@pulse-compute/provider-node 1.0.0-beta.4 → 1.0.0-beta.6

package/src/javascript/node-adapter.js

@@ -67,33 +67,31 @@ function bodyAllowed(method) {
   return normalized !== 'GET' && normalized !== 'HEAD';
 }
 
-async function readNodeRequestBody(request, maxBytes = DEFAULT_MAX_BODY_BYTES) {
+async function readNodeRequestBody(request, maxBytes = DEFAULT_MAX_BODY_BYTES, signal) {
   const limit = Number(maxBytes);
   if (!Number.isSafeInteger(limit) || limit <= 0) throw new TypeError('Pulse Node maxBodyBytes must be a positive safe integer.');
-  const chunks = [];
-  let bytes = 0;
-  try {
-    for await (const chunk of request) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let bytes = 0;
+    function cleanup() {
+      for (const [event, fn] of [['data', data], ['end', end], ['error', error], ['aborted', aborted]]) request.removeListener(event, fn);
+      signal?.removeEventListener('abort', cancel);
+    }
+    function fail(cause) { cleanup(); chunks.length = 0; request.once('error', () => {}); request.resume(); reject(cause); }
+    function cancel() { fail(signal.reason); }
+    function error(cause) { fail(new PulseNodeJavascriptRequestError('PULSE_NODE_REQUEST_READ_FAILED', 'Pulse could not read the Node request body.', { causeName: cause?.name })); }
+    function aborted() { error(new Error('Request aborted')); }
+    function data(chunk) {
       const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
       bytes += buffer.byteLength;
-      if (bytes > limit) {
-        throw new PulseNodeJavascriptRequestError(
-          'PULSE_REQUEST_BODY_TOO_LARGE',
-          `Request body exceeds ${limit} bytes.`,
-          { maxBytes: limit, bytes }
-        );
-      }
+      if (bytes > limit) return fail(new PulseNodeJavascriptRequestError('PULSE_REQUEST_BODY_TOO_LARGE', `Request body exceeds ${limit} bytes.`, { maxBytes: limit, bytes }));
       chunks.push(buffer);
     }
-  } catch (error) {
-    if (error instanceof PulseNodeJavascriptRequestError) throw error;
-    throw new PulseNodeJavascriptRequestError(
-      'PULSE_NODE_REQUEST_READ_FAILED',
-      'Pulse could not read the Node request body.',
-      { causeName: error && error.name }
-    );
-  }
-  return Buffer.concat(chunks);
+    function end() { cleanup(); resolve(Buffer.concat(chunks)); }
+    if (signal?.aborted) return cancel();
+    signal?.addEventListener('abort', cancel, { once: true });
+    request.on('data', data); request.once('end', end); request.once('error', error); request.once('aborted', aborted);
+  });
 }
 
 async function nodeRequestToWebRequest(request, options = {}) {
@@ -104,10 +102,15 @@ async function nodeRequestToWebRequest(request, options = {}) {
   for (const [name, value] of headerPairs) headers.append(name, value);
   const init = { method, headers };
   if (bodyAllowed(method)) {
-    const body = await readNodeRequestBody(request, options.maxRequestBodyBytes ?? options.maxBodyBytes);
-    if (body.byteLength > 0) {
-      init.body = body;
+    if (options.bodyForwarding || options.bodyTransform) {
+      init.body = require('./incoming-body.js').nodeIncomingStream(request);
       init.duplex = 'half';
+    } else {
+      const body = await readNodeRequestBody(request, options.maxRequestBodyBytes ?? options.maxBodyBytes, options.signal);
+      if (body.byteLength > 0) {
+        init.body = body;
+        init.duplex = 'half';
+      }
     }
   }
   return Object.freeze({
@@ -144,25 +147,40 @@ async function writeWebResponseToNode(response, nodeResponse, options = {}) {
   if (!(response instanceof Response)) throw new TypeError('Pulse Node response adaptation requires a Web Response.');
   if (!nodeResponse || typeof nodeResponse.end !== 'function') throw new TypeError('Pulse Node response adaptation requires a ServerResponse-like object.');
 
