@pulse-compute/provider-fastly 1.0.0-beta.4 → 1.0.0-beta.6

package/src/build/s3-native.as.ts

@@ -10,6 +10,7 @@
 @external('fastly_http_resp', 'header_values_get') declare function __s3_header_values(response: i32, name: usize, length: i32, buffer: usize, size: i32, cursor: i32, end: usize, written: usize): i32
 
 class __PulseS3Binding {
+  method: string = ''; range: string = ''; ifNoneMatch: string = '';
   contentType: string = ''; endpoint: string = ''; bucket: string = ''; region: string = ''; backend: string = '';
   id: string = ''; secret: string = ''; token: string = ''; max: i32 = 32768; timeout: i32 = 10000;
 }
@@ -35,6 +36,7 @@ function __s3_result(status: string, reason: string = '', http: i32 = 0): i32 {
   return result;
 }
 function __s3_failure(index: i32, reason: string, http: i32 = 0): i32 {
+  if (__pulse_fastly_effect_kind(index) == 21) return __s3_body_failure(reason);
   return __s3_result(__pulse_fastly_effect_kind(index) == 14 ? (__s3_dispatched[index] ? 'unknown' : 'not-stored') : 'failed', reason, http);
 }
 function __s3_fail(index: i32, reason: string): void { __pulse_fastly_ready_effect(index, __s3_failure(index, reason)) }
@@ -71,7 +73,9 @@ function __pulse_fastly_s3_begin(index: i32, outer: __PulseFastlyValue): void {
   let data = new Uint8Array(0);
   if (put) {
     const text = __pulse_fastly_value(__pulse_fastly_payload_field(payload, 'text'));
-    if (text.kind != PULSE_VALUE_STRING || !__pulse_s3_scalar(text.text)) { __s3_fail(index, 'invalid-text'); return; }
+    if (text.kind != PULSE_VALUE_STRING) { __s3_fail(index, 'invalid-text'); return; }
+    if (text.text.length > binding.max) { __s3_fail(index, 'too-large'); return; }
+    if (!__pulse_s3_scalar(text.text)) { __s3_fail(index, 'invalid-text'); return; }
     data = __pulse_s3_bytes(text.text);
     if (data.length > binding.max) { __s3_fail(index, 'too-large'); return; }
     __pulse_fastly_remember_secret(text.text);
@@ -82,10 +86,10 @@ function __pulse_fastly_s3_begin(index: i32, outer: __PulseFastlyValue): void {
   const token = binding.token.length ? __s3_secret(store[0], binding.token) : '';
   if (__s3_remaining(index) == 0) { __s3_fail(index, 'timeout'); return; }
   if (id === null || secret === null || token === null || !__pulse_s3_credentials(id, secret, token)) { __s3_fail(index, 'credentials'); return; }
-  const method = put ? 'PUT' : __pulse_fastly_effect_kind(index) == 12 ? 'HEAD' : 'GET', path = '/' + binding.bucket + '/' + encoded;
+  const method = binding.method.length ? binding.method : put ? 'PUT' : __pulse_fastly_effect_kind(index) == 12 ? 'HEAD' : 'GET', path = '/' + binding.bucket + '/' + encoded;
   const now = __s3_clock(0);
   if (now < 0 || !__pulse_s3_date(now / 1000000000).length) { __s3_fail(index, 'configuration'); return; }
-  const signature = __pulse_s3_sign(method, path, binding.endpoint.slice(8), binding.region, id, secret, token, now / 1000000000, data, binding.contentType);
+  const signature = __pulse_s3_sign(method, path, binding.endpoint.slice(8), binding.region, id, secret, token, now / 1000000000, data, binding.contentType, binding.range, binding.ifNoneMatch);
   __s3_sent_bytes[index] = data.length; __s3_digests[index] = signature.digest;
   __pulse_fastly_remember_secret(signature.digest);
   __pulse_fastly_remember_secret(signature.authorization); __pulse_fastly_remember_secret(binding.endpoint + path);
@@ -98,6 +102,8 @@ function __pulse_fastly_s3_begin(index: i32, outer: __PulseFastlyValue): void {
     && __s3_header(req, 'host', binding.endpoint.slice(8)) && __s3_header(req, 'x-amz-date', signature.date)
     && __s3_header(req, 'x-amz-content-sha256', signature.digest) && __s3_header(req, 'authorization', signature.authorization)
     && __s3_header(req, 'accept-encoding', 'identity');
+  if (ok && binding.range.length) ok = __s3_header(req, 'range', binding.range);
+  if (ok && binding.ifNoneMatch.length) ok = __s3_header(req, 'if-none-match', binding.ifNoneMatch);
   if (ok && put) ok = __s3_header(req, 'content-type', binding.contentType) && __s3_header(req, 'content-length', data.length.toString());
   if (ok && token.length) ok = __s3_header(req, 'x-amz-security-token', token);
   if (!ok || fastly_http_body_new(changetype<usize>(body)) != 0) { __s3_close_req(req); __s3_fail(index, 'transport'); return; }
@@ -133,6 +139,7 @@ function __s3_list(buffer: Uint8Array, size: i32): Array<string> | null {
   return result;
 }
 function __s3_read_response(index: i32, response: i32, body: i32, status: i32): i32 {
+  if (__pulse_fastly_effect_kind(index) == 21) return __s3_body_response(index, response, body, status);
   const put = __pulse_fastly_effect_kind(index) == 14;
   const rejected = put && status >= 400 && status <= 499 && status != 408;
   if (!put && status == 404) return __s3_result('not-found');
@@ -211,5 +218,6 @@ function __pulse_fastly_s3_wait(index: i32): i32 {
   let result: i32;
   if (fastly_http_resp_status_get(response[0], changetype<usize>(code)) != 0) result = __s3_failure(index, 'protocol');
   else result = __s3_remaining(index) == 0 ? __s3_failure(index, 'timeout', code[0]) : __s3_read_response(index, response[0], body[0], code[0]);
-  __s3_close_body(body[0]); __s3_close_resp(response[0]); return result;
+  if (!__pulse_fastly_value(result).s3Body) __s3_close_body(body[0]);
+  __s3_close_resp(response[0]); return result;
 }

