@pulse-compute/wasm-compiler 1.0.0-beta.3 → 1.0.0-beta.5

package/README.md

@@ -8,9 +8,9 @@
 > **Stability:** Internal compiler interface; no application-author compatibility guarantee.<br>
 > **npm:** [`@pulse-compute/wasm-compiler`](https://www.npmjs.com/package/@pulse-compute/wasm-compiler)<br>
 > **Canonical replacement:** `@pulse-compute/cli`<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.3/packages/implementation-packages/)
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.5/packages/implementation-packages/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.3` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.5` package policy.
 <!-- pulse-package-status:end -->
 
 Whole-project compiler implementation used by the `pulse` workflow. Application projects should use `@pulse-compute/cli`, not import this package directly.
@@ -52,4 +52,4 @@ The package exports its root implementation plus focused compiler, CLI, extracto
 
 Compiler changes should be covered by focused static/lowering tests, canonical project inspection, provider-plan parity, packed-package discovery where relevant, and the release documentation gates.
 
-See the installed [implementation package guide](https://pulsecompute.io/v1.0.0-beta.3/packages/implementation-packages/) and [compilation concepts](https://pulsecompute.io/v1.0.0-beta.3/concepts/compilation-and-lowering/).
+See the installed [implementation package guide](https://pulsecompute.io/v1.0.0-beta.5/packages/implementation-packages/) and [compilation concepts](https://pulsecompute.io/v1.0.0-beta.5/concepts/compilation-and-lowering/).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-compute/wasm-compiler",
-  "version": "1.0.0-beta.3",
+  "version": "1.0.0-beta.5",
   "license": "Apache-2.0",
   "description": "PulseWasm compiler package inside the Pulse monorepo.",
   "type": "commonjs",
@@ -9,15 +9,15 @@
     "pulsewasm": "./bin/pulsewasm-extract.js"
   },
   "dependencies": {
-    "@pulse-compute/provider-fastly": "1.0.0-beta.3",
-    "@pulse-compute/provider-node": "1.0.0-beta.3",
-    "@pulse-compute/wasm-build-support": "1.0.0-beta.3",
-    "@pulse-compute/wasm-contracts": "1.0.0-beta.3",
-    "@pulse-compute/wasm-guest-link": "1.0.0-beta.3",
-    "@pulse-compute/wasm-host-runtime": "1.0.0-beta.3",
-    "@pulse-compute/wasm-library-kit": "1.0.0-beta.3",
-    "@pulse-compute/wasm-runtime-core-as": "1.0.0-beta.3",
-    "@pulse-compute/wasm-schema-json": "1.0.0-beta.3",
+    "@pulse-compute/provider-fastly": "1.0.0-beta.5",
+    "@pulse-compute/provider-node": "1.0.0-beta.5",
+    "@pulse-compute/wasm-build-support": "1.0.0-beta.5",
+    "@pulse-compute/wasm-contracts": "1.0.0-beta.5",
+    "@pulse-compute/wasm-guest-link": "1.0.0-beta.5",
+    "@pulse-compute/wasm-host-runtime": "1.0.0-beta.5",
+    "@pulse-compute/wasm-library-kit": "1.0.0-beta.5",
+    "@pulse-compute/wasm-runtime-core-as": "1.0.0-beta.5",
+    "@pulse-compute/wasm-schema-json": "1.0.0-beta.5",
     "assemblyscript": "0.28.18",
     "json-as": "1.5.0",
     "typescript": "5.9.3"
@@ -58,7 +58,7 @@
     "url": "git+https://github.com/pulse-compute/pulse.git",
     "directory": "wasm/packages/compiler"
   },
-  "homepage": "https://pulsecompute.io/v1.0.0-beta.3/packages/implementation-packages/",
+  "homepage": "https://pulsecompute.io/v1.0.0-beta.5/packages/implementation-packages/",
   "bugs": {
     "url": "https://github.com/pulse-compute/pulse/issues"
   },

package/src/canonical-native-compiler.js

@@ -230,6 +230,11 @@ function realizeCanonicalNativePlan(plan, options = {}, providerRequirements) {
       '--optimize'
     ];
     const optimization = appendAssemblyScriptOptimizationArgs(args, options.nativeOptimization);
+    // The text capacity profile bounds each Native module to 256 MiB.
+    // Linked guests retain their separately owned fixed-memory ABI.
+    if (guestUnits.length === 0 && plan.effects.some(effect => effect.kind === 'crypto.digestText' || effect.kind.startsWith('s3.'))) {
+      args.push('--maximumMemory', '4096');
+    }
     if (guestUnits.length > 0) {
       args.push(
         '--importMemory',
@@ -254,7 +259,7 @@ function realizeCanonicalNativePlan(plan, options = {}, providerRequirements) {
       maxBuffer: 16 * 1024 * 1024,
       timeout: Number(options.timeoutMs || 120000),
       env: schemaCodecsActive
-        ? { ...process.env, JSON_STRICT: 'true', JSON_USE_FAST_PATH: '0' }
+        ? { ...process.env, JSON_STRICT: 'true', JSON_USE_FAST_PATH: '0', JSON_MODE: 'NAIVE' }
         : process.env
     });
     const durationMs = Date.now() - startedAt;
@@ -308,7 +313,7 @@ function verifyCanonicalNativeRealization(realization) {
     assemblyScript: Object.freeze({ package: 'assemblyscript', version: realization.assemblyScriptVersion }),
     optimization: resolveNativeOptimization(realization.optimization),
     jsonAs: realization.jsonAsVersion
-      ? Object.freeze({ package: 'json-as', version: realization.jsonAsVersion, transform: true, strict: true })
+      ? Object.freeze({ package: 'json-as', version: realization.jsonAsVersion, transform: true, strict: true, mode: 'NAIVE', fastPath: false })
       : null,
     wasm: Object.freeze({ bytes: inspection.bytes, sha256: inspection.sha256, magic: inspection.magic }),
     wat: Object.freeze({ bytes: Buffer.byteLength(realization.wat), sha256: sha256(realization.wat) }),

