@pulse-compute/runtime 1.0.0-beta.4 → 1.0.0-beta.6

package/src/internal/context.js

@@ -2,6 +2,8 @@
 
 const { createStructuredBodyReader, normalizeBodyLimit } = require('./body.js');
 const { normalizeFetchRequest } = require('./fetch.js');
+const { isIncomingBody } = require('./incoming-body.js');
+const { PulseRuntimeContractError } = require('./errors.js');
 const { decodeSchemaText, encodeSchemaValue, requireExplicitSchemaId, strictSchemaPolicy } = require('./schema.js');
 const {
   cloneKvValue,
@@ -20,6 +22,10 @@ const {
   projectFetchResponse
 } = require('./response.js');
 
+// Router entries create new contexts but share one effect execution. Keep fetch
+// numbering with that execution, without retaining completed requests.
+const fetchSequences = new WeakMap();
+
 function headersToPairs(headers) {
   const pairs = [];
   for (const [name, value] of headers.entries()) pairs.push(Object.freeze([name, value]));
@@ -35,6 +41,7 @@ function normalizeRequestHeaderPairs(headers, fallback) {
 }
 
 function createRequestView(request, requestHeaders, effectExecution, options = {}) {
+  options.incomingBody?.bindInvalidation(error => effectExecution.invalidateAdmission(error));
   const url = new URL(request.url);
   const headers = normalizeRequestHeaderPairs(requestHeaders, request.headers);
   const body = createStructuredBodyReader(request, {
@@ -52,16 +59,28 @@ function createRequestView(request, requestHeaders, effectExecution, options = {
     url: request.url,
     path: url.pathname || '/',
     headers,
+    body(...args) {
+      if (args.length) throw new TypeError('ctx.req.body takes no arguments.');
+      if (!options.incomingBody) throw new PulseRuntimeContractError(
+        'PULSE_REQUEST_FORWARDING_UNAVAILABLE', 'Incoming body forwarding requires the configured Node JavaScript provider.');
+      return options.incomingBody.marker();
+    },
+    readTextChunk(...args) {
+      if (args.length) throw new TypeError('ctx.req.readTextChunk takes no arguments.');
+      return effectExecution.dispatch({ kind: 'output.readTextChunk', providerKind: 'output', operation: 'readTextChunk', capability: 'request.body.transform', parallelEligible: false });
+    },
     header(name) {
       const lower = String(name).toLowerCase();
       const match = headers.find(([header]) => header.toLowerCase() === lower);
       return match ? match[1] : undefined;
     },
     text() {
+      options.incomingBody?.structured();
       if (!textEffect) textEffect = effectExecution.local('request.body.text', () => body.text());
       return textEffect;
     },
     json(schemaId) {
+      options.incomingBody?.structured();
       if (schemaId === undefined && !strictSchemaPolicy(options)) {
         if (!jsonEffect) jsonEffect = effectExecution.local('request.body.json', () => body.json());
         return jsonEffect;
@@ -145,7 +164,6 @@ function createContext(frame) {
     ...(frame.executionOptions || {}),
     signal: frame.signal
   });
-  let fetchSequence = 0;
   const log = createPulseLogger({
     reporting: options.reporting,
     redact(message) { return effects.redactValue(message); },
@@ -161,17 +179,32 @@ function createContext(frame) {
       const id = requireExplicitSchemaId(schemaId, options, 'application-value');
       return encodeSchemaValue(id, value, options, { source: 'application-value' }).text;
     },
+    decodeJson(text, schemaId) {
+      const id = requireExplicitSchemaId(schemaId, options, 'application-text');
+      return decodeSchemaText(id, text, options, { source: 'application-text' });
+    },
     ...(eventContext ? {} : { req }),
     state,
     log,
     fetch(url, init) {
-      fetchSequence += 1;
+      const fetchSequence = (fetchSequences.get(effects) || 0) + 1;
+      fetchSequences.set(effects, fetchSequence);
       const effectId = `fetch-${fetchSequence}`;
-      const fetchRequest = normalizeFetchRequest(url, init, {
-        ...options,
-        operationId: `fetch-request:${effectId}`,
-        effectId
-      });
+      let fetchRequest;
+      try {
+        fetchRequest = normalizeFetchRequest(url, init, {
+          ...options,
+          operationId: `fetch-request:${effectId}`,
+          effectId
+        });
+        if (fetchRequest.init.bodyMode === 'incoming-request-v1') {
+          if (!options.incomingBody) throw new PulseRuntimeContractError('PULSE_REQUEST_BODY_OWNERSHIP', 'Incoming body belongs to another execution.');
+          options.incomingBody.claim(fetchRequest.init.body, fetchRequest.init);
+        }
+      } catch (error) {
+        if (isIncomingBody(init?.body)) effects.invalidateAdmission(error);
+        throw error;
+      }
       const fetchEffect = effects.dispatch({
         id: effectId,
         kind: 'fetch',
@@ -183,6 +216,12 @@ function createContext(frame) {
       });
       return createFetchOperation(effects, fetchEffect, fetchRequest, options, effectId);
     },
+    time: Object.freeze({
+      now(...args) {
+        if (args.length) throw new TypeError('Pulse time.now takes no arguments.');
+        return effects.dispatch({ kind: 'time.now', providerKind: 'time', operation: 'now', capability: 'time.wall-clock' });
+      }
+    }),
     parallel(record) { return effects.parallel(record); },
     config: Object.freeze({
       get(name) {
@@ -256,6 +295,26 @@ function createContext(frame) {
   if (eventContext) {
     ctx.event = frame.event;
   } else {
+    const output = () => {
+      if (!options.outputExecution) throw new PulseRuntimeContractError('PULSE_OUTPUT_UNAVAILABLE', 'Generated output requires configured Node HTTP execution.');
+      return options.outputExecution;
+    };
+    ctx.output = Object.freeze({
+      start(...args) {
+        if (args.length > 1) throw new TypeError('output.start accepts one options object.');
+        output().assertEffect();
+        return effects.dispatch({ kind: 'output.start', providerKind: 'output', operation: 'start', capability: 'response.output', parallelEligible: false, argument0: args[0] });
+      },
+      write(...args) {
+        if (args.length !== 1) throw new TypeError('output.write requires one text chunk.');
+        output().assertEffect();
+        return effects.dispatch({ kind: 'output.write', providerKind: 'output', operation: 'write', capability: 'response.output', parallelEligible: false, argument0: args[0] });
+      },
+      close(...args) {
+        if (args.length) throw new TypeError('output.close accepts no arguments.');
+        return output().close(init => createTextResult('', init));
+      }
+    });
     ctx.json = (value, descriptor) => createJsonResult(value, descriptor, options);
     ctx.text = (value, responseOptions) => createTextResult(value, responseOptions);
     ctx.response = (input) => createResponseResult(input);

