@statewalker/webrun-http-browser 0.3.3 → 0.4.2

package/dist/sw.js

@@ -0,0 +1,1883 @@
+//#region ../webrun-streams/dist/index.js
+function serializeError(error) {
+	if (error instanceof Error) {
+		const out = {
+			message: error.message,
+			stack: error.stack
+		};
+		const bag = error;
+		for (const key of Object.keys(bag)) out[key] = bag[key];
+		return out;
+	}
+	if (typeof error === "object" && error !== null) {
+		const bag = error;
+		return {
+			message: String(bag.message ?? error),
+			...bag
+		};
+	}
+	return { message: String(error) };
+}
+function deserializeError(error) {
+	const payload = typeof error === "string" ? { message: error } : error;
+	return Object.assign(new Error(payload.message), payload);
+}
+new TextEncoder();
+new TextDecoder();
+/**
+* The newAsyncGenerator function creates async generators from callback-based initialization
+* functions, providing a bridge between imperative event handling and declarative async
+* iteration patterns.
+*
+* The initialization function receives two callback functions that control the generator's
+* behavior. The `next` function yields values to consumers, while the `done` function
+* signals completion or error conditions. The initialization function can return a cleanup
+* function that will be called when the generator is closed or an error occurs.
+*
+* The generator manages an internal queue of values and completion signals, ensuring that
+* producers can yield values without overwhelming consumers. Proper backpressure is implemented
+* by having the `next` and `done` functions return promises that resolve only after the
+* consumer has processed the values. This prevents memory leaks and ensures that producers
+* are aware of whether their values were successfully handled.
+* The generator also handles cleanup by draining any remaining items in the queue and notifying
+* producers that their values were not processed if the generator is closed early. This ensures
+* that resources are properly managed and that no memory leaks occur.
+*
+* Example usage:
+* ```typescript
+* const asyncGen = newAsyncGenerator<number>((next, done) => {
+*   let count = 0;
+*   const interval = setInterval(() => {
+*     if (count < 5) {
+*       next(count++);
+*     } else {
+*       done();
+*       clearInterval(interval);
+*     }
+*   }, 1000);
+*   return () => clearInterval(interval); // Cleanup function
+* });
+* (async () => {
+*   for await (const num of asyncGen) {
+*     console.log(num); // Logs numbers 0 to 4 at 1 second intervals
+*   }
+*   console.log("Completed");
+* })();
+* ```
+* @template T The type of values yielded by the generator
+* @template E The type of errors that can be thrown; defaults to Error
+* @param init Initialization function that sets up the generator behavior with next/done callbacks;
+*  The first parameter - `next` function - is used to yield values to consumers;
+*  It returns a Promise<boolean> indicating whether the value was successfully handled;
+*  The second parameter - `done` function - is used to signal completion or error;
+*  It returns a Promise<boolean> indicating whether the completion was successfully handled;
+*  The initialization function can optionally return a cleanup function that will be called
+*  when the generator is closed or an error occurs;
+* @param skipValues If true, only the most recent value is kept in the queue,
+* skipping intermediate values (not consumed values are considered skipped);
+* This is useful for scenarios where only the latest value matters, such as UI updates.
+* Defaults to false, meaning all values are queued and processed in order.
+* @returns AsyncGenerator that properly manages backpressure and resource cleanup
+*/
+async function* newAsyncGenerator(init, skipValues = false) {
+	let head;
+	let tail;
+	/** Flag to prevent new values from being queued after generator closes */
+	let closed = false;
+	/** Wake-up function to notify the generator loop of new items */
+	let wakeUp;
+	/**
+	* Drains the internal queue, notifying all pending producers that their values
+	* were not processed due to generator closure. This prevents memory leaks and
+	* ensures proper backpressure signaling.
+	*/
+	const drainQueue = () => {
+		for (; head; head = head.next) {
+			closed = closed || head.done;
+			head.resolve(false);
+		}
+		tail = void 0;
+	};
+	/**
+	* Enqueues a value or completion signal with a promise that resolves when the item
+	* is processed. This enables backpressure by allowing producers to know when their
+	* values have been consumed.
+	*/
+	const enqueue = (params) => {
+		if (skipValues) drainQueue();
+		return !closed ? new Promise((resolve) => {
+			const next = {
+				...params,
+				next: void 0,
+				resolve
+			};
+			if (tail) tail.next = next;
+			tail = next;
+			if (!head) head = tail;
+			wakeUp?.();
+		}) : Promise.resolve(false);
+	};
+	/**
+	* Producer function to yield a value to consumers. Returns a promise that resolves
+	* to true if the value was successfully processed, false if the generator is closed
+	* or the value was skipped due to backpressure.
+	*/
+	const next = (value) => enqueue({
+		done: false,
+		value
+	});
+	/**
+	* Producer function to signal completion or error. Optional error parameter will
+	* cause the generator to throw that error to consumers.
+	*/
+	const done = (error) => enqueue({
+		done: true,
+		error
+	});
+	const unsubscribe = init(next, done);
+	try {
+		while (!closed) {
+			if (!head) {
+				await new Promise((resolve) => {
+					wakeUp = resolve;
+				}).then(() => {
+					wakeUp = void 0;
+				});
+				continue;
+			}
+			const slot = head;
+			head = head.next;
+			if (tail === slot) tail = head;
+			try {
+				if (slot.done) {
+					closed = true;
+					if (slot.error !== void 0) throw slot.error;
+					break;
+				}
+				yield slot.value;
+			} finally {
+				slot.resolve(true);
+			}
+		}
+	} finally {
+		/**
+		* Cleanup phase - ensures proper resource management and notification of any
+		* remaining producers. This runs whether the generator completes normally,
+		* encounters an error, or is closed early by the consumer.
+		*/
+		closed = true;
+		wakeUp?.();
+		if (typeof unsubscribe === "function") await unsubscribe();
+		/**
+		* Drain any remaining items in the queue and notify their producers that
+		* the values were not processed. This prevents memory leaks and ensures
+		* proper backpressure signaling.
+		*/
+		drainQueue();
+	}
+}
+new TextEncoder();
+/**
+* The iterator ↔ `ReadableStream` boundary.
+*
+* Both adapters must carry CANCELLATION, not just data: a response body leaves
+* a handler as a `ReadableStream`, crosses a transport as an iterator, and
+* becomes a `ReadableStream` again at the caller — so when the caller walks
+* away, the only path back to the handler's producer runs through both of
+* these functions. Teardown that stops at an adapter leaves a producer running
+* for ever.
+*/
+function toReadableStream(it) {
+	return new ReadableStream({
+		/**
+		* One chunk per pull. An earlier version drained the whole iterator inside
+		* a single `pull`, which defeated the stream's own backpressure (every
+		* chunk was enqueued as fast as the producer could make them, however slow
+		* the reader was) and left no point between chunks at which a cancellation
+		* could take effect.
+		*/
+		async pull(controller) {
+			try {
+				const slot = await it.next();
+				if (!slot || slot.done) {
+					controller.close();
+					return;
+				}
+				controller.enqueue(await slot.value);
+			} catch (error) {
+				controller.error(error);
+			}
+		},
+		/**
+		* Release the source. NOT awaited: `.return()` on an async generator that
+		* is parked awaiting its own source is queued behind that pending
+		* `next()`, so awaiting it here would hang `reader.cancel()` on exactly
+		* the producers that most need cancelling.
+		*/
+		cancel(reason) {
+			Promise.resolve(it.return?.(reason)).catch(() => {});
+		}
+	});
+}
+async function* fromReadableStream(stream) {
+	const reader = stream.getReader();
+	let drained = false;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) {
+				drained = true;
+				break;
+			}
+			if (value !== void 0) yield value;
+		}
+	} finally {
+		if (drained) reader.releaseLock();
+		else await reader.cancel().catch(() => {});
+	}
+}
+/**
+* Inverse of {@link sendIterator}: turns a sequence of `{done, value, error}`
+* chunks (delivered to the supplied callback by `installer`) into an async
+* generator.
