mask & 32 ? view().getBigUint64(config + 24, true) : undefined;
+      const fault = call('insert', { store: name, key, wire, mode, mask, condition, config: readBytes(config, 32) });
+      let code = fault.kvError;
+      if (code === undefined && (!fault.status || fault.commit)) code = authority.apply(name, key, wire, mode, condition);
+      bodies.delete(body); // Host takes ownership of the body.
+      if (fault.status) return fault.status;
+      const handle = alloc('kvInsert'); pending.set(handle, { kind: 'insert', code, readyAt: now() + Number(fault.readyDelayMs || 0) });
+      writeU32(out, handle); return 0;
+    },
+    insert_wait(handle, error) {
+      const item = pending.get(handle); if (!item || item.readyAt > now()) throw new Error('KV insert wait called before readiness.');
+      pending.delete(handle); const fault = call('insert_wait'); writeU32(error, fault.kvError ?? item.code ?? 0); return fault.status ?? 0;
+    }
+  };
+  const select = imports.fastly_async_io.select;
+  imports.fastly_async_io.select = (handles, count, timeout, done) => {
+    const handle = view().getUint32(handles, true), item = pending.get(handle) || (bodyFixtures.has(handle) && bodies.get(handle));
+    if (!item) return select(handles, count, timeout, done);
+    if (count !== 1 || timeout <= 0) throw new Error('KV select must be bounded.');
+    const fault = call('select', { kind: item.kind || 'body', timeout });
+    if (fault.status) return fault.status;
+    const wait = Math.max(0, item.readyAt - now()); advance(Math.min(wait, timeout));
+    writeU32(done, fault.readyIndex ?? (wait >= timeout ? 0xffffffff : 0)); return 0;
+  };
+  for (const name of ['new', 'write', 'read', 'close']) {
+    const original = imports.fastly_http_body[name];
+    imports.fastly_http_body[name] = (...args) => {
+      const [handle] = args;
+      if (sendingResponse) return original(...args);
+      if (name === 'read' && !bodyFixtures.has(handle)) return original(...args);
+      const fault = call('body_' + name, { handle });
+      if (fault.status) return fault.status;
+      const result = original(...args);
+      if (name === 'read') {
+        const fixture = bodyFixtures.get(handle), body = bodies.get(handle);
+        if (body) body.readyAt = now() + Number(fixture.chunkDelayMs || 0);
+        if (fault.written !== undefined) writeU32(args[3], fault.written);
+      }
+      if (name === 'write' && fault.written !== undefined) writeU32(args[4], fault.written);
+      if (name === 'close') bodyFixtures.delete(handle);
+      return result;
+    };
+  }
+  const clock = imports.wasi_snapshot_preview1.clock_time_get;
+  imports.wasi_snapshot_preview1.clock_time_get = (...args) => { const fault = call('clock'); return fault.status || clock(...args); };
+  return { pending, bodyFixtures };
+}
+module.exports = { createConditionalKvAuthority, attachConditionalKvHost };

package/src/testing/native-platform-capabilities-host.js

@@ -10,7 +10,7 @@ const FASTLY_STATUS_BUFLEN = 4;
 const FASTLY_STATUS_NONE = 10;
 const FASTLY_KV_ERROR_OK = 1;
 const FASTLY_KV_ERROR_NOT_FOUND = 3;
-const SENSITIVE_HEADERS = new Set(['authorization', 'proxy-authorization', 'x-api-key', 'x-auth-token', 'cookie', 'set-cookie']);
+const SENSITIVE_HEADERS = new Set(['authorization', 'proxy-authorization', 'x-api-key', 'x-auth-token', 'cookie', 'set-cookie', 'x-amz-security-token', 'x-amz-content-sha256']);
 
