@pulse-compute/provider-fastly 1.0.0-beta.4 → 1.0.0-beta.6

package/README.md

@@ -7,9 +7,9 @@
 > **Supported entry points:** `@pulse-compute/provider-fastly`, `@pulse-compute/provider-fastly/contract`, `@pulse-compute/provider-fastly/toolchain`, `@pulse-compute/provider-fastly/config-schema`, `@pulse-compute/provider-fastly/runtime/canonical-api-runtime`, `@pulse-compute/provider-fastly/build/canonical-target`, `@pulse-compute/provider-fastly/testing/fastly-cli`<br>
 > **Stability:** The listed entry points are supported for the Beta; all other exported subpaths are implementation-only.<br>
 > **npm:** [`@pulse-compute/provider-fastly`](https://www.npmjs.com/package/@pulse-compute/provider-fastly)<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.4/packages/provider-fastly/)
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.6/packages/provider-fastly/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.4` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.6` package policy.
 <!-- pulse-package-status:end -->
 
 Fastly provider configuration, canonical capability lowering, local conformance execution, Compute target generation, and explicit external-tool boundaries.
@@ -49,7 +49,7 @@ trusted wall-clock authority. It does not fall back to Node execution.
 
 ## Documentation
 
-- [Fastly package guide](https://pulsecompute.io/v1.0.0-beta.4/packages/provider-fastly/)
-- [Project configuration](https://pulsecompute.io/v1.0.0-beta.4/reference/project-config/#fastly-provider-options)
-- [Fastly capabilities guide](https://pulsecompute.io/v1.0.0-beta.4/guides/fastly-capabilities/)
-- [Environment variables](https://pulsecompute.io/v1.0.0-beta.4/reference/environment/#pulse-fastly-bin)
+- [Fastly package guide](https://pulsecompute.io/v1.0.0-beta.6/packages/provider-fastly/)
+- [Project configuration](https://pulsecompute.io/v1.0.0-beta.6/reference/project-config/#fastly-provider-options)
+- [Fastly capabilities guide](https://pulsecompute.io/v1.0.0-beta.6/guides/fastly-capabilities/)
+- [Environment variables](https://pulsecompute.io/v1.0.0-beta.6/reference/environment/#pulse-fastly-bin)

package/dist/config-schema.json

@@ -72,6 +72,16 @@
         "fastly.local.networkFetch": {
             "kind": "boolean",
             "default": false
+        },
+        "fastly.maxDurationMs": {
+            "kind": "optional-number"
+        },
+        "fastly.build.maxWasmBytes": {
+            "kind": "positive-safe-integer",
+            "default": 4194304
+        },
+        "fastly.maxWasmBytes": {
+            "kind": "positive-safe-integer"
         }
     }
 }

package/dist/index.d.ts

@@ -14,6 +14,9 @@ export interface PulseFastlyLocalOptions {
     readonly networkFetch?: boolean;
 }
 export interface PulseFastlyProviderOptions {
+    /** Inclusive final Native Wasm byte budget; default 4 MiB. */
+    readonly maxWasmBytes?: number;
+    readonly maxDurationMs?: number;
     readonly configStore?: string;
     readonly secretStore?: string;
     readonly kv?: Readonly<Record<string, string>>;
@@ -26,6 +29,7 @@ export interface PulseFastlyProviderOptions {
     readonly local?: PulseFastlyLocalOptions;
 }
 export interface PulseFastlyProviderConfig {
+    readonly maxDurationMs?: number;
     readonly kind: 'fastly';
     readonly version: typeof FASTLY_PROVIDER_API_VERSION;
     readonly bindings: {
@@ -47,6 +51,7 @@ export interface PulseFastlyProviderConfig {
         readonly dynamicBackends: boolean;
     };
     readonly build: {
+        readonly maxWasmBytes: number;
         readonly name: string;
         readonly description: string;
         readonly authors: readonly string[];

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,2BAA2B,EAAG,8BAAuC,CAAC;AAEnF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,uBAAuB,CAAC;CAC1C;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,2BAA2B,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,EAAE;YACd,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;YAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;YAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YACjC,QAAQ,CAAC,cAAc,CAAC,EAAE;gBACxB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;aAC5B,CAAC;YACF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;SAC9B,CAAC;QACF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;KACnC,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QACpC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;KAChC,CAAC;IACF,QAAQ,CAAC,wBAAwB,EAAE,KAAK,CAAC;CAC1C;AA2BD,wBAAgB,MAAM,CAAC,OAAO,GAAE,0BAA+B,GAAG,yBAAyB,CAsB1F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,2BAA2B,EAAG,8BAAuC,CAAC;AAEnF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,0BAA0B;IACzC,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,uBAAuB,CAAC;CAC1C;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,2BAA2B,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,EAAE;YACd,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;YAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;YAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YACjC,QAAQ,CAAC,cAAc,CAAC,EAAE;gBACxB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;aAC5B,CAAC;YACF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;SAC9B,CAAC;QACF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;KACnC,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QACpC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;KAChC,CAAC;IACF,QAAQ,CAAC,wBAAwB,EAAE,KAAK,CAAC;CAC1C;AA2BD,wBAAgB,MAAM,CAAC,OAAO,GAAE,0BAA+B,GAAG,yBAAyB,CAwB1F"}