package/src/canonical-native-plan.js

@@ -5,6 +5,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const ts = require('typescript');
 const { executeCanonicalNativePlanSpine } = require('./spine/canonical-native-plan.js');
+const { inspectBoundedPureLoop } = require('./spine/bounded-pure-loop.js');
 
 function loadNativePlanContract() {
   try { return require('@pulse-compute/wasm-contracts/handler/canonical-native-plan'); }
@@ -202,6 +203,8 @@ function intrinsicForContextCall(parts) {
     'req.text': ['request.text', 'string'],
     'req.json': ['request.json', 'json'],
     json: ['response.json', 'pulse-result'],
+    encodeJson: ['schema.encode.text', 'string'],
+    decodeJson: ['schema.decode.text', 'json'],
     text: ['response.text', 'pulse-result'],
     response: ['response.custom', 'pulse-result'],
     kv: ['kv.namespace', 'kv-namespace'],
@@ -220,6 +223,7 @@ function resultKindForEffect(site, decoder, continuation, resultMode) {
   if (site.result === 'ack') return 'ack';
   if (site.kind === 'fetch') return 'fetch-response';
   if (site.kind === 'config.get' || site.kind === 'secret.get') return 'string-or-undefined';
+  if (site.kind === 'time.now') return 'json';
   if (site.kind === 'kv.get') return 'json-or-undefined';
   if (site.kind === 'kv.put') return 'ack';
   if (['kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap'].includes(site.kind)) return 'json';
@@ -442,7 +446,7 @@ class NativePlanBuilder {
     if (ts.isBinaryExpression(current)) {
       const operator = current.operatorToken.getText(this.sourceFile);
       if (ASSIGNMENT_OPERATORS.has(operator)) {
-        const target = this.expression(current.left, scope);
+        const target = this.assignmentTarget(current.left, scope);
         const value = this.expression(current.right, scope);
         return Object.freeze({ kind: 'assignment', operator, target, value, valueKind: value.valueKind || 'unknown' });
       }
@@ -457,7 +461,7 @@ class NativePlanBuilder {
     if (ts.isPrefixUnaryExpression(current)) {
       const operator = ts.tokenToString(current.operator) || current.getText(this.sourceFile).slice(0, 1);
       if (UPDATE_OPERATORS.has(operator)) {
-        return Object.freeze({ kind: 'update', operator, prefix: true, target: this.expression(current.operand, scope), valueKind: 'number' });
+        return Object.freeze({ kind: 'update', operator, prefix: true, target: this.assignmentTarget(current.operand, scope), valueKind: 'number' });
       }
       if (!PREFIX_OPERATORS.has(operator)) {
         this.fail(current, contract.CANONICAL_NATIVE_PLAN_DIAGNOSTIC_CODES.EXPRESSION_UNSUPPORTED, `Prefix operator ${operator} is outside the canonical native value model.`, { operator });
@@ -469,7 +473,7 @@ class NativePlanBuilder {
     if (ts.isPostfixUnaryExpression(current)) {
       const operator = ts.tokenToString(current.operator) || current.getText(this.sourceFile).slice(-2);
       if (!UPDATE_OPERATORS.has(operator)) this.fail(current, contract.CANONICAL_NATIVE_PLAN_DIAGNOSTIC_CODES.EXPRESSION_UNSUPPORTED, `Postfix operator ${operator} is outside the canonical native value model.`, { operator });
-      return Object.freeze({ kind: 'update', operator, prefix: false, target: this.expression(current.operand, scope), valueKind: 'number' });
+      return Object.freeze({ kind: 'update', operator, prefix: false, target: this.assignmentTarget(current.operand, scope), valueKind: 'number' });
     }
 
     if (ts.isConditionalExpression(current)) {
@@ -586,6 +590,9 @@ class NativePlanBuilder {
     if (ts.isPropertyAccessExpression(target)) {
       const receiver = this.expression(target.expression, scope);
       const method = target.name.text;
+      if (method === 'trim' && !target.questionDotToken && !call.questionDotToken && call.arguments.length === 0) {
+        return Object.freeze({ kind: 'method-call', receiver, method: 'string.trim', arguments: Object.freeze([]), valueKind: 'string' });
+      }
       if (!FETCH_RESPONSE_METHODS.has(method) || receiver.valueKind !== 'fetch-response') {
         this.fail(call, contract.CANONICAL_NATIVE_PLAN_DIAGNOSTIC_CODES.EXPRESSION_UNSUPPORTED, `Method call .${method}() is outside the canonical native fetch-response contract.`, { method, receiverKind: receiver.valueKind });
       }
@@ -606,6 +613,14 @@ class NativePlanBuilder {
     return Object.freeze({ kind: 'intrinsic', name: 'unsupported:call', arguments: Object.freeze([]), valueKind: 'unknown' });
   }
 
