@pulse-compute/provider-fastly 1.0.0-beta.5 → 1.0.0-beta.6

package/src/index.ts

@@ -1,3 +1,4 @@
+const { normalizeFastlyMaxWasmBytes } = require('../src/build/wasm-budget.js') as { normalizeFastlyMaxWasmBytes(value?: number): number };
 const { normalizeRequestDuration } = require('@pulse-compute/runtime/host') as { normalizeRequestDuration(value?: number): number | undefined };
 import FASTLY_CONFIG_SCHEMA from './config-schema.json';
 
@@ -24,6 +25,8 @@ export interface PulseFastlyLocalOptions {
 }
 
 export interface PulseFastlyProviderOptions {
+  /** Inclusive final Native Wasm byte budget; default 4 MiB. */
+  readonly maxWasmBytes?: number;
   readonly maxDurationMs?: number;
   readonly configStore?: string;
   readonly secretStore?: string;
@@ -60,6 +63,7 @@ export interface PulseFastlyProviderConfig {
     readonly dynamicBackends: boolean;
   };
   readonly build: {
+    readonly maxWasmBytes: number;
     readonly name: string;
     readonly description: string;
     readonly authors: readonly string[];
@@ -111,6 +115,7 @@ export function fastly(options: PulseFastlyProviderOptions = {}): PulseFastlyPro
       dynamicBackends: options.dynamicBackends === undefined ? Boolean(fastlyDefaults['fastly.dynamicBackends']) : options.dynamicBackends === true
     }),
     build: Object.freeze({
+      maxWasmBytes: normalizeFastlyMaxWasmBytes(options.maxWasmBytes),
       name: String(options.name ?? fastlyDefaults['fastly.name']),
       description: String(options.description ?? fastlyDefaults['fastly.description']),
       authors: Object.freeze((options.authors ?? (Array.isArray(fastlyDefaults['fastly.authors']) ? fastlyDefaults['fastly.authors'] : [])).map(String)),

package/src/javascript/jwt-verifier.js

@@ -1,10 +1,12 @@
 'use strict';
 
 const {
+  normalizeJwtSignEffect,
   normalizeJwtVerifyEffect
 } = require('@pulse-compute/wasm-contracts/jwt/contracts');
 const {
   CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION,
+  CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION,
   CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION
 } = require('@pulse-compute/wasm-contracts/crypto/contracts');
 
@@ -16,6 +18,7 @@ const FASTLY_JAVASCRIPT_JWT_REALIZATIONS = Object.freeze({
     implementation: CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION,
     automaticFallback: false
   }),
+  RS256: Object.freeze({ algorithm: 'RS256', realization: 'runtime-builtin', implementation: CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION, automaticFallback: false }),
   ES256: Object.freeze({
     algorithm: 'ES256',
     realization: 'runtime-builtin',
@@ -83,12 +86,19 @@ function createFastlyJavascriptJwtVerify(options = {}) {
   return async function verifyFastlyJavascriptJwt(effect, execution) {
     const { jwtProvider, cryptoProvider } = await loadRuntimeModules();
     assertRequestActive(execution, jwtProvider);
-    const input = normalizeJwtVerifyEffect(effect);
-    if (execution && typeof execution.registerRedactionValue === 'function') {
+    const signing = effect.operation === 'sign';
+    const input = signing ? normalizeJwtSignEffect(effect) : normalizeJwtVerifyEffect(effect);
+    if (!signing && execution && typeof execution.registerRedactionValue === 'function') {
       execution.registerRedactionValue(input.token);
     }
     assertRequestActive(execution, jwtProvider);
-    const selectedCrypto = assertRuntimeBuiltin(cryptoProvider, jwtProvider);
+    const selectedCrypto = signing
+      ? (input.options.algorithm === 'RS256'
+        ? require('@pulse-compute/crypto/provider').bindJavascriptRs256Signer()
+        : input.options.algorithm === 'ES256'
+        ? require('@pulse-compute/crypto/provider').bindJavascriptEs256Signer()
+        : require('@pulse-compute/crypto/provider').bindJavascriptDigestMac(['HMAC-SHA256']))
+      : assertRuntimeBuiltin(cryptoProvider, jwtProvider);
     const host = {
       async captureWallClock() {
         assertRequestActive(execution, jwtProvider);
@@ -118,7 +128,7 @@ function createFastlyJavascriptJwtVerify(options = {}) {
         return result;
       };
     }
-    const result = await jwtProvider.verifyJwtWithCrypto(
+    const result = await (signing ? jwtProvider.signJwtWithCrypto : jwtProvider.verifyJwtWithCrypto)(
       input,
       Object.freeze(host),
       selectedCrypto

