@pulse-compute/provider-node 1.0.0-beta.5 → 1.0.0-beta.6

package/README.md

@@ -2,20 +2,22 @@
 
 <!-- pulse-package-status:start -->
 > **Support tier:** Implementation/transitive surface<br>
-> **Audience:** Pulse canonical Node provider and compiler maintainers.<br>
-> **Install directly:** No for application projects; select provider: node through the CLI.<br>
-> **Supported entry points:** `@pulse-compute/provider-node/toolchain`<br>
-> **Stability:** The listed built-in toolchain entry is synchronized with the Beta bootstrap contract; other canonical Node provider interfaces remain internal.<br>
+> **Audience:** Node deployment integrators and Pulse provider maintainers.<br>
+> **Install directly:** Yes for the production Node launcher; application handlers remain provider-neutral.<br>
+> **Supported entry points:** `@pulse-compute/provider-node/toolchain`, `@pulse-compute/provider-node/server`<br>
+> **Stability:** The /server export is an explicit supported-entry-point exception within this implementation package: finite production HTTP for explicit Node Native and JavaScript builds. Forwarding, generated output, transforms, S3-body bindings and blob-specific production qualification remain separate. /toolchain serves the CLI; all other provider subpaths remain internal.<br>
 > **npm:** [`@pulse-compute/provider-node`](https://www.npmjs.com/package/@pulse-compute/provider-node)<br>
-> **Canonical replacement:** `provider: 'node' through @pulse-compute/cli`<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.5/packages/implementation-packages/)
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.6/packages/implementation-packages/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.5` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.6` package policy.
 <!-- pulse-package-status:end -->
 
 Canonical Node provider implementation used internally when a project selects `provider: 'node'`.
 
-Application projects do not install or import this package directly. The supported entry is provider selection through `@pulse-compute/cli`.
+Deployment integrators install this package and import `@pulse-compute/provider-node/server`
+to launch a trusted `pulse build` directory. Application handlers remain provider-neutral.
+See [Node build and execution](https://pulsecompute.io/v1.0.0-beta.6/guides/deploying-node/)
+for configuration, readiness, drain, signals and restart.
 
 ## Responsibilities
 
@@ -60,4 +62,4 @@ The package exposes focused compiler and runtime modules for the synchronized
 repository, including `runtime/canonical-api-runtime`. Those exports are
 implementation interfaces, not application-author APIs.
 
-See [Contracts and providers](https://pulsecompute.io/v1.0.0-beta.5/concepts/contracts-and-providers/) and [Implementation packages](https://pulsecompute.io/v1.0.0-beta.5/packages/implementation-packages/).
+See [Contracts and providers](https://pulsecompute.io/v1.0.0-beta.6/concepts/contracts-and-providers/) and [Implementation packages](https://pulsecompute.io/v1.0.0-beta.6/packages/implementation-packages/).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-compute/provider-node",
-  "version": "1.0.0-beta.5",
+  "version": "1.0.0-beta.6",
   "license": "Apache-2.0",
   "engines": {
     "node": "^22.14.0 || ^24.0.0"
@@ -39,16 +39,20 @@
     "./javascript/package-effects": "./src/javascript/package-effects.js",
     "./javascript/jwt-verifier": "./src/javascript/jwt-verifier.js",
     "./javascript/grip-broadcast": "./src/javascript/grip-broadcast.js",
-    "./javascript/source-package": "./src/javascript/source-package.js"
+    "./javascript/source-package": "./src/javascript/source-package.js",
+    "./server": {
+      "types": "./src/server/index.d.ts",
+      "default": "./src/server/index.js"
+    }
   },
   "dependencies": {
-    "@pulse-compute/crypto": "1.0.0-beta.5",
-    "@pulse-compute/jwt": "1.0.0-beta.5",
-    "@pulse-compute/runtime": "1.0.0-beta.5",
-    "@pulse-compute/s3": "1.0.0-beta.5",
-    "@pulse-compute/wasm-build-support": "1.0.0-beta.5",
-    "@pulse-compute/wasm-contracts": "1.0.0-beta.5",
-    "@pulse-compute/wasm-host-runtime": "1.0.0-beta.5"
+    "@pulse-compute/crypto": "1.0.0-beta.6",
+    "@pulse-compute/jwt": "1.0.0-beta.6",
+    "@pulse-compute/runtime": "1.0.0-beta.6",
+    "@pulse-compute/s3": "1.0.0-beta.6",
+    "@pulse-compute/wasm-build-support": "1.0.0-beta.6",
+    "@pulse-compute/wasm-contracts": "1.0.0-beta.6",
+    "@pulse-compute/wasm-host-runtime": "1.0.0-beta.6"
   },
   "publishConfig": {
     "access": "public"
@@ -64,7 +68,7 @@
     "url": "git+https://github.com/pulse-compute/pulse.git",
     "directory": "packages/provider-node"
   },
-  "homepage": "https://pulsecompute.io/v1.0.0-beta.5/packages/implementation-packages/",
+  "homepage": "https://pulsecompute.io/v1.0.0-beta.6/packages/implementation-packages/",
   "bugs": {
     "url": "https://github.com/pulse-compute/pulse/issues"
   }

