@pulse-compute/provider-node 1.0.0-beta.5 → 1.0.0-beta.6

package/src/javascript/test-runtime.js

@@ -42,7 +42,10 @@ async function executeNodeJavascriptTestCase(application, testCase, options = {}
     options.networkFetch === true ? globalThis.fetch : undefined,
     { rawResponse: true }
   );
+  const collected = options.generatedOutput ? require('../runtime/generated-output-test.js').collector({ ...options, requestMethod: adapted.request.method }) : undefined;
+  try {
   const response = await executeNodeJavascriptApplication(application, adapted.request, {
+    outputExecution: collected?.outputExecution,
     capabilities: options.capabilities,
     effectAdapter: options.effectAdapter,
     fetchImplementation: fixtureFetch,
@@ -60,7 +63,9 @@ async function executeNodeJavascriptTestCase(application, testCase, options = {}
     kv: testCase.kv || {},
     application: options.application,
     requestHeaders: adapted.headerPairs,
-    maxDurationMs: options.maxDurationMs, requestClock: options.requestClock, requestBudget: options.requestBudget, signal: options.signal,
+    maxDurationMs: options.maxDurationMs, requestClock: options.requestClock, requestBudget: collected?.budget || options.requestBudget, signal: options.signal,
+    bodyForwarding: options.bodyForwarding,
+    bodyTransform: options.bodyTransform,
     maxEffects: options.maxEffects,
     maxRequestBodyBytes: options.maxRequestBodyBytes ?? options.maxBodyBytes ?? testCase.maxBodyBytes,
     maxFetchBodyBytes: options.maxFetchBodyBytes ?? testCase.maxBodyBytes,
@@ -86,7 +91,8 @@ async function executeNodeJavascriptTestCase(application, testCase, options = {}
     }
   });
   const method = String(testCase.request && testCase.request.method || 'GET').toUpperCase();
-  const body = method === 'HEAD' ? '' : Buffer.from(await response.arrayBuffer()).toString('utf8');
+  if (collected?.outputExecution.started) await collected.outputExecution.finish();
+  const body = collected?.outputExecution.started ? collected.body() : method === 'HEAD' ? '' : Buffer.from(await response.arrayBuffer()).toString('utf8');
   return Object.freeze({
     version: NODE_JAVASCRIPT_TEST_RUNTIME_VERSION,
     response: Object.freeze({
@@ -107,6 +113,7 @@ async function executeNodeJavascriptTestCase(application, testCase, options = {}
     }))),
     resolutionOrder: effectSummary ? effectSummary.resolutionOrder : Object.freeze([])
   });
+  } finally { collected?.dispose(); }
 }
 
 module.exports = Object.freeze({

package/src/native/target.js

@@ -30,6 +30,13 @@ const NODE_NATIVE_TARGET_DESCRIPTOR = Object.freeze({
   capabilities: NODE_NATIVE_TARGET_CAPABILITIES,
   keyTypes: Object.freeze(['secret', 'jwk', 'jwks']),
   realizations: Object.freeze([
+    Object.freeze({
+      kind: 'package-native-application',
+      contractId: 'pulse.entities',
+      implementation: 'pulse.package-native-application.v1',
+      implemented: true,
+      automaticFallback: false
+    }),
     Object.freeze({
       kind: 'crypto-composed',
       realization: 'guest-source:pulse-hmac-as',
@@ -55,6 +62,19 @@ const NODE_NATIVE_TARGET_DESCRIPTOR = Object.freeze({
       guestUnitRequired: true,
       portable: true,
       automaticFallback: false
+    }),
+Object.freeze({
+      kind: 'crypto-composed',
+      realization: 'guest-linked:pulse-rs256-bearssl-i31',
+      implementation: 'bearssl.0.6.rsa-i31.sha256.v1',
+      algorithms: Object.freeze(['RS256']),
+      keyTypes: Object.freeze(['jwk', 'jwks']),
+      implemented: true,
+      status: 'implemented-rs256',
+      semanticOwner: '@pulse-compute/crypto',
+      guestUnitRequired: true,
+      portable: true,
+      automaticFallback: false
     })
   ]),
   automaticFallback: false,
@@ -70,6 +90,11 @@ const NODE_NATIVE_TARGET_DESCRIPTOR = Object.freeze({
       realization: 'guest-linked:pulse-es256-rustcrypto-p256',
       implemented: true,
       status: 'implemented-g3'
+    }, {
+      algorithm: 'RS256',
+      realization: 'guest-linked:pulse-rs256-bearssl-i31',
+      implemented: true,
+      status: 'implemented-rs256'
     }]
   }),
   finalWasmPolicy: nodeFinalWasmPolicy