package/src/build/s3-native.js

@@ -21,10 +21,10 @@ function s3NativeSource(plan, bindings) {
   const lines = ['function __pulse_fastly_s3_binding(index: i32): __PulseS3Binding {', 'const value = new __PulseS3Binding();', 'switch (index) {'];
   for (const binding of bindings.s3) {
     lines.push(`case ${binding.index}:`);
-    for (const [field, input] of Object.entries({ contentType: 'contentType', endpoint: 'endpoint', bucket: 'bucket', region: 'region', backend: 'backend', id: 'accessKeyIdSecret', secret: 'secretAccessKeySecret', token: 'sessionTokenSecret' })) lines.push(`value.${field} = ${JSON.stringify(binding[input] || '')};`);
+    for (const [field, input] of Object.entries({ method: 'method', range: 'range', ifNoneMatch: 'ifNoneMatch', contentType: 'contentType', endpoint: 'endpoint', bucket: 'bucket', region: 'region', backend: 'backend', id: 'accessKeyIdSecret', secret: 'secretAccessKeySecret', token: 'sessionTokenSecret' })) lines.push(`value.${field} = ${JSON.stringify(binding[input] || '')};`);
     lines.push(`value.max = ${binding.maxTextBytes}; value.timeout = ${binding.timeoutMs}; break;`);
   }
   lines.push('default: unreachable();', '}', 'return value;', '}');
-  return [contribution.source, fs.readFileSync(path.join(__dirname, 's3-native.as.ts'), 'utf8'), lines.join('\n')].join('\n');
+  return [contribution.source, fs.readFileSync(path.join(__dirname, 's3-native.as.ts'), 'utf8'), fs.readFileSync(path.join(__dirname, 's3-body.as.ts'), 'utf8'), lines.join('\n')].join('\n');
 }
 module.exports = { S3_IMPORTS, s3NativeSource };

