@pulse-compute/cli 1.0.0-beta.1 → 1.0.0-beta.3

package/project-config.schema.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "pulse.project-config-schema-bundle.v1",
-  "releaseVersion": "1.0.0-beta.1",
+  "releaseVersion": "1.0.0-beta.3",
   "project": {
     "schemaVersion": "pulse.project-config-schema.v1",
     "discovery": [
@@ -23,7 +23,7 @@
       {
         "id": "crypto",
         "title": "Cryptographic requirements",
-        "description": "Declare exact algorithms for the global or selected profile and resolve one target realization without fallback. This surface is part of the synchronized 1.0.0-beta.1 package set."
+        "description": "Declare exact algorithms for the global or selected profile and resolve one target realization without fallback. This surface is part of the synchronized 1.0.0-beta.3 package set."
       },
       {
         "id": "schemas",
@@ -35,6 +35,11 @@
         "title": "Local development",
         "description": "Configure the foreground local server and local-only provider inputs."
       },
+      {
+        "description": "Provider-owned Node profile configuration.",
+        "id": "node",
+        "title": "Node provider options"
+      },
       {
         "description": "Options passed to fastly(...) from @pulse-compute/provider-fastly.",
         "id": "fastly",
@@ -111,7 +116,7 @@
       {
         "required": false,
         "default": "implicit no-crypto declaration",
-        "allowed": "`HS256`, `ES256`; exact pins `runtime-builtin`, `guest-source:pulse-hmac-as`, and `guest-linked:pulse-es256-rustcrypto-p256`",
+        "allowed": "`HS256`, `ES256`, `SHA-256`, `HMAC-SHA256`; exact pins `runtime-builtin`, `guest-source:pulse-hmac-as`, and `guest-linked:pulse-es256-rustcrypto-p256`",
         "precedence": "Used only when the selected profile omits `crypto`.",
         "security": "Keys and verification bytes are not configuration values. Target selection is deterministic and never probes or falls back.",
         "diagnostics": [
@@ -122,14 +127,14 @@
         ],
         "section": "crypto",
         "path": "pulse.crypto",
-        "type": "readonly ('HS256' | 'ES256')[] | { readonly HS256?: { readonly realization?: PulseCryptoRealization }; readonly ES256?: { readonly realization?: PulseCryptoRealization } }",
+        "type": "readonly PulseCryptoAlgorithm[] | Readonly<Partial<Record<PulseCryptoAlgorithm, { readonly realization?: PulseCryptoRealization }>>>",
         "scope": "global crypto requirement default",
         "description": "Declares the complete global algorithm set. Array entries are canonical algorithm names; object entries may pin one exact known realization."
       },
       {
         "required": false,
         "default": "inherit `pulse.crypto` when absent",
-        "allowed": "`[]` and `{}` explicitly select no crypto; otherwise `HS256` and/or `ES256`",
+        "allowed": "`[]` and `{}` explicitly select no crypto; otherwise `HS256`, `ES256`, `SHA-256`, `HMAC-SHA256`",
         "precedence": "Selected-profile declaration replaces `pulse.crypto`; absence inherits it.",
         "security": "Every declared algorithm must resolve for the selected target before lowering. A failed exact realization cannot select another backend.",
         "diagnostics": [
@@ -139,7 +144,7 @@
         ],
         "section": "crypto",
         "path": "<profile>.crypto",
-        "type": "readonly ('HS256' | 'ES256')[] | { readonly HS256?: { readonly realization?: PulseCryptoRealization }; readonly ES256?: { readonly realization?: PulseCryptoRealization } }",
+        "type": "readonly PulseCryptoAlgorithm[] | Readonly<Partial<Record<PulseCryptoAlgorithm, { readonly realization?: PulseCryptoRealization }>>>",
         "scope": "selected profile",
         "description": "Replaces the complete global crypto declaration for the selected profile. Arrays and objects never merge with `pulse.crypto`."
       },
@@ -330,6 +335,32 @@
         "scope": "local fetch capability",
         "description": "Deterministic fetch fixtures resolved before optional live network fetch."
       },
+      {
+        "required": false,
+        "default": "`{}`",
+        "allowed": "—",
+        "precedence": "Configuration value.",
+        "security": "Only named credential references are configuration. Runtime keys cannot override authority.",
+        "diagnostics": [],
+        "description": "Maps literal logical names to fixed HTTPS endpoint, bucket, region, accessKeyIdSecret, secretAccessKeySecret, optional sessionTokenSecret, maxTextBytes (1–32768, default 32768) and timeoutMs (1–30000, default 10000).",
+        "path": "node.bindings.s3",
+        "scope": "Node Native and JavaScript S3",
+        "section": "node",
+        "type": "Readonly<Record<string, S3Binding>>"
+      },
+      {
+        "required": false,
+        "default": "`{}`",
+        "allowed": "—",
+        "precedence": "Configuration value.",
+        "security": "Credentials resolve through the configured Secret Store at execution. Dynamic backend authority and guest endpoint overrides are forbidden.",
+        "diagnostics": [],
+        "description": "Maps logical names to fixed HTTPS endpoint, bucket, region, named static backend, accessKeyIdSecret, secretAccessKeySecret, optional sessionTokenSecret, maxTextBytes (1–32768, default 32768) and timeoutMs (1–30000, default 10000).",
+        "path": "fastly.bindings.s3",
+        "scope": "Fastly Native S3",
+        "section": "fastly",
+        "type": "Readonly<Record<string, S3Binding & { backend: string }>>"
+      },
       {
         "required": false,
         "default": "`pulse_config`",
@@ -729,7 +760,9 @@
               "items": {
                 "enum": [
                   "HS256",
-                  "ES256"
+                  "ES256",
+                  "SHA-256",
+                  "HMAC-SHA256"
                 ]
               }
             },
@@ -762,6 +795,32 @@
                       ]
                     }
                   }
+                },
+                "SHA-256": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "properties": {
+                    "realization": {
+                      "enum": [
+                        "runtime-builtin",
+                        "guest-source:pulse-hmac-as",
+                        "guest-linked:pulse-es256-rustcrypto-p256"
+                      ]
+                    }
+                  }
+                },
+                "HMAC-SHA256": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "properties": {
+                    "realization": {
+                      "enum": [
+                        "runtime-builtin",
+                        "guest-source:pulse-hmac-as",
+                        "guest-linked:pulse-es256-rustcrypto-p256"
+                      ]
+                    }
+                  }
                 }
               }
             }
@@ -844,6 +903,10 @@
     "fastly": {
       "schemaVersion": "pulse.provider-fastly-config-schema.v1",
       "fields": {
+        "fastly.bindings.s3": {
+          "kind": "object",
+          "default": {}
+        },
         "fastly.configStore": {
           "kind": "string",
           "default": "pulse_config"