 class FastlyNativePlatformCapabilitiesMockError extends Error {
   constructor(message, code = 'PULSE_FASTLY_NATIVE_PLATFORM_CAPABILITIES_MOCK_FAILED', detail = {}) {
@@ -113,6 +113,8 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
   const url = String(requestInput.url || `https://pulse.test${pathValue.startsWith('/') ? pathValue : `/${pathValue}`}`);
   const requestHeaders = normalizeHeaders(requestInput.headers);
   const trace = [];
+  let monotonicMs = 0;
+  const privateUrls = new Set();
   let nextHandle = 10;
   const typedHandleStarts = options.handleStarts && typeof options.handleStarts === 'object' ? options.handleStarts : {};
   const typedHandleNext = new Map();
@@ -127,7 +129,7 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
   const secretStores = normalizeNamedStores(options.secretStores, options.secretStore || 'app_secrets', options.secrets);
   const secretValues = [...secretStores.values()].flatMap((values) => [...values.values()].map((value) => String(value))).filter(Boolean);
   const redactText = (value) => secretValues.reduce((output, secret) => output.split(secret).join('[REDACTED]'), String(value));
-  const redactRuntimeHeaders = (headers) => headers.map(([name, value]) => [name, SENSITIVE_HEADERS.has(String(name).toLowerCase()) ? '[REDACTED]' : redactText(value)]);
+  const redactRuntimeHeaders = (headers, privateS3 = false) => headers.map(([name, value]) => [name, SENSITIVE_HEADERS.has(String(name).toLowerCase()) || privateS3 && ['etag', 'content-type'].includes(String(name).toLowerCase()) ? '[REDACTED]' : redactText(value)]);
   const kvStores = normalizeNamedStores(options.kvStores, options.kvStore || 'app_sessions', undefined);
   for (const values of kvStores.values()) for (const [key, value] of values) values.set(key, encodeKvValue(value));
   const configHandles = new Map();
@@ -206,17 +208,37 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
       headers,
       origin: true
     });
-    bodies.set(bodyHandle, { bytes: normalizeBody(body), readOffset: 0, writes: [] });
+    bodies.set(bodyHandle, { bytes: normalizeBody(body), readOffset: 0, writes: [], fixture: normalized, readyAt: monotonicMs + Number(normalized.bodyDelayMs || 0) });
     return { responseHandle, bodyHandle };
   }
 
