@pulse-compute/provider-fastly 1.0.0-beta.10 → 1.0.0-beta.11

package/README.md

@@ -7,9 +7,9 @@
 > **Supported entry points:** `@pulse-compute/provider-fastly`, `@pulse-compute/provider-fastly/contract`, `@pulse-compute/provider-fastly/toolchain`, `@pulse-compute/provider-fastly/config-schema`, `@pulse-compute/provider-fastly/runtime/canonical-api-runtime`, `@pulse-compute/provider-fastly/build/canonical-target`, `@pulse-compute/provider-fastly/testing/fastly-cli`<br>
 > **Stability:** The listed entry points are supported for the Beta; all other exported subpaths are implementation-only.<br>
 > **npm:** [`@pulse-compute/provider-fastly`](https://www.npmjs.com/package/@pulse-compute/provider-fastly)<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.10/packages/provider-fastly/)
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.11/packages/provider-fastly/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.10` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.11` package policy.
 <!-- pulse-package-status:end -->
 
 Fastly provider configuration, canonical capability lowering, local conformance execution, Compute target generation, and explicit external-tool boundaries.
@@ -49,7 +49,7 @@ trusted wall-clock authority. It does not fall back to Node execution.
 
 ## Documentation
 
-- [Fastly package guide](https://pulsecompute.io/v1.0.0-beta.10/packages/provider-fastly/)
-- [Project configuration](https://pulsecompute.io/v1.0.0-beta.10/reference/project-config/#fastly-provider-options)
-- [Fastly capabilities guide](https://pulsecompute.io/v1.0.0-beta.10/guides/fastly-capabilities/)
-- [Environment variables](https://pulsecompute.io/v1.0.0-beta.10/reference/environment/#pulse-fastly-bin)
+- [Fastly package guide](https://pulsecompute.io/v1.0.0-beta.11/packages/provider-fastly/)
+- [Project configuration](https://pulsecompute.io/v1.0.0-beta.11/reference/project-config/#fastly-provider-options)
+- [Fastly capabilities guide](https://pulsecompute.io/v1.0.0-beta.11/guides/fastly-capabilities/)
+- [Environment variables](https://pulsecompute.io/v1.0.0-beta.11/reference/environment/#pulse-fastly-bin)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-compute/provider-fastly",
-  "version": "1.0.0-beta.10",
+  "version": "1.0.0-beta.11",
   "license": "Apache-2.0",
   "engines": {
     "node": "^22.14.0 || ^24.0.0"
@@ -59,15 +59,15 @@
     }
   },
   "dependencies": {
-    "@pulse-compute/crypto": "1.0.0-beta.10",
-    "@pulse-compute/jwt": "1.0.0-beta.10",
-    "@pulse-compute/runtime": "1.0.0-beta.10",
-    "@pulse-compute/s3": "1.0.0-beta.10",
-    "@pulse-compute/wasm-build-support": "1.0.0-beta.10",
-    "@pulse-compute/wasm-contracts": "1.0.0-beta.10",
-    "@pulse-compute/wasm-guest-link": "1.0.0-beta.10",
-    "@pulse-compute/wasm-host-runtime": "1.0.0-beta.10",
-    "@pulse-compute/wasm-runtime-core-as": "1.0.0-beta.10",
+    "@pulse-compute/crypto": "1.0.0-beta.11",
+    "@pulse-compute/jwt": "1.0.0-beta.11",
+    "@pulse-compute/runtime": "1.0.0-beta.11",
+    "@pulse-compute/s3": "1.0.0-beta.11",
+    "@pulse-compute/wasm-build-support": "1.0.0-beta.11",
+    "@pulse-compute/wasm-contracts": "1.0.0-beta.11",
+    "@pulse-compute/wasm-guest-link": "1.0.0-beta.11",
+    "@pulse-compute/wasm-host-runtime": "1.0.0-beta.11",
+    "@pulse-compute/wasm-runtime-core-as": "1.0.0-beta.11",
     "esbuild": "0.28.1"
   },
   "types": "./dist/index.d.ts",
@@ -87,7 +87,7 @@
     "url": "git+https://github.com/pulse-compute/pulse.git",
     "directory": "packages/provider-fastly"
   },
-  "homepage": "https://pulsecompute.io/v1.0.0-beta.10/packages/provider-fastly/",
+  "homepage": "https://pulsecompute.io/v1.0.0-beta.11/packages/provider-fastly/",
   "bugs": {
     "url": "https://github.com/pulse-compute/pulse/issues"
   },

package/src/build/canonical-target.js

@@ -82,6 +82,12 @@ function assertExactProviderNative(native) {
       }
     );
   }
+  if (native.manifest.hostExtensions) {
+    const evidence = native.manifest.hostExtensions;
+    if (evidence.finalWasmSha256 !== observedSha256) throw providerBuildError(
+      'PULSE_HOST_EXTENSION_IMPORT', 'Terminal service evidence does not identify the packaged Wasm.', { automaticFallback: false });
+    require('@pulse-compute/wasm-contracts/provider/toolchain').hostExtensions.auditWasm(native.wasm, evidence.importPolicy);
+  }
   if (native.guestLink) {
     const audit = native.guestLink.audit;
     if (

package/src/build/effect-invocations.js

@@ -3,6 +3,8 @@
 const { CANONICAL_EFFECT_INVOCATION_POLICY } = require('@pulse-compute/wasm-contracts/handler/canonical-runtime');
 
