@botiverse/porthole 0.2.0 → 0.2.2

package/src/conformance/served.ts

@@ -58,20 +58,20 @@ export interface ServedConformanceHost {
   /** How many requests reached `canary(name)`. */
   canaryHits(name: string): Promise<number>;
   /** A served shell (domain isolation) for `scope`. */
-  shell(scope: string): InstanceRef;
+  shell(scope: string): InstanceRef | Promise<InstanceRef>;
   /**
    * A url-mode app for `scope`: its page loads a script from its own origin that sets
    * `document.documentElement.dataset.app = "ready"`.
    */
-  app(scope: string): InstanceRef;
+  app(scope: string): InstanceRef | Promise<InstanceRef>;
   /**
    * A stored artifact page (domain isolation) for `scope`: version `"1"` and `"2"` of one page,
    * each with `<main id="artifact">version N</main>` and a script that records
    * `document.documentElement.dataset.rtc = typeof RTCPeerConnection`.
    */
-  artifact(scope: string, version: "1" | "2"): InstanceRef;
+  artifact(scope: string, version: "1" | "2"): InstanceRef | Promise<InstanceRef>;
   /** The MCP Apps sandbox proxy (domain isolation) for `scope`, opening the view's `egress`. */
-  proxy(scope: string, egress?: EgressConfig): InstanceRef;
+  proxy(scope: string, egress?: EgressConfig): InstanceRef | Promise<InstanceRef>;
 }
 
 export interface ServedSuiteOptions {
@@ -198,8 +198,11 @@ export function servedTests(
       ["url", (scope: string) => host.app(scope)],
     ] as const;
     // A served shell draws (and has a height to click in) once its host gives it content.
-    const showMode = (page: Page, mode: "domain" | "url", instance: InstanceRef) =>
-      host.show(page, instance, mode === "domain" ? { content: SHELL_CONTENT } : {});
+    const showMode = async (
+      page: Page,
+      mode: "domain" | "url",
+      instance: InstanceRef | Promise<InstanceRef>,
+    ) => host.show(page, await instance, mode === "domain" ? { content: SHELL_CONTENT } : {});
 