+  function headerList(values, buffer, size, end, written) {
+    const output = Buffer.from(values.map((value) => String(value) + '\0').join(''));
+    writeU32(written, output.length); view().setBigInt64(Number(end), -1n, true);
+    if (output.length > Number(size)) return FASTLY_STATUS_BUFLEN;
+    new Uint8Array(memory().buffer, Number(buffer), output.length).set(output);
+    return FASTLY_STATUS_OK;
+  }
   const imports = {
+    fastly_async_io: {
+      select(handles, count, timeout, done) {
+        if (Number(count) !== 1 || Number(timeout) <= 0) return FASTLY_STATUS_ERROR;
+        const handle = view().getUint32(Number(handles), true);
+        const item = pending.get(handle) || bodies.get(handle);
+        if (!item) return FASTLY_STATUS_BADF;
+        const wait = Math.max(0, Number(item.readyAt || 0) - monotonicMs);
+        monotonicMs += Math.min(wait, Number(timeout));
+        writeU32(done, wait >= Number(timeout) ? 0xffffffff : 0);
+        trace.push({ module: 'fastly_async_io', name: 'select', timeout: Number(timeout), timedOut: wait >= Number(timeout) });
+        return FASTLY_STATUS_OK;
+      }
+    },
     wasi_snapshot_preview1: {
       clock_time_get(clockId, precision, timeOut) {
         const seconds = Number.isFinite(Number(options.clockUnixSeconds))
           ? Number(options.clockUnixSeconds)
           : Math.floor(Date.now() / 1000);
-        writeU64(timeOut, BigInt(Math.trunc(seconds * 1_000_000_000)));
+        writeU64(timeOut, BigInt(Math.trunc((Number(clockId) === 1 ? monotonicMs : seconds * 1000 + monotonicMs) * 1_000_000)));
         trace.push({
           module: 'wasi_snapshot_preview1',
           name: 'clock_time_get',
@@ -316,33 +338,54 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
         if (!request) return FASTLY_STATUS_BADF;
         const name = readUtf8(namePointer, nameLength);
         const value = readUtf8(valuePointer, valueLength);
+        if (name.toLowerCase() === 'authorization' && value.includes('/s3/aws4_request')) privateUrls.add(request.url);
         request.headers = request.headers.filter(([headerName]) => headerName.toLowerCase() !== name.toLowerCase());
         request.headers.push([name, value]);
-        trace.push({ module: 'fastly_http_req', name: 'header_insert', handle: Number(handle), header: [name, SENSITIVE_HEADERS.has(name.toLowerCase()) ? '[REDACTED]' : redactText(value)] });
+        trace.push({ module: 'fastly_http_req', name: 'header_insert', handle: Number(handle), header: redactRuntimeHeaders([[name, value]], privateUrls.has(request.url))[0] });
         return FASTLY_STATUS_OK;
       },
+      cache_override_set(handle, tag, ttl, swr) {
+        const request = requests.get(Number(handle)); if (!request) return FASTLY_STATUS_BADF;
+        request.cacheOverride = Number(tag); return FASTLY_STATUS_OK;
+      },
+      auto_decompress_response_set(handle, encodings) {
+        const request = requests.get(Number(handle)); if (!request) return FASTLY_STATUS_BADF;
+        request.decompression = Number(encodings); return FASTLY_STATUS_OK;
+      },
+      close(handle) { return requests.delete(Number(handle)) ? FASTLY_STATUS_OK : FASTLY_STATUS_BADF; },
+      pending_req_poll_v2(handle, detail, done, responseOut, bodyOut) {
+        const item = pending.get(Number(handle)); if (!item) return FASTLY_STATUS_BADF;
+        if (monotonicMs < item.readyAt) { writeU32(done, 0); return FASTLY_STATUS_OK; }
+        writeU32(done, 1); return imports.fastly_http_req.pending_req_wait(handle, responseOut, bodyOut);
+      },
       send_async(handle, bodyHandle, backendPointer, backendLength, pendingOut) {
         const request = requests.get(Number(handle));
         const body = bodies.get(Number(bodyHandle));
         if (!request || !body) return FASTLY_STATUS_BADF;
         const backend = readUtf8(backendPointer, backendLength);
+        const signedS3 = request.headers.some(([name, value]) => name.toLowerCase() === 'authorization' && value.startsWith('AWS4-HMAC-SHA256 '));
+        if (signedS3) privateUrls.add(request.url);
         const fixture = resolveFixture(options.fixtures, backend, request.method, request.url);
         if (!fixture) {
-          trace.push({ module: 'fastly_http_req', name: 'send_async', handle: Number(handle), backend, method: request.method, url: request.url, missingFixture: true });
+          trace.push({ module: 'fastly_http_req', name: 'send_async', handle: Number(handle), backend, method: request.method, url: signedS3 ? '[REDACTED]' : request.url, missingFixture: true });
           return FASTLY_STATUS_ERROR;
         }
         const pendingHandle = alloc('pending');
         const capturedBody = bodyBytes(bodyHandle);
-        pending.set(pendingHandle, { request: { ...request, headers: request.headers.map((entry) => [...entry]), body: capturedBody }, backend, fixture });
+        pending.set(pendingHandle, { request: { ...request, headers: request.headers.map((entry) => [...entry]), body: capturedBody }, backend, fixture, readyAt: monotonicMs + Number(fixture.delayMs || 0) });
+        if (typeof options.onOutboundRequest === 'function') options.onOutboundRequest({ ...request, backend, headers: request.headers.map((entry) => [...entry]), body: capturedBody });
+        if (fixture.sendStatus) { pending.delete(pendingHandle); return Number(fixture.sendStatus); }
+        if (request.headers.some(([name, value]) => name.toLowerCase() === 'authorization' && value.startsWith('AWS4-HMAC-SHA256 '))) privateUrls.add(request.url);