 function runtimeSource(options = {}) {
+  const lifecycle = options.lifecycle;
+  const delivery = options.packageCompletion ? 'result == 0 ? pulse_package_set_effect_failure(index) : pulse_set_effect_result(index, result)' : 'pulse_set_effect_result(index, result)';
   return `
 const PULSE_FASTLY_MAX_EFFECT_INVOCATIONS: i32 = ${CANONICAL_EFFECT_INVOCATION_POLICY.defaultMaxEffects}
 let __pulse_invocation_count: i32 = 0
@@ -28,13 +30,13 @@ function __pulse_invocation_settle(index: i32, ticket: i32, result: i32): i32 {
     || ticket <= 0 || unchecked(__pulse_invocation_tickets[index]) != ticket) {
     __pulse_fastly_fail(PULSE_ERROR_STATE, __pulse_invocation_failure, index); return 0
   }
-  unchecked(__pulse_invocation_tickets[index] = 0)
-  return ${options.packageCompletion ? "result == 0 ? pulse_package_set_effect_failure(index) : pulse_set_effect_result(index, result)" : "pulse_set_effect_result(index, result)"}
+${lifecycle?.site('effect-settle') ? lifecycle.site('effect-settle') + '\n' : ''}  unchecked(__pulse_invocation_tickets[index] = 0)
+  ${lifecycle ? lifecycle.site('effect-deliver', delivery) : 'return ' + delivery}
 }
 function __pulse_invocation_close(): void {
-  __pulse_invocation_closed = true
+${lifecycle?.site('invocation-close') ? lifecycle.site('invocation-close') + '\n' : ''}  __pulse_invocation_closed = true
   for (let i = 0; i < PULSE_FASTLY_EFFECT_COUNT; i += 1) unchecked(__pulse_invocation_tickets[i] = 0)
-}
+${lifecycle?.site('invocation-closed') ? lifecycle.site('invocation-closed') + '\n' : ''}}
 `;
 }
 

