@pulse-compute/wasm-host-runtime 1.0.0-beta.5 → 1.0.0-beta.6

package/README.md

@@ -7,9 +7,9 @@
 > **Supported entry points:** `None for application authors.`<br>
 > **Stability:** Internal compiler/runtime interface synchronized with this release set.<br>
 > **npm:** [`@pulse-compute/wasm-host-runtime`](https://www.npmjs.com/package/@pulse-compute/wasm-host-runtime)<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.5/packages/implementation-packages/)
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.6/packages/implementation-packages/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.5` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.6` package policy.
 <!-- pulse-package-status:end -->
 
 Package-owned PulseWasm host-runtime build-time builders and local runtime helpers.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-compute/wasm-host-runtime",
-  "version": "1.0.0-beta.5",
+  "version": "1.0.0-beta.6",
   "license": "Apache-2.0",
   "engines": {
     "node": "^22.14.0 || ^24.0.0"
@@ -28,11 +28,11 @@
     "./runtime/canonical-native-host": "./src/runtime/canonical-native-host.js"
   },
   "dependencies": {
-    "@pulse-compute/crypto": "1.0.0-beta.5",
-    "@pulse-compute/runtime": "1.0.0-beta.5",
-    "@pulse-compute/wasm-build-support": "1.0.0-beta.5",
-    "@pulse-compute/wasm-contracts": "1.0.0-beta.5",
-    "@pulse-compute/wasm-schema-json": "1.0.0-beta.5"
+    "@pulse-compute/crypto": "1.0.0-beta.6",
+    "@pulse-compute/runtime": "1.0.0-beta.6",
+    "@pulse-compute/wasm-build-support": "1.0.0-beta.6",
+    "@pulse-compute/wasm-contracts": "1.0.0-beta.6",
+    "@pulse-compute/wasm-schema-json": "1.0.0-beta.6"
   },
   "publishConfig": {
     "access": "public"
@@ -48,7 +48,7 @@
     "url": "git+https://github.com/pulse-compute/pulse.git",
     "directory": "wasm/packages/host-runtime"
   },
-  "homepage": "https://pulsecompute.io/v1.0.0-beta.5/packages/implementation-packages/",
+  "homepage": "https://pulsecompute.io/v1.0.0-beta.6/packages/implementation-packages/",
   "bugs": {
     "url": "https://github.com/pulse-compute/pulse/issues"
   }

package/src/runtime/canonical-api-runtime.js

@@ -1,4 +1,5 @@
 'use strict';
+const { createEffectInvocations, normalizeMaxEffects } = require('./effect-invocations.js');
 const portableKv = require('@pulse-compute/runtime/host');
 
 
@@ -262,7 +263,10 @@ function redactRuntimeError(error, sensitiveValues = new Set(), seen = new WeakS
   const rawDetail = ownDataValue(error, 'detail');
   const message = redactString(typeof rawMessage === 'string' ? rawMessage : 'Pulse runtime failure.', sensitiveValues);
   const name = redactString(typeof rawName === 'string' ? rawName : 'Error', sensitiveValues);
-  const code = typeof rawCode === 'string' ? redactString(rawCode, sensitiveValues) : undefined;
+  // Keep the finite admitted discriminator intact; messages, causes and arbitrary
+  // provider codes still pass through ordinary sensitive-value redaction.
+  const code = portableKv.isApplicationError(error) ? rawCode
+    : typeof rawCode === 'string' ? redactString(rawCode, sensitiveValues) : undefined;
   const detail = rawDetail === undefined ? undefined : redactRuntimeValue(rawDetail, sensitiveValues, seen, 'detail', depth + 1);
 
   const safe = code === undefined
@@ -786,11 +790,12 @@ function normalizedInit(init = {}, schemaCodecs, options = {}) {
   let body;
   let bodyMode = 'none';
   if (hasBody) {
-    if (typeof value.body !== 'string') {
+    const incoming = options.incomingBody && value.body === options.incomingBody.marker();
+    if (typeof value.body !== 'string' && !incoming) {
       throw new CanonicalRuntimeError('FetchRequestError', 'PULSE_FETCH_BODY_INVALID', 'Canonical fetch body must be a string.', { valueType: typeof value.body });
     }
     body = value.body;
-    bodyMode = 'text';
+    bodyMode = incoming ? 'incoming-request-v1' : 'text';
   } else if (hasJson) {
     if (!headerValue(headers, 'content-type')) headers.push(['content-type', 'application/json; charset=utf-8']);
     if (hasSchema) {
@@ -936,6 +941,8 @@ function normalizeProviderEffect(effect, schemaCodecs, options = {}) {
   if (effect.kind === 'fetch') return normalizeFetchEffect(effect, schemaCodecs, options);
   const id = String(effect.id || '');
   if (!id) throw new CanonicalRuntimeError('CanonicalEffectProtocolError', 'PULSE_CANONICAL_EFFECT_PROTOCOL', 'Canonical provider effect requires an id.', { effect });
+  if (effect.kind === 'output.readTextChunk') return Object.freeze({ id, kind: effect.kind, providerKind: 'output', operation: 'readTextChunk', capability: 'request.body.transform' });
+  if (effect.kind === 'output.start' || effect.kind === 'output.write') return Object.freeze({ id, kind: effect.kind, providerKind: 'output', operation: effect.kind.slice(7), capability: 'response.output', argument0: effect.argument0 });
   if (effect.kind === 'time.now') return Object.freeze({ id, kind: 'time.now', providerKind: 'time', operation: 'now', capability: 'time.wall-clock', source: effect.source, ...(effect.groupKey === undefined ? {} : { groupKey: String(effect.groupKey) }) });
   if (effect.kind === 'config.get' || effect.kind === 'secret.get') {
     return Object.freeze({ id, kind: effect.kind, name: String(effect.name), ...(effect.groupKey === undefined ? {} : { groupKey: String(effect.groupKey) }), source: effect.source });
@@ -1364,6 +1371,9 @@ function createCanonicalHostRuntime(options = {}) {
     const metadata = assertCanonicalProgramCompatibility(programModule);
     executionSequence += 1;
     const executionId = String(executionOptions.executionId || `canonical-${adapter.id}-${executionSequence}`);
+    const maxEffects = normalizeMaxEffects(executionOptions.maxEffects ?? options.maxEffects);
+    const invocations = createEffectInvocations(() => executionOptions.requestBudget.check());
+    const continuationIds = [];
     const sensitiveValues = initialSensitiveValues({ ...options, ...executionOptions });
     let executionStatus = 'failed';
     let executionFailure;
@@ -1416,23 +1426,24 @@ function createCanonicalHostRuntime(options = {}) {
     let dispatchedEffects = 0;
 