+        requests.delete(Number(handle)); bodies.delete(Number(bodyHandle));
         outboundRequests.push(Object.freeze({
           backend,
           method: request.method,
-          url: redactText(request.url),
-          headers: Object.freeze(redactRuntimeHeaders(request.headers).map((header) => Object.freeze(header))),
-          body: redactText(capturedBody.toString('utf8'))
+          url: privateUrls.has(request.url) ? '[REDACTED]' : redactText(request.url),
+          headers: Object.freeze(redactRuntimeHeaders(request.headers, signedS3).map((header) => Object.freeze(header))),
+          body: signedS3 ? '[REDACTED]' : redactText(capturedBody.toString('utf8'))
         }));
         writeU32(pendingOut, pendingHandle);
-        trace.push({ module: 'fastly_http_req', name: 'send_async', handle: Number(handle), bodyHandle: Number(bodyHandle), pendingHandle, backend, method: request.method, url: redactText(request.url), headers: redactRuntimeHeaders(request.headers), bodyBytes: capturedBody.length });
+        trace.push({ module: 'fastly_http_req', name: 'send_async', handle: Number(handle), bodyHandle: Number(bodyHandle), pendingHandle, backend, method: request.method, url: redactText(request.url), headers: redactRuntimeHeaders(request.headers, signedS3), bodyBytes: capturedBody.length });
         return FASTLY_STATUS_OK;
       },
       pending_req_wait(handle, responseOut, bodyOut) {
@@ -384,6 +427,8 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
         const handle = alloc('secretStore'); secretStoreHandles.set(handle, values); writeU32(handleOut, handle); return FASTLY_STATUS_OK;
       },
       get(handle, keyPointer, keyLength, secretOut) {
+        monotonicMs += Number(options.secretDelayMs || 0);
+        if (typeof options.onSecretLookup === 'function') options.onSecretLookup();
         const values = secretStoreHandles.get(Number(handle));
         const key = readUtf8(keyPointer, keyLength);
         const value = values && values.get(key);
@@ -447,6 +492,16 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
       }
     },
     fastly_http_resp: {
+      close(handle) { trace.push({ module: 'fastly_http_resp', name: 'close' }); return responses.delete(Number(handle)) ? FASTLY_STATUS_OK : FASTLY_STATUS_BADF; },
+      header_names_get(handle, buffer, size, cursor, end, written) {
+        const response = responses.get(Number(handle)); if (!response || cursor !== 0) return FASTLY_STATUS_BADF;
+        return headerList([...new Set(response.headers.map(([name]) => name.toLowerCase()))], buffer, size, end, written);
+      },
+      header_values_get(handle, pointer, length, buffer, size, cursor, end, written) {
+        const response = responses.get(Number(handle)); if (!response || cursor !== 0) return FASTLY_STATUS_BADF;
+        const name = readUtf8(pointer, length).toLowerCase();
+        return headerList(response.headers.filter(([key]) => key.toLowerCase() === name).map(([, value]) => value), buffer, size, end, written);
+      },
       new(handleOut) {
         const handle = alloc('response');
         responses.set(handle, { status: 200, headers: [], origin: false });
@@ -503,6 +558,7 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
       }
     },
     fastly_http_body: {
+      close(handle) { trace.push({ module: 'fastly_http_body', name: 'close' }); return bodies.delete(Number(handle)) ? FASTLY_STATUS_OK : FASTLY_STATUS_BADF; },
       new(handleOut) {
         const handle = alloc('body');
         bodies.set(handle, { bytes: Buffer.alloc(0), readOffset: 0, writes: [] });
@@ -513,11 +569,13 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
       read(handle, buffer, bufferLength, readOut) {
         const body = bodies.get(Number(handle));
         if (!body) return FASTLY_STATUS_BADF;
+        if (body.fixture && body.fixture.bodyReadStatus) return Number(body.fixture.bodyReadStatus);
         const source = bodyBytes(handle);
         const offset = body.readOffset || 0;
-        const count = Math.min(Number(bufferLength), Math.max(0, source.length - offset));
+        const count = Math.min(Number(bufferLength), Math.max(0, source.length - offset), Number(body.fixture && body.fixture.chunkBytes || 65536));
         if (count > 0) new Uint8Array(memory().buffer, Number(buffer), count).set(source.subarray(offset, offset + count));
         body.readOffset = offset + count;
+        body.readyAt = monotonicMs + Number(body.fixture && body.fixture.chunkDelayMs || 0);
         writeU32(readOut, count);
         trace.push({ module: 'fastly_http_body', name: 'read', handle: Number(handle), bytes: count });
         return FASTLY_STATUS_OK;
@@ -525,7 +583,9 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
       write(handle, buffer, bufferLength, end, writtenOut) {
         const body = bodies.get(Number(handle));
         if (!body) return FASTLY_STATUS_BADF;
-        const bytes = readBytes(buffer, bufferLength);
+        if (requests.size > 1 && options.outboundBodyWriteStatus) return Number(options.outboundBodyWriteStatus);
+        const length = Math.min(Number(bufferLength), Number(options.bodyWriteChunkBytes || bufferLength));
+        const bytes = readBytes(buffer, length);
         body.writes.push(bytes);
         writeU32(writtenOut, bytes.length);
         trace.push({ module: 'fastly_http_body', name: 'write', handle: Number(handle), bytes: bytes.length, end: Number(end) });
@@ -534,12 +594,28 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
     }
   };
 