package/src/capabilities.js

@@ -3,8 +3,11 @@
 const NODE_JWT_VERIFY_CAPABILITY = 'jwt.verify';
 
 const NODE_CANONICAL_PROVIDER_CAPABILITIES = Object.freeze([
-  's3.head', 's3.getText', 's3.putText',
+  's3.head', 's3.getText', 's3.putText', 's3.getBody',
   'request',
+  'request.body.forward',
+  'response.output',
+  'request.body.transform',
   'response.json',
   'response.text',
   'response.custom',
@@ -21,14 +24,18 @@ const NODE_CANONICAL_PROVIDER_CAPABILITIES = Object.freeze([
   'assets.lookup',
   'grip.broadcast',
   NODE_JWT_VERIFY_CAPABILITY,
+  'jwt.sign',
   'opaque.pass-through'
 ]);
 
 const NODE_CANONICAL_PROVIDER_LOWERING = Object.freeze({
   request: 'node.http.request',
+  'request.body.forward': 'node.http.incoming-request-v1',
   'response.json': 'node.http.response.json',
   'response.text': 'node.http.response.text',
   'response.custom': 'node.http.response.custom',
+  'request.body.transform': 'node.http.bounded-text-transform-v1',
+  'response.output': 'node.http.generated-output-v1',
   fetch: 'node.fetch.dispatch',
   'time.wall-clock': 'node.runtime.time.now',
   'crypto.digestText': 'node.crypto.digest-text',
@@ -44,17 +51,21 @@ const NODE_CANONICAL_PROVIDER_LOWERING = Object.freeze({
   's3.head': 'node.native.s3.head',
   's3.getText': 'node.native.s3.getText',
   's3.putText': 'node.native.s3.putText',
+  's3.getBody': 'node.s3.opaque-body',
   'assets.lookup': 'node.runtime.assets.lookup',
   'grip.broadcast': 'node.http.grip.publish',
   [NODE_JWT_VERIFY_CAPABILITY]: 'node.native.jwt.verify',
+  'jwt.sign': 'node.native.jwt.sign',
   'opaque.pass-through': 'node.http.response.stream'
 });
 
 const NODE_NATIVE_TARGET_CAPABILITIES = Object.freeze([
-  's3.head', 's3.getText', 's3.putText',
+  's3.head', 's3.getText', 's3.putText', 's3.getBody',
   NODE_JWT_VERIFY_CAPABILITY,
+  'jwt.sign',
   'jwt.verify.hs256',
   'jwt.verify.es256',
+  'jwt.verify.rs256',
   'secret.get',
   'event.ingress',
   'event.emit',

package/src/config/s3.js

@@ -13,7 +13,7 @@ function normalizeNodeS3(input = {}) {
 }
 function validateNodeS3Operations(metadata, bindings) {
   for (const effect of metadata.providerOperations || []) {
-    if (!['s3.head', 's3.getText', 's3.putText'].includes(effect.kind)) continue;
+    if (!['s3.head', 's3.getText', 's3.putText', 's3.getBody'].includes(effect.kind)) continue;
     if (!bindings.s3 || !Object.hasOwn(bindings.s3, effect.resource && effect.resource.binding)) throw new TypeError('The required Node S3 binding is missing.');
   }
 }

package/src/javascript/fetch-adapter.js

@@ -22,6 +22,9 @@ function createNodeJavascriptFetchCapability(options = {}) {
     }
 
     try {
+      if (init.body && typeof init.body === 'object') {
+        return await runtimeHost.forwardIncomingBody(init.body, String(url), init, execution);
+      }
       const response = await implementation(String(url), {
         method: init.method,
         headers: init.headers,
@@ -136,6 +139,14 @@ function createNodeJavascriptFixtureFetch(fetches = {}, fallback, options = {})
     }
     await delayWithSignal(fixture.delayMs, init.signal);
 
