@pulse-compute/wasm-contracts 1.0.0-beta.4 → 1.0.0-beta.6

package/src/handler/surface-contract.js

@@ -57,6 +57,18 @@ function surface(definition) {
 }
 
 const HANDLER_SURFACE_DEFINITIONS = Object.freeze([
+  surface({ id: 'ctx.req.readTextChunk', class: 'effect', canonicalOperation: 'output.readTextChunk',
+    publicForms: ['ctx.req.readTextChunk()'], awaitPolicy: 'required-when-consumed', validPositions: ['statement'],
+    targetSupport: { javascript: true, native: true }, nativeBehavior: 'request-owned-input-suspension', status: 'experimental' }),
+  ...['start', 'write'].map(operation => surface({
+    id: `ctx.output.${operation}`, class: 'effect', canonicalOperation: `output.${operation}`,
+    publicForms: [`ctx.output.${operation}(...)`], awaitPolicy: 'required-when-consumed',
+    validPositions: ['statement'], targetSupport: { javascript: true, native: true },
+    nativeBehavior: 'request-owned-output-suspension', status: 'experimental'
+  })),
+  surface({ id: 'ctx.output.close', class: 'sync', canonicalOperation: 'response.output.close',
+    publicForms: ['ctx.output.close()'], awaitPolicy: 'forbidden', validPositions: ['return'],
+    targetSupport: { javascript: true, native: true }, nativeBehavior: 'terminal-output-marker', status: 'experimental' }),
   surface({
     id: 'handler.managed-async-wrapper',
     class: 'handler-wrapper',
@@ -212,6 +224,18 @@ const HANDLER_SURFACE_DEFINITIONS = Object.freeze([
     nativeBehavior: 'construct-canonical-result',
     status: 'existing-alias-normalization'
   }),
+  surface({
+    id: 'ctx.decodeJson',
+    class: 'sync',
+    canonicalOperation: 'schema.decode.text',
+    publicForms: ["ctx.decodeJson<T>(text, 'schema.id')"],
+    awaitPolicy: 'optional-redundant-warning',
+    validPositions: ['expression', 'return', 'condition'],
+    targetSupport: { javascript: true, native: true },
+    nativeBehavior: 'decode-bounded-schema-text',
+    schemaPolicy: 'literal-schema-required',
+    status: 'supported'
+  }),
   surface({
     id: 'ctx.encodeJson',
     class: 'sync',
@@ -257,6 +281,17 @@ const HANDLER_SURFACE_DEFINITIONS = Object.freeze([
     nativeBehavior: 'emit-effect-and-continuation',
     status: 'supported'
   }),
+  surface({
+    id: 'ctx.req.body',
+    class: 'sync',
+    canonicalOperation: 'request.body.forward-marker',
+    publicForms: ["ctx.fetch(url, { method: 'POST', body: ctx.req.body() })"],
+    awaitPolicy: 'forbidden',
+    validPositions: ['fetch-body'],
+    targetSupport: { javascript: true, native: true },
+    nativeBehavior: 'host-owned-marker',
+    status: 'node-configured-only'
+  }),
   surface({
     id: 'ctx.req.json.schema',
     class: 'effect',
@@ -315,6 +350,17 @@ const HANDLER_SURFACE_DEFINITIONS = Object.freeze([
     nativeBehavior: 'emit-terminal-fetch-effect',
     status: 'supported'
   }),
+  surface({
+    id: 'ctx.time.now',
+    class: 'effect',
+    canonicalOperation: 'effect.time.now',
+    publicForms: ['ctx.time.now()'],
+    awaitPolicy: 'required-when-consumed',
+    validPositions: ['await-expression', 'parallel-member'],
+    targetSupport: { javascript: true, native: true },
+    nativeBehavior: 'emit-provider-wall-clock-effect-and-continuation',
+    status: 'supported'
+  }),
   surface({
     id: 'ctx.config.get',
     class: 'effect',