package/src/javascript/package-effects.js

@@ -35,7 +35,7 @@ function createFastlyJavascriptPackageEffectCapabilities(options = {}) {
         }
         return gripBroadcast(effect.payload, execution);
       }
-      if (effect && effect.contractId === 'pulse.jwt' && effect.operation === 'verify') {
+      if (effect && effect.contractId === 'pulse.jwt' && ['verify', 'sign'].includes(effect.operation)) {
         if (typeof jwtVerify !== 'function') return unavailable(effect);
         return jwtVerify(effect, execution);
       }

package/src/javascript/target-support-policy.js

@@ -16,9 +16,11 @@ function blockedRestriction(id, restriction) {
 
 function classifyFastlyJavascriptCapability(id, restrictions = {}) {
   const capability = String(id);
+  if (capability === 'request.body.transform') return decision(capability, 'blocked', 'fastly-body-transform-unavailable', 'provider-fastly');
+  if (capability === 'request.body.forward' || capability === 'req.body') return decision(capability, 'blocked', 'fastly-incoming-body-forwarding-unavailable', 'provider-fastly');
   if (capability === 'crypto.digestText') return decision(capability, 'eligible', 'fastly-javascript-crypto-sha256-runtime-builtin', 'provider-fastly');
   if (['kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap'].includes(capability)) return decision(capability, 'blocked', 'fastly-conditional-kv-incomplete', 'provider-fastly');
-  if (['s3.head', 's3.getText', 's3.putText'].includes(capability)) return decision(capability, 'blocked', 'fastly-javascript-s3-raw-headers-unavailable', 'provider-fastly');
+  if (['s3.head', 's3.getText', 's3.putText', 's3.getBody'].includes(capability)) return decision(capability, 'blocked', 'fastly-javascript-s3-raw-headers-unavailable', 'provider-fastly');
   if (isJavascriptCoreCapability(capability)) {
     return decision(capability, 'eligible', 'fastly-request-router-runtime', 'provider-fastly');
   }
@@ -82,9 +84,11 @@ function classifyFastlyJavascriptCapability(id, restrictions = {}) {
     return decision(capability, 'eligible', 'fastly-javascript-provider-wall-clock-authority', 'provider-fastly');
   }
   if (
-    capability === 'jwt.verify'
+    capability === 'jwt.sign'
+    || capability === 'jwt.verify'
     || capability === 'jwt.verify.hs256'
     || capability === 'jwt.verify.es256'
+    || capability === 'jwt.verify.rs256'
   ) {
     return blockedRestriction(capability, restrictions.jwt)
       || decision(capability, 'eligible', 'fastly-javascript-jwt-crypto-runtime-builtin', 'provider-fastly');
@@ -105,7 +109,7 @@ function classifyFastlyJavascriptProviderRequirement(id, restrictions = {}) {
   const requirement = String(id);
   if (requirement === 'crypto.digestText') return decision(requirement, 'eligible', 'fastly-javascript-crypto-sha256-runtime-builtin', 'provider-fastly');
   if (['kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap'].includes(requirement)) return decision(requirement, 'blocked', 'fastly-conditional-kv-incomplete', 'provider-fastly');
-  if (['s3.head', 's3.getText', 's3.putText'].includes(requirement)) return decision(requirement, 'blocked', 'fastly-javascript-s3-raw-headers-unavailable', 'provider-fastly');
+  if (['s3.head', 's3.getText', 's3.putText', 's3.getBody'].includes(requirement)) return decision(requirement, 'blocked', 'fastly-javascript-s3-raw-headers-unavailable', 'provider-fastly');
   if (requirement === 'request' || ['response.json', 'response.text', 'response.custom'].includes(requirement)) {
     return decision(requirement, 'eligible', 'fastly-request-response-lifecycle', 'provider-fastly');
   }
@@ -147,9 +151,11 @@ function classifyFastlyJavascriptProviderRequirement(id, restrictions = {}) {
     return decision(requirement, 'eligible', 'fastly-javascript-provider-wall-clock-authority', 'provider-fastly');
   }
   if (
-    requirement === 'jwt.verify'
+    requirement === 'jwt.sign'
+    || requirement === 'jwt.verify'
     || requirement === 'jwt.verify.hs256'
     || requirement === 'jwt.verify.es256'
+    || requirement === 'jwt.verify.rs256'
   ) {
     return blockedRestriction(requirement, restrictions.jwt)
       || decision(requirement, 'eligible', 'fastly-javascript-jwt-crypto-runtime-builtin', 'provider-fastly');
@@ -188,7 +194,7 @@ function fastlyJavascriptProjectRestrictions(compiled, project) {
   const secretSites = sites.filter((entry) => entry.kind === 'secret.get');
   const jwtSites = sites.filter((entry) => (
     entry.contractId === 'pulse.jwt'
-    && (entry.operation === 'verify' || entry.kind === 'jwt.verify')
+    && (['verify', 'sign'].includes(entry.operation) || ['jwt.verify', 'jwt.sign'].includes(entry.kind))
   ));
   const output = {};
 