package/src/internal/effect-adapter.js

@@ -9,11 +9,13 @@ const {
   normalizeKvNamespace,
   normalizeKvPutResult
 } = require('./bindings.js');
+const { normalizeTimeResult, readWallTime } = require('./time.js');
 const conditionalKv = require('./conditional-kv.js');
 const { fetchRequestInitForHost } = require('./fetch.js');
 const { createRedactionState } = require('./redaction.js');
 const { validateSchemaValue } = require('./schema.js');
 const { EVENT_EMIT_CODES } = require('./event-emission.js');
+const { cancelResponseBody, retainFetchResponseForBudget, releaseFetchResponseCancellation } = require('./response.js');
 
 const JAVASCRIPT_EFFECT_PROTOCOL_VERSION = 'pulse.javascript-effect.v1';
 const JAVASCRIPT_EFFECT_ADAPTER_VERSION = 'pulse.javascript-effect-adapter.v1';
@@ -244,6 +246,7 @@ function createCapabilityEffectAdapter(capabilities = {}) {
         if (typeof value.fetch !== 'function') return unavailableCapability(effect);
         return value.fetch(effect.url, fetchRequestInitForHost(effect.init, execution.signal), execution);
       }
+      if (effect.kind === 'time.now') return typeof value.time === 'function' ? value.time(execution) : readWallTime();
       if (effect.kind === 'config.get') {
         if (typeof value.config !== 'function') return unavailableCapability(effect);
         return value.config(effect.name, execution);
@@ -305,6 +308,7 @@ function normalizeEffectDescriptor(input, limits) {
 }
 
