@pulse-compute/cli 1.0.0-beta.1 → 1.0.0-beta.2

package/docs/packages/provider-fastly.md

@@ -10,7 +10,7 @@ Install it only in projects that select the Fastly provider.
 ## Install
 
 ```bash
-npm install @pulse-compute/provider-fastly@1.0.0-beta.1
+npm install @pulse-compute/provider-fastly@1.0.0-beta.2
 ```
 
 ## Configure a project
@@ -105,8 +105,34 @@ pulse build ./my-app
 
 `target: 'native'` compiles the provider-neutral plan and emits generated
 `src/main.as.ts` plus compact `bin/main.wasm` importing the required `fastly_*`
-hostcalls directly. It contains no JavaScript runtime image, `pulse_host`, or
-WASI dependency.
+hostcalls directly. It contains no JavaScript runtime image or `pulse_host`.
+Clock-dependent capabilities import only WASI `clock_time_get`.
+
+Conditional KV (`getVersioned`, `insertIfAbsent`, `compareAndSwap`) uses this
+Native path and the existing logical KV bindings. It preserves generation tokens
+without numeric narrowing, stages a bounded Pulse JSON envelope, and distinguishes
+confirmed rejection from unconfirmed dispatch. Pending completion and body reads
+use readiness selection with a monotonic deadline. Read bodies are closed; expired
+pending operations remain owned by invocation teardown, with no rollback promise.
+Fastly JavaScript remains explicitly incomplete for these operations. See
+[conditional KV](../concepts/effects-and-continuations.md#conditional-kv) for the
+portable contract. The generated-Wasm corpus is local evidence; it does not replace
+deployed cross-location acceptance. The legacy JavaScript fixture runner does
+not realize Native conditional KV; it reports a configuration failure. Exercise
+these operations through generated Wasm or the Compute execution lane.
+
+The required conditional KV acceptance task is `kv-conditional-acceptance`.
+It builds and installs exact tarballs and executes their Native artifact through
+Fastly CLI/Viceroy; an unavailable engine fails the task. Viceroy 0.21.0 currently
+fails the missing-key CAS contract: it creates the key instead of returning
+`conflict`. A September 12, 2026 standalone Rust SDK probe on deployed Fastly
+rejected CAS on both never-created and deleted keys, which remained absent.
+This resolves the live missing-key concern for those cases and distinguishes it
+from the Viceroy defect. The required local gate still fails, and full Pulse
+deployed cross-location acceptance remains pending the isolated development
+environment. The [K4 acceptance record](https://github.com/pulse-compute/pulse/blob/latest/wasm/test/kv/K4.md)
+retains both captures and their scope. Neither that standalone probe nor passing
+injected-host or portable tests clears the full acceptance gates.
 
 ### Fastly JavaScript
 

package/docs/packages/pulse.md

@@ -8,7 +8,7 @@ provider-neutral runtime contract.
 ## Install
 
 ```bash
-npm install @pulse-compute/pulse@1.0.0-beta.1
+npm install @pulse-compute/pulse@1.0.0-beta.2
 ```
 
 The package exposes two supported entry points:

package/docs/packages/runtime.md

@@ -5,7 +5,7 @@
 ## Install
 
 ```bash
-npm install @pulse-compute/runtime@1.0.0-beta.1
+npm install @pulse-compute/runtime@1.0.0-beta.2
 ```
 
 A project created by `pulse init` depends on the public
@@ -212,6 +212,15 @@ const token = await ctx.secret.get('API_TOKEN')
 const session = await ctx.kv<{ userId: number }>('sessions').get('current')
 ```
 
+Conditional KV extends the same namespace with `getVersioned`, `insertIfAbsent`,
+and `compareAndSwap`. The Node reference realizes them through JavaScript and
+compiled Native execution; Fastly Native uses direct conditional KV hostcalls. Reads pair a value with an opaque string generation;
+writes distinguish `stored`, `conflict`, `not-stored`, and `unknown` (possibly
+committed). Pulse snapshots candidates, preserves tokens without numeric
+coercion, and performs no automatic retry. Fastly JavaScript remains incomplete;
+K4 retains the deployed acceptance gate.