+  const kvEvidence = options.conditionalKv ? require('./conditional-kv-host.js').attachConditionalKvHost(imports, {
+    view, writeU32, writeU64, readBytes, readUtf8, alloc, bodies, bodyBytes, trace,
+    now: () => monotonicMs, advance: ms => { monotonicMs += ms; }
+  }, options.conditionalKv) : undefined;
+
+  // Model invocation termination, including cancellation raised by a host call.
+  // Throwing stops the Wasm invocation; it never fabricates an effect result.
+  const checkActive = () => { if (options.signal && options.signal.aborted) throw options.signal.reason || new Error('Request cancelled.'); };
+  checkActive();
+  if (options.signal) for (const namespace of Object.values(imports)) {
+    for (const [name, hostcall] of Object.entries(namespace)) if (typeof hostcall === 'function') namespace[name] = (...args) => {
+      checkActive(); const result = hostcall(...args); checkActive(); return result;
+    };
+  }
   const module = new WebAssembly.Module(wasm);
   instance = new WebAssembly.Instance(module, imports);
   if (typeof instance.exports._start !== 'function') {
     throw new FastlyNativePlatformCapabilitiesMockError('Pass98 native module is missing _start.', 'PULSE_FASTLY_NATIVE_PLATFORM_CAPABILITIES_MOCK_START_MISSING');
   }
+  if (options.conditionalKv && options.conditionalKv.deadlineNs !== undefined) instance.exports.pulse_fastly_kv_request_deadline(BigInt(options.conditionalKv.deadlineNs));
   instance.exports._start();
+  for (const entry of trace) if (entry.url && privateUrls.has(entry.url)) entry.url = '[REDACTED]';
   const lastError = typeof instance.exports.pulse_fastly_last_error === 'function'
     ? Number(instance.exports.pulse_fastly_last_error())
     : undefined;
@@ -580,6 +656,7 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
     logs: Object.freeze(logs),
     outboundRequests: Object.freeze(outboundRequests),
     stores: Object.freeze({ config: snapshotStores(configStores), secrets: Object.fromEntries([...secretStores].map(([name, values]) => [name, Object.fromEntries([...values].map(([key]) => [key, '[REDACTED]']))])), kv: snapshotStores(kvStores, true) }),
+    kvEvidence,
     instance
   });
 }

