@pulse-compute/runtime 1.0.0-beta.4 → 1.0.0-beta.6

package/README.md

@@ -7,9 +7,9 @@
 > **Supported entry points:** `@pulse-compute/runtime`<br>
 > **Stability:** Supported application authoring and execution contract.<br>
 > **npm:** [`@pulse-compute/runtime`](https://www.npmjs.com/package/@pulse-compute/runtime)<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.4/packages/runtime/)
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.6/packages/runtime/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.4` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.6` package policy.
 <!-- pulse-package-status:end -->
 
 `@pulse-compute/runtime` is the low-level, provider-neutral Pulse application contract.

package/docs/API.md

@@ -1,17 +1,17 @@
 # Pulse runtime contract
 
 For source eligibility, use [Managed handler TypeScript and
-JavaScript](https://pulsecompute.io/v1.0.0-beta.4/reference/handler-authoring/). For provider and target
+JavaScript](https://pulsecompute.io/v1.0.0-beta.6/reference/handler-authoring/). For provider and target
 differences, use the [compatibility
-matrix](https://pulsecompute.io/v1.0.0-beta.4/reference/compatibility-matrix/). For CLI and runtime failures,
+matrix](https://pulsecompute.io/v1.0.0-beta.6/reference/compatibility-matrix/). For CLI and runtime failures,
 use the stable codes in the [diagnostics
-reference](https://pulsecompute.io/v1.0.0-beta.4/reference/diagnostics/).
+reference](https://pulsecompute.io/v1.0.0-beta.6/reference/diagnostics/).
 
 This document describes the provider-neutral TypeScript application contract compiled by Pulse. Low-level authoring types and the static `Router` come from `@pulse-compute/runtime`. The public `@pulse-compute/pulse` package owns the conventional `Pulse` application root, deferred project configuration, and schema declarations, while `@pulse-compute/cli` owns workspace orchestration.
 
 `@pulse-compute/runtime` is the low-level portable application surface and
 `@pulse-compute/pulse` is the conventional project surface. Both belong to the
-14-package public release catalog. Native and JavaScript execution remain
+19-package public release catalog. Native and JavaScript execution remain
 explicitly selected targets over the same canonical runtime contract.
 