+The detailed contract is in [Effects and continuations](../concepts/effects-and-continuations.md#conditional-kv).
+
 Those calls are compiled into explicit effects and validated against the selected provider. See [Compilation and lowering](../concepts/compilation-and-lowering.md).
 
 ## Structured and opaque fetch results

package/docs/packages/s3.md

@@ -0,0 +1,101 @@
+# `@pulse-compute/s3`
+
+S3 provides bounded exact-key `head`, `getText` and `putText` effects. It is a
+supported extension in the synchronized `1.0.0-beta.2` candidate. Candidate
+preparation does not assert that the package has been published to npm. Consume
+the exact compatible S3, Pulse, CLI and provider tarballs from one release pack.
+
+## Authoring and lowering
+
+```ts
+import { s3 } from '@pulse-compute/s3'
+
+const written = await s3.putText(ctx, 'objects', key, text, {
+  contentType: 'application/json',
+})
+const inspected = await ctx.parallel({
+  metadata: s3.head(ctx, 'objects', key),
+  object: s3.getText(ctx, 'objects', key),
+})
+```
+
+Use these expressions inside a Pulse handler. Await into a local variable or
+use keyed `ctx.parallel`. The logical binding must be a string literal. Key and
+text may be runtime strings; content type is optional literal metadata and does
+not serialize the text. Strict JSON responses require a response schema.
+
+S3 owns its facade, operation contract, compiler recognition, Native lowering,
+key encoding, SigV4 protocol and result interpretation. Native targets compose
+the packaged AssemblyScript implementation with Crypto's SHA-256 and HMAC-SHA256
+primitives. Node JavaScript uses the package protocol and Crypto's bounded Web
+Crypto realization. Providers own fixed authority, credential resolution,
+deadlines, raw metadata and transport. Application imports use only the package
+root; `/provider`, manifest, compiler and Native exports are toolchain integration.
+
+## Binding map
+
+Declare `crypto: ['SHA-256', 'HMAC-SHA256']` in Pulse configuration. Map each
+logical name under `<profile>.node.bindings.s3` or
+`<profile>.fastly.bindings.s3`.
+
+| Field | Contract |
+| --- | --- |
+| `endpoint` | Fixed HTTPS origin, without a path, query or credentials |
+| `bucket`, `region` | Explicit bucket and signing region |
+| `accessKeyIdSecret`, `secretAccessKeySecret` | Names of provider secrets |
+| `sessionTokenSecret` | Optional provider secret name |
+| `maxTextBytes` | 1–32768; default 32768 |
+| `timeoutMs` | 1–30000; default 10000; includes credentials, signing and body completion |
+| `backend` | Fastly requires a named static backend; configure its secret store in `fastly.bindings.secretStore` |
+
+Runtime keys cannot select an origin, bucket, region, backend or credentials.
+Keys are 1–1024 UTF-8 bytes, with no controls or `.`/`..` path segments. Slashes,
+repeated slashes and Unicode normalization are preserved; encoding occurs once.
+
+## Results and bounds
+
+| Operation | Successful result | Other results |
+| --- | --- | --- |
+| `head` | `found`: byte length, optional opaque ETag and content type | `not-found` or `failed` with bounded reason and observed HTTP status |
+| `getText` | `found`: exact UTF-8 text, raw byte length and SHA-256, optional metadata | `not-found` or `failed`; malformed UTF-8 is rejected |
+| `putText` | `stored`: sent byte length and SHA-256, optional opaque ETag | `not-stored` before dispatch or for complete explicit 4xx rejection except 408; `unknown` when dispatch may have stored bytes |
+
+GET and PUT are bounded to 32768 UTF-8 bytes, or the lower binding limit. Empty
+text is allowed and a BOM is preserved. HEAD requires a safe Content-Length and
+can describe an object larger than the text limit. Metadata is bounded to 16384
+aggregate bytes and 1024 bytes per selected value; duplicate selected headers,
+malformed lengths, truncated bodies and compression fail closed.
+
+PUT succeeds only on a complete 200 acknowledgement with an empty body. Its
+digest identifies sent bytes, not origin durability. Cancellation terminates
+the request lifecycle without a typed S3 result or a rollback promise. There
+are no retries, redirects, decompression or caches. For a JSON request carrying
+32768 escaped control characters, configure `schemas.maxBytes: 262144`; the
+object byte limit remains unchanged.