package/src/runtime/body-transform.js

@@ -0,0 +1,87 @@
+'use strict';
+
+const { createIncomingBodyOwnership, PulseRuntimeContractError } = require('@pulse-compute/runtime/host');
+const limits = Object.freeze({ inputBytes: 65536, outputBytes: 262144, expansion: 4, sourceChunkBytes: 65536, readBytes: 4093, textBytes: 4096, reads: 18 });
+const error = (code, message) => new PulseRuntimeContractError(code, message);
+
+function normalizeBodyTransform(value, options) {
+  if (value === undefined) return undefined;
+  if (value !== true || options.generatedOutput !== true || options.bodyForwarding !== undefined
+    || !Number.isInteger(options.maxDurationMs) || options.maxDurationMs < 1 || options.maxDurationMs > 30000) {
+    throw error('PULSE_TRANSFORM_CONFIG_INVALID', 'node.bodyTransform requires generatedOutput and maxDurationMs (1–30000), and excludes bodyForwarding.');
+  }
+  return true;
+}
+
+function createTransformInput(request, options) {
+  try { return admitTransformInput(request, options); }
+  catch (reason) {
+    if (request.body && !request.body.locked) void request.body.cancel(reason).catch(() => {});
+    throw reason;
+  }
+}
+
+function admitTransformInput(request, options) {
+  normalizeBodyTransform(options.bodyTransform, options);
+  const length = request.headers.get('content-length');
+  if (length !== null && (!/^\d+$/.test(length) || !Number.isSafeInteger(Number(length)))) throw error('PULSE_TRANSFORM_HEADERS_INVALID', 'Invalid incoming content length.');
+  if (length !== null && Number(length) > limits.inputBytes) throw error('PULSE_TRANSFORM_INPUT_LIMIT', 'Transform input exceeds 65536 bytes.');
+  // Fatal decoding preserves a BOM as data and carries at most three UTF-8 bytes.
+  const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+  let reader, pending, offset = 0, ended = false, stopped = false, failure, reads = 0;
+  const metrics = { inputBytes: 0, deliveredBytes: 0, maxSourceChunkBytes: 0, maxTextBytes: 0, maxQueuedBytes: 0 };
+  function release() { try { reader?.releaseLock(); } catch (_) {} }
+  function cancel(reason) {
+    if (stopped) return;
+    stopped = true; failure ||= reason; pending = undefined;
+    try { Promise.resolve(reader ? reader.cancel(reason) : request.body?.cancel(reason)).catch(() => {}).finally(release); } catch (_) {}
+  }
+  return createIncomingBodyOwnership({
+    validate() { throw error('PULSE_REQUEST_BODY_OWNERSHIP', 'Transform input cannot be forwarded.'); },
+    forward() { throw error('PULSE_REQUEST_BODY_OWNERSHIP', 'Transform input cannot be forwarded.'); },
+    cancel,
+    async readTextChunk(budget) {
+      if (stopped) throw failure || error('PULSE_TRANSFORM_CLOSED', 'Transform input is closed.');
+      if (++reads > limits.reads) throw error('PULSE_TRANSFORM_READ_LIMIT', 'Transform input permits at most 18 reads, including EOF.');
+      const removeAbort = budget.onAbort(() => cancel(budget.signal.reason));
+      try {
+        budget.check();
+        // Fixed bounded blocks make chunk transforms independent of network fragmentation.
+        const block = new Uint8Array(limits.readBytes);
+        let used = 0;
+        while (used < block.length && !ended) {
+          if (!pending) {
+            if (!request.body) { ended = true; break; }
+            reader ||= request.body.getReader();
+            const next = await budget.race(reader.read());
+            budget.check();
+            if (next.done) { ended = true; release(); break; }
+            if (!(next.value instanceof Uint8Array) || next.value.byteLength > limits.sourceChunkBytes || next.value.buffer.byteLength > limits.sourceChunkBytes) {
+              throw error('PULSE_TRANSFORM_CHUNK_INVALID', 'Transform source chunks and backing allocations must not exceed 65536 bytes.');
+            }
+            metrics.inputBytes += next.value.byteLength;
+            if (metrics.inputBytes > limits.inputBytes) throw error('PULSE_TRANSFORM_INPUT_LIMIT', 'Transform input exceeds 65536 bytes.');
+            pending = next.value; offset = 0;
+            metrics.maxSourceChunkBytes = Math.max(metrics.maxSourceChunkBytes, pending.byteLength);
+            metrics.maxQueuedBytes = Math.max(metrics.maxQueuedBytes, pending.byteLength + block.length + 3);
+          }
+          const count = Math.min(block.length - used, pending.byteLength - offset);
+          block.set(pending.subarray(offset, offset + count), used);
+          used += count; offset += count;
+          if (offset === pending.byteLength) pending = undefined;
+        }
+        let text;
+        try { text = decoder.decode(block.subarray(0, used), { stream: !ended }); }
+        catch (_) { throw error('PULSE_TRANSFORM_UTF8_INVALID', 'Transform input must be valid UTF-8, including its final sequence.'); }
+        const bytes = Buffer.byteLength(text);
+        metrics.deliveredBytes += bytes;
+        metrics.maxTextBytes = Math.max(metrics.maxTextBytes, bytes);
+        options.onBodyTransformObservation?.(Object.freeze({ ...metrics, reads }));
+        return Object.freeze({ done: ended && used === 0 && text.length === 0, text });
+      } catch (reason) { cancel(reason); throw reason; }
+      finally { removeAbort(); }
+    }
+  });
+}
+
+module.exports = { limits, normalizeBodyTransform, createTransformInput };