 ## Context at a glance
@@ -25,9 +25,11 @@ process, provider SDK, or global network surface behind it.
 | [`ctx.req.header(name)`](#request-metadata-and-headers) | HTTP handlers and middleware | Case-insensitive first-value header lookup. |
 | [`ctx.param(name)`](#ctxparam) | Matched route handlers | Named parameters from the static route pattern. |
 | [`ctx.state`](#ctxstate) | HTTP and event handlers | Invocation-local string state shared across one execution. |
+| [`ctx.time.now()`](#ctxtime) | HTTP and event handlers | Provider wall-clock sample with matching Unix milliseconds and UTC text. |
 | [`ctx.fetch`](#ctxfetch) | HTTP and event handlers | Explicit outbound HTTP effect and structured or opaque response ownership. |
 | [`ctx.parallel`](#ctxparallel) | HTTP and event handlers | Statically keyed concurrent Pulse effects. |
 | [`ctx.encodeJson`](#ctxencodejson) | HTTP and event handlers | Synchronous schema-bound, size-limited JSON text. |
+| [`ctx.decodeJson`](#ctxdecodejson) | HTTP and event handlers | Synchronous schema-bound decode of bounded application text. |
 | [`ctx.emit`](#ctxemit) | HTTP and event handlers | One-way, schema-bound event acceptance effect. |
 | [`ctx.log`](#ctxlog) | HTTP and event handlers | Synchronous thresholded logging. |
 | [`ctx.config`, `ctx.secret`](#config-and-secrets) | HTTP and event handlers | Explicit configured binding reads. |
@@ -50,7 +52,7 @@ Every managed handler is async-shaped:
 type Handler = (ctx: PulseContext) => Promise<PulseResult | PulseFetchResponse>
 ```
 
-For native targets the compiler erases the async wrapper. Awaited Pulse effects lower into the existing explicit effect and continuation state machine; no Promise runtime or Asyncify transform is linked. Awaiting a proven synchronous `ctx` expression is redundant and may warn, while arbitrary non-Pulse awaits mark the native eligibility boundary. The canonical [handler authoring reference](https://pulsecompute.io/v1.0.0-beta.4/reference/handler-authoring/) defines the static language subset; the [compatibility matrix](https://pulsecompute.io/v1.0.0-beta.4/reference/compatibility-matrix/) owns the tested four-mode claims.
+For native targets the compiler erases the async wrapper. Awaited Pulse effects lower into the existing explicit effect and continuation state machine; no Promise runtime or Asyncify transform is linked. Awaiting a proven synchronous `ctx` expression is redundant and may warn, while arbitrary non-Pulse awaits mark the native eligibility boundary. The canonical [handler authoring reference](https://pulsecompute.io/v1.0.0-beta.6/reference/handler-authoring/) defines the static language subset; the [compatibility matrix](https://pulsecompute.io/v1.0.0-beta.6/reference/compatibility-matrix/) owns the tested four-mode claims.
 
 ## Static `Router`
 
@@ -138,9 +140,9 @@ eligibility. Fastly targets fail closed because no event ingress/emit adapter is
 claimed. There is no public event injection command, no event-aware development
 listener, no HTTP/GRIP translation, and no automatic target fallback.
 
-The [static events guide](https://pulsecompute.io/v1.0.0-beta.4/guides/events/) owns the complete frame,
+The [static events guide](https://pulsecompute.io/v1.0.0-beta.6/guides/events/) owns the complete frame,
 queue, target-eligibility, diagnostic, and Native-extension contract. The
-source-bound [event example](https://pulsecompute.io/v1.0.0-beta.4/examples/11-events/) runs the same mixed project
+source-bound [event example](https://pulsecompute.io/v1.0.0-beta.6/examples/11-events/) runs the same mixed project
 on Node JavaScript and Node Native.
 
 ## `ctx.req`
@@ -152,6 +154,8 @@ interface PulseRequest {
   readonly path: string
   readonly headers: readonly [string, string][]
   header(name: string): string | undefined
+  body(): PulseIncomingBody
+  readTextChunk(): PulseEffect<{ readonly done: boolean; readonly text: string }>
   text(): PulseEffect<string>
   json<T = unknown>(schemaId?: string): PulseEffect<T>
 }
@@ -159,6 +163,15 @@ interface PulseRequest {
 
 Structured request bodies are bounded runtime-owned snapshots. Repeated `text()` and `json()` reads are memoized immutable transforms.
 
+`body()` is an opaque incoming handle under the Node `bodyForwarding` opt-in;
+it grants no reader or binary inspection. `readTextChunk()` belongs only to the
+experimental Node `bodyTransform` opt-in, with generated output and a finite
+deadline. It excludes forwarding and structured body reads. Both Fastly targets
+reject these capabilities. The [bodies guide](https://pulsecompute.io/v1.0.0-beta.6/concepts/bodies/) owns the
+byte/read/write limits and separates installed output qualification from pending
+installed transform qualification. The production `/server` launcher remains
+qualified for finite HTTP, as described in [Node deployment](https://pulsecompute.io/v1.0.0-beta.6/guides/deploying-node/).
+
 ### Request metadata and headers
 
 ```ts
@@ -382,6 +395,16 @@ return ctx.json(output, {
 })
 ```
 
+## `ctx.time`
+
+`await ctx.time.now()` returns one provider-owned wall-clock sample. On success,
+`status` is `'ok'`, `unixEpochMs` is integer Unix milliseconds and `iso8601` is
+its matching UTC string. A failed sample has `status: 'failed'` and reason
+`'unavailable'` or `'invalid-clock'`. Direct awaited calls and keyed parallel
+members are supported on Node/Fastly Native and JavaScript. Wall time can regress
+and is separate from monotonic deadlines and exact commit timestamps. See the
+[complete result contract](https://pulsecompute.io/v1.0.0-beta.6/packages/runtime/#wall-time).
+
 ## Config and secrets
 
