@pulse-compute/runtime 1.0.0-beta.4 → 1.0.0-beta.5

package/README.md

@@ -7,9 +7,9 @@
 > **Supported entry points:** `@pulse-compute/runtime`<br>
 > **Stability:** Supported application authoring and execution contract.<br>
 > **npm:** [`@pulse-compute/runtime`](https://www.npmjs.com/package/@pulse-compute/runtime)<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.4/packages/runtime/)
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.5/packages/runtime/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.4` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.5` package policy.
 <!-- pulse-package-status:end -->
 
 `@pulse-compute/runtime` is the low-level, provider-neutral Pulse application contract.

package/docs/API.md

@@ -1,11 +1,11 @@
 # Pulse runtime contract
 
 For source eligibility, use [Managed handler TypeScript and
-JavaScript](https://pulsecompute.io/v1.0.0-beta.4/reference/handler-authoring/). For provider and target
+JavaScript](https://pulsecompute.io/v1.0.0-beta.5/reference/handler-authoring/). For provider and target
 differences, use the [compatibility
-matrix](https://pulsecompute.io/v1.0.0-beta.4/reference/compatibility-matrix/). For CLI and runtime failures,
+matrix](https://pulsecompute.io/v1.0.0-beta.5/reference/compatibility-matrix/). For CLI and runtime failures,
 use the stable codes in the [diagnostics
-reference](https://pulsecompute.io/v1.0.0-beta.4/reference/diagnostics/).
+reference](https://pulsecompute.io/v1.0.0-beta.5/reference/diagnostics/).
 
 This document describes the provider-neutral TypeScript application contract compiled by Pulse. Low-level authoring types and the static `Router` come from `@pulse-compute/runtime`. The public `@pulse-compute/pulse` package owns the conventional `Pulse` application root, deferred project configuration, and schema declarations, while `@pulse-compute/cli` owns workspace orchestration.
 
@@ -25,9 +25,11 @@ process, provider SDK, or global network surface behind it.
 | [`ctx.req.header(name)`](#request-metadata-and-headers) | HTTP handlers and middleware | Case-insensitive first-value header lookup. |
 | [`ctx.param(name)`](#ctxparam) | Matched route handlers | Named parameters from the static route pattern. |
 | [`ctx.state`](#ctxstate) | HTTP and event handlers | Invocation-local string state shared across one execution. |
+| [`ctx.time.now()`](#ctxtime) | HTTP and event handlers | Provider wall-clock sample with matching Unix milliseconds and UTC text. |
 | [`ctx.fetch`](#ctxfetch) | HTTP and event handlers | Explicit outbound HTTP effect and structured or opaque response ownership. |
 | [`ctx.parallel`](#ctxparallel) | HTTP and event handlers | Statically keyed concurrent Pulse effects. |
 | [`ctx.encodeJson`](#ctxencodejson) | HTTP and event handlers | Synchronous schema-bound, size-limited JSON text. |
+| [`ctx.decodeJson`](#ctxdecodejson) | HTTP and event handlers | Synchronous schema-bound decode of bounded application text. |
 | [`ctx.emit`](#ctxemit) | HTTP and event handlers | One-way, schema-bound event acceptance effect. |
 | [`ctx.log`](#ctxlog) | HTTP and event handlers | Synchronous thresholded logging. |
 | [`ctx.config`, `ctx.secret`](#config-and-secrets) | HTTP and event handlers | Explicit configured binding reads. |
@@ -50,7 +52,7 @@ Every managed handler is async-shaped:
 type Handler = (ctx: PulseContext) => Promise<PulseResult | PulseFetchResponse>
 ```
 
-For native targets the compiler erases the async wrapper. Awaited Pulse effects lower into the existing explicit effect and continuation state machine; no Promise runtime or Asyncify transform is linked. Awaiting a proven synchronous `ctx` expression is redundant and may warn, while arbitrary non-Pulse awaits mark the native eligibility boundary. The canonical [handler authoring reference](https://pulsecompute.io/v1.0.0-beta.4/reference/handler-authoring/) defines the static language subset; the [compatibility matrix](https://pulsecompute.io/v1.0.0-beta.4/reference/compatibility-matrix/) owns the tested four-mode claims.
+For native targets the compiler erases the async wrapper. Awaited Pulse effects lower into the existing explicit effect and continuation state machine; no Promise runtime or Asyncify transform is linked. Awaiting a proven synchronous `ctx` expression is redundant and may warn, while arbitrary non-Pulse awaits mark the native eligibility boundary. The canonical [handler authoring reference](https://pulsecompute.io/v1.0.0-beta.5/reference/handler-authoring/) defines the static language subset; the [compatibility matrix](https://pulsecompute.io/v1.0.0-beta.5/reference/compatibility-matrix/) owns the tested four-mode claims.
 
 ## Static `Router`
 
@@ -138,9 +140,9 @@ eligibility. Fastly targets fail closed because no event ingress/emit adapter is
 claimed. There is no public event injection command, no event-aware development
 listener, no HTTP/GRIP translation, and no automatic target fallback.
 
-The [static events guide](https://pulsecompute.io/v1.0.0-beta.4/guides/events/) owns the complete frame,
+The [static events guide](https://pulsecompute.io/v1.0.0-beta.5/guides/events/) owns the complete frame,
 queue, target-eligibility, diagnostic, and Native-extension contract. The
-source-bound [event example](https://pulsecompute.io/v1.0.0-beta.4/examples/11-events/) runs the same mixed project
+source-bound [event example](https://pulsecompute.io/v1.0.0-beta.5/examples/11-events/) runs the same mixed project
 on Node JavaScript and Node Native.
 
 ## `ctx.req`
@@ -382,6 +384,16 @@ return ctx.json(output, {
 })
 ```
 