package/src/runtime/canonical-api-runtime.js

@@ -45,11 +45,13 @@ function providerResponseSpec(spec = {}) {
       streamRef: spec.streamRef
     };
   }
-  const body = Object.prototype.hasOwnProperty.call(spec, 'body') ? spec.body : JSON.stringify(Object.prototype.hasOwnProperty.call(spec, 'value') ? spec.value : {});
+  const textFixture = Object.prototype.hasOwnProperty.call(spec, 'text') && !Object.prototype.hasOwnProperty.call(spec, 'value');
+  const body = Object.prototype.hasOwnProperty.call(spec, 'body') ? spec.body
+    : textFixture ? String(spec.text) : JSON.stringify(Object.prototype.hasOwnProperty.call(spec, 'value') ? spec.value : {});
   return {
     status: Number(Object.prototype.hasOwnProperty.call(spec, 'status') ? spec.status : 200),
     kind: spec.kind || 'text',
-    headers: normalizeHeaders(spec.headers || [['content-type', 'application/json; charset=utf-8']]),
+    headers: normalizeHeaders(spec.headers || [['content-type', textFixture ? 'text/plain; charset=utf-8' : 'application/json; charset=utf-8']]),
     body: typeof body === 'string' || Buffer.isBuffer(body) ? body : JSON.stringify(body)
   };
 }
@@ -134,7 +136,12 @@ function assetContentType(key) {
   })[extension] || 'application/octet-stream';
 }
 
-function assetResponse(payload, stores) {
+function assetResponse(payload, stores, request) {
+  if (payload.embeddedId !== undefined) {
+    const result = require('@pulse-compute/wasm-contracts/assets/contracts').embeddedAssetResponse(payload, request?.headers);
+    const bodyStream = result.bytes === null ? undefined : new ReadableStream({start(controller) { controller.enqueue(result.bytes); controller.close(); }});
+    return {status:result.status,kind:'stream',headers:[...result.headers],...(bodyStream ? {bodyStream} : {})};
+  }
   const storeName = portableRuntimeHost.normalizeKvNamespace(payload.store, {});
   const key = portableRuntimeHost.normalizeKvKey(payload.key, {});
   const store = stores.get(storeName);
@@ -486,6 +493,11 @@ function createNodeProviderAdapter(baseOptions = {}) {
   function kvStoresFor(executionOptions) { return kvReferenceFor(executionOptions).legacyStores(); }
 