package/release-manifest.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": "pulse.release-catalog.v1",
-  "releaseVersion": "1.0.0-beta.1",
+  "releaseVersion": "1.0.0-beta.3",
   "channel": "beta",
-  "releasedAt": "2026-08-01",
+  "releasedAt": "2026-09-14",
   "license": "Apache-2.0",
   "display": {
     "productName": "Pulse",
     "candidateLabel": "Beta",
-    "candidateName": "Pulse 1.0.0-beta.1 — Beta",
+    "candidateName": "Pulse 1.0.0-beta.3 — Beta",
     "activationStage": "documentation-release"
   },
   "legal": {
@@ -29,7 +29,7 @@
   "documentation": {
     "origin": "https://pulsecompute.io",
     "basePath": "/",
-    "version": "v1.0.0-beta.1",
+    "version": "v1.0.0-beta.3",
     "latestAlias": "latest",
     "source": "docs/README.md"
   },
@@ -97,7 +97,7 @@
   },
   "publication": {
     "registry": "https://registry.npmjs.org",
-    "distTag": "beta",
+    "distTag": "latest",
     "access": "public",
     "authentication": "npm-trusted-publishing-oidc",
     "provenance": "automatic",
@@ -153,7 +153,7 @@
     {
       "dir": "packages/runtime",
       "name": "@pulse-compute/runtime",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/runtime.md",
       "role": "public-runtime",
       "tier": "canonical-application",
@@ -167,7 +167,7 @@
     {
       "dir": "packages/pulse",
       "name": "@pulse-compute/pulse",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/pulse.md",
       "role": "public-api",
       "tier": "canonical-application",
@@ -182,7 +182,7 @@
     {
       "dir": "wasm/packages/cli",
       "name": "@pulse-compute/cli",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/cli.md",
       "role": "public-cli",
       "tier": "canonical-application",
@@ -207,7 +207,7 @@
     {
       "dir": "packages/provider-fastly",
       "name": "@pulse-compute/provider-fastly",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/provider-fastly.md",
       "role": "public-provider",
       "tier": "supported-extension",
@@ -227,7 +227,7 @@
     {
       "dir": "packages/grip",
       "name": "@pulse-compute/grip",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/grip.md",
       "role": "public-extension",
       "tier": "supported-extension",
@@ -241,7 +241,7 @@
     {
       "dir": "packages/assets",
       "name": "@pulse-compute/assets",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/assets.md",
       "role": "public-extension",
       "tier": "supported-extension",
@@ -255,7 +255,7 @@
     {
       "dir": "packages/crypto",
       "name": "@pulse-compute/crypto",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/crypto.md",
       "role": "public-extension",
       "tier": "supported-extension",
@@ -269,7 +269,7 @@
     {
       "dir": "packages/jwt",
       "name": "@pulse-compute/jwt",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/jwt.md",
       "role": "public-extension",
       "tier": "supported-extension",
@@ -283,7 +283,7 @@
     {
       "dir": "packages/entities",
       "name": "@pulse-compute/entities",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/entities.md",
       "role": "public-extension",
       "tier": "supported-extension",
@@ -294,10 +294,24 @@
       ],
       "stability": "The package root and first-party JSON-RPC adapter are supported Beta contracts; compiler integration subpaths remain toolchain-only."
     },
+    {
+      "dir": "packages/s3",
+      "name": "@pulse-compute/s3",
+      "version": "1.0.0-beta.3",
+      "documentation": "docs/packages/s3.md",
+      "role": "public-extension",
+      "tier": "supported-extension",
+      "audience": "Applications using bounded exact-key object reads and writes through Pulse effects.",
+      "directInstall": "Yes, when an application uses S3 object operations.",
+      "entryPoints": [
+        "@pulse-compute/s3"
+      ],
+      "stability": "The package root supports head, getText and putText on Node Native, Node JavaScript and Fastly Native. Fastly JavaScript is ineligible. Provider and lowering subpaths are toolchain-only; live origin acceptance is separate."
+    },
     {
       "dir": "wasm/packages/build-support",
       "name": "@pulse-compute/wasm-build-support",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/implementation-packages.md",
       "role": "implementation",
       "tier": "implementation",
@@ -311,7 +325,7 @@
     {
       "dir": "wasm/packages/compiler",
       "name": "@pulse-compute/wasm-compiler",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/implementation-packages.md",
       "role": "implementation",
       "tier": "implementation",
@@ -326,7 +340,7 @@
     {
       "dir": "wasm/packages/wasm-guest-link",
       "name": "@pulse-compute/wasm-guest-link",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/implementation-packages.md",
       "role": "implementation",
       "tier": "implementation",
@@ -340,7 +354,7 @@
     {
       "dir": "wasm/packages/contracts",
       "name": "@pulse-compute/wasm-contracts",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/implementation-packages.md",
       "role": "implementation",
       "tier": "implementation",
@@ -354,7 +368,7 @@
     {
       "dir": "wasm/packages/host-runtime",
       "name": "@pulse-compute/wasm-host-runtime",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/implementation-packages.md",
       "role": "implementation",
       "tier": "implementation",
@@ -368,7 +382,7 @@
     {
       "dir": "wasm/packages/library-kit",
       "name": "@pulse-compute/wasm-library-kit",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/implementation-packages.md",
       "role": "implementation",
       "tier": "implementation",
@@ -382,7 +396,7 @@
     {
       "dir": "packages/provider-node",
       "name": "@pulse-compute/provider-node",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/implementation-packages.md",
       "role": "implementation",
       "tier": "implementation",
@@ -397,7 +411,7 @@
     {
       "dir": "wasm/packages/runtime-core-as",
       "name": "@pulse-compute/wasm-runtime-core-as",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/implementation-packages.md",
       "role": "implementation",
       "tier": "implementation",
@@ -411,7 +425,7 @@
     {
       "dir": "wasm/packages/schema-json",
       "name": "@pulse-compute/wasm-schema-json",
-      "version": "1.0.0-beta.1",
+      "version": "1.0.0-beta.3",
       "documentation": "docs/packages/implementation-packages.md",
       "role": "implementation",
       "tier": "implementation",