package/src/build/schema-admission.js

@@ -0,0 +1,83 @@
+'use strict';
+
+const { schemaAdmission } = require('@pulse-compute/wasm-runtime-core-as/compiler');
+
+function fastlyJsonValueAdmissionSource() {
+  return `
+class __PulseFastlyAdmissionFrame {
+  index: i32 = 0
+  constructor(public handle: i32) {}
+}
+function __pulse_fastly_admission_enter(handle: i32, budget: __PulseJsonAdmissionBudget,
+  stack: Array<__PulseFastlyAdmissionFrame>, active: Set<i32>): bool {
+  if (handle <= 0 || handle > __pulse_fastly_values.length) return budget.fail(12)
+  const value = __pulse_fastly_values[handle - 1]
+  const array = value.kind == PULSE_VALUE_ARRAY
+  const object = value.kind == PULSE_VALUE_OBJECT
+  if (!budget.node(stack.length + (array || object ? 1 : 0))) return false
+  if (value.kind == PULSE_VALUE_NULL) return budget.addBytes(4)
+  if (value.kind == PULSE_VALUE_BOOLEAN) return budget.addBytes(value.boolean != 0 ? 4 : 5)
+  if (value.kind == PULSE_VALUE_NUMBER) return isFinite(value.number) ? budget.addBytes(24) : budget.fail(11)
+  if (value.kind == PULSE_VALUE_STRING) return budget.stringBytes(value.text, false)
+  if (!array && !object) return budget.fail(12)
+  if (active.has(handle)) return budget.fail(13)
+  if (array && value.values.length > budget.limits.maxArrayItems) return budget.fail(6)
+  if (object && value.keys.length > budget.limits.maxObjectMembers) return budget.fail(5)
+  if (object && value.keys.length != value.values.length) return budget.fail(12)
+  if (!budget.addBytes(2)) return false
+  active.add(handle)
+  stack.push(new __PulseFastlyAdmissionFrame(handle))
+  return true
+}
+function __pulse_fastly_admit_bounded_value(handle: i32, limits: __PulseJsonAdmissionLimits): __PulseJsonAdmissionBudget {
+  const budget = new __PulseJsonAdmissionBudget(limits)
+  const stack = new Array<__PulseFastlyAdmissionFrame>()
+  const active = new Set<i32>()
+  if (!__pulse_fastly_admission_enter(handle, budget, stack, active)) return budget
+  while (stack.length > 0) {
+    const frame = stack[stack.length - 1]
+    const value = __pulse_fastly_values[frame.handle - 1]
+    if (frame.index == value.values.length) { active.delete(frame.handle); stack.pop(); continue }
+    const index = frame.index++
+    if (index > 0 && !budget.addBytes(1)) return budget
+    if (value.kind == PULSE_VALUE_OBJECT) {
+      if (!budget.stringBytes(value.keys[index], true) || !budget.addBytes(1)) return budget
+    }
+    if (!__pulse_fastly_admission_enter(value.values[index], budget, stack, active)) return budget
+  }
+  return budget
+}
+`;
+}
+
+// Standalone composition used by focused admission fixtures.
+function generateFastlyJsonAdmission(limits, parserMaxDepth = 64) {
+  const generated = schemaAdmission.generateJsonAdmission(limits);
+  if (!Number.isInteger(parserMaxDepth) || parserMaxDepth < 1 || parserMaxDepth > 0x7fffffff
+    || generated.identity.limits.maxDepth > parserMaxDepth) {
+    throw new TypeError('JSON admission depth exceeds the selected Fastly parser capacity.');
+  }
+  return Object.freeze({ identity: generated.identity, source: `${generated.source}
+${fastlyJsonValueAdmissionSource()}
+function __pulse_fastly_admit_value(handle: i32): __PulseJsonAdmissionBudget {
+  return __pulse_fastly_admit_bounded_value(handle, __pulse_json_limits())
+}
+function __pulse_fastly_admitted_json(text: string, duplicateMode: i32 = 0): i32 {
+  const admission = __pulse_json_admit(text, duplicateMode)
+  if (admission.failure != 0) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 57, -1); return 0 }
+  return __pulse_fastly_parse_json(text)
+}
+function __pulse_fastly_admitted_json_text(handle: i32): string {
+  const admission = __pulse_fastly_admit_value(handle)
+  if (admission.failure != 0) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 57, -1); return '' }
+  const text = __pulse_fastly_json(handle, 0)
+  if (String.UTF8.byteLength(text) > admission.limits.maxTextBytes) {
+    __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 57, -1)
+    return ''
+  }
+  return text
+}
+` });
+}
+
+module.exports = { generateFastlyJsonAdmission, fastlyJsonValueAdmissionSource };