+*
+* The `installer` is given a `deliver` function. It should call `deliver`
+* once for each incoming chunk and may return a cleanup callback that
+* runs when the consumer stops iterating.
+*/
+function recieveIterator(installer) {
+	return newAsyncGenerator((next, done) => {
+		const cleanup = installer(async (chunk = { done: true }) => {
+			const { done: isDone = true, value, error } = chunk;
+			if (error) return await done(error);
+			if (isDone) return await done();
+			return await next(value);
+		});
+		if (cleanup) return async () => {
+			await cleanup();
+		};
+	});
+}
+/**
+* Drain an async iterator into a sink that consumes one chunk at a time.
+*
+* Each yielded value becomes `{ done: false, value }`. Completion emits
+* `{ done: true }`. If the iterator throws, the error is caught and the
+* final `done` chunk carries it so the peer can rethrow on its side.
+*/
+async function sendIterator(send, it) {
+	let error;
+	try {
+		for await (const value of it) await send({
+			done: false,
+			value
+		});
+	} catch (err) {
+		error = err;
+	} finally {
+		await send({
+			done: true,
+			error
+		});
+	}
+}
+//#endregion
+//#region ../webrun-http-streams/dist/index.js
+const CR = 13;
+const LF = 10;
+const EMPTY = /* @__PURE__ */ new Uint8Array(0);
+var ByteStreamError = class extends Error {
+	name = "ByteStreamError";
+};
+function toAsyncIterator(input) {
+	const asyncIter = input[Symbol.asyncIterator];
+	if (asyncIter) return asyncIter.call(input);
+	const syncIter = input[Symbol.iterator]();
+	return { next() {
+		return Promise.resolve(syncIter.next());
+	} };
+}
+/**
+* Discard an iterable we are contractually forbidden from consuming — a body
+* skipped for HEAD/204, or one abandoned because the peer reported an error.
+*
+* The `.next()` is not optional: `.return()` on a generator still in suspended
+* start is a no-op, so the body never runs and its `try/finally` never unwinds.
+* Without it a wrapped ReadableStream or socket is never cancelled.
+*/
+async function discard(source) {
+	if (source === void 0) return;
+	const it = toAsyncIterator(source);
+	try {
+		await it.next();
+		await it.return?.();
+	} catch {}
+}
+function concatChunks(parts, totalLen) {
+	if (parts.length === 1) {
+		const only = parts[0];
+		if (only !== void 0) return only;
+	}
+	const out = new Uint8Array(totalLen);
+	let off = 0;
+	for (const p of parts) {
+		out.set(p, off);
+		off += p.byteLength;
+	}
+	return out;
+}
+/**
+* Pull-based reader over a byte source. Holds at most one pending buffer, and
+* hands out `subarray` views rather than copies — a body never passes through
+* an allocation here.
+*/
+var ByteReader = class {
+	#iter;
+	#buf = EMPTY;
+	#done = false;
+	constructor(input) {
+		this.#iter = toAsyncIterator(input);
+	}
+	/** Bytes already pulled from the source but not yet consumed. */
+	bufferedLength() {
+		return this.#buf.byteLength;
+	}
+	/** Pull one more non-empty chunk. Returns false at end of stream. */
+	async #pull() {
+		if (this.#done) return false;
+		while (true) {
+			const next = await this.#iter.next();
+			if (next.done) {
+				this.#done = true;
+				return false;
+			}
+			const chunk = next.value;
+			if (chunk.byteLength === 0) continue;
+			this.#buf = this.#buf.byteLength === 0 ? chunk : concatChunks([this.#buf, chunk], this.#buf.byteLength + chunk.byteLength);
+			return true;
+		}
+	}
+	async peekByte() {
+		while (this.#buf.byteLength === 0) if (!await this.#pull()) return void 0;
+		return this.#buf[0];
+	}
+	/** Up to `max` bytes. `undefined` means end of stream. */
+	async readSome(max) {
+		while (this.#buf.byteLength === 0) if (!await this.#pull()) return void 0;
+		const take = Math.min(max, this.#buf.byteLength);
+		const out = this.#buf.subarray(0, take);
+		this.#buf = this.#buf.subarray(take);
+		return out;
+	}
+	/**
+	* One CRLF-terminated line, without the CRLF. A bare LF is rejected: real
+	* peers always send CRLF, and tolerating a bare LF is precisely the lenience
+	* that lets request smuggling through a proxy pair.
+	*
+	* The `maxBytes` bound is best-effort: it only rejects a line if the check
+	* happens to run before the line is fully buffered. A line already sitting in
+	* the buffer bypasses the check. Callers needing a hard per-line limit or
+	* aggregate bounds must keep their own running total.
+	*/
+	async readLine(maxBytes) {
+		let searched = 0;
+		while (true) {
+			const idx = this.#buf.indexOf(LF, searched);
+			if (idx !== -1) {
+				if (idx === 0 || this.#buf[idx - 1] !== CR) throw new ByteStreamError("bare LF line terminator; CRLF required");
+				const line = this.#buf.subarray(0, idx - 1);
+				this.#buf = this.#buf.subarray(idx + 1);
+				return line;
+			}
+			searched = this.#buf.byteLength;
+			if (searched > maxBytes) throw new ByteStreamError(`line exceeds ${maxBytes} bytes without CRLF`);
+			if (!await this.#pull()) throw new ByteStreamError(`stream ended after ${searched} bytes without CRLF`);
+		}
+	}
+	/** Everything not yet consumed, lazily. */
+	async *rest() {
+		while (true) {
+			if (this.#buf.byteLength > 0) {
+				const out = this.#buf;
+				this.#buf = EMPTY;
+				yield out;
+				continue;
+			}
+			if (!await this.#pull()) return;
+		}
+	}
+};
+/**
+* Raised for any byte sequence this codec refuses to interpret. Every case is
+* a refusal to guess: HTTP/1.1 parsers that guess are how request smuggling
+* works.
+*/
+var HttpParseError = class extends Error {
+	name = "HttpParseError";
+};
+const NEWLINE = 10;
+/** Mirrors the HTTP/1.1 codec's default `maxHeaderBytes`. */
+const MAX_ENVELOPE_BYTES = 65536;
+const encoder$1 = new TextEncoder();
+const decoder = new TextDecoder();
+/**
+* Encode an HTTP envelope plus optional body as one continuous byte stream:
+*
+*     <JSON.stringify(envelope)>\n<body bytes...>
+*
+* `JSON.stringify` with default whitespace never emits a literal `\n`, so the
+* first `0x0a` byte unambiguously terminates the envelope.
+*
+* This is the same wire shape used by the legacy `webrun-http-port` package.
+*/
+async function* encodeMessage(envelope, body) {
+	yield encoder$1.encode(`${JSON.stringify(envelope)}\n`);
+	if (!body) return;
+	for await (const chunk of body) if (chunk.byteLength > 0) yield chunk;
+}
+/**
+* Consume an envelope-then-body byte stream. Returns the parsed envelope and
+* an async iterable over the remaining body bytes.