package/src/documentation.js

@@ -3,7 +3,7 @@
 // Generated from release/pulse-release-manifest.json by wasm/scripts/sync-reference-docs.cjs.
 const DOCUMENTATION_ORIGIN = "https://pulsecompute.io";
 const DOCUMENTATION_BASE_PATH = "";
-const DOCUMENTATION_VERSION = "v1.0.0-beta.1";
+const DOCUMENTATION_VERSION = "v1.0.0-beta.3";
 const DOCUMENTATION_LATEST_ALIAS = "latest";
 
 function trimSlashes(value) { return String(value || '').replace(/^\/+|\/+$/g, ''); }

package/src/project-config-schema.js

@@ -36,7 +36,7 @@ function field(value) {
 
 const CONFIG_SECTIONS = Object.freeze([
   Object.freeze({ id: 'project', title: 'Project and provider selection', description: 'Select the canonical entry, provider, and build output.' }),
-  Object.freeze({ id: 'crypto', title: 'Cryptographic requirements', description: 'Declare exact algorithms for the global or selected profile and resolve one target realization without fallback. This surface is part of the synchronized 1.0.0-beta.1 package set.' }),
+  Object.freeze({ id: 'crypto', title: 'Cryptographic requirements', description: 'Declare exact algorithms for the global or selected profile and resolve one target realization without fallback. This surface is part of the synchronized 1.0.0-beta.3 package set.' }),
   Object.freeze({ id: 'schemas', title: 'JSON schema policy', description: 'Configure bounded schema-body policy. Conventional projects declare registry identity only through pulse.schema.' }),
   Object.freeze({ id: 'dev', title: 'Local development', description: 'Configure the foreground local server and local-only provider inputs.' }),
   ...providerConfigSections
@@ -48,8 +48,8 @@ const CONFIG_FIELDS = Object.freeze([
   field({ section: 'project', path: 'outDir', type: 'string', default: '`./dist`', scope: 'compile/build', description: 'Project-relative artifact output directory.', precedence: '`--out` overrides this field for the current command.', security: 'Must remain a real child of the project root; absolute, parent-traversal, and symbolic-link traversal outside the project root is rejected.', diagnostics: ['PULSE_BUILD_OUT_UNSAFE'] }),
   field({ section: 'project', path: 'reporting', type: "'off' | 'error' | 'warn' | 'info' | 'debug'", default: '`info`', allowed: '`off`, `error`, `warn`, `info`, `debug`', scope: 'compile/build/dev/test', description: 'Resolved synchronous logging threshold after the flat profile override is applied.', precedence: 'Selected-profile `reporting`, then `pulse.reporting`, then `info`.', security: 'Known request-owned secret values are redacted before provider emission.', diagnostics: ['PULSE_REPORTING_LEVEL_UNSUPPORTED'] }),
 