package/src/build/host-extensions.js

@@ -0,0 +1,254 @@
+'use strict';
+
+// The provider owns the terminal service. Package selection and ABI admission
+// use the shared contribution contract; trusted source is not sandboxed.
+const contract = require('@pulse-compute/wasm-contracts/provider/toolchain').hostExtensions;
+const { CANONICAL_NATIVE_VALUE_TRANSFER_MAX_BYTES } = require('@pulse-compute/wasm-contracts/handler/canonical-native-runtime');
+const MAX_BACKEND_BYTES = Math.min(1024, CANONICAL_NATIVE_VALUE_TRANSFER_MAX_BYTES);
+const { STATES } = require('./response-authority.js');
+const ADMISSION = contract.normalizeAdmission({ version: contract.ADMISSION_VERSION,
+  protocols: [contract.VERSION], services: [contract.TERMINAL_SERVICE] });
+const TARGET = Object.freeze({ provider: 'fastly', target: 'native', targetId: 'fastly-compute-native', hostExtensions: ADMISSION });
+function fail(message, operation) { contract.fail('PLACEMENT', message, operation); }
+const matches = contract.matches;
+function validateBinding(effect, bindings = {}) {
+  const key = effect.resource?.value;
+  const backend = effect.resource?.kind === 'literal' && (bindings.backends || {})[key];
+  if (typeof key !== 'string' || typeof backend !== 'string' || !backend || backend.includes('\0') || Buffer.byteLength(backend) > MAX_BACKEND_BYTES)
+    contract.fail('BINDING', `${effect.package}.${effect.operation} requires a configured static backend binding.`, effect);
+  return backend;
+}
+function select(plan, options = {}) {
+  try { return selectPlan(plan, options); }
+  catch (error) {
+    if (error.code?.startsWith('PULSE_HOST_EXTENSION_') && plan.entry?.kind === 'router') {
+      const used = (plan.effects || []).filter(effect => effect.kind === 'host.extension');
+      const effect = used.find(effect => effect.package === error.detail?.package && effect.operation === error.detail?.operation) || used[0];
+      const entry = plan.routing?.entries?.find(entry => entry.stableId === effect?.routerEntryStableId);
+      const source = entry?.nativeBody?.source || plan.handlers?.find(handler => handler.id === effect?.routerEntryStableId)?.source || null;
+      // Lowered Router positions address generated dispatch text. Public errors
+      // must identify the authored handler and state the coarser source basis.
+      error.detail = Object.freeze({ ...error.detail, loc: source, sourceBasis: source ? 'authored-entry' : 'not-recorded' });
+    }
+    throw error;
+  }
+}
+function selectPlan(plan, options = {}) {
+  const effects = plan.effects || [];
+  const used = effects.filter(effect => effect.kind === 'host.extension');
+  if (!used.length) return [];
+  const reject = message => fail(message, used[0]);
+  // Reuse the canonical Router dispatcher and private terminal-route bodies.
+  // Admission bounds authored behavior; no new scheduler or package special case.
+  const routed = plan.entry?.kind === 'router';
+  if (used.length !== 1 || effects.length !== 1 || used[0].grouped || used[0].result?.mode !== 'return'
+    || used[0].declaredResult !== 'host-terminal'
+    || (plan.helpers || []).length || (plan.callables || []).length || (plan.stages || []).length
+    || options.bodyForwarding || options.bindings?.dynamicBackends || options.guestUnits?.length
+    || plan.packages?.application || plan.logging?.enabledStatements)
+    reject('only one direct terminal effect without surrounding effects or composition is admitted.');
+  const handlers = new Map((plan.handlers || []).map(handler => [handler.id, handler]));
+  const entries = plan.routing?.entries || [];
+  if (routed) {
+    if (!entries.length || entries.length !== handlers.size
+      || entries.some(entry => entry.kind !== 'route' || entry.nativeBody?.family !== 'terminal-route'
+        || !handlers.has(entry.stableId))
+      || used[0].routerEntryKind !== 'route' || !handlers.has(used[0].routerEntryStableId)
+      || !used[0].statementPath?.startsWith(`handlers.${used[0].routerEntryStableId}.body[`))
+      reject('terminal Router placement requires private route bodies without middleware or error composition.');
+  } else if (plan.entry?.kind !== 'handler' || handlers.size || entries.length
+    || !used[0].statementPath?.startsWith('entry.body[')) {
+    reject('terminal placement requires a plain HTTP handler or one selected Router route.');
+  }
+  const dispatcherLocals = new Set((plan.locals || []).filter(local => local.scopeId === 'entry').map(local => local.id));
+  function expression(value, dispatcher = false) {
+    if (!value || typeof value !== 'object') return;
+    if (dispatcher && value.kind === 'local' && dispatcherLocals.has(value.id)) return;
+    if (dispatcher && value.kind === 'undefined') return;
+    if (dispatcher && value.kind === 'assignment' && value.operator === '='
+      && value.target?.kind === 'local' && dispatcherLocals.has(value.target.id)) {
+      expression(value.value, true); return;
+    }
+    // Router exhaustion emits a literal status option; authored text siblings
+    // may use that same bounded response shape, without evaluating callbacks.
+    if (routed && value.kind === 'object' && value.entries?.every(entry => entry.kind === 'property'
+      && entry.key?.kind === 'literal' && entry.key.value === 'status' && entry.value?.kind === 'literal'
+      && Number.isInteger(entry.value.value) && entry.value.value >= 100 && entry.value.value <= 599)) return;
+    if (!['literal', 'context-read', 'binary', 'intrinsic'].includes(value.kind)) reject('unsupported expression in the terminal proof.');
+    if (value.kind === 'context-read' && !['req.path', 'req.method', 'req.url'].includes(value.path.join('.'))) reject('request mutation/body/state is outside this proof.');
+    if (value.kind === 'intrinsic' && value.name !== 'response.text' && !(dispatcher && value.name === 'router.match'))
+      reject('only a plain text response control is admitted beside the handoff.');
+    for (const child of [value.left, value.right, ...(value.arguments || [])]) if (child) expression(child, dispatcher);
+  }
+  let occurrences = 0;
+  const calls = new Map();
+  function statements(body, owner) {
+    const dispatcher = routed && owner === 'entry';
+    for (const [index, statement] of body.entries()) {
+      if (statement.kind === 'if') { expression(statement.test, dispatcher); statements(statement.then, owner); statements(statement.else, owner); }
+      else if (statement.kind === 'return') {
+        if (statement.value?.kind !== 'intrinsic' || statement.value.name !== 'response.text') reject('Ordinary terminal branches must return a text response.');
+        expression(statement.value, dispatcher);
+      } else if (statement.kind === 'effect') {
+        if (dispatcher || statement.effectId !== used[0].id || statement.result?.mode !== 'return'
+          || (routed && owner !== used[0].routerEntryStableId)) reject('handoff must return directly from its selected route.');
+        occurrences++;
+      } else if (dispatcher && statement.kind === 'handler-call' && handlers.has(statement.handlerId)) {
+        calls.set(statement.handlerId, (calls.get(statement.handlerId) || 0) + 1);
+      } else if (dispatcher && statement.kind === 'local' && dispatcherLocals.has(statement.localId)) {
+        expression(statement.value, true);
+      } else if (dispatcher && statement.kind === 'expression') {
+        expression(statement.expression, true);
+      } else if (routed && !dispatcher && index === 0 && statement.kind === 'local'
+        && statement.name === `__pulse_router_transferred_${entries.find(entry => entry.stableId === owner)?.index}`
+        && handlers.get(owner)?.localIds.includes(statement.localId)
+        && statement.value?.kind === 'literal' && statement.value.value === false) {
+        // The canonical route body's private transfer flag, not an authored token.
+      } else reject('only bounded route dispatch, pure conditions, direct handoff and text responses are admitted.');
+    }
+  }
+  statements(plan.entry.body, 'entry');
+  for (const handler of handlers.values()) {
+    if (calls.get(handler.id) !== 1) reject('each terminal route requires exactly one dispatcher call.');
+    statements(handler.body, handler.id);
+  }
+  if (occurrences !== 1) reject('exactly one terminal handoff site is required.');
+  const effect = used[0];
+  const inputs = effect.inputs || [];
+  if (inputs.length !== 2 || inputs[0].name !== 'resource' || inputs[1].name !== 'payload'
+    || inputs[1].value?.kind !== 'object' || inputs[1].value.entries?.length !== 0
+    || inputs[0].value?.kind !== 'object' || inputs[0].value.entries?.length !== 2
+    || inputs[0].value.entries.some(entry => entry.kind !== 'property' || entry.key?.kind !== 'literal'
+      || !['kind', 'value'].includes(entry.key.value) || entry.value?.kind !== 'literal'
+      || entry.value.value !== effect.resource?.[entry.key.value])) reject('The terminal service accepts only a static resource and empty payload.');