package/dist/index.js

@@ -5,6 +5,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FASTLY_PROVIDER_API_VERSION = void 0;
 exports.fastly = fastly;
+const { normalizeFastlyMaxWasmBytes } = require('../src/build/wasm-budget.js');
+const { normalizeRequestDuration } = require('@pulse-compute/runtime/host');
 const config_schema_json_1 = __importDefault(require("./config-schema.json"));
 const fastlySchemaFields = config_schema_json_1.default.fields;
 const fastlyDefaults = Object.freeze(Object.fromEntries(Object.entries(fastlySchemaFields).filter(([, rule]) => Object.prototype.hasOwnProperty.call(rule, 'default')).map(([key, rule]) => [key, rule.default])));
@@ -37,6 +39,7 @@ function fastly(options = {}) {
     const normalizedGrip = options.grip === undefined ? undefined : gripBindings(options.grip);
     return Object.freeze({
         kind: 'fastly',
+        maxDurationMs: normalizeRequestDuration(options.maxDurationMs),
         version: exports.FASTLY_PROVIDER_API_VERSION,
         bindings: Object.freeze({
             configStore: String(options.configStore ?? fastlyDefaults['fastly.configStore']),
@@ -47,6 +50,7 @@ function fastly(options = {}) {
             dynamicBackends: options.dynamicBackends === undefined ? Boolean(fastlyDefaults['fastly.dynamicBackends']) : options.dynamicBackends === true
         }),
         build: Object.freeze({
+            maxWasmBytes: normalizeFastlyMaxWasmBytes(options.maxWasmBytes),
             name: String(options.name ?? fastlyDefaults['fastly.name']),
             description: String(options.description ?? fastlyDefaults['fastly.description']),
             authors: Object.freeze((options.authors ?? (Array.isArray(fastlyDefaults['fastly.authors']) ? fastlyDefaults['fastly.authors'] : [])).map(String)),