     for (const [mode, instance] of modes) {
       define(
@@ -298,7 +301,9 @@ export function servedTests(
       "served.domain.address",
       "a served frame's address is its own, carrying at most Porthole's ticket: never the app's",
       async ({ page }) => {
-        const display = await host.show(page, host.shell("address"), { content: SHELL_CONTENT });
+        const display = await host.show(page, await host.shell("address"), {
+          content: SHELL_CONTENT,
+        });
         const frame = await display.frame();
         const seen = await frame.evaluate(() => ({
           origin: location.origin,
@@ -316,13 +321,19 @@ export function servedTests(
       "served.domain.storage-scope",
       "storage persists within a scope and is never shared across scopes",
       async ({ page }) => {
-        const first = await host.show(page, host.shell("scope-a"), { content: SHELL_CONTENT });
+        const first = await host.show(page, await host.shell("scope-a"), {
+          content: SHELL_CONTENT,
+        });
         await (await first.frame()).evaluate(() => localStorage.setItem("kept", "a"));
         await first.destroy();
-        const again = await host.show(page, host.shell("scope-a"), { content: SHELL_CONTENT });
+        const again = await host.show(page, await host.shell("scope-a"), {
+          content: SHELL_CONTENT,
+        });
         expect(await (await again.frame()).evaluate(() => localStorage.getItem("kept"))).toBe("a");
         expect(again.origin).toBe(first.origin);
-        const other = await host.show(page, host.shell("scope-b"), { content: SHELL_CONTENT });
+        const other = await host.show(page, await host.shell("scope-b"), {
+          content: SHELL_CONTENT,
+        });
         expect(other.origin).not.toBe(first.origin);
         expect(await (await other.frame()).evaluate(() => localStorage.getItem("kept"))).toBeNull();
       },
@@ -332,8 +343,8 @@ export function servedTests(
       "served.artifact.versions",
       "each version of a page shows as stored, on its scope's origin, hardened before it runs",
       async ({ page }) => {
-        const one = await host.show(page, host.artifact("artifact-scope", "1"));
-        const two = await host.show(page, host.artifact("artifact-scope", "2"));
+        const one = await host.show(page, await host.artifact("artifact-scope", "1"));
+        const two = await host.show(page, await host.artifact("artifact-scope", "2"));
         expect(two.origin).toBe(one.origin);
         for (const [display, version] of [
           [one, "1"],
@@ -352,7 +363,7 @@ export function servedTests(
       "served.domain.ticket-once",
       "a ticket opens its content once; without it there is nothing",
       async ({ page, browserName }) => {
-        const location = await host.locate(host.shell("ticket-once"));
+        const location = await host.locate(await host.shell("ticket-once"));
         const first = await page.goto(location.url);
         expect(first?.status()).toBe(200);
         // A fresh browser state: no cookie, only the used ticket.
@@ -372,7 +383,7 @@ export function servedTests(
       "served.domain.frame-ancestors",
       "only the host's origins may frame content",
       async ({ page }) => {
-        const location = await host.locate(host.shell("foreign"));
+        const location = await host.locate(await host.shell("foreign"));
         await host.frameFromForeignOrigin(page, location.url);
         await page.waitForTimeout(SETTLE_MS);
         for (const frame of page.frames().slice(1)) {
@@ -400,7 +411,9 @@ export function servedTests(
       "served.domain.egress",
       "the CSP in the document's headers closes egress; only what the config opens to any https site (images, media) reaches it",
       async ({ page }) => {
-        const display = await host.show(page, host.shell("egress"), { content: SHELL_CONTENT });
+        const display = await host.show(page, await host.shell("egress"), {
+          content: SHELL_CONTENT,
+        });
         const frame = await display.frame();
         const kinds = ["fetch", "img", "media", "script", "style", "frame"] as const;
         const urls = Object.fromEntries(
@@ -494,7 +507,7 @@ export function servedTests(
       "served.proxy.view",
       "the sandbox proxy becomes the view, hardened, talking to its host directly",
       async ({ page }) => {
-        const display = await host.show(page, host.proxy("proxy-view"));
+        const display = await host.show(page, await host.proxy("proxy-view"));
         await proxyReady(display);
         const canary = await host.canary("proxy-undeclared");
         await display.post(resourceReady(PROBE_VIEW(canary)));
@@ -515,7 +528,7 @@ export function servedTests(
       "served.proxy.parent-only",
       "the sandbox proxy takes a view only from its host",
       async ({ page }) => {
-        const display = await host.show(page, host.proxy("proxy-parent"));
+        const display = await host.show(page, await host.proxy("proxy-parent"));
         await proxyReady(display);
         const frame = await display.frame();
         await frame.evaluate(
@@ -534,7 +547,7 @@ export function servedTests(
         const canary = await host.canary("proxy-declared");
         const display = await host.show(
           page,
-          host.proxy("proxy-egress", { connect: [new URL(canary).origin] }),
+          await host.proxy("proxy-egress", { connect: [new URL(canary).origin] }),
         );
         await proxyReady(display);
         await display.post(resourceReady(PROBE_VIEW(canary)));
@@ -548,7 +561,7 @@ export function servedTests(
       "served.url.ticket",
       "an app shows nothing to a browser without its ticket's cookie",
       async ({ page }) => {
-        const location = await host.locate(host.app("url-ticket"));
+        const location = await host.locate(await host.app("url-ticket"));
         // A fresh browser: no cookie of the content's, none of the app's. Porthole refuses it, or
         // (redirect entry, P068) hands it to the app's authorize route, which asks it to sign in.
         const fresh = await page.context().browser()!.newContext();
@@ -570,7 +583,7 @@ export function servedTests(
       "served.url.tab",
       "an app opened on a tab of its own runs, its requests riding on its cookie",
       async ({ page }) => {
-        const location = await host.locate(host.app("url-tab"));
+        const location = await host.locate(await host.app("url-tab"));
         await page.goto(location.url);
         await expect(page.locator("html")).toHaveAttribute("data-app", "ready");
       },
@@ -583,7 +596,7 @@ export function servedTests(
         // Measured (P025): WebKit keeps no cookie in a cross-site frame, partitioned or not, so a
         // framed app's subresources are refused there; such hosts open the app on a tab.
         typed.fail(browserName === "webkit", "WebKit keeps no cookie in a cross-site frame");
-        const display = await host.show(page, host.app("url-framed"));
+        const display = await host.show(page, await host.app("url-framed"));
         const frame = await display.frame();
         await expect
           .poll(() => frame.evaluate(() => document.documentElement.dataset.app ?? null), {