-  field({ section: 'crypto', path: 'pulse.crypto', type: "readonly ('HS256' | 'ES256')[] | { readonly HS256?: { readonly realization?: PulseCryptoRealization }; readonly ES256?: { readonly realization?: PulseCryptoRealization } }", default: 'implicit no-crypto declaration', allowed: '`HS256`, `ES256`; exact pins `runtime-builtin`, `guest-source:pulse-hmac-as`, and `guest-linked:pulse-es256-rustcrypto-p256`', scope: 'global crypto requirement default', description: 'Declares the complete global algorithm set. Array entries are canonical algorithm names; object entries may pin one exact known realization.', precedence: 'Used only when the selected profile omits `crypto`.', security: 'Keys and verification bytes are not configuration values. Target selection is deterministic and never probes or falls back.', diagnostics: ['PULSE_CRYPTO_CONFIG_SHAPE_INVALID', 'PULSE_CRYPTO_ALGORITHM_DUPLICATE', 'PULSE_CRYPTO_ALGORITHM_UNKNOWN', 'PULSE_CRYPTO_REALIZATION_UNKNOWN'] }),
-  field({ section: 'crypto', path: '<profile>.crypto', type: "readonly ('HS256' | 'ES256')[] | { readonly HS256?: { readonly realization?: PulseCryptoRealization }; readonly ES256?: { readonly realization?: PulseCryptoRealization } }", default: 'inherit `pulse.crypto` when absent', allowed: '`[]` and `{}` explicitly select no crypto; otherwise `HS256` and/or `ES256`', scope: 'selected profile', description: 'Replaces the complete global crypto declaration for the selected profile. Arrays and objects never merge with `pulse.crypto`.', precedence: 'Selected-profile declaration replaces `pulse.crypto`; absence inherits it.', security: 'Every declared algorithm must resolve for the selected target before lowering. A failed exact realization cannot select another backend.', diagnostics: ['PULSE_CRYPTO_CONFIG_REQUIRED', 'PULSE_CRYPTO_REALIZATION_PIN_INVALID', 'PULSE_CRYPTO_REALIZATION_UNAVAILABLE'] }),
+  field({ section: 'crypto', path: 'pulse.crypto', type: "readonly PulseCryptoAlgorithm[] | Readonly<Partial<Record<PulseCryptoAlgorithm, { readonly realization?: PulseCryptoRealization }>>>", default: 'implicit no-crypto declaration', allowed: '`HS256`, `ES256`, `SHA-256`, `HMAC-SHA256`; exact pins `runtime-builtin`, `guest-source:pulse-hmac-as`, and `guest-linked:pulse-es256-rustcrypto-p256`', scope: 'global crypto requirement default', description: 'Declares the complete global algorithm set. Array entries are canonical algorithm names; object entries may pin one exact known realization.', precedence: 'Used only when the selected profile omits `crypto`.', security: 'Keys and verification bytes are not configuration values. Target selection is deterministic and never probes or falls back.', diagnostics: ['PULSE_CRYPTO_CONFIG_SHAPE_INVALID', 'PULSE_CRYPTO_ALGORITHM_DUPLICATE', 'PULSE_CRYPTO_ALGORITHM_UNKNOWN', 'PULSE_CRYPTO_REALIZATION_UNKNOWN'] }),
+  field({ section: 'crypto', path: '<profile>.crypto', type: "readonly PulseCryptoAlgorithm[] | Readonly<Partial<Record<PulseCryptoAlgorithm, { readonly realization?: PulseCryptoRealization }>>>", default: 'inherit `pulse.crypto` when absent', allowed: '`[]` and `{}` explicitly select no crypto; otherwise `HS256`, `ES256`, `SHA-256`, `HMAC-SHA256`', scope: 'selected profile', description: 'Replaces the complete global crypto declaration for the selected profile. Arrays and objects never merge with `pulse.crypto`.', precedence: 'Selected-profile declaration replaces `pulse.crypto`; absence inherits it.', security: 'Every declared algorithm must resolve for the selected target before lowering. A failed exact realization cannot select another backend.', diagnostics: ['PULSE_CRYPTO_CONFIG_REQUIRED', 'PULSE_CRYPTO_REALIZATION_PIN_INVALID', 'PULSE_CRYPTO_REALIZATION_UNAVAILABLE'] }),
 
   field({ section: 'schemas', path: 'schemas', type: 'PulseSchemaConfig', default: '`{}`', scope: 'compile/dev/test/build', description: 'Sets schema body limits and content-type policy. Schema identities come from the module selected by pulse.schema.', security: 'Structured bodies are bounded before decoding.', diagnostics: ['PULSE_SCHEMA_COMPILE_FAILED'] }),
   field({ section: 'schemas', path: 'schemas.contentTypePolicy', type: "'accept-json-or-missing' | 'require-json'", default: '`accept-json-or-missing`', allowed: '`accept-json-or-missing`, `require-json`', scope: 'request and fetched-body schema decode', description: 'Controls whether a JSON content type is mandatory.', diagnostics: ['PULSE_SCHEMA_CONTENT_TYPE_POLICY_INVALID', 'PULSE_SCHEMA_DECODE'] }),