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;AA+FA,wBAsBC;AArHD,8EAAwD;AAGxD,MAAM,kBAAkB,GAAG,4BAAoB,CAAC,MAAoD,CAAC;AACrG,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAsC,CAAC;AAE3O,QAAA,2BAA2B,GAAG,8BAAuC,CAAC;AAgEnF,SAAS,SAAS,CAAC,KAAmD;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5H,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA2D;IACrF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,IAAI,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;IAClG,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,QAAiB;QACzB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;KACnC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAyC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,KAAK,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;QAC3F,eAAe,EAAE,KAAK,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;QACjG,UAAU,EAAE,KAAK,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QAClF,cAAc,EAAE,KAAK,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;QAC9F,cAAc,EAAE,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC;QACzD,UAAU,EAAE,KAAK,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,KAAK;KAC7H,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,MAAM,CAAC,UAAsC,EAAE;IAC7D,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,mCAA2B;QACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,oBAAoB,CAAC,CAAC;YAChF,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,oBAAoB,CAAC,CAAC;YAChF,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;YACrC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,eAAe,EAAE,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI;SAC9I,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,aAAa,CAAC,CAAC;YAC3D,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,oBAAoB,CAAC,CAAC;YAChF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClJ,QAAQ,EAAE,OAAO;SAClB,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,IAAI,cAAc,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC;QAC3H,wBAAwB,EAAE,KAAK;KAChC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;AAsGA,wBAwBC;AA9HD,MAAM,EAAE,2BAA2B,EAAE,GAAG,OAAO,CAAC,6BAA6B,CAA4D,CAAC;AAC1I,MAAM,EAAE,wBAAwB,EAAE,GAAG,OAAO,CAAC,6BAA6B,CAAqE,CAAC;AAChJ,8EAAwD;AAGxD,MAAM,kBAAkB,GAAG,4BAAoB,CAAC,MAAoD,CAAC;AACrG,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAsC,CAAC;AAE3O,QAAA,2BAA2B,GAAG,8BAAuC,CAAC;AAqEnF,SAAS,SAAS,CAAC,KAAmD;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5H,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA2D;IACrF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,IAAI,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;IAClG,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,QAAiB;QACzB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;KACnC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAyC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,KAAK,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;QAC3F,eAAe,EAAE,KAAK,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;QACjG,UAAU,EAAE,KAAK,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QAClF,cAAc,EAAE,KAAK,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;QAC9F,cAAc,EAAE,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC;QACzD,UAAU,EAAE,KAAK,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,KAAK;KAC7H,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,MAAM,CAAC,UAAsC,EAAE;IAC7D,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,QAAQ;QACd,aAAa,EAAE,wBAAwB,CAAC,OAAO,CAAC,aAAa,CAAC;QAC9D,OAAO,EAAE,mCAA2B;QACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,oBAAoB,CAAC,CAAC;YAChF,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,oBAAoB,CAAC,CAAC;YAChF,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;YACrC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,eAAe,EAAE,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI;SAC9I,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,YAAY,EAAE,2BAA2B,CAAC,OAAO,CAAC,YAAY,CAAC;YAC/D,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,aAAa,CAAC,CAAC;YAC3D,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,oBAAoB,CAAC,CAAC;YAChF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClJ,QAAQ,EAAE,OAAO;SAClB,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,IAAI,cAAc,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC;QAC3H,wBAAwB,EAAE,KAAK;KAChC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-compute/provider-fastly",
-  "version": "1.0.0-beta.4",
+  "version": "1.0.0-beta.6",
   "license": "Apache-2.0",
   "engines": {
     "node": "^22.14.0 || ^24.0.0"
@@ -59,15 +59,15 @@
     }
   },
   "dependencies": {
-    "@pulse-compute/crypto": "1.0.0-beta.4",
-    "@pulse-compute/jwt": "1.0.0-beta.4",
-    "@pulse-compute/runtime": "1.0.0-beta.4",
-    "@pulse-compute/s3": "1.0.0-beta.4",
-    "@pulse-compute/wasm-build-support": "1.0.0-beta.4",
-    "@pulse-compute/wasm-contracts": "1.0.0-beta.4",
-    "@pulse-compute/wasm-guest-link": "1.0.0-beta.4",
-    "@pulse-compute/wasm-host-runtime": "1.0.0-beta.4",
-    "@pulse-compute/wasm-runtime-core-as": "1.0.0-beta.4",
+    "@pulse-compute/crypto": "1.0.0-beta.6",
+    "@pulse-compute/jwt": "1.0.0-beta.6",
+    "@pulse-compute/runtime": "1.0.0-beta.6",
+    "@pulse-compute/s3": "1.0.0-beta.6",
+    "@pulse-compute/wasm-build-support": "1.0.0-beta.6",
+    "@pulse-compute/wasm-contracts": "1.0.0-beta.6",
+    "@pulse-compute/wasm-guest-link": "1.0.0-beta.6",
+    "@pulse-compute/wasm-host-runtime": "1.0.0-beta.6",
+    "@pulse-compute/wasm-runtime-core-as": "1.0.0-beta.6",
     "esbuild": "0.28.1"
   },
   "types": "./dist/index.d.ts",
@@ -87,7 +87,7 @@
     "url": "git+https://github.com/pulse-compute/pulse.git",
     "directory": "packages/provider-fastly"
   },
-  "homepage": "https://pulsecompute.io/v1.0.0-beta.4/packages/provider-fastly/",
+  "homepage": "https://pulsecompute.io/v1.0.0-beta.6/packages/provider-fastly/",
   "bugs": {
     "url": "https://github.com/pulse-compute/pulse/issues"
   },

package/src/build/canonical-target.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const crypto = require('node:crypto');
+const { normalizeFastlyMaxWasmBytes, assertFastlyWasmBudget } = require('./wasm-budget.js');
 const fs = require('node:fs');
 const path = require('node:path');
 const { CANONICAL_NATIVE_PLAN_VERSION } = require('@pulse-compute/wasm-contracts/handler/canonical-native-plan');
@@ -222,6 +223,8 @@ function inspectFastlyCanonicalTarget(options = {}) {
   }
   const providerConfig = options.providerConfig || {};
   const bindings = options.bindings || providerConfig.bindings || {};
+  const maxWasmBytes = normalizeFastlyMaxWasmBytes(providerConfig.build?.maxWasmBytes);
+  if (isFastlyNativeArtifact(options.native)) assertFastlyWasmBudget(options.native.wasm.length, maxWasmBytes);
   const native = isFastlyNativeArtifact(options.native)
     ? assertExactProviderNative(options.native)
     : compileFastlyNativePlatformCapabilitiesPlan(plan, {
@@ -229,6 +232,8 @@ function inspectFastlyCanonicalTarget(options = {}) {
         projectRoot: options.projectRoot,
         profile: options.profile,
         bindings,
+        maxDurationMs: providerConfig.maxDurationMs,
+        maxWasmBytes,
         requirePlatformCapability: false,
         canonicalBuild: true,
         targetDescriptor: options.targetDescriptor,
@@ -239,8 +244,13 @@ function inspectFastlyCanonicalTarget(options = {}) {
           || (options.native && options.native.guestUnits),
         nativeOptimization: options.nativeOptimization
           || (options.experimentalNativeSize === true ? 'experimental-native-size' : undefined),
+        emitWat: options.emitWat,
         timeoutMs: options.compileTimeoutMs
       });
+  const duration = require('@pulse-compute/runtime/host').normalizeRequestDuration(providerConfig.maxDurationMs);
+  if (native.manifest.bindings?.maxDurationMs !== duration) {
+    throw providerBuildError('PULSE_REQUEST_DURATION_ARTIFACT_MISMATCH', 'Fastly artifact request deadline does not match the selected provider profile.');
+  }
   return Object.freeze({
     target: FASTLY_CANONICAL_TARGET,
     provider: 'fastly',
@@ -287,6 +297,8 @@ function writeFastlyCanonicalTarget(options = {}) {
   fs.mkdirSync(binDir, { recursive: true });
 