-  nodeResponse.statusCode = response.status;
-  if (response.statusText && typeof nodeResponse.statusMessage === 'string') nodeResponse.statusMessage = response.statusText;
-  for (const group of groupHeaderPairs(runtimeHost.responseHeaderPairs(response))) {
-    nodeResponse.setHeader(group.name, group.values.length === 1 ? group.values[0] : [...group.values]);
-  }
+  const check = () => { options.requestBudget?.check(); options.signal?.throwIfAborted(); };
+  try {
+    check();
+    nodeResponse.statusCode = response.status;
+    if (response.statusText && typeof nodeResponse.statusMessage === 'string') nodeResponse.statusMessage = response.statusText;
+    for (const group of groupHeaderPairs(runtimeHost.responseHeaderPairs(response))) {
+      nodeResponse.setHeader(group.name, group.values.length === 1 ? group.values[0] : [...group.values]);
+    }
+    if (options.closeConnection) nodeResponse.setHeader('connection', 'close');
 
-  const method = String(options.requestMethod || 'GET').toUpperCase();
-  if (method === 'HEAD' || !statusAllowsBody(response.status) || response.body == null) {
-    nodeResponse.end();
-    return response;
-  }
+    const method = String(options.requestMethod || 'GET').toUpperCase();
+    if (method === 'HEAD' || !statusAllowsBody(response.status) || response.body == null) {
+      check();
+      nodeResponse.end();
+      return response;
+    }
+
+    if (typeof Readable.fromWeb === 'function') {
+      check();
+      await pipeline(Readable.fromWeb(response.body), nodeResponse, { signal: options.signal });
+      check();
+      return response;
+    }
 
-  if (typeof Readable.fromWeb === 'function') {
-    await pipeline(Readable.fromWeb(response.body), nodeResponse);
+    const body = Buffer.from(await response.arrayBuffer());
+    check();
+    nodeResponse.end(body);
     return response;
+  } catch (error) {
+    if (response.body && !response.body.locked) void response.body.cancel(error).catch(() => {});
+    // Preserve the deadline diagnostic instead of pipeline's generic AbortError.
+    check();
+    throw error;
   }
-
-  nodeResponse.end(Buffer.from(await response.arrayBuffer()));
-  return response;
 }
 