+  const target = options.targetDescriptor ? { provider: 'fastly', ...options.targetDescriptor } : TARGET;
+  const [artifact] = contract.select(used, options.realizationArtifacts || [], target);
+  const data = artifact.data;
+  if (data.service !== contract.TERMINAL_SERVICE || data.imports.length !== 1
+    || JSON.stringify(data.imports[0].parameters) !== '["i32","i32","i32"]'
+    || JSON.stringify(data.imports[0].results) !== '["i32"]')
+    contract.fail('SIGNATURE', 'The terminal backend service requires (i32, i32, i32) -> i32.', effect);
+  const backend = validateBinding(effect, options.bindings || options);
+  return Object.freeze([Object.freeze({ artifact, effect, index: effects.indexOf(effect), backend })]);
+}
+// The terminal service uses driver-owned response authority and binds each
+// selected contribution to a slot: static per-effect data (effect index, ABI
+// entry, backend). Only one terminal handoff can win per request, so the
+// dynamic state (dispatching slot, token, ticket, settlement) is request-scoped.
+function slotSwitch(selected, slot, cases, fallback) {
+  return selected.map((item, n) => `if (${slot} == ${n}) ${cases(item, n)}`).join('\n  ') + `\n  ${fallback}`;
+}
+function source(selected) {
+  if (!selected.length) return '';
+  const contributed = [...new Map(selected.map(item => [item.artifact.id, item.artifact.data.source])).values()].join('\n');
+  return `
+${contributed}
+let __pulse_extension_status: i32 = -1
+let __pulse_extension_slot: i32 = -1
+let __pulse_extension_token: i32 = 0
+let __pulse_extension_invocation: i32 = 0
+let __pulse_extension_delivering: bool = false
+let __pulse_extension_settled: bool = false
+let __pulse_extension_handles_owned: bool = false
+function __pulse_extension_slot_of(effectIndex: i32): i32 {
+  ${selected.map((item, n) => `if (effectIndex == ${item.index}) return ${n}`).join('\n  ')}
+  return -1
+}
+function __pulse_extension_backend(slot: i32): ArrayBuffer {
+  ${slotSwitch(selected, 'slot', item => `return __pulse_fastly_utf8(${JSON.stringify(item.backend)})`, 'return new ArrayBuffer(0)')}
+}
+function __pulse_extension_call(slot: i32, request: i32, backend: ArrayBuffer): i32 {
+  ${slotSwitch(selected, 'slot', item => `return ${item.artifact.data.entry}(request, changetype<usize>(backend), backend.byteLength)`, 'return -1')}
+}
+function __pulse_extension_cleanup(): void {
+  // This service borrows the request handle. Status zero transfers downstream
+  // response authority, not ownership of these local request/body handles.
+  // Nonzero/trapped dispatch remains uncertain and is left to host teardown.
+  if (!__pulse_extension_handles_owned || (__pulse_extension_slot >= 0 && __pulse_response_authority == ${STATES['outcome-unknown']})) return
+  __pulse_extension_handles_owned = false
+  const request = __pulse_fastly_request_handle, body = __pulse_fastly_request_body_handle
+  __pulse_fastly_request_handle = -1
+  __pulse_fastly_request_body_handle = -1
+  const requestStatus = __pulse_fetch_close_request(request)
+  const bodyStatus = __pulse_fetch_close_body(body)
+  if (requestStatus != 0 || bodyStatus != 0) __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 285, __pulse_extension_slot)
+}
+function __pulse_extension_begin(effectIndex: i32, payload: __PulseFastlyValue): void {
+  const slot = __pulse_extension_slot_of(effectIndex)
+  if (slot < 0 || __pulse_response_authority != ${STATES['owned']} || !__pulse_invocation_started || __pulse_invocation_closed || __pulse_fastly_last_error != 0 || unchecked(__pulse_invocation_tickets[effectIndex]) <= 0) { __pulse_fastly_fail(PULSE_ERROR_STATE, 280, effectIndex); return }
+  // One bounded backend encoding and one opaque token per admitted invocation.
+  const backend = __pulse_extension_backend(slot)
+  if (backend.byteLength > ${MAX_BACKEND_BYTES} || __pulse_extension_token != 0) { __pulse_fastly_fail(PULSE_ERROR_VALUE, 280, effectIndex); return }
+  // Allocate before dispatch, while we still own downstream response authority.
+  const value = new __PulseFastlyValue()
+  value.kind = 9 // private provider completion token, never an authored value
+  __pulse_extension_token = __pulse_fastly_put(value)
+  if (__pulse_extension_token <= 0 || __pulse_fastly_last_error != 0) return
+  // Recheck the shared request budget immediately before crossing the ABI.
+  if (!__pulse_fetch_request_check(effectIndex) || __pulse_invocation_closed || __pulse_fastly_last_error != 0) return
+  __pulse_extension_invocation = unchecked(__pulse_invocation_tickets[effectIndex])
+  __pulse_extension_slot = slot
+  if (!__pulse_response_begin()) return
+  __pulse_extension_status = __pulse_extension_call(slot, __pulse_fastly_request_handle, backend)
+  if (__pulse_extension_status != 0) { __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 281, effectIndex); return }
+  __pulse_response_transferred()
+  __pulse_extension_cleanup()
+  if (!__pulse_fetch_request_check(effectIndex) || __pulse_invocation_closed || __pulse_fastly_last_error != 0) return
+  __pulse_fastly_ready_effect(effectIndex, __pulse_extension_token)
+}
+`;
+}
+// Typed contributions to the existing structural lifecycle emitter.
+// Bodies see parameters and module globals, never the caller's local variables.
+const OWNER = 'host-extension.terminal';
+function hooks(selected) {
+  if (!selected.length) return [];
+  const mine = (effect) => `__pulse_extension_slot_of(${effect}) >= 0`;
+  // The dispatched slot only; an undispatched terminal effect can never settle.
+  const dispatched = (effect) => `__pulse_extension_slot_of(${effect}) == __pulse_extension_slot`;
+  return [
+    { point: 'request.acquired', owner: OWNER, order: 0, body: '  __pulse_extension_handles_owned = true' },
+    // Authenticate the terminal value before the ordinary invocation consumes its
+    // ticket. A raw exported setter is not authority to complete this operation.
+    { point: 'effect.settle', owner: OWNER, order: 0, body: `  if (!(${mine('effect')})) return true
+  if (!(${dispatched('effect')}) || __pulse_response_authority != ${STATES['transferred']} || __pulse_extension_settled || ticket != __pulse_extension_invocation || result != __pulse_extension_token || result <= 0) {
+    __pulse_fastly_fail(PULSE_ERROR_STATE, 284, effect); return false
+  }
+  return true` },
+    { point: 'effect.deliver', owner: OWNER, order: 0,
+      before: `  __pulse_extension_delivering = ${mine('effect')}`,
+      after: `  __pulse_extension_delivering = false
+  if (${mine('effect')} && accepted == 1) __pulse_extension_settled = true` },
+    { point: 'effect.result', owner: OWNER, order: 0, body: `  if (!(${mine('effect')})) return true
+  if (!(${dispatched('effect')}) || !__pulse_extension_delivering || __pulse_response_authority != ${STATES['transferred']} || __pulse_extension_settled || result != __pulse_extension_token || __pulse_invocation_closed) {
+    __pulse_fastly_fail(PULSE_ERROR_STATE, 284, effect); return false
+  }
+  return true` },
+    { point: 'invocation.close', owner: OWNER, order: 0, body: `  __pulse_extension_cleanup()
+  __pulse_extension_token = 0
+  __pulse_extension_invocation = 0
+  __pulse_extension_delivering = false` },
+    { point: 'result.claim', owner: OWNER, order: 0, body: `  if (__pulse_response_authority == ${STATES['owned']}) return false
+  if (__pulse_response_authority != ${STATES['transferred']} || !__pulse_extension_settled || result != __pulse_extension_token || __pulse_extension_token <= 0) { __pulse_fastly_fail(PULSE_ERROR_STATE, 283, -1); return true }
+  __pulse_response_complete()
+  __pulse_extension_token = 0
+  return true` }
+  ];
+}
+function policy(selected, baseline) {
+  return contract.composeImportPolicy(baseline, selected.map(item => item.artifact));
+}
+function evidence(selected, lifecycle, importPolicy) {
+  if (!selected.length) return undefined;
+  return Object.freeze({ version: 'pulse.fastly-terminal-service.v1', service: contract.TERMINAL_SERVICE,
+    implementation: require('../provider-contract.js').FASTLY_PROVIDER_DESCRIPTOR.lowering['host.extension'],
+    contributions: importPolicy.contributions,
+    useSites: selected.map(({artifact,effect,index}) => ({ contributionId: artifact.id, effectId: effect.id, index,
+      source: effect.source || null })),
+    lifecycle: { executionVersion: lifecycle.plan.executionVersion, httpVersion: lifecycle.plan.httpVersion,
+      selectedPoints: lifecycle.plan.sites.map(site => ({ site: site.id, points: site.points.map(point => ({ point: point.point, kind: point.kind, contributions: point.contributions })) })),
+      coverage: 'selected-points; normal-return-only after/end/closed; no trap finalizer' },
+    limits: { backendBytes: MAX_BACKEND_BYTES, completionValues: 1 },
+    accounting: 'not-selected', importPolicy });
+}
+module.exports = { ADMISSION, TARGET, MAX_BACKEND_BYTES, validateBinding, select, matches, source, hooks, policy, evidence };

