@pulse-compute/wasm-contracts 1.0.0-beta.4 → 1.0.0-beta.6

package/README.md

@@ -7,9 +7,9 @@
 > **Supported entry points:** `@pulse-compute/wasm-contracts/provider/toolchain`<br>
 > **Stability:** The provider toolchain contract is versioned and supported for the Beta; other protocol and proof interfaces remain internal.<br>
 > **npm:** [`@pulse-compute/wasm-contracts`](https://www.npmjs.com/package/@pulse-compute/wasm-contracts)<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.4/packages/implementation-packages/)
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.6/packages/implementation-packages/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.4` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.6` package policy.
 <!-- pulse-package-status:end -->
 
 This package owns stable data contracts shared by the compiler, runtime, and providers.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-compute/wasm-contracts",
-  "version": "1.0.0-beta.4",
+  "version": "1.0.0-beta.6",
   "license": "Apache-2.0",
   "engines": {
     "node": "^22.14.0 || ^24.0.0"
@@ -126,7 +126,7 @@
     "url": "git+https://github.com/pulse-compute/pulse.git",
     "directory": "wasm/packages/contracts"
   },
-  "homepage": "https://pulsecompute.io/v1.0.0-beta.4/packages/implementation-packages/",
+  "homepage": "https://pulsecompute.io/v1.0.0-beta.6/packages/implementation-packages/",
   "bugs": {
     "url": "https://github.com/pulse-compute/pulse/issues"
   }

package/src/assets/contracts.js

@@ -37,7 +37,7 @@ const ASSETS_INITIAL_PROVIDER_TARGETS = Object.freeze(['node', 'fastly']);
 
 const ASSETS_PAYLOAD_MODE_STATUSES = LOWERABLE_LIBRARY_PAYLOAD_MODE_STATUSES;
 
-const ASSETS_SUPPORTED_BODY_KINDS = Object.freeze(['text-response-body']);
+const ASSETS_SUPPORTED_BODY_KINDS = Object.freeze(['text-response-body', 'embedded-blob-response']);
 const ASSETS_LOWERING_PLAN_ONLY_BODY_KINDS = Object.freeze(['stream-pass-through-response']);
 const ASSETS_RESERVED_BODY_KINDS = Object.freeze(['binary-buffer']);
 const ASSETS_UNSUPPORTED_BODY_KINDS = Object.freeze(['json-response-body']);
@@ -78,6 +78,11 @@ const ASSETS_DIAGNOSTIC_CODES = Object.freeze({
 });
 
 const ASSETS_PAYLOAD_MODE_CLASSIFICATION = Object.freeze({
+  embeddedBlobResponse: Object.freeze({
+    mode: 'embedded-blob-response', status: 'implemented-now', hostResultKind: 'opaque-response',
+    hostCapabilities: Object.freeze(['assets', 'result']), owner: '@pulse-compute/assets',
+    notes: 'Native-only, compile-time admitted embeddedManifest literal; bounded selected bytes remain provider-owned.'
+  }),
   textResponseBody: Object.freeze({
     mode: 'text-response-body',
     status: 'implemented-now',
@@ -249,6 +254,7 @@ function assetsProtocolExtension() {
 }
 
 module.exports = {
+  ...require('./embedded.js'),
   ASSETS_CONTRACT_VERSION,
   ASSETS_HOST_ABI_VERSION,
   ASSETS_PROVIDER_CONFIG_VERSION,

package/src/assets/embedded.as.ts

@@ -0,0 +1,48 @@
+// Native counterpart of embeddedAssetResponse; inputs are admitted by the Assets lowerer.
+class __PulseEmbeddedSelection {
+  status: i32 = 200; start: i32 = 0; end: i32 = -1; contentRange: string = '';
+}
+function __pulse_embedded_decimal(value: string): f64 {
+  if (!value.length || (value.length > 1 && value.charCodeAt(0) == 48)) return -1;
+  let output: f64 = 0;
+  for (let i = 0; i < value.length; i++) {
+    const digit = value.charCodeAt(i) - 48; if (digit < 0 || digit > 9) return -1;
+    output = output * 10 + digit; if (output > 9007199254740991) return -1;
+  }
+  return output;
+}
+function __pulse_embedded_selection(length: i32, method: string, etag: string, validator: string | null, range: string | null, ifRange: string | null): __PulseEmbeddedSelection {
+  const output = new __PulseEmbeddedSelection(); output.end = length - 1;
+  if (length < 0) { output.status = 404; return output; }
+  if (validator !== null) {
+    let tag = validator;
+    if (tag.startsWith('W/')) tag = tag.slice(2);
+    if (validator != '*') {
+      if (tag.length < 2 || tag.charAt(0) != '"' || tag.charAt(tag.length - 1) != '"') { output.status = 400; return output; }
+      for (let i = 1; i < tag.length - 1; i++) if (tag.charCodeAt(i) < 33 || tag.charCodeAt(i) > 126 || tag.charCodeAt(i) == 34) { output.status = 400; return output; }
+    }
+    if (validator == '*' || tag == etag) { output.status = 304; return output; }
+  }
+  if (method == 'GET' && range !== null && (ifRange === null || ifRange == etag)) {
+    if (!range.startsWith('bytes=')) { output.status = 400; return output; }
+    const parts = range.slice(6).split('-');
+    if (parts.length != 2) { output.status = 400; return output; }
+    const start = __pulse_embedded_decimal(parts[0]), end = __pulse_embedded_decimal(parts[1]);
+    if (start < 0 || end < start) { output.status = 400; return output; }
+    if (start >= length) { output.status = 416; output.contentRange = 'bytes */' + length.toString(); return output; }
+    output.start = i32(start); output.end = i32(Math.min(end, f64(length - 1))); output.status = 206;
+    output.contentRange = 'bytes ' + output.start.toString() + '-' + output.end.toString() + '/' + length.toString();
+  }
+  return output;
+}
+function __pulse_embedded_bytes(data: string, start: i32, end: i32): Uint8Array {
+  const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+  const output = new Uint8Array(max<i32>(0, end - start + 1));
+  // Decode only the selected interval, without a full-file temporary copy.
+  for (let index = start; index <= end; index++) {
+    const group = (index / 3) * 4, part = index % 3;
+    const a = alphabet.indexOf(data.charAt(group + part)), b = alphabet.indexOf(data.charAt(group + part + 1));
+    output[index - start] = u8(part == 0 ? (a << 2) | (b >> 4) : part == 1 ? (a << 4) | (b >> 2) : (a << 6) | b);
+  }
+  return output;
+}