package/src/javascript/target.js

@@ -14,6 +14,11 @@ const FASTLY_JAVASCRIPT_TARGET_DESCRIPTOR = normalizeJavascriptTargetDescriptor(
   crypto: defineCryptoTargetCapabilities({
     target: 'javascript',
     algorithms: [{
+      algorithm: 'HMAC-SHA256',
+      realization: 'runtime-builtin',
+      implemented: true,
+      status: 'implemented-jwt-sign'
+    }, {
       algorithm: 'SHA-256',
       realization: 'runtime-builtin',
       implemented: true,
@@ -28,6 +33,11 @@ const FASTLY_JAVASCRIPT_TARGET_DESCRIPTOR = normalizeJavascriptTargetDescriptor(
       realization: 'runtime-builtin',
       implemented: true,
       status: 'implemented-h4'
+    }, {
+      algorithm: 'RS256',
+      realization: 'runtime-builtin',
+      implemented: true,
+      status: 'implemented-h4'
     }]
   }),
   capabilities: {

package/src/provider-contract.js

@@ -14,8 +14,8 @@ const FASTLY_PROVIDER_DESCRIPTOR = canonical.normalizeDescriptor({
   capabilities: [
     'request', 'response.json', 'response.text', 'response.custom', 'fetch',
     'time.wall-clock', 'crypto.digestText', 'config.get', 'secret.get', 'kv.get', 'kv.put', 'kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap', 'assets.lookup',
-    'grip.channel', 'grip.hold', 'grip.publish', 'grip.broadcast', 'jwt.verify',
-    'opaque.pass-through', 's3.head', 's3.getText', 's3.putText'
+    'grip.channel', 'grip.hold', 'grip.publish', 'grip.broadcast', 'jwt.verify', 'jwt.sign',
+    'opaque.pass-through', 's3.head', 's3.getText', 's3.putText', 's3.getBody'
   ],
   lowering: {
     request: 'fastly.compute.request',
@@ -38,8 +38,10 @@ const FASTLY_PROVIDER_DESCRIPTOR = canonical.normalizeDescriptor({
     'grip.publish': 'fastly.fanout.publish',
     'grip.broadcast': 'fastly.grip.publish-control',
     'jwt.verify': 'fastly.native.jwt.verify',
+    'jwt.sign': 'fastly.native.jwt.sign',
     's3.head': 'fastly.native.s3.head',
     's3.getText': 'fastly.native.s3.getText',
+    's3.getBody': 'fastly.native.s3.getBody',
     's3.putText': 'fastly.native.s3.putText',
     'opaque.pass-through': 'fastly.response-body.stream'
   }