package/src/guide/guide.ts

@@ -157,7 +157,7 @@ function widget(c: Context): string {
     "",
     what,
     "",
-    `Where it runs: ${fills ? `in a sandboxed frame that fills the viewer, about ${layout.narrowWidthPx} px wide on a phone (${layout.minWidthPx} on a small one) and as wide as the window on a desktop` : `in a sandboxed frame as wide as the column it sits in, about ${layout.narrowWidthPx} px on a phone (${layout.minWidthPx} on a small one) and ${layout.wideWidthPx} on a desktop`}; the same ${noun} is read on both, so never write for one of them. Design for ${layout.narrowWidthPx} first; where the layout depends on the width, read it as it runs (the ${fills ? "window's innerWidth, again on resize" : "box's clientWidth, again from a ResizeObserver"}). ${said("layout")} ${said("theme")} It runs again each time it is shown${loadsScripts(config) ? ": pin library versions" : ""}.`,
+    `Where it runs: ${fills ? `in a sandboxed frame that fills the app's viewer (often smaller than the window: toolbars and side panels take room), about ${layout.narrowWidthPx} px wide on a phone (${layout.minWidthPx} on a small one) and wider on a desktop` : `in a sandboxed frame as wide as the column it sits in, about ${layout.narrowWidthPx} px on a phone (${layout.minWidthPx} on a small one) and ${layout.wideWidthPx} on a desktop`}; the same ${noun} is read on both, so never write for one of them. Design for ${layout.narrowWidthPx} first; where the layout depends on the width, read it as it runs (the ${fills ? "frame's own innerWidth, again on resize" : "box's clientWidth, again from a ResizeObserver"}). ${said("layout")} ${said("theme")} It runs again each time it is shown${loadsScripts(config) ? ": pin library versions" : ""}.`,
     "",
     "Sizes that read on a phone:",
     c.when(
@@ -179,7 +179,7 @@ function widget(c: Context): string {
       : null,
     "",
     themeless
-      ? `Colors: these variables hold the app's light palette; use them, or colors of your own. Give the ${noun} its own background.`
+      ? `Colors: these variables hold the app's palette; use them, or colors of your own. Give the ${noun} its own background.`
       : optsIn(config)
         ? `Colors, for a ${noun} that declares light and dark: every color from these variables, never hard-coded, so both work; its own background then stays transparent (it sits on the app's surface).`
         : `Colors: every color from these variables, never hard-coded, so light and dark both work. The ${noun}'s own background is transparent (it sits on the app's surface).`,
@@ -204,7 +204,7 @@ function widget(c: Context): string {
     otherVariables(c) === "" ? null : `- Also: ${otherVariables(c)}`,
     "",
     exampleFits(c, GUIDE_EXAMPLES.stats)
-      ? `Cards that read in both themes, and wrap on a phone:\n${GUIDE_EXAMPLES.stats}\n`
+      ? `Cards that ${themeless ? "" : "read in both themes, and "}wrap on a phone:\n${GUIDE_EXAMPLES.stats}\n`
       : null,
     c.when(
       `Don't use --color-background-primary as a card's fill: it is the app's own surface, so a card on it vanishes.`,
@@ -445,7 +445,7 @@ export function generateToolDescription(config: PortholeConfig): string {
   const read =
     config.guide.guideToolName === undefined
       ? ""
-      : ` Read ${config.guide.guideToolName} once before your first ${c.noun}${config.mode === "inline" ? " (topic chart before your first chart)" : ""}.`;
+      : ` Call ${config.guide.guideToolName} once before your first ${c.noun}${config.mode === "inline" ? " (topic chart before your first chart)" : ""}.`;
   const where =
     layout.kind === "fill"
       ? `It fills the viewer in a sandbox about ${layout.narrowWidthPx} px wide on a phone, from the same code on every screen`