 function normalizeEffectResult(descriptor, value, limits) {
+  if (descriptor.kind === 'time.now') return normalizeTimeResult(value);
   if (descriptor.kind === 'config.get' || descriptor.kind === 'secret.get') {
     return normalizeBindingValue(descriptor.kind, descriptor.name, value, limits);
   }
@@ -490,6 +494,8 @@ function createJavascriptEffectExecution(options = {}) {
     event: options.event,
     application: options.application,
     signal: lifecycleController.signal,
+    deadlineMonotonicMs: options.deadlineMonotonicMs,
+    requestBudget: options.requestBudget,
     registerRedactionValue(value) {
       if (typeof value === 'string' && value.length > 0) redaction.add(value);
     },
@@ -505,6 +511,7 @@ function createJavascriptEffectExecution(options = {}) {
   const counters = new Map();
   const dispatchedIds = new Set();
   const pendingEffects = new Map();
+  const ownedResponses = new Set();
   const claimedParallelRootIds = new Set();
   const observations = [];
   const resolutionOrder = [];
@@ -541,6 +548,7 @@ function createJavascriptEffectExecution(options = {}) {
         'Pulse effect execution is already closed.'
       );
     }
+    options.requestBudget?.check();
   }
 
   function trackEffect(effect, data) {
@@ -565,6 +573,7 @@ function createJavascriptEffectExecution(options = {}) {
           limitMessage
         );
       }
+      options.outputExecution?.assertEffect();
       const normalizedInput = normalizeEffectDescriptor(input, limits);
       const kind = String(normalizedInput.kind || 'effect');
       const descriptor = Object.freeze({
@@ -597,20 +606,36 @@ function createJavascriptEffectExecution(options = {}) {
       const operationSignal = createEffectSignal(lifecycleController.signal, descriptor);
       const operationExecution = Object.freeze({ ...externalExecution, signal: operationSignal.signal });
       const raw = raceWithSignal(Promise.resolve().then(() => {
+        options.requestBudget?.check();
         if (operationSignal.signal.aborted) throw abortedEffectError(operationSignal.signal.reason);
+        options.outputExecution?.assertEffect();
+        if (kind.startsWith('output.')) {
+          if (!options.outputExecution) throw new PulseRuntimeContractError('PULSE_OUTPUT_UNAVAILABLE', 'Generated output requires a Node HTTP writer.');
+          return options.outputExecution.dispatch(descriptor);
+        }
         if (conditionalKv.isConditionalKv(kind)) return conditionalKv.executeConditionalKv(descriptor,
           adapter.prepareConditionalKv || ((_admitted, kvExecution) => () => adapter.dispatch(descriptor, kvExecution)),
           { ...operationExecution, onKvObservation: observe }, limits);
-        return adapter.dispatch(descriptor, operationExecution);
+        return Promise.resolve(adapter.dispatch(descriptor, operationExecution)).then(value => {
+          if (value instanceof Response && value.body) {
+            if (closed || operationSignal.signal.aborted) cancelResponseBody(value, operationSignal.signal.reason);
+            else {
+              ownedResponses.add(value);
+              retainFetchResponseForBudget(value, options.requestBudget, () => ownedResponses.delete(value));
+            }
+          }
+          return value;
+        });
       }), operationSignal.signal).then(
         (value) => {
+          options.requestBudget?.check();
           const normalized = normalizeEffectResult(descriptor, value, limits);
           if (descriptor.kind === 'secret.get' && typeof normalized === 'string') redaction.add(normalized);
           return normalized;
         },
         (error) => { throw redaction.redactError(error); }
       ).finally(operationSignal.dispose);
-      const projected = (typeof projector === 'function' ? raw.then(projector) : raw).catch((error) => {
+      const projected = (typeof projector === 'function' ? raw.then(value => { options.requestBudget?.check(); return projector(value); }).then(value => { options.requestBudget?.check(); return value; }) : raw).catch((error) => {
         throw redaction.redactError(error);
       });
       const effectData = {
@@ -672,9 +697,10 @@ function createJavascriptEffectExecution(options = {}) {
       const publicDescriptor = publicEffectDescriptor(descriptor, redaction);
       observe({ type: 'effect-dispatched', effect: publicDescriptor });
       const promise = Promise.resolve().then(() => {
+        options.requestBudget?.check();
         if (lifecycleController.signal.aborted) throw abortedEffectError(lifecycleController.signal.reason);
         return producer(externalExecution);
-      }).catch((error) => { throw redaction.redactError(error); });
+      }).then(value => { options.requestBudget?.check(); return value; }).catch((error) => { throw redaction.redactError(error); });
       const effectData = {
         execution,
         id,
@@ -711,7 +737,7 @@ function createJavascriptEffectExecution(options = {}) {
             : 'Pulse effect projections require a request-owned Pulse effect.'
         );
       }
-      const projected = raceWithSignal(parent.then(projector), lifecycleController.signal).catch((error) => {
+      const projected = raceWithSignal(parent.then(value => { options.requestBudget?.check(); return projector(value); }).then(value => { options.requestBudget?.check(); return value; }), lifecycleController.signal).catch((error) => {
         throw redaction.redactError(error);
       });
       const effectData = {
@@ -723,7 +749,12 @@ function createJavascriptEffectExecution(options = {}) {
 