package/src/project-execution.js

@@ -16,14 +16,11 @@ const {
 } = require('@pulse-compute/wasm-compiler/canonical-project-compiler');
 const { createCanonicalSchemaCodecs } = require('@pulse-compute/wasm-schema-json/compiler/canonical-schema-codecs');
 const { buildJavascriptApplicationPlan } = require('@pulse-compute/wasm-compiler/javascript-application-plan');
-const { buildCanonicalNativePlan } = require('@pulse-compute/wasm-compiler/canonical-native-plan');
+const { buildCanonicalNativePlan, CanonicalNativePlanError } = require('@pulse-compute/wasm-compiler/canonical-native-plan');
 const {
   compileCanonicalNativePlan,
   writeCanonicalNativeModule
 } = require('@pulse-compute/wasm-compiler/canonical-native-compiler');
-const {
-  executeCanonicalNativeModule
-} = require('@pulse-compute/wasm-host-runtime/runtime/canonical-native-host');
 const { PulseProjectError, projectJson, relative } = require('./project-config.js');
 const { describeDiagnostic, decorateDiagnostic, httpStatusForDiagnostic } = require('./diagnostics.js');
 const {
@@ -293,9 +290,10 @@ function jsonPolicyInspection(project, compiled, nativePlan) {
 
 function compileProject(project, options = {}) {
   const handlerAuthoring = options.handlerAuthoring || HANDLER_AUTHORING_MODES.ASYNC_REQUIRED;
-  const configuredTarget = project.target || 'native';
+  const configuredTarget = options.target || project.target || 'native';
   const packageTargetDescriptor = getProviderTargetDescriptor(providerDriver(project), configuredTarget);
   return compileCanonicalProject(project.entryFile, {
+    target: configuredTarget,
     rootDir: project.root,
     // Package lowerers are discovered from the nearest package-manager workspace.
     // The Pulse project root remains authoritative for config and paths, but a
@@ -308,7 +306,6 @@ function compileProject(project, options = {}) {
     handlerAuthoring,
     requireAsync: handlerAuthoring === HANDLER_AUTHORING_MODES.ASYNC_REQUIRED,
     requireEffectAwait: false,
-    nativeEligibilityMode: (project.target || 'native') === 'javascript' ? 'record' : 'enforce',
     packageTargetDescriptor,
     packageTarget: configuredTarget,
     applicationProjectMetadata: Object.freeze({
@@ -322,14 +319,26 @@ function compileProject(project, options = {}) {
       crypto: project.profilePlan && project.profilePlan.crypto,
       reporting: project.reporting,
       reportingLevel: project.reportingLevel,
-      target: project.target || 'native',
+      target: configuredTarget,
       host: project.provider || null
     })
   });
 }
 
 function compileNativeProjectInMemory(project, options = {}) {
-  const compiled = options.compiled || compileProject(project);
+  let compiled;
+  try {
+    compiled = options.compiled && options.compiled.target !== 'javascript'
+      ? options.compiled
+      : compileProject(project, { ...options, target: 'native' });
+  } catch (error) {
+    // Native inspection is independent of a successful JavaScript compilation.
+    // Keep its rejection in the Native diagnostic lane used by doctor/inspect.
+    if ((project.target || 'native') !== 'javascript' || !Array.isArray(error.diagnostics)) throw error;
+    const failure = new CanonicalNativePlanError(error.message, error.diagnostics);
+    failure.detail = Object.freeze({ ...error.detail, causeCode: error.code, automaticFallback: false });
+    throw failure;
+  }
   const plan = buildCanonicalNativePlan(compiled, { reporting: project.reporting });
   const native = compileCanonicalNativePlan(plan, {
     cwd: project.root,
@@ -482,13 +491,23 @@ function providerExecutionOptions(project, values = {}) {
   return driver.executionOptions ? driver.executionOptions(project.providerConfig, resolved) : resolved;
 }
 