+*/
+async function decodeMessage(input) {
+	const iter = toAsyncIterator(input);
+	const accum = [];
+	let accumLen = 0;
+	let before;
+	let tail;
+	while (true) {
+		const next = await iter.next();
+		if (next.done) throw new HttpParseError(`decodeMessage: stream ended after ${accumLen} bytes without delimiter (\\n)`);
+		const chunk = next.value;
+		if (chunk.byteLength === 0) continue;
+		const nl = chunk.indexOf(NEWLINE);
+		if (nl === -1) {
+			accum.push(chunk);
+			accumLen += chunk.byteLength;
+			if (accumLen > MAX_ENVELOPE_BYTES) throw new HttpParseError(`decodeMessage: envelope exceeds ${MAX_ENVELOPE_BYTES} bytes without delimiter (\\n)`);
+			continue;
+		}
+		accum.push(chunk.subarray(0, nl));
+		accumLen += nl;
+		before = concatChunks(accum, accumLen);
+		tail = chunk.subarray(nl + 1);
+		break;
+	}
+	let envelope;
+	try {
+		envelope = JSON.parse(decoder.decode(before));
+	} catch (err) {
+		throw new HttpParseError(`decodeMessage: malformed envelope JSON at bytes 0..${before.byteLength}: ${err.message}`);
+	}
+	async function* body() {
+		if (tail.byteLength > 0) yield tail;
+		while (true) {
+			const next = await iter.next();
+			if (next.done) return;
+			if (next.value.byteLength > 0) yield next.value;
+		}
+	}
+	return {
+		envelope,
+		body: body()
+	};
+}
+const OPEN_BRACE = 123;
+/**
+* The original wire format — `<JSON.stringify(envelope)>\n<body bytes…>` —
+* expressed as a `MessageCodec`. Direction-agnostic: requests and responses
+* serialise identically.
+*
+* Retained so a peer pair can be upgraded in either order; see ADR-0006.
+*/
+const jsonEnvelopeCodec = {
+	name: "json-envelope",
+	sniff: (byte) => byte === OPEN_BRACE,
+	encodeRequest: (env, body) => encodeMessage(env, body),
+	encodeResponse: (env, body) => encodeMessage(env, body),
+	decodeRequest: (input) => decodeMessage(input),
+	decodeResponse: (input) => decodeMessage(input)
+};
+const TCHAR = /* @__PURE__ */ new Set("!#$%&'*+-.^_`|~0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ");
+const SP = 32;
+const HTAB = 9;
+function isTokenChar(byte) {
+	return byte > SP && byte < 127 && TCHAR.has(String.fromCharCode(byte));
+}
+function isToken(value) {
+	if (value.length === 0) return false;
+	for (const ch of value) if (!TCHAR.has(ch)) return false;
+	return true;
+}
+/**
+* Header bytes are latin-1: byte-preserving, matching Node, and lossless
+* across a decode/encode round-trip. Control characters are rejected
+* separately by `assertValidHeaderValue`.
+*/
+function decodeLatin1(bytes) {
+	let out = "";
+	for (const byte of bytes) out += String.fromCharCode(byte);
+	return out;
+}
+function encodeLatin1(text) {
+	const out = new Uint8Array(text.length);
+	for (let i = 0; i < text.length; i++) {
+		const code = text.charCodeAt(i);
+		if (code > 255) throw new HttpParseError(`not latin-1 encodable: ${JSON.stringify(text)}`);
+		out[i] = code;
+	}
+	return out;
+}
+const HOST_IP_LITERAL = /^\[[0-9A-Fa-f:.]+\](:\d{1,5})?$/;
+const HOST_REG_NAME = /^[A-Za-z0-9._~-]+(:\d{1,5})?$/;
+/**
+* Validates a value that is about to become (or was read as) a `Host`
+* header: untrusted input either way, so an unrecognised shape is a refusal,
+* not a guess. Rejects a present-but-empty value, one carrying userinfo
+* (`evil.com@good.com`), and — the reason this also runs on encode — one
+* smuggling a CRLF-terminated line into the authority of a caller-supplied
+* url. Never applied to trusted configuration (a codec's `opts.host`).
+*/
+function assertValidHost(host) {
+	if (!HOST_IP_LITERAL.test(host) && !HOST_REG_NAME.test(host)) throw new HttpParseError(`invalid Host header: ${JSON.stringify(host)}`);
+}
+/**
+* A request-target must be entirely visible ASCII (RFC 9110 VCHAR) — nothing
+* `<= 0x20` (space and every control character, CR/LF included) and nothing
+* `>= 0x7F` (DEL and beyond). Applied on encode (`splitTarget`, so a
+* caller-supplied url can never inject a second request line) and on decode
+* (so a relay that decodes then re-encodes can never put an embedded control
+* character back on the wire).
+*/
+function assertValidTarget(target) {
+	for (let i = 0; i < target.length; i++) {
+		const code = target.charCodeAt(i);
+		if (code <= SP || code >= 127) throw new HttpParseError(`invalid request-target: ${JSON.stringify(target)}`);
+	}
+}
+/**
+* Shared control-character check behind both `assertValidHeaderValue` and
+* `assertValidStatusText` — the two were previously checked by different,
+* looser rules (statusText only rejected CR/LF), which is exactly the
+* asymmetry class C1 and M5 are both instances of. `label` is prepended
+* verbatim to each message, so callers keep their own wording.
+*/
+function assertNoControlChars(label, value) {
+	for (let i = 0; i < value.length; i++) {
+		const code = value.charCodeAt(i);
+		if (code === 13 || code === 10) throw new HttpParseError(`${label} contains CR or LF`);
+		if (code < SP && code !== HTAB || code === 127) throw new HttpParseError(`${label} contains a control character`);
+		if (code > 255) throw new HttpParseError(`${label} is not latin-1 encodable`);
+	}
+}
+function assertValidHeaderValue(name, value) {
+	assertNoControlChars(`header "${name}" value`, value);
+}
+/** Same character class as a header value (M5) — CR/LF, every C0 control, and DEL. */
+function assertValidStatusText(value) {
+	assertNoControlChars("statusText", value);
+}
+function encodeHeaderLines(headers) {
+	let out = "";
+	for (const [name, value] of headers) {
+		if (!isToken(name)) throw new HttpParseError(`invalid header name: ${JSON.stringify(name)}`);
+		assertValidHeaderValue(name, value);
+		out += `${name}: ${value}\r\n`;
+	}
+	return out;
+}
+/**
+* Read to the blank line. `alreadyUsed` is the byte count of the start line,
+* so the bound covers the whole head section rather than the headers alone.
+*/
+async function readHeaderSection(reader, maxHeaderBytes, alreadyUsed) {
+	const headers = [];
+	let used = alreadyUsed;
+	while (true) {
+		const remaining = maxHeaderBytes - used;
+		if (remaining <= 0) throw new HttpParseError(`head section exceeds ${maxHeaderBytes} bytes`);
+		const lineBytes = await reader.readLine(remaining);
+		used += lineBytes.byteLength + 2;
+		if (used > maxHeaderBytes) throw new HttpParseError(`head section exceeds ${maxHeaderBytes} bytes`);
+		if (lineBytes.byteLength === 0) return headers;
+		if (lineBytes[0] === SP || lineBytes[0] === HTAB) throw new HttpParseError("obs-fold header continuation is not accepted");
+		const line = decodeLatin1(lineBytes);
+		const colon = line.indexOf(":");
+		if (colon <= 0) throw new HttpParseError(`malformed header line: ${JSON.stringify(line)}`);
+		const name = line.slice(0, colon);
+		if (!isToken(name)) throw new HttpParseError(`invalid header name: ${JSON.stringify(name)}`);
+		const value = line.slice(colon + 1).replace(/^[ \t]+/, "").replace(/[ \t]+$/, "");
+		assertValidHeaderValue(name, value);
+		headers.push([name, value]);
+	}
+}
+function getAll(headers, name) {
+	const lower = name.toLowerCase();
+	return headers.filter(([k]) => k.toLowerCase() === lower).map(([, v]) => v);
+}
+function withoutHeaders(headers, names) {
+	const drop = new Set(names.map((n) => n.toLowerCase()));
+	return headers.filter(([k]) => !drop.has(k.toLowerCase()));
+}
+/**
+* Parse a `Content-Length` field into a single validated value.