package/src/build/schema-nested-json.js

@@ -0,0 +1,93 @@
+'use strict';
+
+const { schemaHasNestedJson, schemaHasScalarRecord } = require('@pulse-compute/wasm-contracts/schema-json/registry');
+const { fastlyJsonValueAdmissionSource } = require('./schema-admission.js');
+
+function hasJsonAdmission(plan) { return (plan.schemas?.registry?.schemas || []).some(schema => schema.jsonLimits); }
+function tracksJsonDuplicates(plan) {
+  return (plan.schemas?.registry?.schemas || []).some(schema => schemaHasNestedJson(schema.root) || schemaHasScalarRecord(schema.root));
+}
+function schemaParserDepth(plan, baseline = 64) {
+  return Math.max(baseline, ...(plan.schemas?.registry?.schemas || []).map(schema => schema.jsonLimits?.maxDepth || 0));
+}
+
+function nestedJsonProjectionLines(node) {
+  return [
+    ...(node.kind === 'json-object' ? ['  if (input.kind != PULSE_VALUE_OBJECT) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 52, -1); return 0 }'] : []),
+    '  return __pulse_fastly_copy_json(valueHandle, checkDuplicates)'
+  ];
+}
+
+function schemaFetchJsonSource() {
+  return `
+function __pulse_fastly_fetch_json_headers(input: __PulseFastlyValue): __PulseFastlyValue {
+  for (let index = 0; index < input.keys.length; index++) if (input.keys[index].toLowerCase() == "content-type") return input
+  const output = new __PulseFastlyValue()
+  output.kind = PULSE_VALUE_OBJECT
+  for (let index = 0; index < input.keys.length; index++) {
+    output.keys.push(input.keys[index]); output.values.push(input.values[index])
+  }
+  output.keys.push("content-type")
+  output.values.push(__pulse_fastly_string_value("application/json; charset=utf-8"))
+  return output
+}
+function __pulse_fastly_fetch_json_body(init: __PulseFastlyValue, valueHandle: i32): string {
+  const index = __pulse_fastly_find(init, "schema")
+  let value = valueHandle
+  if (index >= 0) {
+    const schema = __pulse_fastly_value(init.values[index])
+    if (schema.kind != PULSE_VALUE_STRING || schema.text.length == 0) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 55, -1); return '' }
+    value = __pulse_fastly_schema_apply(schema.text, valueHandle, true)
+    if (value <= 0 || __pulse_fastly_last_error != 0) return ''
+  }
+  return __pulse_fastly_json(value, 0)
+}
+`;
+}
+
+function schemaJsonAdmissionSource(plan) {
+  const schemas = plan.schemas?.registry?.schemas || [];
+  if (!hasJsonAdmission(plan)) return '';
+  const nested = schemas.some(schema => schemaHasNestedJson(schema.root));
+  return `${fastlyJsonValueAdmissionSource()}
+function __pulse_fastly_schema_parse_json(text: string, schemaHandle: i32): i32 {
+  const schema = __pulse_fastly_value(schemaHandle)
+  if (schema.kind == PULSE_VALUE_STRING) {
+${schemas.map((schema, index) => schema.jsonLimits ? `    if (schema.text == ${JSON.stringify(schema.id)} && __pulse_schema_json_scan_${index}(text, 0).failure != 0) {
+      __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 57, -1); return 0
+    }` : '').join('\n')}
+  }
+  return __pulse_fastly_parse_json(text)
+}
+${nested ? `
+class __PulseFastlyJsonCopyFrame {
+  index: i32 = 0
+  constructor(public input: i32, public output: i32) {}
+}
+function __pulse_fastly_json_copy_enter(handle: i32, duplicates: bool, frames: Array<__PulseFastlyJsonCopyFrame>): i32 {
+  const value = __pulse_fastly_value(handle)
+  if (value.kind != PULSE_VALUE_ARRAY && value.kind != PULSE_VALUE_OBJECT) return handle
+  if (duplicates && value.duplicateJsonKeys) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 57, -1); return 0 }
+  const copy = value.kind == PULSE_VALUE_ARRAY ? host_value_array() : host_value_object()
+  frames.push(new __PulseFastlyJsonCopyFrame(handle, copy))
+  return copy
+}
+function __pulse_fastly_copy_json(handle: i32, duplicates: bool): i32 {
+  const frames = new Array<__PulseFastlyJsonCopyFrame>()
+  const output = __pulse_fastly_json_copy_enter(handle, duplicates, frames)
+  while (frames.length > 0) {
+    const frame = frames[frames.length - 1]
+    const value = __pulse_fastly_value(frame.input)
+    if (frame.index == value.values.length) { frames.pop(); continue }
+    const index = frame.index++
+    const copy = __pulse_fastly_json_copy_enter(value.values[index], duplicates, frames)
+    if (copy <= 0) return 0
+    if (value.kind == PULSE_VALUE_ARRAY) host_value_array_push(frame.output, copy)
+    else host_value_object_set(frame.output, __pulse_fastly_string_value(value.keys[index]), copy)
+  }
+  return output
+}
+` : ''}`;
+}
+
+module.exports = { hasJsonAdmission, tracksJsonDuplicates, schemaParserDepth, nestedJsonProjectionLines, schemaJsonAdmissionSource, schemaFetchJsonSource };

package/src/build/schema-scalar-record.js

@@ -0,0 +1,41 @@
+'use strict';
+
+const { schemaHasScalarRecord } = require('@pulse-compute/wasm-contracts/schema-json/registry');
+
+function hasScalarRecords(plan) {
+  return (plan.schemas?.registry?.schemas || []).some(schema => schemaHasScalarRecord(schema.root));
+}
+
+// Both Fastly Native realizations validate handles before json-as sees them.
+function scalarRecordProjectionLines(node) {
+  const limits = node.limits;
+  return [
+    '  if (input.kind != PULSE_VALUE_OBJECT || (checkDuplicates && input.duplicateJsonKeys)) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 56, -1); return 0 }',
+    `  if (input.keys.length > ${limits.maxKeys}) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 56, -1); return 0 }`,
+    '  const keys = input.keys.slice().sort()',
+    '  const output = host_value_object()',
+    '  let bytes = 2',
+    '  for (let i = 0; i < keys.length; i++) {',
+    '    const key = keys[i]',
+    `    if (key.length > ${limits.maxKeyLength}) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 56, -1); return 0 }`,
+    '    const keyHandle = __pulse_fastly_string_value(key)',
+    '    const itemHandle = host_value_property(valueHandle, keyHandle)',
+    '    const item = __pulse_fastly_value(itemHandle)',
+    '    let size = 0',
+    '    if (item.kind == PULSE_VALUE_STRING) {',
+    `      if (item.text.length > ${limits.maxStringLength}) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 56, -1); return 0 }`,
+    '      size = __pulse_scalar_record_string_bytes(item.text)',
+    '    } else if (item.kind == PULSE_VALUE_NUMBER && isFinite(item.number)) {',
+    `      size = ${limits.numberBytes}`,
+    '    } else if (item.kind == PULSE_VALUE_BOOLEAN) size = item.boolean != 0 ? 4 : 5',
+    '    else if (item.kind == PULSE_VALUE_NULL) size = 4',
+    '    else { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 56, -1); return 0 }',
+    '    bytes += (i == 0 ? 0 : 1) + __pulse_scalar_record_string_bytes(key) + 1 + size',
+    `    if (bytes > ${limits.maxBytes}) { __pulse_fastly_fail(PULSE_ERROR_SCHEMA, 56, -1); return 0 }`,
+    '    host_value_object_set(output, keyHandle, itemHandle)',
+    '  }',
+    '  return output'
+  ];
+}
+
+module.exports = { hasScalarRecords, scalarRecordProjectionLines };