package/src/testing/native-http-effects-host.js

@@ -80,6 +80,7 @@ function executeFastlyNativeHttpEffects(input, options = {}) {
   const bodies = new Map();
   const responses = new Map();
   const pending = new Map();
+  const outboundRequests = [];
   const downstreamRequestHandle = 1;
   const downstreamBodyHandle = 2;
   requests.set(downstreamRequestHandle, { method, url, headers: requestHeaders.map((entry) => [...entry]) });
@@ -230,7 +231,9 @@ function executeFastlyNativeHttpEffects(input, options = {}) {
           return FASTLY_STATUS_ERROR;
         }
         const pendingHandle = alloc('pending');
-        pending.set(pendingHandle, { request: { ...request, headers: request.headers.map((entry) => [...entry]), body: bodyBytes(bodyHandle) }, backend, fixture });
+        const outbound = { ...request, headers: request.headers.map((entry) => [...entry]), body: bodyBytes(bodyHandle) };
+        outboundRequests.push(outbound);
+        pending.set(pendingHandle, { request: outbound, backend, fixture });
         writeU32(pendingOut, pendingHandle);
         trace.push({ module: 'fastly_http_req', name: 'send_async', handle: Number(handle), bodyHandle: Number(bodyHandle), pendingHandle, backend, method: request.method, url: request.url });
         return FASTLY_STATUS_OK;
@@ -373,6 +376,7 @@ function executeFastlyNativeHttpEffects(input, options = {}) {
       bodyHandle: downstream.bodyHandle
     }),
     trace: Object.freeze(trace.map((entry) => Object.freeze({ ...entry }))),
+    outboundRequests: Object.freeze(outboundRequests.map(entry => Object.freeze(entry))),
     instance
   });
 }

