feat(PRO-401): edge contract 2 on Fastly Compute

[alistairsmith-tech]

The Fastly plugin is now the Compute adapter for edge-core (plan step 2, D9 in monocle-fastly-port-plan.md; tracked by PRO-401, web half PRO-432). Edge-core owns the request pipeline, the /__mcl/* endpoints, decisions, credentials and injection; this package supplies what only the platform can. The previous plugin (MCLVALID cookie, captcha_page.html, own cookie/policy/path modules, PROTECTED_PATHS scoping) is gone.

The adapter

• config.ts: the deployment from the Config Store — v, id, cv, x and the chunked cfg.<i> DeploymentConfig — validated with edge-core's compileConfig; the origin settings (ORIGIN_HOST, CACHE_RULES, CHAIN_SECRET, CLIENT_IP_HEADER) read best-effort; secrets read lazily, the Policy key only for /__mcl/*.
• platform.ts: Platform for Compute. The client address is event.client.address. A host the config does not name is forwarded unassessed (the domain is attached to this service either way); plain HTTP is sent to HTTPS, since the cookies are Secure.
• origin.ts: the origin leg — host override, the client address stamped into X-Forwarded-For, Fastly-Client-IP and the customer's CLIENT_IP_HEADER (PRO-326 folded in; overwritten, never appended), the time-limited chaining signature, cloned cache rules as a CacheOverride, origin backend.
• html.ts: HTMLRewritingStream — every meta CSP through edge-core's augmentation, the tag appended to body, or to the document when there is none.
• breaker.ts and crawlers.ts: the breaker state and the crawler snapshot in the POP cache (SimpleCache), the scope Policy reachability has. Nothing schedules on Compute, so the request that finds the snapshot missing refreshes it in waitUntil, once per POP per lease, through static crawler_<host> backends.
• backends.ts: the named backend every fetch() needs, injected into edge-core's Policy client and feed fetcher.

What js-compute does not have

Found by npm run typecheck, which checks edge-core's sources against js-compute's types: no AES-GCM (cookies use edge-core's HMAC sealer), no AbortSignal (the Policy deadline is the backend's first-byte timeout), no redirect/signal request options, a lenient TextDecoder. edge-core 0.7.1 (spurintel/monocle-edge-core#17) carries the shims, the exclusions and the store-backed breaker this needs.

Verification

• Typecheck clean; 20 tests run the handler in Node against doubles for the fastly:* modules (test/doubles): unreadable and torn config, challenge and state, mint through the Policy backend then an injected cleared page, refusals and blocks, exclusions, unnamed hosts, HTTP→HTTPS, the origin leg (host, client-address headers, chaining signature, cache rules, 502), lazy crawler refresh without stampede, the breaker surviving between requests, secret reads only on the endpoints.
• Built to Wasm and run under Viceroy against the live example.com origin: /__mcl/state 200, cold enforced navigation 503 with the interstitial, cookieless action 403 with the challenge header, assessed navigation served with the resident tag injected before </body> by the real HTMLRewritingStream, excluded path proxied, resident script served private, no-store.
• CI gains the edge-core deploy key (secret set on this repo) and moves to Node 22.

Pinned to v0.7.1-rc.1; repin to v0.7.1 once edge-core #17 merges. Release v2.0.0 when the web side (PRO-432) can write the new store layout.

🤖 Generated with Claude Code