@pulse-compute/wasm-host-runtime 1.0.0-beta.1 → 1.0.0-beta.3

package/README.md

@@ -6,9 +6,10 @@
 > **Install directly:** No for application projects; it is installed transitively.<br>
 > **Supported entry points:** `None for application authors.`<br>
 > **Stability:** Internal compiler/runtime interface synchronized with this release set.<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.1/packages/implementation-packages/)
+> **npm:** [`@pulse-compute/wasm-host-runtime`](https://www.npmjs.com/package/@pulse-compute/wasm-host-runtime)<br>
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.3/packages/implementation-packages/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.1` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.3` package policy.
 <!-- pulse-package-status:end -->
 
 Package-owned PulseWasm host-runtime build-time builders and local runtime helpers.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-compute/wasm-host-runtime",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0-beta.3",
   "license": "Apache-2.0",
   "engines": {
     "node": "^22.14.0 || ^24.0.0"
@@ -28,9 +28,11 @@
     "./runtime/canonical-native-host": "./src/runtime/canonical-native-host.js"
   },
   "dependencies": {
-    "@pulse-compute/wasm-build-support": "1.0.0-beta.1",
-    "@pulse-compute/wasm-contracts": "1.0.0-beta.1",
-    "@pulse-compute/wasm-schema-json": "1.0.0-beta.1"
+    "@pulse-compute/crypto": "1.0.0-beta.3",
+    "@pulse-compute/runtime": "1.0.0-beta.3",
+    "@pulse-compute/wasm-build-support": "1.0.0-beta.3",
+    "@pulse-compute/wasm-contracts": "1.0.0-beta.3",
+    "@pulse-compute/wasm-schema-json": "1.0.0-beta.3"
   },
   "publishConfig": {
     "access": "public"
@@ -46,7 +48,7 @@
     "url": "git+https://github.com/pulse-compute/pulse.git",
     "directory": "wasm/packages/host-runtime"
   },
-  "homepage": "https://pulsecompute.io/v1.0.0-beta.1/packages/implementation-packages/",
+  "homepage": "https://pulsecompute.io/v1.0.0-beta.3/packages/implementation-packages/",
   "bugs": {
     "url": "https://github.com/pulse-compute/pulse/issues"
   }

package/src/runtime/canonical-api-runtime.js

@@ -1,4 +1,5 @@
 'use strict';
+const portableKv = require('@pulse-compute/runtime/host');
 