package/src/toolchain/config.js

@@ -1,4 +1,5 @@
 'use strict';
+const { normalizeFastlyS3 } = require('./s3.js');
 
 function providerConfigError(code, message, detail) {
   const error = new TypeError(message);
@@ -37,6 +38,7 @@ function normalizeFastlyProviderConfig(value) {
       configStore: String(bindings.configStore || 'pulse_config'),
       secretStore: String(bindings.secretStore || 'pulse_secrets'),
       kv: normalizeStringMap(bindings.kv, 'PULSE_FASTLY_KV_BINDINGS_INVALID'),
+      s3: normalizeFastlyS3(bindings.s3),
       backends: normalizeStringMap(bindings.backends, 'PULSE_FASTLY_BACKEND_BINDINGS_INVALID'),
       grip: Object.freeze({
         fanoutBackend: gripInput.fanoutBackend === undefined ? undefined : String(gripInput.fanoutBackend),
@@ -98,6 +100,7 @@ const FASTLY_PROJECT_CONFIG_REFERENCE = Object.freeze({
     })
   ]),
   fields: Object.freeze([
+    Object.freeze({ section: 'fastly', path: 'fastly.bindings.s3', type: 'Readonly<Record<string, S3Binding & { backend: string }>>', default: '`{}`', scope: 'Fastly Native S3', description: 'Maps logical names to fixed HTTPS endpoint, bucket, region, named static backend, accessKeyIdSecret, secretAccessKeySecret, optional sessionTokenSecret, maxTextBytes (1–32768, default 32768) and timeoutMs (1–30000, default 10000).', security: 'Credentials resolve through the configured Secret Store at execution. Dynamic backend authority and guest endpoint overrides are forbidden.' }),
     Object.freeze({ section: 'fastly', path: 'fastly.configStore', type: 'string', default: '`pulse_config`', scope: 'Fastly config capability', description: 'Fastly Config Store resource name.' }),
     Object.freeze({ section: 'fastly', path: 'fastly.secretStore', type: 'string', default: '`pulse_secrets`', scope: 'Fastly secret capability', description: 'Fastly Secret Store resource name.', security: 'The name is build metadata; secret values are never embedded by this option.' }),
     Object.freeze({ section: 'fastly', path: 'fastly.kv', type: 'Readonly<Record<string, string>>', default: '`{}`', scope: 'Fastly KV capability', description: 'Maps logical ctx.kv names to Fastly KV Store resource names.', diagnostics: Object.freeze(['PULSE_FASTLY_KV_BINDINGS_INVALID']) }),

package/src/toolchain/index.js

@@ -169,6 +169,8 @@ function createDriver() {
         runtimeClass: 'native',
         status: 'supported',
         capabilities: Object.freeze([
+          's3.head', 's3.getText',
+          'kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap',
           'jwt.verify',
           'jwt.verify.hs256',
           'jwt.verify.es256',
@@ -221,7 +223,7 @@ function createDriver() {
         automaticFallback: false,
         crypto: defineCryptoTargetCapabilities({
           target: 'native',
-          algorithms: [{
+          algorithms: [...['SHA-256', 'HMAC-SHA256'].map((algorithm) => ({ algorithm, realization: 'guest-source:pulse-hmac-as', implemented: true, status: 'implemented-o2' })), {
             algorithm: 'HS256',
             realization: 'guest-source:pulse-hmac-as',
             implemented: true,
@@ -240,6 +242,7 @@ function createDriver() {
       javascript: FASTLY_JAVASCRIPT_TARGET_DESCRIPTOR
     }),
     execute: fastlyRuntime.executeCanonicalProgram,
+    prepareNativeExecution: require('./native-execution.js').prepareFastlyNativeExecution,
     createLoweringPlan(metadata, providerConfig = {}) {
       return createFastlyLoweringPlan(metadata, providerConfig.bindings || {});
     },