     function executionContinuations() {
-      const prefix = `${executionId}:`;
-      return registry.list().filter((entry) => entry.id.startsWith(prefix));
+      return continuationIds.map(id => registry.get(id));
     }
 
     async function dispatchOne(effect) {
       executionOptions.requestBudget.check();
+      const ticket = invocations.open(effect.id, effect.id);
       const normalized = normalizeProviderEffect(effect, schemaCodecs, runtimeOptions);
       const conditional = portableKv.isConditionalKv(normalized.kind);
       if (conditional) portableKv.registerKvRedactions(normalized, (value) => sensitiveValues.add(value));
-      recordTrace(effectTraceStart(adapter.id, executionId, normalized, sensitiveValues));
+      recordTrace({ ...effectTraceStart(adapter.id, executionId, normalized, sensitiveValues), invocationId: ticket.invocationId });
       dispatchedEffects += 1;
       try {
-        const effectExecution = { ...options, ...executionOptions, metadata, executionId, trace: traceSink, registerRedactionValue: (value) => sensitiveValues.add(value), onKvObservation: recordTrace };
+        const effectExecution = { ...options, ...executionOptions, metadata, executionId, invocationId: ticket.invocationId, trace: traceSink, registerRedactionValue: (value) => sensitiveValues.add(value), onKvObservation: recordTrace };
         let snapshot = conditional
           ? await portableKv.executeConditionalKv(normalized, adapter.prepareConditionalKv || ((_admitted, kvExecution) => () => adapter.dispatchEffect(normalized, kvExecution)), effectExecution, runtimeOptions)
           : await executionOptions.requestBudget.race(adapter.dispatchEffect(normalized, effectExecution));
         executionOptions.requestBudget.check();
+        invocations.assertPending(ticket);
         if (normalized.kind === 'config.get' || normalized.kind === 'secret.get') {
           if (snapshot !== undefined && typeof snapshot !== 'string') {
             throw new CanonicalRuntimeError(
@@ -1480,9 +1491,13 @@ function createCanonicalHostRuntime(options = {}) {
             })
           : snapshot;
         resolutionOrder.push(effect.id);
-        recordTrace(effectTraceResolved(adapter.id, executionId, normalized, value));
-        return value;
+        recordTrace({ ...effectTraceResolved(adapter.id, executionId, normalized, value), invocationId: ticket.invocationId });
+        return invocations.settle(ticket, () => value);
       } catch (error) {
+        // A request deadline outranks a capability's concurrent abort result.
+        try { executionOptions.requestBudget.check(); } catch (failure) {
+          if (typeof failure?.code === 'string' && failure.code.startsWith('PULSE_REQUEST_')) error = failure;
+        }
         recordTrace(Object.freeze({ type: 'effect-failed', provider: adapter.id, executionId, effectId: effect.id, kind: normalized.kind, error: error.name || 'Error', code: error.code }));
         throw redactRuntimeError(error, sensitiveValues);
       }
@@ -1533,12 +1548,18 @@ function createCanonicalHostRuntime(options = {}) {
       const marker = step.value;
       if (!marker || marker.protocol !== canonicalRuntimeContract.CANONICAL_RUNTIME_PROTOCOL_VERSION || !canonicalRuntimeContract.CANONICAL_EFFECT_MARKER_KINDS.includes(marker.kind)) throw new CanonicalRuntimeError('CanonicalEffectProtocolError', 'PULSE_CANONICAL_EFFECT_PROTOCOL', 'Canonical handler yielded an unsupported runtime marker.', { marker });
       const effects = marker.kind === 'group' ? marker.effects : [marker.effect];
-      const continuationId = `${executionId}:${marker.continuationId}`;
+      const continuationId = `${executionId}:${invocations.execution}:${marker.continuationId}:${continuationIds.length + 1}`;
       registry.create({ id: continuationId, branchPoint: marker.continuationId, effectIds: effects.map((effect) => effect.id), ttlMs: executionOptions.continuationTtlMs || options.continuationTtlMs });
+      continuationIds.push(continuationId);
       registry.wait(continuationId);
       recordTrace(Object.freeze({ type: 'continuation-waiting', provider: adapter.id, executionId, continuationId, effectIds: effects.map((effect) => effect.id) }));
       let value;
       try {
+        if (dispatchedEffects + effects.length > maxEffects) {
+          throw new CanonicalRuntimeError('EffectLimitError', 'PULSE_RUNTIME_EFFECT_LIMIT_EXCEEDED',
+            `Pulse request exceeded the maximum of ${maxEffects} request-owned effects.`,
+            { effectCount: dispatchedEffects, pendingEffects: effects.length, maxEffects });
+        }
         value = marker.kind === 'group' ? await dispatchGroup(effects) : await dispatchOne(effects[0]);
         executionOptions.requestBudget.check();
         registry.resume(continuationId);
@@ -1584,6 +1605,7 @@ function createCanonicalHostRuntime(options = {}) {
       executionFailure = redactRuntimeError(error, sensitiveValues);
       throw executionFailure;
     } finally {
+      invocations.close();
       try { adapter.disposeExecution(Object.freeze({ executionId, metadata, status: executionStatus, error: executionFailure })); }
       catch (_) { /* provider cleanup must not mask execution results */ }
     }

package/src/runtime/canonical-native-host.js

@@ -1,5 +1,7 @@
 'use strict';
 const portableKv = require('@pulse-compute/runtime/host');
+const { createEffectInvocations, normalizeMaxEffects } = require('./effect-invocations.js');
+const { NativeValueBudget } = require('./native-value-budget.js');
 
 const crypto = require('node:crypto');
 const {
@@ -45,7 +47,6 @@ const canonicalRuntime = loadCanonicalRuntime();
 const schemaCodecTools = loadSchemaCodecTools();
 const eventContract = loadEventContract();
 let executionSequence = 0;
-const DEFAULT_MAX_EFFECTS = 1024;
 
 class CanonicalNativeHostError extends Error {
   constructor(message, code = 'PULSE_CANONICAL_NATIVE_HOST_FAILED', detail = {}) {
@@ -60,14 +61,6 @@ function sha256(value) {
   return crypto.createHash('sha256').update(value).digest('hex');
 }
 