 ```ts
@@ -453,7 +476,20 @@ projects the value, then returns detached JSON text bounded by `schemas.maxBytes
 in UTF-8 bytes. It does not create a response or dispatch an effect. Invalid
 values and oversized text fail before subsequent writes. Declaration order and
 array order are preserved; cross-target parity is semantic, not a universal
-canonical-byte format. See [application-owned encoding](https://pulsecompute.io/v1.0.0-beta.4/guides/json-schemas/#encode-application-owned-text).
+canonical-byte format. See [application-owned encoding](https://pulsecompute.io/v1.0.0-beta.6/guides/json-schemas/#encode-application-owned-text).
+
+## `ctx.decodeJson`
+
+```ts
+const candidate = ctx.decodeJson<Candidate>(stored.text, 'app.Candidate')
+```
+
+Requires a literal registered schema even in non-strict mode. The input must
+be a string within `schemas.maxBytes` UTF-8 bytes. Decoding returns a detached,
+deeply immutable value with declared fields only. It performs no effect and
+does not apply HTTP content-type policy. Keep the original text for hashing,
+verification and retries; decoding does not establish byte canonicalization or
+storage acceptance. See [application text decoding](https://pulsecompute.io/v1.0.0-beta.6/guides/json-schemas/#decode-application-owned-text).
 
 ## Explicit JSON schemas
 
@@ -496,12 +532,12 @@ forms lower into canonical package operations; JavaScript targets execute the
 real package implementation.
 
 Older `/pulsewasm` imports are compatibility-only and are isolated in the
-[migration guide](https://pulsecompute.io/v1.0.0-beta.4/guides/compatibility-imports/). See the
-[GRIP package guide](https://pulsecompute.io/v1.0.0-beta.4/packages/grip/) for the complete current surface.
+[migration guide](https://pulsecompute.io/v1.0.0-beta.6/guides/compatibility-imports/). See the
+[GRIP package guide](https://pulsecompute.io/v1.0.0-beta.6/packages/grip/) for the complete current surface.
 