package/src/testing/native-platform-capabilities-host.js

@@ -204,6 +204,15 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
       body = JSON.stringify(normalized.json);
       if (!headers.some(([name]) => name.toLowerCase() === 'content-type')) headers.push(['content-type', 'application/json; charset=utf-8']);
     }
+    // Ordinary Pulse harness fixtures use value/text; preserve the ABI fixture
+    // body's explicit precedence and its existing json shorthand.
+    if (body === undefined && Object.prototype.hasOwnProperty.call(normalized, 'value')) {
+      body = JSON.stringify(normalized.value);
+      if (!headers.some(([name]) => name.toLowerCase() === 'content-type')) headers.push(['content-type', 'application/json; charset=utf-8']);
+    } else if (body === undefined && Object.prototype.hasOwnProperty.call(normalized, 'text')) {
+      body = String(normalized.text);
+      if (!headers.some(([name]) => name.toLowerCase() === 'content-type')) headers.push(['content-type', 'text/plain; charset=utf-8']);
+    }
     responses.set(responseHandle, {
       status: Number(normalized.status || 200),
       headers,
@@ -607,7 +616,7 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
       }
     },
     fastly_http_body: {
-      close(handle) { trace.push({ module: 'fastly_http_body', name: 'close' }); return bodies.delete(Number(handle)) ? FASTLY_STATUS_OK : FASTLY_STATUS_BADF; },
+      close(handle) { trace.push({ module: 'fastly_http_body', name: 'close', handle: Number(handle) }); if (downstream?.streaming && downstream.bodyHandle === Number(handle)) { downstream.bodyBytes = bodyBytes(handle); downstream.finished = true; } return bodies.delete(Number(handle)) ? FASTLY_STATUS_OK : FASTLY_STATUS_BADF; },
       new(handleOut) {
         const handle = alloc('body');
         bodies.set(handle, { bytes: Buffer.alloc(0), readOffset: 0, writes: [] });
@@ -632,6 +641,7 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
       write(handle, buffer, bufferLength, end, writtenOut) {
         const body = bodies.get(Number(handle));
         if (!body) return FASTLY_STATUS_BADF;
+        if (downstream?.streaming && Number(handle) === downstream.bodyHandle && options.downstreamBodyWriteStatus) return Number(options.downstreamBodyWriteStatus);
         if (requests.size > 1 && options.outboundBodyWriteStatus) return Number(options.outboundBodyWriteStatus);
         const length = Math.min(Number(bufferLength), Number(options.bodyWriteChunkBytes || bufferLength));
         const bytes = readBytes(buffer, length);
@@ -665,7 +675,16 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
     throw new FastlyNativePlatformCapabilitiesMockError('Pass98 native module is missing _start.', 'PULSE_FASTLY_NATIVE_PLATFORM_CAPABILITIES_MOCK_START_MISSING');
   }
   if (options.conditionalKv && options.conditionalKv.deadlineNs !== undefined) instance.exports.pulse_fastly_kv_request_deadline(BigInt(options.conditionalKv.deadlineNs));
-  instance.exports._start();
+  try { instance.exports._start(); }
+  catch (error) {
+    if (Number(instance.exports.pulse_fastly_last_error?.()) !== 1010) throw error;
+    throw new FastlyNativePlatformCapabilitiesMockError('Native retained-value budget exceeded.',
+      'PULSE_RUNTIME_MEMORY_LIMIT_EXCEEDED', {
+        lastError: 1010, errorStage: Number(instance.exports.pulse_fastly_error_stage()), trace,
+        bytes: Number(instance.exports.pulse_fastly_memory_bytes()),
+        values: Number(instance.exports.pulse_fastly_memory_values())
+      });
+  }
   for (const entry of trace) if (entry.url && privateUrls.has(entry.url)) entry.url = '[REDACTED]';
   const lastError = typeof instance.exports.pulse_fastly_last_error === 'function'
     ? Number(instance.exports.pulse_fastly_last_error())
@@ -679,10 +698,11 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
   const pulseLastError = typeof instance.exports.pulse_last_error_code === 'function'
     ? Number(instance.exports.pulse_last_error_code())
     : undefined;
+  if (downstream?.streaming && !downstream.finished) { downstream.bodyBytes = bodyBytes(downstream.bodyHandle); downstream.aborted = true; }
   const handledJwtError = options.allowHandledJwtError === true
     && lastError === 1008
     && Boolean(downstream);
-  if (lastError !== FASTLY_STATUS_OK && !handledJwtError) {
+  if (lastError !== FASTLY_STATUS_OK && !handledJwtError && !(options.allowAbortedResponse === true && downstream?.aborted)) {
     throw new FastlyNativePlatformCapabilitiesMockError('Fastly native platform capabilities module reported an execution error.', 'PULSE_FASTLY_NATIVE_PLATFORM_CAPABILITIES_MOCK_EXECUTION_FAILED', { lastError, errorStage, errorEffect, pulseLastError, trace });
   }
   if (!downstream) {
@@ -699,6 +719,7 @@ function executeFastlyNativePlatformCapabilities(input, options = {}) {
       bodyBytes: downstream.bodyBytes,
       sent: true,
       streaming: downstream.streaming,
+      aborted: downstream.aborted === true,
       origin: downstream.origin,
       responseHandle: downstream.responseHandle,
       bodyHandle: downstream.bodyHandle

package/src/toolchain/config.js

@@ -1,4 +1,5 @@
 'use strict';
+const { normalizeFastlyMaxWasmBytes } = require('../build/wasm-budget.js');
 const { normalizeFastlyS3 } = require('./s3.js');
 