   let native;
+  const maxWasmBytes = normalizeFastlyMaxWasmBytes(providerConfig.build?.maxWasmBytes);
+  if (isFastlyNativeArtifact(options.native)) assertFastlyWasmBudget(options.native.wasm.length, maxWasmBytes);
   const auditedNative = isFastlyNativeArtifact(options.native)
     ? assertExactProviderNative(options.native)
     : null;
@@ -308,6 +320,7 @@ function writeFastlyCanonicalTarget(options = {}) {
         || (options.native && options.native.guestUnits),
       nativeOptimization: options.nativeOptimization
         || (options.experimentalNativeSize === true ? 'experimental-native-size' : undefined),
+      emitWat: options.emitWat,
       compileTimeoutMs: options.compileTimeoutMs
     });
     native = realization.native;
@@ -373,7 +386,7 @@ function writeFastlyCanonicalTarget(options = {}) {
     }),
     optimization: native.manifest.optimization,
     wasm: Object.freeze({ file: 'bin/main.wasm', ...native.manifest.wasm }),
-    wat: Object.freeze({ file: 'bin/main.wat', ...native.manifest.wat }),
+    wat: Object.freeze({ file: written.watFile ? 'bin/main.wat' : null, ...native.manifest.wat }),
     imports: native.manifest.imports,
     importModules: native.manifest.importModules,
     exports: native.manifest.exports,
@@ -402,7 +415,7 @@ function writeFastlyCanonicalTarget(options = {}) {
       localEntry: 'fastly-entry.cjs',
       sourceEntry: 'src/main.as.ts',
       wasm: 'bin/main.wasm',
-      wat: 'bin/main.wat',
+      wat: written.watFile ? 'bin/main.wat' : null,
       nativePlan: 'fastly-native-plan.json',
       nativeManifest: 'fastly-native-manifest.json',
       fastlyToml: 'fastly.toml',

package/src/build/digest-native.js

@@ -0,0 +1,25 @@
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+function digestNativeSource(plan) {
+  if (!plan.effects.some(effect => effect.kind === 'crypto.digestText')) return '';
+  const selected = plan.crypto?.algorithms.find(entry => entry.algorithm === 'SHA-256');
+  if (!selected || selected.realization !== 'guest-source:pulse-hmac-as' || selected.automaticFallback !== false) throw new TypeError('Digest requires the selected Crypto SHA-256 guest source.');
+  const root = path.dirname(require.resolve('@pulse-compute/crypto/pulsewasm-native'));
+  return fs.readFileSync(path.join(root, 'as/digest-text.as.ts'), 'utf8') + `
+function __pulse_fastly_digest_begin(index: i32, outer: __PulseFastlyValue): void {
+  const payload = __pulse_fastly_value(__pulse_fastly_payload_field(outer, 'invocation'))
+  const text = __pulse_fastly_value(__pulse_fastly_payload_field(payload, 'text'))
+  const digest = __pulse_crypto_digest_text(text.kind == PULSE_VALUE_STRING ? text.text : null)
+  if (text.kind == PULSE_VALUE_STRING) __pulse_fastly_remember_secret(text.text)
+  const result = host_value_object()
+  host_value_object_set(result, __pulse_fastly_string_value('status'), __pulse_fastly_string_value(digest.status))
+  if (digest.status == 'ok') {
+    host_value_object_set(result, __pulse_fastly_string_value('sha256'), __pulse_fastly_string_value(digest.sha256))
+    host_value_object_set(result, __pulse_fastly_string_value('byteLength'), host_value_number(f64(digest.byteLength)))
+  } else host_value_object_set(result, __pulse_fastly_string_value('reason'), __pulse_fastly_string_value(digest.reason))
+  __pulse_fastly_ready_effect(index, result)
+}
+`;
+}
+module.exports = { digestNativeSource };