 ## Entities API
 
-`@pulse-compute/entities` is part of the synchronized `1.0.0-beta.4` package
+`@pulse-compute/entities` is part of the synchronized `1.0.0-beta.6` package
 set. The application surface has two runtime values:
 
 ```ts
@@ -563,9 +599,9 @@ Registrations and the terminal binding must use the supported static form. The
 first-party JSON-RPC adapter accepts bounded JSON-RPC 2.0 request objects and
 named params, validates declared schemas, uses stable error framing, and
 acknowledges notifications with HTTP `204`. See the [package
-guide](https://pulsecompute.io/v1.0.0-beta.4/packages/entities/), [entity/adapter
-model](https://pulsecompute.io/v1.0.0-beta.4/concepts/entities-and-adapters/), and [executable
-example](https://pulsecompute.io/v1.0.0-beta.4/examples/10-entities-tools/).
+guide](https://pulsecompute.io/v1.0.0-beta.6/packages/entities/), [entity/adapter
+model](https://pulsecompute.io/v1.0.0-beta.6/concepts/entities-and-adapters/), and [executable
+example](https://pulsecompute.io/v1.0.0-beta.6/examples/10-entities-tools/).
 
 ## Project workflow
 
@@ -582,5 +618,5 @@ selected profile, handler entry, schema declarations, provider bindings, and
 output directory through `.pulse/config.ts`. `pulse inspect` is optional
 observability, and `pulse compile` is the advanced provider-neutral Native
 artifact command; neither is required before `pulse build`. See the [project
-lifecycle guide](https://pulsecompute.io/v1.0.0-beta.4/guides/project-lifecycle/) and [CLI
-reference](https://pulsecompute.io/v1.0.0-beta.4/reference/cli/).
+lifecycle guide](https://pulsecompute.io/v1.0.0-beta.6/guides/project-lifecycle/) and [CLI
+reference](https://pulsecompute.io/v1.0.0-beta.6/reference/cli/).

package/docs/guides/routing.md

@@ -1,6 +1,6 @@
 # Static Router authoring
 
-Use `Router` when an application has several method/path entry points or needs compile-time middleware. It is a static authoring marker from `@pulse-compute/runtime`, not a JavaScript runtime dispatcher. The shared async/static restrictions are defined in [Managed handler TypeScript and JavaScript](https://pulsecompute.io/v1.0.0-beta.4/reference/handler-authoring/); target claims live in the [compatibility matrix](https://pulsecompute.io/v1.0.0-beta.4/reference/compatibility-matrix/).
+Use `Router` when an application has several method/path entry points or needs compile-time middleware. It is a static authoring marker from `@pulse-compute/runtime`, not a JavaScript runtime dispatcher. The shared async/static restrictions are defined in [Managed handler TypeScript and JavaScript](https://pulsecompute.io/v1.0.0-beta.6/reference/handler-authoring/); target claims live in the [compatibility matrix](https://pulsecompute.io/v1.0.0-beta.6/reference/compatibility-matrix/).
 
 <!-- pulse-doc-source: examples/09-router-lowering/src/index.ts -->
 ```ts
@@ -105,6 +105,43 @@ acceptance only; they do not implement Catalog persistence or authorization.
 node wasm/scripts/run-wasm-tests.cjs --task catalog-router-parity --no-report
 ```
 
+## Selected groups
+
+Mount a group once after earlier selectors have set request-local state:
+
+```ts
+app.mount('/api', collection, { state: 'read-family', equals: 'collection' })
+```
+
+The optional third argument is an inline object containing exactly `state` and
+`equals`, both string literals. At this mount's ordered position, the request
+path must match and `ctx.state.get('read-family') === 'collection'` must hold.
+An absent or unequal value skips every child owner and effect directly to the
+parent continuation. Selection is not authorization; keep authorization in its
+existing owner.
+
+A match enters the child once. Child `next()` still advances to the next sibling,
+and exhaustion joins the parent continuation once. Terminal responses and ordered
+local/parent error handling keep their existing semantics. A suspended effect
+resumes inside the child; changing selection state there does not reevaluate the
+mount. Method, path and parameter scoping are unchanged. An empty selected child
+continues immediately.
+
+This form is supported by live JavaScript and canonical Native compilation.
+Eligibility does not accept callbacks, calls, getters, spreads, computed keys,
+descriptor references or dynamic values. Unsupported source receives
+`PULSEWASM_UNSUPPORTED_MOUNT_ELIGIBILITY`; historical table/harness emitters also
+reject selected mounts rather than ignoring them. Two-argument mounts are
+unchanged. The group remains one placement with one existing parent continuation.
+
+The `router-selected-groups` task checks exclusion, suspension after a state
+change, terminal/error paths, nested parameters and one common tail on live
+JavaScript and compiled Node/Fastly Native (Fastly uses its local ABI mock host).