package/src/assets/embedded.js

@@ -0,0 +1,63 @@
+'use strict';
+// Compile-time admission and host response policy for explicitly embedded bytes.
+const LIMITS = Object.freeze({ files:256, fileBytes:262144, totalBytes:1048576, pathBytes:1024, serializedBytes:2097152 });
+const VERSION = 'pulse.embedded-assets.v1';
+function fail() { throw new TypeError('Invalid or oversized embedded asset manifest.'); }
+function fields(value, names) {
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length !== names.length || names.some(name=>!Object.hasOwn(value,name))) fail();
+}
+function assetPath(value) {
+  if (typeof value !== 'string' || !value.isWellFormed() || !value.startsWith('/') || value === '/' || Buffer.byteLength(value)>LIMITS.pathBytes
+    || /[\\%?#\u0000-\u001f\u007f-\u009f]/u.test(value) || value.slice(1).split('/').some(p=>!p||p==='.'||p==='..')) fail();
+  return value;
+}
+function selectEmbeddedAsset(serialized, key) {
+  if (typeof serialized !== 'string' || serialized.length > LIMITS.serializedBytes || Buffer.byteLength(serialized)>LIMITS.serializedBytes) fail();
+  let manifest; try { manifest=JSON.parse(serialized); } catch { fail(); }
+  // Canonical serialization rejects duplicate fields and ambiguous encodings.
+  if (JSON.stringify(manifest)!==serialized) fail();
+  fields(manifest,['version','id','byteLength','files']);
+  if (manifest.version!==VERSION || !Array.isArray(manifest.files) || manifest.files.length>LIMITS.files) fail();
+  const hash = value=>require('node:crypto').createHash('sha256').update(value).digest('hex');
+  let total=0,previous='';
+  for (const file of manifest.files) {
+    fields(file,['path','data','byteLength','sha256','contentType']);
+    const path=assetPath(file.path);
+    if (path<=previous || !Number.isInteger(file.byteLength) || file.byteLength<0 || file.byteLength>LIMITS.fileBytes
+      || typeof file.contentType!=='string' || !/^[\x20-\x7e]{1,128}$/.test(file.contentType) || file.contentType.trim()!==file.contentType
+      || typeof file.data!=='string' || file.data.length!==4*Math.ceil(file.byteLength/3)) fail();
+    previous=path; total+=file.byteLength; if(total>LIMITS.totalBytes) fail();
+    const bytes=Buffer.from(file.data,'base64');
+    if(bytes.length!==file.byteLength || bytes.toString('base64')!==file.data || hash(bytes)!==file.sha256) fail();
+  }
+  if(manifest.byteLength!==total || hash(JSON.stringify([VERSION,manifest.files.map(f=>[f.path,f.contentType,f.byteLength,f.sha256])]))!==manifest.id) fail();
+  assetPath(key);
+  const file=manifest.files.find(f=>f.path===key);
+  return Object.freeze({embeddedId:manifest.id,embeddedFound:!!file,embeddedData:file?.data??'',embeddedLength:file?.byteLength??0,embeddedType:file?.contentType??'',embeddedEtag:file?`"${file.sha256}"`:''});
+}
+function embeddedAssetResponse(payload, requestHeaders) {
+  const headers=new Headers(requestHeaders), output=new Headers();
+  const length=payload.embeddedLength;
+  if(!payload.embeddedFound) return {status:404,headers:output,bytes:null};
+  if(!Number.isInteger(length)||length<0||length>LIMITS.fileBytes||typeof payload.embeddedData!=='string'||payload.embeddedData.length!==4*Math.ceil(length/3)) fail();
+  output.set('content-type',payload.embeddedType); output.set('etag',payload.embeddedEtag); output.set('accept-ranges','bytes');
+  const validator=headers.get('if-none-match');
+  if(validator!==null) {
+    if(!/^(?:\*|(?:W\/)?"[\x21\x23-\x7e]*")$/.test(validator)) return {status:400,headers:new Headers(),bytes:null};
+    if(validator==='*'||validator.replace(/^W\//,'')===payload.embeddedEtag) return {status:304,headers:output,bytes:null};
+  }
+  let start=0,end=length-1,status=200;
+  const range=headers.get('range'), ifRange=headers.get('if-range');
+  if(payload.method==='GET'&&range!==null&&(ifRange===null||ifRange===payload.embeddedEtag)) {
+    const match=/^bytes=(0|[1-9][0-9]*)-(0|[1-9][0-9]*)$/.exec(range);
+    if(!match||!Number.isSafeInteger(Number(match[2]))||Number(match[1])>Number(match[2])) return {status:400,headers:new Headers(),bytes:null};
+    start=Number(match[1]);end=Math.min(Number(match[2]),end);
+    if(start>=length){output.set('content-range',`bytes */${length}`);return {status:416,headers:output,bytes:null};}
+    status=206;output.set('content-range',`bytes ${start}-${end}/${length}`);
+  }
+  output.set('content-length',String(Math.max(0,end-start+1)));
+  const bytes=payload.method==='HEAD'?null:Buffer.from(payload.embeddedData,'base64').subarray(start,end+1);
+  return {status,headers:output,bytes};
+}
+function embeddedNativeSource() { return require('node:fs').readFileSync(require('node:path').join(__dirname,'embedded.as.ts'),'utf8'); }
+module.exports={embeddedNativeSource,EMBEDDED_ASSET_NATIVE_LIMITS:LIMITS,selectEmbeddedAsset,embeddedAssetResponse};