+## `ctx.time`
+
+`await ctx.time.now()` returns one provider-owned wall-clock sample. On success,
+`status` is `'ok'`, `unixEpochMs` is integer Unix milliseconds and `iso8601` is
+its matching UTC string. A failed sample has `status: 'failed'` and reason
+`'unavailable'` or `'invalid-clock'`. Direct awaited calls and keyed parallel
+members are supported on Node/Fastly Native and JavaScript. Wall time can regress
+and is separate from monotonic deadlines and exact commit timestamps. See the
+[complete result contract](https://pulsecompute.io/v1.0.0-beta.5/packages/runtime/#wall-time).
+
 ## Config and secrets
 
 ```ts
@@ -453,7 +465,20 @@ projects the value, then returns detached JSON text bounded by `schemas.maxBytes
 in UTF-8 bytes. It does not create a response or dispatch an effect. Invalid
 values and oversized text fail before subsequent writes. Declaration order and
 array order are preserved; cross-target parity is semantic, not a universal
-canonical-byte format. See [application-owned encoding](https://pulsecompute.io/v1.0.0-beta.4/guides/json-schemas/#encode-application-owned-text).
+canonical-byte format. See [application-owned encoding](https://pulsecompute.io/v1.0.0-beta.5/guides/json-schemas/#encode-application-owned-text).
+
+## `ctx.decodeJson`
+
+```ts
+const candidate = ctx.decodeJson<Candidate>(stored.text, 'app.Candidate')
+```
+
+Requires a literal registered schema even in non-strict mode. The input must
+be a string within `schemas.maxBytes` UTF-8 bytes. Decoding returns a detached,
+deeply immutable value with declared fields only. It performs no effect and
+does not apply HTTP content-type policy. Keep the original text for hashing,
+verification and retries; decoding does not establish byte canonicalization or
+storage acceptance. See [application text decoding](https://pulsecompute.io/v1.0.0-beta.5/guides/json-schemas/#decode-application-owned-text).
 
 ## Explicit JSON schemas
 
@@ -496,12 +521,12 @@ forms lower into canonical package operations; JavaScript targets execute the
 real package implementation.
 
 Older `/pulsewasm` imports are compatibility-only and are isolated in the
-[migration guide](https://pulsecompute.io/v1.0.0-beta.4/guides/compatibility-imports/). See the
-[GRIP package guide](https://pulsecompute.io/v1.0.0-beta.4/packages/grip/) for the complete current surface.
+[migration guide](https://pulsecompute.io/v1.0.0-beta.5/guides/compatibility-imports/). See the
+[GRIP package guide](https://pulsecompute.io/v1.0.0-beta.5/packages/grip/) for the complete current surface.
 
 ## Entities API
 
-`@pulse-compute/entities` is part of the synchronized `1.0.0-beta.4` package
+`@pulse-compute/entities` is part of the synchronized `1.0.0-beta.5` package
 set. The application surface has two runtime values:
 
 ```ts
@@ -563,9 +588,9 @@ Registrations and the terminal binding must use the supported static form. The
 first-party JSON-RPC adapter accepts bounded JSON-RPC 2.0 request objects and
 named params, validates declared schemas, uses stable error framing, and
 acknowledges notifications with HTTP `204`. See the [package
-guide](https://pulsecompute.io/v1.0.0-beta.4/packages/entities/), [entity/adapter
-model](https://pulsecompute.io/v1.0.0-beta.4/concepts/entities-and-adapters/), and [executable
-example](https://pulsecompute.io/v1.0.0-beta.4/examples/10-entities-tools/).
+guide](https://pulsecompute.io/v1.0.0-beta.5/packages/entities/), [entity/adapter
+model](https://pulsecompute.io/v1.0.0-beta.5/concepts/entities-and-adapters/), and [executable
+example](https://pulsecompute.io/v1.0.0-beta.5/examples/10-entities-tools/).
 
 ## Project workflow
 
@@ -582,5 +607,5 @@ selected profile, handler entry, schema declarations, provider bindings, and
 output directory through `.pulse/config.ts`. `pulse inspect` is optional
 observability, and `pulse compile` is the advanced provider-neutral Native
 artifact command; neither is required before `pulse build`. See the [project
-lifecycle guide](https://pulsecompute.io/v1.0.0-beta.4/guides/project-lifecycle/) and [CLI
-reference](https://pulsecompute.io/v1.0.0-beta.4/reference/cli/).
+lifecycle guide](https://pulsecompute.io/v1.0.0-beta.5/guides/project-lifecycle/) and [CLI
+reference](https://pulsecompute.io/v1.0.0-beta.5/reference/cli/).

package/docs/guides/routing.md

@@ -1,6 +1,6 @@
 # Static Router authoring
 
-Use `Router` when an application has several method/path entry points or needs compile-time middleware. It is a static authoring marker from `@pulse-compute/runtime`, not a JavaScript runtime dispatcher. The shared async/static restrictions are defined in [Managed handler TypeScript and JavaScript](https://pulsecompute.io/v1.0.0-beta.4/reference/handler-authoring/); target claims live in the [compatibility matrix](https://pulsecompute.io/v1.0.0-beta.4/reference/compatibility-matrix/).
+Use `Router` when an application has several method/path entry points or needs compile-time middleware. It is a static authoring marker from `@pulse-compute/runtime`, not a JavaScript runtime dispatcher. The shared async/static restrictions are defined in [Managed handler TypeScript and JavaScript](https://pulsecompute.io/v1.0.0-beta.5/reference/handler-authoring/); target claims live in the [compatibility matrix](https://pulsecompute.io/v1.0.0-beta.5/reference/compatibility-matrix/).
 