+
+```sh
+node wasm/scripts/run-wasm-tests.cjs --task router-selected-groups --no-report
+```
+
 ## `next()` is a terminal transfer
 
 `next()` is not an onion-style callback. It is a compiler-visible control transfer:
@@ -146,6 +183,39 @@ app.error(async (error, ctx, next) => {
 
 If the normal lane is exhausted, Pulse returns `404 Not Found`. If the error lane is exhausted, Pulse returns `500 Internal Server Error`.
 
+Request UTF-8 failures, schema data failures and JWT validation failures enter the next registered
+error handler. Branch on `error.code`; the portable contract does not require
+identical messages, stacks, causes or detail fields across providers.
+
+| Boundary | Portable error codes |
+| --- | --- |
+| Request text encoding | `PULSE_REQUEST_BODY_INVALID_UTF8` (Node Native, Node JavaScript, Fastly Native) |
+| Schema data | `PULSE_SCHEMA_DECODE`, `PULSE_SCHEMA_ENCODE`, `PULSE_SCHEMA_JSON_MALFORMED`, `PULSE_SCHEMA_CONTENT_TYPE`, `PULSE_BODY_TOO_LARGE` |
+| JWT input and verification | `PULSE_JWT_TOKEN_REQUIRED`, `PULSE_JWT_BEARER_INVALID`, `PULSE_JWT_MALFORMED`, `PULSE_JWT_LIMIT_EXCEEDED`, `PULSE_JWT_ALGORITHM_NOT_ALLOWED`, `PULSE_JWT_KEY_INVALID`, `PULSE_JWT_SIGNATURE_INVALID` |
+| JWT claims | `PULSE_JWT_CLOCK_INVALID`, `PULSE_JWT_CLAIMS_INVALID`, `PULSE_JWT_CLAIMS_SCHEMA_INVALID` |
+
+These admitted `error.code` values remain stable through redaction, including
+when a secret, KV key or array index overlaps their spelling. Messages, stacks,
+causes, details and arbitrary provider error codes remain subject to redaction.
+This preserves the existing recovery catalog; it does not admit new failures.
+
+Recovery moves forward in registration order, including through mounted
+routers. A failed handler never resumes. An error handler can return a response,
+forward with `return next(error)`, or clear the error lane with `return next()`.
+A data failure inside an error handler transfers to a later error handler.
+
+Already-started members of a failed effect group settle before application
+recovery. Pulse does not retry them, undo completed writes, or imply that a
+failed invocation had no external effects. Conditional KV results such as
+`conflict`, `not-stored` and `unknown` remain ordinary outcomes for the handler to
+inspect. Their meaning does not change when an error handler is registered.
+
+Cancellation ends the invocation without an application response. On Native,
+traps, provider protocol failures and unavailable capabilities remain terminal; they
+do not acquire recovery or rollback guarantees. Native authoring still does not
+admit arbitrary `throw` or `try`/`catch`. JavaScript retains its existing
+`PulseUnhandledError` containment for unexpected handler failures.
+
 ## Middleware scope and effects
 
 A path-scoped `use('/api', handler)` applies only to that subtree. Middleware declared on a mounted child Router is naturally limited to the mounted subtree.

package/docs/preview-scope.md

@@ -1,6 +1,6 @@
 # Beta scope
 
-Pulse `1.0.0-beta.4` is a Beta of one provider-neutral application contract
+Pulse `1.0.0-beta.6` is a Beta of one provider-neutral application contract
 with explicit Native and JavaScript execution targets. The intended 1.0
 surface is present, but deliberate corrections may still occur before the
 stable `1.0.0` release.
@@ -18,6 +18,8 @@ targets.
   middleware, GET/HEAD/POST/PUT/PATCH/DELETE routes, exact paths, named parameters, trailing
   wildcards, and acyclic mounts.
 - Basic branching and structured object, array, and scalar manipulation.
+- Literal-capped pure `for` loops and zero-argument string `.trim()` across
+  Native and JavaScript; see [bounded application values](https://pulsecompute.io/v1.0.0-beta.6/concepts/compilation-and-lowering/#bounded-application-values).
 - Request method, URL, path, headers, text, and JSON access.
 - Bounded, memoized structured body decoding.
 - Explicit TypeScript JSON schema declarations and literal schema IDs.
@@ -75,6 +77,11 @@ JavaScript-selected project into a Native one.
 
 ## Deliberately unsupported
 
+- Unbounded loops, arbitrary callback transformations and Native helper shapes
+  outside the supported bounded subset. Effectful loops are limited to the
+  experimental finite Node output/transform forms in the [bodies guide](https://pulsecompute.io/v1.0.0-beta.6/concepts/bodies/);
+  other loop bodies must stay within the admitted pure forms.
+
 - Automatic fallback from Native lowering to JavaScript execution.
 - Declaring general target availability without satisfying every declared
   full-target-support gate.
@@ -88,7 +95,9 @@ JavaScript-selected project into a Native one.
 - Automatic discovery of arbitrary TypeScript types.
 - Dynamic schema IDs.