package/src/crypto/contracts.js

@@ -23,8 +23,15 @@ const CRYPTO_VERIFICATION_STATUSES = Object.freeze([
   'realization-failure'
 ]);
 
-const CRYPTO_ALGORITHMS = Object.freeze(['HS256', 'ES256', 'SHA-256', 'HMAC-SHA256']);
+const CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION = 'webcrypto.subtle.rsassa-pkcs1-v1_5-sha-256.v1';
+const CRYPTO_RS256_GUEST_LINKED_REALIZATION = 'guest-linked:pulse-rs256-bearssl-i31';
+const CRYPTO_RS256_GUEST_LINKED_IMPLEMENTATION = 'bearssl.0.6.rsa-i31.sha256.v1';
+const CRYPTO_ALGORITHMS = Object.freeze(['HS256', 'ES256', 'RS256', 'SHA-256', 'HMAC-SHA256']);
 const CRYPTO_REALIZATIONS = Object.freeze([
+  { id: 'runtime-builtin', kind: 'runtime-builtin', algorithm: 'RS256', targets: ['javascript'], implementation: CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION },
+  { id: CRYPTO_RS256_GUEST_LINKED_REALIZATION, kind: 'guest-linked', algorithm: 'RS256', targets: ['native'],
+    backend: 'pulse-rs256-bearssl-i31', implementation: CRYPTO_RS256_GUEST_LINKED_IMPLEMENTATION,
+    source: { package: '@pulse-compute/crypto', export: './pulsewasm-native', contractVersion: 'pulse.guest-unit-contribution.v1', contribution: 'pulseEs256GuestUnit' } },
   ...['SHA-256', 'HMAC-SHA256'].map((algorithm) => Object.freeze({
     id: 'runtime-builtin', kind: 'runtime-builtin', algorithm, targets: Object.freeze(['javascript']),
     implementation: algorithm === 'SHA-256' ? 'webcrypto.subtle.sha-256-bytes.v1' : 'webcrypto.subtle.hmac-sha-256-bytes.v1'
@@ -148,7 +155,7 @@ const CRYPTO_ES256_CONTRACT = deepFreeze({
     unitId: 'pulse.crypto.es256.rustcrypto-p256.v1',
     module: 'pulse_crypto_es256',
     owner: '@pulse-compute/crypto',
-    abi: 'pulse.crypto.es256.verify.v1',
+    abi: 'pulse.crypto.es256-rs256.verify-and-sign.v3',
     export: {
       name: 'pulse_crypto_es256_verify',
       parameters: ['i32', 'i32'],
@@ -594,7 +601,7 @@ function planCryptoRealizations(input = {}) {
     const requirement = requirements.algorithms.find((entry) => entry.algorithm === configured.algorithm);
     return {
       algorithm: configured.algorithm,
-      primitive: configured.algorithm === 'ES256'
+      primitive: configured.algorithm === 'RS256' ? Object.freeze({ kind: 'rsa-pkcs1-v1_5', hash: 'SHA-256' }) : configured.algorithm === 'ES256'
         ? Object.freeze({ kind: 'ecdsa', curve: 'P-256', hash: 'SHA-256' })
         : Object.freeze({ kind: configured.algorithm === 'SHA-256' ? 'digest' : 'hmac', hash: 'SHA-256' }),
       requestedBy: requirement ? requirement.requestedBy : Object.freeze([]),
@@ -623,6 +630,7 @@ function planCryptoRealizations(input = {}) {
 }
 
 module.exports = Object.freeze({
+  CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_RS256_GUEST_LINKED_REALIZATION, CRYPTO_RS256_GUEST_LINKED_IMPLEMENTATION,
   CRYPTO_CONFIGURATION_VERSION,
   CRYPTO_TARGET_CAPABILITIES_VERSION,
   CRYPTO_REQUIREMENTS_VERSION,