 async function resolveRequestOption(value, context) {
@@ -188,86 +206,120 @@ function createNodeJavascriptHandler(application, options = {}) {
         maxKvValueDepth: options.maxKvValueDepth,
         maxKvValueEntries: options.maxKvValueEntries
       });
-  return async function pulseNodeJavascriptHandler(request, response) {
-    const adapted = await nodeRequestToWebRequest(request, options);
-    const requestContext = Object.freeze({
-      request,
-      response,
-      webRequest: adapted.request,
-      headerPairs: adapted.headerPairs
-    });
-    const requestedCapabilities = await resolveRequestOption(options.capabilities, requestContext);
-    const effectAdapter = await resolveRequestOption(options.effectAdapter, requestContext);
-    const schemaCodecs = await resolveRequestOption(options.schemaCodecs, requestContext);
-    const config = hasDynamicBindings ? await resolveRequestOption(options.config, requestContext) : options.config;
-    const secrets = hasDynamicBindings ? await resolveRequestOption(options.secrets, requestContext) : options.secrets;
-    const kv = hasDynamicBindings ? await resolveRequestOption(options.kv, requestContext) : options.kv;
-    const bindings = staticBindings || createNodeJavascriptBindingCapabilities({
-      config, secrets, kv,
-      kvReference: options.kvReference,
-      maxBindingNameBytes: options.maxBindingNameBytes,
-      maxBindingValueBytes: options.maxBindingValueBytes,
-      maxKvNamespaceBytes: options.maxKvNamespaceBytes,
-      maxKvKeyBytes: options.maxKvKeyBytes,
-      maxKvValueBytes: options.maxKvValueBytes,
-      maxKvValueDepth: options.maxKvValueDepth,
-      maxKvValueEntries: options.maxKvValueEntries
-    });
-    const capabilities = effectAdapter === undefined
-      ? withNodeBindingCapabilities(requestedCapabilities, { bindings })
-      : requestedCapabilities;
-    const started = process.hrtime.bigint();
-    const activeApplication = options.getApplication
-      ? runtimeHost.normalizeApplication(options.getApplication())
-      : normalizedApplication;
-    const webResponse = await executeNodeJavascriptApplication(activeApplication, adapted.request, {
-      capabilities,
-      effectAdapter,
-      config,
-      secrets,
-      kv,
-      application: options.application,
-      requestHeaders: adapted.headerPairs,
-      signal: options.signal || adapted.request.signal,
-      fetchImplementation: options.fetchImplementation,
-      s3: options.s3 || options.bindings && options.bindings.s3,
-      s3FetchImplementation: options.s3FetchImplementation,
-      assetsLookup: options.assetsLookup,
-      gripBroadcast: options.gripBroadcast,
-      jwtCaptureWallClock: options.jwtCaptureWallClock,
-      assets: options.assets,
-      grip: options.grip,
-      maxEffects: options.maxEffects,
-      kvClock: options.kvClock, deadlineMonotonicMs: options.deadlineMonotonicMs,
-      maxRequestBodyBytes: options.maxRequestBodyBytes ?? options.maxBodyBytes,
-      maxFetchBodyBytes: options.maxFetchBodyBytes,
-      maxStructuredBodyBytes: options.maxStructuredBodyBytes,
-      maxBindingNameBytes: options.maxBindingNameBytes,
-      maxBindingValueBytes: options.maxBindingValueBytes,
-      maxKvNamespaceBytes: options.maxKvNamespaceBytes,
-      maxKvKeyBytes: options.maxKvKeyBytes,
-      maxKvValueBytes: options.maxKvValueBytes,
-      maxKvValueDepth: options.maxKvValueDepth,
-      maxKvValueEntries: options.maxKvValueEntries,
-      schemaCodecs,
-      strict: options.strict === true,
-      provider: options.provider || 'node',
-      redactionValues: options.redactionValues,
-      onJsonTrace: options.onJsonTrace,
-      onEffectObservation: options.onEffectObservation,
-      onEffectSummary: options.onEffectSummary
-    });
-    await writeWebResponseToNode(webResponse, response, { requestMethod: adapted.method });
-    if (typeof options.onRequest === 'function') {
-      options.onRequest(Object.freeze({
-        method: adapted.method,
-        url: adapted.request.url,
-        path: new URL(adapted.request.url).pathname,
-        status: webResponse.status,
-        durationMs: Number(process.hrtime.bigint() - started) / 1e6
-      }));
+  return async function pulseNodeJavascriptHandler(request, response, requestSignal) {
+    const connection = new AbortController();
+    const aborted = () => connection.abort(new Error('Node request disconnected.'));
+    const closed = () => { if (!response.writableFinished) aborted(); };
+    request.once('aborted', aborted); response.once?.('close', closed);
+    const signal = AbortSignal.any([options.signal, requestSignal, connection.signal].filter(Boolean));
+    const budget = runtimeHost.createRequestBudget({ ...options, signal });
+    let incomingBody, adapted, outputExecution;
+    try {
+      budget.check();
+      adapted = await budget.race(nodeRequestToWebRequest(request, { ...options, signal: budget.signal }));
+      if ((options.bodyForwarding || options.bodyTransform) && bodyAllowed(adapted.method)) response.setHeader('connection', 'close');
+      incomingBody = require('./incoming-body.js').createIncomingBody(adapted.request, {