 <!-- pulse-doc-source: examples/09-router-lowering/src/index.ts -->
 ```ts
@@ -146,6 +146,34 @@ app.error(async (error, ctx, next) => {
 
 If the normal lane is exhausted, Pulse returns `404 Not Found`. If the error lane is exhausted, Pulse returns `500 Internal Server Error`.
 
+Request UTF-8 failures, schema data failures and JWT validation failures enter the next registered
+error handler. Branch on `error.code`; the portable contract does not require
+identical messages, stacks, causes or detail fields across providers.
+
+| Boundary | Portable error codes |
+| --- | --- |
+| Request text encoding | `PULSE_REQUEST_BODY_INVALID_UTF8` (Node Native, Node JavaScript, Fastly Native) |
+| Schema data | `PULSE_SCHEMA_DECODE`, `PULSE_SCHEMA_ENCODE`, `PULSE_SCHEMA_JSON_MALFORMED`, `PULSE_SCHEMA_CONTENT_TYPE`, `PULSE_BODY_TOO_LARGE` |
+| JWT input and verification | `PULSE_JWT_TOKEN_REQUIRED`, `PULSE_JWT_BEARER_INVALID`, `PULSE_JWT_MALFORMED`, `PULSE_JWT_LIMIT_EXCEEDED`, `PULSE_JWT_ALGORITHM_NOT_ALLOWED`, `PULSE_JWT_KEY_INVALID`, `PULSE_JWT_SIGNATURE_INVALID` |
+| JWT claims | `PULSE_JWT_CLOCK_INVALID`, `PULSE_JWT_CLAIMS_INVALID`, `PULSE_JWT_CLAIMS_SCHEMA_INVALID` |
+
+Recovery moves forward in registration order, including through mounted
+routers. A failed handler never resumes. An error handler can return a response,
+forward with `return next(error)`, or clear the error lane with `return next()`.
+A data failure inside an error handler transfers to a later error handler.
+
+Already-started members of a failed effect group settle before application
+recovery. Pulse does not retry them, undo completed writes, or imply that a
+failed invocation had no external effects. Conditional KV results such as
+`conflict`, `not-stored` and `unknown` remain ordinary outcomes for the handler to
+inspect. Their meaning does not change when an error handler is registered.
+
+Cancellation ends the invocation without an application response. On Native,
+traps, provider protocol failures and unavailable capabilities remain terminal; they
+do not acquire recovery or rollback guarantees. Native authoring still does not
+admit arbitrary `throw` or `try`/`catch`. JavaScript retains its existing
+`PulseUnhandledError` containment for unexpected handler failures.
+
 ## Middleware scope and effects
 
 A path-scoped `use('/api', handler)` applies only to that subtree. Middleware declared on a mounted child Router is naturally limited to the mounted subtree.

package/docs/preview-scope.md

@@ -1,6 +1,6 @@
 # Beta scope
 
-Pulse `1.0.0-beta.4` is a Beta of one provider-neutral application contract
+Pulse `1.0.0-beta.5` is a Beta of one provider-neutral application contract
 with explicit Native and JavaScript execution targets. The intended 1.0
 surface is present, but deliberate corrections may still occur before the
 stable `1.0.0` release.
@@ -18,6 +18,8 @@ targets.
   middleware, GET/HEAD/POST/PUT/PATCH/DELETE routes, exact paths, named parameters, trailing
   wildcards, and acyclic mounts.
 - Basic branching and structured object, array, and scalar manipulation.
+- Literal-capped pure `for` loops and zero-argument string `.trim()` across
+  Native and JavaScript; see [bounded application values](https://pulsecompute.io/v1.0.0-beta.5/concepts/compilation-and-lowering/#bounded-application-values).
 - Request method, URL, path, headers, text, and JSON access.
 - Bounded, memoized structured body decoding.
 - Explicit TypeScript JSON schema declarations and literal schema IDs.
@@ -75,6 +77,9 @@ JavaScript-selected project into a Native one.
 
 ## Deliberately unsupported
 
+- Effectful or unbounded loops, arbitrary callback transformations, and Native
+  pure-helper calls. Pure loop bodies cannot transfer from the handler.
+
 - Automatic fallback from Native lowering to JavaScript execution.
 - Declaring general target availability without satisfying every declared
   full-target-support gate.
@@ -106,13 +111,13 @@ JavaScript-selected project into a Native one.
 ## Compatibility authority
 
 The single source-form, provider-binding, artifact, and deployment-boundary
-table is [Provider and target compatibility](https://pulsecompute.io/v1.0.0-beta.4/reference/compatibility-matrix/).
+table is [Provider and target compatibility](https://pulsecompute.io/v1.0.0-beta.5/reference/compatibility-matrix/).
 It uses one public target order—Node JavaScript, Fastly JavaScript, Node Native,
 and Fastly Native—and links every row to a focused proof or canonical contract.
 
 The exact portable language subset and the JavaScript-only Native eligibility
 boundaries are defined in
-[Managed handler TypeScript and JavaScript](https://pulsecompute.io/v1.0.0-beta.4/reference/handler-authoring/).
+[Managed handler TypeScript and JavaScript](https://pulsecompute.io/v1.0.0-beta.5/reference/handler-authoring/).
 
 ## Body model
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-compute/runtime",
-  "version": "1.0.0-beta.4",
+  "version": "1.0.0-beta.5",
   "license": "Apache-2.0",
   "engines": {
     "node": "^22.14.0 || ^24.0.0"
@@ -41,7 +41,7 @@
     "url": "git+https://github.com/pulse-compute/pulse.git",
     "directory": "packages/runtime"
   },
-  "homepage": "https://pulsecompute.io/v1.0.0-beta.4/packages/runtime/",
+  "homepage": "https://pulsecompute.io/v1.0.0-beta.5/packages/runtime/",
   "bugs": {
     "url": "https://github.com/pulse-compute/pulse/issues"
   }

package/src/host.d.ts

@@ -1,5 +1,6 @@
 import type {
   Handler,
+  PulseTimeResult,
   PulseEffect,
   PulseKvGeneration, PulseKvVersionedResult, PulseKvConditionalResult,
   PulseFetchResponse,
@@ -16,6 +17,8 @@ export interface PulseJavascriptEffectHostExecution {
   readonly application?: unknown;
   readonly signal?: AbortSignal;
   readonly deadlineMonotonicMs?: number;
+  /** Host-only request authority; package transports recheck before dispatch. */
+  readonly requestBudget?: PulseRequestBudget;
   /** Adds execution-owned sensitive text to runtime redaction before provider work continues. */
   registerRedactionValue(value: string | Uint8Array): void;
   /** Applies one project-owned schema codec directly to an in-memory semantic value. */
@@ -112,6 +115,7 @@ export interface PulseRuntimeHostKvNamespace<T = unknown> {
 /** Compatibility injection shape retained while providers move to one effect adapter. */