package/src/definitions/router-api.js

@@ -41,9 +41,10 @@ const ROUTER_API_DEFINITIONS = Object.freeze([
     name: 'mount',
     kind: 'mount',
     opKind: 'mount',
-    allowedArities: Object.freeze([2]),
+    allowedArities: Object.freeze([2, 3]),
     signatures: Object.freeze([
-      Object.freeze({ arity: 2, pathArg: 0, routerArg: 1 })
+      Object.freeze({ arity: 2, pathArg: 0, routerArg: 1 }),
+      Object.freeze({ arity: 3, pathArg: 0, routerArg: 1, eligibilityArg: 2 })
     ]),
     pathPolicy: 'mount-static'
   }),

package/src/diagnostics/codes.js

@@ -10,6 +10,7 @@ const DIAGNOSTIC_CODES = Object.freeze({
   UNSUPPORTED_HANDLER: 'PULSEWASM_UNSUPPORTED_HANDLER',
   UNSUPPORTED_CHANNEL: 'PULSEWASM_UNSUPPORTED_CHANNEL',
   UNSUPPORTED_LIFECYCLE: 'PULSEWASM_UNSUPPORTED_LIFECYCLE',
+  UNSUPPORTED_MOUNT_ELIGIBILITY: 'PULSEWASM_UNSUPPORTED_MOUNT_ELIGIBILITY',
   UNSUPPORTED_MOUNT_TARGET: 'PULSEWASM_UNSUPPORTED_MOUNT_TARGET',
   COMPUTED_METHOD: 'PULSEWASM_COMPUTED_METHOD',
   DYNAMIC_ROUTE_REGISTRATION: 'PULSEWASM_DYNAMIC_ROUTE_REGISTRATION',

package/src/diagnostics.js

@@ -2,7 +2,7 @@
 
 const path = require('node:path');
 
-const PACKAGE_VERSION = 'pulsewasm-route-extractor@1.0.0-beta.4';
+const PACKAGE_VERSION = 'pulsewasm-route-extractor@1.0.0-beta.6';
 const DIAGNOSTICS_VERSION = 'pulsewasm.diagnostics.v1';
 
 function stableFileName(fileName, cwd) {

package/src/entities/contracts.d.ts

@@ -71,6 +71,7 @@ declare const contracts: {
   normalizeStaticMetadata(value: unknown, limits?: EntitiesLimits): Readonly<Record<string, unknown>> | undefined;
   normalizeEntityDeclaration(input: unknown, limits?: EntitiesLimits): NormalizedEntityDeclaration;
   normalizeHandler<T extends Function>(handler: T): T;
+  nativeEntitySchemaIssue(schema: Readonly<{ id: string; root?: unknown; jsonLimits?: unknown }>): Readonly<{ schemaId: string; reason: string; path: string; kind?: string }> | null;
   normalizeHandlerReference(input: unknown): Readonly<Record<string, string>>;
   normalizeJsonRpcAdapterOptions(input?: Readonly<{ namedParamsOnly?: true; acceptEmptyObjectForNoInput?: boolean }>): Readonly<{
     namedParamsOnly: true;

package/src/entities/contracts.js

@@ -98,6 +98,26 @@ function normalizeEntityPlan(input) {
   return Object.freeze({ ...normalized, planHash: sha256Hex(stableStringify(normalized)) });
 }
 
+// One capability decision shared by catalog inspection and Native source
+// generation. Closed typed nesting is implemented; dynamic JSON and explicit
+// admission policies must never be silently projected or ignored.
+function nativeEntitySchemaIssue(schema) {
+  if (schema.jsonLimits) return Object.freeze({ schemaId: schema.id, reason: 'json-admission-not-realized', path: 'root' });
+  function visit(node, path) {
+    if (!node) return null; // Declaration-only compiler passes have no schema IR.
+    if (node.additionalProperties) return { schemaId: schema.id, reason: 'open-object-not-realized', path };
+    if (['scalar-record', 'json-value', 'json-object'].includes(node.kind)) return { schemaId: schema.id, reason: 'dynamic-json-not-realized', path, kind: node.kind };
+    if (node.kind === 'nullable') return visit(node.value, path + '.value');
+    if (node.kind === 'array') return visit(node.element, path + '[]');
+    if (node.kind === 'object') {
+      for (const field of node.fields) { const issue = visit(field.value, path + '.' + field.name); if (issue) return issue; }
+    }
+    return null;
+  }
+  const issue = visit(schema.root, 'root');
+  return issue ? Object.freeze(issue) : null;
+}
+
 module.exports = Object.freeze({
   ...runtime,
   ENTITIES_PACKAGE_VERSION,
@@ -116,6 +136,7 @@ module.exports = Object.freeze({
   ENTITIES_PACKAGE_INTRINSIC_VERSION,
   ENTITIES_PUBLIC_SYMBOLS,
   ENTITIES_PACKAGE_INTRINSICS,
+  nativeEntitySchemaIssue,
   normalizeHandlerReference,
   normalizeEntityRegistry,
   normalizeEntityPlan

package/src/handler/canonical-native-plan.js

@@ -1,19 +1,50 @@
 'use strict';
 