     parallel(record) {
       assertOpen();
-      const entries = validateParallelRecord(record, execution, claimedParallelRootIds);
+      let entries;
+      try { entries = validateParallelRecord(record, execution, claimedParallelRootIds); }
+      catch (error) {
+        if (record && Object.values(Object.getOwnPropertyDescriptors(record)).some(field => dataForEffect(field.value)?.kind?.startsWith('output.'))) execution.invalidateAdmission(error);
+        throw error;
+      }
       for (const entry of entries) claimedParallelRootIds.add(entry.data.rootId);
       parallelCount += 1;
       const id = `parallel-${parallelCount}`;
@@ -790,6 +821,11 @@ function createJavascriptEffectExecution(options = {}) {
       );
       return parallelEffect;
     },
+    invalidateAdmission(error) {
+      // A synchronous body-claim conflict must fence every already queued
+      // group member before its provider dispatch microtask can run.
+      if (!lifecycleController.signal.aborted) lifecycleController.abort(error);
+    },
 
     async assertIdle() {
       if (pendingEffects.size === 0) return;
@@ -840,7 +876,7 @@ function createJavascriptEffectExecution(options = {}) {
       });
     },
 
-    async close() {
+    async close(transferredResponse) {
       if (closed) return;
       closed = true;
       if (pendingEffects.size > 0 && !lifecycleController.signal.aborted) {
@@ -853,9 +889,21 @@ function createJavascriptEffectExecution(options = {}) {
       }
       if (pendingEffects.size > 0) await Promise.allSettled(Array.from(pendingEffects.keys()));
       if (removeSourceAbortListener) removeSourceAbortListener();
-      if (adapter.dispose) {
-        try { await adapter.dispose(externalExecution); }
-        catch (error) { throw redaction.redactError(error); }
+      try {
+        if (adapter.dispose) await adapter.dispose(externalExecution);
+      } catch (error) {
+        transferredResponse = undefined;
+        throw redaction.redactError(error);
+      } finally {
+        // Only the final response escapes this execution. Intermediate router
+        // responses and successful siblings of a failed group remain owned.
+        for (const response of ownedResponses) {
+          if (response.body !== transferredResponse?.body) {
+            cancelResponseBody(response, lifecycleController.signal.reason);
+            releaseFetchResponseCancellation(response);
+          }
+        }
+        ownedResponses.clear();
       }
     }
   };