   async function dispatchFetch(normalized, executionOptions = {}) {
+    if (normalized.init.bodyMode === 'incoming-request-v1') {
+      const response = await portableRuntimeHost.forwardIncomingBody(normalized.init.body, normalized.parts.url, normalized.init, executionOptions);
+      if (response.body) executionOptions.forwardedBodies?.add(response.body);
+      return { status: response.status, kind: 'stream', headers: responseHeaders(response), bodyStream: response.body };
+    }
     const fetchFixtures = normalizeFetchFixtures(executionOptions.fetches || baseOptions.fetches);
     const providerData = buildProviderBackends(fetchFixtures);
     const fixture = providerData.specs.get(`${normalized.init.method} ${normalized.parts.url}`) || providerData.specs.get(normalized.parts.url);
@@ -528,14 +540,17 @@ function createNodeProviderAdapter(baseOptions = {}) {
     async dispatchEffect(effect, executionOptions = {}) {
       if (effect.kind === 'crypto.digestText') return require('@pulse-compute/crypto/provider').executeTextDigest(effect, executionOptions);
       if (effect.kind === 'time.now') return portableRuntimeHost.readWallTime(baseOptions.wallClock === undefined ? () => Date.now() : baseOptions.wallClock);
-      if (['s3.head', 's3.getText', 's3.putText'].includes(effect.kind)) {
-        return require('./s3-reader.js').readS3(effect, { ...baseOptions, ...executionOptions,
+      if (['s3.head', 's3.getText', 's3.putText', 's3.getBody'].includes(effect.kind)) {
+        const result = await require('./s3-reader.js').readS3(effect, { ...baseOptions, ...executionOptions,
           fetchImplementation: executionOptions.s3FetchImplementation || baseOptions.s3FetchImplementation
             || executionOptions.fetchImplementation || baseOptions.fetchImplementation
         }, (name) => bindingValue(executionOptions, 'secrets', name));
+        if (effect.operation !== 'getBody') return result;
+        if (result.body) executionOptions.registerResponseBody?.(result.body);
+        return { status: result.status, kind: 'stream', headers: [...result.headers], bodyStream: result.body || undefined };
       }
       if (effect.kind === 'fetch') return dispatchFetch(effect, executionOptions);
-      if (effect.kind === 'jwt.verify') return verifyNativeJwt(effect, executionOptions);
+      if (effect.kind === 'jwt.verify' || effect.kind === 'jwt.sign') return verifyNativeJwt(effect, executionOptions);
       if (effect.kind === 'grip.broadcast') {
         const grip = executionOptions.grip || baseOptions.grip || {};
         const broadcast = createNodeJavascriptGripBroadcast({
@@ -581,7 +596,7 @@ function createNodeProviderAdapter(baseOptions = {}) {
         return eventAdapter.acceptOutbound(effect.frame, executionOptions);
       }
       if (effect.kind === 'assets.lookup') {
-        return assetResponse(effect.payload || {}, kvStoresFor(executionOptions));
+        return assetResponse(effect.payload || {}, kvStoresFor(executionOptions), executionOptions.request);
       }
       throw new hostRuntime.CanonicalRuntimeError('ProviderCapabilityError', 'PULSE_PROVIDER_CAPABILITY_UNSUPPORTED', `Node provider does not implement ${effect.kind}.`, { provider: 'node', kind: effect.kind, effectId: effect.id });
     },

package/src/runtime/generated-output-test.js

@@ -0,0 +1,35 @@
+'use strict';
+
+// Explicit finite test-harness collector. HTTP execution never takes this path.
+const { Writable } = require('node:stream');
+const { createRequestBudget, PulseRuntimeContractError } = require('@pulse-compute/runtime/host');
+const { createGeneratedOutput } = require('./generated-output.js');
+
+function collector(options) {
+  const chunks = [], headers = new Map();
+  const response = new Writable({ write(chunk, _encoding, done) { chunks.push(Buffer.from(chunk)); done(); } });
+  response.setHeader = (name, value) => headers.set(name.toLowerCase(), value);
+  response.hasHeader = name => headers.has(name.toLowerCase());
+  const budget = options.requestBudget || createRequestBudget(options);
+  const outputExecution = createGeneratedOutput(response, { ...options, requestBudget: budget });
+  return {
+    outputExecution, budget,
+    body: () => Buffer.concat(chunks).toString('utf8'),
+    headers: () => [...headers],
+    dispose() { outputExecution?.dispose(); if (!options.requestBudget) budget.close(); }
+  };
+}
+
+async function executeNative(native, options, execute) {
+  if (!native.plan.capabilities.some(id => ['response.output', 'request.body.transform'].includes(id)) || options.outputExecution) return execute(native, options);
+  if (!options.outputCollect || !options.generatedOutput) throw new PulseRuntimeContractError('PULSE_OUTPUT_UNAVAILABLE', 'Generated output needs an HTTP writer or an explicit finite test collector.');
+  const collected = collector({ ...options, requestMethod: options.request?.method || 'GET' });
+  try {
+    const result = await execute(native, { ...options, requestBudget: collected.budget, signal: collected.budget.signal, outputExecution: collected.outputExecution });
+    if (!collected.outputExecution.started) return result;
+    await collected.outputExecution.finish();
+    return Object.freeze({ ...result, response: Object.freeze({ ...result.response, body: collected.body(), headers: collected.headers() }) });
+  } finally { collected.dispose(); }
+}
+
+module.exports = { collector, executeNative };