package/src/build/effect-invocations.js

@@ -0,0 +1,49 @@
+'use strict';
+
+const { CANONICAL_EFFECT_INVOCATION_POLICY } = require('@pulse-compute/wasm-contracts/handler/canonical-runtime');
+
+function runtimeSource(options = {}) {
+  return `
+const PULSE_FASTLY_MAX_EFFECT_INVOCATIONS: i32 = ${CANONICAL_EFFECT_INVOCATION_POLICY.defaultMaxEffects}
+let __pulse_invocation_count: i32 = 0
+let __pulse_invocation_started: bool = false
+let __pulse_invocation_closed: bool = false
+let __pulse_invocation_failure: i32 = 171
+const __pulse_invocation_tickets = new StaticArray<i32>(PULSE_FASTLY_EFFECT_COUNT)
+function __pulse_invocation_begin(index: i32): bool {
+  if (__pulse_invocation_closed || index < 0 || index >= PULSE_FASTLY_EFFECT_COUNT
+    || unchecked(__pulse_invocation_tickets[index]) != 0) {
+    __pulse_fastly_fail(PULSE_ERROR_STATE, __pulse_invocation_failure, index); return false
+  }
+  if (__pulse_invocation_count >= PULSE_FASTLY_MAX_EFFECT_INVOCATIONS) {
+    __pulse_invocation_closed = true
+    __pulse_invocation_failure = 170
+    __pulse_fastly_fail(PULSE_ERROR_STATE, 170, index); return false
+  }
+  unchecked(__pulse_invocation_tickets[index] = ++__pulse_invocation_count)
+  return true
+}
+function __pulse_invocation_settle(index: i32, ticket: i32, result: i32): i32 {
+  if (__pulse_invocation_closed || index < 0 || index >= PULSE_FASTLY_EFFECT_COUNT
+    || ticket <= 0 || unchecked(__pulse_invocation_tickets[index]) != ticket) {
+    __pulse_fastly_fail(PULSE_ERROR_STATE, __pulse_invocation_failure, index); return 0
+  }
+  unchecked(__pulse_invocation_tickets[index] = 0)
+  return ${options.packageCompletion ? "result == 0 ? pulse_package_set_effect_failure(index) : pulse_set_effect_result(index, result)" : "pulse_set_effect_result(index, result)"}
+}
+function __pulse_invocation_close(): void {
+  __pulse_invocation_closed = true
+  for (let i = 0; i < PULSE_FASTLY_EFFECT_COUNT; i += 1) unchecked(__pulse_invocation_tickets[i] = 0)
+}
+`;
+}
+
+function instrument(source) {
+  const signature = 'function host_effect_begin(effectIndex: i32, payload: i32): void {';
+  if (!source.includes(signature)) throw new Error('Fastly invocation admission boundary drift.');
+  // Every guest-requested slot gets a ticket, including a group member suppressed
+  // by an earlier application error. Its undefined result can then be drained.
+  return source.replace(signature, signature + '\n  if (!__pulse_invocation_begin(effectIndex)) return;');
+}
+
+module.exports = { runtimeSource, instrument, policy: CANONICAL_EFFECT_INVOCATION_POLICY };

package/src/build/embedded-assets.as.ts

@@ -0,0 +1,32 @@
+function __pulse_embedded_request_header(name: string): string | null {
+  const values = __pulse_request_header_list(name, false);
+  return values.length ? values.join(', ') : null;
+}
+function __pulse_embedded_field(payload: __PulseFastlyValue, name: string): string { return __pulse_fastly_string(__pulse_fastly_payload_field(payload, name)); }
+function __pulse_fastly_embedded_asset(payload: __PulseFastlyValue): i32 {
+  // Avoid exposing provider buffers as canonical application values.
+  const length = __pulse_fastly_value(__pulse_fastly_payload_field(payload, 'embeddedFound')).boolean != 0 ? i32(__pulse_fastly_number(__pulse_fastly_payload_field(payload, 'embeddedLength'))) : -1;
+  const etag = __pulse_embedded_field(payload, 'embeddedEtag'), method = __pulse_embedded_field(payload, 'method');
+  const selected = __pulse_embedded_selection(length, method, etag,
+    __pulse_embedded_request_header('if-none-match'), __pulse_embedded_request_header('range'), __pulse_embedded_request_header('if-range'));
+  if (__pulse_request_headers_failed) return 0;
+  const output = new __PulseFastlyValue(); output.kind = PULSE_VALUE_RESPONSE; output.status = selected.status;
+  if (selected.status != 400 && selected.status != 404) {
+    output.headers.push(new __PulseFastlyHeader('content-type', __pulse_embedded_field(payload, 'embeddedType')));
+    output.headers.push(new __PulseFastlyHeader('etag', etag)); output.headers.push(new __PulseFastlyHeader('accept-ranges', 'bytes'));
+    if (selected.contentRange.length) output.headers.push(new __PulseFastlyHeader('content-range', selected.contentRange));
+    if (selected.status == 200 || selected.status == 206) {
+      output.headers.push(new __PulseFastlyHeader('content-length', max<i32>(0, selected.end - selected.start + 1).toString()));
+      if (method != 'HEAD') output.binaryBody = __pulse_embedded_bytes(__pulse_embedded_field(payload, 'embeddedData'), selected.start, selected.end);
+    }
+  }
+  return __pulse_fastly_put(output);
+}
+function __pulse_fastly_write_binary(handle: i32, data: Uint8Array): i32 {
+  const written = new StaticArray<i32>(1); let offset = 0;
+  while (offset < data.length) {
+    if (fastly_http_body_write(handle, data.dataStart + offset, data.length - offset, 0, changetype<usize>(written)) != 0 || written[0] <= 0 || written[0] > data.length - offset) return 1;
+    offset += written[0];
+  }
+  return 0;
+}