package/src/internal/errors.js

@@ -24,4 +24,32 @@ class PulseUnhandledError extends Error {
   }
 }
 
-module.exports = Object.freeze({ PulseRuntimeContractError, PulseUnhandledError });
+// Data failures admitted to the Router error lane. Configuration, provider
+// protocol failures and VM traps are deliberately outside this catalog.
+const APPLICATION_ERROR_CODES = new Set([
+  'PULSE_SCHEMA_DECODE', 'PULSE_SCHEMA_ENCODE',
+  'PULSE_SCHEMA_JSON_MALFORMED', 'PULSE_SCHEMA_CONTENT_TYPE',
+  'PULSE_BODY_TOO_LARGE', 'PULSE_REQUEST_BODY_INVALID_UTF8',
+  'PULSE_JWT_TOKEN_REQUIRED', 'PULSE_JWT_BEARER_INVALID',
+  'PULSE_JWT_MALFORMED', 'PULSE_JWT_LIMIT_EXCEEDED',
+  'PULSE_JWT_ALGORITHM_NOT_ALLOWED', 'PULSE_JWT_KEY_INVALID',
+  'PULSE_JWT_SIGNATURE_INVALID', 'PULSE_JWT_CLAIMS_INVALID',
+  'PULSE_JWT_CLAIMS_SCHEMA_INVALID', 'PULSE_JWT_CLOCK_INVALID'
+]);
+
+function isApplicationError(error) {
+  if (!(error instanceof Error)) return false;
+  const code = Object.getOwnPropertyDescriptor(error, 'code')?.value;
+  if (!APPLICATION_ERROR_CODES.has(code)) return false;
+  const seen = new Set();
+  for (let cause = error; cause instanceof Error; cause = Object.getOwnPropertyDescriptor(cause, 'cause')?.value) {
+    if (seen.has(cause)) return false;
+    seen.add(cause);
+    if (cause instanceof WebAssembly.RuntimeError
+      || Object.getOwnPropertyDescriptor(cause, 'code')?.value === 'PULSE_CANONICAL_NATIVE_AS_ABORT'
+      || Object.getOwnPropertyDescriptor(cause, 'name')?.value === 'AbortError') return false;
+  }
+  return true;
+}
+
+module.exports = Object.freeze({ PulseRuntimeContractError, PulseUnhandledError, isApplicationError });

package/src/internal/fetch.js

@@ -2,6 +2,7 @@
 
 const { PulseRuntimeContractError } = require('./errors.js');
 const { encodeSchemaValue, requireExplicitSchemaId } = require('./schema.js');
+const { isIncomingBody } = require('./incoming-body.js');
 
 const SUPPORTED_FETCH_METHODS = Object.freeze(new Set(['GET', 'HEAD', 'POST']));
 const SUPPORTED_FETCH_INIT_FIELDS = Object.freeze(new Set(['method', 'headers', 'body', 'json', 'schema', 'timeoutMs']));
@@ -153,11 +154,11 @@ function normalizeFetchInit(input, options = {}) {
   let body;
   let bodyMode = 'none';
   if (hasBody) {
-    if (typeof value.body !== 'string') {
+    if (typeof value.body !== 'string' && !isIncomingBody(value.body)) {
       throw fetchContractError('PULSE_FETCH_BODY_INVALID', 'Pulse fetch body must be a string.', { type: typeof value.body });
     }
     body = value.body;
-    bodyMode = 'text';
+    bodyMode = isIncomingBody(value.body) ? 'incoming-request-v1' : 'text';
   } else if (hasJson) {
     if (!hasHeader(headers, 'content-type')) {
       headers.push(Object.freeze(['content-type', 'application/json; charset=utf-8']));