 - Arbitrary binary body inspection or mutation.
-- Userland chunk iteration, transform streams, or manual backpressure.
+- General userland chunk iteration, transform streams, or manual backpressure.
+  Experimental finite Node UTF-8 output/transforms are explicit bounded opt-ins,
+  not general stream support or production-launcher qualification.
 - Background tasks and work that outlives the request.
 - Raw TCP or UDP sockets.
 - Dynamic GRIP channel, framing-option, or message shapes under Native
@@ -106,13 +115,13 @@ JavaScript-selected project into a Native one.
 ## Compatibility authority
 
 The single source-form, provider-binding, artifact, and deployment-boundary
-table is [Provider and target compatibility](https://pulsecompute.io/v1.0.0-beta.4/reference/compatibility-matrix/).
+table is [Provider and target compatibility](https://pulsecompute.io/v1.0.0-beta.6/reference/compatibility-matrix/).
 It uses one public target order—Node JavaScript, Fastly JavaScript, Node Native,
 and Fastly Native—and links every row to a focused proof or canonical contract.
 
 The exact portable language subset and the JavaScript-only Native eligibility
 boundaries are defined in
-[Managed handler TypeScript and JavaScript](https://pulsecompute.io/v1.0.0-beta.4/reference/handler-authoring/).
+[Managed handler TypeScript and JavaScript](https://pulsecompute.io/v1.0.0-beta.6/reference/handler-authoring/).
 
 ## Body model
 
@@ -136,7 +145,7 @@ pass it through → opaque handle
 - Package names, release artifacts, and published versions are immutable once
   released.
 
-The intended npm dist-tag for the Beta is `beta`. It becomes
-active only through the atomic documentation-release transaction and an
-explicitly authorized publication. The workflow never assigns `latest`
-implicitly.
+The release manifest explicitly selects the npm `latest` dist-tag while package
+versions retain the Beta prerelease suffix. The npm tag and Git branch are
+separate names. Publication remains a distinct human-authorized action; this
+support cleanup does not change that policy.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-compute/runtime",
-  "version": "1.0.0-beta.4",
+  "version": "1.0.0-beta.6",
   "license": "Apache-2.0",
   "engines": {
     "node": "^22.14.0 || ^24.0.0"
@@ -41,7 +41,7 @@
     "url": "git+https://github.com/pulse-compute/pulse.git",
     "directory": "packages/runtime"
   },
-  "homepage": "https://pulsecompute.io/v1.0.0-beta.4/packages/runtime/",
+  "homepage": "https://pulsecompute.io/v1.0.0-beta.6/packages/runtime/",
   "bugs": {
     "url": "https://github.com/pulse-compute/pulse/issues"
   }

package/src/host.d.ts

@@ -1,5 +1,6 @@
 import type {
   Handler,
+  PulseTimeResult,
   PulseEffect,
   PulseKvGeneration, PulseKvVersionedResult, PulseKvConditionalResult,
   PulseFetchResponse,
@@ -16,6 +17,8 @@ export interface PulseJavascriptEffectHostExecution {
   readonly application?: unknown;
   readonly signal?: AbortSignal;
   readonly deadlineMonotonicMs?: number;
+  /** Host-only request authority; package transports recheck before dispatch. */
+  readonly requestBudget?: PulseRequestBudget;
   /** Adds execution-owned sensitive text to runtime redaction before provider work continues. */
   registerRedactionValue(value: string | Uint8Array): void;
   /** Applies one project-owned schema codec directly to an in-memory semantic value. */
@@ -112,6 +115,7 @@ export interface PulseRuntimeHostKvNamespace<T = unknown> {
 /** Compatibility injection shape retained while providers move to one effect adapter. */
 export interface PulseRuntimeHostCapabilities {
   prepareConditionalKv?: PulseConditionalKvPreparation;
+  time?(execution?: PulseJavascriptEffectHostExecution): PulseTimeResult | Promise<PulseTimeResult>;
   fetch?(
     url: string,
     init?: unknown,
@@ -173,6 +177,8 @@ export interface PulseJavascriptEffectSummary {
 
 /** Maintainer bridge used by the managed Router lifecycle and focused adapter tests. */
 export interface PulseJavascriptEffectExecution {
+  /** Host/runtime admission fence; rejects queued provider dispatch after an ownership conflict. */
+  invalidateAdmission(error: unknown): void;
   /** Execution-owned local projection. It participates in lifecycle containment but is not parallel-eligible. */
   local<T = unknown>(
     kind: string,
@@ -199,7 +205,48 @@ export interface PulseJavascriptEffectExecution {
   close(): Promise<void>;
 }
 
+export interface PulseRequestBudget {
+  readonly signal: AbortSignal;
+  readonly deadlineMonotonicMs?: number;
+  readonly clock: PulseKvClock;
+  check(): void;
+  onAbort(callback: () => void): () => void;
+  remainingMs(): number;
+  race<T>(value: T | PromiseLike<T>): Promise<T>;
+  close(): void;
+}