package/src/build/time-native.js

@@ -0,0 +1,49 @@
+'use strict';
+
+// Provider-owned realtime sampling. The portable guest still suspends through
+// effect_begin; no clock import is exposed to application-authored code.
+function timeNativeSource(plan) {
+  if (!(plan.effects || []).some(effect => effect.kind === 'time.now')) return '';
+  return `
+function __pulse_time_pad(value: i32, width: i32): string {
+  let text = value.toString()
+  while (text.length < width) text = "0" + text
+  return text
+}
+function __pulse_time_iso(ms: u64): string {
+  // Gregorian civil date from whole days since the Unix epoch.
+  const z = <i32>(ms / 86400000) + 719468
+  const era = z / 146097
+  const doe = z - era * 146097
+  const yoe = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365
+  let year = yoe + era * 400
+  const doy = doe - (365 * yoe + yoe / 4 - yoe / 100)
+  const mp = (5 * doy + 2) / 153
+  const day = doy - (153 * mp + 2) / 5 + 1
+  const month = mp + (mp < 10 ? 3 : -9)
+  if (month <= 2) year += 1
+  const rest = <i32>(ms % 86400000)
+  return __pulse_time_pad(year, 4) + "-" + __pulse_time_pad(month, 2) + "-" + __pulse_time_pad(day, 2)
+    + "T" + __pulse_time_pad(rest / 3600000, 2) + ":" + __pulse_time_pad((rest / 60000) % 60, 2)
+    + ":" + __pulse_time_pad((rest / 1000) % 60, 2) + "." + __pulse_time_pad(rest % 1000, 3) + "Z"
+}
+function __pulse_fastly_time_begin(effectIndex: i32, payload: __PulseFastlyValue): void {
+  const out = new StaticArray<u64>(1)
+  const status = wasi_snapshot_preview1_clock_time_get(0, 1000000, changetype<usize>(out))
+  const result = host_value_object()
+  if (status != 0) {
+    host_value_object_set(result, __pulse_fastly_string_value("status"), __pulse_fastly_string_value("failed"))
+    host_value_object_set(result, __pulse_fastly_string_value("reason"), __pulse_fastly_string_value("unavailable"))
+  } else {
+    // Divide integer nanoseconds before conversion to f64 to retain millisecond precision.
+    const ms = unchecked(out[0]) / 1000000
+    host_value_object_set(result, __pulse_fastly_string_value("status"), __pulse_fastly_string_value("ok"))
+    host_value_object_set(result, __pulse_fastly_string_value("unixEpochMs"), host_value_number(<f64>ms))
+    host_value_object_set(result, __pulse_fastly_string_value("iso8601"), __pulse_fastly_string_value(__pulse_time_iso(ms)))
+  }
+  __pulse_fastly_ready_effect(effectIndex, result)
+}
+`;
+}
+
+module.exports = Object.freeze({ timeNativeSource });

package/src/build/wasm-budget.js

@@ -0,0 +1,28 @@
+'use strict';
+
+const { fastlyConfigDefault } = require('../config-schema.js');
+const DEFAULT_FASTLY_MAX_WASM_BYTES = fastlyConfigDefault('fastly.build.maxWasmBytes');
+
+function normalizeFastlyMaxWasmBytes(value) {
+  if (value === undefined) return DEFAULT_FASTLY_MAX_WASM_BYTES;
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    const error = new TypeError('fastly.build.maxWasmBytes must be a positive safe integer byte count.');
+    error.code = 'PULSE_FASTLY_MAX_WASM_BYTES_INVALID';
+    throw error;
+  }
+  return value;
+}
+
+function assertFastlyWasmBudget(bytes, value) {
+  const maxBytes = normalizeFastlyMaxWasmBytes(value);
+  if (bytes > maxBytes) {
+    const error = new Error('Generated Fastly Native module exceeds the configured Pulse compilation budget.');
+    error.name = 'FastlyNativePlatformCapabilitiesError';
+    error.code = 'PULSE_FASTLY_NATIVE_PLATFORM_CAPABILITIES_WASM_TOO_LARGE';
+    error.detail = Object.freeze({ bytes, maxBytes });
+    throw error;
+  }
+  return maxBytes;
+}
+
+module.exports = Object.freeze({ DEFAULT_FASTLY_MAX_WASM_BYTES, normalizeFastlyMaxWasmBytes, assertFastlyWasmBudget });

package/src/config-api.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const { normalizeFastlyMaxWasmBytes } = require('./build/wasm-budget.js');
 const { fastlyConfigDefault } = require('./config-schema.js');
 