 export interface PulseRuntimeHostCapabilities {
   prepareConditionalKv?: PulseConditionalKvPreparation;
+  time?(execution?: PulseJavascriptEffectHostExecution): PulseTimeResult | Promise<PulseTimeResult>;
   fetch?(
     url: string,
     init?: unknown,
@@ -199,7 +203,32 @@ export interface PulseJavascriptEffectExecution {
   close(): Promise<void>;
 }
 
+export interface PulseRequestBudget {
+  readonly signal: AbortSignal;
+  readonly deadlineMonotonicMs?: number;
+  readonly clock: PulseKvClock;
+  check(): void;
+  onAbort(callback: () => void): () => void;
+  remainingMs(): number;
+  race<T>(value: T | PromiseLike<T>): Promise<T>;
+  close(): void;
+}
+export declare function normalizeRequestDuration(value?: number): number | undefined;
+export declare function createRequestBudget(options?: {
+  maxDurationMs?: number;
+  requestBudget?: PulseRequestBudget;
+  requestClock?: PulseKvClock;
+  signal?: AbortSignal;
+  requestSignal?: AbortSignal;
+}): PulseRequestBudget;
+
 export interface PulseRuntimeExecutionOptions {
+  /** Provider-owned total managed request budget, 1..30000 ms. Omitted preserves existing behavior. */
+  readonly maxDurationMs?: number;
+  /** Shared host budget; nested adapters must not restart or close an inherited budget. */
+  readonly requestBudget?: PulseRequestBudget;
+  /** Monotonic host clock/scheduler, never application wall time. */
+  readonly requestClock?: PulseKvClock;
   /** Host-only monotonic clock/scheduler injection for deterministic lifecycle evidence. */
   readonly kvClock?: PulseKvClock;
   /** Host monotonic deadline; conditional KV uses the earlier of this and 10 seconds. */
@@ -418,3 +447,10 @@ export declare function admitConditionalKv(input: Readonly<Record<string, unknow
 export declare function normalizeConditionalKvResult(effect: Readonly<{ kind: string }>, value: unknown, options?: PulseBindingValueLimits): PulseKvVersionedResult<unknown> | PulseKvConditionalResult;
 export declare function executeConditionalKv(effect: Readonly<Record<string, unknown>>, prepare: PulseConditionalKvPreparation, execution?: PulseConditionalKvExecution, options?: PulseRuntimeExecutionOptions): Promise<PulseKvVersionedResult<unknown> | PulseKvConditionalResult>;
 export declare function registerKvRedactions(effect: Readonly<Record<string, unknown>>, register?: (value: string) => void): void;
+/** Whether a data failure can transfer to the next Router error handler. */
+export declare function isApplicationError(error: unknown): boolean;
+
+/** Host-only wall-clock result contract; the callback samples integer Unix milliseconds. */
+export declare const WALL_TIME_MAX_MS: 253402300799999;
+export declare function readWallTime(clock?: (() => number) | null): PulseTimeResult;
+export declare function normalizeTimeResult(value: unknown): PulseTimeResult;

package/src/host.js

@@ -78,6 +78,9 @@ async function executeApplication(application, request, options = {}) {
 }
 
 module.exports = Object.freeze({
+  ...require('./internal/time.js'),
+  ...require('./internal/request-budget.js'),
+  isApplicationError: require('./internal/errors.js').isApplicationError,
   ...require('./internal/conditional-kv.js'),
   RUNTIME_HOST_API_VERSION,
   JAVASCRIPT_EFFECT_PROTOCOL_VERSION,

package/src/index.d.ts

@@ -133,10 +133,19 @@ export type PulseEmitEvent<Payload = unknown> =
   | Readonly<{ schema: string; payload: Payload }>
   | Readonly<{ schema: null; payload?: never }>;
 
+/** One provider wall-clock sample. This is neither monotonic nor a commit timestamp. */
+export type PulseTimeResult =
+  | { readonly status: 'ok'; readonly unixEpochMs: number; readonly iso8601: string }
+  | { readonly status: 'failed'; readonly reason: 'unavailable' | 'invalid-clock' };
+
 /** Plane-neutral authority shared by one isolated HTTP request or event invocation. */
 export interface PulseExecutionContext {
   /** Validate/project a value through a literal registered schema and return bounded JSON text. */
   encodeJson(value: unknown, schemaId: string): string;
+  /** Decode bounded application-owned JSON text through a literal registered schema. */
+  decodeJson<T = unknown>(text: string, schemaId: string): T;
+  /** Fresh sample at dispatch, UTC 1970–9999, integer Unix milliseconds. */
+  readonly time: { now(): PulseParallelEffect<PulseTimeResult> };
   readonly state: PulseState;
   readonly log: PulseLogger;
   fetch(url: string, init?: PulseFetchInit): PulseFetchOperation;

package/src/internal/body.js

@@ -206,7 +206,13 @@ function createStructuredBodyReader(owner, options = {}) {
 
   function text() {
     assertInspectable();
-    if (!textPromise) textPromise = bytes().then((value) => new TextDecoder().decode(value));
+    if (!textPromise) textPromise = bytes().then((value) => {
+      if (label !== 'request') return new TextDecoder().decode(value);
+      try { return new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(value); }
+      catch (cause) {
+        throw bodyError('PULSE_REQUEST_BODY_INVALID_UTF8', 'Pulse request text must be well-formed UTF-8.', {}, cause);
+      }
+    });
     return textPromise;
   }
 

package/src/internal/context.js

@@ -161,6 +161,10 @@ function createContext(frame) {
       const id = requireExplicitSchemaId(schemaId, options, 'application-value');
       return encodeSchemaValue(id, value, options, { source: 'application-value' }).text;
     },
+    decodeJson(text, schemaId) {
+      const id = requireExplicitSchemaId(schemaId, options, 'application-text');
+      return decodeSchemaText(id, text, options, { source: 'application-text' });
+    },
     ...(eventContext ? {} : { req }),
     state,
     log,
@@ -183,6 +187,12 @@ function createContext(frame) {
       });
       return createFetchOperation(effects, fetchEffect, fetchRequest, options, effectId);
     },
+    time: Object.freeze({
+      now(...args) {
+        if (args.length) throw new TypeError('Pulse time.now takes no arguments.');
+        return effects.dispatch({ kind: 'time.now', providerKind: 'time', operation: 'now', capability: 'time.wall-clock' });
+      }
+    }),
     parallel(record) { return effects.parallel(record); },
     config: Object.freeze({
       get(name) {

package/src/internal/effect-adapter.js