-const CANONICAL_NATIVE_PLAN_VERSION = 'pulse.canonical-native-plan.v2';
+const CANONICAL_NATIVE_PLAN_VERSION = 'pulse.canonical-native-plan.v9';
+const CANONICAL_NATIVE_PURE_LOOP_CALL_VERSION = 'pulse.bounded-pure-loop-call.v1';
+const CANONICAL_NATIVE_TYPED_KV_BORROW_VERSION = 'pulse.typed-kv-borrow.v1';
+const CANONICAL_NATIVE_PURE_BORROW_VERSION = 'pulse.pure-borrow.v1';
+const CANONICAL_NATIVE_PURE_HELPER_VERSION = 'pulse.canonical-native-pure-helper.v2';
+const CANONICAL_NATIVE_HANDLER_BODY_VERSION = 'pulse.canonical-native-handler-body.v1';
+const CANONICAL_NATIVE_STAGE_CONTRACT = Object.freeze({
+  version: 'pulse.canonical-native-stage.v1',
+  maxEffectSites: 64,
+  outputs: Object.freeze(['response', 'next', 'error', 'suspend', 'failure']),
+  frame: Object.freeze({ lifetime: 'invocation', reset: 'stage-entry', suspension: 'retain', nesting: false })
+});
 const CANONICAL_NATIVE_PLAN_HASH_ALGORITHM = 'sha256';
 const CANONICAL_NATIVE_PLAN_OWNERSHIP_VERSION = 'pulse.canonical-native-ownership.v1';
+const CANONICAL_PURE_LOOP_LIMITS = Object.freeze({ maxIterations: 1024, maxNestedIterations: 65536 });
+const CANONICAL_READ_LOOP_CONTRACT = Object.freeze({
+  version: 'pulse.bounded-read-loop.v1',
+  maxIterations: 64,
+  maxNestedIterations: CANONICAL_PURE_LOOP_LIMITS.maxNestedIterations,
+  effectKinds: Object.freeze(['s3.getText', 'kv.getVersioned', 'crypto.digestText', 'output.write', 'output.readTextChunk']),
+  valueIntrinsics: Object.freeze(['schema.decode.text', 'schema.encode.text', 'response.text', 'response.json', 'response.custom']),
+  nestedEffects: false,
+  helperCallVersion: 'pulse.bounded-read-loop-helper.v1',
+  continueTarget: 'increment',
+  breakTarget: 'exit'
+});
 
 const CANONICAL_NATIVE_STATEMENT_KINDS = Object.freeze([
   'local',
   'effect',
   'effect-group',
   'if',
+  'pure-loop',
+  'read-loop',
+  'break',
+  'continue',
   'return',
+  'handler-call',
+  'helper-call',
+  'stage-call',
   'expression'
 ]);
 
 const CANONICAL_NATIVE_EXPRESSION_KINDS = Object.freeze([
+  'pure-helper-call',
   'literal',
   'undefined',
   'local',
@@ -42,11 +73,15 @@ const CANONICAL_NATIVE_CONTEXT_READS = Object.freeze([
 ]);
 
 const CANONICAL_NATIVE_INTRINSICS = Object.freeze([
+  'package.application',
   'request.header',
   'request.text',
+  'request.body.forward-marker',
+  'response.output.close',
   'request.json',
   'response.json',
   'schema.encode.text',
+  'schema.decode.text',
   'response.text',
   'response.custom',
   'kv.namespace',
@@ -119,7 +154,23 @@ const CANONICAL_NATIVE_PLAN_POLICY = Object.freeze({
   javascriptRuntime: false,
   promiseSemantics: false,
   asyncify: false,
-  controlFlow: 'structured straight-line statements plus if/else branches',
+  controlFlow: 'structured statements, if/else, literal-capped pure for loops and non-nested bounded sequential read loops',
+  handlerBodies: Object.freeze({
+    version: CANONICAL_NATIVE_HANDLER_BODY_VERSION,
+    family: 'terminal HTTP route bodies without next transfer',
+    calls: 'one static tail call from the dispatcher; no recursion or captured locals',
+    outcomes: 'response, suspension, normalized application-error transfer, terminal failure',
+    suspension: 'resume the owning body by program counter; no live call stack',
+    budget: 'one charge per original state; the call reference adds no state'
+  }),
+  sharedStages: Object.freeze({
+    version: CANONICAL_NATIVE_STAGE_CONTRACT.version,
+    family: 'transfer-capable HTTP routes and middleware with 1..64 bound sequential text-fetch, time.now or crypto.digestText sites',
+    inputs: 'request context, stage-owned locals and registration-owned return/effect/continuation bindings',
+    outputs: 'response, next, error, suspension or terminal failure',
+    calls: 'dispatcher admission only; bounded pure loops retain canonical caps; no captures, recursion, helper calls, groups or effect loops',
+    suspension: 'one invocation-owned frame; reset locals at entry and retain across suspension'
+  }),
   suspension: 'explicit effect and effect-group statements with stable continuation IDs',
   values: 'versioned JSON expression tree with stable local identities',
   logging: 'compile-time threshold pruning plus synchronous provider-adapter emission',
@@ -129,7 +180,15 @@ const CANONICAL_NATIVE_PLAN_POLICY = Object.freeze({
 });
 