+        ...options, signal: budget.signal, responseWriterOwnsCompletion: true
+      });
+      const requestContext = Object.freeze({
+        request,
+        response,
+        webRequest: adapted.request,
+        signal: budget.signal,
+        headerPairs: adapted.headerPairs
+      });
+      const resolve = value => { budget.check(); return budget.race(resolveRequestOption(value, requestContext)); };
+      const requestedCapabilities = await resolve(options.capabilities);
+      const effectAdapter = await resolve(options.effectAdapter);
+      const schemaCodecs = await resolve(options.schemaCodecs);
+      const config = hasDynamicBindings ? await resolve(options.config) : options.config;
+      const secrets = hasDynamicBindings ? await resolve(options.secrets) : options.secrets;
+      const kv = hasDynamicBindings ? await resolve(options.kv) : options.kv;
+      const bindings = staticBindings || createNodeJavascriptBindingCapabilities({
+        config, secrets, kv,
+        kvReference: options.kvReference,
+        maxBindingNameBytes: options.maxBindingNameBytes,
+        maxBindingValueBytes: options.maxBindingValueBytes,
+        maxKvNamespaceBytes: options.maxKvNamespaceBytes,
+        maxKvKeyBytes: options.maxKvKeyBytes,
+        maxKvValueBytes: options.maxKvValueBytes,
+        maxKvValueDepth: options.maxKvValueDepth,
+        maxKvValueEntries: options.maxKvValueEntries
+      });
+      const capabilities = effectAdapter === undefined
+        ? withNodeBindingCapabilities(requestedCapabilities, { bindings })
+        : requestedCapabilities;
+      const started = process.hrtime.bigint();
+      const activeApplication = options.getApplication
+        ? runtimeHost.normalizeApplication(options.getApplication())
+        : normalizedApplication;
+      outputExecution = require('../runtime/generated-output.js').createGeneratedOutput(response, { ...options, requestBudget: budget, requestMethod: adapted.method });
+      const webResponse = await executeNodeJavascriptApplication(activeApplication, adapted.request, {
+        outputExecution,
+        incomingBody,
+        capabilities,
+        effectAdapter,
+        config,
+        secrets,
+        kv,
+        application: options.application,
+        requestHeaders: adapted.headerPairs,
+        signal: budget.signal,
+        requestBudget: budget, requestClock: options.requestClock,
+        fetchImplementation: options.fetchImplementation,
+        s3: options.s3 || options.bindings && options.bindings.s3,
+        s3FetchImplementation: options.s3FetchImplementation,
+        assetsLookup: options.assetsLookup,
+        gripBroadcast: options.gripBroadcast,
+        jwtCaptureWallClock: options.jwtCaptureWallClock,
+        assets: options.assets,
+        grip: options.grip,
+        maxEffects: options.maxEffects,
+        kvClock: options.kvClock, deadlineMonotonicMs: options.deadlineMonotonicMs,
+        maxRequestBodyBytes: options.maxRequestBodyBytes ?? options.maxBodyBytes,
+        maxFetchBodyBytes: options.maxFetchBodyBytes,
+        maxStructuredBodyBytes: options.maxStructuredBodyBytes,
+        maxBindingNameBytes: options.maxBindingNameBytes,
+        maxBindingValueBytes: options.maxBindingValueBytes,
+        maxKvNamespaceBytes: options.maxKvNamespaceBytes,
+        maxKvKeyBytes: options.maxKvKeyBytes,
+        maxKvValueBytes: options.maxKvValueBytes,
+        maxKvValueDepth: options.maxKvValueDepth,
+        maxKvValueEntries: options.maxKvValueEntries,
+        schemaCodecs,
+        strict: options.strict === true,
+        provider: options.provider || 'node',
+        redactionValues: options.redactionValues,
+        onJsonTrace: options.onJsonTrace,
+        onEffectObservation: options.onEffectObservation,
+        onEffectSummary: options.onEffectSummary
+      });
+      if (incomingBody?.failure) throw incomingBody.failure;
+      if (outputExecution?.started) await outputExecution.finish();
+      else await writeWebResponseToNode(webResponse, response, {
+        requestMethod: adapted.method,
+        signal: incomingBody?.responseSignal || budget.signal, requestBudget: budget,
+        closeConnection: Boolean((options.bodyForwarding || options.bodyTransform) && bodyAllowed(adapted.method))
+      });
+      if (typeof options.onRequest === 'function') {
+        options.onRequest(Object.freeze({
+          method: adapted.method,
+          url: adapted.request.url,
+          path: new URL(adapted.request.url).pathname,
+          status: webResponse.status,
+          durationMs: Number(process.hrtime.bigint() - started) / 1e6
+        }));
+      }
+      return webResponse;
+    } finally {
+      outputExecution?.dispose();
+      await incomingBody?.close();
+      if ((options.bodyForwarding || options.bodyTransform) && !incomingBody && adapted?.request.body && !adapted.request.body.locked) {
+        void adapted.request.body.cancel().catch(() => {});
+      }
+      request.removeListener('aborted', aborted); response.removeListener?.('close', closed);
+      if (!options.requestBudget) budget.close();
     }
-    return webResponse;
   };
 }
 