 const FASTLY_PROVIDER_API_VERSION = 'pulse.provider-fastly-api.v2';
@@ -38,6 +39,7 @@ function fastly(options = {}) {
   const normalizedGrip = options.grip === undefined ? undefined : gripBindings(options.grip);
   return Object.freeze({
     kind: 'fastly',
+    ...(options.maxDurationMs === undefined ? {} : { maxDurationMs: require('@pulse-compute/runtime/host').normalizeRequestDuration(options.maxDurationMs) }),
     version: FASTLY_PROVIDER_API_VERSION,
     bindings: Object.freeze({
       configStore: String(options.configStore ?? fastlyConfigDefault('fastly.configStore')),
@@ -48,6 +50,7 @@ function fastly(options = {}) {
       dynamicBackends: options.dynamicBackends === undefined ? fastlyConfigDefault('fastly.dynamicBackends') : options.dynamicBackends === true
     }),
     build: Object.freeze({
+      maxWasmBytes: normalizeFastlyMaxWasmBytes(options.maxWasmBytes),
       name: String(options.name ?? fastlyConfigDefault('fastly.name')),
       description: String(options.description ?? fastlyConfigDefault('fastly.description')),
       authors: Object.freeze((Array.isArray(options.authors) ? options.authors : fastlyConfigDefault('fastly.authors')).map(String)),

package/src/config-schema.json

@@ -72,6 +72,16 @@
     "fastly.local.networkFetch": {
       "kind": "boolean",
       "default": false
+    },
+    "fastly.maxDurationMs": {
+      "kind": "optional-number"
+    },
+    "fastly.build.maxWasmBytes": {
+      "kind": "positive-safe-integer",
+      "default": 4194304
+    },
+    "fastly.maxWasmBytes": {
+      "kind": "positive-safe-integer"
     }
   }
 }

package/src/index.ts

@@ -1,3 +1,5 @@
+const { normalizeFastlyMaxWasmBytes } = require('../src/build/wasm-budget.js') as { normalizeFastlyMaxWasmBytes(value?: number): number };
+const { normalizeRequestDuration } = require('@pulse-compute/runtime/host') as { normalizeRequestDuration(value?: number): number | undefined };
 import FASTLY_CONFIG_SCHEMA from './config-schema.json';
 
 type FastlySchemaRule = Readonly<{ kind: string; default?: unknown }>;
@@ -23,6 +25,9 @@ export interface PulseFastlyLocalOptions {
 }
 
 export interface PulseFastlyProviderOptions {
+  /** Inclusive final Native Wasm byte budget; default 4 MiB. */
+  readonly maxWasmBytes?: number;
+  readonly maxDurationMs?: number;
   readonly configStore?: string;
   readonly secretStore?: string;
   readonly kv?: Readonly<Record<string, string>>;
@@ -36,6 +41,7 @@ export interface PulseFastlyProviderOptions {
 }
 
 export interface PulseFastlyProviderConfig {
+  readonly maxDurationMs?: number;
   readonly kind: 'fastly';
   readonly version: typeof FASTLY_PROVIDER_API_VERSION;
   readonly bindings: {
@@ -57,6 +63,7 @@ export interface PulseFastlyProviderConfig {
     readonly dynamicBackends: boolean;
   };
   readonly build: {
+    readonly maxWasmBytes: number;
     readonly name: string;
     readonly description: string;
     readonly authors: readonly string[];
@@ -97,6 +104,7 @@ export function fastly(options: PulseFastlyProviderOptions = {}): PulseFastlyPro
   const normalizedGrip = options.grip === undefined ? undefined : gripBindings(options.grip);
   return Object.freeze({
     kind: 'fastly',
+    maxDurationMs: normalizeRequestDuration(options.maxDurationMs),
     version: FASTLY_PROVIDER_API_VERSION,
     bindings: Object.freeze({
       configStore: String(options.configStore ?? fastlyDefaults['fastly.configStore']),
@@ -107,6 +115,7 @@ export function fastly(options: PulseFastlyProviderOptions = {}): PulseFastlyPro
       dynamicBackends: options.dynamicBackends === undefined ? Boolean(fastlyDefaults['fastly.dynamicBackends']) : options.dynamicBackends === true
     }),
     build: Object.freeze({
+      maxWasmBytes: normalizeFastlyMaxWasmBytes(options.maxWasmBytes),
       name: String(options.name ?? fastlyDefaults['fastly.name']),
       description: String(options.description ?? fastlyDefaults['fastly.description']),
       authors: Object.freeze((options.authors ?? (Array.isArray(fastlyDefaults['fastly.authors']) ? fastlyDefaults['fastly.authors'] : [])).map(String)),

package/src/javascript/jwt-verifier.js

@@ -1,10 +1,12 @@
 'use strict';
 
 const {
+  normalizeJwtSignEffect,
   normalizeJwtVerifyEffect
 } = require('@pulse-compute/wasm-contracts/jwt/contracts');
 const {
   CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION,
+  CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION,
   CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION
 } = require('@pulse-compute/wasm-contracts/crypto/contracts');
 