-function normalizeMaxEffects(value) {
-  const maxEffects = value === undefined ? DEFAULT_MAX_EFFECTS : Number(value);
-  if (!Number.isSafeInteger(maxEffects) || maxEffects <= 0) {
-    throw new TypeError('Pulse maxEffects must be a positive safe integer.');
-  }
-  return maxEffects;
-}
-
 function staticDecoderArgument(expression, effect) {
   if (expression && expression.kind === 'literal' && ['string', 'number', 'boolean'].includes(typeof expression.value)) return expression.value;
   if (expression && expression.kind === 'literal' && expression.value === null) return null;
@@ -117,13 +110,40 @@ function createSchemaCodecs(registryInput = {}) {
 }
 
 class ValueHeap {
-  constructor() {
+  constructor(budget) {
+    this.budget = budget;
     this.values = new Map();
     this.next = 1;
+    // Immutable scalars have value semantics. Reuse common handles rather than
+    // retaining a new boxed value for every literal/property read in a loop.
+    // Bound the index itself and rotate its oldest mapping as the working set
+    // changes. Eviction never releases a handle or refunds its cumulative charge.
+    this.scalars = budget ? new Map() : undefined;
+    this.identities = budget ? new WeakMap() : undefined;
+    this.identityCount = 0;
+    this.negativeZero = Symbol('negative-zero');
   }
   put(value) {
+    this.budget?.charge(0, 0); // Cached reads cannot recover a latched failure.
+    const type = typeof value;
+    const scalar = value === null || type === 'undefined' || type === 'boolean' || type === 'number' || type === 'string';
+    const object = value !== null && type === 'object';
+    if (object && this.identities?.has(value)) return this.identities.get(value);
+    const key = Object.is(value, -0) ? this.negativeZero : value;
+    if (scalar && this.scalars?.has(key)) return this.scalars.get(key);
+    const cache = scalar && this.scalars;
+    const cacheIdentity = object && this.identities && this.identityCount < 8192;
+    // Charge index growth once. Replacing a scalar mapping reuses its bounded
+    // capacity; every new value handle below remains cumulatively charged.
+    if ((cache && this.scalars.size < 8192) || cacheIdentity) this.budget.charge(1, this.budget.policy.edgeBytes * 2);
+    this.budget?.retain(value);
     const handle = this.next++;
     this.values.set(handle, value);
+    if (cache) {
+      if (this.scalars.size === 8192) this.scalars.delete(this.scalars.keys().next().value);
+      this.scalars.set(key, handle);
+    }
+    if (cacheIdentity) { this.identities.set(value, handle); this.identityCount++; }
     return handle;
   }
   has(handle) { return this.values.has(Number(handle)); }
@@ -244,6 +264,7 @@ function nativeEffect(planEffect, payload) {
     resource: planEffect.resource,
     source: planEffect.source
   };
+  if (planEffect.kind === 'output.start' || planEffect.kind === 'output.write') return { ...base, argument0: payload.argument0 };
   if (planEffect.kind === 'time.now') return { ...base, providerKind: 'time', operation: 'now', capability: 'time.wall-clock' };
   if (planEffect.kind === 'fetch') {
     const response = nativeFetchResponseContract(planEffect, payload);
@@ -348,6 +369,9 @@ function validateNativeModule(module, plan) {
   const missing = runtimeContract.CANONICAL_NATIVE_EXPORT_NAMES.filter((name) => !exportNames.has(name));
   if (missing.length > 0) throw new CanonicalNativeHostError('Native module is missing required ABI exports.', 'PULSE_CANONICAL_NATIVE_ABI_EXPORT_MISMATCH', { missing });
   if (!plan || typeof plan !== 'object' || !plan.planHash) throw new TypeError('Native module execution requires its canonical native plan.');
+  if (plan.packages?.application?.effectFailure === 'package-completion' && !exports.some(entry => entry.name === 'pulse_package_set_effect_failure' && entry.kind === 'function')) {
+    throw new CanonicalNativeHostError('Native package application is missing its effect failure ABI.', 'PULSE_CANONICAL_NATIVE_ABI_EXPORT_MISMATCH');
+  }
   const eventReachable = Boolean(plan.events && plan.events.catalog && plan.events.catalog.events.length > 0);
   const eventExportNames = eventContract.EVENT_NATIVE_ABI_EXTENSION.exports.map((entry) => entry.name);
   const presentEventExports = eventExportNames.filter((name) => exportNames.has(name));
@@ -371,9 +395,32 @@ function instantiateCanonicalNativeModule(compiled, options = {}) {
   const moduleShape = validateNativeModule(module, plan);
   const adapter = normalizeProviderAdapter(options.providerAdapter || options.provider);
   const executionPlane = options.executionPlane === 'event' ? 'event' : 'http';
-  const heap = new ValueHeap();
+  const memoryBudget = (runtimeContract.hasBoundedReadLoop(plan) || plan.capabilities.includes('response.output') || plan.capabilities.includes('request.body.transform'))
+    ? new NativeValueBudget(runtimeContract.CANONICAL_NATIVE_READ_LOOP_MEMORY, close) : undefined;
+  const heap = new ValueHeap(memoryBudget);
   const pending = [];
+  const invocations = createEffectInvocations(() => {
+    options.requestBudget?.check();
+    if (options.signal?.aborted) throw nativeRequestCancelled(options.signal);
+  });
+  function close() {
+    invocations.close();
+    pending.length = 0;
+    options.signal?.removeEventListener('abort', close);
+  }
+  function run(operation) {
+    try {
+      invocations.assertOpen();
+      const status = operation();
+      if (status === runtimeContract.CANONICAL_NATIVE_RUN_STATUS.COMPLETE || status === runtimeContract.CANONICAL_NATIVE_RUN_STATUS.FAILED) close();
+      return status;
+    } catch (error) { close(); throw error; }
+  }
   const trace = [];
+  if (memoryBudget) Object.defineProperty(trace, 'push', { value(...entries) {
+    for (const entry of entries) memoryBudget.retain(entry);
+    return Array.prototype.push.apply(this, entries);
+  } });
   const sensitiveValues = new Set();
   const configuredSecrets = options.secrets && typeof options.secrets === 'object' ? options.secrets : {};
   for (const value of Object.values(configuredSecrets)) if (typeof value === 'string' && value.length > 0) sensitiveValues.add(value);
@@ -569,6 +616,15 @@ function instantiateCanonicalNativeModule(compiled, options = {}) {
   }
 