 
 function loadRuntimeApi() {
@@ -886,6 +887,7 @@ function normalizeProviderEffect(effect, schemaCodecs, options = {}) {
   if (!effect || typeof effect !== 'object') {
     throw new CanonicalRuntimeError('CanonicalEffectProtocolError', 'PULSE_CANONICAL_EFFECT_PROTOCOL', 'Canonical provider effect must be an object.', { effect });
   }
+  if (portableKv.isConditionalKv(effect.kind)) return Object.freeze({ ...portableKv.admitConditionalKv(effect, options), id: effect.id, groupKey: effect.groupKey, source: effect.source });
   if (effect.kind === 'fetch') return normalizeFetchEffect(effect, schemaCodecs, options);
   const id = String(effect.id || '');
   if (!id) throw new CanonicalRuntimeError('CanonicalEffectProtocolError', 'PULSE_CANONICAL_EFFECT_PROTOCOL', 'Canonical provider effect requires an id.', { effect });
@@ -980,6 +982,7 @@ function effectTraceStart(adapterId, executionId, normalized, sensitiveValues) {
     headers: redactedHeaders(normalized.init.headers, sensitiveValues)
   });
   if (normalized.kind === 'config.get' || normalized.kind === 'secret.get') return Object.freeze({ ...base, name: redactString(normalized.name, sensitiveValues) });
+  if (portableKv.isConditionalKv(normalized.kind)) return Object.freeze({ ...base, key: '<redacted>', generation: '<redacted>', value: '<redacted>' });
   if (normalized.kind === 'kv.get' || normalized.kind === 'kv.put') return Object.freeze({ ...base, store: redactString(normalized.store, sensitiveValues), key: redactString(normalized.key, sensitiveValues) });
   if (normalized.kind === 'event.emit') return Object.freeze({ ...base, eventType: redactString(normalized.frame.type, sensitiveValues), schemaId: normalized.frame.schemaId });
   if (normalized.package) return Object.freeze({ ...base, package: normalized.package, contractId: normalized.contractId, operation: normalized.operation });
@@ -991,6 +994,7 @@ function effectTraceResolved(adapterId, executionId, normalized, value) {
   if (normalized.kind === 'fetch') return Object.freeze({ ...base, status: value.status, bodyClass: value.bodyClass });
   if (normalized.kind === 'secret.get') return Object.freeze({ ...base, hit: value !== undefined, value: '<redacted>' });
   if (normalized.kind === 'config.get') return Object.freeze({ ...base, hit: value !== undefined });
+  if (portableKv.isConditionalKv(normalized.kind)) return Object.freeze({ ...base, status: value.status });
   if (normalized.kind === 'kv.get') return Object.freeze({ ...base, hit: value !== undefined });
   if (normalized.kind === 'kv.put') return Object.freeze({ ...base, stored: Boolean(value) });
   if (normalized.kind === 'event.emit') return Object.freeze({ ...base, accepted: value === undefined });
@@ -1288,6 +1292,7 @@ function normalizeProviderAdapter(input = {}) {
     version: String(input.version || `pulse.canonical-${id}-provider.v1`),
     createCapabilities: typeof input.createCapabilities === 'function' ? input.createCapabilities : () => ({}),
     dispatchEffect,
+    prepareConditionalKv: typeof input.prepareConditionalKv === 'function' ? input.prepareConditionalKv.bind(input) : undefined,
     resultMetadata: typeof input.resultMetadata === 'function' ? input.resultMetadata : () => undefined,
     disposeExecution: typeof input.disposeExecution === 'function' ? input.disposeExecution : () => undefined
   });
@@ -1361,10 +1366,15 @@ function createCanonicalHostRuntime(options = {}) {
 
     async function dispatchOne(effect) {
       const normalized = normalizeProviderEffect(effect, schemaCodecs, runtimeOptions);
+      const conditional = portableKv.isConditionalKv(normalized.kind);
+      if (conditional) portableKv.registerKvRedactions(normalized, (value) => sensitiveValues.add(value));
       recordTrace(effectTraceStart(adapter.id, executionId, normalized, sensitiveValues));
       dispatchedEffects += 1;
       try {
-        let snapshot = await adapter.dispatchEffect(normalized, { ...options, ...executionOptions, metadata, executionId, trace: traceSink });
+        const effectExecution = { ...options, ...executionOptions, metadata, executionId, trace: traceSink, registerRedactionValue: (value) => sensitiveValues.add(value), onKvObservation: recordTrace };
+        let snapshot = conditional
+          ? await portableKv.executeConditionalKv(normalized, adapter.prepareConditionalKv || ((_admitted, kvExecution) => () => adapter.dispatchEffect(normalized, kvExecution)), effectExecution, runtimeOptions)
+          : await adapter.dispatchEffect(normalized, effectExecution);
         if (normalized.kind === 'config.get' || normalized.kind === 'secret.get') {
           if (snapshot !== undefined && typeof snapshot !== 'string') {
             throw new CanonicalRuntimeError(

package/src/runtime/canonical-native-host.js

@@ -1,4 +1,5 @@
 'use strict';
+const portableKv = require('@pulse-compute/runtime/host');
 