+    // Incoming forwarding fixture transport consumes the already bounded
+    // provider stream without accumulating bytes or replaying it.
+    if (init.duplex === 'half' && init.body?.getReader) {
+      const reader = init.body.getReader();
+      try { while (!(await reader.read()).done) init.signal?.throwIfAborted(); }
+      finally { reader.releaseLock(); }
+    }
+
     const status = Number(fixture.status || 200);
     let body = null;
     let defaultContentType;
@@ -169,7 +180,7 @@ function createNodeJavascriptFixtureFetch(fetches = {}, fallback, options = {})
       && status !== 304
       && !(status >= 100 && status < 200);
     const response = new Response(bodyAllowed ? body : null, { status, headers });
-    if (options.rawResponse === true) return response;
+    if (options.rawResponse === true || init.duplex === 'half') return response;
     return runtimeHost.createOpaqueFetchResponse({ response, headers: headerPairs });
   };
 }

package/src/javascript/incoming-body.js

@@ -0,0 +1,163 @@
+'use strict';
+
+const host = require('@pulse-compute/runtime/host');
+const CHUNK_BYTES = 16 * 1024;
+const QUEUE_BYTES = 64 * 1024;
+const error = (code, message) => new host.PulseRuntimeContractError(code, message);
+
+function normalizeBodyForwarding(value, maxDurationMs) {
+  if (value === undefined) return undefined;
+  if (!value || typeof value !== 'object' || Object.keys(value).some(key => key !== 'maxBytes')
+    || !Number.isSafeInteger(value.maxBytes) || value.maxBytes <= 0
+    || !Number.isSafeInteger(maxDurationMs) || maxDurationMs < 1 || maxDurationMs > 30000) {
+    throw error('PULSE_REQUEST_FORWARDING_CONFIG_INVALID', 'node.bodyForwarding requires a positive safe integer maxBytes and node.maxDurationMs (1–30000).');
+  }
+  return Object.freeze({ maxBytes: value.maxBytes });
+}
+
+// One retained host chunk, one pending read, no whole-body accumulation. The
+// host chunk contract is checked before retaining it; slices are copied so a
+// small outgoing chunk cannot keep an oversized backing allocation alive.
+function boundedBody(source, maxBytes, signal, observe, onClose) {
+  let reader, controller, pending, failure, offset = 0, ended = false, stopped = false;
+  const metrics = { bytes: 0, maxSourceChunkBytes: 0, maxChunkBytes: 0, maxQueuedBytes: 0 };
+  const release = () => { try { reader?.releaseLock(); } catch (_) {} };
+  function stop(reason) {
+    if (stopped || ended) return;
+    failure ||= reason;
+    stopped = true; pending = undefined;
+    try { Promise.resolve(reader ? reader.cancel(reason) : source?.cancel(reason)).catch(() => {}).finally(release); } catch (_) {}
+    try { reason ? controller.error(reason) : controller.close(); } catch (_) {}
+    signal?.removeEventListener('abort', abort);
+    onClose?.();
+  }
+  const abort = () => stop(signal.reason);
+  const stream = new ReadableStream({
+    start(value) { controller = value; signal?.addEventListener('abort', abort, { once: true }); if (signal?.aborted) abort(); },
+    async pull(value) {
+      if (stopped || ended) return;
+      try {
+        signal?.throwIfAborted();
+        if (!pending) {
+          if (!source) { ended = true; value.close(); signal?.removeEventListener('abort', abort); onClose?.(); return; }
+          reader ||= source.getReader();
+          const next = await reader.read();
+          if (stopped) return;
+          signal?.throwIfAborted();
+          if (next.done) { ended = true; value.close(); release(); signal?.removeEventListener('abort', abort); onClose?.(); return; }
+          if (!(next.value instanceof Uint8Array) || next.value.byteLength > QUEUE_BYTES
+            || next.value.buffer.byteLength > QUEUE_BYTES) {
+            throw error('PULSE_REQUEST_FORWARDING_CHUNK_INVALID', 'Provider body chunks and their backing allocations must not exceed 65536 bytes.');
+          }
+          metrics.bytes += next.value.byteLength;
+          if (metrics.bytes > maxBytes) throw error('PULSE_REQUEST_BODY_TOO_LARGE', 'Forwarded body exceeds the configured transfer limit.');
+          pending = next.value; offset = 0;
+          metrics.maxSourceChunkBytes = Math.max(metrics.maxSourceChunkBytes, pending.byteLength);
+          metrics.maxQueuedBytes = Math.max(metrics.maxQueuedBytes, pending.byteLength);
+        }
+        const count = Math.min(CHUNK_BYTES, pending.byteLength - offset);
+        if (count) {
+          value.enqueue(Uint8Array.from(pending.subarray(offset, offset + count)));
+          metrics.maxChunkBytes = Math.max(metrics.maxChunkBytes, count);
+        }
+        offset += count;
+        if (offset === pending.byteLength) pending = undefined;
+        observe?.(Object.freeze({ ...metrics }));
+      } catch (cause) { stop(cause); }
+    },
+    cancel(reason) { stop(reason); }
+  }, { highWaterMark: 0 });
+  return { stream, stop, metrics, get failure() { return failure; } };
+}
+
+function createIncomingBody(request, options) {
+  if (options.bodyTransform !== undefined) return require('../runtime/body-transform.js').createTransformInput(request, options);
+  const policy = normalizeBodyForwarding(options.bodyForwarding, options.maxDurationMs);
+  if (!policy) return undefined;
+  let upload, timeoutMs, timer, responseSignal, responseTransferred = false;
+  const clearTimer = () => { if (timer !== undefined) clearTimeout(timer); timer = undefined; };