   const pulseHost = {
+    value_json(handle) {
+      const text = JSON.stringify(value(handle) ?? null);
+      if (Buffer.byteLength(text, 'utf8') > runtimeContract.CANONICAL_NATIVE_VALUE_TRANSFER_MAX_BYTES) throw new CanonicalNativeHostError('Native value transfer exceeds 1 MiB.', 'PULSE_CANONICAL_NATIVE_VALUE_TYPE');
+      const exports = instance.exports;
+      const pointer = exports.__new(text.length * 2, exports.pulse_schema_string_id());
+      const view = new Uint16Array(memory().buffer, pointer, text.length);
+      for (let index = 0; index < text.length; index++) view[index] = text.charCodeAt(index);
+      return pointer;
+    },
     value_undefined() { return put(undefined); },
     value_null() { return put(null); },
     value_boolean(input) { return put(Number(input) !== 0); },
@@ -578,26 +634,43 @@ function instantiateCanonicalNativeModule(compiled, options = {}) {
     value_array_push(arrayHandle, valueHandle) {
       const target = value(arrayHandle);
       if (!Array.isArray(target)) throw new CanonicalNativeHostError('value_array_push target is not an array.', 'PULSE_CANONICAL_NATIVE_VALUE_TYPE', { arrayHandle });
+      memoryBudget?.write(target, String(target.length), value(valueHandle));
       target.push(value(valueHandle));
     },
     value_array_spread(arrayHandle, valueHandle) {
       const target = value(arrayHandle);
       const source = value(valueHandle);
       if (!Array.isArray(target) || !source || typeof source[Symbol.iterator] !== 'function') throw new CanonicalNativeHostError('value_array_spread requires iterable input.', 'PULSE_CANONICAL_NATIVE_VALUE_TYPE');
-      target.push(...source);
+      const append = item => {
+        memoryBudget?.write(target, String(target.length), item);
+        target.push(item);
+      };
+      if (Array.isArray(source)) {
+        const length = source.length;
+        for (let index = 0; index < length; index++) append(source[index]);
+      } else for (const item of source) append(item);
     },
     value_object() { return put({}); },
     value_object_set(objectHandle, keyHandle, valueHandle) {
       const target = value(objectHandle);
       if (!target || typeof target !== 'object') throw new CanonicalNativeHostError('value_object_set target is not an object.', 'PULSE_CANONICAL_NATIVE_VALUE_TYPE', { objectHandle });
-      target[String(value(keyHandle))] = value(valueHandle);
+      const key = String(value(keyHandle));
+      memoryBudget?.write(target, key, value(valueHandle));
+      target[key] = value(valueHandle);
     },
     value_object_spread(objectHandle, valueHandle) {
       const target = value(objectHandle);
       const source = value(valueHandle);
       if (!target || typeof target !== 'object') throw new CanonicalNativeHostError('value_object_spread target is not an object.', 'PULSE_CANONICAL_NATIVE_VALUE_TYPE');
       if (source === null || source === undefined) return;
-      Object.assign(target, source);
+      // String spreading materializes one property per UTF-16 code unit.
+      // Reserve that capacity before asking the engine to enumerate its keys.
+      if (typeof source === 'string') memoryBudget?.charge(source.length,
+        source.length * (runtimeContract.CANONICAL_NATIVE_READ_LOOP_MEMORY.valueBytes + runtimeContract.CANONICAL_NATIVE_READ_LOOP_MEMORY.edgeBytes));
+      for (const key of Object.keys(source)) {
+        memoryBudget?.write(target, key, source[key]);
+        target[key] = source[key];
+      }
     },
     value_property(objectHandle, keyHandle) {
       const target = value(objectHandle);
@@ -608,6 +681,7 @@ function instantiateCanonicalNativeModule(compiled, options = {}) {
       const target = value(objectHandle);
       if (target === null || target === undefined) throw new CanonicalNativeHostError('Cannot write a property on null or undefined.', 'PULSE_CANONICAL_NATIVE_VALUE_TYPE', { objectHandle });
       const assigned = value(valueHandle);
+      memoryBudget?.write(target, String(value(keyHandle)), assigned);
       target[String(value(keyHandle))] = assigned;
       return valueHandle;
     },
@@ -620,6 +694,7 @@ function instantiateCanonicalNativeModule(compiled, options = {}) {
       const target = value(objectHandle);
       if (target === null || target === undefined) throw new CanonicalNativeHostError('Cannot write an element on null or undefined.', 'PULSE_CANONICAL_NATIVE_VALUE_TYPE', { objectHandle });
       const assigned = value(valueHandle);
+      memoryBudget?.write(target, value(keyHandle), assigned);
       target[value(keyHandle)] = assigned;
       return valueHandle;
     },
@@ -657,9 +732,19 @@ function instantiateCanonicalNativeModule(compiled, options = {}) {
       const header = context.ctx.req.headers.find(([key]) => String(key).toLowerCase() === name);
       return put(header ? header[1] : undefined);
     },
-    request_text() { requireHttpSurface('ctx.req.text'); return put(context.ctx.req.text()); },
+    request_body() {
+      requireHttpSurface('ctx.req.body');
+      if (!options.incomingBody || adapter.id !== 'node') throw new CanonicalNativeHostError('Incoming forwarding requires an admitted Node request owner.', 'PULSE_REQUEST_FORWARDING_UNAVAILABLE');
+      return put(options.incomingBody.marker());
+    },
+    request_text() {
+      requireHttpSurface('ctx.req.text');
+      if (options.incomingBody) throw new CanonicalNativeHostError('Native forwarding/transform admission cannot also project structured request bytes.', 'PULSE_REQUEST_BODY_OWNERSHIP');
+      return put(context.ctx.req.text());
+    },
     request_json(schemaHandle) {
       requireHttpSurface('ctx.req.json');
+      if (options.incomingBody) throw new CanonicalNativeHostError('Native forwarding/transform admission cannot also project structured request bytes.', 'PULSE_REQUEST_BODY_OWNERSHIP');
       const schema = value(schemaHandle);
       return put(schema === undefined ? context.ctx.req.json() : context.ctx.req.json(schema));
     },
@@ -736,14 +821,26 @@ function instantiateCanonicalNativeModule(compiled, options = {}) {
       if (!response || typeof response.header !== 'function') throw new CanonicalNativeHostError('fetch_header requires a fetch response.', 'PULSE_CANONICAL_NATIVE_VALUE_TYPE');
       return put(response.header(value(nameHandle)));
     },
+    output_close() {
+      if (!options.outputExecution) throw new portableKv.PulseRuntimeContractError('PULSE_OUTPUT_UNAVAILABLE', 'Generated output requires Node HTTP execution.');
+      return put(options.outputExecution.close());
+    },
     effect_begin(effectIndex, payloadHandle) {
+      options.outputExecution?.assertEffect();
       const index = Number(effectIndex);
       const effect = plan.effects && plan.effects[index];
       if (!effect) throw new CanonicalNativeHostError(`Native module requested unknown effect index ${index}.`, 'PULSE_CANONICAL_NATIVE_EFFECT_INDEX_INVALID', { effectIndex: index });
       const payload = value(payloadHandle);
+      // Admission happens while the guest builds its suspension group. A bad
+      // later member throws before the host dispatch loop starts any member.
+      if (effect.kind === 'fetch' && options.incomingBody) {
+        const admitted = canonicalRuntime.normalizeProviderEffect(nativeEffect(effect, payload), schemaCodecs, { ...options, strict, target: 'native', provider: adapter.id });
+        if (admitted.init.bodyMode === 'incoming-request-v1') options.incomingBody.claim(admitted.init.body, admitted.init);
+      }
       const kvAdmission = portableKv.isConditionalKv(effect.kind) ? portableKv.admitConditionalKv(nativeEffect(effect, payload), options) : undefined;
       if (kvAdmission) portableKv.registerKvRedactions(kvAdmission, (value) => sensitiveValues.add(value));
-      pending.push(Object.freeze({ index, effect, payload, ...(kvAdmission ? { kvAdmission } : {}) }));
+      const ticket = invocations.open(index, effect.id);
+      pending.push(Object.freeze({ index, effect, payload, ticket, ...(kvAdmission ? { kvAdmission } : {}) }));
     }
   };
 