package/src/runtime/generated-output.js

@@ -0,0 +1,167 @@
+'use strict';
+
+const { validateHeaderName, validateHeaderValue } = require('node:http');
+const { PulseRuntimeContractError } = require('@pulse-compute/runtime/host');
+const limits = Object.freeze({ chunkBytes: 16384, writes: 64, totalBytes: 1048576 });
+const error = (code, message) => new PulseRuntimeContractError(code, message);
+
+function normalizeGeneratedOutput(value, duration) {
+  if (value === undefined) return undefined;
+  if (value !== true || !Number.isInteger(duration) || duration < 1 || duration > 30000) {
+    throw error('PULSE_OUTPUT_CONFIG_INVALID', 'node.generatedOutput must be true and requires node.maxDurationMs (1–30000).');
+  }
+  return true;
+}
+
+// One request-owned writer. It never stores a queue of application chunks.
+function createGeneratedOutput(response, options) {
+  if (!options.generatedOutput) return undefined;
+  normalizeGeneratedOutput(options.generatedOutput, options.maxDurationMs);
+  const transform = require('./body-transform.js');
+  transform.normalizeBodyTransform(options.bodyTransform, options);
+  let input, inputBytes = 0, inputDone = false, readStarted = false;
+  const budget = options.requestBudget;
+  if (!budget || budget.deadlineMonotonicMs === undefined) throw error('PULSE_OUTPUT_UNAVAILABLE', 'Generated output requires a shared request deadline.');
+  let phase = 'idle', committed = false, busy = false, bytes = 0, writes = 0, failure, completion;
+  let status = 200, headers = [];
+  const completions = new WeakSet();
+  function cancel(reason) {
+    if (phase === 'finished') return;
+    failure ||= reason || error('PULSE_OUTPUT_CANCELLED', 'Generated output was cancelled.');
+    phase = 'failed';
+    if (committed && !response.destroyed) response.destroy();
+  }
+  const removeAbort = budget.onAbort(() => cancel(budget.signal.reason));
+  function check() { if (failure) throw failure; budget.check(); }
+  function assertEffect() {
+    check();
+    if (phase === 'closing' || phase === 'finished') throw error('PULSE_OUTPUT_CLOSED', 'No effect may run after output.close().');
+  }
+  async function dispatch(effect) {
+    try {
+      assertEffect();
+      if (busy) throw error('PULSE_OUTPUT_OWNERSHIP', 'Generated output allows one awaited write at a time.');
+      busy = true;
+      if (effect.kind === 'output.readTextChunk') {
+        if (!options.bodyTransform || !input) throw error('PULSE_TRANSFORM_UNAVAILABLE', 'Text chunks require configured Node transform input.');
+        if (inputDone) throw error('PULSE_TRANSFORM_CLOSED', 'Transform input has reached EOF.');
+        readStarted = true;
+        const chunk = await input.readTextChunk(budget);
+        check();
+        inputBytes += Buffer.byteLength(chunk.text);
+        inputDone = chunk.done;
+        return chunk;
+      }
+      if (effect.kind === 'output.start') {
+        if (phase !== 'idle') throw error('PULSE_OUTPUT_OWNERSHIP', 'Generated output may start once.');
+        const init = effect.argument0 || {};
+        if (typeof init !== 'object' || Array.isArray(init) || Object.keys(init).some(key => !['status', 'headers'].includes(key))) {
+          throw error('PULSE_OUTPUT_OPTIONS_INVALID', 'Generated output accepts only status and headers.');
+        }
+        status = init.status === undefined ? 200 : init.status;
+        if (!Number.isInteger(status) || status < 200 || status > 599 || [204, 205, 304].includes(status)
+          || String(options.requestMethod).toUpperCase() === 'HEAD') {
+          throw error('PULSE_OUTPUT_BODYLESS', 'Generated output requires a response that permits a body.');
+        }
+        headers = Array.isArray(init.headers) ? init.headers : Object.entries(init.headers || {});
+        if (headers.length > 64) throw error('PULSE_OUTPUT_LIMIT_EXCEEDED', 'Too many generated output headers.');
+        let headerBytes = 0;
+        headers = headers.map(pair => {
+          if (!Array.isArray(pair) || pair.length !== 2 || pair.some(value => typeof value !== 'string')) throw error('PULSE_OUTPUT_OPTIONS_INVALID', 'Headers must be string pairs.');
+          const [name, value] = pair;
+          validateHeaderName(name); validateHeaderValue(name, value);
+          if (['content-length', 'transfer-encoding', 'connection', 'keep-alive', 'upgrade', 'trailer', 'te', 'host', 'proxy-connection'].includes(name.toLowerCase())) {
+            throw error('PULSE_OUTPUT_OPTIONS_INVALID', 'Generated output forbids framing and hop-by-hop headers.');
+          }
+          headerBytes += Buffer.byteLength(name) + Buffer.byteLength(value);
+          if (headerBytes > 16384) throw error('PULSE_OUTPUT_LIMIT_EXCEEDED', 'Generated output headers exceed 16 KiB.');
+          return Object.freeze([name, value]);
+        });
+        check();
+        response.statusCode = status;
+        for (const [name, value] of headers) response.setHeader(name, value);
+        if (!response.hasHeader?.('content-type')) response.setHeader('content-type', 'text/plain; charset=utf-8');
+        phase = 'open'; committed = true;
+        response.flushHeaders?.();
+        return undefined;
+      }
+      if (effect.kind !== 'output.write' || phase !== 'open') throw error('PULSE_OUTPUT_OWNERSHIP', 'Call output.start() before output.write().');