 module.exports = Object.freeze({
+  CANONICAL_NATIVE_PURE_LOOP_CALL_VERSION,
+  CANONICAL_NATIVE_PURE_BORROW_VERSION,
+  CANONICAL_NATIVE_TYPED_KV_BORROW_VERSION,
+  CANONICAL_NATIVE_PURE_HELPER_VERSION,
   CANONICAL_NATIVE_PLAN_VERSION,
+  CANONICAL_NATIVE_HANDLER_BODY_VERSION,
+  CANONICAL_NATIVE_STAGE_CONTRACT,
+  CANONICAL_PURE_LOOP_LIMITS,
+  CANONICAL_READ_LOOP_CONTRACT,
   CANONICAL_NATIVE_PLAN_HASH_ALGORITHM,
   CANONICAL_NATIVE_PLAN_OWNERSHIP_VERSION,
   CANONICAL_NATIVE_STATEMENT_KINDS,

package/src/handler/canonical-native-runtime.js

@@ -2,9 +2,34 @@
 
 const CANONICAL_NATIVE_WASM_VERSION = 'pulse.canonical-native-wasm.v2';
 const CANONICAL_NATIVE_ABI_VERSION = 2;
-const CANONICAL_NATIVE_AS_GENERATOR_VERSION = 'pulse.canonical-native-as-generator.v3';
+const CANONICAL_NATIVE_AS_GENERATOR_VERSION = 'pulse.canonical-native-as-generator.v9';
 const CANONICAL_NATIVE_COMPILER_VERSION = 'pulse.canonical-native-wasm-compiler.v3';
-const CANONICAL_NATIVE_HOST_VERSION = 'pulse.canonical-native-host.v3';
+const CANONICAL_NATIVE_HOST_VERSION = 'pulse.canonical-native-host.v4';
+
+// Execution-wide containment for plans with bounded storage-read loops. These
+// are accounting limits, not a JavaScript process/RSS limit. Native providers
+// retain handles until completion; no iteration reset may refund this budget.
+const CANONICAL_NATIVE_READ_LOOP_MEMORY = Object.freeze({
+  version: 'pulse.native-read-loop-memory.v1',
+  maxBytes: 64 * 1024 * 1024,
+  maxValues: 1024 * 1024,
+  valueBytes: 32,
+  edgeBytes: 8,
+  maximumMemoryPages: 4096,
+  lifetime: 'execution',
+  reclamation: 'retain-until-terminal'
+});
+
+function hasBoundedReadLoop(plan) {
+  function visit(node) {
+    if (!node || typeof node !== 'object') return false;
+    return node.kind === 'read-loop' || Object.values(node).some(visit);
+  }
+  return visit(plan && plan.entry) || visit(plan && plan.handlers) || visit(plan && plan.helpers);
+}
+
+// Optional data-only host-to-guest JSON copy. UTF-8 accounting precedes guest allocation.
+const CANONICAL_NATIVE_VALUE_TRANSFER_MAX_BYTES = 1024 * 1024;
 
 const CANONICAL_NATIVE_RUN_STATUS = Object.freeze({
   COMPLETE: 0,
@@ -44,6 +69,8 @@ const CANONICAL_NATIVE_ASSIGNMENT_OPERATORS = Object.freeze([
 const CANONICAL_NATIVE_IMPORT_MODULE = 'pulse_host';
 const CANONICAL_NATIVE_ALLOWED_ENV_IMPORTS = Object.freeze(['abort', 'seed']);
 const CANONICAL_NATIVE_IMPORTS = Object.freeze([
+  // Optional, bounded JSON transfer into a managed guest string; no host authority.
+  ['value_json', ['i32'], ['i32']],
   ['value_undefined', [], ['i32']],
   ['value_null', [], ['i32']],
   ['value_boolean', ['i32'], ['i32']],
@@ -63,6 +90,7 @@ const CANONICAL_NATIVE_IMPORTS = Object.freeze([
   ['value_unary', ['i32', 'i32'], ['i32']],
   ['value_truthy', ['i32'], ['i32']],
   ['value_nullish', ['i32'], ['i32']],
+  ['value_string_trim', ['i32'], ['i32']],
   ['log', ['i32', 'i32'], []],
   ['request_method', [], ['i32']],
   ['request_url', [], ['i32']],
@@ -70,12 +98,20 @@ const CANONICAL_NATIVE_IMPORTS = Object.freeze([
   ['request_headers', [], ['i32']],
   ['request_header', ['i32'], ['i32']],
   ['request_text', [], ['i32']],
+  // Optional incoming-request-v1 extension: execution-local opaque marker,
+  // never a guest byte buffer or an invocation ticket. Older hosts fail import validation.
+  ['request_body', [], ['i32']],
   ['request_json', ['i32'], ['i32']],
   ['router_match', ['i32', 'i32'], ['i32']],
   ['router_param', ['i32', 'i32', 'i32'], ['i32']],
+  // 0: no failure; positive: application error handle; negative: terminal failure.
+  ['router_error_take', [], ['i32']],
   ['response_json', ['i32', 'i32'], ['i32']],
   ['schema_encode', ['i32', 'i32'], ['i32']],
+  ['schema_decode', ['i32', 'i32'], ['i32']],
   ['response_text', ['i32', 'i32'], ['i32']],
+  // Optional output-v1 extension, required only by generated-output artifacts.
+  ['output_close', [], ['i32']],
   ['response_custom', ['i32'], ['i32']],
   ['grip_is_websocket', [], ['i32']],
   ['grip_subscribe', ['i32', 'i32'], ['i32']],
@@ -115,6 +151,21 @@ const CANONICAL_NATIVE_IMPORT_NAMES = Object.freeze(CANONICAL_NATIVE_IMPORTS.map
 const CANONICAL_NATIVE_EXPORT_NAMES = Object.freeze(CANONICAL_NATIVE_EXPORTS.map(([name]) => name));
 const CANONICAL_NATIVE_SCHEMA_EXPORT_NAMES = Object.freeze(CANONICAL_NATIVE_SCHEMA_EXPORTS.map(([name]) => name));
 