@@ -763,6 +860,7 @@ function instantiateCanonicalNativeModule(compiled, options = {}) {
   let applicationError = 0;
   const applicationErrors = executionPlane === 'http' && (plan.routing?.entries || []).some(entry => entry.kind === 'error');
   function captureApplicationError(error) {
+    if (options.outputExecution?.started) return false;
     if (!applicationErrors || options.signal?.aborted || !portableKv.isApplicationError(error)) return false;
     if (!applicationError) {
       const safe = canonicalRuntime.redactRuntimeError(error, sensitiveValues);
@@ -857,13 +955,25 @@ function instantiateCanonicalNativeModule(compiled, options = {}) {
     return result;
   }
 
-  function setEffectResult(index, result) {
-    const handle = put(result);
-    const accepted = instance.exports.pulse_set_effect_result(Number(index), handle);
-    if (accepted !== runtimeContract.CANONICAL_NATIVE_RESULT_STATUS.ACCEPTED) {
-      throw new CanonicalNativeHostError(`Native module rejected effect result index ${index}.`, 'PULSE_CANONICAL_NATIVE_EFFECT_INDEX_INVALID', { effectIndex: Number(index), errorCode: instance.exports.pulse_last_error_code() });
-    }
-    return handle;
+  function setEffectResult(ticket, result) {
+    return invocations.settle(ticket, () => {
+      const handle = put(result);
+      const accepted = instance.exports.pulse_set_effect_result(ticket.slot, handle);
+      if (accepted !== runtimeContract.CANONICAL_NATIVE_RESULT_STATUS.ACCEPTED) {
+        close();
+        throw new CanonicalNativeHostError('Native module rejected an invocation result.', 'PULSE_CANONICAL_NATIVE_EFFECT_INDEX_INVALID', { effectIndex: ticket.slot, errorCode: instance.exports.pulse_last_error_code() });
+      }
+      return handle;
+    });
+  }
+
+  function setEffectFailure(ticket) {
+    return invocations.settle(ticket, () => {
+      if (instance.exports.pulse_package_set_effect_failure(ticket.slot) !== runtimeContract.CANONICAL_NATIVE_RESULT_STATUS.ACCEPTED) {
+        close();
+        throw new CanonicalNativeHostError('Native package rejected an invocation failure.', 'PULSE_CANONICAL_NATIVE_EFFECT_INDEX_INVALID');
+      }
+    });
   }
 
   function resultValue() {
@@ -903,9 +1013,11 @@ function instantiateCanonicalNativeModule(compiled, options = {}) {
       schemaId: selected.schemaId,
       payloadHandle
     });
-    return instance.exports.pulse_event_start(selected.runtimeId, payloadHandle);
+    return run(() => instance.exports.pulse_event_start(selected.runtimeId, payloadHandle));
   }
 
+  options.signal?.addEventListener('abort', close, { once: true });
+  if (options.signal?.aborted) close();
   return Object.freeze({
     version: runtimeContract.CANONICAL_NATIVE_HOST_VERSION,
     plan,
@@ -922,14 +1034,17 @@ function instantiateCanonicalNativeModule(compiled, options = {}) {
     cryptoVerifier: nativeCrypto.verifier,
     cryptoRealization: nativeCrypto.realization,
     executionPlane,
-    start() { requireExecutionPlane('http'); return instance.exports.pulse_start(); },
+    start() { requireExecutionPlane('http'); return run(() => instance.exports.pulse_start()); },
     startEvent,
     eventSelection() { return activeEvent; },
-    resume() { return instance.exports.pulse_resume(); },
+    resume() { return run(() => instance.exports.pulse_resume()); },
+    close,
+    assertPendingEffect: invocations.assertPending,
     pendingEffects: takePending,
     prepareEffectResult,
     captureApplicationError,
     setEffectResult,
+    setEffectFailure,
     resultValue,
     response() { requireHttpSurface('HTTP completion'); return canonicalRuntime.finalResponse(resultValue(), context.ctx.req.method); },
     programCounter() { return instance.exports.pulse_program_counter(); },
@@ -977,6 +1092,13 @@ function raceNativeSignal(value, signal, eventMode = true) {
 }
 
 async function executeCanonicalNativeInvocation(compiled, options = {}, invocation = Object.freeze({ plane: 'http' })) {
+  const ownedResponseBodies = new Set();
+  let responseBodyTransferred, invocationClosed = false;
+  const cancelBody = body => { try { void body.cancel().catch(() => {}); } catch (_) {} };
+  options = { ...options, registerResponseBody(body) {
+    if (invocationClosed) cancelBody(body);
+    else ownedResponseBodies.add(body);
+  } };
   const eventMode = invocation && invocation.plane === 'event';
   const maxEffects = normalizeMaxEffects(options.maxEffects);
   const controller = instantiateCanonicalNativeModule(compiled, { ...options, executionPlane: eventMode ? 'event' : 'http' });
@@ -1020,6 +1142,7 @@ async function executeCanonicalNativeInvocation(compiled, options = {}, invocati
       }
       activeContinuation = {
         id: continuation.id,
+        invocationId: `continuation-${pending[0].ticket.invocationId}`,
         kind: continuation.kind,
         effectIds: Object.freeze([...pendingEffectIds]),
         stateIndex: continuationState,
@@ -1027,7 +1150,7 @@ async function executeCanonicalNativeInvocation(compiled, options = {}, invocati
         states: ['created', 'waiting']
       };
       continuations.push(activeContinuation);
-      controller.trace.push(Object.freeze(redactValue({ type: 'native-continuation-waiting', executionId, continuationId: continuation.id, continuationState, effectIds: Object.freeze([...pendingEffectIds]) }, controller.sensitiveValues)));
+      controller.trace.push(Object.freeze(redactValue({ type: 'native-continuation-waiting', executionId, continuationId: continuation.id, invocationId: activeContinuation.invocationId, continuationState, effectIds: Object.freeze([...pendingEffectIds]) }, controller.sensitiveValues)));
       if (effectCount + pending.length > maxEffects) {
         throw new CanonicalNativeHostError(
           eventMode
@@ -1039,6 +1162,7 @@ async function executeCanonicalNativeInvocation(compiled, options = {}, invocati
       }
       effectCount += pending.length;
 