+
+## Target support and evidence
+
+| Target | S3 support | Local acceptance |
+| --- | --- | --- |
+| Node Native | Supported | Compiled Wasm with the Node provider |
+| Node JavaScript | Supported | Package runtime with bounded Web Crypto |
+| Fastly Native | Supported | Compiled provider Wasm with host ABI fixtures |
+| Fastly JavaScript | Ineligible | SDK header projection loses required raw metadata |
+
+The read and write corpus is repeated from isolated exact-version tarball
+installs, using installed compilers, package lowering and provider realizations.
+It covers signatures, key encoding, malformed and truncated data, limits,
+credentials, redaction, deadlines and ambiguous writes. Fastly JavaScript's
+exclusion does not gate these supported targets.
+
+Local fixtures do not establish live Fastly Object Storage semantics. Live
+origin acceptance follows infrastructure setup (T2) and records endpoint,
+region, target artifact, exact observed bytes and acknowledgement behavior.
+There is no listing, multipart upload, copy, presigning, arbitrary bucket
+selection or conditional creation. Assets alignment remains separate.
+
+## Related material
+
+- [Project configuration](../reference/project-config.md)
+- [Package-owned lowering](../concepts/package-owned-lowering.md)
+- [Crypto](./crypto.md)

package/docs/preview-scope.md

@@ -1,6 +1,6 @@
 # Beta scope
 
-Pulse `1.0.0-beta.1` is a Beta of one provider-neutral application contract
+Pulse `1.0.0-beta.2` is a Beta of one provider-neutral application contract
 with explicit Native and JavaScript execution targets. The intended 1.0
 surface is present, but deliberate corrections may still occur before the
 stable `1.0.0` release.
@@ -15,7 +15,7 @@ targets.
 - Async-shaped provider-neutral TypeScript handlers; trusted Pulse awaits lower
   into explicit effects and continuations without a Promise runtime.
 - Static Router v2 with terminal middleware, route fallthrough, error
-  middleware, GET/HEAD/POST routes, exact paths, named parameters, trailing
+  middleware, GET/HEAD/POST/PUT/PATCH/DELETE routes, exact paths, named parameters, trailing
   wildcards, and acyclic mounts.
 - Basic branching and structured object, array, and scalar manipulation.
 - Request method, URL, path, headers, text, and JSON access.

package/docs/reference/cli-spec.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "pulse.cli-command-spec.v5",
-  "cliVersion": "1.0.0-beta.1",
+  "cliVersion": "1.0.0-beta.2",
   "completionShells": [
     "bash",
     "zsh",

package/docs/reference/cli.md

@@ -2,7 +2,7 @@
 
 <!-- Generated by wasm/scripts/sync-reference-docs.cjs. Edit the source catalog, not this file. -->
 
-The `pulse` CLI in `@pulse-compute/cli@1.0.0-beta.1` is the supported project workflow. One command specification generates this page, installed help, and the shipped Bash, Zsh, and Fish completion scripts, so a public command or option cannot drift between those surfaces.
+The `pulse` CLI in `@pulse-compute/cli@1.0.0-beta.2` is the supported project workflow. One command specification generates this page, installed help, and the shipped Bash, Zsh, and Fish completion scripts, so a public command or option cannot drift between those surfaces.
 
 ## Meta invocations
 

package/docs/reference/compatibility-matrix.md

@@ -29,7 +29,7 @@ the Native build; it does not authorize automatic JavaScript fallback.