+// Canonical compilation produces a Pulse host-ABI module before provider
+// packaging. Its imports are checked independently of the final provider ABI.
+const { defineFinalWasmPolicy, FINAL_WASM_POLICY_VERSION } = require('../provider/final-wasm-policy.js');
+const CANONICAL_NATIVE_FINAL_WASM_POLICY = defineFinalWasmPolicy({
+  version: FINAL_WASM_POLICY_VERSION,
+  descriptorOwner: '@pulse-compute/wasm-contracts',
+  toolchainVersion: 'pulse.provider-toolchain.v1',
+  descriptorIdentity: 'pulse-canonical-native-host',
+  permittedImports: [
+    ...CANONICAL_NATIVE_IMPORT_NAMES.map(name => ({ module: 'pulse_host', name, kind: 'function' })),
+    ...CANONICAL_NATIVE_ALLOWED_ENV_IMPORTS.map(name => ({ module: 'env', name, kind: 'function' }))
+  ],
+  requiredExports: CANONICAL_NATIVE_EXPORTS.map(([name, second]) => ({ name, kind: second === 'memory' ? 'memory' : 'function' }))
+});
+
 const CANONICAL_NATIVE_DIAGNOSTIC_CODES = Object.freeze({
   PLAN_REQUIRED: 'PULSE_CANONICAL_NATIVE_WASM_PLAN_REQUIRED',
   PLAN_INVALID: 'PULSE_CANONICAL_NATIVE_WASM_PLAN_INVALID',
@@ -139,6 +190,7 @@ const CANONICAL_NATIVE_POLICY = Object.freeze({
   suspension: 'effect_begin records descriptors before one explicit suspension boundary; results are injected before pulse_resume',
   groupedEffects: 'all group members begin before one suspension boundary and all results must be ready before resume',
   incompleteResume: 'rejected without advancing the program counter or consuming available results',
+  resultFreshness: 'managed hosts authenticate single-use invocation tickets; raw ABI v2 index/handle exports are trusted-host operations',
   authority: 'request data and consequential effects remain host-owned; guest control flow remains authoritative',
   schemaJson: 'normalized registry IR generates json-as 1.5.0 guest codecs; host preflight enforces shared policy and structured errors',
   schemaBodyOwnership: 'request and fetched-response bytes are snapshotted once; application JSON values are encoded before suspension'
@@ -150,6 +202,9 @@ module.exports = Object.freeze({
   CANONICAL_NATIVE_AS_GENERATOR_VERSION,
   CANONICAL_NATIVE_COMPILER_VERSION,
   CANONICAL_NATIVE_HOST_VERSION,
+  CANONICAL_NATIVE_READ_LOOP_MEMORY,
+  CANONICAL_NATIVE_VALUE_TRANSFER_MAX_BYTES,
+  hasBoundedReadLoop,
   CANONICAL_NATIVE_RUN_STATUS,
   CANONICAL_NATIVE_RESULT_STATUS,
   CANONICAL_NATIVE_ERROR_CODES,
@@ -165,5 +220,6 @@ module.exports = Object.freeze({
   CANONICAL_NATIVE_SCHEMA_EXPORTS,
   CANONICAL_NATIVE_SCHEMA_EXPORT_NAMES,
   CANONICAL_NATIVE_DIAGNOSTIC_CODES,
-  CANONICAL_NATIVE_POLICY
+  CANONICAL_NATIVE_POLICY,
+  CANONICAL_NATIVE_FINAL_WASM_POLICY
 });

package/src/handler/canonical-runtime.js

@@ -4,10 +4,19 @@ const CANONICAL_PROGRAM_VERSION = 'pulse.canonical-program.v2';
 const CANONICAL_RUNTIME_PROTOCOL_VERSION = 'pulse.canonical-runtime-protocol.v2';
 const CANONICAL_EFFECT_MARKER_KINDS = Object.freeze(['effect', 'group']);
 const CANONICAL_PACKAGE_EFFECT_VERSION = 'pulse.canonical-package-effect.v1';
+const CANONICAL_EFFECT_INVOCATION_POLICY = Object.freeze({
+  version: 'pulse.effect-invocation.v1',
+  defaultMaxEffects: 1024,
+  identity: 'execution-owned single-use ticket; static effect and continuation sites remain reusable',
+  terminal: 'completion, failure and cancellation invalidate outstanding tickets',
+  budget: 'cumulative effect invocations and one inherited monotonic deadline',
+  nativeResultBoundary: 'managed host; raw guest ABI v2 setters remain trusted-host operations'
+});
 