+  assignmentTarget(node, scope) {
+    const target = this.expression(node, scope);
+    if (target.kind === 'local' && scope.get(target.name)?.declaration === 'const') {
+      this.fail(node, contract.CANONICAL_NATIVE_PLAN_DIAGNOSTIC_CODES.EXPRESSION_UNSUPPORTED, 'A const local cannot be reassigned.', { name: target.name });
+    }
+    return target;
+  }
+
   allocateLocal(name, valueKind, statementPath, declaration) {
     this.localIndex += 1;
     const local = Object.freeze({
@@ -899,10 +914,38 @@ class NativePlanBuilder {
 
     if (ts.isVariableStatement(statement)) return this.lowerVariableStatement(statement, scope, pathParts, depth);
 
+    if (ts.isForStatement(statement)) {
+      const loop = inspectBoundedPureLoop(statement, { ctxName: this.ctxName });
+      for (const error of loop.errors) this.fail(error.node, 'PULSE_CANONICAL_PURE_LOOP_UNSUPPORTED', error.message);
+      if (loop.errors.length) return [];
+      const loopScope = new Map(scope);
+      const local = this.allocateLocal(loop.name, 'number', statementPath, 'let');
+      loopScope.set(loop.name, local);
+      const previousDepth = this.pureLoopDepth || 0;
+      this.pureLoopDepth = previousDepth + 1;
+      const body = this.statement(statement.statement, loopScope, [...pathParts, 'body'], depth + 1);
+      this.pureLoopDepth = previousDepth;
+      return [Object.freeze({ kind: 'pure-loop', localId: local.id, maxIterations: loop.maxIterations,
+        test: this.expression(statement.condition, loopScope), body: Object.freeze(body), statementPath })];
+    }
+    if ((ts.isBreakStatement(statement) || ts.isContinueStatement(statement)) && this.pureLoopDepth && !statement.label) {
+      return [Object.freeze({ kind: ts.isBreakStatement(statement) ? 'break' : 'continue', statementPath })];
+    }
+
     if (ts.isIfStatement(statement)) {
       this.summary.branchCount += 1;
       const thenScope = new Map(scope);
       const elseScope = new Map(scope);
+      const test = this.expression(statement.expression, scope);
+      // A const primitive cannot change between this guard and a branch read.
+      // Keep mutable locals and the scope after the branch unrefined.
+      if (test.kind === 'binary' && ['===', '!=='].includes(test.operator)) {
+        const read = test.left.kind === 'undefined' ? test.right : test.right.kind === 'undefined' ? test.left : undefined;
+        const local = read?.kind === 'local' ? scope.get(read.name) : undefined;
+        if (local?.declaration === 'const' && local.valueKind === 'string-or-undefined') {
+          (test.operator === '!==' ? thenScope : elseScope).set(local.name, Object.freeze({ ...local, valueKind: 'string' }));
+        }
+      }
       const thenBody = ts.isBlock(statement.thenStatement)
         ? this.statementList(statement.thenStatement.statements, thenScope, [...pathParts, 'then'], depth + 1)
         : this.statement(statement.thenStatement, thenScope, [...pathParts, 'then', 0], depth + 1);
@@ -913,7 +956,7 @@ class NativePlanBuilder {
           : this.statement(statement.elseStatement, elseScope, [...pathParts, 'else', 0], depth + 1);
       return [Object.freeze({
         kind: 'if',
-        test: this.expression(statement.expression, scope),
+        test,
         then: Object.freeze(thenBody),
         else: Object.freeze(elseBody),
         statementPath
@@ -1159,6 +1202,9 @@ function walkStatements(statements, visitor) {
       walkExpression(statement.test, visitor.expression);
       walkStatements(statement.then, visitor);
       walkStatements(statement.else, visitor);
+    } else if (statement.kind === 'pure-loop') {
+      walkExpression(statement.test, visitor.expression);
+      walkStatements(statement.body, visitor);
     } else if (statement.kind === 'return') walkExpression(statement.value, visitor.expression);
     else if (statement.kind === 'expression') walkExpression(statement.expression, visitor.expression);
   }
@@ -1193,6 +1239,9 @@ function summarizeNativePlan(body, locals, effects, continuations) {
         summary.expressionCount += countExpression(statement.test);
         visitStatements(statement.then, depth + 1);
         visitStatements(statement.else, depth + 1);
+      } else if (statement.kind === 'pure-loop') {
+        summary.expressionCount += countExpression(statement.test);
+        visitStatements(statement.body, depth + 1);
       } else if (statement.kind === 'return') {
         summary.returnCount += 1;
         summary.expressionCount += countExpression(statement.value);
@@ -1237,6 +1286,41 @@ function validateResult(result, fail, localIds, detail = {}) {
 }
 