package/src/toolchain/native-execution.js

@@ -0,0 +1,71 @@
+'use strict';
+
+const { inspectFastlyCanonicalTarget } = require('../build/canonical-target.js');
+const { executeFastlyNativePlatformCapabilities } = require('../testing/native-platform-capabilities-host.js');
+const { createConditionalKvAuthority } = require('../testing/conditional-kv-host.js');
+
+// Execute the provider artifact against the existing fixture ABI. This is local
+// conformance evidence, never Viceroy or deployed Fastly acceptance.
+function prepareFastlyNativeExecution(invocation) {
+  const bindings = invocation.providerConfig.bindings;
+  const { native } = inspectFastlyCanonicalTarget({
+    plan: invocation.applicationPlan,
+    providerConfig: invocation.providerConfig,
+    projectRoot: invocation.project.root,
+    profile: invocation.project.profile,
+    targetDescriptor: invocation.selectedTarget,
+    synchronizedPackages: invocation.synchronizedPackages,
+    realizationArtifacts: invocation.nativeArtifact.realizationArtifacts,
+    guestUnits: invocation.nativeArtifact.guestUnits,
+    nativeOptimization: invocation.optimization,
+    compileTimeoutMs: invocation.timeoutMs || undefined
+  });
+  const evidence = Object.freeze({
+    kind: 'fastly-native-fixture-abi',
+    provider: 'fastly',
+    target: 'fastly-compute-native',
+    wasmSha256: native.manifest.wasm.sha256,
+    providerRealityValidated: false,
+    effectObservations: 'unavailable'
+  });
+  return (options = {}) => {
+    if (options.liveFetch === true) throw new TypeError('Fastly Native fixture execution cannot perform live fetches.');
+    const kvStores = {};
+    for (const [logical, physical] of Object.entries(bindings.kv || {})) {
+      kvStores[physical] = { ...kvStores[physical], ...(options.kv && options.kv[logical] || {}) };
+    }
+    const authority = createConditionalKvAuthority();
+    for (const [store, values] of Object.entries(kvStores)) {
+      authority.stores.set(store, new Map());
+      for (const [key, value] of Object.entries(values)) {
+        authority.seed(store, key, Buffer.from(JSON.stringify({ __pulseKv: 1, value })));
+      }
+    }
+    const execution = executeFastlyNativePlatformCapabilities(native, {
+      request: options.request,
+      fixtures: options.fetches,
+      configStore: bindings.configStore,
+      config: options.config,
+      secretStore: bindings.secretStore,
+      secrets: options.secrets,
+      kvStores,
+      conditionalKv: { authority }
+    });
+    const contentType = execution.response.headers.find(([name]) => name.toLowerCase() === 'content-type');
+    const type = String(contentType && contentType[1] || '').toLowerCase();
+    return Object.freeze({
+      response: Object.freeze({
+        ...execution.response,
+        kind: type.includes('application/json') || type.includes('+json') ? 'json' : type.startsWith('text/') ? 'text' : 'response',
+        bodyClass: execution.response.origin === true ? 'opaque' : 'structured'
+      }),
+      // The fixture ABI has hostcall traces, not canonical continuation telemetry.
+      effectCount: null,
+      continuations: Object.freeze([]),
+      resolutionOrder: Object.freeze([]),
+      evidence
+    });
+  };
+}
+
+module.exports = { prepareFastlyNativeExecution };

package/src/toolchain/s3.js

@@ -0,0 +1,26 @@
+'use strict';
+const { normalizeBinding, namePattern } = require('@pulse-compute/s3/provider');
+function normalizeFastlyS3(input = {}) {
+  if (!input || typeof input !== 'object' || Array.isArray(input) || ![Object.prototype, null].includes(Object.getPrototypeOf(input))) throw new TypeError('Fastly S3 bindings must be a map.');
+  for (const key of Reflect.ownKeys(input)) {
+    const field = Object.getOwnPropertyDescriptor(input, key);
+    if (typeof key !== 'string' || !field.enumerable || !Object.hasOwn(field, 'value')) throw new TypeError('Fastly S3 bindings require data properties.');
+  }
+  return Object.freeze(Object.fromEntries(Object.entries(input).map(([name, value]) => {
+    if (!namePattern.test(name) || !value || typeof value !== 'object' || ![Object.prototype, null].includes(Object.getPrototypeOf(value))
+      || Reflect.ownKeys(value).some((key) => { const field = Object.getOwnPropertyDescriptor(value, key); return typeof key !== 'string' || !field.enumerable || !Object.hasOwn(field, 'value'); })) throw new TypeError('Fastly S3 binding is invalid.');
+    const { backend, ...binding } = value;
+    if (typeof backend !== 'string' || !namePattern.test(backend)) throw new TypeError('Fastly S3 requires a named static backend.');
+    return [name, Object.freeze({ ...normalizeBinding(binding), backend })];
+  })));
+}
+function resolveFastlyS3(effects, input) {
+  const configured = normalizeFastlyS3(input);
+  return Object.freeze(effects.flatMap((effect, index) => {
+    if (!['s3.head', 's3.getText', 's3.putText'].includes(effect.kind)) return [];
+    const name = effect.resource && effect.resource.binding;
+    if (!Object.hasOwn(configured, name)) throw new TypeError('The required Fastly S3 binding is missing.');
+    return [Object.freeze({ index, ...configured[name], contentType: effect.operation === 'putText' ? require('@pulse-compute/s3/provider').normalizePutOptions({ contentType: effect.payload && effect.payload.contentType }).contentType : '' })];
+  }));
+}
+module.exports = { normalizeFastlyS3, resolveFastlyS3 };