package/src/build/kv-native.as.ts

@@ -80,35 +80,40 @@ function __kv_number(value: f64): string {
   // Count the portable serialized value budget, including this boundary case.
   return text.endsWith('.0') ? text.substring(0, text.length - 2) : text;
 }
-function __kv_private(text: string): void {
+// Return the same quoted form registered for redaction so validation and writes
+// do not allocate and scan a second representation of each string or key.
+function __kv_private(text: string): string {
   __pulse_fastly_remember_secret(text);
   const encoded = __pulse_fastly_quote(text);
   __pulse_fastly_remember_secret(encoded.substring(1, encoded.length - 1));
+  return encoded;
 }
 class __KvEncoder {
   reason: string = ''; entries: i32 = 0; bytes: i32 = 0;
-  seen: Set<i32> = new Set<i32>(); parts: Array<string> = new Array<string>();
-  add(text: string): void { this.bytes += String.UTF8.byteLength(text); if (this.bytes > __KV_valueBytes) this.reason = 'too-large'; else this.parts.push(text); }
+  seen: Set<i32> = new Set<i32>(); parts: Array<string> | null;
+  // Reads need the same validation and redaction walk, but no serialized output.
+  constructor(materialize: bool = true) { this.parts = materialize ? new Array<string>() : null; }
+  add(text: string): void { this.bytes += String.UTF8.byteLength(text); if (this.bytes > __KV_valueBytes) this.reason = 'too-large'; else if (this.parts !== null) this.parts!.push(text); }
   visit(handle: i32, depth: i32 = 0): void {
     if (this.reason.length) return;
     if (++this.entries > __KV_entries || depth > __KV_depth) { this.reason = 'too-large'; return; }
     const value = __pulse_fastly_value(handle);
     if (value.kind == PULSE_VALUE_NULL) this.add('null');
     else if (value.kind == PULSE_VALUE_BOOLEAN) this.add(value.boolean ? 'true' : 'false');
-    else if (value.kind == PULSE_VALUE_STRING) { __kv_private(value.text); this.add(__pulse_fastly_quote(value.text)); }
+    else if (value.kind == PULSE_VALUE_STRING) this.add(__kv_private(value.text));
     else if (value.kind == PULSE_VALUE_NUMBER) { if (!isFinite(value.number)) this.reason = 'invalid-value'; else this.add(value.number == 0 ? '0' : __kv_number(value.number)); }
     else if (value.kind == PULSE_VALUE_ARRAY || value.kind == PULSE_VALUE_OBJECT) {
       if (this.seen.has(handle)) { this.reason = 'invalid-value'; return; } this.seen.add(handle);
       const object = value.kind == PULSE_VALUE_OBJECT; this.add(object ? '{' : '[');
       for (let i = 0; i < value.values.length && !this.reason.length; i++) {
         if (i) this.add(',');
-        if (object) { __kv_private(value.keys[i]); this.add(__pulse_fastly_quote(value.keys[i]) + ':'); }
+        if (object) this.add(__kv_private(value.keys[i]) + ':');
         this.visit(value.values[i], depth + 1);
       }
       this.add(object ? '}' : ']');
     } else this.reason = 'invalid-value';
   }
-  encode(handle: i32): string { this.visit(handle); return this.reason.length ? '' : this.parts.join(''); }
+  encode(handle: i32): string { this.visit(handle); return this.reason.length ? '' : this.parts!.join(''); }
 }
 function __pulse_fastly_kv_conditional_begin(index: i32, payload: __PulseFastlyValue): void {
   __kv_dispatched[index] = false;
@@ -171,8 +176,13 @@ function __kv_utf8(data: Uint8Array, length: i32): bool {
   }
   return true;
 }
+// Each read is synchronous through owned-string decoding and parsing. Parallel
+// effects enter their waits serially; no result or pending hostcall owns this
+// scratch buffer. Only the written prefix is inspected, including after errors.
+@lazy let __kv_read_buffer: Uint8Array | null = null;
 function __kv_read(index: i32, body: i32, generation: u64): i32 {
-  const buffer = new Uint8Array(__KV_wireBytes + 1), written = new StaticArray<i32>(1); let count = 0;
+  if (__kv_read_buffer === null) __kv_read_buffer = new Uint8Array(__KV_wireBytes + 1);
+  const buffer = __kv_read_buffer!, written = new StaticArray<i32>(1); let count = 0;
   while (true) {
     const ready = __kv_ready(index, body); if (ready <= 0) return __kv_ready_failure(index, ready);
     written[0] = 0;
@@ -188,7 +198,7 @@ function __kv_read(index: i32, body: i32, generation: u64): i32 {
   if (outer.kind != PULSE_VALUE_OBJECT || outer.keys.length != 2 || __pulse_fastly_find(outer, '__pulseKv') < 0 || __pulse_fastly_find(outer, 'value') < 0) return __kv_failure(index, 'protocol');
   const marker = __pulse_fastly_value(__pulse_fastly_payload_field(outer, '__pulseKv'));
   if (marker.kind != PULSE_VALUE_NUMBER || marker.number != 1) return __kv_failure(index, 'protocol');
-  const value = __pulse_fastly_payload_field(outer, 'value'), encoder = new __KvEncoder(); encoder.encode(value);
+  const value = __pulse_fastly_payload_field(outer, 'value'), encoder = new __KvEncoder(false); encoder.visit(value);
   if (encoder.reason.length) return __kv_failure(index, encoder.reason);
   const remaining = __kv_remaining(index); if (remaining <= 0) return __kv_failure(index, remaining == 0 ? 'timeout' : 'unavailable');
   const result = __kv_result('found'), token = __kv_token(generation); __kv_private(token);