+      const text = effect.argument0;
+      if (typeof text !== 'string') throw error('PULSE_OUTPUT_CHUNK_INVALID', 'Generated output writes require text.');
+      // Bound before UTF-8 allocation; byte length remains authoritative.
+      if (text.length > limits.chunkBytes) throw error('PULSE_OUTPUT_LIMIT_EXCEEDED', 'Generated output chunk exceeds 16 KiB.');
+      const length = Buffer.byteLength(text);
+      if (length > limits.chunkBytes || writes === limits.writes || length > limits.totalBytes - bytes) throw error('PULSE_OUTPUT_LIMIT_EXCEEDED', 'Generated output exceeded its chunk, write-count or total-byte limit.');
+      if (options.bodyTransform && (bytes + length > transform.limits.outputBytes || bytes + length > inputBytes * transform.limits.expansion)) {
+        throw error('PULSE_TRANSFORM_OUTPUT_LIMIT', 'Transform output exceeds 262144 bytes or four times delivered input bytes.');
+      }
+      writes++; bytes += length;
+      await waitForWrite(Buffer.from(text));
+      check();
+    } catch (reason) { cancel(reason); throw failure; }
+    finally { busy = false; }
+  }
+  function waitForWrite(chunk) {
+    return budget.race(new Promise((resolve, reject) => {
+      let callbackDone = false, drained = false, returned = false, settled = false;
+      const cleanup = () => { response.removeListener('error', fail); response.removeListener('close', closed); response.removeListener('drain', drain); budget.signal.removeEventListener('abort', aborted); };
+      const fail = reason => { if (settled) return; settled = true; cleanup(); reject(reason); };
+      const done = () => { if (returned && callbackDone && drained && !settled) { settled = true; cleanup(); resolve(); } };
+      const closed = () => fail(error('PULSE_OUTPUT_CANCELLED', 'Output writer closed before completion.'));
+      const aborted = () => fail(budget.signal.reason);
+      const drain = () => { drained = true; done(); };
+      response.once('error', fail); response.once('close', closed); response.on('drain', drain); budget.signal.addEventListener('abort', aborted, { once: true });
+      try {
+        check();
+        const accepted = response.write(chunk, reason => { if (reason) fail(reason); else { callbackDone = true; done(); } });
+        drained ||= accepted; returned = true; done();
+      } catch (reason) { fail(reason); }
+    }));
+  }
+  return Object.freeze({
+    dispatch, assertEffect, cancel,
+    bindInput(value) {
+      if (!options.bodyTransform) return;
+      if (input && input !== value) throw error('PULSE_REQUEST_BODY_OWNERSHIP', 'Transform input is already bound.');
+      input = value;
+    },
+    get started() { return phase !== 'idle'; },
+    get finished() { return phase === 'finished'; },
+    close(factory) {
+      try {
+        check();
+        if (phase !== 'open' || busy) throw error('PULSE_OUTPUT_OWNERSHIP', 'Return output.close() after all writes settle.');
+        if (options.bodyTransform && !inputDone) throw error('PULSE_TRANSFORM_EOF_REQUIRED', 'Read transform input through EOF before output.close().');
+        phase = 'closing';
+        completion = factory ? factory({ status, headers }) : Object.freeze({ status, headers, kind: 'text', bodyClass: 'structured', body: '' });
+        completions.add(completion);
+        return completion;
+      } catch (reason) { cancel(reason); throw failure; }
+    },
+    validateResult(result) {
+      check();
+      if ((phase !== 'idle' || readStarted) && (phase !== 'closing' || !completions.has(result))) throw error('PULSE_OUTPUT_CLOSE_REQUIRED', 'A generated-output handler must return its output.close() result.');
+    },
+    async finish() {
+      if (phase === 'idle') return;
+      try {
+        check();
+        if (phase !== 'closing') throw error('PULSE_OUTPUT_CLOSE_REQUIRED', 'Generated output did not close.');
+        await budget.race(new Promise((resolve, reject) => {
+          const cleanup = () => { response.removeListener('finish', done); response.removeListener('error', fail); response.removeListener('close', closed); budget.signal.removeEventListener('abort', aborted); };
+          const done = () => { cleanup(); resolve(); };
+          const fail = reason => { cleanup(); reject(reason); };
+          const closed = () => { if (!response.writableFinished) fail(error('PULSE_OUTPUT_CANCELLED', 'Output closed before finish.')); };
+          const aborted = () => fail(budget.signal.reason);
+          response.once('finish', done); response.once('error', fail); response.once('close', closed); budget.signal.addEventListener('abort', aborted, { once: true });
+          try { check(); response.end(); } catch (reason) { fail(reason); }
+        }));
+        check(); phase = 'finished';
+      } catch (reason) { cancel(reason); throw failure; }
+    },
+    dispose() { removeAbort(); if (!['idle', 'finished'].includes(phase)) cancel(); },
+    snapshot() { return Object.freeze({ phase, bytes, writes, ...(options.bodyTransform ? { inputBytes, inputDone, expansionRatio: inputBytes ? bytes / inputBytes : 0 } : {}) }); }
+  });
+}
+
+module.exports = { limits, normalizeGeneratedOutput, createGeneratedOutput };