@@ -9,6 +9,7 @@ const {
   normalizeKvNamespace,
   normalizeKvPutResult
 } = require('./bindings.js');
+const { normalizeTimeResult, readWallTime } = require('./time.js');
 const conditionalKv = require('./conditional-kv.js');
 const { fetchRequestInitForHost } = require('./fetch.js');
 const { createRedactionState } = require('./redaction.js');
@@ -244,6 +245,7 @@ function createCapabilityEffectAdapter(capabilities = {}) {
         if (typeof value.fetch !== 'function') return unavailableCapability(effect);
         return value.fetch(effect.url, fetchRequestInitForHost(effect.init, execution.signal), execution);
       }
+      if (effect.kind === 'time.now') return typeof value.time === 'function' ? value.time(execution) : readWallTime();
       if (effect.kind === 'config.get') {
         if (typeof value.config !== 'function') return unavailableCapability(effect);
         return value.config(effect.name, execution);
@@ -305,6 +307,7 @@ function normalizeEffectDescriptor(input, limits) {
 }
 
 function normalizeEffectResult(descriptor, value, limits) {
+  if (descriptor.kind === 'time.now') return normalizeTimeResult(value);
   if (descriptor.kind === 'config.get' || descriptor.kind === 'secret.get') {
     return normalizeBindingValue(descriptor.kind, descriptor.name, value, limits);
   }
@@ -490,6 +493,8 @@ function createJavascriptEffectExecution(options = {}) {
     event: options.event,
     application: options.application,
     signal: lifecycleController.signal,
+    deadlineMonotonicMs: options.deadlineMonotonicMs,
+    requestBudget: options.requestBudget,
     registerRedactionValue(value) {
       if (typeof value === 'string' && value.length > 0) redaction.add(value);
     },
@@ -541,6 +546,7 @@ function createJavascriptEffectExecution(options = {}) {
         'Pulse effect execution is already closed.'
       );
     }
+    options.requestBudget?.check();
   }
 
   function trackEffect(effect, data) {
@@ -597,20 +603,29 @@ function createJavascriptEffectExecution(options = {}) {
       const operationSignal = createEffectSignal(lifecycleController.signal, descriptor);
       const operationExecution = Object.freeze({ ...externalExecution, signal: operationSignal.signal });
       const raw = raceWithSignal(Promise.resolve().then(() => {
+        options.requestBudget?.check();
         if (operationSignal.signal.aborted) throw abortedEffectError(operationSignal.signal.reason);
         if (conditionalKv.isConditionalKv(kind)) return conditionalKv.executeConditionalKv(descriptor,
           adapter.prepareConditionalKv || ((_admitted, kvExecution) => () => adapter.dispatch(descriptor, kvExecution)),
           { ...operationExecution, onKvObservation: observe }, limits);
-        return adapter.dispatch(descriptor, operationExecution);
+        return Promise.resolve(adapter.dispatch(descriptor, operationExecution)).then(value => {
+          if (value instanceof Response && value.body && options.requestBudget) {
+            options.requestBudget.onAbort(() => {
+              if (!value.body.locked) void value.body.cancel(options.requestBudget.signal.reason).catch(() => {});
+            });
+          }
+          return value;
+        });
       }), operationSignal.signal).then(
         (value) => {
+          options.requestBudget?.check();
           const normalized = normalizeEffectResult(descriptor, value, limits);
           if (descriptor.kind === 'secret.get' && typeof normalized === 'string') redaction.add(normalized);
           return normalized;
         },
         (error) => { throw redaction.redactError(error); }
       ).finally(operationSignal.dispose);
-      const projected = (typeof projector === 'function' ? raw.then(projector) : raw).catch((error) => {
+      const projected = (typeof projector === 'function' ? raw.then(value => { options.requestBudget?.check(); return projector(value); }).then(value => { options.requestBudget?.check(); return value; }) : raw).catch((error) => {
         throw redaction.redactError(error);
       });
       const effectData = {
@@ -672,9 +687,10 @@ function createJavascriptEffectExecution(options = {}) {
       const publicDescriptor = publicEffectDescriptor(descriptor, redaction);
       observe({ type: 'effect-dispatched', effect: publicDescriptor });
       const promise = Promise.resolve().then(() => {
+        options.requestBudget?.check();
         if (lifecycleController.signal.aborted) throw abortedEffectError(lifecycleController.signal.reason);
         return producer(externalExecution);
-      }).catch((error) => { throw redaction.redactError(error); });
+      }).then(value => { options.requestBudget?.check(); return value; }).catch((error) => { throw redaction.redactError(error); });
       const effectData = {
         execution,
         id,
@@ -711,7 +727,7 @@ function createJavascriptEffectExecution(options = {}) {
             : 'Pulse effect projections require a request-owned Pulse effect.'
         );
       }
-      const projected = raceWithSignal(parent.then(projector), lifecycleController.signal).catch((error) => {
+      const projected = raceWithSignal(parent.then(value => { options.requestBudget?.check(); return projector(value); }).then(value => { options.requestBudget?.check(); return value; }), lifecycleController.signal).catch((error) => {
         throw redaction.redactError(error);
       });
       const effectData = {

package/src/internal/errors.js

@@ -24,4 +24,32 @@ class PulseUnhandledError extends Error {
   }
 }
 
-module.exports = Object.freeze({ PulseRuntimeContractError, PulseUnhandledError });
+// Data failures admitted to the Router error lane. Configuration, provider
+// protocol failures and VM traps are deliberately outside this catalog.
+const APPLICATION_ERROR_CODES = new Set([
+  'PULSE_SCHEMA_DECODE', 'PULSE_SCHEMA_ENCODE',
+  'PULSE_SCHEMA_JSON_MALFORMED', 'PULSE_SCHEMA_CONTENT_TYPE',
+  'PULSE_BODY_TOO_LARGE', 'PULSE_REQUEST_BODY_INVALID_UTF8',
+  'PULSE_JWT_TOKEN_REQUIRED', 'PULSE_JWT_BEARER_INVALID',
+  'PULSE_JWT_MALFORMED', 'PULSE_JWT_LIMIT_EXCEEDED',
+  'PULSE_JWT_ALGORITHM_NOT_ALLOWED', 'PULSE_JWT_KEY_INVALID',
+  'PULSE_JWT_SIGNATURE_INVALID', 'PULSE_JWT_CLAIMS_INVALID',
+  'PULSE_JWT_CLAIMS_SCHEMA_INVALID', 'PULSE_JWT_CLOCK_INVALID'
+]);
+