+*
+* RFC 9110 §8.6 permits the value to be a comma-separated list of identical
+* numbers (a relay may have appended one), so the list is folded; differing
+* values are a refusal, not a choice. Shared by `resolveFraming` on decode and
+* by the encoder's declared-length check, which previously carried its own
+* copy that did NOT split on commas — so decode accepted `5, 5` while encode
+* rejected it, and a relay that decoded then re-encoded threw.
+*
+* Returns undefined when the field is absent.
+*/
+function parseContentLength(values) {
+	if (values.length === 0) return void 0;
+	const unique = new Set(values.flatMap((v) => v.split(",").map((s) => s.trim())));
+	if (unique.size !== 1) throw new HttpParseError(`conflicting Content-Length values: ${[...unique].join(", ")}`);
+	const raw = [...unique][0];
+	if (!/^\d{1,15}$/.test(raw)) throw new HttpParseError(`invalid Content-Length: ${JSON.stringify(raw)}`);
+	return Number(raw);
+}
+/**
+* Statuses that carry no body whatever the headers say (RFC 9110 §8.6): 1xx,
+* 204 and 304. Defined once because the encoder must not frame a body for
+* them and the decoder must not try to read one — two lists that agreed today
+* and were free to drift tomorrow.
+*
+* A response to HEAD is also bodyless, but that depends on the request rather
+* than the status, so callers test it separately.
+*/
+function isBodylessStatus(status) {
+	return status < 200 || status === 204 || status === 304;
+}
+/**
+* RFC 9112 §6.3, with every ambiguity turned into a refusal. In particular a
+* message declaring both Content-Length and Transfer-Encoding is rejected
+* rather than resolved — disagreeing on which one wins is request smuggling.
+*/
+function resolveFraming(headers, version) {
+	const te = getAll(headers, "transfer-encoding");
+	const cl = getAll(headers, "content-length");
+	if (te.length > 0 && cl.length > 0) throw new HttpParseError("message declares both Content-Length and Transfer-Encoding; refusing (request smuggling)");
+	if (te.length > 0) {
+		const encodings = te.join(",").split(",").map((s) => s.trim().toLowerCase()).filter((s) => s !== "");
+		if (encodings.length !== 1 || encodings[0] !== "chunked") throw new HttpParseError(`unsupported Transfer-Encoding: ${JSON.stringify(te.join(", "))}`);
+		if (version === "HTTP/1.0") throw new HttpParseError("Transfer-Encoding is not valid in HTTP/1.0");
+		return { kind: "chunked" };
+	}
+	const length = parseContentLength(cl);
+	if (length !== void 0) return {
+		kind: "length",
+		length
+	};
+	return { kind: "none" };
+}
+const CRLF = new Uint8Array([13, 10]);
+const LAST_CHUNK = new Uint8Array([
+	48,
+	13,
+	10,
+	13,
+	10
+]);
+const encoder = new TextEncoder();
+/**
+* Chunk sizes are written in HEXADECIMAL — a 21-byte chunk is `15`. Writing
+* them in decimal is the defect note 15 found in @libp2p/http, and it is the
+* one that cannot be caught downstream: decimal digits are also valid hex, so
+* a conforming parser silently reads the wrong length.
+*
+* Zero-length source chunks are skipped; a zero-sized chunk on the wire is the
+* body terminator.
+*/
+async function* encodeChunked(body) {
+	for await (const chunk of body) {
+		if (chunk.byteLength === 0) continue;
+		yield encoder.encode(`${chunk.byteLength.toString(16)}\r\n`);
+		yield chunk;
+		yield CRLF;
+	}
+	yield LAST_CHUNK;
+}
+/**
+* Decode a chunked body, yielding data chunks as they arrive. Nothing is
+* accumulated: a chunk larger than the transport's frame is yielded in pieces.
+*/
+async function* decodeChunked(reader, maxLineBytes) {
+	while (true) {
+		const sizeLine = decodeLatin1(await reader.readLine(maxLineBytes));
+		const semicolon = sizeLine.indexOf(";");
+		const sizeText = semicolon === -1 ? sizeLine : sizeLine.slice(0, semicolon);
+		if (!/^[0-9a-fA-F]{1,32}$/.test(sizeText)) throw new HttpParseError(`invalid chunk size: ${JSON.stringify(sizeLine)}`);
+		const size = Number.parseInt(sizeText, 16);
+		if (!Number.isSafeInteger(size)) throw new HttpParseError(`chunk size is too large: ${JSON.stringify(sizeLine)}`);
+		if (size === 0) {
+			let used = 0;
+			while (true) {
+				const remaining = maxLineBytes - used;
+				if (remaining <= 0) throw new HttpParseError(`trailer section exceeds ${maxLineBytes} bytes`);
+				const lineBytes = await reader.readLine(remaining);
+				used += lineBytes.byteLength + 2;
+				if (used > maxLineBytes) throw new HttpParseError(`trailer section exceeds ${maxLineBytes} bytes`);
+				if (lineBytes.byteLength === 0) break;
+			}
+			return;
+		}
+		let remaining = size;
+		while (remaining > 0) {
+			const part = await reader.readSome(remaining);
+			if (part === void 0) throw new HttpParseError(`chunk truncated: ${remaining} of ${size} bytes missing`);
+			remaining -= part.byteLength;
+			yield part;
+		}
+		try {
+			if ((await reader.readLine(2)).byteLength !== 0) throw new HttpParseError("chunk data not terminated by CRLF");
+		} catch (err) {
+			if (err instanceof ByteStreamError) throw new HttpParseError("chunk data not terminated by CRLF");
+			throw err;
+		}
+	}
+}
+const VERSIONS = /* @__PURE__ */ new Set(["HTTP/1.1", "HTTP/1.0"]);
+const ABSOLUTE_FORM = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//;
+/**
+* One message per Duplex call (ADR-0006), so bytes after a complete message
+* are an error. Checked against what is ALREADY BUFFERED rather than by
+* awaiting end-of-stream: a live socket from a keep-alive peer never reaches
+* EOF, so awaiting one would hang instead of failing.
+*/
+function assertNoBufferedBytes(reader) {
+	const extra = reader.bufferedLength();
+	if (extra > 0) throw new HttpParseError(`${extra} trailing bytes after a complete message`);
+}
+/**
+* The public error contract (I2): everything leaving `decodeRequest` /
+* `decodeResponse` is an `HttpParseError`, whether the refusal happened
+* synchronously (a malformed start line or header) or lazily while the body
+* is later drained. `ByteStreamError` — the `ByteReader`'s own class, never
+* exported — is the one thing converted here, message and all preserved via
+* `cause`. Anything else is a genuine failure of the underlying source (a
+* dropped socket, say) and must reach the caller unchanged: blanket-catching
+* would hide that distinction.
+*/
+function toHttpParseError(err) {
+	if (err instanceof ByteStreamError) throw new HttpParseError(err.message, { cause: err });
+	throw err;
+}
+/** Applies `toHttpParseError` across the whole lifetime of a body generator. */
+async function* convertBodyErrors(source) {
+	try {
+		yield* source;
+	} catch (err) {
+		toHttpParseError(err);
+	}
+}
+async function* readBody(reader, framing, opts, noneMeansEof) {
+	if (framing.kind === "chunked") {
+		yield* decodeChunked(reader, opts.maxHeaderBytes);
+		assertNoBufferedBytes(reader);
+		return;
+	}
+	if (framing.kind === "length") {
+		let remaining = framing.length;
+		while (remaining > 0) {
+			const part = await reader.readSome(remaining);
+			if (part === void 0) throw new HttpParseError(`body truncated: ${remaining} of ${framing.length} bytes missing`);
+			remaining -= part.byteLength;
+			yield part;
+		}
+		assertNoBufferedBytes(reader);
+		return;
+	}
+	if (noneMeansEof) {
+		yield* reader.rest();
+		return;
+	}
+	assertNoBufferedBytes(reader);
+}
+/**
+* `readLine`'s bound is best-effort — it is skipped when the line is already
+* buffered — so a very long start line can reach these messages intact. Since
+* a refusal is now echoed back to the sender in a 400 body, quote only enough
+* to diagnose rather than reflecting the whole thing.