 function validatePlanTree(plan, fail, localIds, effectIds, continuationIds) {
+  function validateLoops(statements, counters = new Set(), product = 1) {
+    for (const statement of statements || []) {
+      if (statement.kind === 'pure-loop') {
+        const limit = statement.maxIterations;
+        if (!localIds.has(statement.localId) || counters.has(statement.localId)) fail('pure loop requires its own local counter');
+        if (!Number.isInteger(limit) || limit < 0 || limit > contract.CANONICAL_PURE_LOOP_LIMITS.maxIterations
+          || product * Math.max(1, limit) > contract.CANONICAL_PURE_LOOP_LIMITS.maxNestedIterations) fail('pure loop iteration bound is invalid');
+        let bound = statement.test;
+        while (bound && bound.kind === 'binary' && bound.operator === '&&') bound = bound.left;
+        if (!bound || bound.kind !== 'binary' || bound.operator !== '<' || bound.left?.kind !== 'local' || bound.left.id !== statement.localId
+          || bound.right?.kind !== 'literal' || bound.right.value !== limit) fail('pure loop test must start with its declared literal cap');
+        const active = new Set([...counters, statement.localId]);
+        checkPureExpression(statement.test, active, true);
+        validateLoops(statement.body, active, product * Math.max(1, limit));
+      } else {
+        if (counters.size && !['local', 'expression', 'if', 'break', 'continue'].includes(statement.kind)) fail('pure loop contains a non-value statement', { kind: statement.kind });
+        if (!counters.size && ['break', 'continue'].includes(statement.kind)) fail('loop transfer outside pure loop');
+        if (counters.size) {
+          if (statement.kind === 'local' && counters.has(statement.localId)) fail('pure loop counter cannot be rebound');
+          checkPureExpression(statement.value || statement.expression || statement.test, counters);
+        }
+        if (statement.kind === 'if') {
+          validateLoops(statement.then, counters, product);
+          validateLoops(statement.else, counters, product);
+        }
+      }
+    }
+  }
+  function checkPureExpression(expression, counters, test = false) {
+    walkExpression(expression, node => {
+      if (node.kind === 'intrinsic' || node.kind === 'context-read' || (node.kind === 'method-call' && (node.method !== 'string.trim' || node.arguments?.length))) fail('pure loop contains a non-value call or context read');
+      if (['assignment', 'update'].includes(node.kind) && (test || (node.target?.kind === 'local' && counters.has(node.target.id)))) fail('pure loop test or counter mutation is invalid');
+    });
+  }
+  validateLoops(plan.entry && plan.entry.body);
   const visitor = (statement) => {
     if (!contract.CANONICAL_NATIVE_STATEMENT_KINDS.includes(statement.kind)) fail('statement kind is unknown', { kind: statement.kind });
     if (statement.kind === 'local' && !localIds.has(statement.localId)) fail('local statement references unknown local', { localId: statement.localId });

package/src/javascript-application-plan.js

@@ -38,7 +38,10 @@ function packageStatus(module, graphBuild) {
     .find((entry) => entry.packageName === module.packageName);
   if (product) {
     const target = product.javascriptTarget;
-    if (target && target.status === 'supported') {
+    // Source loadability is separate from selected-provider eligibility. The
+    // target-support owner checks provider-dependent requirements before build.
+    if (target && ['supported', 'provider-dependent'].includes(target.status)
+      && target.realization === 'javascript-package-runtime' && target.entry) {
       return Object.freeze({ status: 'package-runtime', runtimeEntry: target.entry, reasonCode: null });
     }
     return Object.freeze({

package/src/project-target-support.js

@@ -92,7 +92,8 @@ function classifyPackage(reachable, planned, product, context, options = {}) {
   }
 
   const targetStatus = product && product.javascriptTarget && product.javascriptTarget.status;
-  if (targetStatus === 'not-realized' || targetStatus === 'provider-dependent') {
+  if (targetStatus === 'not-realized'
+    || (targetStatus === 'provider-dependent' && (!planned || planned.status !== 'package-runtime'))) {
     return Object.freeze({ ...common, status: 'pending', reasonId: 'package-javascript-realization-pending', owner: pendingPackageOwner(product) });
   }
   if (targetStatus === 'unsupported') {
@@ -335,7 +336,14 @@ function buildJavascriptTargetSupportEvidence(project, options = {}, policy = {}
   const capabilities = Object.freeze(compilerCapabilities
     .map((id) => policy.classifyCapability(id, context))
     .sort((a, b) => a.id.localeCompare(b.id)));
-  const providerRequirements = Object.freeze(requirementsFromMetadata(compiled.metadata)
+  const requiredContracts = new Set(packages.filter((entry) => entry.required).map((entry) => entry.contractId));
+  const packageRequirements = (compiled.packageProduct && compiled.packageProduct.contracts || [])
+    .filter((entry) => requiredContracts.has(entry.contractId) && entry.javascriptTarget
+      && entry.javascriptTarget.status === 'provider-dependent')
+    .flatMap((entry) => entry.javascriptTarget.providerRequirements || []);
+  const providerRequirements = Object.freeze([...new Set([
+    ...requirementsFromMetadata(compiled.metadata), ...packageRequirements
+  ])]
     .map((id) => policy.classifyProviderRequirement(id, compilerCapabilities, context))
     .sort((a, b) => a.id.localeCompare(b.id)));
   const status = expectedProjectStatus(application, capabilities, providerRequirements, packages);