+      if (pending.length > 1 && pending.some(entry => entry.effect.kind.startsWith('output.'))) throw new portableKv.PulseRuntimeContractError('PULSE_OUTPUT_PARALLEL_FORBIDDEN', 'Output effects cannot be grouped.');
       const settled = await raceNativeSignal(Promise.allSettled(pending.map(async (entry) => {
         options.requestBudget?.check();
         if (eventMode && options.signal && options.signal.aborted) {
@@ -1046,7 +1170,7 @@ async function executeCanonicalNativeInvocation(compiled, options = {}, invocati
         }
         const rawEffect = { ...nativeEffect(entry.effect, entry.payload), ...entry.kvAdmission };
         const conditional = portableKv.isConditionalKv(rawEffect.kind);
-        const privateEffect = conditional || ((controller.plan.packages && controller.plan.packages.effects) || []).some((item) =>
+        const privateEffect = rawEffect.kind.startsWith('output.') || conditional || ((controller.plan.packages && controller.plan.packages.effects) || []).some((item) =>
           item.package === entry.effect.package && item.contractId === entry.effect.contractId && item.operation === entry.effect.operation
           && item.redaction && Object.keys(item.redaction).length > 0);
         const normalized = canonicalRuntime.normalizeProviderEffect(rawEffect, controller.schemaCodecs, {
@@ -1058,10 +1182,12 @@ async function executeCanonicalNativeInvocation(compiled, options = {}, invocati
           target: 'native',
           provider: adapter.id
         });
-        controller.trace.push(Object.freeze(redactValue({ type: 'native-effect-start', executionId, provider: adapter.id, effectId: normalized.id, kind: normalized.kind, payload: privateEffect ? '<redacted>' : entry.payload }, controller.sensitiveValues)));
+        controller.assertPendingEffect(entry.ticket);
+        controller.trace.push(Object.freeze(redactValue({ type: 'native-effect-start', executionId, invocationId: entry.ticket.invocationId, provider: adapter.id, effectId: normalized.id, kind: normalized.kind, payload: privateEffect ? '<redacted>' : entry.payload }, controller.sensitiveValues)));
         const effectExecution = {
           ...options,
           executionId,
+          invocationId: entry.ticket.invocationId,
           metadata: compiled && compiled.plan ? compiled.plan.canonical : controller.plan.canonical,
           plan: controller.plan,
           packageArtifacts,
@@ -1075,13 +1201,20 @@ async function executeCanonicalNativeInvocation(compiled, options = {}, invocati
             return controller.schemaCodecs.decode(String(schemaId), value, context.source || 'package-effect');
           }
         };
-        const rawResult = conditional
+        options.outputExecution?.assertEffect();
+        const rawResult = normalized.kind.startsWith('output.')
+          ? await (options.outputExecution ? options.outputExecution.dispatch(normalized) : Promise.reject(new portableKv.PulseRuntimeContractError('PULSE_OUTPUT_UNAVAILABLE', 'Generated output requires Node HTTP execution.')))
+          : conditional
           ? await portableKv.executeConditionalKv(normalized, adapter.prepareConditionalKv || ((_admitted, kvExecution) => () => adapter.dispatchEffect(normalized, kvExecution)),
               { ...effectExecution, onKvObservation: (event) => controller.trace.push(event) }, options)
           : await raceNativeSignal(adapter.dispatchEffect(normalized, effectExecution), options.signal, eventMode);
         options.requestBudget?.check();
-        const result = controller.prepareEffectResult(entry.index, rawResult);
-        controller.trace.push(Object.freeze(redactValue({ type: 'native-effect-resolved', executionId, provider: adapter.id, effectId: normalized.id, kind: normalized.kind, result: privateEffect || entry.effect.kind === 'secret.get' ? '<redacted>' : result && typeof result.toJSON === 'function' ? result.toJSON() : result }, controller.sensitiveValues)));
+        controller.assertPendingEffect(entry.ticket);
+        // executeConditionalKv already validates, detaches, freezes and registers
+        // redactions using these execution limits. Reuse only that internal
+        // result; raw controller callers still use prepareEffectResult.
+        const result = conditional ? rawResult : controller.prepareEffectResult(entry.index, rawResult);
+        controller.trace.push(Object.freeze(redactValue({ type: 'native-effect-resolved', executionId, invocationId: entry.ticket.invocationId, provider: adapter.id, effectId: normalized.id, kind: normalized.kind, result: privateEffect || entry.effect.kind === 'secret.get' ? '<redacted>' : result && typeof result.toJSON === 'function' ? result.toJSON() : result }, controller.sensitiveValues)));
         resolutionOrder.push(entry.effect.id);
         return { entry, result };
       })), options.signal, eventMode);
@@ -1093,12 +1226,15 @@ async function executeCanonicalNativeInvocation(compiled, options = {}, invocati
       if (!eventMode && options.signal?.aborted) throw nativeRequestCancelled(options.signal);
       const failures = settled.filter(entry => entry.status === 'rejected');
       const failed = failures.find(entry => !portableKv.isApplicationError(entry.reason)) || failures[0];
-      if (failed && (!failures.every(entry => portableKv.isApplicationError(entry.reason))
+      const packageFailure = controller.plan.packages?.application?.effectFailure === 'package-completion';
+      if (failed && !packageFailure && (!failures.every(entry => portableKv.isApplicationError(entry.reason))
         || !controller.captureApplicationError(failed.reason))) {
         throw canonicalRuntime.redactRuntimeError(failed.reason, controller.sensitiveValues);
       }
-      settled.forEach((item, index) => controller.setEffectResult(pending[index].index,
-        item.status === 'fulfilled' ? item.value.result : undefined));
+      settled.forEach((item, index) => {
+        if (item.status === 'rejected' && packageFailure) controller.setEffectFailure(pending[index].ticket);
+        else controller.setEffectResult(pending[index].ticket, item.status === 'fulfilled' ? item.value.result : undefined);
+      });
       const previousPc = controller.programCounter();
       activeContinuation.state = 'resumed';
       activeContinuation.states.push('resumed');
@@ -1108,7 +1244,7 @@ async function executeCanonicalNativeInvocation(compiled, options = {}, invocati
       }
       activeContinuation.state = failed ? 'failed' : 'completed';
       activeContinuation.states.push(activeContinuation.state);
-      controller.trace.push(Object.freeze(redactValue({ type: 'native-continuation-resumed', executionId, continuationId: continuation.id, continuationState }, controller.sensitiveValues)));
+      controller.trace.push(Object.freeze(redactValue({ type: 'native-continuation-resumed', executionId, continuationId: continuation.id, invocationId: activeContinuation.invocationId, continuationState }, controller.sensitiveValues)));
       activeContinuation = undefined;
     }
 