+*/
+function quoteLine(line) {
+	const MAX = 120;
+	return line.length <= MAX ? JSON.stringify(line) : `${JSON.stringify(line.slice(0, MAX))} (truncated from ${line.length} chars)`;
+}
+async function decodeRequest(input, opts) {
+	const reader = new ByteReader(input);
+	try {
+		const startBytes = await reader.readLine(opts.maxHeaderBytes);
+		const startLine = decodeLatin1(startBytes);
+		const parts = startLine.split(" ");
+		if (parts.length !== 3) throw new HttpParseError(`malformed request line: ${quoteLine(startLine)}`);
+		const [method, target, version] = parts;
+		if (!isToken(method)) throw new HttpParseError(`invalid method: ${JSON.stringify(method)}`);
+		if (!VERSIONS.has(version)) throw new HttpParseError(`unsupported HTTP version: ${JSON.stringify(version)}`);
+		if (target === "*") throw new HttpParseError("asterisk-form request target is not supported");
+		assertValidTarget(target);
+		const headers = await readHeaderSection(reader, opts.maxHeaderBytes, startBytes.byteLength + 2);
+		const hosts = getAll(headers, "host");
+		if (hosts.length > 1) throw new HttpParseError("multiple Host headers");
+		const host = hosts[0];
+		let url;
+		if (target.startsWith("/")) {
+			if (version === "HTTP/1.1" && host === void 0) throw new HttpParseError("HTTP/1.1 request has no Host header");
+			if (host !== void 0) assertValidHost(host);
+			url = `${opts.scheme}://${host ?? opts.host}${target}`;
+		} else if (ABSOLUTE_FORM.test(target)) url = target;
+		else throw new HttpParseError(`unsupported request target: ${JSON.stringify(target)}`);
+		try {
+			new URL(url);
+		} catch {
+			throw new HttpParseError(`decoded url is not a valid URL: ${JSON.stringify(url)}`);
+		}
+		return {
+			envelope: {
+				url,
+				method,
+				headers
+			},
+			body: convertBodyErrors(readBody(reader, resolveFraming(headers, version), opts, false))
+		};
+	} catch (err) {
+		toHttpParseError(err);
+	}
+}
+async function decodeResponse(input, opts, method) {
+	const reader = new ByteReader(input);
+	try {
+		const startBytes = await reader.readLine(opts.maxHeaderBytes);
+		const startLine = decodeLatin1(startBytes);
+		const firstSp = startLine.indexOf(" ");
+		if (firstSp === -1) throw new HttpParseError(`malformed status line: ${quoteLine(startLine)}`);
+		const version = startLine.slice(0, firstSp);
+		if (!VERSIONS.has(version)) throw new HttpParseError(`unsupported HTTP version: ${JSON.stringify(version)}`);
+		const afterVersion = startLine.slice(firstSp + 1);
+		const secondSp = afterVersion.indexOf(" ");
+		const codeText = secondSp === -1 ? afterVersion : afterVersion.slice(0, secondSp);
+		if (!/^\d{3}$/.test(codeText)) throw new HttpParseError(`invalid status code: ${JSON.stringify(codeText)}`);
+		const status = Number(codeText);
+		const statusText = secondSp === -1 ? "" : afterVersion.slice(secondSp + 1);
+		const headers = await readHeaderSection(reader, opts.maxHeaderBytes, startBytes.byteLength + 2);
+		const bodyless = isBodylessStatus(status) || method.toUpperCase() === "HEAD";
+		const framing = bodyless ? { kind: "none" } : resolveFraming(headers, version);
+		return {
+			envelope: {
+				status,
+				statusText,
+				headers
+			},
+			body: convertBodyErrors(readBody(reader, framing, opts, !bodyless))
+		};
+	} catch (err) {
+		toHttpParseError(err);
+	}
+}
+/** Headers the codec owns: a caller-supplied copy is dropped and re-derived. */
+const REQUEST_OWNED = [
+	"host",
+	"connection",
+	"transfer-encoding"
+];
+const RESPONSE_OWNED = ["connection", "transfer-encoding"];
+/**
+* Split a URL into an origin-form request target and an authority *without*
+* going through `new URL()`. `URL` normalises percent-encoding and would
+* re-serialise the target — which is the exact class of defect note 15 found
+* in @libp2p/http, where rebuilding the request line silently dropped
+* `url.search`. Here the target is a verbatim slice of the caller's string.
+*/
+function splitTarget(url, opts) {
+	if (url.startsWith("/")) {
+		assertValidTarget(url);
+		return {
+			target: url,
+			authority: opts.host
+		};
+	}
+	const match = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/([^/?#]*)([^#]*)/.exec(url);
+	if (!match) throw new HttpParseError(`cannot derive a request target from url: ${JSON.stringify(url)}`);
+	const rawAuthority = match[1];
+	if (rawAuthority === "") throw new HttpParseError(`url has no authority: ${JSON.stringify(url)}`);
+	const at = rawAuthority.lastIndexOf("@");
+	const authority = at === -1 ? rawAuthority : rawAuthority.slice(at + 1);
+	assertValidHost(authority);
+	const rawTarget = match[2];
+	const target = rawTarget === "" ? "/" : rawTarget.startsWith("/") ? rawTarget : `/${rawTarget}`;
+	assertValidTarget(target);
+	return {
+		target,
+		authority
+	};
+}
+async function* emitBody(body, declared) {
+	if (declared === void 0) {
+		yield* encodeChunked(body);
+		return;
+	}
+	let sent = 0;
+	for await (const chunk of body) {
+		if (chunk.byteLength === 0) continue;
+		sent += chunk.byteLength;
+		if (sent > declared) throw new HttpParseError(`body exceeds declared Content-Length ${declared} (${sent} bytes so far)`);
+		yield chunk;
+	}
+	if (sent !== declared) throw new HttpParseError(`body is ${sent} bytes but Content-Length declares ${declared}`);
+}
+async function* encodeRequest(env, body, opts) {
+	if (!isToken(env.method)) throw new HttpParseError(`invalid method: ${JSON.stringify(env.method)}`);
+	const { target, authority } = splitTarget(env.url, opts);
+	if (authority === "") throw new HttpParseError("no Host available: url has no authority and no host is configured");
+	const carried = withoutHeaders(env.headers, REQUEST_OWNED);
+	const declared = parseContentLength(getAll(carried, "content-length"));
+	let head = `${env.method} ${target} HTTP/1.1\r\n`;
+	head += `Host: ${authority}\r\n`;
+	head += encodeHeaderLines(carried);
+	head += "Connection: close\r\n";
+	if (body !== void 0 && declared === void 0) head += "Transfer-Encoding: chunked\r\n";
+	head += "\r\n";
+	yield encodeLatin1(head);
+	if (body === void 0) {
+		if (declared !== void 0 && declared !== 0) throw new HttpParseError(`body is 0 bytes but Content-Length declares ${declared}`);
+		return;
+	}
+	yield* emitBody(body, declared);
+}
+async function* encodeResponse(env, body, _opts, requestMethod) {
+	if (!Number.isInteger(env.status) || env.status < 100 || env.status > 599) throw new HttpParseError(`invalid status: ${env.status}`);
+	const reason = env.statusText ?? "";
+	assertValidStatusText(reason);
+	const bodylessStatus = isBodylessStatus(env.status);
+	const bodyless = bodylessStatus || requestMethod?.toUpperCase() === "HEAD";
+	const owned = bodylessStatus ? [...RESPONSE_OWNED, "content-length"] : RESPONSE_OWNED;
+	const carried = withoutHeaders(env.headers, owned);
+	const declared = parseContentLength(getAll(carried, "content-length"));
+	let head = `HTTP/1.1 ${env.status} ${reason}\r\n`;
+	head += encodeHeaderLines(carried);
+	head += "Connection: close\r\n";
+	if (!bodyless && body !== void 0 && declared === void 0) head += "Transfer-Encoding: chunked\r\n";
+	head += "\r\n";
+	yield encodeLatin1(head);
+	if (bodyless) {
+		await discard(body);
+		return;
+	}
+	if (body === void 0) {
+		if (declared !== void 0 && declared !== 0) throw new HttpParseError(`body is 0 bytes but Content-Length declares ${declared}`);
+		return;
+	}
+	yield* emitBody(body, declared);
+}
+function newHttpCodec(options = {}) {
+	const opts = {
+		scheme: options.scheme ?? "http",
+		host: options.host ?? "localhost",
+		maxHeaderBytes: options.maxHeaderBytes ?? 65536
+	};
+	return {
+		name: "http/1.1",
+		sniff: (byte) => isTokenChar(byte),
+		encodeRequest: (env, body) => encodeRequest(env, body, opts),
+		encodeResponse: (env, body, o) => encodeResponse(env, body, opts, o?.method),
+		decodeRequest: (input) => decodeRequest(input, opts),
+		decodeResponse: (input, o) => decodeResponse(input, opts, o.method)
+	};
+}
+const httpCodec = newHttpCodec();
+/**
+* Dispatches on byte 0. The formats are self-identifying — a JSON envelope
+* always begins `{`, which is not a token character and so can never begin an
+* HTTP start-line — so no negotiation handshake, magic prefix, or version byte
+* is needed.