package/src/build/lifecycle.js

@@ -0,0 +1,50 @@
+'use strict';
+
+const { executionLifecycle, httpLifecycle, lifecyclePlanner } = require('@pulse-compute/wasm-contracts/provider/toolchain');
+const { createLifecycleEmitter } = require('@pulse-compute/wasm-runtime-core-as/compiler/canonical-native');
+const forwarding = require('./native-body-forwarding.js');
+const authority = require('./response-authority.js');
+
+// Provider-owned site and ABI bindings. No anchors, source scanning or insertion
+// order. The shared planner owns semantic roles; the shared emitter owns AS.
+function create(plan, bindings, services = []) {
+  if (!Array.isArray(services)) throw new TypeError('Internal lifecycle services must be a list.');
+  const hooks = [...(forwarding.hooks(plan)), ...services];
+  const needsAuthority = hooks.some(hook => ['response.error', 'response.authority', 'result.claim'].includes(hook.point));
+  if (needsAuthority) hooks.push(...authority.hooks());
+  if (plan.packages?.application && hooks.length) throw Object.assign(new Error('Lifecycle contributions require the canonical driver emitter; package-owned emitters are not yet bound.'), { code: 'PULSE_FASTLY_LIFECYCLE_HOOK_INVALID' });
+  const sites = [
+    { id: 'request-acquired', points: [{ point: 'request.acquired', parameters: {} }] },
+    { id: 'effect-settle', points: [{ point: 'effect.settle', parameters: { effect: 'settle.index', ticket: 'settle.ticket', result: 'settle.result' }, reject: 'reject-settle' }] },
+    { id: 'effect-deliver', points: [{ point: 'effect.deliver', parameters: { effect: 'settle.index', result: 'settle.result' }, afterParameters: { accepted: 'delivery.accepted' } }] },
+    { id: 'effect-result', points: [{ point: 'effect.result', parameters: { effect: 'setter.index', result: 'setter.result' }, reject: 'reject-result' }] },
+    { id: 'invocation-close', points: [{ point: 'invocation.close', parameters: {} }] },
+    { id: 'invocation-end', points: [{ point: 'invocation.end', parameters: {} }] },
+    { id: 'invocation-closed', points: [{ point: 'invocation.closed', parameters: {} }] },
+    { id: 'response-error', points: [
+      { point: 'response.authority', parameters: {}, reject: 'stop-error' },
+      { point: 'response.error', parameters: {}, onClaim: 'stop-error' }
+    ] },
+    { id: 'response-send', points: [{ point: 'response.authority', parameters: {}, reject: 'reject-send' }] },
+    ...(bindings.maxDurationMs === undefined ? [] : [{ id: 'response-timeout', points: [{ point: 'response.authority', parameters: {}, reject: 'stop-error' }] }]),
+    { id: 'result-claim', points: [{ point: 'result.claim', parameters: { result: 'driver.result' }, onClaim: 'stop-error' }] }
+  ];
+  const emitter = createLifecycleEmitter({
+    bindings: { version: lifecyclePlanner.BINDINGS_VERSION, executionVersion: executionLifecycle.VERSION, httpVersion: httpLifecycle.VERSION, sites },
+    contributions: hooks.map(({ point, owner, order }) => ({ point, owner, order })),
+    implementations: hooks.map(({ order, ...implementation }) => implementation),
+    values: {
+      'settle.index': { name: 'index', type: 'i32' }, 'settle.ticket': { name: 'ticket', type: 'i32' }, 'settle.result': { name: 'result', type: 'i32' },
+      'setter.index': { name: 'effectIndex', type: 'i32' }, 'setter.result': { name: 'handle', type: 'i32' },
+      'delivery.accepted': { name: '__pulse_delivery_accepted', type: 'i32' }, 'driver.result': { name: 'result', type: 'i32' }
+    },
+    actions: { 'reject-settle': 'return 0;', 'reject-result': 'return 0;', 'stop-error': 'return;', 'reject-send': '{ __pulse_fastly_fail(PULSE_ERROR_STATE, 282, -1); return PULSE_ERROR_STATE; }' }
+  });
+  return Object.freeze({ ...emitter, authority: needsAuthority,
+    // Legacy error/body/deadline owners instrument only the inner implementation.
+    // Structural wrappers keep shared authority outside them, regardless of pass order.
+    legacyName: name => emitter.active ? name + '_impl' : name,
+    supportSource: [emitter.source, ...(needsAuthority ? [authority.runtimeSource()] : [])].filter(Boolean).join('\n')
+  });
+}
+module.exports = Object.freeze({ create });