package/src/runtime/incoming-body.js

@@ -0,0 +1,63 @@
+'use strict';
+
+const host = require('@pulse-compute/runtime/host');
+const { createIncomingBody } = require('../javascript/incoming-body.js');
+const { createNodeJavascriptFixtureFetch } = require('../javascript/fetch-adapter.js');
+const { nodeRequestToWebRequest } = require('../javascript/node-adapter.js');
+
+function forwardingOptions(options) {
+  return {
+    ...options,
+    fetchImplementation: createNodeJavascriptFixtureFetch(options.fetches || {},
+      options.fetchImplementation || (options.liveFetch === true ? globalThis.fetch : undefined), { rawResponse: true })
+  };
+}
+
+async function prepareNativeRequest(request, options) {
+  const adapted = await nodeRequestToWebRequest(request, options);
+  let incomingBody;
+  try {
+    incomingBody = createIncomingBody(adapted.request, {
+      ...forwardingOptions(options), responseWriterOwnsCompletion: true
+    });
+  } catch (error) {
+    if (adapted.request.body && !adapted.request.body.locked) void adapted.request.body.cancel(error).catch(() => {});
+    throw error;
+  }
+  return Object.freeze({
+    request: { method: adapted.method, url: adapted.request.url, headers: adapted.headerPairs },
+    options: { incomingBody },
+    get signal() { return incomingBody.responseSignal || options.signal; },
+    close() { return incomingBody.close(); }
+  });
+}
+
+async function executeNativeWithIncomingBody(native, options) {
+  const { executeCanonicalNativeModule } = require('@pulse-compute/wasm-host-runtime/runtime/canonical-native-host');
+  if (!options.bodyTransform && !native.plan.capabilities.includes('request.body.forward')) return executeCanonicalNativeModule(native, options);
+  if (!options.bodyForwarding && !options.bodyTransform) throw new host.PulseRuntimeContractError('PULSE_REQUEST_FORWARDING_UNAVAILABLE', 'Node Native forwarding requires node.bodyForwarding.');
+  const forwardedBodies = new Set();
+  let incomingBody = options.incomingBody, result;
+  if (!incomingBody) {
+    const input = options.request || {};
+    const method = input.method || 'GET';
+    const request = new Request(input.url || 'http://pulse.local' + (input.path || '/'), {
+      method, headers: input.headers,
+      ...(!['GET','HEAD'].includes(method) && input.body !== undefined ? {body:input.body,duplex:'half'} : {})
+    });
+    incomingBody = createIncomingBody(request, forwardingOptions(options));
+  }
+  try {
+    options.outputExecution?.bindInput(incomingBody);
+    result = await executeCanonicalNativeModule(native, { ...options, incomingBody, forwardedBodies });
+    if (incomingBody.failure) throw incomingBody.failure;
+    return result;
+  } finally {
+    for (const body of forwardedBodies) if (body !== result?.response.bodyStream) {
+      try { void body.cancel().catch(() => {}); } catch (_) {}
+    }
+    if (!options.incomingBody) await incomingBody.close();
+  }
+}
+
+module.exports = { prepareNativeRequest, executeNativeWithIncomingBody };

package/src/runtime/jwt-verifier.js

@@ -2,12 +2,15 @@
 
 const {
   CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION,
+  CRYPTO_RS256_GUEST_LINKED_IMPLEMENTATION, CRYPTO_RS256_GUEST_LINKED_REALIZATION,
   CRYPTO_ES256_GUEST_LINKED_REALIZATION,
   CRYPTO_GUEST_SOURCE_IMPLEMENTATION
 } = require('@pulse-compute/wasm-contracts/crypto/contracts');
 