+  function validate() {
+    const length = request.headers.get('content-length');
+    if (length !== null && (!/^\d+$/.test(length) || !Number.isSafeInteger(Number(length)))) {
+      throw error('PULSE_REQUEST_FORWARDING_HEADERS_INVALID', 'Invalid incoming content length.');
+    }
+    if (length !== null && Number(length) > policy.maxBytes) throw error('PULSE_REQUEST_BODY_TOO_LARGE', 'Incoming body exceeds the configured transfer limit.');
+  }
+  validate();
+  return host.createIncomingBodyOwnership({
+    get responseSignal() { return responseSignal; },
+    validate(init) {
+      validate();
+      if (init.method !== 'POST') throw error('PULSE_FETCH_BODY_METHOD_UNSUPPORTED', 'Incoming forwarding requires an outbound POST.');
+      for (const [name] of init.headers) if (/^(host|content-length|transfer-encoding|connection|keep-alive|te|trailer|upgrade|proxy-connection)$/i.test(name)) {
+        throw error('PULSE_REQUEST_FORWARDING_HEADERS_INVALID', 'The provider owns forwarding framing and hop-by-hop headers.');
+      }
+      if (typeof options.fetchImplementation !== 'function') throw error('PULSE_FETCH_IMPLEMENTATION_UNAVAILABLE', 'Incoming forwarding requires provider-owned network transport.');
+      timeoutMs = init.timeoutMs;
+    },
+    async forward(url, init, execution) {
+      // The ordinary fetch effect settles at headers. Keep its shorter budget
+      // through response-body completion for this single-use transfer.
+      const timeout = new AbortController();
+      if (timeoutMs !== undefined) timer = setTimeout(() => timeout.abort(error('PULSE_FETCH_TIMEOUT', 'Incoming forwarding exceeded its fetch timeout.')), Math.min(timeoutMs, options.maxDurationMs));
+      const signal = AbortSignal.any([execution.signal, options.signal, timeout.signal].filter(Boolean));
+      responseSignal = signal;
+      upload = boundedBody(request.body, policy.maxBytes, signal, options.onBodyForwardingObservation);
+      let response;
+      try {
+        response = await options.fetchImplementation(url, {
+          method: 'POST', headers: init.headers, body: upload.stream,
+          signal, duplex: 'half', redirect: 'manual'
+        });
+      } catch (cause) { clearTimer(); throw upload.failure || cause; }
+      finally { upload.stop(); }
+      if (signal.aborted) {
+        clearTimer();
+        try { void response?.body?.cancel(signal.reason).catch(() => {}); } catch (_) {}
+        signal.throwIfAborted();
+      }
+      if (!(response instanceof Response)) throw error('PULSE_FETCH_RESPONSE_INVALID', 'Forwarding transport must return a Web Response.');
+      if (response.status >= 300 && response.status < 400) {
+        try { void response.body?.cancel().catch(() => {}); } catch (_) {}
+        throw error('PULSE_REQUEST_FORWARDING_REDIRECT', 'Single-use incoming bodies cannot be replayed on redirects.');
+      }
+      const responseBody = response.body && boundedBody(response.body, policy.maxBytes, signal, options.onBodyForwardingObservation,
+        () => { if (!options.responseWriterOwnsCompletion) clearTimer(); });
+      responseTransferred = Boolean(responseBody);
+      if (!responseBody && !options.responseWriterOwnsCompletion) clearTimer();
+      // Headers and status remain provider-owned. No incoming request headers
+      // are copied implicitly; the response bytes retain their ordinary form.
+      return new Response(responseBody ? responseBody.stream : null, { status: response.status, statusText: response.statusText, headers: response.headers });
+    },
+    cancel(reason) {
+      if (!responseTransferred || options.responseWriterOwnsCompletion) clearTimer();
+      upload?.stop(reason);
+      if (!upload && request.body && !request.body.locked) void request.body.cancel(reason).catch(() => {});
+      // Response ownership has transferred separately to the HTTP writer.
+    }
+  });
+}
+
+// Adapt IncomingMessage without switching it into flowing mode. Node's own
+// transport buffer is separate from the Pulse queue and stays at most 64 KiB.
+function nodeIncomingStream(request) {
+  if (request.readableHighWaterMark > QUEUE_BYTES) throw error('PULSE_REQUEST_FORWARDING_CHUNK_INVALID', 'Incoming Node transport high-water mark exceeds 65536 bytes.');
+  let stopped = false, wake;
+  const notify = () => { wake?.(); wake = undefined; };
+  for (const event of ['readable', 'end', 'error', 'aborted']) request.on(event, notify);
+  function cleanup() { for (const event of ['readable', 'end', 'error', 'aborted']) request.removeListener(event, notify); }
+  return new ReadableStream({
+    async pull(controller) {
+      while (!stopped) {
+        if (request.errored || request.aborted) { cleanup(); throw request.errored || error('PULSE_NODE_REQUEST_READ_FAILED', 'Incoming request was aborted.'); }
+        const chunk = request.read(Math.min(request.readableLength || CHUNK_BYTES, CHUNK_BYTES));
+        if (chunk) { controller.enqueue(Uint8Array.from(chunk)); return; }
+        if (request.readableEnded) { cleanup(); controller.close(); return; }
+        await new Promise(resolve => { wake = resolve; });
+      }
+    },
+    cancel() { stopped = true; request.pause(); cleanup(); notify(); }
+  }, { highWaterMark: 0 });
+}
+
+module.exports = { normalizeBodyForwarding, boundedBody, createIncomingBody, nodeIncomingStream };