package/src/internal/incoming-body.js

@@ -0,0 +1,68 @@
+'use strict';
+
+const { PulseRuntimeContractError } = require('./errors.js');
+const owners = new WeakMap();
+function conflict() {
+  return new PulseRuntimeContractError('PULSE_REQUEST_BODY_OWNERSHIP', 'The incoming body has already been claimed by this request.');
+}
+
+// Host integration only. Markers carry no stream, bytes or serializable identity.
+function createIncomingBodyOwnership(transport) {
+  let state = 'available', invalidation, failure, disposed = false;
+  const marker = Object.freeze(Object.create(null));
+  const owner = Object.freeze({
+    marker() { return marker; },
+    bindInvalidation(callback) { invalidation = callback; },
+    fail(error) {
+      failure ||= error;
+      state = 'failed';
+      invalidation?.(error);
+      return error;
+    },
+    structured() {
+      if (transport.readTextChunk) throw owner.fail(conflict());
+      if (state !== 'available' && state !== 'structured') throw owner.fail(conflict());
+      state = 'structured';
+    },
+    claim(value, init) {
+      if (owners.get(value) !== owner || state !== 'available') throw owner.fail(conflict());
+      transport.validate(init);
+      state = 'reserved';
+    },
+    async readTextChunk(budget) {
+      if (!transport.readTextChunk || !['available', 'reading'].includes(state)) throw owner.fail(conflict());
+      state = 'reading';
+      try { return await transport.readTextChunk(budget); } catch (error) { throw owner.fail(error); }
+    },
+    async forward(url, init, execution) {
+      if (state !== 'reserved') throw failure || conflict();
+      state = 'forwarding';
+      try {
+        const response = await transport.forward(url, init, execution);
+        state = 'closed';
+        return response;
+      } catch (error) { throw owner.fail(error); }
+    },
+    async close() {
+      if (disposed) return;
+      disposed = true;
+      if (state !== 'closed' && state !== 'failed') state = 'cancelled';
+      // Provider cleanup is best effort, must observe rejection, and never
+      // delay an execution or grant application authority.
+      try { Promise.resolve(transport.cancel(failure)).catch(() => {}); } catch (_) {}
+    },
+    get failure() { return failure; },
+    get responseSignal() { return transport.responseSignal; }
+  });
+  owners.set(marker, owner);
+  return owner;
+}
+
+function isIncomingBody(value) { return value !== null && typeof value === 'object' && owners.has(value); }
+function forwardIncomingBody(value, url, init, execution) {
+  const owner = owners.get(value);
+  if (!owner) throw conflict();
+  return owner.forward(url, init, execution);
+}
+
+module.exports = { createIncomingBodyOwnership, isIncomingBody, forwardIncomingBody };

package/src/internal/package-runtime.js

@@ -10,14 +10,23 @@ const {
 const PACKAGE_RUNTIME_BRIDGE_VERSION = 'pulse.package-runtime-bridge.v1';
 const PACKAGE_SCHEMA_CODEC_BRIDGE_VERSION = 'pulse.first-party-embedded-schema-codec-bridge.v1';
 const DEFAULT_MAX_PAYLOAD_BYTES = 256 * 1024;
+// Fixed first-party text operations alone admit 2 MiB plus worst-case JSON
+// escaping and 64 KiB metadata. Other package operations retain their bounds.
+const TEXT_MAX_PAYLOAD_BYTES = 6 * 2097152 + 65536;
 const DEFAULT_MAX_PAYLOAD_DEPTH = 32;
 const DEFAULT_MAX_PAYLOAD_ENTRIES = 4096;
 
 const PACKAGE_CONTEXTS = new WeakMap();
 