package/src/javascript/package-effects.js

@@ -30,6 +30,7 @@ function unavailable(effect) {
 function createNodeJavascriptPackageEffectCapabilities(options = {}) {
   const assetsLookup = options.assetsLookup || (options.assets && options.assets.lookup);
   const gripBroadcast = options.gripBroadcast || (options.grip && options.grip.broadcast);
+  const digestText = require('@pulse-compute/crypto/provider').createJavascriptTextDigest(options);
   const jwtVerify = options.jwtVerify || (options.jwt && options.jwt.verify);
   const s3 = options.s3;
   return Object.freeze({
@@ -39,6 +40,7 @@ function createNodeJavascriptPackageEffectCapabilities(options = {}) {
         if (typeof s3 !== 'function') return unavailable(effect);
         return s3(effect, execution);
       }
+      if (effect && effect.contractId === 'pulse.crypto' && effect.operation === 'digestText') return digestText(effect, execution);
       if (effect && effect.contractId === 'pulse.assets' && effect.operation === 'lookup') {
         if (typeof assetsLookup !== 'function') return unavailable(effect);
         return assetsLookup(effect.payload, execution);
@@ -47,7 +49,7 @@ function createNodeJavascriptPackageEffectCapabilities(options = {}) {
         if (typeof gripBroadcast !== 'function') return unavailableGrip();
         return gripBroadcast(effect.payload, execution);
       }
-      if (effect && effect.contractId === 'pulse.jwt' && effect.operation === 'verify') {
+      if (effect && effect.contractId === 'pulse.jwt' && ['verify', 'sign'].includes(effect.operation)) {
         if (typeof jwtVerify !== 'function') return unavailable(effect);
         return jwtVerify(effect, execution);
       }
@@ -63,7 +65,8 @@ function withNodePackageEffectCapabilities(capabilities, options = {}) {
     ...base,
     effect(effect, execution) {
       if (effect && (
-        effect.contractId === 'pulse.assets'
+        effect.contractId === 'pulse.crypto'
+        || effect.contractId === 'pulse.assets'
         || effect.contractId === 'pulse.grip'
         || effect.contractId === 'pulse.jwt'
         || effect.contractId === 'pulse.s3'

package/src/javascript/runtime-host.js

@@ -44,7 +44,10 @@ function nodeJavascriptProviderCapabilities(options) {
     maxKvValueDepth: options.maxKvValueDepth,
     maxKvValueEntries: options.maxKvValueEntries
   };
-  const bindingCapabilities = withNodeBindingCapabilities(options.capabilities, bindingOptions);
+  const bindingCapabilities = Object.freeze({
+    time: () => runtimeHost.readWallTime(options.wallClock === undefined ? () => Date.now() : options.wallClock),
+    ...withNodeBindingCapabilities(options.capabilities, bindingOptions)
+  });
   const configuredGripBroadcast = options.gripBroadcast
     || (options.grip && options.grip.broadcast)
     || (options.grip && options.grip.publishEndpoint
@@ -67,6 +70,7 @@ function nodeJavascriptProviderCapabilities(options) {
       assetsLookup: configuredAssetsLookup,
       gripBroadcast: configuredGripBroadcast,
       jwtVerify: configuredJwtVerify,
+      digestSubtle: options.digestSubtle,
       s3: createNodeJavascriptS3(options, bindingCapabilities.secret),
       assets: options.assets,
       grip: options.grip
@@ -84,12 +88,18 @@ function nodeJavascriptProviderCapabilities(options) {
 