package/src/javascript/jwt-verifier.js

@@ -1,10 +1,12 @@
 'use strict';
 
 const {
+  normalizeJwtSignEffect,
   normalizeJwtVerifyEffect
 } = require('@pulse-compute/wasm-contracts/jwt/contracts');
 const {
   CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION,
+  CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION,
   CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION
 } = require('@pulse-compute/wasm-contracts/crypto/contracts');
 
@@ -16,6 +18,7 @@ const NODE_JAVASCRIPT_JWT_REALIZATIONS = Object.freeze({
     implementation: CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION,
     automaticFallback: false
   }),
+  RS256: Object.freeze({ algorithm: 'RS256', realization: 'runtime-builtin', implementation: CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION, automaticFallback: false }),
   ES256: Object.freeze({
     algorithm: 'ES256',
     realization: 'runtime-builtin',
@@ -83,12 +86,19 @@ function createNodeJavascriptJwtVerify(options = {}) {
   return async function verifyNodeJavascriptJwt(effect, execution) {
     const { jwtProvider, cryptoProvider } = await loadRuntimeModules();
     assertRequestActive(execution, jwtProvider);
-    const input = normalizeJwtVerifyEffect(effect);
-    if (execution && typeof execution.registerRedactionValue === 'function') {
+    const signing = effect.operation === 'sign';
+    const input = signing ? normalizeJwtSignEffect(effect) : normalizeJwtVerifyEffect(effect);
+    if (!signing && execution && typeof execution.registerRedactionValue === 'function') {
       execution.registerRedactionValue(input.token);
     }
     assertRequestActive(execution, jwtProvider);
-    const selectedCrypto = assertRuntimeBuiltin(cryptoProvider, jwtProvider);
+    const selectedCrypto = signing
+      ? (input.options.algorithm === 'RS256'
+        ? require('@pulse-compute/crypto/provider').bindJavascriptRs256Signer()
+        : input.options.algorithm === 'ES256'
+        ? require('@pulse-compute/crypto/provider').bindJavascriptEs256Signer()
+        : require('@pulse-compute/crypto/provider').bindJavascriptDigestMac(['HMAC-SHA256']))
+      : assertRuntimeBuiltin(cryptoProvider, jwtProvider);
     const host = {
       async captureWallClock() {
         assertRequestActive(execution, jwtProvider);
@@ -118,7 +128,7 @@ function createNodeJavascriptJwtVerify(options = {}) {
         return result;
       };
     }
-    const result = await jwtProvider.verifyJwtWithCrypto(
+    const result = await (signing ? jwtProvider.signJwtWithCrypto : jwtProvider.verifyJwtWithCrypto)(
       input,
       Object.freeze(host),
       selectedCrypto