-function requiresExactNativeCrypto(compiled) {
-  return Boolean(
-    compiled
-    && compiled.cryptoRealizationPlan
-    && Array.isArray(compiled.cryptoRealizationPlan.algorithms)
-    && compiled.cryptoRealizationPlan.algorithms.some((entry) => entry.kind === 'guest-linked')
-  );
+function requiresExactNativeExecution(compiled) {
+  const algorithms = compiled.cryptoRealizationPlan && compiled.cryptoRealizationPlan.algorithms || [];
+  const operations = compiled.metadata && compiled.metadata.providerOperations || [];
+  return algorithms.some((entry) => entry.kind === 'guest-linked' || entry.kind === 'guest-source')
+    || operations.some((entry) => ['kv.getVersioned', 'kv.insertIfAbsent', 'kv.compareAndSwap'].includes(entry.capability));
+}
+
+function prepareNativeExecution(project, compiled, native) {
+  const driver = providerDriver(project);
+  if (typeof driver.prepareNativeExecution !== 'function') {
+    throw new TypeError(`Provider ${driver.id} cannot execute this Native artifact locally.`);
+  }
+  const execute = driver.prepareNativeExecution(providerTargetInvocation(
+    project, 'execute-native', native.plan, providerLoweringPlan(project, compiled.metadata), { native }
+  ));
+  if (typeof execute !== 'function') throw new TypeError('Provider Native execution preparation must return a function.');
+  return execute;
 }
 