package/src/build/native-body-forwarding.as.ts

@@ -29,7 +29,6 @@ let __fwd_index: i32 = -1
 let __fwd_result: i32 = 0
 let __fwd_marker: i32 = 0
 let __fwd_failure: i32 = 0
-let __fwd_committed: bool = false
 let __fwd_reserved: bool = false
 let __fwd_header_count: i32 = 0
 let __fwd_request_length: i32 = -1
@@ -42,13 +41,14 @@ function host_request_body(): i32 {
 }
 function __fwd_fail(status: i32): void {
   if (__fwd_failure == 0) __fwd_failure = status;
+  if (__fwd_ra !== null) __fwd_ra!.fail(1,u32(status));
   __pulse_fastly_fail(PULSE_ERROR_HOSTCALL, 280, __fwd_index);
 }
 function __fwd_remaining(): i32 {
   if (__fwd_failure != 0) return 0;
-  if (wasi_snapshot_preview1_clock_time_get(1, 1, __fwd_io) != 0) { __fwd_fail(504); return 0; }
+  if (wasi_snapshot_preview1_clock_time_get(1, 1, __fwd_io) != 0) { __fra_clock_failed = true; __fwd_fail(504); return 0; }
   const now = load<i64>(__fwd_io);
-  if (now < 0 || now < __request_last_clock || now < __pulse_fetch_last_clock) { __fwd_fail(504); return 0; }
+  if (now < 0 || now < __request_last_clock || now < __pulse_fetch_last_clock) { __fra_clock_failed = true; __fwd_fail(504); return 0; }
   __request_last_clock = now; __pulse_fetch_last_clock = now;
   let remaining = f64(__request_deadline - now) / 1000000.0;
   if (__request_expired || remaining <= 0) { __request_expired = true; __fwd_fail(504); return 0; }
@@ -57,35 +57,20 @@ function __fwd_remaining(): i32 {
   return i32(Math.ceil(remaining)); // 1..30000; zero never reaches async.select
 }
 function __fwd_cleanup(): void {
-  if (__fwd_source >= 0) { __pulse_fetch_close_body(__fwd_source); __fwd_source = -1; }
-  if (__fwd_upload >= 0) { __fwd_abandon(__fwd_upload); __fwd_upload = -1; }
-  if (__fwd_request >= 0) { __pulse_fetch_close_request(__fwd_request); __fwd_request = -1; }
-  if (__fwd_body >= 0) { __pulse_fetch_close_body(__fwd_body); __fwd_body = -1; }
-  if (__fwd_response >= 0) { __pulse_fetch_close_response(__fwd_response); __fwd_response = -1; }
-  if (__fwd_output >= 0) { __pulse_fetch_close_response(__fwd_output); __fwd_output = -1; }
-  if (__fwd_downstream >= 0) { __fwd_abandon(__fwd_downstream); __fwd_downstream = -1; }
-  if (__fwd_pending >= 0) {
-    // No pending-request cancel ABI. Poll once without waiting and discard any
-    // late handles; an unresolved host operation ends at invocation teardown.
-    __pulse_send_error_detail_reset(__fwd_detail);
-    store<i32>(__fwd_done, 0);
-    const status = __pulse_fetch_poll(__fwd_pending, __fwd_detail, __fwd_done, __fwd_response_out, __fwd_body_out);
-    if (status == 0 && load<i32>(__fwd_done) == 1) {
-      __pulse_fetch_close_response(load<i32>(__fwd_response_out)); __pulse_fetch_close_body(load<i32>(__fwd_body_out));
-    }
-    __fwd_pending = -1;
-  }
+  __fra_cleanup();
+  __fwd_source = -1; __fwd_upload = -1; __fwd_request = -1;
+  __fwd_body = -1; __fwd_response = -1; __fwd_output = -1;
+  __fwd_downstream = -1; __fwd_pending = -1;
 }
 function __fwd_error_response(): bool {
-  if (__fwd_committed) { __fwd_cleanup(); return true; }
+  if (__fwd_ra === null) return false;
+  if (__fwd_failure == 0 && __pulse_fastly_last_error != 0) __fwd_fail(502);
+  if (!__pulse_response_owned()) { __fwd_cleanup(); return true; }
   if (__fwd_failure == 0) return false;
   const status = __fwd_failure;
-  __fwd_cleanup(); __request_error_response = true;
-  __pulse_fastly_last_error = 0;
-  const value = new __PulseFastlyValue(); value.kind = PULSE_VALUE_RESPONSE; value.status = status;
-  value.text = status == 413 ? 'Payload Too Large' : status == 504 ? 'Gateway Timeout' : status == 400 ? 'Bad Request' : 'Bad Gateway';
-  __fwd_committed = true;
-  __pulse_fastly_send_result(__pulse_fastly_put(value)); return true;
+  __fwd_cleanup();
+  __fra_error(status);
+  return true;
 }
 function __fwd_lower(byte: u8): u8 { return byte >= 65 && byte <= 90 ? byte + 32 : byte; }
 function __fwd_equal(ptr: usize, size: i32, text: string): bool {
@@ -136,9 +121,9 @@ function __fwd_begin(index: i32, payload: __PulseFastlyValue): void {
   if (__pulse_fastly_last_error != 0 || !__fwd_remaining() || !__fwd_declared_request()) return;
   const url = __pulse_fastly_utf8(__pulse_fastly_string(__pulse_fastly_payload_field(payload, 'url')));
   const backend = __pulse_fastly_utf8(__pulse_fastly_backend(index));
-  if (fastly_http_req_new(__fwd_io + 52) != 0) { __fwd_fail(502); return; }
+  if (__fra_new(2,__fwd_io + 52) != 0) { __fwd_fail(502); return; }
   __fwd_request = load<i32>(__fwd_io + 52);
-  if (fastly_http_body_new(__fwd_io + 52) != 0) { __fwd_fail(502); return; }
+  if (__fra_new(3,__fwd_io + 52) != 0) { __fwd_fail(502); return; }
   __fwd_upload = load<i32>(__fwd_io + 52);
   const method = memory.data<u8>([80,79,83,84]);
   if (fastly_http_req_method_set(__fwd_request, method, 4) != 0 || fastly_http_req_uri_set(__fwd_request, changetype<usize>(url), url.byteLength) != 0) { __fwd_fail(502); return; }
@@ -152,9 +137,8 @@ function __fwd_begin(index: i32, payload: __PulseFastlyValue): void {