 const crypto = require('node:crypto');
 const {
@@ -81,6 +82,7 @@ function normalizeProviderAdapter(input) {
   if (!input || typeof input !== 'object') {
     return Object.freeze({
       id: 'unconfigured',
+      prepareConditionalKv() { return undefined; },
       version: 'pulse.canonical-native-unconfigured-provider.v1',
       async dispatchEffect(effect) {
         throw new CanonicalNativeHostError(`No provider adapter is configured for native effect ${effect.kind}.`, 'PULSE_PROVIDER_CAPABILITY_MISSING', { effectId: effect.id, kind: effect.kind });
@@ -104,6 +106,7 @@ function normalizeProviderAdapter(input) {
     id,
     version: String(input.version || `pulse.canonical-native-${id}-provider.v1`),
     dispatchEffect,
+    prepareConditionalKv: typeof input.prepareConditionalKv === 'function' ? input.prepareConditionalKv.bind(input) : undefined,
     resultMetadata: typeof input.resultMetadata === 'function' ? input.resultMetadata.bind(input) : () => undefined,
     disposeExecution: typeof input.disposeExecution === 'function' ? input.disposeExecution.bind(input) : () => undefined
   });
@@ -247,6 +250,7 @@ function nativeEffect(planEffect, payload) {
   }
   if (planEffect.kind === 'config.get' || planEffect.kind === 'secret.get') return { ...base, name: payload.name };
   if (planEffect.kind === 'kv.get' || planEffect.kind === 'kv.put') return { ...base, store: kvStoreName(payload.store), key: payload.key, value: planEffect.kind === 'kv.put' ? payload.value : undefined };
+  if (portableKv.isConditionalKv(planEffect.kind)) return { ...base, store: kvStoreName(payload.store), key: payload.key, value: payload.value, generation: payload.generation };
   if (planEffect.kind === 'event.emit') {
     return {
       ...base,
@@ -724,7 +728,9 @@ function instantiateCanonicalNativeModule(compiled, options = {}) {
       const effect = plan.effects && plan.effects[index];
       if (!effect) throw new CanonicalNativeHostError(`Native module requested unknown effect index ${index}.`, 'PULSE_CANONICAL_NATIVE_EFFECT_INDEX_INVALID', { effectIndex: index });
       const payload = value(payloadHandle);
-      pending.push(Object.freeze({ index, effect, payload }));
+      const kvAdmission = portableKv.isConditionalKv(effect.kind) ? portableKv.admitConditionalKv(nativeEffect(effect, payload), options) : undefined;
+      if (kvAdmission) portableKv.registerKvRedactions(kvAdmission, (value) => sensitiveValues.add(value));
+      pending.push(Object.freeze({ index, effect, payload, ...(kvAdmission ? { kvAdmission } : {}) }));
     }
   };
 
@@ -782,7 +788,7 @@ function instantiateCanonicalNativeModule(compiled, options = {}) {
       throw new CanonicalNativeHostError(`Native host cannot prepare an unknown effect index ${effectIndex}.`, 'PULSE_CANONICAL_NATIVE_EFFECT_INDEX_INVALID', { effectIndex });
     }
 