+export declare function normalizeRequestDuration(value?: number): number | undefined;
+export declare function createRequestBudget(options?: {
+  maxDurationMs?: number;
+  requestBudget?: PulseRequestBudget;
+  requestClock?: PulseKvClock;
+  signal?: AbortSignal;
+  requestSignal?: AbortSignal;
+}): PulseRequestBudget;
+
+export interface PulseGeneratedOutputExecution {
+  readonly started: boolean;
+  readonly finished: boolean;
+  assertEffect(): void;
+  dispatch(effect: Readonly<Record<string, unknown>>): Promise<unknown>;
+  bindInput(input: PulseIncomingBodyOwnership | undefined): void;
+  close(factory?: (options: import('./index').PulseResponseOptions) => unknown): any;
+  validateResult(result: unknown): void;
+  finish(): Promise<void>;
+  cancel(reason?: unknown): void;
+  dispose(): void;
+}
 export interface PulseRuntimeExecutionOptions {
+  /** Provider-owned output authority; unavailable to application code. */
+  readonly outputExecution?: PulseGeneratedOutputExecution;
+  /** Provider-owned incoming stream controller; never an application capability. */
+  readonly incomingBody?: PulseIncomingBodyOwnership;
+  /** Provider-owned total managed request budget, 1..30000 ms. Omitted preserves existing behavior. */
+  readonly maxDurationMs?: number;
+  /** Shared host budget; nested adapters must not restart or close an inherited budget. */
+  readonly requestBudget?: PulseRequestBudget;
+  /** Monotonic host clock/scheduler, never application wall time. */
+  readonly requestClock?: PulseKvClock;
   /** Host-only monotonic clock/scheduler injection for deterministic lifecycle evidence. */
   readonly kvClock?: PulseKvClock;
   /** Host monotonic deadline; conditional KV uses the earlier of this and 10 seconds. */
@@ -418,3 +465,31 @@ export declare function admitConditionalKv(input: Readonly<Record<string, unknow
 export declare function normalizeConditionalKvResult(effect: Readonly<{ kind: string }>, value: unknown, options?: PulseBindingValueLimits): PulseKvVersionedResult<unknown> | PulseKvConditionalResult;
 export declare function executeConditionalKv(effect: Readonly<Record<string, unknown>>, prepare: PulseConditionalKvPreparation, execution?: PulseConditionalKvExecution, options?: PulseRuntimeExecutionOptions): Promise<PulseKvVersionedResult<unknown> | PulseKvConditionalResult>;
 export declare function registerKvRedactions(effect: Readonly<Record<string, unknown>>, register?: (value: string) => void): void;
+/** Whether a data failure can transfer to the next Router error handler. */
+export declare function isApplicationError(error: unknown): boolean;
+
+/** Host-only wall-clock result contract; the callback samples integer Unix milliseconds. */
+export declare const WALL_TIME_MAX_MS: 253402300799999;
+export declare function readWallTime(clock?: (() => number) | null): PulseTimeResult;
+export declare function normalizeTimeResult(value: unknown): PulseTimeResult;
+
+/** Host-only lifecycle authority for one incoming request body. */
+export interface PulseIncomingBodyOwnership {
+  marker(): import('./index').PulseIncomingBody;
+  bindInvalidation(callback: (error: unknown) => void): void;
+  structured(): void;
+  readTextChunk(budget: PulseRequestBudget): Promise<{ readonly done: boolean; readonly text: string }>;
+  claim(marker: unknown, init: unknown): void;
+  forward(url: string, init: unknown, execution: PulseJavascriptEffectHostExecution): Promise<Response>;
+  close(): Promise<void>;
+  readonly failure: unknown;
+  readonly responseSignal?: AbortSignal;
+}
+export declare function createIncomingBodyOwnership(transport: {
+  readonly responseSignal?: AbortSignal;
+  readTextChunk?(budget: PulseRequestBudget): Promise<{ readonly done: boolean; readonly text: string }>;
+  validate(init: unknown): void;
+  forward(url: string, init: unknown, execution: PulseJavascriptEffectHostExecution): Promise<Response>;
+  cancel(reason?: unknown): unknown;
+}): PulseIncomingBodyOwnership;
+export declare function forwardIncomingBody(marker: unknown, url: string, init: unknown, execution: PulseJavascriptEffectHostExecution): Promise<Response>;

package/src/host.js

@@ -78,6 +78,11 @@ async function executeApplication(application, request, options = {}) {
 }
 
 module.exports = Object.freeze({
+  createIncomingBodyOwnership: require('./internal/incoming-body.js').createIncomingBodyOwnership,
+  forwardIncomingBody: require('./internal/incoming-body.js').forwardIncomingBody,
+  ...require('./internal/time.js'),
+  ...require('./internal/request-budget.js'),
+  isApplicationError: require('./internal/errors.js').isApplicationError,
   ...require('./internal/conditional-kv.js'),
   RUNTIME_HOST_API_VERSION,
   JAVASCRIPT_EFFECT_PROTOCOL_VERSION,

package/src/index.d.ts