package/src/build/native-application-errors.js

@@ -0,0 +1,140 @@
+'use strict';
+
+function enabled(plan) {
+  return (plan.routing?.entries || []).some(entry => entry.kind === 'error');
+}
+
+// Capture provider diagnostics before clearing them. A failed continuation is
+// drained once; only its application data error can enter the next Router lane.
+function runtimeSource(plan) {
+  const jwt = ['TOKEN_REQUIRED', 'BEARER_INVALID', 'MALFORMED', 'LIMIT_EXCEEDED',
+    'ALGORITHM_NOT_ALLOWED', 'KEY_INVALID', 'SIGNATURE_INVALID', 'CLOCK_INVALID',
+    'CLAIMS_INVALID', 'CLAIMS_SCHEMA_INVALID'];
+  return `
+let __pulse_application_schema: i32 = 0
+let __pulse_application_failed_schema: i32 = 0
+function __pulse_application_code(): string {
+  if (__pulse_fastly_last_error == PULSE_ERROR_REQUEST_BODY)
+    return __pulse_fastly_error_stage == 21 ? "PULSE_BODY_TOO_LARGE" : "PULSE_REQUEST_BODY_INVALID_UTF8"
+  if (__pulse_fastly_jwt_error > 0) {
+    if (__pulse_fastly_last_error != PULSE_ERROR_JWT
+      && !(__pulse_fastly_last_error == PULSE_ERROR_SCHEMA && __pulse_fastly_jwt_error == 10)) return ""
+    switch (__pulse_fastly_jwt_error) {
+${jwt.map((code, i) => `      case ${i + 1}: return "PULSE_JWT_${code}"`).join('\n')}
+      default: return ""
+    }
+  }
+  if (__pulse_application_failed_schema == 0) return ""
+  if (__pulse_fastly_last_error == PULSE_ERROR_JSON) return "PULSE_SCHEMA_JSON_MALFORMED"
+  if (__pulse_fastly_last_error != PULSE_ERROR_SCHEMA) return ""
+  if (__pulse_fastly_error_stage == 21) return "PULSE_BODY_TOO_LARGE"
+  if (__pulse_fastly_error_stage == 44) return "PULSE_SCHEMA_CONTENT_TYPE"
+  // Stages 56/57 reject ScalarRecord and bounded nested JSON data.
+  // Stage 55 remains a fatal schema-ID/configuration error.
+  if ((__pulse_fastly_error_stage >= 50 && __pulse_fastly_error_stage <= 54)
+    || __pulse_fastly_error_stage == 56 || __pulse_fastly_error_stage == 57)
+    return __pulse_application_failed_schema == 2 ? "PULSE_SCHEMA_ENCODE" : "PULSE_SCHEMA_DECODE"
+  return ""
+}
+function __pulse_application_clear(): void {
+  __pulse_fastly_last_error = 0; __pulse_fastly_error_stage = 0; __pulse_fastly_error_effect = -1
+  __pulse_fastly_jwt_error = 0; __pulse_application_failed_schema = 0
+}
+${(plan?.effects || []).length > 0 ? settlementSource() : ''}
+function host_router_error_take(): i32 {
+  if (__pulse_fastly_last_error == 0) return 0
+  const code = __pulse_application_code()
+  if (code.length == 0) return -1
+  // Never abandon a dispatched sibling to run application recovery.
+  for (let i = 0; i < PULSE_FASTLY_EFFECT_COUNT; i += 1)
+    if (unchecked(__pulse_fastly_pending_mode[i]) != PULSE_FASTLY_PENDING_NONE) return 0
+  __pulse_application_clear()
+  const error = host_value_object()
+  host_value_object_set(error, __pulse_fastly_string_value("code"), __pulse_fastly_string_value(code))
+  host_value_object_set(error, __pulse_fastly_string_value("name"), __pulse_fastly_string_value("PulseApplicationError"))
+  host_value_object_set(error, __pulse_fastly_string_value("message"), __pulse_fastly_string_value("Pulse application data validation failed."))
+  return error
+}
+`;
+}
+
+// The caller retains the static pending-slot guards. The shared body owns one
+// site's resolution and authenticated settlement; diagnostics carry the saved
+// failure between calls without allocating an accumulator or merging slot state.
+function settlementSource() {
+  return `
+// Returns 0 for recoverable/no failure, 1 for fatal, -1 for rejected settlement.
+function __pulse_application_settle_effect(index: i32, fatal: bool): i32 {
+  let failure = __pulse_fastly_last_error
+  let stage = __pulse_fastly_error_stage