+function isApplicationError(error) {
+  if (!(error instanceof Error)) return false;
+  const code = Object.getOwnPropertyDescriptor(error, 'code')?.value;
+  if (!APPLICATION_ERROR_CODES.has(code)) return false;
+  const seen = new Set();
+  for (let cause = error; cause instanceof Error; cause = Object.getOwnPropertyDescriptor(cause, 'cause')?.value) {
+    if (seen.has(cause)) return false;
+    seen.add(cause);
+    if (cause instanceof WebAssembly.RuntimeError
+      || Object.getOwnPropertyDescriptor(cause, 'code')?.value === 'PULSE_CANONICAL_NATIVE_AS_ABORT'
+      || Object.getOwnPropertyDescriptor(cause, 'name')?.value === 'AbortError') return false;
+  }
+  return true;
+}
+
+module.exports = Object.freeze({ PulseRuntimeContractError, PulseUnhandledError, isApplicationError });

package/src/internal/package-runtime.js

@@ -10,12 +10,20 @@ const {
 const PACKAGE_RUNTIME_BRIDGE_VERSION = 'pulse.package-runtime-bridge.v1';
 const PACKAGE_SCHEMA_CODEC_BRIDGE_VERSION = 'pulse.first-party-embedded-schema-codec-bridge.v1';
 const DEFAULT_MAX_PAYLOAD_BYTES = 256 * 1024;
+// Fixed first-party text operations alone admit 2 MiB plus worst-case JSON
+// escaping and 64 KiB metadata. Other package operations retain their bounds.
+const TEXT_MAX_PAYLOAD_BYTES = 6 * 2097152 + 65536;
 const DEFAULT_MAX_PAYLOAD_DEPTH = 32;
 const DEFAULT_MAX_PAYLOAD_ENTRIES = 4096;
 
 const PACKAGE_CONTEXTS = new WeakMap();
 
 const TRUSTED_PACKAGE_EFFECT_CATALOG = Object.freeze({
+  '@pulse-compute/crypto': Object.freeze({
+    contractId: 'pulse.crypto', providerKind: 'crypto', operations: Object.freeze({
+      digestText: Object.freeze({ kind: 'crypto.digestText', capability: 'crypto.digestText', result: 'text-digest-result' })
+    })
+  }),
   '@pulse-compute/s3': Object.freeze({
     contractId: 'pulse.s3', providerKind: 's3', operations: Object.freeze({
       head: Object.freeze({ kind: 's3.head', capability: 's3.head', result: 's3-head-result' }),
@@ -586,7 +594,10 @@ function createPackageRuntime(input) {
         operation,
         capability: declared.capability,
         result: declared.result,
-        payload: clonePackageEffectPayload(payload)
+        payload: clonePackageEffectPayload(payload, {
+          maxBytes: declared.kind === 'crypto.digestText' || declared.kind === 's3.putText'
+            ? TEXT_MAX_PAYLOAD_BYTES : DEFAULT_MAX_PAYLOAD_BYTES
+        })
       }, projector);
     }
   });

package/src/internal/redaction.js

@@ -121,9 +121,12 @@ function createRedactionState(initialValues = []) {
         : redactValue(descriptor.value, key, seen, depth + 1);
       Object.defineProperty(output, outputKey, {
         enumerable: true,
-        configurable: false,
+        // Different private keys can redact to the same spelling. Their value
+        // association is lost, so collapse the collision to a redacted marker.
+        // Properties remain replaceable only until the completed record freezes.
+        configurable: true,
         writable: false,
-        value: outputValue
+        value: Object.prototype.hasOwnProperty.call(output, outputKey) ? REDACTED_VALUE : outputValue
       });
     }
     return Object.freeze(output);

package/src/internal/request-budget.js

@@ -0,0 +1,100 @@
+'use strict';
+
+const { PulseRuntimeContractError } = require('./errors.js');
+const budgets = new WeakSet();
+
+function normalizeRequestDuration(value) {
+  if (value === undefined) return undefined;
+  if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 1 || value > 30000) {
+    throw new PulseRuntimeContractError('PULSE_REQUEST_DURATION_INVALID', 'Request maxDurationMs must be an integer from 1 through 30000.');
+  }
+  return value;
+}
+
+// Host-only authority. One budget is passed through adapters; nested calls must
+// never restart it. Wall time and inbound headers are deliberately not inputs.
+function createRequestBudget(options = {}) {
+  if (options.requestBudget !== undefined) {
+    if (!budgets.has(options.requestBudget)) throw new TypeError('Invalid host request budget.');
+    return options.requestBudget;
+  }
+  const duration = normalizeRequestDuration(options.maxDurationMs);
+  const clock = options.requestClock || {
+    now: () => performance.now(),
+    setTimeout: (callback, ms) => setTimeout(callback, ms),
+    clearTimeout: handle => clearTimeout(handle)
+  };
+  const controller = new AbortController();
+  let timer, closed = false, last = -Infinity;
+  const read = () => {
+    let value;
+    try { value = clock.now(); } catch (_) { value = NaN; }
+    if (!Number.isFinite(value) || value < last) {
+      controller.abort(new PulseRuntimeContractError('PULSE_REQUEST_CLOCK_INVALID', 'Request monotonic clock failed or regressed.'));
+      controller.signal.throwIfAborted();
+    }
+    last = value;
+    return value;
+  };
+  const deadline = duration === undefined ? undefined : read() + duration;
+  const expire = () => controller.abort(new PulseRuntimeContractError('PULSE_REQUEST_DEADLINE_EXCEEDED', 'Pulse request exceeded its total execution deadline.'));
+  const signals = [...new Set([options.signal, options.requestSignal].filter(Boolean))];
+  const listeners = signals.map(signal => {
+    const abort = () => controller.abort(signal.reason);
+    if (signal.aborted) abort();
+    else signal.addEventListener('abort', abort, { once: true });
+    return () => signal.removeEventListener('abort', abort);
+  });
+  const budget = Object.freeze({
+    signal: controller.signal,
+    deadlineMonotonicMs: deadline,
+    clock,
+    check() {
+      if (closed) throw new PulseRuntimeContractError('PULSE_REQUEST_EXECUTION_CLOSED', 'Pulse request execution is closed.');
+      if (!controller.signal.aborted && deadline !== undefined && read() >= deadline) expire();
+      controller.signal.throwIfAborted();
+    },
+    onAbort(callback) {
+      if (controller.signal.aborted || closed) { callback(); return () => {}; }
+      const remove = () => controller.signal.removeEventListener('abort', callback);
+      listeners.push(remove);
+      controller.signal.addEventListener('abort', callback, { once: true });
+      return remove;
+    },
+    remainingMs() { budget.check(); return deadline === undefined ? Infinity : Math.max(0, deadline - last); },
+    race(value) {