 function providerConfigError(code, message, detail) {
@@ -55,6 +56,7 @@ function normalizeFastlyProviderConfig(value) {
       dynamicBackends: bindings.dynamicBackends === true
     }),
     build: Object.freeze({
+      maxWasmBytes: normalizeFastlyMaxWasmBytes(input.build?.maxWasmBytes),
       name: String(input.build && input.build.name || 'pulse-app'),
       description: String(input.build && input.build.description || 'Pulse application'),
       authors: Object.freeze(Array.isArray(input.build && input.build.authors) ? input.build.authors.map(String) : [])
@@ -102,6 +104,8 @@ const FASTLY_PROJECT_CONFIG_REFERENCE = Object.freeze({
     })
   ]),
   fields: Object.freeze([
+    Object.freeze({section:'fastly',path:'fastly.maxWasmBytes',type:'integer',allowed:'positive safe integer',default:'4194304 (4 MiB)',scope:'fastly() facade',description:'Facade option projected to build.maxWasmBytes. Conventional profiles configure fastly.build.maxWasmBytes.'}),
+    Object.freeze({section:'fastly',path:'fastly.build.maxWasmBytes',type:'integer',allowed:'positive safe integer',default:'4194304 (4 MiB)',scope:'Native final Wasm artifact',description:'Inclusive byte budget checked for newly compiled and reused artifacts. Raising it does not increase runtime memory or change Fastly service limits. The fastly() facade accepts maxWasmBytes.'}),
     Object.freeze({section:'fastly',path:'fastly.maxDurationMs',type:'integer',allowed:'1–30000',default:'omitted',scope:'HTTP request execution',description:'One provider-owned monotonic budget through buffered response handoff; expiry attempts 504 before headers commit and never asserts rollback of dispatched writes. No CPU preemption or post-handoff delivery guarantee.'}),
     Object.freeze({ section: 'fastly', path: 'fastly.bindings.s3', type: 'Readonly<Record<string, S3Binding & { backend: string }>>', default: '`{}`', scope: 'Fastly Native S3', description: 'Maps logical names to fixed HTTPS endpoint, bucket, region, named static backend, accessKeyIdSecret, secretAccessKeySecret, optional sessionTokenSecret, maxTextBytes (1–2097152, default 32768) and timeoutMs (1–30000, default 10000).', security: 'Credentials resolve through the configured Secret Store at execution. Dynamic backend authority and guest endpoint overrides are forbidden.' }),
     Object.freeze({ section: 'fastly', path: 'fastly.configStore', type: 'string', default: '`pulse_config`', scope: 'Fastly config capability', description: 'Fastly Config Store resource name.' }),