package/src/guide/limits.ts

@@ -95,7 +95,7 @@ export function manualLimits(config: PortholeConfig, network: string): ManualLim
   add(
     "layout",
     config.layout.kind === "fill"
-      ? "It is as tall as the window: the page scrolls itself, and position: fixed and sticky work."
+      ? "It is as tall as the viewer, not the window: the page scrolls itself, and position: fixed and sticky work."
       : declared.has("resize")
         ? `Its height follows its content, at most ${config.limits.maxHeightPx.toLocaleString("en-US")} px (then it scrolls inside).`
         : "Its height is fixed by the app: keep it short, or let it scroll inside.",

package/src/node/index.ts

@@ -40,8 +40,15 @@ export interface NodeHost {
   readonly upgrade: UpgradeListener;
 }
 
-/** The Node request as a fetch `Request`: an absolute-form target kept as it came (P056). */
-export function toRequest(request: IncomingMessage, scheme: "https" | "http"): Request {
+/**
+ * The Node request as a fetch `Request`: an absolute-form target kept as it came (P056). `signal`
+ * (`nodeHost` gives one, aborted when the client goes away) lets an upstream stop its work.
+ */
+export function toRequest(
+  request: IncomingMessage,
+  scheme: "https" | "http",
+  signal?: AbortSignal,
+): Request {
   const headers = new Headers();
   for (const [name, value] of Object.entries(request.headers)) {
     for (const each of Array.isArray(value) ? value : value === undefined ? [] : [value]) {
@@ -55,10 +62,21 @@ export function toRequest(request: IncomingMessage, scheme: "https" | "http"): R
   const method = request.method ?? "GET";
   const body =
     method === "GET" || method === "HEAD" ? null : (Readable.toWeb(request) as ReadableStream);
-  return new Request(url, { method, headers, body, duplex: "half" } as RequestInit);
+  return new Request(url, {
+    method,
+    headers,
+    body,
+    duplex: "half",
+    ...(signal === undefined ? {} : { signal }),
+  } as RequestInit);
 }
 
-/** Writes a fetch `Response` to a Node response, cookies one header each. */
+/**
+ * Writes a fetch `Response` to a Node response, cookies one header each (P070): it waits for the
+ * socket to drain before reading on (a slow client never makes it buffer the body), cancels the
+ * body when the client goes away (an event stream ends with the page that asked for it), and on
+ * an error mid-body destroys the response rather than end it looking complete.
+ */
 export async function sendResponse(response: ServerResponse, answer: Response): Promise<void> {
   const headers: Record<string, string | string[]> = {};
   for (const [name, value] of answer.headers) {
@@ -75,10 +93,45 @@ export async function sendResponse(response: ServerResponse, answer: Response):
     response.end();
     return;
   }
-  for await (const chunk of answer.body as unknown as AsyncIterable<Uint8Array>) {
-    response.write(chunk);
+  const reader = answer.body.getReader();
+  let gone = false;
+  const leave = () => {
+    gone = true;
+    reader.cancel().catch(() => undefined);
+  };
+  // The client went away before the end: stop reading, and let the body's source know.
+  response.once("close", () => {
+    if (!response.writableFinished) {
+      leave();
+    }
+  });
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done || gone) {
+        break;
+      }
+      if (!response.write(value)) {
+        await new Promise<void>((resolve) => {
+          const on = () => {
+            response.off("drain", on);
+            response.off("close", on);
+            resolve();
+          };
+          response.on("drain", on);
+          response.on("close", on);
+        });
+      }
+    }
+  } catch (error) {
+    // The head is sent: a body cut short must not look whole.
+    leave();
+    response.destroy(error instanceof Error ? error : new Error(String(error)));
+    return;
+  }
+  if (!gone) {
+    response.end();
   }
-  response.end();
 }
 