 | Source form | Node JS | Fastly JS | Node Native | Fastly Native | Notes |
 |---|---:|---:|---:|---:|---|
 | Async-shaped managed handler | Yes | Yes | Yes | Yes | Native erases the authoring wrapper; it does not link Promise, JSPI, or Asyncify semantics. |
-| Static `Router` topology and terminal `next()` | Yes | Yes | Yes | Yes | Covers static `get`, `head`, `post`, middleware, mounts, parameters, trailing wildcard, fallthrough, and the error lane. |
+| Static `Router` topology and terminal `next()` | Yes | Yes | Yes | Yes | Covers static `get`, `head`, `post`, `put`, `patch`, `delete`, middleware, mounts, parameters, trailing wildcard, fallthrough, and the error lane. |
 | Root-only `Pulse.on` and non-HTTP event context | Yes | No | Yes | No | Node owns the bounded reference ingress. Fastly source remains inspectable but execution/build eligibility fails closed. |
 | Awaited one-way `ctx.emit` acceptance | Yes | No | Yes | No | Static schema-bound frames only; no delivery, loopback, public bus, call surface, or target fallback. |
 | Sequential awaits of trusted Pulse effects | Yes | Yes | Yes | Yes | JavaScript preserves source order. Native lowers effects and continuations and may group adjacent independent effects without changing results. |
@@ -86,7 +86,7 @@ separate ordinary-lifecycle and Fastly Native integration boundaries.
 ## JWT and crypto Beta packages
 
 This table records the sealed Phase D and E behavior of the synchronized
-`1.0.0-beta.1` JWT/crypto packages. Validation does not itself authorize npm
+`1.0.0-beta.2` JWT/crypto packages. Validation does not itself authorize npm
 publication.
 
 | Candidate capability | Node JS | Fastly JS | Node Native | Fastly Native | Notes |

package/docs/reference/diagnostics.md

@@ -2,11 +2,11 @@
 
 <!-- Generated by wasm/scripts/sync-reference-docs.cjs. Edit the source catalog, not this file. -->
 
-Pulse 1.0.0-beta.1 treats the 114 codes on this page as the stable public CLI diagnostic catalog. Code, category, summary, remediation intent, exit class, and anchor are generated from the same source used by the CLI. Human wording may improve compatibly.
+Pulse 1.0.0-beta.2 treats the 114 codes on this page as the stable public CLI diagnostic catalog. Code, category, summary, remediation intent, exit class, and anchor are generated from the same source used by the CLI. Human wording may improve compatibly.
 
 Every catalogued failure links to a versioned installed artifact under:
 
-`https://pulsecompute.io/v1.0.0-beta.1/reference/diagnostics/`
+`https://pulsecompute.io/v1.0.0-beta.2/reference/diagnostics/`
 
 Uncatalogued/internal or forward-compatible codes link to that reference root instead of inventing a nonexistent anchor. Internal `PULSEWASM_*` proof/compiler tokens are not part of this public catalog.
 
@@ -22,7 +22,7 @@ A Native eligibility diagnostic never authorizes automatic JavaScript fallback.
 ```json
 {
   "status": "error",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0-beta.2",
   "error": {
     "name": "PulseProjectError",
     "code": "PULSE_BUILD_OUT_UNSAFE",
@@ -35,7 +35,7 @@ A Native eligibility diagnostic never authorizes automatic JavaScript fallback.
     ],
     "stability": "preview-stable",
     "scope": "public",
-    "docs": "https://pulsecompute.io/v1.0.0-beta.1/reference/diagnostics/#pulse-build-out-unsafe"
+    "docs": "https://pulsecompute.io/v1.0.0-beta.2/reference/diagnostics/#pulse-build-out-unsafe"
   }
 }
 ```
@@ -89,7 +89,7 @@ pulse test examples/02-request-schema --case invalid-user --json
       "expectedError": {
         "code": "PULSE_SCHEMA_DECODE",
         "category": "request",
-        "docs": "https://pulsecompute.io/v1.0.0-beta.1/reference/diagnostics/#pulse-schema-decode"
+        "docs": "https://pulsecompute.io/v1.0.0-beta.2/reference/diagnostics/#pulse-schema-decode"
       }
     }
   ]

package/docs/reference/documentation-versions.json

@@ -1,14 +1,22 @@
 {
   "schemaVersion": "pulse.documentation-versions.v1",
-  "latest": "1.0.0-beta.1",
+  "latest": "1.0.0-beta.2",
   "versions": [
+    {
+      "version": "1.0.0-beta.2",
+      "segment": "v1.0.0-beta.2",
+      "channel": "beta",
+      "releasedAt": "2026-09-13",
+      "status": "current",
+      "sourceManifest": "release/pulse-release-manifest.json"
+    },
     {
       "version": "1.0.0-beta.1",
       "segment": "v1.0.0-beta.1",
       "channel": "beta",
       "releasedAt": "2026-08-01",
-      "status": "current",
-      "sourceManifest": "release/pulse-release-manifest.json"
+      "status": "archived",
+      "sourceManifest": "release/documentation-site-archives/v1.0.0-beta.1/release-manifest.json"
     }
   ]
 }

package/docs/reference/handler-authoring.md

@@ -189,7 +189,7 @@ compatible merely because both targets are JavaScript.