@@ -1136,12 +1272,15 @@ async function executeCanonicalNativeInvocation(compiled, options = {}, invocati
         resolutionOrder: Object.freeze([...resolutionOrder]),
         continuations: Object.freeze(continuations.map((entry) => Object.freeze({ ...entry, states: Object.freeze([...entry.states]) }))),
         trace: Object.freeze([...controller.trace]),
-        valueHandleCount: controller.heap.size()
+        valueHandleCount: controller.heap.size(),
+        ...(controller.heap.budget ? { memory: controller.heap.budget.snapshot() } : {})
       });
     }
     if (options.signal?.aborted) throw nativeRequestCancelled(options.signal);
     options.requestBudget?.check();
+    options.outputExecution?.validateResult(controller.resultValue());
     const response = controller.response();
+    responseBodyTransferred = response.bodyStream;
     controller.trace.push(Object.freeze(redactValue({ type: 'native-execution-completed', executionId, provider: adapter.id, status: response.status, bodyClass: response.bodyClass }, controller.sensitiveValues)));
     return Object.freeze({
       status: 'completed',
@@ -1155,10 +1294,12 @@ async function executeCanonicalNativeInvocation(compiled, options = {}, invocati
       wasmSha256: controller.wasmSha256,
       response,
       effectCount,
+      ...((options.incomingBody || options.outputExecution) ? {guestMemoryBytes:controller.exports.memory.buffer.byteLength} : {}),
       resolutionOrder: Object.freeze([...resolutionOrder]),
       continuations: Object.freeze(continuations.map((entry) => Object.freeze({ ...entry, states: Object.freeze([...entry.states]) }))),
       trace: Object.freeze([...controller.trace]),
-      valueHandleCount: controller.heap.size()
+      valueHandleCount: controller.heap.size(),
+      ...(controller.heap.budget ? { memory: controller.heap.budget.snapshot() } : {})
     });
   } catch (error) {
     executionFailure = canonicalRuntime.redactRuntimeError(error, controller.sensitiveValues);
@@ -1175,6 +1316,10 @@ async function executeCanonicalNativeInvocation(compiled, options = {}, invocati
     }) });
     throw executionFailure;
   } finally {
+    invocationClosed = true;
+    for (const body of ownedResponseBodies) if (body !== responseBodyTransferred) cancelBody(body);
+    ownedResponseBodies.clear();
+    controller.close();
     try { adapter.disposeExecution(Object.freeze({ executionId, metadata: controller.plan.canonical, plan: controller.plan, status: executionFailure ? 'failed' : 'completed', error: executionFailure })); }
     catch (_) { /* provider cleanup must not mask execution */ }
   }
@@ -1184,7 +1329,7 @@ async function executeCanonicalNativeModule(compiled, options = {}) {
   const budget = portableKv.createRequestBudget(options);
   try {
     budget.check();
-    return await executeCanonicalNativeInvocation(compiled, { ...options, requestBudget: budget, signal: budget.signal, deadlineMonotonicMs: budget.deadlineMonotonicMs ?? options.deadlineMonotonicMs, kvClock: budget.deadlineMonotonicMs === undefined ? options.kvClock : budget.clock }, Object.freeze({ plane: 'http' }));
+    return await executeCanonicalNativeInvocation(compiled, { ...options, responseSignal: options.signal, requestBudget: budget, signal: budget.signal, deadlineMonotonicMs: budget.deadlineMonotonicMs ?? options.deadlineMonotonicMs, kvClock: budget.deadlineMonotonicMs === undefined ? options.kvClock : budget.clock }, Object.freeze({ plane: 'http' }));
   } finally { if (!options.requestBudget) budget.close(); }
 }
 

package/src/runtime/effect-invocations.js

@@ -0,0 +1,52 @@
+'use strict';
+
+const { CANONICAL_EFFECT_INVOCATION_POLICY } = require('@pulse-compute/wasm-contracts/handler/canonical-runtime');
+let executionSequence = 0;
+
+function normalizeMaxEffects(value) {
+  const max = value === undefined ? CANONICAL_EFFECT_INVOCATION_POLICY.defaultMaxEffects : Number(value);
+  if (!Number.isSafeInteger(max) || max <= 0) throw new TypeError('Pulse maxEffects must be a positive safe integer.');
+  return max;
+}
+
+// A ticket is authenticated by object identity, never by caller-supplied fields.
+// Only pending slots are retained; the sequence is cumulative across loop visits.
+function createEffectInvocations(check = () => {}) {
+  const execution = ++executionSequence;
+  const active = new Map();
+  let sequence = 0;
+  let closed = false;
+  function invalid() {
+    const error = new Error('Effect invocation is stale, already settled, foreign, or closed.');
+    error.name = 'EffectInvocationError';
+    error.code = 'PULSE_EFFECT_INVOCATION_INVALID';
+    throw error;
+  }
+  function assertOpen() { if (closed) invalid(); check(); }
+  function assertPending(ticket) {
+    assertOpen();
+    if (!ticket || active.get(ticket.slot) !== ticket) invalid();
+    return ticket;
+  }
+  return Object.freeze({
+    execution,
+    open(slot, siteId) {
+      assertOpen();
+      if (active.has(slot) || !Number.isSafeInteger(sequence + 1)) invalid();
+      const ticket = Object.freeze({ slot, siteId, sequence: ++sequence, invocationId: `effect-${execution}-${sequence}` });
+      active.set(slot, ticket);
+      return ticket;
+    },
+    assertOpen,
+    assertPending,
+    settle(ticket, consume) {
+      assertPending(ticket);
+      active.delete(ticket.slot); // Consume before calling into the guest.
+      return consume();
+    },
+    close() { closed = true; active.clear(); },
+    get closed() { return closed; }
+  });
+}
+
+module.exports = { createEffectInvocations, normalizeMaxEffects };