 /** Whether a Node request's Host (or absolute-form target) is under the content domain. */
@@ -110,7 +163,15 @@ export function nodeHost<V>(content: ContentHost<V>, app: NodeHostOptions): Node
         app.request(request, response);
         return;
       }
-      content.fetch(toRequest(request, scheme())).then(
+      // Aborted when the client goes away first, so an upstream (a proxied app's event stream)
+      // stops with it.
+      const gone = new AbortController();
+      response.once("close", () => {
+        if (!response.writableFinished) {
+          gone.abort();
+        }
+      });
+      content.fetch(toRequest(request, scheme(), gone.signal)).then(
         (answer) => {
           if (answer === null) {
             // A label the app routes itself.
@@ -120,9 +181,11 @@ export function nodeHost<V>(content: ContentHost<V>, app: NodeHostOptions): Node
           return sendResponse(response, answer);
         },
         () => {
-          if (!response.headersSent) {
-            response.writeHead(500, { "content-type": "text/plain; charset=utf-8" });
+          if (response.headersSent) {
+            response.destroy();
+            return;
           }
+          response.writeHead(500, { "content-type": "text/plain; charset=utf-8" });
           response.end("Content couldn't be served.");
         },
       );

package/src/server/host.ts

@@ -47,6 +47,12 @@ export interface HealthOptions {
   /** How the check is fetched (default: `fetch`; on Node, `nodeProbe()`). */
   readonly probe?: HealthProbe;
   readonly timeoutMs?: number;
+  /**
+   * Told each time the gate's state changes (P070): checking to healthy or unhealthy, and every
+   * flip between them, with the new view. `meta().served` changes with it, so an app that tells
+   * its clients whether frames are served pushes it from here.
+   */
+  readonly onChange?: (view: ContentHealthView) => void;
 }
 