package/src/handler/types-contract.js

@@ -20,7 +20,7 @@ function defaultHandlerTypesContract() {
       set: 'void'
     }),
     executionContexts: Object.freeze({
-      shared: Object.freeze(['state', 'log', 'fetch', 'parallel', 'config', 'secret', 'kv', 'emit', 'encodeJson']),
+      shared: Object.freeze(['state', 'log', 'time', 'fetch', 'parallel', 'config', 'secret', 'kv', 'emit', 'encodeJson', 'decodeJson']),
       http: Object.freeze(['req', 'json', 'text', 'response']),
       route: Object.freeze(['param']),
       event: Object.freeze(['event.type', 'event.payload']),

package/src/jwt/contracts.js

@@ -17,7 +17,7 @@ const JWT_CONTRACT_ID = 'pulse.jwt';
 const JWT_PACKAGE_NAME = '@pulse-compute/jwt';
 
 const JWT_ALGORITHMS = Object.freeze(['HS256', 'RS256', 'ES256', 'EdDSA']);
-const JWT_IMPLEMENTED_ALGORITHMS = Object.freeze(['HS256', 'ES256']);
+const JWT_IMPLEMENTED_ALGORITHMS = Object.freeze(['HS256', 'ES256', 'RS256']);
 const JWT_KEY_TYPES = Object.freeze(['secret', 'jwk', 'jwks']);
 const JWT_IMPLEMENTED_KEY_TYPES = Object.freeze(['secret', 'jwk', 'jwks']);
 const JWT_NATIVE_REALIZATION_KINDS = Object.freeze(['crypto-composed']);
@@ -139,6 +139,38 @@ const JWT_VERIFY_OPERATION = Object.freeze({
   clock: 'provider-wall-clock'
 });
 
+const JWT_SIGN_OPERATION = Object.freeze({
+  version: JWT_CANONICAL_EFFECT_VERSION, contractId: JWT_CONTRACT_ID,
+  package: JWT_PACKAGE_NAME, import: JWT_PACKAGE_NAME,
+  kind: 'jwt.sign', providerKind: 'jwt', operation: 'sign', capability: 'jwt.sign',
+  result: 'string', placement: 'variable', clock: 'provider-wall-clock'
+});
+const JWT_SIGN_CONTRACT = Object.freeze({
+  version: 'pulse.jwt-sign.v2', algorithms: Object.freeze(['HS256', 'ES256', 'RS256']), keyType: 'secret',
+  kidBytesMaximum: 256, es256PrivateKey: 'secret-json-p256-private-jwk',
+  header: Object.freeze({ alg: 'selected-algorithm', typ: 'JWT', kid: 'optional-explicit-key-id' }),
+  claimsBytes: 8192, claimsEntries: 1024, claimsDepth: 32,
+  keyBytesMinimum: 32, keyBytesMaximum: 4096,
+  expiresInSecondsMinimum: 1, expiresInSecondsMaximum: Number.MAX_SAFE_INTEGER,
+  expirationSecondsMaximum: 8_640_000_000_000, lifetimePolicy: 'application-owned',