 const TRUSTED_PACKAGE_EFFECT_CATALOG = Object.freeze({
+  '@pulse-compute/crypto': Object.freeze({
+    contractId: 'pulse.crypto', providerKind: 'crypto', operations: Object.freeze({
+      digestText: Object.freeze({ kind: 'crypto.digestText', capability: 'crypto.digestText', result: 'text-digest-result' })
+    })
+  }),
   '@pulse-compute/s3': Object.freeze({
     contractId: 'pulse.s3', providerKind: 's3', operations: Object.freeze({
+      getBody: Object.freeze({ kind: 's3.getBody', capability: 's3.getBody', result: 'opaque-response' }),
       head: Object.freeze({ kind: 's3.head', capability: 's3.head', result: 's3-head-result' }),
       getText: Object.freeze({ kind: 's3.getText', capability: 's3.getText', result: 's3-get-text-result' }),
       putText: Object.freeze({ kind: 's3.putText', capability: 's3.putText', result: 's3-put-text-result' })
@@ -49,6 +58,7 @@ const TRUSTED_PACKAGE_EFFECT_CATALOG = Object.freeze({
     contractId: 'pulse.jwt',
     providerKind: 'jwt',
     operations: Object.freeze({
+      sign: Object.freeze({ kind: 'jwt.sign', capability: 'jwt.sign', result: 'string' }),
       verify: Object.freeze({
         kind: 'jwt.verify',
         capability: 'jwt.verify',
@@ -586,7 +596,12 @@ function createPackageRuntime(input) {
         operation,
         capability: declared.capability,
         result: declared.result,
-        payload: clonePackageEffectPayload(payload)
+        payload: clonePackageEffectPayload(payload, {
+          // The sign payload adds one envelope level around its 32-level claims.
+          maxDepth: declared.kind === 'jwt.sign' ? DEFAULT_MAX_PAYLOAD_DEPTH + 1 : DEFAULT_MAX_PAYLOAD_DEPTH,
+          maxBytes: declared.kind === 'crypto.digestText' || declared.kind === 's3.putText'
+            ? TEXT_MAX_PAYLOAD_BYTES : DEFAULT_MAX_PAYLOAD_BYTES
+        })
       }, projector);
     }
   });

package/src/internal/redaction.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { PulseRuntimeContractError, PulseUnhandledError } = require('./errors.js');
+const { PulseRuntimeContractError, PulseUnhandledError, isApplicationError } = require('./errors.js');
 
 const REDACTED_VALUE = '<redacted>';
 const CIRCULAR_VALUE = '<circular>';
@@ -121,9 +121,12 @@ function createRedactionState(initialValues = []) {
         : redactValue(descriptor.value, key, seen, depth + 1);
       Object.defineProperty(output, outputKey, {
         enumerable: true,
-        configurable: false,
+        // Different private keys can redact to the same spelling. Their value
+        // association is lost, so collapse the collision to a redacted marker.
+        // Properties remain replaceable only until the completed record freezes.
+        configurable: true,
         writable: false,
-        value: outputValue
+        value: Object.prototype.hasOwnProperty.call(output, outputKey) ? REDACTED_VALUE : outputValue
       });
     }
     return Object.freeze(output);
@@ -142,6 +145,10 @@ function createRedactionState(initialValues = []) {
     const rawMessage = ownDataValue(error, 'message');
     const rawName = ownDataValue(error, 'name');
     const rawCode = ownDataValue(error, 'code');
+    // Admitted discriminators are fixed protocol vocabulary, not private text.
+    // Short KV keys/array indexes must not change Router recovery decisions.
+    const stableCode = isApplicationError(error) ? rawCode
+      : error instanceof PulseUnhandledError ? 'PULSE_RUNTIME_UNHANDLED_ERROR' : undefined;
     const message = redactString(typeof rawMessage === 'string' ? rawMessage : 'Pulse runtime failure.');
     const causeDescriptor = Object.getOwnPropertyDescriptor(error, 'cause');
     const cause = causeDescriptor && Object.prototype.hasOwnProperty.call(causeDescriptor, 'value')
@@ -167,6 +174,10 @@ function createRedactionState(initialValues = []) {
     }
 
     const reserved = new Set(['name', 'message', 'stack', 'cause', 'detail']);
+    if (stableCode !== undefined) {
+      reserved.add('code');
+      Object.defineProperty(safe, 'code', { enumerable: true, configurable: true, writable: false, value: stableCode });
+    }
     for (const key of Reflect.ownKeys(error).slice(0, MAX_REDACTION_ENTRIES)) {
       if (typeof key !== 'string' || reserved.has(key)) continue;
       const descriptor = Object.getOwnPropertyDescriptor(error, key);