   }
   if (!__fwd_remaining()) return;
   __pulse_transport_slots[index] = null;
-  const status = __fwd_dispatch(__fwd_request, __fwd_upload, changetype<usize>(backend), backend.byteLength, __fwd_io + 52);
-  // send may consume the request even on failure. Cleanup makes only a best-effort
-  // close on that error path before any handle allocation/reuse can occur.
+  const status = __fra_dispatch(__fwd_request, __fwd_upload, changetype<usize>(backend), backend.byteLength, __fwd_io + 52);
+  // An ambiguous send retains its fenced request claim; cleanup never retries it.
   if (status != 0) { __pulse_transport_capture(__fwd_index, status, 'send'); __fwd_fail(502); return; }
   __fwd_request = -1; __fwd_pending = load<i32>(__fwd_io + 52);
   __pulse_fastly_pending[index] = __fwd_pending; __pulse_fastly_pending_mode[index] = PULSE_FASTLY_PENDING_ASYNC;
@@ -165,7 +149,7 @@ function __fwd_poll(): bool {
   if (__fwd_pending < 0 || !__fwd_remaining()) return __fwd_response >= 0;
   __pulse_send_error_detail_reset(__fwd_detail);
   store<i32>(__fwd_done, 0);
-  const status = __pulse_fetch_poll(__fwd_pending, __fwd_detail, __fwd_done, __fwd_response_out, __fwd_body_out);
+  const status = __fra_poll();
   const done = load<i32>(__fwd_done);
   if (status != 0) { __pulse_transport_capture(__fwd_index, status, 'poll', __fwd_detail); __fwd_pending = -1; __fwd_fail(502); return false; }
   if (done != 0 && done != 1) { __fwd_fail(502); return false; }
@@ -229,11 +213,11 @@ function __fwd_copy(source: i32, sink: i32, cap: i32, declared: i32, upload: boo
 function __fwd_wait(): i32 {
   if (__fwd_failure != 0 || __fwd_pending < 0) return 0;
   const eof = __fwd_copy(__fwd_source, __fwd_upload, __FWD_REQUEST_MAX, __fwd_request_length, true);
-  __pulse_fetch_close_body(__fwd_source); __fwd_source = -1;
+  __fra_dispose(1); __fwd_source = -1;
   if (eof && __fwd_remaining()) {
     const upload = __fwd_upload; __fwd_upload = -1;
-    if (__pulse_fetch_close_body(upload) != 0) __fwd_fail(502);
-  } else if (__fwd_upload >= 0) { __fwd_abandon(__fwd_upload); __fwd_upload = -1; }
+    if (__fra_dispose(3) != 0) __fwd_fail(502);
+  } else if (__fwd_upload >= 0) { __fra_dispose(3,true); __fwd_upload = -1; }
   while (__fwd_failure == 0 && __fwd_response < 0) {
     if (__fwd_poll()) break;
     if (__fwd_failure != 0 || !__fwd_wait_io(__fwd_pending, false)) break;
@@ -310,9 +294,9 @@ function __fwd_nominated(name: usize, length: i32): bool {
 }
 function __fwd_send(): i32 {
   if (!__fwd_response_headers()) { __fwd_error_response(); return 0; }
-  if (fastly_http_resp_new(__fwd_io + 52) != 0) { __fwd_fail(502); __fwd_error_response(); return 0; }
+  if (__fra_new(7,__fwd_io + 52) != 0) { __fwd_fail(502); __fwd_error_response(); return 0; }
   __fwd_output = load<i32>(__fwd_io + 52);
-  if (fastly_http_resp_status_set(__fwd_output, __fwd_status) != 0 || fastly_http_body_new(__fwd_io + 52) != 0) { __fwd_fail(502); __fwd_error_response(); return 0; }
+  if (fastly_http_resp_status_set(__fwd_output, __fwd_status) != 0 || __fra_new(8,__fwd_io + 52) != 0) { __fwd_fail(502); __fwd_error_response(); return 0; }
   __fwd_downstream = load<i32>(__fwd_io + 52);
   for (let i = 0; i < __fwd_header_count; i++) {
     const pair = __fwd_pairs + i * 16, name = load<usize>(pair), length = load<i32>(pair + 4);
@@ -321,19 +305,19 @@ function __fwd_send(): i32 {
     if (__fwd_hop(name, length) || nominated) continue;
     if (fastly_http_resp_header_append(__fwd_output, name, length, load<usize>(pair + 8), load<i32>(pair + 12)) != 0) { __fwd_fail(502); break; }
   }
-  __pulse_fetch_close_response(__fwd_response); __fwd_response = -1;
+  __fra_dispose(5); __fwd_response = -1;
   if (!__fwd_remaining()) { __fwd_error_response(); return 0; }
   // Treat even an ambiguous send failure as committed: never emit a second
   // response. The writable body remains ours until explicit EOF or abandon.
-  __fwd_committed = true;
   const output = __fwd_output; __fwd_output = -1;
-  if (fastly_http_resp_send_downstream(output, __fwd_downstream, 1) != 0) { __pulse_fetch_close_response(output); __fwd_fail(502); __fwd_cleanup(); return 0; }
+  if (__fra_send(output, __fwd_downstream, 1) != 0) { __fwd_fail(502); __fwd_cleanup(); return 0; }
   const bodyless = __fwd_status == 204 || __fwd_status == 205 || __fwd_status == 304;
   const eof = __fwd_copy(__fwd_body, __fwd_downstream, bodyless ? 0 : __FWD_RESPONSE_MAX, bodyless ? 0 : __fwd_response_length, false);
-  __pulse_fetch_close_body(__fwd_body); __fwd_body = -1;
+  __fra_dispose(6); __fwd_body = -1;
   if (eof && __fwd_remaining()) {
     const downstream = __fwd_downstream; __fwd_downstream = -1;
-    if (__pulse_fetch_close_body(downstream) != 0) __fwd_fail(502);
+    if (__fra_dispose(8) != 0) __fwd_fail(502);
+    else __pulse_response_complete();
     // Success is the host-handoff boundary. The handle is gone; there is no
     // final-writer wait, delivery receipt, or post-handoff timeout guarantee.
   }