package/src/javascript/lifecycle.js

@@ -14,7 +14,7 @@ function statusForError(error) {
 
 function writeSafeError(response, error) {
   if (response.headersSent) {
-    if (!response.writableEnded) response.end();
+    if (!response.writableEnded) response.destroy(error);
     return;
   }
   response.statusCode = statusForError(error);

package/src/javascript/node-adapter.js

@@ -102,10 +102,15 @@ async function nodeRequestToWebRequest(request, options = {}) {
   for (const [name, value] of headerPairs) headers.append(name, value);
   const init = { method, headers };
   if (bodyAllowed(method)) {
-    const body = await readNodeRequestBody(request, options.maxRequestBodyBytes ?? options.maxBodyBytes, options.signal);
-    if (body.byteLength > 0) {
-      init.body = body;
+    if (options.bodyForwarding || options.bodyTransform) {
+      init.body = require('./incoming-body.js').nodeIncomingStream(request);
       init.duplex = 'half';
+    } else {
+      const body = await readNodeRequestBody(request, options.maxRequestBodyBytes ?? options.maxBodyBytes, options.signal);
+      if (body.byteLength > 0) {
+        init.body = body;
+        init.duplex = 'half';
+      }
     }
   }
   return Object.freeze({
@@ -150,6 +155,7 @@ async function writeWebResponseToNode(response, nodeResponse, options = {}) {
     for (const group of groupHeaderPairs(runtimeHost.responseHeaderPairs(response))) {
       nodeResponse.setHeader(group.name, group.values.length === 1 ? group.values[0] : [...group.values]);
     }
+    if (options.closeConnection) nodeResponse.setHeader('connection', 'close');
 
     const method = String(options.requestMethod || 'GET').toUpperCase();
     if (method === 'HEAD' || !statusAllowsBody(response.status) || response.body == null) {
@@ -200,11 +206,21 @@ function createNodeJavascriptHandler(application, options = {}) {
         maxKvValueDepth: options.maxKvValueDepth,
         maxKvValueEntries: options.maxKvValueEntries
       });
-  return async function pulseNodeJavascriptHandler(request, response) {
-    const budget = runtimeHost.createRequestBudget(options);
+  return async function pulseNodeJavascriptHandler(request, response, requestSignal) {
+    const connection = new AbortController();
+    const aborted = () => connection.abort(new Error('Node request disconnected.'));
+    const closed = () => { if (!response.writableFinished) aborted(); };
+    request.once('aborted', aborted); response.once?.('close', closed);
+    const signal = AbortSignal.any([options.signal, requestSignal, connection.signal].filter(Boolean));
+    const budget = runtimeHost.createRequestBudget({ ...options, signal });
+    let incomingBody, adapted, outputExecution;
     try {
       budget.check();
-      const adapted = await budget.race(nodeRequestToWebRequest(request, { ...options, signal: budget.signal }));
+      adapted = await budget.race(nodeRequestToWebRequest(request, { ...options, signal: budget.signal }));
+      if ((options.bodyForwarding || options.bodyTransform) && bodyAllowed(adapted.method)) response.setHeader('connection', 'close');
+      incomingBody = require('./incoming-body.js').createIncomingBody(adapted.request, {
+        ...options, signal: budget.signal, responseWriterOwnsCompletion: true
+      });
       const requestContext = Object.freeze({
         request,
         response,
@@ -237,7 +253,10 @@ function createNodeJavascriptHandler(application, options = {}) {
       const activeApplication = options.getApplication
         ? runtimeHost.normalizeApplication(options.getApplication())
         : normalizedApplication;
+      outputExecution = require('../runtime/generated-output.js').createGeneratedOutput(response, { ...options, requestBudget: budget, requestMethod: adapted.method });
       const webResponse = await executeNodeJavascriptApplication(activeApplication, adapted.request, {
+        outputExecution,
+        incomingBody,
         capabilities,
         effectAdapter,
         config,
@@ -275,7 +294,13 @@ function createNodeJavascriptHandler(application, options = {}) {
         onEffectObservation: options.onEffectObservation,
         onEffectSummary: options.onEffectSummary
       });
-      await writeWebResponseToNode(webResponse, response, { requestMethod: adapted.method, signal: budget.signal, requestBudget: budget });
+      if (incomingBody?.failure) throw incomingBody.failure;
+      if (outputExecution?.started) await outputExecution.finish();
+      else await writeWebResponseToNode(webResponse, response, {
+        requestMethod: adapted.method,
+        signal: incomingBody?.responseSignal || budget.signal, requestBudget: budget,
+        closeConnection: Boolean((options.bodyForwarding || options.bodyTransform) && bodyAllowed(adapted.method))
+      });
       if (typeof options.onRequest === 'function') {
         options.onRequest(Object.freeze({
           method: adapted.method,
@@ -286,7 +311,15 @@ function createNodeJavascriptHandler(application, options = {}) {
         }));
       }
       return webResponse;
-    } finally { if (!options.requestBudget) budget.close(); }
+    } finally {
+      outputExecution?.dispose();
+      await incomingBody?.close();
+      if ((options.bodyForwarding || options.bodyTransform) && !incomingBody && adapted?.request.body && !adapted.request.body.locked) {
+        void adapted.request.body.cancel().catch(() => {});
+      }
+      request.removeListener('aborted', aborted); response.removeListener?.('close', closed);
+      if (!options.requestBudget) budget.close();
+    }
   };
 }
 