package/src/internal/request-budget.js

@@ -0,0 +1,103 @@
+'use strict';
+
+const { PulseRuntimeContractError } = require('./errors.js');
+const budgets = new WeakSet();
+
+function normalizeRequestDuration(value) {
+  if (value === undefined) return undefined;
+  if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 1 || value > 30000) {
+    throw new PulseRuntimeContractError('PULSE_REQUEST_DURATION_INVALID', 'Request maxDurationMs must be an integer from 1 through 30000.');
+  }
+  return value;
+}
+
+// Host-only authority. One budget is passed through adapters; nested calls must
+// never restart it. Wall time and inbound headers are deliberately not inputs.
+function createRequestBudget(options = {}) {
+  if (options.requestBudget !== undefined) {
+    if (!budgets.has(options.requestBudget)) throw new TypeError('Invalid host request budget.');
+    return options.requestBudget;
+  }
+  const duration = normalizeRequestDuration(options.maxDurationMs);
+  const clock = options.requestClock || {
+    now: () => performance.now(),
+    setTimeout: (callback, ms) => setTimeout(callback, ms),
+    clearTimeout: handle => clearTimeout(handle)
+  };
+  const controller = new AbortController();
+  let timer, closed = false, last = -Infinity;
+  const read = () => {
+    let value;
+    try { value = clock.now(); } catch (_) { value = NaN; }
+    if (!Number.isFinite(value) || value < last) {
+      controller.abort(new PulseRuntimeContractError('PULSE_REQUEST_CLOCK_INVALID', 'Request monotonic clock failed or regressed.'));
+      controller.signal.throwIfAborted();
+    }
+    last = value;
+    return value;
+  };
+  const deadline = duration === undefined ? undefined : read() + duration;
+  const expire = () => controller.abort(new PulseRuntimeContractError('PULSE_REQUEST_DEADLINE_EXCEEDED', 'Pulse request exceeded its total execution deadline.'));
+  const signals = [...new Set([options.signal, options.requestSignal].filter(Boolean))];
+  const listeners = new Set(signals.map(signal => {
+    const abort = () => controller.abort(signal.reason);
+    if (signal.aborted) abort();
+    else signal.addEventListener('abort', abort, { once: true });
+    return () => signal.removeEventListener('abort', abort);
+  }));
+  const budget = Object.freeze({
+    signal: controller.signal,
+    deadlineMonotonicMs: deadline,
+    clock,
+    check() {
+      if (closed) throw new PulseRuntimeContractError('PULSE_REQUEST_EXECUTION_CLOSED', 'Pulse request execution is closed.');
+      if (!controller.signal.aborted && deadline !== undefined && read() >= deadline) expire();
+      controller.signal.throwIfAborted();
+    },
+    onAbort(callback) {
+      if (controller.signal.aborted || closed) { callback(); return () => {}; }
+      const remove = () => {
+        controller.signal.removeEventListener('abort', callback);
+        listeners.delete(remove);
+      };
+      listeners.add(remove);
+      controller.signal.addEventListener('abort', callback, { once: true });
+      return remove;
+    },
+    remainingMs() { budget.check(); return deadline === undefined ? Infinity : Math.max(0, deadline - last); },
+    race(value) {
+      // Always observe the pending work, including an already-expired request.
+      const pending = Promise.resolve(value);
+      return new Promise((resolve, reject) => {
+        const abort = () => { cleanup(); reject(controller.signal.reason); };
+        controller.signal.addEventListener('abort', abort, { once: true });
+        const cleanup = () => controller.signal.removeEventListener('abort', abort);
+        pending.then(result => {
+          cleanup();
+          try { budget.check(); resolve(result); } catch (error) { reject(error); }
+        }, error => { cleanup(); reject(error); });
+        try { budget.check(); } catch (error) { cleanup(); reject(error); }
+      });
+    },
+    close() {
+      if (closed) return;
+      closed = true;
+      if (timer !== undefined) clock.clearTimeout(timer);
+      for (const remove of listeners) remove();
+      listeners.clear();
+    }
+  });
+  budgets.add(budget);
+  if (deadline !== undefined && !controller.signal.aborted) {
+    const schedule = () => {
+      try {
+        budget.check();
+        timer = clock.setTimeout(schedule, budget.remainingMs());
+      } catch (_) { /* check has already revoked execution authority */ }
+    };
+    timer = clock.setTimeout(schedule, duration);
+  }
+  return budget;
+}
+
+module.exports = { createRequestBudget, normalizeRequestDuration };