+*
+* This is what makes a mixed-version peer pair safe: readers accept either
+* format, so the two ends can be upgraded in any order.
+*/
+function newSniffingCodec(options) {
+	const { write, accept } = options;
+	async function pick(input) {
+		const reader = new ByteReader(input);
+		const first = await reader.peekByte();
+		if (first === void 0) throw new HttpParseError("sniff: stream ended before any bytes arrived");
+		const codec = accept.find((c) => c.sniff(first));
+		if (!codec) throw new HttpParseError(`sniff: no accepted codec recognises a message starting with byte 0x${first.toString(16).padStart(2, "0")}`);
+		return {
+			codec,
+			input: reader.rest()
+		};
+	}
+	return {
+		name: `sniff(write=${write.name}; accept=${accept.map((c) => c.name).join(",")})`,
+		sniff: (byte) => accept.some((c) => c.sniff(byte)),
+		encodeRequest: (env, body) => write.encodeRequest(env, body),
+		encodeResponse: (env, body, o) => write.encodeResponse(env, body, o),
+		decodeRequest: async (input) => {
+			const picked = await pick(input);
+			try {
+				return {
+					...await picked.codec.decodeRequest(picked.input),
+					codec: picked.codec
+				};
+			} catch (error) {
+				if (error !== null && typeof error === "object") error.codec = picked.codec;
+				throw error;
+			}
+		},
+		decodeResponse: async (input, o) => {
+			const picked = await pick(input);
+			return picked.codec.decodeResponse(picked.input, o);
+		}
+	};
+}
+newSniffingCodec({
+	write: httpCodec,
+	accept: [httpCodec, jsonEnvelopeCodec]
+});
+/**
+* The one place that knows a runtime may not implement request body streams,
+* and the buffering both fallbacks need. `fetch.ts` and `http-stubs.ts` each
+* carry a client and a server direction that must agree on the answer, so the
+* predicate lives here rather than being written out four times.
+*/
+/**
+* Whether `Request.prototype` exposes a `body` accessor. Two call sites read
+* that property, and two more depend on the constructor accepting a
+* `ReadableStream` as `init.body`; this predicate answers for all four.
+*
+* What was verified, and all that is claimed here: Firefox (146 at the time of
+* writing) has *neither*, and Chromium and Node have *both*. On Firefox it is
+* not that `body` is `undefined` on the instance —
+* `Object.getOwnPropertyDescriptor(Request.prototype, "body")` is `null`, the
+* accessor is genuinely absent — and because a `ReadableStream` is then not a
+* recognised `BodyInit`, the constructor falls through to the string branch and
+* stores the literal text `[object ReadableStream]`.
+*
+* The two halves are NOT guaranteed to ship together, so do not read this as a
+* test for "request streams" in general. Safari is the counterexample: it has
+* had `Request.body` since 11.1 but only accepts a stream as `init.body` from
+* Technology Preview 250, so a shipping Safari has the reader half without the
+* upload half and this returns `true` there. That looks benign — WebKit appears
+* to store the stream on the `Request` rather than stringify it, and its error
+* comes from `fetch()`, which this package never calls on the objects it builds
+* — but it is untested, and it is the case to look at first if a Safari report
+* arrives. The sharper probe, if one is ever needed, is whether
+* `new Request(url, {method:"POST", body:new ReadableStream(), duplex:"half"})`
+* has a `content-type` of `text/plain;charset=UTF-8` (stringified) or `null`
+* (stored); it is not used here because it costs a `Request` and a
+* `ReadableStream` per call and agrees with the descriptor check on every
+* runtime measured.
+*
+* A capability check, never a user-agent test: the question is what this
+* runtime does, and the answer flips on its own the day Firefox ships request
+* streams. Evaluated per call rather than cached at module load so that a test
+* can install a `Request` without the capability and exercise the real branch
+* under Node.
+*/
+function supportsRequestStreams() {
+	return typeof Request === "function" && Object.getOwnPropertyDescriptor(Request.prototype, "body") != null;
+}
+/**
+* Drain a body iterable into one contiguous buffer. Only the fallbacks need it.
+* Allocates its own buffer rather than reusing `bytes.ts`'s `concatChunks`,
+* which passes a single chunk straight through: that chunk is a view onto the
+* decoder's own read buffer, and the result here is handed to `new Request` and
+* outlives the decode. The allocation is also what makes it a
+* `Uint8Array<ArrayBuffer>`, which `BodyInit` accepts and the looser
+* `Uint8Array<ArrayBufferLike>` does not.
+*/
+async function collectBytes(source) {
+	const parts = [];
+	let total = 0;
+	for await (const chunk of source) {
+		if (chunk.byteLength === 0) continue;
+		parts.push(chunk);
+		total += chunk.byteLength;
+	}
+	const out = new Uint8Array(total);
+	let offset = 0;
+	for (const part of parts) {
+		out.set(part, offset);
+		offset += part.byteLength;
+	}
+	return out;
+}
+const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([
+	101,
+	103,
+	204,
+	205,
+	304
+]);
+const REQUEST_FIELDS = [
+	"url",
+	"method",
+	"mode",
+	"credentials",
+	"cache",
+	"redirect",
+	"referrer",
+	"referrerPolicy",
+	"integrity",
+	"keepalive"
+];
+/** `SerializedHttpEnvelope.content` is never absent, only empty. */
+async function* noBytes() {}
+async function* oneChunk(chunk) {
+	yield chunk;
+}
+/**
+* Returns an HTTP handler that serializes a Request, hands the envelope to
+* `send` for transport, and deserializes the reply into a Response. Used on
+* the caller side.