+  reservedClaims: Object.freeze(['iat', 'exp', 'nbf']),
+  providerRequirements: Object.freeze(['jwt.sign', 'secret.get', 'time.wall-clock']),
+  cryptoAlgorithms: Object.freeze({ HS256: 'HMAC-SHA256', ES256: 'ES256', RS256: 'RS256' }), automaticFallback: false
+});
+
+function normalizeJwtSignEffect(effect) {
+  if (!ordinaryObject(effect) || ['contractId', 'package', 'kind', 'providerKind', 'operation', 'capability', 'result']
+    .some(name => dataProperty(effect, name) !== JWT_SIGN_OPERATION[name])) {
+    throw new PulseJwtContractError('Pulse JWT provider received an invalid signing operation.', { field: 'identity' });
+  }
+  const payload = dataProperty(effect, 'payload');
+  if (!ordinaryObject(payload) || Reflect.ownKeys(payload).length !== 2
+    || !ordinaryObject(dataProperty(payload, 'claims')) || !ordinaryObject(dataProperty(payload, 'options'))) {
+    throw new PulseJwtContractError('Pulse JWT signing requires claims and options.', { field: 'payload' });
+  }
+  return Object.freeze({ claims: dataProperty(payload, 'claims'), options: dataProperty(payload, 'options') });
+}
+
 const JWT_EXECUTION_REQUIREMENTS = Object.freeze({
   containment: 'request-owned-effect',
   cancellation: 'request-lifecycle-signal',
@@ -175,6 +207,7 @@ const JWT_NATIVE_LOWERING_CONTRACT = Object.freeze({
     'jwt.verify',
     'jwt.verify.hs256',
     'jwt.verify.es256',
+    'jwt.verify.rs256',
     'secret.get',
     'time.wall-clock'
   ]),
@@ -192,6 +225,11 @@ const JWT_NATIVE_LOWERING_CONTRACT = Object.freeze({
       realization: 'guest-linked:pulse-es256-rustcrypto-p256',
       implementation: 'rustcrypto.p256-0.13.2.ecdsa-0.16.9.sha2-0.10.9.v1',
       guestUnitRequired: true
+    }),
+    RS256: Object.freeze({
+      realization: 'guest-linked:pulse-rs256-bearssl-i31',
+      implementation: 'bearssl.0.6.rsa-i31.sha256.v1',
+      guestUnitRequired: true
     })
   }),
   cryptoSemanticOwner: CRYPTO_SEMANTIC_OWNER,
@@ -414,6 +452,9 @@ module.exports = Object.freeze({
   JWT_RESOURCE_LIMITS,
   JWT_ES256_KEY_NORMALIZATION_CONTRACT,
   JWT_VERIFY_OPERATION,
+  JWT_SIGN_OPERATION,
+  JWT_SIGN_CONTRACT,
+  normalizeJwtSignEffect,
   JWT_EXECUTION_REQUIREMENTS,
   JWT_NATIVE_LOWERING_CONTRACT,
   JWT_TARGET_REALIZATIONS,