 function providerLoweringPlan(project, metadata) {
@@ -1513,11 +1532,12 @@ async function runProjectTests(project, options = {}) {
   assertImplementedTarget(project, 'test');
   const executeCanonicalProgram = driver.execute;
   if (!compiled) compiled = compileProject(project);
-  const exactNativeCrypto = requiresExactNativeCrypto(compiled);
-  const program = exactNativeCrypto ? null : loadCanonicalModule(compiled);
-  const native = hasEventCase || exactNativeCrypto
+  const exactNativeExecution = requiresExactNativeExecution(compiled);
+  const program = exactNativeExecution ? null : loadCanonicalModule(compiled);
+  const native = hasEventCase || exactNativeExecution
     ? compileNativeProjectInMemory(project, { ...options, compiled }).native
     : null;
+  const executeNative = exactNativeExecution ? prepareNativeExecution(project, compiled, native) : null;
   const cases = [];
   let failed = 0;
   for (const testCase of selected) {
@@ -1555,8 +1575,8 @@ async function runProjectTests(project, options = {}) {
         continuationTtlMs: testCase.continuationTtlMs,
         executionId: `test:${testCase.name}`
       });
-      const execution = exactNativeCrypto
-        ? await executeCanonicalNativeModule(native, executionOptions)
+      const execution = exactNativeExecution
+        ? await executeNative(executionOptions)
         : await executeCanonicalProgram(program, executionOptions);
       if (testCase.expect.error) throw new assert.AssertionError({ message: `${testCase.name}: expected ${testCase.expect.error.name || 'an error'} but execution completed` });
       assertExpectation(testCase, Object.freeze({
@@ -1569,6 +1589,7 @@ async function runProjectTests(project, options = {}) {
         durationMs: Number(process.hrtime.bigint() - started) / 1e6,
         response: Object.freeze({ status: execution.response.status, bodyClass: execution.response.bodyClass, kind: execution.response.kind }),
         effects: execution.effectCount,
+        ...(execution.evidence ? { executionEvidence: execution.evidence } : {}),
         continuations: execution.continuations.map((entry) => Object.freeze({ id: entry.id, state: entry.state, effectIds: entry.effectIds })),
         resolutionOrder: execution.resolutionOrder
       }));
@@ -1894,7 +1915,11 @@ function doctorProject(project, options = {}) {
   let eventInspection;
   try {
     compiled = compileProject(project);
-    check('canonical-compile', (compiled.metadata.warningCount || 0) > 0 ? 'warning' : 'passed', `Canonical source lowered with ${compiled.metadata.effectCount} effect(s), ${compiled.metadata.continuationCount} continuation(s), and ${compiled.metadata.warningCount || 0} warning(s).`, { capabilities: compiled.metadata.capabilities, warnings: compiled.metadata.warnings || [] });
+    check('canonical-compile', (compiled.metadata.warningCount || 0) > 0 ? 'warning' : 'passed',
+      compiled.target === 'javascript'
+        ? `JavaScript source inspected with ${compiled.metadata.effectCount} recognized Pulse effect(s) and ${compiled.metadata.warningCount || 0} warning(s); execution retains the original source graph.`
+        : `Canonical source lowered with ${compiled.metadata.effectCount} effect(s), ${compiled.metadata.continuationCount} continuation(s), and ${compiled.metadata.warningCount || 0} warning(s).`,
+      { capabilities: compiled.metadata.capabilities, warnings: compiled.metadata.warnings || [] });
     eventSupport = selectedEventTargetSupport(project, compiled, selectedTargetDescriptor);
     if (eventSupport) {