+*/
+function newHttpClientStub(send) {
+	return async (requestOrPromise) => {
+		const request = await requestOrPromise;
+		const headers = [...request.headers].map(([k, v]) => [k, v]);
+		const options = {
+			url: request.url,
+			headers
+		};
+		for (const field of REQUEST_FIELDS) {
+			const val = request[field];
+			if (val !== void 0 && field !== "url") options[field] = val;
+		}
+		let content;
+		if (request.body != null) content = fromReadableStream(request.body);
+		else if (!supportsRequestStreams()) content = oneChunk(new Uint8Array(await request.arrayBuffer()));
+		else content = noBytes();
+		const result = await send({
+			options,
+			content
+		});
+		if (!result) return new Response(null, {
+			status: 404,
+			statusText: "Error 404: Not Found"
+		});
+		const responseOptions = result.options;
+		const method = options.method;
+		if (method === "HEAD" || method === "OPTIONS" || NULL_BODY_STATUSES.has(responseOptions.status)) {
+			await discard(result.content);
+			return new Response(null, responseOptions);
+		}
+		return new Response(toReadableStream(result.content[Symbol.asyncIterator]()), responseOptions);
+	};
+}
+/**
+* Returns a server-side transport handler. It deserializes the incoming
+* request envelope, delegates to `handler`, and serializes the response.
+*/
+function newHttpServerStub(handler) {
+	return async (envelopeOrPromise) => {
+		const { options, content } = await envelopeOrPromise;
+		const { url, method, headers = [], ...rest } = options;
+		const { mode: _mode, ...forwardable } = rest;
+		const requestHeaders = new Headers();
+		for (const [key, value] of headers) requestHeaders.append(key, value);
+		const hasBody = method !== "GET" && method !== "HEAD" && method !== "OPTIONS";
+		const requestInit = {
+			...forwardable,
+			method,
+			headers: requestHeaders
+		};
+		if (!hasBody) await discard(content);
+		else if (supportsRequestStreams()) {
+			requestInit.body = toReadableStream(content[Symbol.asyncIterator]());
+			requestInit.duplex = "half";
+		} else requestInit.body = await collectBytes(content);
+		const response = await handler(new Request(url, requestInit));
+		return {
+			options: {
+				status: response.status,
+				statusText: response.statusText,
+				headers: Object.fromEntries([...response.headers])
+			},
+			content: response.body ? fromReadableStream(response.body) : (async function* () {})()
+		};
+	};
+}
+//#endregion
+//#region src/core/data-channels.ts
+const MESSAGE_TYPE_REQUEST = "REQUEST";
+const MESSAGE_TYPE_RESPONSE = "RESPONSE";
+let __invocationCounter = 0;
+function newInvokationChannel({ port, handler = () => {
+	throw new Error("Handler not implemented");
+}, onError = console.error, newCallId = () => ++__invocationCounter }) {
+	const requests = {};
+	const listener = async (event) => {
+		const data = event.data ?? {};
+		if (data.type === MESSAGE_TYPE_REQUEST) try {
+			const result = await handler(data.request, ...event.ports);
+			const [response, ...transfers] = Array.isArray(result) ? result : result !== void 0 ? [result] : [];
+			port.postMessage({
+				type: MESSAGE_TYPE_RESPONSE,
+				callId: data.callId,
+				response
+			}, transfers);
+		} catch (error) {
+			port.postMessage({
+				type: MESSAGE_TYPE_RESPONSE,
+				callId: data.callId,
+				error: serializeError(error)
+			});
+		}
+		else if (data.type === MESSAGE_TYPE_RESPONSE) {
+			const pending = requests[data.callId];
+			delete requests[data.callId];
+			if (!pending) return;
+			if (data.error) pending.reject(deserializeError(data.error));
+			else pending.resolve(data.response);
+		}
+	};
+	const start = async () => {
+		try {
+			port.addEventListener("message", listener);
+			await port.start?.();
+		} catch (e) {
+			onError(e);
+		}
+	};
+	const close = async () => {
+		try {
+			port.removeEventListener("message", listener);
+			await port.close?.();
+		} catch (e) {
+			onError(e);
+		}
+	};
+	const invoke = (request = {}, ...transfers) => {
+		const callId = newCallId();
+		return new Promise((resolve, reject) => {
+			try {
+				requests[callId] = {
+					resolve,
+					reject
+				};
+				port.postMessage({
+					type: MESSAGE_TYPE_REQUEST,
+					callId,
+					request
+				}, transfers);
+			} catch (error) {
+				delete requests[callId];
+				reject(error);
+			}
+		});
+	};
+	return {
+		start,
+		close,
+		invoke
+	};
+}
+async function* sendStream(communicationPort, input, params = {}) {
+	const messageChannel = new MessageChannel();
+	communicationPort.postMessage({
+		type: "START_CALL",
+		params
+	}, [messageChannel.port2]);
+	const channel = newStreamChannel(messageChannel.port1);
+	let drained = false;
+	try {
+		await channel.start();
+		channel.sendAll(input);
+		yield* channel.recieveAll();
+		drained = true;
+	} finally {
+		if (!drained) channel.cancel();
+		await channel.close();
+	}
+}
+function handleStreams(communicationPort, handler) {
+	const listener = async (event) => {
+		const { type, params } = event.data ?? {};
+		if (type !== "START_CALL") return;
+		const port = event.ports[0];
+		const channel = newStreamChannel(port);
+		try {
+			await channel.start();
+			const response = await handler(channel.recieveAll(), params ?? {});
+			await channel.sendAll(response);
+		} finally {
+			await channel.close();
+		}
+	};
+	communicationPort.addEventListener("message", listener);
+	communicationPort.start?.();
+	return () => communicationPort.removeEventListener("message", listener);
+}
+function newStreamChannel(port) {
+	let listeners = [];
+	let iterators = [];
+	const notifyAll = async (data) => {
+		for (const listener of listeners) await listener(data);
+	};
+	/**
+	* Release whatever we are sending. NOT awaited: `.return()` on an async
+	* generator parked awaiting its own source is queued behind that pending
+	* `next()`, so awaiting it here would block the message handler — and the
+	* chunk that would unblock it can only arrive through that same handler.
+	*/
+	const cancelOutgoing = () => {
+		for (const it of [...iterators]) {
+			const iterable = it;
+			Promise.resolve(iterable.return?.()).catch(() => {});
+		}
+	};
+	const channel = newInvokationChannel({
+		port,
+		handler: (data) => {
+			const message = data;
+			if (message?.cancel) {
+				cancelOutgoing();
+				return;
+			}
+			return notifyAll(message);
+		}
+	});
+	const start = () => channel.start();
+	const cancel = () => {
+		channel.invoke({ cancel: true }).catch(() => {});
+	};
+	const close = async () => {
+		await notifyAll({ done: true });
+		for (const it of [...iterators]) await it.return?.();
+		await channel.close();
+	};
+	async function* recieveAll() {
+		yield* recieveIterator((deliver) => {
+			listeners.push(deliver);
+			return () => {
+				listeners = listeners.filter((l) => l !== deliver);
+			};
+		});
+	}
+	async function sendAll(it) {
+		await sendIterator((chunk) => void channel.invoke(chunk), (async function* () {
+			try {
+				iterators.push(it);
+				yield* it;
+			} finally {
+				iterators = iterators.filter((i) => i !== it);
+			}
+		})());
+	}
+	return {
+		start,
+		close,
+		cancel,
+		recieveAll,
+		sendAll
+	};
+}
+//#endregion
+//#region src/http/http-send-recieve.ts
+async function* httpToIterator(envelopeOrPromise) {
+	const { options, content } = await envelopeOrPromise;
+	yield new TextEncoder().encode(JSON.stringify(options));
+	yield* content;
+}
+async function httpFromIterator(iterable) {
+	const it = (await iterable)[Symbol.asyncIterator]();
+	const { done, value } = await it.next();
+	let options = {};
+	if (!done && value) {
+		const str = new TextDecoder().decode(value);
+		options = JSON.parse(str);
+	}
+	return {
+		options,
+		content: { [Symbol.asyncIterator]() {
+			return it;
+		} }
+	};
+}
+/**
+* Serve an `HttpHandler` over a `MessageTarget`, using this package's own
+* `handleStreams` transport.