package/src/library/manifest.js

@@ -87,6 +87,7 @@ function normalizeManifest(manifest) {
       version: compiler.version,
       entry: compiler.entry,
       export: compiler.export,
+      ...(compiler.nativeApplicationExport !== undefined ? { nativeApplicationExport: compiler.nativeApplicationExport } : {}),
       artifact: compiler.artifact,
       builderOwner: compiler.builderOwner,
       trust: compiler.trust,
@@ -267,6 +268,16 @@ function validateLowerableLibraryManifest(manifest) {
     ));
   }
 
+  if (compiler.nativeApplicationExport !== undefined && (!isNonEmptyString(compiler.nativeApplicationExport)
+    || !/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(compiler.nativeApplicationExport))) {
+    diagnostics.push(makeDiagnostic(
+      'PULSEWASM_LOWERABLE_LIBRARY_COMPILER_EXPORT_REQUIRED',
+      'Native application builders must name a static compiler export.',
+      'Set compiler.nativeApplicationExport to an exported first-party builder function name.',
+      { nativeApplicationExport: compiler.nativeApplicationExport }
+    ));
+  }
+
   if (compiler.trust !== 'first-party') {
     diagnostics.push(makeDiagnostic(
       'PULSEWASM_LOWERABLE_LIBRARY_COMPILER_TRUST_REQUIRED',

package/src/project/native-optimization.js

@@ -2,8 +2,10 @@
 
 const NATIVE_OPTIMIZATION_VERSION = 'pulse.native-optimization.v1';
 const EXPERIMENTAL_NATIVE_SIZE_MODE = 'experimental-native-size';
+const EXPERIMENTAL_NATIVE_BOUNDED_SIZE_MODE = 'experimental-native-bounded-size';
 
 module.exports = Object.freeze({
   NATIVE_OPTIMIZATION_VERSION,
-  EXPERIMENTAL_NATIVE_SIZE_MODE
+  EXPERIMENTAL_NATIVE_SIZE_MODE,
+  EXPERIMENTAL_NATIVE_BOUNDED_SIZE_MODE
 });

package/src/provider/canonical-provider.js

@@ -5,10 +5,15 @@ const CANONICAL_PROVIDER_PLAN_VERSION = 'pulse.canonical-provider-plan.v1';
 