 /** Where content stands, for the app's own meta and logs. */
@@ -95,7 +101,13 @@ export interface ContentHostOptions<V> {
    * that says which scope a label names (`prefixedName` does).
    */
   readonly name?: Naming;
-  /** Labels the app routes itself (`p-*` previews): `fetch` hands them back. */
+  /**
+   * Labels the app itself serves on the content domain, which `fetch` hands back (null) so the
+   * app's own routes answer there: Ferry's `p-*` previews, another server's namespace it routes
+   * on. Not for labels nothing should answer: a label the naming never makes, the bare domain
+   * and an address `entry.at` says names nothing all get Porthole's 404, with nothing to list
+   * (P070). The health label is reserved by the gate itself.
+   */
   readonly reserved?: readonly string[] | ((label: string) => boolean);
   /**
    * Policy 1, mapping: the instance a request proposes (`{ instance }`), as the app means it,
@@ -145,22 +157,49 @@ export interface EntryOptions<V> {
   /** The app's authorize route (`ContentHost.authorize`), an absolute URL on an app origin. */
   readonly authorizeUrl: string;
   /**
-   * Policy 1 for a clean address: the instance a scope's path means, or null (404). The path is
-   * the address's pathname; its query rides along but never chooses the instance.
+   * Policy 1 for a clean address: the instance a scope's path means, or null/undefined: nothing
+   * (404). The path is the address's pathname; its query rides along but never chooses the
+   * instance. Asked twice: on the content origin, with no viewer, whether the address names
+   * anything at all (nothing: Porthole's 404 there, never the app's sign-in, P070); then at the
+   * authorize route with the viewer. Say what exists the same way for both; `access` says who
+   * may see it.
    */
   readonly at: (
     scope: string,
     path: string,
     viewer: V | null,
     request: Request,
-  ) => Awaitable<InstanceRef | null>;
+  ) => Awaitable<InstanceRef | null | undefined>;
   /**
    * The app's own sign-in, which comes back to `returnTo` (the authorize URL) once signed in.
-   * Only ever on a tab: in a frame, the person is asked to open a new tab instead.
+   * Only ever on a tab: in a frame, the person is asked to open a new tab instead. `entry` is the
+   * address being opened, decoded (P070).
    */
-  readonly signIn: (returnTo: string, request: Request) => Awaitable<Response>;
-  /** The app's refusal page on a tab (a frame gets Porthole's plain one). Default: Porthole's. */
-  readonly refusal?: (status: 403 | 404, request: Request) => Awaitable<Response>;
+  readonly signIn: (returnTo: string, request: Request, entry: EntryContext) => Awaitable<Response>;
+  /**
+   * The app's refusal page on a tab (a frame gets Porthole's plain one), for the address in
+   * `entry`. Nothing (null, undefined): Porthole's own (P070).
+   */
+  readonly refusal?: (
+    status: 403 | 404,
+    request: Request,
+    entry: EntryContext,
+  ) => Awaitable<Response | null | undefined>;
+}
+
+/** The clean address a redirect entry is opening, as its authorize route decoded it (P070). */
+export interface EntryContext {
+  /** The address's label, and the scope it names (null: one the naming never makes). */
+  readonly label: string;
+  readonly scope: string | null;
+  /** The path (and query) asked for. */
+  readonly path: string;
+  /** The clean address itself: where the person comes back to. */
+  readonly url: string;
+  /** The instance the path names for this viewer (`entry.at`), or null. */
+  readonly instance: InstanceRef | null;
+  /** Whether it was asked from a frame. */
+  readonly framed: boolean;
 }
 
 export interface ContentHost<V> {
@@ -294,7 +333,21 @@ export function createContentHost<V>(options: ContentHostOptions<V>): ContentHos
         ...(options.upstream === undefined ? {} : { upstream: options.upstream }),
         ...(options.entry === undefined
           ? {}
-          : { entry: { authorizeUrl: options.entry.authorizeUrl } }),
+          : {
+              entry: {
+                authorizeUrl: options.entry.authorizeUrl,
+                // Whether a clean address names anything, before a browser is sent away (P070).
+                named: async (label: string, path: string, request: Request) => {
+                  const scope = options.name?.scopeOf?.(label) ?? null;
+                  const at = options.entry?.at;
+                  return (
+                    scope !== null &&
+                    at !== undefined &&
+                    (await at(scope, path, null, request)) != null
+                  );
+                },
+              },
+            }),
         ...(options.authorize === undefined
           ? {}
           : {
@@ -386,6 +439,13 @@ export function createContentHost<V>(options: ContentHostOptions<V>): ContentHos
             : { evt: "porthole.content.unhealthy", reason },
         );
       }
+      if (before.state !== view.state) {
+        try {
+          gate.onChange?.(view);
+        } catch {
+          // The app's listener failing changes nothing here.
+        }
+      }
       running = null;
       schedule();
       return view;
@@ -622,13 +682,22 @@ export function createContentHost<V>(options: ContentHostOptions<V>): ContentHos
           const instance =
             scope === null
               ? null
-              : await entry.at(
+              : ((await entry.at(
                   scope,
                   new URL(state.path, "https://x.invalid").pathname,
                   viewer,
                   request,
-                );
+                )) ?? null);
           const grant = instance === null ? null : await options.access(instance, viewer, request);
+          // The address being opened, decoded, for the app's sign-in and refusal pages.
+          const context: EntryContext = {
+            label: state.label,
+            scope,
+            path: state.path,
+            url: clean,
+            instance,
+            framed,
+          };
           if (instance === null || grant === null) {
             if (viewer === null) {
               // The app's sign-in never shows in a frame: the person opens a tab for it.
@@ -640,11 +709,12 @@ export function createContentHost<V>(options: ContentHostOptions<V>): ContentHos
                     "sign-in",
                     method,
                   )
-                : await entry.signIn(request.url, request);
+                : await entry.signIn(request.url, request, context);
             }
             const status = instance === null ? 404 : 403;
-            if (!framed && entry.refusal !== undefined) {
-              return await entry.refusal(status, request);
+            const own = framed ? null : await entry.refusal?.(status, request, context);
+            if (own !== null && own !== undefined) {
+              return own;
             }
             return status === 404
               ? appPage(404, "Not found", "There is nothing here.", "not-found", method)