package/src/toolchain/index.js

@@ -169,16 +169,25 @@ function createDriver() {
         runtimeClass: 'native',
         status: 'supported',
         capabilities: Object.freeze([
-          's3.head', 's3.getText',
+          's3.head', 's3.getText', 's3.getBody',
           'kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap',
           'jwt.verify',
+          'jwt.sign',
           'jwt.verify.hs256',
           'jwt.verify.es256',
+          'jwt.verify.rs256',
           'secret.get',
           'time.wall-clock'
         ]),
         keyTypes: Object.freeze(['secret', 'jwk', 'jwks']),
         realizations: Object.freeze([
+          Object.freeze({
+            kind: 'package-native-application',
+            contractId: 'pulse.entities',
+            implementation: 'pulse.package-native-application.v1',
+            implemented: true,
+            automaticFallback: false
+          }),
           Object.freeze({
             kind: 'crypto-composed',
             realization: 'guest-source:pulse-hmac-as',
@@ -204,6 +213,19 @@ function createDriver() {
             guestUnitRequired: true,
             portable: true,
             automaticFallback: false
+          }),
+          Object.freeze({
+            kind: 'crypto-composed',
+            realization: 'guest-linked:pulse-rs256-bearssl-i31',
+            implementation: 'bearssl.0.6.rsa-i31.sha256.v1',
+            algorithms: Object.freeze(['RS256']),
+            keyTypes: Object.freeze(['jwk', 'jwks']),
+            implemented: true,
+            status: 'implemented-g4',
+            semanticOwner: '@pulse-compute/crypto',
+            guestUnitRequired: true,
+            portable: true,
+            automaticFallback: false
           })
         ]),
         jwt: Object.freeze({
@@ -233,6 +255,11 @@ function createDriver() {
             realization: 'guest-linked:pulse-es256-rustcrypto-p256',
             implemented: true,
             status: 'implemented-g4'
+          }, {
+            algorithm: 'RS256',
+            realization: 'guest-linked:pulse-rs256-bearssl-i31',
+            implemented: true,
+            status: 'implemented-g4'
           }]
         }),
         finalWasmPolicy: fastlyFinalWasmPolicy,
@@ -258,6 +285,7 @@ function createDriver() {
         realizationArtifacts: invocation.nativeArtifact.realizationArtifacts,
         guestUnits: invocation.nativeArtifact.guestUnits,
         nativeOptimization: invocation.optimization,
+        emitWat: invocation.nativeArtifact.manifest.wat?.emitted === true,
         compileTimeoutMs: invocation.timeoutMs
       });
       const { native, ...publicRealization } = realization;
@@ -286,6 +314,7 @@ function createDriver() {
         realizationArtifacts: invocation.nativeArtifact.realizationArtifacts,
         guestUnits: invocation.nativeArtifact.guestUnits,
         nativeOptimization: invocation.optimization,
+        emitWat: invocation.nativeArtifact.manifest.wat?.emitted === true,
         compileTimeoutMs: invocation.timeoutMs
       });
       const providerBuild = writeFastlyCanonicalTarget({

package/src/toolchain/native-execution.js

@@ -18,6 +18,7 @@ function prepareFastlyNativeExecution(invocation) {
     realizationArtifacts: invocation.nativeArtifact.realizationArtifacts,
     guestUnits: invocation.nativeArtifact.guestUnits,
     nativeOptimization: invocation.optimization,
+    emitWat: invocation.nativeArtifact.manifest.wat?.emitted === true,
     compileTimeoutMs: invocation.timeoutMs || undefined
   });
   const evidence = Object.freeze({

package/src/toolchain/s3.js

@@ -17,10 +17,10 @@ function normalizeFastlyS3(input = {}) {
 function resolveFastlyS3(effects, input) {
   const configured = normalizeFastlyS3(input);
   return Object.freeze(effects.flatMap((effect, index) => {
-    if (!['s3.head', 's3.getText', 's3.putText'].includes(effect.kind)) return [];
+    if (!['s3.head', 's3.getText', 's3.putText', 's3.getBody'].includes(effect.kind)) return [];
     const name = effect.resource && effect.resource.binding;
     if (!Object.hasOwn(configured, name)) throw new TypeError('The required Fastly S3 binding is missing.');
-    return [Object.freeze({ index, ...configured[name], contentType: effect.operation === 'putText' ? require('@pulse-compute/s3/provider').normalizePutOptions({ contentType: effect.payload && effect.payload.contentType }).contentType : '' })];
+    return [Object.freeze({ index, ...configured[name], ...(effect.operation === 'getBody' ? require('@pulse-compute/s3/provider').normalizeBodyOptions(Object.fromEntries(['method', 'range', 'ifNoneMatch'].filter(key => effect.payload?.[key] !== undefined).map(key => [key, effect.payload[key]]))) : {}), contentType: effect.operation === 'putText' ? require('@pulse-compute/s3/provider').normalizePutOptions({ contentType: effect.payload && effect.payload.contentType }).contentType : '' })];
   }));
 }
 module.exports = { normalizeFastlyS3, resolveFastlyS3 };