 const CANONICAL_PROVIDER_CAPABILITIES = Object.freeze([
   'request',
+  'request.body.forward',
   'response.json',
   'response.text',
   'response.custom',
+  'response.output',
+  'request.body.transform',
   'fetch',
+  'time.wall-clock',
+  'crypto.digestText',
   'config.get',
   'secret.get',
   'kv.get',
@@ -21,10 +26,11 @@ const CANONICAL_PROVIDER_CAPABILITIES = Object.freeze([
   'grip.hold',
   'grip.publish',
   'grip.broadcast',
-  'jwt.verify',
+  'jwt.verify', 'jwt.sign',
   's3.head',
   's3.getText',
   's3.putText',
+  's3.getBody',
   'opaque.pass-through'
 ]);
 

package/src/provider/toolchain.js

@@ -52,6 +52,8 @@ const DRIVER_FIELDS = Object.freeze([
   'targets',
   'execute',
   'prepareNativeExecution',
+  'prepareNativeRequest',
+  'createGeneratedOutput',
   'createLoweringPlan',
   'inspectRealization',
   'writeTarget',
@@ -370,6 +372,10 @@ function defineProviderDriver(input, expected = {}) {
   if (input.prepareNativeExecution !== undefined && typeof input.prepareNativeExecution !== 'function') {
     throw new TypeError(`Pulse provider driver ${id} prepareNativeExecution must be a function.`);
   }
+  if (input.prepareNativeRequest !== undefined && typeof input.prepareNativeRequest !== 'function') {
+    throw new TypeError(`Pulse provider driver ${id} prepareNativeRequest must be a function.`);
+  }
+  if (input.createGeneratedOutput !== undefined && typeof input.createGeneratedOutput !== 'function') throw new TypeError('Pulse provider createGeneratedOutput must be a function.');
   const descriptor = input.descriptor === undefined ? undefined : normalizeDescriptor(input.descriptor);
   if (descriptor && descriptor.id !== id) throw new TypeError(`Pulse provider driver ${id} descriptor identity does not match.`);
   const javascript = normalizeJavascriptDriver(input.javascript, targets.javascript);
@@ -397,6 +403,8 @@ function defineProviderDriver(input, expected = {}) {
     targets,
     execute: input.execute,
     prepareNativeExecution: input.prepareNativeExecution,
+    prepareNativeRequest: input.prepareNativeRequest,
+    createGeneratedOutput: input.createGeneratedOutput,
     createLoweringPlan: input.createLoweringPlan,
     inspectRealization: input.inspectRealization,
     writeTarget: input.writeTarget,

package/src/s3/contracts.js

@@ -3,10 +3,10 @@
 const S3_CONTRACT_ID = 'pulse.s3';
 const S3_PACKAGE = '@pulse-compute/s3';
 const S3_LOWERING_PLAN_VERSION = 'pulse.s3-lowering-plan.v1';
-const S3_LIMITS = Object.freeze({ keyBytes: 1024, textBytes: 32768, metadataBytes: 1024, headerBytes: 16384, envelopeBytes: 262144 });
-const S3_OPERATIONS = Object.freeze(Object.fromEntries(['head', 'getText', 'putText'].map((name) => [name, Object.freeze({
-  kind: `s3.${name}`, capability: `s3.${name}`, result: name === 'head' ? 's3-head-result' : name === 'getText' ? 's3-get-text-result' : 's3-put-text-result'
+const S3_LIMITS = Object.freeze({ keyBytes: 1024, textBytes: 2097152, defaultTextBytes: 32768, metadataBytes: 1024, headerBytes: 16384, envelopeBytes: 12648448 });
+const S3_OPERATIONS = Object.freeze(Object.fromEntries(['head', 'getText', 'putText', 'getBody'].map((name) => [name, Object.freeze({
+  kind: `s3.${name}`, capability: `s3.${name}`, result: name === 'getBody' ? 'opaque-response' : name === 'head' ? 's3-head-result' : name === 'getText' ? 's3-get-text-result' : 's3-put-text-result'
 })])));
-const S3_PROVIDER_REQUIREMENTS = Object.freeze(['s3.head', 's3.getText', 's3.putText', 'secret.get', 'time.wall-clock']);
+const S3_PROVIDER_REQUIREMENTS = Object.freeze(['s3.head', 's3.getText', 's3.putText', 's3.getBody', 'secret.get', 'time.wall-clock']);
 const S3_CRYPTO_ALGORITHMS = Object.freeze(['SHA-256', 'HMAC-SHA256']);
 module.exports = Object.freeze({ S3_CONTRACT_ID, S3_PACKAGE, S3_LOWERING_PLAN_VERSION, S3_LIMITS, S3_OPERATIONS, S3_PROVIDER_REQUIREMENTS, S3_CRYPTO_ALGORITHMS });