package/src/spine/bounded-pure-loop.js

@@ -0,0 +1,145 @@
+'use strict';
+
+const ts = require('typescript');
+function loadContract() {
+  try { return require('@pulse-compute/wasm-contracts/handler/canonical-native-plan'); }
+  catch (error) {
+    if (error && ['MODULE_NOT_FOUND', 'ERR_PACKAGE_PATH_NOT_EXPORTED'].includes(error.code)) return require('../../../contracts/src/handler/canonical-native-plan.js');
+    throw error;
+  }
+}
+const { CANONICAL_PURE_LOOP_LIMITS } = loadContract();
+
+function unwrap(node) {
+  while (node && (ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isTypeAssertionExpression(node) || ts.isNonNullExpression(node))) node = node.expression;
+  return node;
+}
+function number(node, expected) {
+  node = unwrap(node);
+  return node && ts.isNumericLiteral(node) && Number(node.text) === expected;
+}
+function named(node, name) { node = unwrap(node); return node && ts.isIdentifier(node) && node.text === name; }
+function firstConjunct(node) {
+  node = unwrap(node);
+  while (node && ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken) node = unwrap(node.left);
+  return node;
+}
+
+// Shared admission for original-source JavaScript and generated Native plans.
+// The literal bound is the first conjunct, so the terminating test cannot run
+// extra application expressions after the counter reaches its cap.
+function inspectBoundedPureLoop(statement, options = {}) {
+  const errors = [];
+  function fail(node, message) { errors.push({ node, message }); }
+  function expression(input, counters, mutation = true) {
+    const node = unwrap(input);
+    if (!node) return;
+    if (ts.isIdentifier(node)) {
+      if (node.text === options.ctxName) fail(node, 'Read context values before entering a pure loop.');
+      return;
+    }
+    if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node) || ts.isNumericLiteral(node)
+      || [ts.SyntaxKind.TrueKeyword, ts.SyntaxKind.FalseKeyword, ts.SyntaxKind.NullKeyword].includes(node.kind)) return;
+    if (ts.isPropertyAccessExpression(node)) {
+      if (node.questionDotToken) fail(node, 'Optional access is outside the bounded pure loop subset.');
+      expression(node.expression, counters, mutation); return;
+    }
+    if (ts.isElementAccessExpression(node)) {
+      if (node.questionDotToken) fail(node, 'Optional access is outside the bounded pure loop subset.');
+      expression(node.expression, counters, mutation); expression(node.argumentExpression, counters, mutation); return;
+    }
+    if (ts.isCallExpression(node)) {
+      const target = unwrap(node.expression);
+      if (!ts.isPropertyAccessExpression(target) || target.name.text !== 'trim' || node.arguments.length || node.questionDotToken || target.questionDotToken) {
+        fail(node, 'Pure loops admit only zero-argument string .trim() calls; effects, helpers and callbacks are separate contracts.'); return;
+      }
+      expression(target.expression, counters, false); return;
+    }
+    if (ts.isBinaryExpression(node)) {
+      const assignment = node.operatorToken.kind >= ts.SyntaxKind.FirstAssignment && node.operatorToken.kind <= ts.SyntaxKind.LastAssignment;
+      const target = unwrap(node.left);
+      if (assignment && !ts.isIdentifier(target) && !ts.isPropertyAccessExpression(target) && !ts.isElementAccessExpression(target)) fail(node, 'Destructuring assignment is outside the pure loop subset.');
+      if (assignment && (!mutation || [...counters].some(name => named(node.left, name)))) fail(node, 'Loop tests cannot mutate values, and loop counters cannot be assigned in the body.');
+      expression(node.left, counters, mutation); expression(node.right, counters, mutation); return;
+    }
+    if (ts.isPrefixUnaryExpression(node) || ts.isPostfixUnaryExpression(node)) {
+      const update = node.operator === ts.SyntaxKind.PlusPlusToken || node.operator === ts.SyntaxKind.MinusMinusToken;
+      if (update && (!mutation || [...counters].some(name => named(node.operand, name)))) fail(node, 'Loop tests cannot mutate values, and loop counters cannot be updated in the body.');
+      expression(node.operand, counters, mutation); return;
+    }
+    if (ts.isConditionalExpression(node)) {
+      expression(node.condition, counters, mutation); expression(node.whenTrue, counters, mutation); expression(node.whenFalse, counters, mutation); return;
+    }
+    if (ts.isTypeOfExpression(node) || ts.isVoidExpression(node)) { expression(node.expression, counters, mutation); return; }
+    if (ts.isArrayLiteralExpression(node)) {
+      for (const item of node.elements) expression(ts.isSpreadElement(item) ? item.expression : item, counters, mutation);
+      return;
+    }
+    if (ts.isObjectLiteralExpression(node)) {
+      for (const item of node.properties) {
+        if (ts.isSpreadAssignment(item)) expression(item.expression, counters, mutation);
+        else if (ts.isShorthandPropertyAssignment(item)) expression(item.name, counters, mutation);
+        else if (ts.isPropertyAssignment(item)) {
+          if (ts.isComputedPropertyName(item.name)) expression(item.name.expression, counters, mutation);
+          expression(item.initializer, counters, mutation);
+        } else fail(item, 'Methods and accessors are outside pure loop values.');
+      }
+      return;
+    }
+    if (ts.isTemplateExpression(node)) { for (const span of node.templateSpans) expression(span.expression, counters, mutation); return; }
+    fail(node, `${ts.SyntaxKind[node.kind]} is outside bounded pure loop expressions.`);
+  }
+  function body(node, counters, product) {
+    if (ts.isBlock(node)) { for (const child of node.statements) body(child, counters, product); return; }
+    if (ts.isForStatement(node)) { loop(node, counters, product); return; }
+    if (ts.isVariableStatement(node)) {
+      if (!(node.declarationList.flags & ts.NodeFlags.BlockScoped)) fail(node, 'Pure loop locals must use let or const.');
+      for (const declaration of node.declarationList.declarations) {
+        if (!ts.isIdentifier(declaration.name) || counters.has(declaration.name.text)) fail(declaration, 'Loop locals require identifiers and cannot shadow an active counter.');
+        if (declaration.initializer) expression(declaration.initializer, counters);
+      }
+      return;
+    }
+    if (ts.isIfStatement(node)) {
+      expression(node.expression, counters); body(node.thenStatement, counters, product);
+      if (node.elseStatement) body(node.elseStatement, counters, product); return;
+    }
+    if (ts.isExpressionStatement(node)) { expression(node.expression, counters); return; }
+    if (ts.isBreakStatement(node) || ts.isContinueStatement(node)) {
+      if (node.label) fail(node, 'Pure loop break and continue must be unlabelled.');
+      return;
+    }
+    if (ts.isEmptyStatement(node)) return;
+    fail(node, 'Pure loop bodies accept locals, value assignments, if/else, nested bounded for, break and continue only.');
+  }
+  function loop(node, inherited, product) {
+    const list = node.initializer;
+    const declaration = list && ts.isVariableDeclarationList(list) && list.declarations.length === 1 && list.declarations[0];
+    if (!declaration || !(list.flags & ts.NodeFlags.Let) || !ts.isIdentifier(declaration.name) || !number(declaration.initializer, 0)) {
+      fail(node, 'A bounded pure loop starts with for (let index = 0; ...; index++).'); return;
+    }
+    const name = declaration.name.text;
+    const bound = firstConjunct(node.condition);
+    if (!bound || !ts.isBinaryExpression(bound) || !named(bound.left, name) || bound.operatorToken.kind !== ts.SyntaxKind.LessThanToken || !ts.isNumericLiteral(unwrap(bound.right))) {
+      fail(node, 'The first loop condition must be index < a literal iteration cap.'); return;
+    }
+    const maxIterations = Number(unwrap(bound.right).text);
+    if (!Number.isInteger(maxIterations) || maxIterations < 0 || maxIterations > CANONICAL_PURE_LOOP_LIMITS.maxIterations || product * Math.max(1, maxIterations) > CANONICAL_PURE_LOOP_LIMITS.maxNestedIterations) {
+      fail(node, 'The literal loop cap or nested iteration product exceeds the portable limit.'); return;
+    }
+    const increment = unwrap(node.incrementor);
+    if (!increment || !((ts.isPostfixUnaryExpression(increment) || ts.isPrefixUnaryExpression(increment)) && increment.operator === ts.SyntaxKind.PlusPlusToken && named(increment.operand, name))
+      && !(ts.isBinaryExpression(increment) && increment.operatorToken.kind === ts.SyntaxKind.PlusEqualsToken && named(increment.left, name) && number(increment.right, 1))) {
+      fail(node, 'The loop increment must be index++ or index += 1.'); return;
+    }
+    if (inherited.has(name)) fail(declaration, 'Nested loop counters cannot shadow active counters.');
+    const counters = new Set([...inherited, name]);
+    expression(node.condition, counters, false);
+    body(node.statement, counters, product * Math.max(1, maxIterations));
+    return { name, maxIterations };
+  }
+  const result = loop(statement, new Set(), 1);
+  return { ...result, errors };
+}
+
+module.exports = { inspectBoundedPureLoop };