package/src/server/index.ts

@@ -40,6 +40,7 @@ export {
   type ContentHost,
   type ContentHostEvent,
   type ContentHostOptions,
+  type EntryContext,
   type EntryOptions,
   type ContentMeta,
   type HealthOptions,
@@ -62,6 +63,9 @@ export {
 } from "./tickets.ts";
 export { FRAME_STATUS_METHOD } from "../isolation/types.ts";
 export { isHostLabel, prefixedName, type Naming } from "./naming.ts";
+// The types an app's callbacks take and give (P070).
+export type { PortholeConfig } from "../config/schema.ts";
+export type { FrameLocation, InstanceRef, ServedDocument } from "../isolation/types.ts";
 export { proxyTo, type ProxyOptions } from "./proxy.ts";
 export type {
   Access,

package/src/server/pages.ts

@@ -22,8 +22,22 @@ export const ENTER_SCRIPT_PATH = "/__porthole/enter.js";
 /** Answers 204 when the request carries a good session for its origin's app, 401 otherwise. */
 export const SESSION_PATH = "/__porthole/session";
 
+/**
+ * Tells the page that frames this one how loading went, at each web host origin. A desktop app's
+ * own scheme (`ferry://app`) is no target origin a browser takes (postMessage throws), so where
+ * the host origins hold one, and the parent isn't known to be a web host origin, the word goes to
+ * the parent as `*`: these pages' `frame-ancestors` already hold their parent to the host origins,
+ * and what they say is no secret (P070). One origin failing never stops the page.
+ */
 const say = (): string =>
-  `const say = (params) => { if (window.parent === window) return; for (const origin of hosts) window.parent.postMessage({ jsonrpc: "2.0", method: ${JSON.stringify(FRAME_STATUS_METHOD)}, params }, origin); };`;
+  `const say = (params) => {
+    if (window.parent === window) return;
+    const message = { jsonrpc: "2.0", method: ${JSON.stringify(FRAME_STATUS_METHOD)}, params };
+    const web = hosts.filter((origin) => origin.startsWith("https://") || origin.startsWith("http://"));
+    for (const origin of web) { try { window.parent.postMessage(message, origin); } catch (_) {} }
+    const parent = location.ancestorOrigins && location.ancestorOrigins.length > 0 ? location.ancestorOrigins[0] : null;
+    if (web.length < hosts.length && (parent === null || !web.includes(parent))) { try { window.parent.postMessage(message, "*"); } catch (_) {} }
+  };`;
 