 ## Router topology and terminal transfer
 
 `Router` is a compile-time authoring marker. The v2 surface supports static
-`get`, `head`, and `post` routes; exact, named-parameter, and trailing-wildcard
+`get`, `head`, `post`, `put`, `patch`, and `delete` routes; exact, named-parameter, and trailing-wildcard
 paths; global and path-scoped middleware; acyclic mounts; fallthrough; and
 error middleware.
 

package/docs/reference/project-config.md

@@ -94,15 +94,15 @@ Resolved synchronous logging threshold after the flat profile override is applie
 
 ## Cryptographic requirements
 
-Declare exact algorithms for the global or selected profile and resolve one target realization without fallback. This surface is part of the synchronized 1.0.0-beta.1 package set.
+Declare exact algorithms for the global or selected profile and resolve one target realization without fallback. This surface is part of the synchronized 1.0.0-beta.2 package set.
 
 ### `pulse.crypto`
 
 Declares the complete global algorithm set. Array entries are canonical algorithm names; object entries may pin one exact known realization.
 
-- **Type:** readonly ('HS256' | 'ES256')[] | { readonly HS256?: { readonly realization?: PulseCryptoRealization }; readonly ES256?: { readonly realization?: PulseCryptoRealization } }
+- **Type:** readonly PulseCryptoAlgorithm[] | Readonly<Partial<Record<PulseCryptoAlgorithm, { readonly realization?: PulseCryptoRealization }>>>
 - **Required/default:** Optional; default implicit no-crypto declaration.
-- **Allowed values or constraints:** `HS256`, `ES256`; exact pins `runtime-builtin`, `guest-source:pulse-hmac-as`, and `guest-linked:pulse-es256-rustcrypto-p256`
+- **Allowed values or constraints:** `HS256`, `ES256`, `SHA-256`, `HMAC-SHA256`; exact pins `runtime-builtin`, `guest-source:pulse-hmac-as`, and `guest-linked:pulse-es256-rustcrypto-p256`
 - **Scope:** global crypto requirement default
 - **Precedence:** Used only when the selected profile omits `crypto`.
 - **Security and safety:** Keys and verification bytes are not configuration values. Target selection is deterministic and never probes or falls back.
@@ -112,9 +112,9 @@ Declares the complete global algorithm set. Array entries are canonical algorith
 
 Replaces the complete global crypto declaration for the selected profile. Arrays and objects never merge with `pulse.crypto`.
 
-- **Type:** readonly ('HS256' | 'ES256')[] | { readonly HS256?: { readonly realization?: PulseCryptoRealization }; readonly ES256?: { readonly realization?: PulseCryptoRealization } }
+- **Type:** readonly PulseCryptoAlgorithm[] | Readonly<Partial<Record<PulseCryptoAlgorithm, { readonly realization?: PulseCryptoRealization }>>>
 - **Required/default:** Optional; default inherit `pulse.crypto` when absent.
-- **Allowed values or constraints:** `[]` and `{}` explicitly select no crypto; otherwise `HS256` and/or `ES256`
+- **Allowed values or constraints:** `[]` and `{}` explicitly select no crypto; otherwise `HS256`, `ES256`, `SHA-256`, `HMAC-SHA256`
 - **Scope:** selected profile
 - **Precedence:** Selected-profile declaration replaces `pulse.crypto`; absence inherits it.
 - **Security and safety:** Every declared algorithm must resolve for the selected target before lowering. A failed exact realization cannot select another backend.
@@ -284,10 +284,38 @@ Deterministic fetch fixtures resolved before optional live network fetch.
 - **Security and safety:** Prefer fixtures for deterministic tests and offline development.
 - **Related diagnostics:** None specific.
 
+## Node provider options
+
+Provider-owned Node profile configuration.