@@ -16,6 +18,7 @@ const FASTLY_JAVASCRIPT_JWT_REALIZATIONS = Object.freeze({
     implementation: CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION,
     automaticFallback: false
   }),
+  RS256: Object.freeze({ algorithm: 'RS256', realization: 'runtime-builtin', implementation: CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION, automaticFallback: false }),
   ES256: Object.freeze({
     algorithm: 'ES256',
     realization: 'runtime-builtin',
@@ -83,12 +86,19 @@ function createFastlyJavascriptJwtVerify(options = {}) {
   return async function verifyFastlyJavascriptJwt(effect, execution) {
     const { jwtProvider, cryptoProvider } = await loadRuntimeModules();
     assertRequestActive(execution, jwtProvider);
-    const input = normalizeJwtVerifyEffect(effect);
-    if (execution && typeof execution.registerRedactionValue === 'function') {
+    const signing = effect.operation === 'sign';
+    const input = signing ? normalizeJwtSignEffect(effect) : normalizeJwtVerifyEffect(effect);
+    if (!signing && execution && typeof execution.registerRedactionValue === 'function') {
       execution.registerRedactionValue(input.token);
     }
     assertRequestActive(execution, jwtProvider);
-    const selectedCrypto = assertRuntimeBuiltin(cryptoProvider, jwtProvider);
+    const selectedCrypto = signing
+      ? (input.options.algorithm === 'RS256'
+        ? require('@pulse-compute/crypto/provider').bindJavascriptRs256Signer()
+        : input.options.algorithm === 'ES256'
+        ? require('@pulse-compute/crypto/provider').bindJavascriptEs256Signer()
+        : require('@pulse-compute/crypto/provider').bindJavascriptDigestMac(['HMAC-SHA256']))
+      : assertRuntimeBuiltin(cryptoProvider, jwtProvider);
     const host = {
       async captureWallClock() {
         assertRequestActive(execution, jwtProvider);
@@ -118,7 +128,7 @@ function createFastlyJavascriptJwtVerify(options = {}) {
         return result;
       };
     }
-    const result = await jwtProvider.verifyJwtWithCrypto(
+    const result = await (signing ? jwtProvider.signJwtWithCrypto : jwtProvider.verifyJwtWithCrypto)(
       input,
       Object.freeze(host),
       selectedCrypto

package/src/javascript/package-effects.js

@@ -15,10 +15,12 @@ function unavailable(effect = {}) {
 function createFastlyJavascriptPackageEffectCapabilities(options = {}) {
   const assetsLookup = options.assetsLookup;
   const gripBroadcast = options.gripBroadcast;
+  const digestText = require('@pulse-compute/crypto/provider').createJavascriptTextDigest(options);
   const jwtVerify = options.jwtVerify;
   return Object.freeze({
     version: FASTLY_JAVASCRIPT_PACKAGE_EFFECTS_VERSION,
     effect(effect, execution) {
+      if (effect && effect.contractId === 'pulse.crypto' && effect.operation === 'digestText') return digestText(effect, execution);
       if (effect && effect.contractId === 'pulse.assets' && effect.operation === 'lookup') {
         if (typeof assetsLookup !== 'function') return unavailable(effect);
         return assetsLookup(effect.payload, execution);
@@ -33,7 +35,7 @@ function createFastlyJavascriptPackageEffectCapabilities(options = {}) {
         }
         return gripBroadcast(effect.payload, execution);
       }
-      if (effect && effect.contractId === 'pulse.jwt' && effect.operation === 'verify') {
+      if (effect && effect.contractId === 'pulse.jwt' && ['verify', 'sign'].includes(effect.operation)) {
         if (typeof jwtVerify !== 'function') return unavailable(effect);
         return jwtVerify(effect, execution);
       }
@@ -49,7 +51,8 @@ function withFastlyPackageEffectCapabilities(capabilities, options = {}) {
     ...base,
     effect(effect, execution) {
       if (effect && (
-        effect.contractId === 'pulse.assets'
+        effect.contractId === 'pulse.crypto'
+        || effect.contractId === 'pulse.assets'
         || effect.contractId === 'pulse.grip'
         || effect.contractId === 'pulse.jwt'
       )) {

package/src/javascript/runtime-host.js

@@ -45,10 +45,10 @@ function createFastlyJavascriptCapabilities(options = {}) {
     : undefined;
   return withFastlyPackageEffectCapabilities(
     withFastlyFetchCapability(
-      withFastlyBindingCapabilities(options.capabilities, { ...options, bindingCapabilities }),
+      withFastlyBindingCapabilities({ time: () => runtimeHost.readWallTime(options.wallClock === undefined ? () => Date.now() : options.wallClock), ...options.capabilities }, { ...options, bindingCapabilities }),
       { ...options, fetchImplementation: options.fetchImplementation }
     ),
-    { assetsLookup, gripBroadcast, jwtVerify }
+    { assetsLookup, gripBroadcast, jwtVerify, digestSubtle: options.digestSubtle }
   );
 }
 