package/src/javascript/package-effects.js

@@ -49,7 +49,7 @@ function createNodeJavascriptPackageEffectCapabilities(options = {}) {
         if (typeof gripBroadcast !== 'function') return unavailableGrip();
         return gripBroadcast(effect.payload, execution);
       }
-      if (effect && effect.contractId === 'pulse.jwt' && effect.operation === 'verify') {
+      if (effect && effect.contractId === 'pulse.jwt' && ['verify', 'sign'].includes(effect.operation)) {
         if (typeof jwtVerify !== 'function') return unavailable(effect);
         return jwtVerify(effect, execution);
       }

package/src/javascript/runtime-host.js

@@ -88,7 +88,12 @@ function nodeJavascriptProviderCapabilities(options) {
 
 async function executeNodeJavascriptApplication(application, request, options = {}) {
   const capabilities = nodeJavascriptProviderCapabilities(options);
-  return runtimeHost.executeApplication(assertNodeJavascriptApplication(application), request, {
+  const incomingBody = options.incomingBody || require('./incoming-body.js').createIncomingBody(request, options);
+  try {
+    options.outputExecution?.bindInput(incomingBody);
+    return await runtimeHost.executeApplication(assertNodeJavascriptApplication(application), request, {
+    outputExecution: options.outputExecution,
+    incomingBody,
     capabilities,
     effectAdapter: options.effectAdapter,
     application: options.application,
@@ -118,7 +123,7 @@ async function executeNodeJavascriptApplication(application, request, options =
     onJsonTrace: options.onJsonTrace,
     onEffectObservation: options.onEffectObservation,
     onEffectSummary: options.onEffectSummary
-  });
+  }); } finally { if (!options.incomingBody) await incomingBody?.close(); }
 }
 
 async function executeNodeJavascriptEvent(application, frame, options = {}) {

package/src/javascript/s3.js

@@ -5,17 +5,18 @@ const { readS3 } = require('../runtime/s3-reader.js');
 
 function createNodeJavascriptS3(options, secretLookup) {
   const s3 = normalizeNodeS3(options.s3 || options.bindings && options.bindings.s3);
-  return (effect, execution = {}) => {
+  return async (effect, execution = {}) => {
     // This provider target explicitly selects Crypto's Web Crypto realization.
     // Native execution supplies its own Wasm exports to the same Node transport.
     let selected;
     try { selected = bindJavascriptDigestMac(['SHA-256', 'HMAC-SHA256']); }
     catch { selected = null; }
-    return readS3(effect, {
-      s3, signal: execution.signal, requestBudget: execution.requestBudget, registerRedactionValue: execution.registerRedactionValue,
+    const result = await readS3(effect, {
+      s3, signal: execution.signal, responseSignal: options.signal, requestBudget: execution.requestBudget, registerRedactionValue: execution.registerRedactionValue,
       fetchImplementation: options.s3FetchImplementation || options.fetchImplementation, cryptoTarget: 'javascript',
       cryptoVerifier: selected, cryptoRealization: selected && selected.realization
     }, (name) => secretLookup(name, execution));
+    return effect.operation === 'getBody' ? require('@pulse-compute/runtime/host').markOpaqueResponse(result) : result;
   };
 }
 module.exports = { createNodeJavascriptS3 };

package/src/javascript/target-support-policy.js

@@ -10,8 +10,12 @@ function decision(id, status, reasonId, owner, required = true) {
 