+
+### `node.bindings.s3`
+
+Maps literal logical names to fixed HTTPS endpoint, bucket, region, accessKeyIdSecret, secretAccessKeySecret, optional sessionTokenSecret, maxTextBytes (1–32768, default 32768) and timeoutMs (1–30000, default 10000).
+
+- **Type:** Readonly<Record<string, S3Binding>>
+- **Required/default:** Optional; default `{}`.
+- **Allowed values or constraints:** —
+- **Scope:** Node Native and JavaScript S3
+- **Precedence:** Configuration value.
+- **Security and safety:** Only named credential references are configuration. Runtime keys cannot override authority.
+- **Related diagnostics:** None specific.
+
 ## Fastly provider options
 
 Options passed to fastly(...) from @pulse-compute/provider-fastly.
 
+### `fastly.bindings.s3`
+
+Maps logical names to fixed HTTPS endpoint, bucket, region, named static backend, accessKeyIdSecret, secretAccessKeySecret, optional sessionTokenSecret, maxTextBytes (1–32768, default 32768) and timeoutMs (1–30000, default 10000).
+
+- **Type:** Readonly<Record<string, S3Binding & { backend: string }>>
+- **Required/default:** Optional; default `{}`.
+- **Allowed values or constraints:** —
+- **Scope:** Fastly Native S3
+- **Precedence:** Configuration value.
+- **Security and safety:** Credentials resolve through the configured Secret Store at execution. Dynamic backend authority and guest endpoint overrides are forbidden.
+- **Related diagnostics:** None specific.
+
 ### `fastly.configStore`
 
 Fastly Config Store resource name.

package/docs/reference/project-config.schema.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "pulse.project-config-schema-bundle.v1",
-  "releaseVersion": "1.0.0-beta.1",
+  "releaseVersion": "1.0.0-beta.2",
   "project": {
     "schemaVersion": "pulse.project-config-schema.v1",
     "discovery": [
@@ -23,7 +23,7 @@
       {
         "id": "crypto",
         "title": "Cryptographic requirements",
-        "description": "Declare exact algorithms for the global or selected profile and resolve one target realization without fallback. This surface is part of the synchronized 1.0.0-beta.1 package set."
+        "description": "Declare exact algorithms for the global or selected profile and resolve one target realization without fallback. This surface is part of the synchronized 1.0.0-beta.2 package set."
       },
       {
         "id": "schemas",
@@ -35,6 +35,11 @@
         "title": "Local development",
         "description": "Configure the foreground local server and local-only provider inputs."
       },
+      {
+        "description": "Provider-owned Node profile configuration.",
+        "id": "node",
+        "title": "Node provider options"
+      },
       {
         "description": "Options passed to fastly(...) from @pulse-compute/provider-fastly.",
         "id": "fastly",
@@ -111,7 +116,7 @@
       {
         "required": false,
         "default": "implicit no-crypto declaration",
-        "allowed": "`HS256`, `ES256`; exact pins `runtime-builtin`, `guest-source:pulse-hmac-as`, and `guest-linked:pulse-es256-rustcrypto-p256`",
+        "allowed": "`HS256`, `ES256`, `SHA-256`, `HMAC-SHA256`; exact pins `runtime-builtin`, `guest-source:pulse-hmac-as`, and `guest-linked:pulse-es256-rustcrypto-p256`",
         "precedence": "Used only when the selected profile omits `crypto`.",
         "security": "Keys and verification bytes are not configuration values. Target selection is deterministic and never probes or falls back.",
         "diagnostics": [
@@ -122,14 +127,14 @@
         ],
         "section": "crypto",
         "path": "pulse.crypto",
-        "type": "readonly ('HS256' | 'ES256')[] | { readonly HS256?: { readonly realization?: PulseCryptoRealization }; readonly ES256?: { readonly realization?: PulseCryptoRealization } }",
+        "type": "readonly PulseCryptoAlgorithm[] | Readonly<Partial<Record<PulseCryptoAlgorithm, { readonly realization?: PulseCryptoRealization }>>>",
         "scope": "global crypto requirement default",
         "description": "Declares the complete global algorithm set. Array entries are canonical algorithm names; object entries may pin one exact known realization."