package/src/spine/handler-ir.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const ts = require('typescript');
+const { inspectBoundedPureLoop } = require('./bounded-pure-loop.js');
 const {
   extractFetchChain,
   extractKvNamespaceDeclaration,
@@ -185,25 +186,35 @@ function buildPlainHandlerIr(frontend, options = {}) {
   const continuationSites = [];
   const effectCounters = new Map();
   let continuationIndex = 0;
-  const packageEffectsByStart = new Map();
+  // Offsets belong to a source file. Project-wide contributions can share an
+  // offset; only duplicate ranges within the same owning source are invalid.
+  const sourceKey = (file, start) => `${String(file).replace(/\\/g, '/')}\u0000${start}`;
+  const inputKey = (input, start) => sourceKey(input.loc && input.loc.file || sourceFile.fileName, start);
+  const callKey = (call) => {
+    const owner = call.getSourceFile() || sourceFile;
+    return sourceKey(owner.fileName, call.getStart(owner));
+  };
+  const packageEffectsBySource = new Map();
   for (const effectInput of options.packageEffects || []) {
     if (!effectInput || effectInput.version !== canonicalRuntimeContract.CANONICAL_PACKAGE_EFFECT_VERSION || !effectInput.range) continue;
     const start = Number(effectInput.range.start);
-    if (!Number.isSafeInteger(start) || packageEffectsByStart.has(start)) {
+    const key = inputKey(effectInput, start);
+    if (!Number.isSafeInteger(start) || packageEffectsBySource.has(key)) {
       diagnostics.push(diagnostic(sourceFile, handler, 'PULSE_CANONICAL_PACKAGE_EFFECT_RANGE_INVALID', 'Package-owned canonical effects require unique source ranges.', { effect: effectInput }));
       continue;
     }
-    packageEffectsByStart.set(start, effectInput);
+    packageEffectsBySource.set(key, effectInput);
   }
-  const packageIntrinsicsByStart = new Map();
-  const linkedPackageIntrinsicsByStart = new Map();
+  const packageIntrinsicsBySource = new Map();
+  const linkedPackageIntrinsicsBySource = new Map();
   for (const intrinsicInput of options.packageIntrinsics || []) {
     const start = Number(intrinsicInput && intrinsicInput.range && intrinsicInput.range.start);
-    if (!Number.isSafeInteger(start) || packageIntrinsicsByStart.has(start)) {
+    const key = intrinsicInput && inputKey(intrinsicInput, start);
+    if (!Number.isSafeInteger(start) || packageIntrinsicsBySource.has(key)) {
       diagnostics.push(diagnostic(sourceFile, handler, 'PULSE_CANONICAL_PACKAGE_INTRINSIC_RANGE_INVALID', 'Package-owned intrinsics require unique source ranges.', { intrinsic: intrinsicInput }));
       continue;
     }
-    packageIntrinsicsByStart.set(start, intrinsicInput);
+    packageIntrinsicsBySource.set(key, intrinsicInput);
   }
 