package/src/runtime/native-crypto-verifier.js

@@ -2,6 +2,7 @@
 
 const {
   CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION,
+  CRYPTO_RS256_GUEST_LINKED_IMPLEMENTATION, CRYPTO_RS256_GUEST_LINKED_REALIZATION,
   CRYPTO_ES256_GUEST_LINKED_REALIZATION,
   CRYPTO_GUEST_SOURCE_IMPLEMENTATION,
   CRYPTO_REALIZATION_PLAN_VERSION
@@ -230,6 +231,9 @@ function createNativeGuestSourceCryptoVerifier(input = {}) {
   const moduleExports = input.exports;
   const selected = selectedHs256(plan);
   const selectedSignature = selectedEs256(plan);
+  const selectedRsa = selectedAlgorithm(plan, 'RS256', CRYPTO_RS256_GUEST_LINKED_REALIZATION, 'guest-linked', CRYPTO_RS256_GUEST_LINKED_IMPLEMENTATION);
+  let rsa;
+  if (selectedRsa) { try { rsa = require('@pulse-compute/crypto/pulsewasm-native').bindNativeRs256(moduleExports); } catch {} }
   const memory = moduleExports && moduleExports.memory;
   const verifyHs256 = moduleExports && moduleExports[HS256_EXPORT];
   const verifyEs256 = moduleExports && moduleExports[ES256_EXPORT];
@@ -249,6 +253,7 @@ function createNativeGuestSourceCryptoVerifier(input = {}) {
   const digestMac = byteAlgorithms.length > 0
     ? require('@pulse-compute/crypto/pulsewasm-native').bindNativeDigestMac(moduleExports) : undefined;
   const selectedRealizations = Object.freeze([
+    ...(selectedRsa ? [{ algorithm: 'RS256', realization: CRYPTO_RS256_GUEST_LINKED_REALIZATION, implementation: CRYPTO_RS256_GUEST_LINKED_IMPLEMENTATION, guestUnitRequired: true, available: Boolean(rsa) }] : []),
     ...byteAlgorithms.map((algorithm) => Object.freeze({ algorithm, realization: HS256_REALIZATION,
       implementation: CRYPTO_GUEST_SOURCE_IMPLEMENTATION, guestUnitRequired: false, available: Boolean(digestMac) })),
     ...(selected ? [Object.freeze({
@@ -276,8 +281,12 @@ function createNativeGuestSourceCryptoVerifier(input = {}) {
     ...(selectedRealizations.length === 1 ? selectedRealizations[0] : {})
   });
 
+  const signer = es256Available && typeof moduleExports.pulse_crypto_es256_sign === 'function'
+    ? require('@pulse-compute/crypto/pulsewasm-native').bindNativeEs256Signer(moduleExports) : undefined;
   const verifier = Object.freeze({
-    ...(digestMac ? { bytes: Object.freeze({
+    ...(digestMac || signer || rsa ? { bytes: Object.freeze({
+      ...(signer ? { es256Sign: signer } : {}),
+      ...(rsa ? { rs256Sign: rsa.sign } : {}),
       ...(byteAlgorithms.includes('SHA-256') ? { sha256: digestMac.sha256 } : {}),
       ...(byteAlgorithms.includes('HMAC-SHA256') ? { hmacSha256: digestMac.hmacSha256 } : {})
     }) } : {}),
@@ -313,6 +322,13 @@ function createNativeGuestSourceCryptoVerifier(input = {}) {
     }),
     signature: Object.freeze({
       verify(request) {
+        if (ownData(request, 'algorithm') === 'RS256') {
+          const key = ownData(request, 'key');
+          if (ownData(key, 'type') !== 'rsa-public-key-bytes') return result('invalid-key');
+          if (!rsa) return result('realization-failure');
+          try { return rsa.verify(ownData(key, 'bytes'), ownData(request, 'data'), ownData(request, 'signature')); }
+          catch (error) { return result(error.code === 'PULSE_CRYPTO_KEY_INVALID' ? 'invalid-key' : 'invalid-input'); }
+        }
         const normalized = normalizeSignatureRequest(request);
         if (normalized.result) return normalized.result;
         if (!es256Available) return result('realization-failure');

package/src/runtime/native-value-budget.js

@@ -0,0 +1,64 @@
+'use strict';
+
+// A conservative cumulative charge, deliberately never refunded. Counting a
+// primitive again on a property read can overestimate retention. Object graphs
+// are visited once; guest mutations are charged separately at the host imports.
+// No charge releases an alias, pending payload, schema value, or returned root.
+class NativeValueBudget {
+  constructor(policy, onFailure = () => {}) {
+    this.policy = policy;
+    this.onFailure = onFailure;
+    this.bytes = 0;
+    this.values = 0;
+    this.failure = undefined;
+    this.objects = new WeakSet();
+  }
+
+  charge(values, bytes) {
+    if (this.failure) throw this.failure;
+    if (values > this.policy.maxValues - this.values || bytes > this.policy.maxBytes - this.bytes) {
+      const error = new Error('Native read-loop execution exceeded its retained-value budget.');
+      error.code = 'PULSE_RUNTIME_MEMORY_LIMIT_EXCEEDED';
+      error.detail = Object.freeze({ bytes: this.bytes, values: this.values,
+        maxBytes: this.policy.maxBytes, maxValues: this.policy.maxValues });
+      this.failure = error;
+      this.onFailure();
+      throw error;
+    }
+    this.values += values;
+    this.bytes += bytes;
+  }
+
+  retain(value) {
+    const visit = input => {
+      this.charge(1, this.policy.valueBytes);
+      if (typeof input === 'string') this.charge(0, input.length * 2);
+      else if (input && typeof input === 'object' && !this.objects.has(input)) {
+        this.objects.add(input);
+        // Charge sparse capacity before visiting elements. Avoid allocating an
+        // intermediate array proportional to an untrusted container's length.
+        if (Array.isArray(input)) this.charge(input.length, input.length * this.policy.edgeBytes);
+        for (const key in input) if (Object.hasOwn(input, key)) {
+          this.charge(1, this.policy.edgeBytes + key.length * 2);
+          visit(input[key]);
+        }
+      }
+    };
+    visit(value);
+  }
+
+  write(target, key, value) {
+    this.charge(1, this.policy.edgeBytes + String(key).length * 2);
+    if (Array.isArray(target)) {
+      const index = Number(key);
+      const length = key === 'length' ? Number(value) :
+        Number.isInteger(index) && index >= 0 && String(index) === String(key) ? index + 1 : target.length;
+      if (length > target.length) this.charge(length - target.length, (length - target.length) * this.policy.edgeBytes);
+    }
+    this.retain(value);
+  }
+
+  snapshot() { return Object.freeze({ version: this.policy.version, bytes: this.bytes, values: this.values }); }
+}
+
+module.exports = { NativeValueBudget };