@@ -57,6 +57,9 @@ function requestHeaderPairs(request) {
 }
 
 async function executeFastlyJavascriptApplication(application, request, options = {}) {
+  if (options.maxDurationMs !== undefined || options.requestBudget !== undefined) {
+    throw new runtimeHost.PulseRuntimeContractError('PULSE_REQUEST_DURATION_UNSUPPORTED', 'Fastly JavaScript does not implement the request deadline; select Native.');
+  }
   const capabilities = options.effectAdapter === undefined
     ? createFastlyJavascriptCapabilities(options)
     : undefined;

package/src/javascript/target-support-policy.js

@@ -16,8 +16,11 @@ function blockedRestriction(id, restriction) {
 
 function classifyFastlyJavascriptCapability(id, restrictions = {}) {
   const capability = String(id);
+  if (capability === 'request.body.transform') return decision(capability, 'blocked', 'fastly-body-transform-unavailable', 'provider-fastly');
+  if (capability === 'request.body.forward' || capability === 'req.body') return decision(capability, 'blocked', 'fastly-incoming-body-forwarding-unavailable', 'provider-fastly');
+  if (capability === 'crypto.digestText') return decision(capability, 'eligible', 'fastly-javascript-crypto-sha256-runtime-builtin', 'provider-fastly');
   if (['kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap'].includes(capability)) return decision(capability, 'blocked', 'fastly-conditional-kv-incomplete', 'provider-fastly');
-  if (['s3.head', 's3.getText', 's3.putText'].includes(capability)) return decision(capability, 'blocked', 'fastly-javascript-s3-raw-headers-unavailable', 'provider-fastly');
+  if (['s3.head', 's3.getText', 's3.putText', 's3.getBody'].includes(capability)) return decision(capability, 'blocked', 'fastly-javascript-s3-raw-headers-unavailable', 'provider-fastly');
   if (isJavascriptCoreCapability(capability)) {
     return decision(capability, 'eligible', 'fastly-request-router-runtime', 'provider-fastly');
   }
@@ -81,9 +84,11 @@ function classifyFastlyJavascriptCapability(id, restrictions = {}) {
     return decision(capability, 'eligible', 'fastly-javascript-provider-wall-clock-authority', 'provider-fastly');
   }
   if (
-    capability === 'jwt.verify'
+    capability === 'jwt.sign'
+    || capability === 'jwt.verify'
     || capability === 'jwt.verify.hs256'
     || capability === 'jwt.verify.es256'
+    || capability === 'jwt.verify.rs256'
   ) {
     return blockedRestriction(capability, restrictions.jwt)
       || decision(capability, 'eligible', 'fastly-javascript-jwt-crypto-runtime-builtin', 'provider-fastly');
@@ -102,8 +107,9 @@ function classifyFastlyJavascriptCapability(id, restrictions = {}) {
 
 function classifyFastlyJavascriptProviderRequirement(id, restrictions = {}) {
   const requirement = String(id);
+  if (requirement === 'crypto.digestText') return decision(requirement, 'eligible', 'fastly-javascript-crypto-sha256-runtime-builtin', 'provider-fastly');
   if (['kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap'].includes(requirement)) return decision(requirement, 'blocked', 'fastly-conditional-kv-incomplete', 'provider-fastly');
-  if (['s3.head', 's3.getText', 's3.putText'].includes(requirement)) return decision(requirement, 'blocked', 'fastly-javascript-s3-raw-headers-unavailable', 'provider-fastly');
+  if (['s3.head', 's3.getText', 's3.putText', 's3.getBody'].includes(requirement)) return decision(requirement, 'blocked', 'fastly-javascript-s3-raw-headers-unavailable', 'provider-fastly');
   if (requirement === 'request' || ['response.json', 'response.text', 'response.custom'].includes(requirement)) {
     return decision(requirement, 'eligible', 'fastly-request-response-lifecycle', 'provider-fastly');
   }
@@ -145,9 +151,11 @@ function classifyFastlyJavascriptProviderRequirement(id, restrictions = {}) {
     return decision(requirement, 'eligible', 'fastly-javascript-provider-wall-clock-authority', 'provider-fastly');
   }
   if (
-    requirement === 'jwt.verify'
+    requirement === 'jwt.sign'
+    || requirement === 'jwt.verify'
     || requirement === 'jwt.verify.hs256'
     || requirement === 'jwt.verify.es256'
+    || requirement === 'jwt.verify.rs256'
   ) {
     return blockedRestriction(requirement, restrictions.jwt)
       || decision(requirement, 'eligible', 'fastly-javascript-jwt-crypto-runtime-builtin', 'provider-fastly');
@@ -169,6 +177,11 @@ function restriction(reasonId, configuration) {
 }
 
 function fastlyJavascriptProjectRestrictions(compiled, project) {
+  if (project.providerConfig?.maxDurationMs !== undefined) {
+    const error = new TypeError('fastly.maxDurationMs requires the Native target; Fastly JavaScript does not implement the request deadline.');
+    error.code = 'PULSE_REQUEST_DURATION_UNSUPPORTED';
+    throw error;
+  }
   const bindings = project.providerConfig && project.providerConfig.bindings || {};
   const backends = bindings.backends && typeof bindings.backends === 'object' ? bindings.backends : {};
   const kv = bindings.kv && typeof bindings.kv === 'object' ? bindings.kv : {};
@@ -181,7 +194,7 @@ function fastlyJavascriptProjectRestrictions(compiled, project) {
   const secretSites = sites.filter((entry) => entry.kind === 'secret.get');
   const jwtSites = sites.filter((entry) => (
     entry.contractId === 'pulse.jwt'
-    && (entry.operation === 'verify' || entry.kind === 'jwt.verify')
+    && (['verify', 'sign'].includes(entry.operation) || ['jwt.verify', 'jwt.sign'].includes(entry.kind))
   ));
   const output = {};