 async function executeNodeJavascriptApplication(application, request, options = {}) {
   const capabilities = nodeJavascriptProviderCapabilities(options);
-  return runtimeHost.executeApplication(assertNodeJavascriptApplication(application), request, {
+  const incomingBody = options.incomingBody || require('./incoming-body.js').createIncomingBody(request, options);
+  try {
+    options.outputExecution?.bindInput(incomingBody);
+    return await runtimeHost.executeApplication(assertNodeJavascriptApplication(application), request, {
+    outputExecution: options.outputExecution,
+    incomingBody,
     capabilities,
     effectAdapter: options.effectAdapter,
     application: options.application,
     requestHeaders: options.requestHeaders,
     signal: options.signal,
+    maxDurationMs: options.maxDurationMs, requestBudget: options.requestBudget, requestClock: options.requestClock,
     kvClock: options.kvClock, deadlineMonotonicMs: options.deadlineMonotonicMs,
     maxEffects: options.maxEffects,
     maxRequestBodyBytes: options.maxRequestBodyBytes,
@@ -113,7 +123,7 @@ async function executeNodeJavascriptApplication(application, request, options =
     onJsonTrace: options.onJsonTrace,
     onEffectObservation: options.onEffectObservation,
     onEffectSummary: options.onEffectSummary
-  });
+  }); } finally { if (!options.incomingBody) await incomingBody?.close(); }
 }
 
 async function executeNodeJavascriptEvent(application, frame, options = {}) {

package/src/javascript/s3.js

@@ -5,17 +5,18 @@ const { readS3 } = require('../runtime/s3-reader.js');
 
 function createNodeJavascriptS3(options, secretLookup) {
   const s3 = normalizeNodeS3(options.s3 || options.bindings && options.bindings.s3);
-  return (effect, execution = {}) => {
+  return async (effect, execution = {}) => {
     // This provider target explicitly selects Crypto's Web Crypto realization.
     // Native execution supplies its own Wasm exports to the same Node transport.
     let selected;
     try { selected = bindJavascriptDigestMac(['SHA-256', 'HMAC-SHA256']); }
     catch { selected = null; }
-    return readS3(effect, {
-      s3, signal: execution.signal, registerRedactionValue: execution.registerRedactionValue,
+    const result = await readS3(effect, {
+      s3, signal: execution.signal, responseSignal: options.signal, requestBudget: execution.requestBudget, registerRedactionValue: execution.registerRedactionValue,
       fetchImplementation: options.s3FetchImplementation || options.fetchImplementation, cryptoTarget: 'javascript',
       cryptoVerifier: selected, cryptoRealization: selected && selected.realization
     }, (name) => secretLookup(name, execution));
+    return effect.operation === 'getBody' ? require('@pulse-compute/runtime/host').markOpaqueResponse(result) : result;
   };
 }
 module.exports = { createNodeJavascriptS3 };

package/src/javascript/target-support-policy.js

@@ -10,7 +10,12 @@ function decision(id, status, reasonId, owner, required = true) {
 