package/src/schema-json/admission-text.js

@@ -0,0 +1,212 @@
+'use strict';
+
+const { JsonAdmissionBudget } = require('./admission.js');
+
+class JsonAdmissionFrame {
+  kind/*: i32 */ = 0; // 0 array; 1 object
+  state/*: i32 */ = 0;
+  count/*: i32 */ = 0;
+  start/*: i32 */ = 0;
+  names/*: Map<string, i32> */ = new Map();
+}
+
+// Iterative syntax and resource admission; never constructs JSON containers.
+// Root containers have depth 1, root scalars depth 0. Nodes include every
+// syntactic value, even overwritten/unknown values. Keys are not value nodes.
+// duplicateMode: 0 allow, 1 reject, 2 report offsets for schema-owned policy.
+class JsonTextAdmission extends JsonAdmissionBudget {
+  text/*: string */;
+  duplicateMode/*: i32 */;
+  offset/*: i32 */ = 0;
+  textBytes/*: i32 */ = 0;
+  frames/*: Array<JsonAdmissionFrame> */ = [];
+  duplicateObjects/*: Array<i32> */ = [];
+  duplicateKeys/*: Array<i32> */ = [];
+  duplicateFirstKeys/*: Array<i32> */ = [];
+  constructor(text/*: string */, limits/*: JsonAdmissionLimits */, duplicateMode/*: i32 */) {
+    super(limits);
+    this.text = text;
+    this.duplicateMode = duplicateMode;
+  }
+  space()/*: void */ {
+    while (this.offset < this.text.length) {
+      const c = this.text.charCodeAt(this.offset);
+      if (c !== 32 && c !== 9 && c !== 10 && c !== 13) break;
+      this.offset++;
+    }
+  }
+  rawBytes()/*: bool */ {
+    // UTF-8 byte count matches replacement encoding for raw lone surrogates.
+    // This prepass stops before any syntax-frame or decoded-key allocation.
+    if (this.text.length > this.limits.maxTextBytes) return this.fail(2);
+    for (let i = 0; i < this.text.length; i++) {
+      const c = this.text.charCodeAt(i);
+      let n = c < 128 ? 1 : c < 2048 ? 2 : 3;
+      if (c >= 0xd800 && c <= 0xdbff && i + 1 < this.text.length) {
+        const next = this.text.charCodeAt(i + 1);
+        if (next >= 0xdc00 && next <= 0xdfff) { n = 4; i++; }
+      }
+      if (n > this.limits.maxTextBytes - this.textBytes) return this.fail(2);
+      this.textBytes += n;
+    }
+    return true;
+  }
+  string(key/*: bool */)/*: string */ {
+    const capture = key && this.duplicateMode !== 0;
+    const parts/*: Array<string> */ = [];
+    let length = 0;
+    let high = false;
+    this.offset++; // opening quote
+    if (!this.addBytes(2)) return '';
+    while (this.offset < this.text.length && this.failure === 0) {
+      let c = this.text.charCodeAt(this.offset++);
+      if (c === 34) {
+        if (high) this.addBytes(6);
+        return capture ? parts.join('') : '';
+      }
+      if (c < 32) { this.fail(1); return ''; }
+      if (c === 92) {
+        if (this.offset >= this.text.length) { this.fail(1); return ''; }
+        c = this.text.charCodeAt(this.offset++);
+        if (c === 117) {
+          let unit = 0;
+          for (let n = 0; n < 4; n++) {
+            if (this.offset >= this.text.length) { this.fail(1); return ''; }
+            const h = this.text.charCodeAt(this.offset++);
+            const digit = h >= 48 && h <= 57 ? h - 48 : h >= 65 && h <= 70 ? h - 55 : h >= 97 && h <= 102 ? h - 87 : -1;
+            if (digit < 0) { this.fail(1); return ''; }
+            unit = unit * 16 + digit;
+          }
+          c = unit;
+        } else if (c === 98) c = 8;
+        else if (c === 102) c = 12;
+        else if (c === 110) c = 10;
+        else if (c === 114) c = 13;
+        else if (c === 116) c = 9;
+        else if (c !== 34 && c !== 92 && c !== 47) { this.fail(1); return ''; }
+      }
+      const limit = key ? this.limits.maxKeyLength : this.limits.maxStringLength;
+      if (length >= limit) { this.fail(key ? 7 : 8); return ''; }
+      length++;
+      if (capture) parts.push(String.fromCharCode(c));
+      if (high) {
+        high = false;
+        if (c >= 0xdc00 && c <= 0xdfff) { this.addBytes(4); continue; }
+        if (!this.addBytes(6)) return '';
+      }
+      if (c >= 0xd800 && c <= 0xdbff) high = true;
+      else this.addBytes(c < 32 ? 6 : c === 34 || c === 92 ? 2 : c < 128 ? 1 : c < 2048 ? 2 : c >= 0xdc00 && c <= 0xdfff ? 6 : 3);
+    }
+    this.fail(1);
+    return '';
+  }
+  digit()/*: bool */ {
+    if (this.offset >= this.text.length) return false;
+    const c = this.text.charCodeAt(this.offset);
+    return c >= 48 && c <= 57;
+  }
+  number()/*: bool */ {