 function classifyNodeJavascriptCapability(id, options = {}) {
   const capability = String(id);
+  if (capability === 'request.body.transform') return decision(capability, options.bodyTransform ? 'eligible' : 'blocked', options.bodyTransform ? 'node-body-transform-experimental' : 'node-body-transform-not-configured', 'provider-node');
+  if (capability === 'response.output') return decision(capability, options.generatedOutput ? 'eligible' : 'blocked', options.generatedOutput ? 'node-generated-output-experimental' : 'node-generated-output-not-configured', 'provider-node');
+  if (capability === 'request.body.forward' || capability === 'req.body') return decision(capability,
+    options.bodyForwarding ? 'eligible' : 'blocked', options.bodyForwarding ? 'node-incoming-body-forwarding' : 'node-incoming-body-forwarding-not-configured', 'provider-node');
   if (capability === 'crypto.digestText') return decision(capability, 'eligible', 'node-javascript-crypto-sha256-runtime-builtin', 'provider-node');
-  if (['s3.head', 's3.getText', 's3.putText'].includes(capability)) return decision(capability, 'eligible', 'node-s3-bounded-origin-transport', 'provider-node');
+  if (['s3.head', 's3.getText', 's3.putText', 's3.getBody'].includes(capability)) return decision(capability, 'eligible', 'node-s3-bounded-origin-transport', 'provider-node');
   if (isJavascriptCoreCapability(capability)) {
     return decision(capability, 'eligible', 'node-router-context-parity', 'provider-node');
   }
@@ -41,9 +45,11 @@ function classifyNodeJavascriptCapability(id, options = {}) {
     return decision(capability, 'eligible', 'node-provider-wall-clock-authority', 'provider-node');
   }
   if (
-    capability === 'jwt.verify'
+    capability === 'jwt.sign'
+    || capability === 'jwt.verify'
     || capability === 'jwt.verify.hs256'
     || capability === 'jwt.verify.es256'
+    || capability === 'jwt.verify.rs256'
   ) {
     return decision(capability, 'eligible', 'node-javascript-jwt-crypto-runtime-builtin', 'provider-node');
   }
@@ -77,8 +83,11 @@ function classifyNodeJavascriptCapability(id, options = {}) {
 
 function classifyNodeJavascriptProviderRequirement(id, compilerCapabilities, options = {}) {
   const requirement = String(id);
+  if (requirement === 'request.body.transform') return classifyNodeJavascriptCapability(requirement, options);
+  if (requirement === 'response.output') return classifyNodeJavascriptCapability(requirement, options);
+  if (requirement === 'request.body.forward') return classifyNodeJavascriptCapability(requirement, options);
   if (requirement === 'crypto.digestText') return decision(requirement, 'eligible', 'node-javascript-crypto-sha256-runtime-builtin', 'provider-node');
-  if (['s3.head', 's3.getText', 's3.putText'].includes(requirement)) return decision(requirement, 'eligible', 'node-s3-bounded-origin-transport', 'provider-node');
+  if (['s3.head', 's3.getText', 's3.putText', 's3.getBody'].includes(requirement)) return decision(requirement, 'eligible', 'node-s3-bounded-origin-transport', 'provider-node');
   if (requirement === 'request') {
     const bodyRequired = compilerCapabilities.some((entry) => entry === 'request.json' || entry.startsWith('request.body'));
     return bodyRequired
@@ -106,9 +115,11 @@ function classifyNodeJavascriptProviderRequirement(id, compilerCapabilities, opt
     return decision(requirement, 'eligible', 'node-provider-wall-clock-authority', 'provider-node');
   }
   if (
-    requirement === 'jwt.verify'
+    requirement === 'jwt.sign'
+    || requirement === 'jwt.verify'
     || requirement === 'jwt.verify.hs256'
     || requirement === 'jwt.verify.es256'
+    || requirement === 'jwt.verify.rs256'
   ) {
     return decision(requirement, 'eligible', 'node-javascript-jwt-crypto-runtime-builtin', 'provider-node');
   }

package/src/javascript/target.js

@@ -27,6 +27,11 @@ const NODE_JAVASCRIPT_TARGET_DESCRIPTOR = normalizeJavascriptTargetDescriptor({
       realization: 'runtime-builtin',
       implemented: true,
       status: 'implemented-g3'
+    }, {
+      algorithm: 'RS256',
+      realization: 'runtime-builtin',
+      implemented: true,
+      status: 'implemented-rs256'
     }]
   }),
   commands: { compile: true, inspect: true, doctor: true, build: true, test: true, dev: true }