 function classifyNodeJavascriptCapability(id, options = {}) {
   const capability = String(id);
-  if (['s3.head', 's3.getText', 's3.putText'].includes(capability)) return decision(capability, 'eligible', 'node-s3-bounded-origin-transport', 'provider-node');
+  if (capability === 'request.body.transform') return decision(capability, options.bodyTransform ? 'eligible' : 'blocked', options.bodyTransform ? 'node-body-transform-experimental' : 'node-body-transform-not-configured', 'provider-node');
+  if (capability === 'response.output') return decision(capability, options.generatedOutput ? 'eligible' : 'blocked', options.generatedOutput ? 'node-generated-output-experimental' : 'node-generated-output-not-configured', 'provider-node');
+  if (capability === 'request.body.forward' || capability === 'req.body') return decision(capability,
+    options.bodyForwarding ? 'eligible' : 'blocked', options.bodyForwarding ? 'node-incoming-body-forwarding' : 'node-incoming-body-forwarding-not-configured', 'provider-node');
+  if (capability === 'crypto.digestText') return decision(capability, 'eligible', 'node-javascript-crypto-sha256-runtime-builtin', 'provider-node');
+  if (['s3.head', 's3.getText', 's3.putText', 's3.getBody'].includes(capability)) return decision(capability, 'eligible', 'node-s3-bounded-origin-transport', 'provider-node');
   if (isJavascriptCoreCapability(capability)) {
     return decision(capability, 'eligible', 'node-router-context-parity', 'provider-node');
   }
@@ -40,9 +45,11 @@ function classifyNodeJavascriptCapability(id, options = {}) {
     return decision(capability, 'eligible', 'node-provider-wall-clock-authority', 'provider-node');
   }
   if (
-    capability === 'jwt.verify'
+    capability === 'jwt.sign'
+    || capability === 'jwt.verify'
     || capability === 'jwt.verify.hs256'
     || capability === 'jwt.verify.es256'
+    || capability === 'jwt.verify.rs256'
   ) {
     return decision(capability, 'eligible', 'node-javascript-jwt-crypto-runtime-builtin', 'provider-node');
   }
@@ -76,7 +83,11 @@ function classifyNodeJavascriptCapability(id, options = {}) {
 
 function classifyNodeJavascriptProviderRequirement(id, compilerCapabilities, options = {}) {
   const requirement = String(id);
-  if (['s3.head', 's3.getText', 's3.putText'].includes(requirement)) return decision(requirement, 'eligible', 'node-s3-bounded-origin-transport', 'provider-node');
+  if (requirement === 'request.body.transform') return classifyNodeJavascriptCapability(requirement, options);
+  if (requirement === 'response.output') return classifyNodeJavascriptCapability(requirement, options);
+  if (requirement === 'request.body.forward') return classifyNodeJavascriptCapability(requirement, options);
+  if (requirement === 'crypto.digestText') return decision(requirement, 'eligible', 'node-javascript-crypto-sha256-runtime-builtin', 'provider-node');
+  if (['s3.head', 's3.getText', 's3.putText', 's3.getBody'].includes(requirement)) return decision(requirement, 'eligible', 'node-s3-bounded-origin-transport', 'provider-node');
   if (requirement === 'request') {
     const bodyRequired = compilerCapabilities.some((entry) => entry === 'request.json' || entry.startsWith('request.body'));
     return bodyRequired
@@ -104,9 +115,11 @@ function classifyNodeJavascriptProviderRequirement(id, compilerCapabilities, opt
     return decision(requirement, 'eligible', 'node-provider-wall-clock-authority', 'provider-node');
   }
   if (
-    requirement === 'jwt.verify'
+    requirement === 'jwt.sign'
+    || requirement === 'jwt.verify'
     || requirement === 'jwt.verify.hs256'
     || requirement === 'jwt.verify.es256'
+    || requirement === 'jwt.verify.rs256'
   ) {
     return decision(requirement, 'eligible', 'node-javascript-jwt-crypto-runtime-builtin', 'provider-node');
   }

package/src/javascript/target.js

@@ -27,6 +27,11 @@ const NODE_JAVASCRIPT_TARGET_DESCRIPTOR = normalizeJavascriptTargetDescriptor({
       realization: 'runtime-builtin',
       implemented: true,
       status: 'implemented-g3'
+    }, {
+      algorithm: 'RS256',
+      realization: 'runtime-builtin',
+      implemented: true,
+      status: 'implemented-rs256'
     }]
   }),
   commands: { compile: true, inspect: true, doctor: true, build: true, test: true, dev: true }