package/src/build/native-body-forwarding.js

@@ -14,12 +14,13 @@ function validate(plan, options) {
   const init = effect?.inputs?.find(input => input.name === 'init')?.value;
   const body = field(init, 'body'), method = field(init, 'method'), headers = field(init, 'headers');
   if (effects.length !== 1 || effect.kind !== 'fetch' || effect.grouped
+    || effect.fetchErrors !== undefined || effect.fetchTiming !== undefined
     || effect.result?.mode !== 'return' || effect.result?.valueKind !== 'opaque-response'
     || effect.resource?.kind !== 'literal' || options.bindings?.dynamicBackends
     || body?.name !== 'request.body.forward-marker' || method?.kind !== 'literal' || method.value !== 'POST'
     || init.entries.some(entry => !['method', 'body', 'headers', 'timeoutMs'].includes(entry.key?.value))
     || (headers && (headers.kind !== 'object' || headers.entries.some(entry => entry.key?.kind !== 'literal' || entry.value?.kind !== 'literal' || typeof entry.value.value !== 'string')))) {
-    throw forwardingError('Fastly Native forwarding admits one terminal opaque POST fetch with inline req.body(), a static backend, and optional literal headers/timeoutMs; groups, decoding, reuse, and dynamic backends are unsupported.');
+    throw forwardingError('Fastly Native forwarding admits one terminal opaque POST fetch with inline req.body(), a static backend, and optional literal headers/timeoutMs; outcome/timing options, groups, decoding, reuse, and dynamic backends are unsupported.');
   }
   const entries = headers?.entries || [];
   const hop = /^(connection|keep-alive|proxy-connection|transfer-encoding|te|trailer|upgrade|content-length|host|proxy-authenticate|proxy-authorization)$/i;
@@ -49,15 +50,6 @@ function instrument(input, plan, bindings) {
     if (!line || !line.endsWith('}')) throw new Error('Fastly forwarding function boundary drift: ' + name);
     replace(line, `function ${name}(${args}): ${result} { ${body} }`);
   }
-  replace('function __pulse_fastly_send_result(handle: i32): i32 {',
-    'function __pulse_fastly_send_result(handle: i32): i32 { if (handle == __fwd_result && handle != 0) return __fwd_send();');
-  replace('function __pulse_fastly_jwt_send_error(): void {',
-    'function __pulse_fastly_jwt_send_error(): void { if (__fwd_error_response()) return;');
-  replace('function __request_send_timeout(): void {',
-    'function __request_send_timeout(): void { if (__fwd_committed) { __fwd_cleanup(); return; }');
-  replace('  __pulse_fastly_run_invocation()\n', '  __pulse_fastly_run_invocation()\n  __fwd_cleanup()\n');
-  replace('  __pulse_fastly_request_body_handle = load<i32>(changetype<usize>(handles) + 4)',
-    '  __pulse_fastly_request_body_handle = load<i32>(changetype<usize>(handles) + 4)\n  __fwd_source = __pulse_fastly_request_body_handle');
   // Generic request-budget code must not wait for headers before driving upload.
   const begin = source.indexOf('function __pulse_fastly_resolve_effect(');
   const end = source.indexOf('\n}', begin);
@@ -66,4 +58,16 @@ function instrument(input, plan, bindings) {
   return source + '\n' + `const __FWD_REQUEST_MAX: i32 = ${bindings.bodyForwarding.requestMaxBytes}\nconst __FWD_RESPONSE_MAX: i32 = ${bindings.bodyForwarding.responseMaxBytes}\n`
     + fs.readFileSync(path.join(__dirname, 'native-body-forwarding.as.ts'), 'utf8');
 }
-module.exports = {IMPORTS, enabled, validate, instrument};
+function hooks(plan) {
+  if (!enabled(plan)) return [];
+  const owner = 'body-forwarding', order = 10;
+  return [
+    { point: 'request.acquired', owner, order, body: '  __fwd_source = __pulse_fastly_request_body_handle' },
+    { point: 'response.error', owner, order, body: '  return __fwd_error_response()' },
+    { point: 'result.claim', owner, order, body: `  if (result != __fwd_result || result == 0) return false
+  if (__pulse_response_owned()) __fwd_send()
+  return true` },
+    { point: 'invocation.end', owner, order, body: '  __fwd_cleanup(); __fra_cleanup(true)'  }
+  ];
+}
+module.exports = {IMPORTS, enabled, validate, instrument, hooks};