+  let effect = __pulse_fastly_error_effect
+  let jwt = __pulse_fastly_jwt_error
+  let schema = __pulse_application_failed_schema
+  const invocation = unchecked(__pulse_invocation_tickets[index])
+  __pulse_application_clear()
+  let result = host_value_undefined()
+  if (unchecked(__pulse_fastly_pending_mode[index]) != PULSE_FASTLY_PENDING_NONE) {
+    result = __pulse_fastly_resolve_effect(index)
+    if (result <= 0 && __pulse_fastly_last_error == 0) __pulse_fastly_fail(PULSE_ERROR_STATE, 101, index)
+  } else if (failure == 0) __pulse_fastly_fail(PULSE_ERROR_STATE, 101, index)
+  if (__pulse_fastly_last_error != 0) {
+    const terminal = __pulse_application_code().length == 0
+    if (failure == 0 || (!fatal && terminal)) {
+      failure = __pulse_fastly_last_error; stage = __pulse_fastly_error_stage; effect = __pulse_fastly_error_effect
+      jwt = __pulse_fastly_jwt_error; schema = __pulse_application_failed_schema; fatal = terminal
+    }
+    __pulse_application_clear()
+    result = host_value_undefined()
+  }
+  if (__pulse_invocation_settle(index, invocation, result) != 1) {
+    __pulse_fastly_fail(PULSE_ERROR_STATE, 101, index); __pulse_fastly_jwt_send_error(); return -1
+  }
+  __pulse_fastly_last_error = failure; __pulse_fastly_error_stage = stage; __pulse_fastly_error_effect = effect
+  __pulse_fastly_jwt_error = jwt; __pulse_application_failed_schema = schema
+  return fatal ? 1 : 0
+}
+`;
+}
+
+// Preserve the fatal-return boundary consumed by request-budget instrumentation.
+function driverLoop(plan) {
+  return `  while (runStatus == 1) {
+    let fatal = __pulse_fastly_last_error != 0 && __pulse_application_code().length == 0
+${(plan.effects || []).map((_, index) => `    if (__pulse_effect_pending_${index} != 0) {
+      const settled = __pulse_application_settle_effect(${index}, fatal)
+      if (settled < 0) return
+      fatal = settled != 0
+    }`).join('\n')}
+    if (fatal) return
+    runStatus = pulse_resume()
+  }`;
+}
+
+function instrument(source) {
+  // The input is compiler-owned AS with simple, typed host signatures. Keep
+  // failure suppression on all imports so a failed expression has no effects.
+  source = source.replace(/function (host_\w+)\(([^)]*)\): (i32|void) \{/g,
+    (declaration, name, _args, result) => name === 'host_router_error_take' ? declaration
+      : `${declaration} if (__pulse_fastly_last_error != 0) return${result === 'void' ? '' : ' 0'};`);
+  const wrappers = [
+    ['host_request_json', 'schema: i32', 'schema', '1'],
+    ['host_schema_decode', 'text: i32, schema: i32', 'text, schema', '1'],
+    ['host_schema_encode', 'value: i32, schema: i32', 'value, schema', '2'],
+    ['host_fetch_json', 'responseHandle: i32, schemaHandle: i32', 'responseHandle, schemaHandle', '1'],
+    ['host_response_json', 'value: i32, options: i32', 'value, options', '2'],
+    ['__pulse_fastly_schema_apply', 'schemaId: string, valueHandle: i32, encode: bool', 'schemaId, valueHandle, encode', 'encode ? 2 : 1']
+  ];
+  for (const [name, params, args, mode] of wrappers) {
+    source = source.replace(`function ${name}(`, `function __pulse_application_impl_${name}(`);
+    source += `\nfunction ${name}(${params}): i32 {
+  const previous = __pulse_application_schema; __pulse_application_schema = ${mode}
+  const result = __pulse_application_impl_${name}(${args})
+  __pulse_application_schema = previous
+  return result
+}\n`;
+  }
+  source = source.replace('__pulse_fastly_last_error = code;', '__pulse_application_failed_schema = __pulse_application_schema; __pulse_fastly_last_error = code;');
+  return source;
+}
+
+module.exports = Object.freeze({ enabled, runtimeSource, driverLoop, instrument });