package/src/javascript/test-runtime.js

@@ -42,7 +42,10 @@ async function executeNodeJavascriptTestCase(application, testCase, options = {}
     options.networkFetch === true ? globalThis.fetch : undefined,
     { rawResponse: true }
   );
+  const collected = options.generatedOutput ? require('../runtime/generated-output-test.js').collector({ ...options, requestMethod: adapted.request.method }) : undefined;
+  try {
   const response = await executeNodeJavascriptApplication(application, adapted.request, {
+    outputExecution: collected?.outputExecution,
     capabilities: options.capabilities,
     effectAdapter: options.effectAdapter,
     fetchImplementation: fixtureFetch,
@@ -60,6 +63,9 @@ async function executeNodeJavascriptTestCase(application, testCase, options = {}
     kv: testCase.kv || {},
     application: options.application,
     requestHeaders: adapted.headerPairs,
+    maxDurationMs: options.maxDurationMs, requestClock: options.requestClock, requestBudget: collected?.budget || options.requestBudget, signal: options.signal,
+    bodyForwarding: options.bodyForwarding,
+    bodyTransform: options.bodyTransform,
     maxEffects: options.maxEffects,
     maxRequestBodyBytes: options.maxRequestBodyBytes ?? options.maxBodyBytes ?? testCase.maxBodyBytes,
     maxFetchBodyBytes: options.maxFetchBodyBytes ?? testCase.maxBodyBytes,
@@ -85,7 +91,8 @@ async function executeNodeJavascriptTestCase(application, testCase, options = {}
     }
   });
   const method = String(testCase.request && testCase.request.method || 'GET').toUpperCase();
-  const body = method === 'HEAD' ? '' : Buffer.from(await response.arrayBuffer()).toString('utf8');
+  if (collected?.outputExecution.started) await collected.outputExecution.finish();
+  const body = collected?.outputExecution.started ? collected.body() : method === 'HEAD' ? '' : Buffer.from(await response.arrayBuffer()).toString('utf8');
   return Object.freeze({
     version: NODE_JAVASCRIPT_TEST_RUNTIME_VERSION,
     response: Object.freeze({
@@ -106,6 +113,7 @@ async function executeNodeJavascriptTestCase(application, testCase, options = {}
     }))),
     resolutionOrder: effectSummary ? effectSummary.resolutionOrder : Object.freeze([])
   });
+  } finally { collected?.dispose(); }
 }
 
 module.exports = Object.freeze({

package/src/native/target.js

@@ -30,6 +30,13 @@ const NODE_NATIVE_TARGET_DESCRIPTOR = Object.freeze({
   capabilities: NODE_NATIVE_TARGET_CAPABILITIES,
   keyTypes: Object.freeze(['secret', 'jwk', 'jwks']),
   realizations: Object.freeze([
+    Object.freeze({
+      kind: 'package-native-application',
+      contractId: 'pulse.entities',
+      implementation: 'pulse.package-native-application.v1',
+      implemented: true,
+      automaticFallback: false
+    }),
     Object.freeze({
       kind: 'crypto-composed',
       realization: 'guest-source:pulse-hmac-as',
@@ -55,6 +62,19 @@ const NODE_NATIVE_TARGET_DESCRIPTOR = Object.freeze({
       guestUnitRequired: true,
       portable: true,
       automaticFallback: false
+    }),
+Object.freeze({
+      kind: 'crypto-composed',
+      realization: 'guest-linked:pulse-rs256-bearssl-i31',
+      implementation: 'bearssl.0.6.rsa-i31.sha256.v1',
+      algorithms: Object.freeze(['RS256']),
+      keyTypes: Object.freeze(['jwk', 'jwks']),
+      implemented: true,
+      status: 'implemented-rs256',
+      semanticOwner: '@pulse-compute/crypto',
+      guestUnitRequired: true,
+      portable: true,
+      automaticFallback: false
     })
   ]),
   automaticFallback: false,
@@ -70,6 +90,11 @@ const NODE_NATIVE_TARGET_DESCRIPTOR = Object.freeze({
       realization: 'guest-linked:pulse-es256-rustcrypto-p256',
       implemented: true,
       status: 'implemented-g3'
+    }, {
+      algorithm: 'RS256',
+      realization: 'guest-linked:pulse-rs256-bearssl-i31',
+      implemented: true,
+      status: 'implemented-rs256'
     }]
   }),
   finalWasmPolicy: nodeFinalWasmPolicy