 module.exports = Object.freeze({
   CANONICAL_PROGRAM_VERSION,
   CANONICAL_RUNTIME_PROTOCOL_VERSION,
   CANONICAL_EFFECT_MARKER_KINDS,
-  CANONICAL_PACKAGE_EFFECT_VERSION
+  CANONICAL_PACKAGE_EFFECT_VERSION,
+  CANONICAL_EFFECT_INVOCATION_POLICY
 });

package/src/handler/ctx-contract.js

@@ -6,8 +6,8 @@ const CTX_CONTRACT_VERSION = 'pulse.ctx-contract.v4';
 const CTX_CONTRACT_ID = 'pulse.ctx';
 const CTX_SURFACE_IDS = Object.freeze([
   'ctx.param','ctx.req.method','ctx.req.url','ctx.req.path','ctx.req.header','ctx.req.headers',
-  'ctx.state.get','ctx.state.set','ctx.encodeJson','ctx.json','ctx.text','ctx.response','ctx.req.text','ctx.req.json.schema',
-  'ctx.req.json.generic','ctx.fetch.projected','ctx.fetch.opaque-return','ctx.config.get','ctx.secret.get',
+  'ctx.state.get','ctx.state.set','ctx.encodeJson','ctx.decodeJson','ctx.json','ctx.text','ctx.response','ctx.req.text','ctx.req.json.schema',
+  'ctx.req.json.generic','ctx.fetch.projected','ctx.fetch.opaque-return','ctx.time.now','ctx.config.get','ctx.secret.get',
   'ctx.kv.get','ctx.kv.put','ctx.kv.getVersioned','ctx.kv.insertIfAbsent','ctx.kv.compareAndSwap','ctx.emit','package.operation'
 ]);
 const surfaceById = new Map(HANDLER_SURFACE_DEFINITIONS.map((entry) => [entry.id, entry]));
@@ -33,7 +33,7 @@ function defaultCtxContract() {
     handlerSurfaceVersion: HANDLER_SURFACE_CONTRACT_VERSION,
     surfaces: CTX_SURFACES,
     planes: Object.freeze({
-      sharedAuthoring: Object.freeze(['state', 'log', 'fetch', 'parallel', 'config', 'secret', 'kv', 'emit', 'encodeJson']),
+      sharedAuthoring: Object.freeze(['state', 'log', 'time', 'fetch', 'parallel', 'config', 'secret', 'kv', 'emit', 'encodeJson', 'decodeJson']),
       httpAuthoring: Object.freeze(['req', 'json', 'text', 'response']),
       routeAuthoring: Object.freeze(['param']),
       eventAuthoring: Object.freeze(['event.type', 'event.payload']),

package/src/handler/runtime-api.js

@@ -12,6 +12,7 @@ const ERROR_KINDS = Object.freeze({
   fetchTimeout: 'FetchTimeoutError',
   bodyTooLarge: 'BodyTooLargeError',
   bodyDecode: 'BodyDecodeError',
+  requestBodyInvalidUtf8: 'RequestBodyInvalidUtf8Error',
   bodyUnavailable: 'BodyUnavailableError',
   opaqueBodyInspection: 'OpaqueBodyInspectionError',
   responseEncode: 'ResponseEncodeError',
@@ -113,7 +114,7 @@ function readInputBody(input) {
     : Object.prototype.hasOwnProperty.call(source, 'text')
       ? source.text
       : source.jsonText;
-  return { available: true, text: Buffer.isBuffer(value) ? value.toString('utf8') : String(value ?? '') };
+  return { available: true, value };
 }
 
 function createStructuredBodyValue(input = {}, options = {}) {
@@ -124,7 +125,8 @@ function createStructuredBodyValue(input = {}, options = {}) {
   const contentClass = classifyContentType(contentType);
   const forceStructured = options.forceStructured === true;
   const body = readInputBody(input);
-  const bytes = utf8ByteLength(body.text);
+  const raw = body.value instanceof Uint8Array ? body.value : undefined;
+  const bytes = raw ? raw.byteLength : utf8ByteLength(body.value);
   const counters = { bodyCopies: 0, textTransforms: 0, jsonTransforms: 0, errors: 0 };
   let textMemo;
   let jsonMemo;
@@ -156,12 +158,20 @@ function createStructuredBodyValue(input = {}, options = {}) {
       textMemo = rejected;
       return textMemo;
     }
+    let value;
+    try {
+      value = raw ? new TextDecoder('utf-8', { fatal: options.strictUtf8 === true, ignoreBOM: true }).decode(raw) : String(body.value ?? '');
+    } catch (_) {
+      counters.errors += 1;
+      textMemo = runtimeValueError(ERROR_KINDS.requestBodyInvalidUtf8, 'Pulse request text must be well-formed UTF-8.');
+      return textMemo;
+    }
     counters.bodyCopies += 1;
     counters.textTransforms += 1;
     textMemo = deepFreeze({
       ok: true,
       kind: 'structured-text',
-      value: String(body.text),
+      value,
       bytes,
       contentType: String(contentType || ''),
       contentClass,