+      // Always observe the pending work, including an already-expired request.
+      const pending = Promise.resolve(value);
+      return new Promise((resolve, reject) => {
+        const abort = () => { cleanup(); reject(controller.signal.reason); };
+        controller.signal.addEventListener('abort', abort, { once: true });
+        const cleanup = () => controller.signal.removeEventListener('abort', abort);
+        pending.then(result => {
+          cleanup();
+          try { budget.check(); resolve(result); } catch (error) { reject(error); }
+        }, error => { cleanup(); reject(error); });
+        try { budget.check(); } catch (error) { cleanup(); reject(error); }
+      });
+    },
+    close() {
+      if (closed) return;
+      closed = true;
+      if (timer !== undefined) clock.clearTimeout(timer);
+      for (const remove of listeners) remove();
+      listeners.length = 0;
+    }
+  });
+  budgets.add(budget);
+  if (deadline !== undefined && !controller.signal.aborted) {
+    const schedule = () => {
+      try {
+        budget.check();
+        timer = clock.setTimeout(schedule, budget.remainingMs());
+      } catch (_) { /* check has already revoked execution authority */ }
+    };
+    timer = clock.setTimeout(schedule, duration);
+  }
+  return budget;
+}
+
+module.exports = { createRequestBudget, normalizeRequestDuration };

package/src/internal/router.js

@@ -1,9 +1,11 @@
 'use strict';
+const { createRequestBudget } = require('./request-budget.js');
 
 const { compileRoutePath, matchRoutePath, normalizeRoutePath } = require('./path.js');
 const { createContext, createRequestView } = require('./context.js');
 const { createJavascriptEffectExecution } = require('./effect-adapter.js');
 const { reportingLevel } = require('./logging.js');
+const { isApplicationError } = require('./errors.js');
 const {
   PulseRuntimeContractError,
   PulseUnhandledError,
@@ -159,7 +161,7 @@ function redactedError(frame, error) {
 
 function containUnexpected(error, frame) {
   const safe = redactedError(frame, error);
-  return safe instanceof PulseUnhandledError ? safe : new PulseUnhandledError(safe);
+  return isApplicationError(error) || safe instanceof PulseUnhandledError ? safe : new PulseUnhandledError(safe);
 }
 
 function contractError(code, message) {
@@ -192,6 +194,7 @@ async function dispatchRouter(router, frame, startIndex, activeError) {
   let error = activeError;
 
   while (index < entries.length) {
+    frame.signal?.throwIfAborted();
     const current = entries[index];
 
     if (error !== NO_ERROR) {
@@ -300,6 +303,7 @@ async function runNormalHandler(_router, frame, index, handler, routeContext) {
   } catch (error) {
     if (handlerError === undefined) handlerError = error;
   }
+  frame.signal?.throwIfAborted();
   if (handlerError !== undefined) {
     return Object.freeze({ kind: 'continue', index: index + 1, error: containUnexpected(handlerError, frame), frame });
   }
@@ -353,6 +357,7 @@ async function runErrorHandler(_router, frame, index, activeError, handler) {
   } catch (error) {
     if (handlerError === undefined) handlerError = error;
   }
+  frame.signal?.throwIfAborted();
   if (handlerError !== undefined) {
     return Object.freeze({ kind: 'continue', index: index + 1, error: containUnexpected(handlerError, frame), frame });
   }
@@ -409,52 +414,60 @@ async function executeRouter(router, request, options = {}) {
       // Logging evidence is best effort.
     }
   }
-  const executionSignal = options.signal || request.signal;
-  const effectExecution = createJavascriptEffectExecution({
-    effectAdapter: options.effectAdapter,
-    capabilities: options.capabilities,
-    application: options.application,
-    request,
-    executionKind: 'request',
-    signal: executionSignal,
-    maxEffects: options.maxEffects,
-    kvClock: options.kvClock, deadlineMonotonicMs: options.deadlineMonotonicMs,
-    maxBindingNameBytes: options.maxBindingNameBytes,
-    maxBindingValueBytes: options.maxBindingValueBytes,
-    maxKvNamespaceBytes: options.maxKvNamespaceBytes,
-    maxKvKeyBytes: options.maxKvKeyBytes,
-    maxKvValueBytes: options.maxKvValueBytes,
-    maxKvValueDepth: options.maxKvValueDepth,
-    maxKvValueEntries: options.maxKvValueEntries,
-    schemaCodecs: options.schemaCodecs,
-    strict: options.strict,
-    target: options.target,
-    provider: options.provider,
-    redactionValues: options.redactionValues,
-    onEffectObservation: options.onEffectObservation
-  });
-  const req = createRequestView(request, options.requestHeaders, effectExecution, {
-    ...options,
-    signal: executionSignal,
-    redactJsonTraceValue(value) { return effectExecution.redactValue(value); }
-  });
-  const executionOptions = Object.freeze({
-    ...options,
-    signal: executionSignal,
-    redactJsonTraceValue(value) { return effectExecution.redactValue(value); }
-  });
-  const frame = {
-    request,
-    req,
-    relativePath: normalizeRoutePath(req.path),
-    params: Object.freeze({}),
-    state: new Map(),
-    effectExecution,
-    signal: executionSignal,
-    executionOptions
-  };
+  const ownsBudget = options.requestBudget === undefined;
+  const budget = createRequestBudget({ ...options, requestSignal: request.signal });
+  options = { ...options, requestBudget: budget, signal: budget.signal, deadlineMonotonicMs: budget.deadlineMonotonicMs ?? options.deadlineMonotonicMs, kvClock: budget.deadlineMonotonicMs === undefined ? options.kvClock : budget.clock };
+  const executionSignal = budget.signal;
+  let effectExecution;
   try {
-    const result = await dispatchRouter(router, frame, 0, NO_ERROR);
+    budget.check();
+    effectExecution = createJavascriptEffectExecution({
+      effectAdapter: options.effectAdapter,
+      capabilities: options.capabilities,
+      application: options.application,
+      request,
+      executionKind: 'request',
+      signal: executionSignal,
+      requestBudget: budget,
+      maxEffects: options.maxEffects,
+      kvClock: options.kvClock, deadlineMonotonicMs: options.deadlineMonotonicMs,
+      maxBindingNameBytes: options.maxBindingNameBytes,
+      maxBindingValueBytes: options.maxBindingValueBytes,
+      maxKvNamespaceBytes: options.maxKvNamespaceBytes,
+      maxKvKeyBytes: options.maxKvKeyBytes,