       },
       {
         "required": false,
         "default": "inherit `pulse.crypto` when absent",
-        "allowed": "`[]` and `{}` explicitly select no crypto; otherwise `HS256` and/or `ES256`",
+        "allowed": "`[]` and `{}` explicitly select no crypto; otherwise `HS256`, `ES256`, `SHA-256`, `HMAC-SHA256`",
         "precedence": "Selected-profile declaration replaces `pulse.crypto`; absence inherits it.",
         "security": "Every declared algorithm must resolve for the selected target before lowering. A failed exact realization cannot select another backend.",
         "diagnostics": [
@@ -139,7 +144,7 @@
         ],
         "section": "crypto",
         "path": "<profile>.crypto",
-        "type": "readonly ('HS256' | 'ES256')[] | { readonly HS256?: { readonly realization?: PulseCryptoRealization }; readonly ES256?: { readonly realization?: PulseCryptoRealization } }",
+        "type": "readonly PulseCryptoAlgorithm[] | Readonly<Partial<Record<PulseCryptoAlgorithm, { readonly realization?: PulseCryptoRealization }>>>",
         "scope": "selected profile",
         "description": "Replaces the complete global crypto declaration for the selected profile. Arrays and objects never merge with `pulse.crypto`."
       },
@@ -330,6 +335,32 @@
         "scope": "local fetch capability",
         "description": "Deterministic fetch fixtures resolved before optional live network fetch."
       },
+      {
+        "required": false,
+        "default": "`{}`",
+        "allowed": "—",
+        "precedence": "Configuration value.",
+        "security": "Only named credential references are configuration. Runtime keys cannot override authority.",
+        "diagnostics": [],
+        "description": "Maps literal logical names to fixed HTTPS endpoint, bucket, region, accessKeyIdSecret, secretAccessKeySecret, optional sessionTokenSecret, maxTextBytes (1–32768, default 32768) and timeoutMs (1–30000, default 10000).",
+        "path": "node.bindings.s3",
+        "scope": "Node Native and JavaScript S3",
+        "section": "node",
+        "type": "Readonly<Record<string, S3Binding>>"
+      },
+      {
+        "required": false,
+        "default": "`{}`",
+        "allowed": "—",
+        "precedence": "Configuration value.",
+        "security": "Credentials resolve through the configured Secret Store at execution. Dynamic backend authority and guest endpoint overrides are forbidden.",
+        "diagnostics": [],
+        "description": "Maps logical names to fixed HTTPS endpoint, bucket, region, named static backend, accessKeyIdSecret, secretAccessKeySecret, optional sessionTokenSecret, maxTextBytes (1–32768, default 32768) and timeoutMs (1–30000, default 10000).",
+        "path": "fastly.bindings.s3",
+        "scope": "Fastly Native S3",
+        "section": "fastly",
+        "type": "Readonly<Record<string, S3Binding & { backend: string }>>"
+      },
       {
         "required": false,
         "default": "`pulse_config`",
@@ -729,7 +760,9 @@
               "items": {
                 "enum": [
                   "HS256",
-                  "ES256"
+                  "ES256",
+                  "SHA-256",
+                  "HMAC-SHA256"
                 ]
               }
             },
@@ -762,6 +795,32 @@
                       ]
                     }
                   }
+                },
+                "SHA-256": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "properties": {
+                    "realization": {
+                      "enum": [
+                        "runtime-builtin",
+                        "guest-source:pulse-hmac-as",
+                        "guest-linked:pulse-es256-rustcrypto-p256"
+                      ]
+                    }
+                  }
+                },
+                "HMAC-SHA256": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "properties": {
+                    "realization": {
+                      "enum": [
+                        "runtime-builtin",
+                        "guest-source:pulse-hmac-as",
+                        "guest-linked:pulse-es256-rustcrypto-p256"
+                      ]
+                    }
+                  }
                 }
               }
             }
@@ -844,6 +903,10 @@
     "fastly": {
       "schemaVersion": "pulse.provider-fastly-config-schema.v1",
       "fields": {
+        "fastly.bindings.s3": {
+          "kind": "object",
+          "default": {}
+        },
         "fastly.configStore": {
           "kind": "string",
           "default": "pulse_config"