 const NODE_NATIVE_JWT_VERIFIER_VERSION = 'pulse.node-native-jwt-verifier.v1';
 const NODE_NATIVE_JWT_REALIZATIONS = Object.freeze({
+  'HMAC-SHA256': Object.freeze({ algorithm: 'HMAC-SHA256', realization: 'guest-source:pulse-hmac-as',
+    implementation: CRYPTO_GUEST_SOURCE_IMPLEMENTATION, guestUnitRequired: false }),
   HS256: Object.freeze({
     algorithm: 'HS256',
     realization: 'guest-source:pulse-hmac-as',
@@ -19,6 +22,12 @@ const NODE_NATIVE_JWT_REALIZATIONS = Object.freeze({
     realization: CRYPTO_ES256_GUEST_LINKED_REALIZATION,
     implementation: CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION,
     guestUnitRequired: true
+  }),
+  RS256: Object.freeze({
+    algorithm: 'RS256',
+    realization: CRYPTO_RS256_GUEST_LINKED_REALIZATION,
+    implementation: CRYPTO_RS256_GUEST_LINKED_IMPLEMENTATION,
+    guestUnitRequired: true
   })
 });
 const NODE_NATIVE_JWT_REALIZATION = Object.freeze({
@@ -122,10 +131,10 @@ function keyArtifact(executionOptions, artifactId, jwtProvider) {
   const data = artifact && dataRecord(artifact.get('data'));
   if (
     !artifact
-    || artifact.get('version') !== 'pulse.jwt-es256-key-artifact.v1'
+    || !['pulse.jwt-es256-key-artifact.v1', 'pulse.jwt-rs256-key-artifact.v1'].includes(artifact.get('version'))
     || artifact.get('contractId') !== 'pulse.jwt'
     || artifact.get('package') !== '@pulse-compute/jwt'
-    || artifact.get('kind') !== 'jwt-es256-static-public-key'
+    || !['jwt-es256-static-public-key', 'jwt-rs256-static-public-key'].includes(artifact.get('kind'))
     || !data
   ) {
     throw jwtProvider.jwtError('PULSE_JWT_KEY_INVALID', {
@@ -205,11 +214,23 @@ function createNodeNativeJwtVerify(baseOptions = {}) {
   return async function verifyNodeNativeJwt(effect, executionOptions = {}) {
     const jwtProvider = await loadJwtProvider();
     requestActive(executionOptions, jwtProvider);
-    const input = effectInput(effect, executionOptions, jwtProvider);
+    const signing = effect.kind === 'jwt.sign';
+    let input;
+    if (signing) {
+      const resource = dataRecord(effect.resource), payload = dataRecord(effect.payload);
+      if (effect.contractId !== 'pulse.jwt' || effect.package !== '@pulse-compute/jwt'
+        || effect.operation !== 'sign' || effect.capability !== 'jwt.sign'
+        || !resource || resource.size !== 3 || resource.get('keyType') !== 'secret'
+        || resource.get('keyArtifactId') !== null || !payload || ![3, 4].includes(payload.size) || [...payload.keys()].some(name => !['claims', 'algorithm', 'expiresInSeconds', 'kid'].includes(name))) {
+        throw jwtProvider.jwtError('PULSE_JWT_OPERATION_FAILED', { category: 'sign-input' });
+      }
+      input = { claims: payload.get('claims'), options: { algorithm: payload.get('algorithm'),
+        expiresInSeconds: payload.get('expiresInSeconds'), key: { type: 'secret', binding: resource.get('secretBinding') }, ...(payload.has('kid') ? { kid: payload.get('kid') } : {}) } };
+    } else input = effectInput(effect, executionOptions, jwtProvider);
     const selectedCrypto = requireCryptoVerifier(
       executionOptions,
       jwtProvider,
-      input.options.algorithms[0]
+      signing ? (input.options.algorithm === 'HS256' ? 'HMAC-SHA256' : input.options.algorithm) : input.options.algorithms[0]
     );
     const execution = dataRecord(executionOptions);
     const executionClock = execution && execution.get('captureJwtWallClock');
@@ -246,7 +267,7 @@ function createNodeNativeJwtVerify(baseOptions = {}) {
         return result;
       };
     }
-    const result = await jwtProvider.verifyJwtWithCrypto(
+    const result = await (signing ? jwtProvider.signJwtWithCrypto : jwtProvider.verifyJwtWithCrypto)(
       input,
       Object.freeze(host),
       selectedCrypto