+    const start = this.offset;
+    if (this.text.charCodeAt(this.offset) === 45) this.offset++;
+    if (!this.digit()) return this.fail(1);
+    if (this.text.charCodeAt(this.offset) === 48) this.offset++;
+    else while (this.digit()) this.offset++;
+    if (this.offset < this.text.length && this.text.charCodeAt(this.offset) === 46) {
+      this.offset++;
+      if (!this.digit()) return this.fail(1);
+      while (this.digit()) this.offset++;
+    }
+    if (this.offset < this.text.length) {
+      const c = this.text.charCodeAt(this.offset);
+      if (c === 69 || c === 101) {
+        this.offset++;
+        if (this.offset < this.text.length && (this.text.charCodeAt(this.offset) === 43 || this.text.charCodeAt(this.offset) === 45)) this.offset++;
+        if (!this.digit()) return this.fail(1);
+        while (this.digit()) this.offset++;
+      }
+    }
+    if (!isFinite(parseFloat(this.text.substring(start, this.offset)))) return this.fail(11);
+    return this.addBytes(24); // finite-f64 conservative spelling budget
+  }
+  value()/*: bool */ {
+    this.space();
+    if (this.offset >= this.text.length) return this.fail(1);
+    const c = this.text.charCodeAt(this.offset);
+    const container = c === 91 || c === 123;
+    if (!this.node(container ? this.frames.length + 1 : this.frames.length)) return false;
+    if (container) {
+      if (!this.addBytes(1)) return false;
+      const frame = new JsonAdmissionFrame();
+      frame.kind = c === 123 ? 1 : 0;
+      frame.start = this.offset++;
+      this.frames.push(frame);
+      return true;
+    }
+    if (c === 34) { this.string(false); return this.failure === 0; }
+    let literal = '';
+    if (c === 116) literal = 'true';
+    else if (c === 102) literal = 'false';
+    else if (c === 110) literal = 'null';
+    if (literal.length > 0) {
+      if (this.text.substring(this.offset, this.offset + literal.length) !== literal) return this.fail(1);
+      this.offset += literal.length;
+      return this.addBytes(literal.length);
+    }
+    return this.number();
+  }
+  scan()/*: bool */ {
+    if (this.duplicateMode < 0 || this.duplicateMode > 2) return this.fail(12);
+    if (!this.rawBytes() || !this.value()) return false;
+    while (this.frames.length > 0 && this.failure === 0) {
+      this.space();
+      if (this.offset >= this.text.length) return this.fail(1);
+      const frame = this.frames[this.frames.length - 1];
+      const c = this.text.charCodeAt(this.offset);
+      const end = frame.kind === 0 ? 93 : 125;
+      const after = frame.kind === 0 ? 1 : 3;
+      if ((frame.state === 0 || frame.state === after) && c === end) {
+        this.offset++;
+        if (!this.addBytes(1)) return false;
+        this.frames.pop();
+      } else if (frame.state === after) {
+        if (c !== 44) return this.fail(1);
+        this.offset++;
+        if (!this.addBytes(1)) return false;
+        frame.state = frame.kind === 0 ? 2 : 4;
+      } else if (frame.kind === 0) {
+        if (frame.count >= this.limits.maxArrayItems) return this.fail(6);
+        frame.count++;
+        frame.state = 1;
+        if (!this.value()) return false;
+      } else if (frame.state === 0 || frame.state === 4) {
+        if (c !== 34) return this.fail(1);
+        if (frame.count >= this.limits.maxObjectMembers) return this.fail(5);
+        frame.count++;
+        const start = this.offset;
+        const name = this.string(true);
+        if (this.failure !== 0) return false;
+        if (this.duplicateMode !== 0) {
+          if (frame.names.has(name)) {
+            if (this.duplicateMode === 1) return this.fail(10);
+            this.duplicateObjects.push(frame.start);
+            this.duplicateKeys.push(start);
+            this.duplicateFirstKeys.push(frame.names.get(name)/* nonnull */);
+          } else frame.names.set(name, start);
+        }
+        frame.state = 1;
+      } else if (frame.state === 1) {
+        if (c !== 58) return this.fail(1);
+        this.offset++;
+        if (!this.addBytes(1)) return false;
+        frame.state = 2;
+      } else {
+        frame.state = 3;
+        if (!this.value()) return false;
+      }
+    }
+    this.space();
+    return this.failure === 0 && (this.offset === this.text.length || this.fail(1));
+  }
+}
+
+module.exports = { JsonAdmissionFrame, JsonTextAdmission };