@@ -2,6 +2,10 @@ export type HeaderPair = readonly [name: string, value: string];
 
 declare const pulseEffectBrand: unique symbol;
 declare const pulseParallelEffectBrand: unique symbol;
+declare const incomingBodyBrand: unique symbol;
+
+/** Single-use opaque marker, admitted only inline as a configured Node fetch body. */
+export interface PulseIncomingBody { readonly [incomingBodyBrand]: true; }
 
 export interface PulseEffect<T> extends Promise<T> {
   readonly [pulseEffectBrand]: T;
@@ -23,6 +27,9 @@ export interface PulseRequest {
   readonly path: string;
   readonly headers: readonly HeaderPair[];
   header(name: string): string | undefined;
+  body(): PulseIncomingBody;
+  /** Experimental finite UTF-8 transform input; Node bodyTransform opt-in required. */
+  readTextChunk(): PulseEffect<{ readonly done: boolean; readonly text: string }>;
   text(): PulseEffect<string>;
   json<T = unknown>(schemaId?: string): PulseEffect<T>;
 }
@@ -35,7 +42,7 @@ export interface PulseFetchInitBase {
 
 export type PulseFetchInit = PulseFetchInitBase & (
   | { readonly body?: never; readonly json?: never; readonly schema?: never }
-  | { readonly body: string; readonly json?: never; readonly schema?: never }
+  | { readonly body: string | PulseIncomingBody; readonly json?: never; readonly schema?: never }
   | { readonly body?: never; readonly json: unknown; readonly schema?: string }
 );
 
@@ -133,10 +140,19 @@ export type PulseEmitEvent<Payload = unknown> =
   | Readonly<{ schema: string; payload: Payload }>
   | Readonly<{ schema: null; payload?: never }>;
 
+/** One provider wall-clock sample. This is neither monotonic nor a commit timestamp. */
+export type PulseTimeResult =
+  | { readonly status: 'ok'; readonly unixEpochMs: number; readonly iso8601: string }
+  | { readonly status: 'failed'; readonly reason: 'unavailable' | 'invalid-clock' };
+
 /** Plane-neutral authority shared by one isolated HTTP request or event invocation. */
 export interface PulseExecutionContext {
   /** Validate/project a value through a literal registered schema and return bounded JSON text. */
   encodeJson(value: unknown, schemaId: string): string;
+  /** Decode bounded application-owned JSON text through a literal registered schema. */
+  decodeJson<T = unknown>(text: string, schemaId: string): T;
+  /** Fresh sample at dispatch, UTC 1970–9999, integer Unix milliseconds. */
+  readonly time: { now(): PulseParallelEffect<PulseTimeResult> };
   readonly state: PulseState;
   readonly log: PulseLogger;
   fetch(url: string, init?: PulseFetchInit): PulseFetchOperation;
@@ -157,6 +173,12 @@ export interface PulseExecutionContext {
 
 /** HTTP request execution context. */
 export interface PulseContext extends PulseExecutionContext {
+  /** Experimental Node output: opt-in, finite, request-owned UTF-8 writes. */
+  readonly output: {
+    start(options?: PulseResponseOptions): PulseEffect<void>;
+    write(text: string): PulseEffect<void>;
+    close(): PulseResult;
+  };
   readonly req: PulseRequest;
   json(value: unknown, descriptor?: PulseJsonResponseOptions | string): PulseResult;
   text(value: string, options?: PulseResponseOptions): PulseResult;
@@ -209,7 +231,8 @@ export declare class Router {
   put(path: string, handler: RouteHandler): this;
   patch(path: string, handler: RouteHandler): this;
   delete(path: string, handler: RouteHandler): this;
-  mount(path: string, router: Router): this;
+  /** Enter the child once only when request state strictly equals the literal string; a miss skips the entire child. */
+  mount(path: string, router: Router, eligibility?: { readonly state: string; readonly equals: string }): this;
   error(handler: RouterErrorHandler): this;
 }
 

package/src/internal/body.js

@@ -200,13 +200,22 @@ function createStructuredBodyReader(owner, options = {}) {
 
   function bytes() {
     assertInspectable();
-    if (!bytesPromise) bytesPromise = readBodyBytes(owner, maxBytes, label, signal);
+    if (!bytesPromise) {
+      bytesPromise = readBodyBytes(owner, maxBytes, label, signal);
+      if (options.onReadSettled) bytesPromise = bytesPromise.finally(options.onReadSettled);
+    }
     return bytesPromise;
   }
 
   function text() {
     assertInspectable();
-    if (!textPromise) textPromise = bytes().then((value) => new TextDecoder().decode(value));
+    if (!textPromise) textPromise = bytes().then((value) => {
+      if (label !== 'request') return new TextDecoder().decode(value);
+      try { return new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(value); }
+      catch (cause) {
+        throw bodyError('PULSE_REQUEST_BODY_INVALID_UTF8', 'Pulse request text must be well-formed UTF-8.', {}, cause);
+      }
+    });
     return textPromise;
   }