       eventInspection = eventInspectionProjection(project, compiled, eventSupport);
@@ -2595,6 +2620,12 @@ async function startJavascriptDevServer(project, options = {}) {
     config: project.dev.config,
     secrets: project.dev.secrets,
     kv: project.dev.kv,
+    bindings: project.providerConfig.bindings,
+    s3FetchImplementation: javascript.createFixtureFetch(
+      project.dev.fetches,
+      project.dev.networkFetch ? globalThis.fetch : undefined,
+      { rawResponse: true }
+    ),
     fetchImplementation: javascript.createFixtureFetch(
       project.dev.fetches,
       project.dev.networkFetch ? globalThis.fetch : undefined
@@ -2664,7 +2695,8 @@ async function startDevServer(project, options = {}) {
   let compiled;
   let program;
   let native;
-  let exactNativeCrypto = false;
+  let executeNative;
+  let exactNativeExecution = false;
   let packageArtifacts = Object.freeze([]);
   let compileError;
   let reloadTimer;
@@ -2689,15 +2721,17 @@ async function startDevServer(project, options = {}) {
   function reload(reason) {
     try {
       const nextCompiled = compileProject(project);
-      const nextExactNativeCrypto = requiresExactNativeCrypto(nextCompiled);
-      const nextProgram = nextExactNativeCrypto ? null : loadCanonicalModule(nextCompiled);
-      const nextNative = nextExactNativeCrypto
+      const nextExactNativeExecution = requiresExactNativeExecution(nextCompiled);
+      const nextProgram = nextExactNativeExecution ? null : loadCanonicalModule(nextCompiled);
+      const nextNative = nextExactNativeExecution
         ? compileNativeProjectInMemory(project, { ...options, compiled: nextCompiled }).native
         : null;
+      const nextExecuteNative = nextExactNativeExecution ? prepareNativeExecution(project, nextCompiled, nextNative) : null;
       compiled = nextCompiled;
       program = nextProgram;
       native = nextNative;
-      exactNativeCrypto = nextExactNativeCrypto;
+      executeNative = nextExecuteNative;
+      exactNativeExecution = nextExactNativeExecution;
       packageArtifacts = packageRealizationArtifactsForCompiled(nextCompiled);
       compileError = undefined;
       syncWatchFiles(compiled.watchFiles);
@@ -2710,8 +2744,8 @@ async function startDevServer(project, options = {}) {
         watchFiles: Object.freeze(compiled.watchFiles.map((file) => relative(file, project.root)))
       }));
     } catch (error) {
-      if (!program) compileError = error;
-      events(Object.freeze({ event: 'compile-error', retainedLastGoodProgram: Boolean(program), error: errorSummary(error, project.dev.secrets) }));
+      if (!program && !executeNative) compileError = error;
+      events(Object.freeze({ event: 'compile-error', retainedLastGoodProgram: Boolean(program || executeNative), error: errorSummary(error, project.dev.secrets) }));
     }
   }
   function scheduleReload() {
@@ -2742,8 +2776,8 @@ async function startDevServer(project, options = {}) {
         liveFetch: project.dev.networkFetch,
         executionId: `dev:${++handled}`
       });
-      const execution = exactNativeCrypto
-        ? await executeCanonicalNativeModule(native, executionOptions)
+      const execution = exactNativeExecution
+        ? await executeNative(executionOptions)
         : await executeCanonicalProgram(program, executionOptions);
       writeNodeHttpResponse(res, execution.response);
       events(Object.freeze({ event: 'request', method: req.method || 'GET', path: url.pathname, status: execution.response.status, effects: execution.effectCount }));