   function unwrapPackageCall(expression) {
@@ -222,7 +233,7 @@ function buildPlainHandlerIr(frontend, options = {}) {
         return linked;
       }
     }
-    const effect = packageEffectsByStart.get(call.getStart(sourceFile));
+    const effect = packageEffectsBySource.get(callKey(call));
     if (effect) linkPackageIntrinsicsWithin(call);
     return effect;
   }
@@ -232,9 +243,11 @@ function buildPlainHandlerIr(frontend, options = {}) {
     if (typeof options.packageIntrinsicForCall === 'function') {
       const linked = options.packageIntrinsicForCall(call);
       if (linked) {
-        const start = call.getStart(sourceFile);
-        if (!linkedPackageIntrinsicsByStart.has(start)) {
-          linkedPackageIntrinsicsByStart.set(start, Object.freeze({
+        const owner = call.getSourceFile() || sourceFile;
+        const start = call.getStart(owner);
+        const key = callKey(call);
+        if (!linkedPackageIntrinsicsBySource.has(key)) {
+          linkedPackageIntrinsicsBySource.set(key, Object.freeze({
             ...linked,
             range: Object.freeze({ start, end: call.getEnd() })
           }));
@@ -242,9 +255,9 @@ function buildPlainHandlerIr(frontend, options = {}) {
         return linked;
       }
     }
-    const start = call.getStart(sourceFile);
-    const intrinsic = packageIntrinsicsByStart.get(start);
-    if (intrinsic && !linkedPackageIntrinsicsByStart.has(start)) linkedPackageIntrinsicsByStart.set(start, intrinsic);
+    const key = callKey(call);
+    const intrinsic = packageIntrinsicsBySource.get(key);
+    if (intrinsic && !linkedPackageIntrinsicsBySource.has(key)) linkedPackageIntrinsicsBySource.set(key, intrinsic);
     return intrinsic;
   }
 
@@ -623,8 +636,13 @@ function buildPlainHandlerIr(frontend, options = {}) {
         return createHandlerOperation('opaque-fetch-return', { statement, chain, site, continuation });
       }
     }
-    if (ts.isTryStatement(statement) || ts.isForStatement(statement) || ts.isForOfStatement(statement) || ts.isWhileStatement(statement) || ts.isDoStatement(statement) || ts.isSwitchStatement(statement)) {
-      diagnostics.push(diagnostic(sourceFile, statement, 'PULSE_CANONICAL_CONTROL_FLOW_UNSUPPORTED', 'The current canonical lowering supports straight-line code and if/else branching; loops, switch, and try/catch are reserved.'));
+    if (ts.isForStatement(statement)) {
+      const loop = inspectBoundedPureLoop(statement, { ctxName });
+      for (const error of loop.errors) diagnostics.push(diagnostic(sourceFile, error.node, 'PULSE_CANONICAL_PURE_LOOP_UNSUPPORTED', error.message));
+      return createHandlerOperation('source-statement', { statement, role: 'bounded-pure-loop' });
+    }
+    if (ts.isTryStatement(statement) || ts.isForInStatement(statement) || ts.isForOfStatement(statement) || ts.isWhileStatement(statement) || ts.isDoStatement(statement) || ts.isSwitchStatement(statement)) {
+      diagnostics.push(diagnostic(sourceFile, statement, 'PULSE_CANONICAL_CONTROL_FLOW_UNSUPPORTED', 'Canonical lowering supports if/else and literal-capped pure for loops; other loops, switch, and try/catch are reserved.'));
     }
     return createHandlerOperation('source-statement', { statement, role: 'preserved-source' });
   }
@@ -709,11 +727,9 @@ function buildPlainHandlerIr(frontend, options = {}) {
     effectSites: Object.freeze(effectSites),
     continuationSites: Object.freeze(continuationSites),
     packageEffects: Object.freeze([...(options.packageEffects || [])]),
-    packageIntrinsics: Object.freeze(
-      typeof options.packageIntrinsicForCall === 'function'
-        ? [...linkedPackageIntrinsicsByStart.values()]
-        : [...(options.packageIntrinsics || [])]
-    ),
+    // The emitter consumes this handler's linked ranges, not the project-wide
+    // recognition index. Keep original loc metadata when rebasing a range.
+    packageIntrinsics: Object.freeze([...linkedPackageIntrinsicsBySource.values()]),
     packageResultAdapters: Object.freeze([...(options.packageResultAdapters || [])]),
     summary: Object.freeze({
       operationCount: operationSummary.operationCount,

package/src/spine/handler-surface-authority.js

@@ -174,6 +174,9 @@ function extractProviderCall(expression, ctxName, kvAliases = new Map(), options
 