 /** Tells the host the page is blocked, and why (from the page's data attributes). */
 const STATUS_SCRIPT = `(() => {

package/src/server/proxy.ts

@@ -120,6 +120,8 @@ export function proxyTo(options: ProxyOptions = {}): Upstream {
       method,
       headers: upstreamRequestHeaders(request.headers, access.origin, target),
       redirect: "manual",
+      // The browser went away (`nodeHost` aborts it): so does the relay (P070).
+      signal: request.signal,
       ...(hasBody ? { body: request.body, duplex: "half" } : {}),
     });
     return new Response(method === "HEAD" ? null : answer.body, {

package/src/server/server.ts

@@ -682,8 +682,17 @@ export function createServer(options: ServerOptions): PortholeServer {
    * signed state, the browser holding the state's nonce in a cookie of this origin. A path just
    * entered whose cookie still didn't come back is a browser that keeps none here: no loop.
    */
-  function beginEntry(request: Request, url: URL, label: string, to: URL): Response {
+  async function beginEntry(request: Request, url: URL, label: string, to: URL): Promise<Response> {
     const method = request.method.toUpperCase();
+    // An address that names nothing is nothing here (P070): never a trip to the app's sign-in.
+    const scopeOf = content.name?.scopeOf;
+    const named = options.entry?.named;
+    if (
+      (scopeOf !== undefined && scopeOf(label) === null) ||
+      (named !== undefined && !(await named(label, url.pathname, request)))
+    ) {
+      return page(404, "Nothing here", "This address names no content.", method);
+    }
     if (method !== "GET" && method !== "HEAD") {
       return page(
         401,
@@ -1148,7 +1157,7 @@ export function createServer(options: ServerOptions): PortholeServer {
             return await serveAccess(request, entered, null);
           }
           if (options.upstream === undefined || accessOf(request, label, null) === null) {
-            return beginEntry(request, url, label, authorizeUrl);
+            return await beginEntry(request, url, label, authorizeUrl);
           }
         }
         // Without an upstream, only Porthole's own paths are served here: any other is nothing.

package/src/server/types.ts

@@ -1,5 +1,6 @@
 import type { PortholeConfig } from "../config/schema.ts";
 import type { FrameLocation, InstanceRef } from "../isolation/types.ts";
+import type { Naming } from "./naming.ts";
 
 export interface ContentDomain {
   /**
@@ -17,13 +18,14 @@ export interface ContentDomain {
    * names like `a-<id>`) must return one lowercase DNS label, the same for the same scope, a
    * different one for a different scope, and never a `reserved` one.
    */
-  readonly name?: (scope: string) => string;
+  readonly name?: Naming;
   /**
-   * Labels this server never serves or names: another server's namespace under the same domain
-   * (`f` for `<instance>.f.<domain>`, `www`), or the host's own (`p-*`: every label starting
-   * `p-`). Each entry is a whole label, or a prefix ending in `*`; or a function that says
-   * whether a label is reserved. Requests for them, and for the names under them, get null (the
-   * host's routes), so a host routes them without wrapping `handle`.
+   * Labels something else serves on this domain, so this server never names them and hands their
+   * requests back: another server's namespace (`f` for `<instance>.f.<domain>`, where that server
+   * answers), or the host's own (`p-*`: its previews). Each entry is a whole label, or a prefix
+   * ending in `*`; or a function that says whether a label is reserved. Requests for them, and for
+   * the names under them, get null (the host's routes), so a host routes them without wrapping
+   * `handle`. Labels nothing serves need no entry: they get this server's 404 (P070).
    */
   readonly reserved?: readonly string[] | ((label: string) => boolean);
 }
@@ -168,7 +170,16 @@ export interface ServerOptions {
    * to the host's authorize route, on a host origin, which decides and sends it back with a
    * one-time code (`enterBy`). Absent: a clean address without a cookie is refused, as before.
    */
-  readonly entry?: { readonly authorizeUrl: string };
+  readonly entry?: {
+    readonly authorizeUrl: string;
+    /**
+     * Whether a clean address names anything (P070): asked before sending a browser away, with
+     * the address's label and pathname. False: this server's 404, never the authorize route. A
+     * naming that says a label's scope (`Naming.scopeOf`) already answers 404 for a label it never
+     * makes.
+     */
+    readonly named?: (label: string, path: string, request: Request) => boolean | Promise<boolean>;
+  };
 }
 
 /** A redirect entry's state, as the host's authorize route reads it (`PortholeServer.entryState`). */