@pulse-compute/s3#
S3 provides bounded exact-key head, getText and putText effects. It is a supported extension in the synchronized 1.0.0-beta.2 candidate. Candidate preparation does not assert that the package has been published to npm. Consume the exact compatible S3, Pulse, CLI and provider tarballs from one release pack.
Authoring and lowering#
import { s3 } from '@pulse-compute/s3'
const written = await s3.putText(ctx, 'objects', key, text, {
contentType: 'application/json',
})
const inspected = await ctx.parallel({
metadata: s3.head(ctx, 'objects', key),
object: s3.getText(ctx, 'objects', key),
})
Use these expressions inside a Pulse handler. Await into a local variable or use keyed ctx.parallel. The logical binding must be a string literal. Key and text may be runtime strings; content type is optional literal metadata and does not serialize the text. Strict JSON responses require a response schema.
S3 owns its facade, operation contract, compiler recognition, Native lowering, key encoding, SigV4 protocol and result interpretation. Native targets compose the packaged AssemblyScript implementation with Crypto's SHA-256 and HMAC-SHA256 primitives. Node JavaScript uses the package protocol and Crypto's bounded Web Crypto realization. Providers own fixed authority, credential resolution, deadlines, raw metadata and transport. Application imports use only the package root; /provider, manifest, compiler and Native exports are toolchain integration.
Binding map#
Declare crypto: ['SHA-256', 'HMAC-SHA256'] in Pulse configuration. Map each logical name under <profile>.node.bindings.s3 or <profile>.fastly.bindings.s3.
| Field | Contract |
|---|---|
endpoint | Fixed HTTPS origin, without a path, query or credentials |
bucket, region | Explicit bucket and signing region |
accessKeyIdSecret, secretAccessKeySecret | Names of provider secrets |
sessionTokenSecret | Optional provider secret name |
maxTextBytes | 1–32768; default 32768 |
timeoutMs | 1–30000; default 10000; includes credentials, signing and body completion |
backend | Fastly requires a named static backend; configure its secret store in fastly.bindings.secretStore |
Runtime keys cannot select an origin, bucket, region, backend or credentials. Keys are 1–1024 UTF-8 bytes, with no controls or ./.. path segments. Slashes, repeated slashes and Unicode normalization are preserved; encoding occurs once.
Results and bounds#
| Operation | Successful result | Other results |
|---|---|---|
head | found: byte length, optional opaque ETag and content type | not-found or failed with bounded reason and observed HTTP status |
getText | found: exact UTF-8 text, raw byte length and SHA-256, optional metadata | not-found or failed; malformed UTF-8 is rejected |
putText | stored: sent byte length and SHA-256, optional opaque ETag | not-stored before dispatch or for complete explicit 4xx rejection except 408; unknown when dispatch may have stored bytes |
GET and PUT are bounded to 32768 UTF-8 bytes, or the lower binding limit. Empty text is allowed and a BOM is preserved. HEAD requires a safe Content-Length and can describe an object larger than the text limit. Metadata is bounded to 16384 aggregate bytes and 1024 bytes per selected value; duplicate selected headers, malformed lengths, truncated bodies and compression fail closed.
PUT succeeds only on a complete 200 acknowledgement with an empty body. Its digest identifies sent bytes, not origin durability. Cancellation terminates the request lifecycle without a typed S3 result or a rollback promise. There are no retries, redirects, decompression or caches. For a JSON request carrying 32768 escaped control characters, configure schemas.maxBytes: 262144; the object byte limit remains unchanged.
Target support and evidence#
| Target | S3 support | Local acceptance |
|---|---|---|
| Node Native | Supported | Compiled Wasm with the Node provider |
| Node JavaScript | Supported | Package runtime with bounded Web Crypto |
| Fastly Native | Supported | Compiled provider Wasm with host ABI fixtures |
| Fastly JavaScript | Ineligible | SDK header projection loses required raw metadata |
The read and write corpus is repeated from isolated exact-version tarball installs, using installed compilers, package lowering and provider realizations. It covers signatures, key encoding, malformed and truncated data, limits, credentials, redaction, deadlines and ambiguous writes. Fastly JavaScript's exclusion does not gate these supported targets.
Local fixtures do not establish live Fastly Object Storage semantics. Live origin acceptance follows infrastructure setup (T2) and records endpoint, region, target artifact, exact observed bytes and acknowledgement behavior. There is no listing, multipart upload, copy, presigning, arbitrary bucket selection or conditional creation. Assets alignment remains separate.