   if (receiver && ts.isPropertyAccessExpression(receiver) && isIdentifierNamed(receiver.expression, ctxName, options)) {
     const namespace = receiver.name.text;
+    if (namespace === 'time' && method === 'now' && current.arguments.length === 0) {
+      return Object.freeze({ call: current, surfaceId: 'ctx.time.now', kind: 'time.now', providerKind: 'time', operation: 'now', capability: 'time.wall-clock', args: Object.freeze([]) });
+    }
     if (namespace === 'config' && method === 'get' && current.arguments.length === 1) {
       return Object.freeze({ call: current, surfaceId: 'ctx.config.get', kind: 'config.get', providerKind: 'config', operation: 'get', capability: 'config.get', resource: current.arguments[0], name: current.arguments[0], args: Object.freeze([...current.arguments]) });
     }
@@ -264,6 +267,8 @@ function recognizeHandlerSurface(node, options = {}) {
         const direct = Object.freeze({
           param: 'ctx.param',
           json: 'ctx.json',
+          encodeJson: 'ctx.encodeJson',
+          decodeJson: 'ctx.decodeJson',
           text: 'ctx.text',
           response: 'ctx.response'
         });

package/src/spine/plain-handler-frontend.js

@@ -117,9 +117,11 @@ function analyzeHandler(sourceFile, handler, ctxName, diagnostics, schemaBundleI
   let schemaBoundJsonCount = 0;
   const forbiddenCalls = new Set(['require', 'setTimeout', 'setInterval', 'setImmediate', 'queueMicrotask', 'eval', 'Function']);
   const forbiddenRoots = new Set(['process', 'global', 'globalThis', 'Deno', 'Bun', 'Buffer', 'console', 'WebSocket', 'XMLHttpRequest', 'EventSource', 'Worker']);
+  const packageEffectRanges = new Set();
 
   for (const effect of options.packageEffects || []) {
     if (effect && effect.capability) capabilities.add(String(effect.capability));
+    if (effect && effect.range) packageEffectRanges.add(`${effect.range.start}:${effect.range.end}`);
   }
 
   function reject(node, code, message, detail = {}) {
@@ -173,7 +175,7 @@ function analyzeHandler(sourceFile, handler, ctxName, diagnostics, schemaBundleI
       );
       return;
     }
-    const encode = usage === 'response-encode' || usage === 'fetch-encode';
+    const encode = usage === 'response-encode' || usage === 'fetch-encode' || usage === 'value-encode';
     schemaReferences.push(Object.freeze({
       id: schemaId,
       usage,
@@ -319,7 +321,12 @@ function analyzeHandler(sourceFile, handler, ctxName, diagnostics, schemaBundleI
         if (root && forbiddenRoots.has(root)) reject(node, 'PULSE_CANONICAL_AMBIENT_AUTHORITY_UNSUPPORTED', `Ambient ${root} authority is not available in canonical user scope.`, { identifier: root });
         if (root === 'Date' && node.expression.name.text === 'now') reject(node, 'PULSE_CANONICAL_NONDETERMINISM_UNSUPPORTED', 'Ambient clock access is not available in canonical user scope.');
         if (root === 'Math' && node.expression.name.text === 'random') reject(node, 'PULSE_CANONICAL_NONDETERMINISM_UNSUPPORTED', 'Ambient randomness is not available in canonical user scope.');
-        if (root === 'crypto') reject(node, 'PULSE_CANONICAL_AMBIENT_AUTHORITY_UNSUPPORTED', 'Ambient crypto authority is not available in canonical user scope.', { identifier: 'crypto' });
+        // A trusted package can own this exact call; its arguments still pass
+        // through ordinary ambient-authority validation below.
+        const packageEffect = typeof options.packageEffectForCall === 'function'
+          ? options.packageEffectForCall(node)
+          : packageEffectRanges.has(`${node.getStart(sourceFile)}:${node.getEnd()}`);
+        if (root === 'crypto' && !packageEffect) reject(node, 'PULSE_CANONICAL_AMBIENT_AUTHORITY_UNSUPPORTED', 'Ambient crypto authority is not available in canonical user scope.', { identifier: 'crypto' });
 
         const target = node.expression;
         const surface = recognizeHandlerSurface(node, { ctxName });
@@ -335,6 +342,14 @@ function analyzeHandler(sourceFile, handler, ctxName, diagnostics, schemaBundleI
               validateFetchSchema(node);
             }
             if (surface.detail.fetch.decoderCall === node) validateDecoderCall(node, 'fetch-decode');
+          } else if (surface.surfaceId === 'ctx.encodeJson' || surface.surfaceId === 'ctx.decodeJson') {
+            const usage = surface.surfaceId === 'ctx.decodeJson' ? 'text-decode' : 'value-encode';
+            if (node.arguments.length !== 2) {
+              reject(node, 'PULSE_CANONICAL_DECODER_ARGUMENTS_UNSUPPORTED', `${surface.surfaceId} requires exactly ${usage === 'text-decode' ? 'JSON text' : 'a value'} and a registered literal schema ID.`, { usage, arguments: node.arguments.length });
+            } else {
+              recordSchemaReference(node, node.arguments[1], usage);
+              schemaBoundJsonCount += 1;
+            }
           } else if (['ctx.json', 'ctx.text', 'ctx.response'].includes(surface.surfaceId)) {
             const method = surface.surfaceId.slice('ctx.'.length);
             capabilities.add(`response.${method}`);

package/src/spine/router-handler-frontend.js

@@ -327,7 +327,7 @@ function normalizeRouterHandler(topology, descriptor, recognition, classificatio
       role,
       nextIndex: entry.nextIndex,
       transferFlag,
-      clearNormalMode: call.arguments.length === 0 && role !== 'error',
+      clearNormalMode: call.arguments.length === 0,
       errorExpression: call.arguments.length > 0 ? rewrite(call.arguments[0]) : undefined
     });
   }