-    let result = rawResult;
+    let result = portableKv.isConditionalKv(effect.kind) ? portableKv.normalizeConditionalKvResult(effect, rawResult, options) : rawResult;
     if (effect.kind === 'event.emit' && result !== undefined) {
       throw new canonicalRuntime.CanonicalRuntimeError(
         'EventAcceptanceError',
@@ -992,7 +998,11 @@ async function executeCanonicalNativeInvocation(compiled, options = {}, invocati
         if (eventMode && options.signal && options.signal.aborted) {
           throw nativeEventCancelled('Native event execution was cancelled before effect dispatch.');
         }
-        const rawEffect = nativeEffect(entry.effect, entry.payload);
+        const rawEffect = { ...nativeEffect(entry.effect, entry.payload), ...entry.kvAdmission };
+        const conditional = portableKv.isConditionalKv(rawEffect.kind);
+        const privateEffect = conditional || ((controller.plan.packages && controller.plan.packages.effects) || []).some((item) =>
+          item.package === entry.effect.package && item.contractId === entry.effect.contractId && item.operation === entry.effect.operation
+          && item.redaction && Object.keys(item.redaction).length > 0);
         const normalized = canonicalRuntime.normalizeProviderEffect(rawEffect, controller.schemaCodecs, {
           ...options,
           strict: options.strict === undefined
@@ -1002,8 +1012,8 @@ async function executeCanonicalNativeInvocation(compiled, options = {}, invocati
           target: 'native',
           provider: adapter.id
         });
-        controller.trace.push(Object.freeze(redactValue({ type: 'native-effect-start', executionId, provider: adapter.id, effectId: normalized.id, kind: normalized.kind, payload: entry.payload }, controller.sensitiveValues)));
-        const rawResult = await raceNativeEventSignal(adapter.dispatchEffect(normalized, {
+        controller.trace.push(Object.freeze(redactValue({ type: 'native-effect-start', executionId, provider: adapter.id, effectId: normalized.id, kind: normalized.kind, payload: privateEffect ? '<redacted>' : entry.payload }, controller.sensitiveValues)));
+        const effectExecution = {
           ...options,
           executionId,
           metadata: compiled && compiled.plan ? compiled.plan.canonical : controller.plan.canonical,
@@ -1018,9 +1028,13 @@ async function executeCanonicalNativeInvocation(compiled, options = {}, invocati
           validateSchemaValue(schemaId, value, context = {}) {
             return controller.schemaCodecs.decode(String(schemaId), value, context.source || 'package-effect');
           }
-        }), eventMode ? options.signal : undefined);
+        };
+        const rawResult = conditional
+          ? await portableKv.executeConditionalKv(normalized, adapter.prepareConditionalKv || ((_admitted, kvExecution) => () => adapter.dispatchEffect(normalized, kvExecution)),
+              { ...effectExecution, onKvObservation: (event) => controller.trace.push(event) }, options)
+          : await raceNativeEventSignal(adapter.dispatchEffect(normalized, effectExecution), eventMode ? options.signal : undefined);
         const result = controller.prepareEffectResult(entry.index, rawResult);
-        controller.trace.push(Object.freeze(redactValue({ type: 'native-effect-resolved', executionId, provider: adapter.id, effectId: normalized.id, kind: normalized.kind, result: entry.effect.kind === 'secret.get' ? '<redacted>' : result && typeof result.toJSON === 'function' ? result.toJSON() : result }, controller.sensitiveValues)));
+        controller.trace.push(Object.freeze(redactValue({ type: 'native-effect-resolved', executionId, provider: adapter.id, effectId: normalized.id, kind: normalized.kind, result: privateEffect || entry.effect.kind === 'secret.get' ? '<redacted>' : result && typeof result.toJSON === 'function' ? result.toJSON() : result }, controller.sensitiveValues)));
         resolutionOrder.push(entry.effect.id);
         return { entry, result };
       }));

package/src/runtime/native-crypto-verifier.js

@@ -244,7 +244,13 @@ function createNativeGuestSourceCryptoVerifier(input = {}) {
     && memory.buffer.byteLength === ES256_MEMORY_BYTES
     && typeof verifyEs256 === 'function'
   );
+  const byteAlgorithms = ['SHA-256', 'HMAC-SHA256'].filter((algorithm) =>
+    selectedAlgorithm(plan, algorithm, HS256_REALIZATION, 'guest-source', CRYPTO_GUEST_SOURCE_IMPLEMENTATION));
+  const digestMac = byteAlgorithms.length > 0
+    ? require('@pulse-compute/crypto/pulsewasm-native').bindNativeDigestMac(moduleExports) : undefined;
   const selectedRealizations = Object.freeze([
+    ...byteAlgorithms.map((algorithm) => Object.freeze({ algorithm, realization: HS256_REALIZATION,
+      implementation: CRYPTO_GUEST_SOURCE_IMPLEMENTATION, guestUnitRequired: false, available: Boolean(digestMac) })),
     ...(selected ? [Object.freeze({
       algorithm: 'HS256',
       realization: HS256_REALIZATION,
@@ -271,6 +277,10 @@ function createNativeGuestSourceCryptoVerifier(input = {}) {
   });
 
   const verifier = Object.freeze({
+    ...(digestMac ? { bytes: Object.freeze({
+      ...(byteAlgorithms.includes('SHA-256') ? { sha256: digestMac.sha256 } : {}),
+      ...(byteAlgorithms.includes('HMAC-SHA256') ? { hmacSha256: digestMac.hmacSha256 } : {})
+    }) } : {}),
     mac: Object.freeze({
       verify(request) {
         const normalized = normalizeRequest(request);