+      maxKvValueBytes: options.maxKvValueBytes,
+      maxKvValueDepth: options.maxKvValueDepth,
+      maxKvValueEntries: options.maxKvValueEntries,
+      schemaCodecs: options.schemaCodecs,
+      strict: options.strict,
+      target: options.target,
+      provider: options.provider,
+      redactionValues: options.redactionValues,
+      onEffectObservation: options.onEffectObservation
+    });
+    const req = createRequestView(request, options.requestHeaders, effectExecution, {
+      ...options,
+      signal: executionSignal,
+      redactJsonTraceValue(value) { return effectExecution.redactValue(value); }
+    });
+    const executionOptions = Object.freeze({
+      ...options,
+      signal: executionSignal,
+      redactJsonTraceValue(value) { return effectExecution.redactValue(value); }
+    });
+    const frame = {
+      request,
+      req,
+      relativePath: normalizeRoutePath(req.path),
+      params: Object.freeze({}),
+      state: new Map(),
+      effectExecution,
+      signal: executionSignal,
+      executionOptions
+    };
+    budget.check();
+    const result = await budget.race(dispatchRouter(router, frame, 0, NO_ERROR));
+    executionSignal?.throwIfAborted();
     if (result.kind === 'response') return result.response;
     if (result.error !== NO_ERROR) {
       return new Response('Internal Server Error', {
@@ -468,9 +481,10 @@ async function executeRouter(router, request, options = {}) {
     });
   } finally {
     try {
-      await effectExecution.close();
+      await effectExecution?.close();
     } finally {
-      if (typeof options.onEffectSummary === 'function') options.onEffectSummary(effectExecution.summary());
+      if (ownsBudget) budget.close();
+      if (effectExecution && typeof options.onEffectSummary === 'function') options.onEffectSummary(effectExecution.summary());
     }
   }
 }

package/src/internal/schema.js

@@ -187,6 +187,7 @@ function emitSchemaTrace(options, event, value) {
 
 function decodeSchemaText(schemaId, text, options = {}, context = {}) {
   const source = String(context.source || 'json');
+  const applicationText = source === 'application-text';
   const id = requireSchemaId(schemaId, options, source);
   if (id === undefined) {
     try {
@@ -197,24 +198,28 @@ function decodeSchemaText(schemaId, text, options = {}, context = {}) {
   }
   let contentType = normalizeContentType(headerValue(context.headers, 'content-type'));
   const event = {
-    boundary: source === 'request' ? 'request' : 'fetch-response',
+    boundary: applicationText ? source : source === 'request' ? 'request' : 'fetch-response',
     schemaId: id,
     responseCaseId: null,
     operationId: String(context.operationId || `${source}:${id}`),
     status: context.status ?? null,
     headers: context.headers || [],
-    bodyOwnership: source === 'request' ? 'request-snapshot' : 'fetched-response-snapshot',
+    bodyOwnership: applicationText ? 'application-owned' : source === 'request' ? 'request-snapshot' : 'fetched-response-snapshot',
     effectId: context.effectId || null,
     groupId: context.groupId || null
   };
   try {
-    contentType = assertSchemaContentType(options, context.headers, id, source);
+    if (applicationText && typeof text !== 'string') {
+      throw schemaRuntimeError('PULSE_SCHEMA_DECODE', 'Application JSON text must be a string.',
+        { schemaId: id, source, expected: 'string', actualKind: typeof text });
+    }
+    if (!applicationText) contentType = assertSchemaContentType(options, context.headers, id, source);
     assertSchemaBodySize(options, text, id, source);
     const codecs = requireSchemaCodecs(options, id, source);
     const value = codecs.decodeJsonText(id, String(text), source);
     emitSchemaTrace(options, {
       ...event,
-      kind: source === 'request' ? 'json.decode.request' : 'json.decode.fetch',
+      kind: applicationText ? 'json.decode.text' : source === 'request' ? 'json.decode.request' : 'json.decode.fetch',
       contentType: contentType || null
     }, value);
     return value;

package/src/internal/time.js

@@ -0,0 +1,41 @@
+'use strict';
+
+const { PulseRuntimeContractError } = require('./errors.js');
+
+// UTC years 1970–9999; integer milliseconds remain exactly representable.
+const WALL_TIME_MAX_MS = 253402300799999;
+const unavailable = Object.freeze({ status: 'failed', reason: 'unavailable' });
+const invalid = Object.freeze({ status: 'failed', reason: 'invalid-clock' });
+
+function validMilliseconds(value) {
+  return Number.isSafeInteger(value) && value >= 0 && value <= WALL_TIME_MAX_MS;
+}
+
+/** The provider supplies the clock. Formatting never samples ambient time. */
+function readWallTime(clock) {
+  if (typeof clock !== 'function') return unavailable;
+  let value;
+  try { value = clock(); } catch { return unavailable; }
+  if (!validMilliseconds(value)) return invalid;
+  return Object.freeze({ status: 'ok', unixEpochMs: value === 0 ? 0 : value, iso8601: new Date(value).toISOString() });
+}
+
+/** Validate and detach a trusted adapter result before guest/application use. */
+function normalizeTimeResult(input) {
+  const fail = () => { throw new PulseRuntimeContractError('PULSE_TIME_RESULT_INVALID', 'Pulse time provider returned an invalid result.'); };
+  if (!input || typeof input !== 'object' || ![Object.prototype, null].includes(Object.getPrototypeOf(input))) return fail();
+  const properties = Object.getOwnPropertyDescriptors(input);
+  const keys = Reflect.ownKeys(properties);
+  if (keys.some(key => typeof key !== 'string' || !Object.hasOwn(properties[key], 'value'))) return fail();
+  const status = properties.status?.value;
+  if (status === 'failed' && keys.length === 2 && properties.reason
+    && ['unavailable', 'invalid-clock'].includes(properties.reason.value)) {
+    return properties.reason.value === 'unavailable' ? unavailable : invalid;
+  }
+  const ms = properties.unixEpochMs?.value;
+  if (status !== 'ok' || keys.length !== 3 || !validMilliseconds(ms)
+    || properties.iso8601?.value !== new Date(ms).toISOString()) return fail();
+  return Object.freeze({ status: 'ok', unixEpochMs: ms === 0 ? 0 : ms, iso8601: properties.iso8601.value });
+}
+
+module.exports = Object.freeze({ WALL_TIME_MAX_MS, readWallTime, normalizeTimeResult });