package/src/schema-json/admission.js

@@ -0,0 +1,99 @@
+'use strict';
+
+const { sha256Hex, stableStringify } = require('../stable-id.js');
+
+const JSON_ADMISSION_VERSION = 'pulse.json-admission.v1';
+const JSON_LIMIT_FIELDS = Object.freeze([
+  'maxTextBytes', 'maxDepth', 'maxNodes', 'maxObjectMembers',
+  'maxArrayItems', 'maxKeyLength', 'maxStringLength', 'maxJsonBytes'
+]);
+const JSON_ADMISSION_FAILURES = Object.freeze([
+  'none', 'malformed', 'text-bytes', 'depth', 'nodes', 'object-members',
+  'array-items', 'key-length', 'string-length', 'json-bytes',
+  'duplicate-key', 'non-finite-number', 'unsupported-value', 'cycle'
+]);
+
+// No application defaults in this internal foundation. All counters fit i32;
+// additions check remaining capacity before adding, including in generated AS.
+function normalizeJsonAdmissionLimits(input) {
+  const invalid = () => {
+    const error = new TypeError('JSON admission requires all eight positive i32 limits as own data properties.');
+    error.code = 'PULSEWASM_JSON_LIMITS_INVALID';
+    throw error;
+  };
+  if (!input || typeof input !== 'object' || Array.isArray(input)) invalid();
+  const proto = Object.getPrototypeOf(input);
+  if (proto !== Object.prototype && proto !== null) invalid();
+  const keys = Reflect.ownKeys(input);
+  if (keys.length !== JSON_LIMIT_FIELDS.length || keys.some(key => !JSON_LIMIT_FIELDS.includes(key))) invalid();
+  const limits = {};
+  for (const key of JSON_LIMIT_FIELDS) {
+    const descriptor = Object.getOwnPropertyDescriptor(input, key);
+    if (!descriptor || !Object.hasOwn(descriptor, 'value')) invalid();
+    const value = descriptor.value;
+    if (!Number.isInteger(value) || value < 1 || value > 0x7fffffff) invalid();
+    limits[key] = value;
+  }
+  return Object.freeze(limits);
+}
+
+function jsonAdmissionIdentity(input) {
+  const limits = normalizeJsonAdmissionLimits(input);
+  return Object.freeze({ version: JSON_ADMISSION_VERSION, limits,
+    hash: sha256Hex(stableStringify({ version: JSON_ADMISSION_VERSION, limits })) });
+}
+
+// These classes are executable reference semantics shared with Native codegen.
+// Type comments are erased by JavaScript and realized by the AS generator.
+class JsonAdmissionLimits {
+  maxTextBytes/*: i32 */ = 0;
+  maxDepth/*: i32 */ = 0;
+  maxNodes/*: i32 */ = 0;
+  maxObjectMembers/*: i32 */ = 0;
+  maxArrayItems/*: i32 */ = 0;
+  maxKeyLength/*: i32 */ = 0;
+  maxStringLength/*: i32 */ = 0;
+  maxJsonBytes/*: i32 */ = 0;
+}
+
+class JsonAdmissionBudget {
+  limits/*: JsonAdmissionLimits */;
+  failure/*: i32 */ = 0;
+  nodes/*: i32 */ = 0;
+  depth/*: i32 */ = 0;
+  jsonBytes/*: i32 */ = 0;
+  constructor(limits/*: JsonAdmissionLimits */) { this.limits = limits; }
+  fail(reason/*: i32 */)/*: bool */ {
+    if (this.failure === 0) this.failure = reason;
+    return false;
+  }
+  addBytes(amount/*: i32 */)/*: bool */ {
+    if (this.failure !== 0) return false;
+    if (amount < 0 || amount > this.limits.maxJsonBytes - this.jsonBytes) return this.fail(9);
+    this.jsonBytes += amount;
+    return true;
+  }
+  node(containerDepth/*: i32 */)/*: bool */ {
+    if (this.failure !== 0) return false;
+    if (this.nodes >= this.limits.maxNodes) return this.fail(4);
+    this.nodes++;
+    if (containerDepth > this.limits.maxDepth) return this.fail(3);
+    if (containerDepth > this.depth) this.depth = containerDepth;
+    return true;
+  }
+  stringBytes(text/*: string */, key/*: bool */)/*: bool */ {
+    if (text.length > (key ? this.limits.maxKeyLength : this.limits.maxStringLength)) return this.fail(key ? 7 : 8);
+    if (!this.addBytes(2)) return false;
+    for (let i = 0; i < text.length; i++) {
+      const c = text.charCodeAt(i);
+      let size = c < 32 ? 6 : c === 34 || c === 92 ? 2 : c < 128 ? 1 : c < 2048 ? 2 : 3;
+      if (c >= 0xd800 && c <= 0xdbff && i + 1 < text.length && text.charCodeAt(i + 1) >= 0xdc00 && text.charCodeAt(i + 1) <= 0xdfff) { size = 4; i++; }
+      else if (c >= 0xd800 && c <= 0xdfff) size = 6;
+      if (!this.addBytes(size)) return false;
+    }
+    return true;
+  }
+}
+
+module.exports = { JSON_ADMISSION_VERSION, JSON_LIMIT_FIELDS, JSON_ADMISSION_FAILURES,
+  normalizeJsonAdmissionLimits, jsonAdmissionIdentity, JsonAdmissionLimits, JsonAdmissionBudget };

package/src/schema-json/contracts.js

@@ -1,6 +1,7 @@
 'use strict';
 
 module.exports = {
+  admission: { ...require('./admission.js'), ...require('./admission-text.js') },
   v1: require('./v1.js'),
   v2: require('./v2.js'),
   compile: require('./compile.js'),