+*
+* @deprecated Prefer the port stack in `@statewalker/webrun-rpc`: open a port
+* (`multiplexPort` over one pipe, or `transferPortMux` where the platform can
+* transfer a real `MessagePort`), turn it into a `Duplex` with
+* `serveDuplexOverPort`, and serve HTTP on that with
+* `httpServe(handler, options)` from `@statewalker/webrun-http-streams`.
+*
+* That path has backpressure; **this one does not.** `sendStream`'s chunk
+* sender discards the promise it is given, so a fast producer over a slow
+* consumer accumulates without bound. It also has no per-stream timeout and no
+* chunking to a transport's message ceiling.
+*
+* Kept for existing ServiceWorker setups built on the `MessageTarget` surface.
+*/
+function handleHttpRequests(communicationPort, handler) {
+	const serverStub = newHttpServerStub(handler);
+	return handleStreams(communicationPort, async (it) => {
+		const envelope = await httpFromIterator(it);
+		return httpToIterator(await serverStub(envelope));
+	});
+}
+/**
+* Ship a `Request` over a `MessageTarget` and await the `Response`, using this
+* package's own `sendStream` transport.
+*
+* @deprecated Prefer the port stack in `@statewalker/webrun-rpc`: open a port
+* (`multiplexPort` over one pipe, or `transferPortMux` where the platform can
+* transfer a real `MessagePort`), turn it into a `Duplex` with
+* `duplexOverPort`, and drive HTTP over it with `httpFetch` from
+* `@statewalker/webrun-http-streams`.
+*
+* Same caveat as {@link handleHttpRequests}: the transport underneath this
+* helper has no backpressure, no per-stream timeout, and no chunking to a
+* transport's message ceiling. Kept for existing ServiceWorker setups.
+*/
+async function sendHttpRequest(communicationPort, request) {
+	return await newHttpClientStub(async (req) => {
+		return await httpFromIterator(sendStream(communicationPort, httpToIterator(req)));
+	})(request);
+}
+//#endregion
+//#region ../../../../node_modules/.pnpm/idb-keyval@6.3.0/node_modules/idb-keyval/dist/index.js
+function promisifyRequest(request) {
+	return new Promise((resolve, reject) => {
+		request.oncomplete = request.onsuccess = () => resolve(request.result);
+		request.onabort = request.onerror = () => reject(request.error);
+	});
+}
+function createStore(dbName, storeName) {
+	let dbp;
+	const getDB = () => {
+		if (dbp) return dbp;
+		const request = indexedDB.open(dbName);
+		request.onupgradeneeded = () => request.result.createObjectStore(storeName);
+		dbp = promisifyRequest(request);
+		dbp.then((db) => {
+			db.onclose = () => dbp = void 0;
+		}, () => {
+			dbp = void 0;
+		});
+		return dbp;
+	};
+	return (txMode, callback) => getDB().then((db) => callback(db.transaction(storeName, txMode).objectStore(storeName)));
+}
+let defaultGetStoreFunc;
+function defaultGetStore() {
+	if (!defaultGetStoreFunc) defaultGetStoreFunc = createStore("keyval-store", "keyval");
+	return defaultGetStoreFunc;
+}
+/**
+* Get a value by its key.
+*
+* @param key
+* @param customStore Method to get a custom store. Use with caution (see the docs).
+*/
+function get(key, customStore = defaultGetStore()) {
+	return customStore("readonly", (store) => promisifyRequest(store.get(key)));
+}
+/**
+* Set a value with a key.
+*
+* @param key
+* @param value
+* @param customStore Method to get a custom store. Use with caution (see the docs).
+*/
+function set(key, value, customStore = defaultGetStore()) {
+	return customStore("readwrite", (store) => {
+		store.put(value, key);
+		return promisifyRequest(store.transaction);
+	});
+}
+//#endregion
+//#region src/core/data-calls.ts
+function callChannel(target, callType, params, ...transfers) {
+	return new Promise((resolve, reject) => {
+		const channel = new MessageChannel();
+		channel.port1.onmessage = (ev) => {
+			const { result, error } = ev.data;
+			if (error) reject(deserializeError(error));
+			else resolve(result);
+		};
+		target.postMessage({
+			type: callType,
+			params
+		}, [channel.port2, ...transfers]);
+	});
+}
+function handleChannelCalls(target, callType, handler) {
+	const listener = async (event) => {
+		if (!event.data || event.data.type !== callType) return;
+		const [port, ...transfers] = event.ports ?? [];
+		const response = {};
+		try {
+			response.result = await handler(event, event.data.params, ...transfers);
+		} catch (error) {
+			response.error = serializeError(error);
+		}
+		port?.postMessage(response);
+	};
+	target.addEventListener("message", listener);
+	target.start?.();
+	return () => target.removeEventListener("message", listener);
+}
+//#endregion
+//#region src/core/registry.ts
+function newRegistry(onError = console.error) {
+	let counter = 0;
+	const registrations = {};
+	const register = (action) => {
+		const id = counter++;
+		const fn = Object.assign((skip) => {
+			try {
+				delete registrations[id];
+				return skip ? void 0 : action();
+			} catch (error) {
+				onError(error);
+			}
+		}, { action });
+		registrations[id] = fn;
+		return fn;
+	};
+	const unregister = (action) => {
+		for (const r of Object.values(registrations)) if (r.action === action) r(true);
+	};
+	const clear = () => {
+		for (const r of Object.values(registrations)) r();
+	};
+	return Object.assign([
+		register,
+		clear,
+		unregister
+	], {
+		register,
+		clear,
+		unregister
+	});
+}
+//#endregion
+//#region src/sw/sw-dispatcher.ts
+/**
+* Page-side counterpart: registers a ServiceWorker and sets up a
+* MessageChannel with it, re-establishing the connection after SW wake-ups.
+*/
+var SwPortHandler = class {
+	options;
+	_serviceWorkerUrl;
+	_serviceWorker;
+	_registrationPromise;
+	_cleanupRegistrations;
+	constructor(options) {
+		this.options = options;
+		if (!this.key) throw new Error("Key is not defined.");
+		if (!this.scope) throw new Error("Scope is not defined");
+	}
+	get key() {
+		return this.options.key;
+	}
+	get scope() {
+		return this.options.scope ?? new URL("./", this.serviceWorkerUrl).pathname;
+	}
+	get rootUrl() {
+		return new URL(this.scope, import.meta.url);
+	}
+	get serviceWorkerUrl() {
+		if (!this._serviceWorkerUrl) {
+			const url = this.options.serviceWorkerUrl ? resolveWorkerUrl(this.options.serviceWorkerUrl) : new URL("./index-sw.js", this.rootUrl);
+			this._serviceWorkerUrl = `${url}`;
+		}
+		return this._serviceWorkerUrl;
+	}
+	async _newCommunicationChannel() {
+		const messageChannel = new MessageChannel();
+		return [messageChannel.port1, messageChannel.port2];
+	}
+	async _setCommunicationPort(port) {
+		await this.options.bindPort(port);
+	}
+	async _updateCommunicationChannel() {
+		if (!this._serviceWorker) return;
+		const [port1, port2] = await this._newCommunicationChannel();
+		await this._setCommunicationPort(port1);
+		await callChannel(this._serviceWorker, "UPDATE_COMMUNICATION_PORT", this._getRegistrationInfo(), port2);
+	}
+	_getRegistrationInfo() {
+		return { key: this.key };
+	}
+	async start() {
+		if (!this._registrationPromise) this._registrationPromise = (async () => {
+			const [register, cleanup] = newRegistry();
+			this._cleanupRegistrations = cleanup;
+			register(() => {
+				this._cleanupRegistrations = void 0;
+			});
+			const registration = await navigator.serviceWorker.register(this.serviceWorkerUrl, { scope: this.scope });
+			register(() => registration.unregister());
+			register(handleChannelCalls(navigator.serviceWorker, "UPDATE_COMMUNICATION_PORT", async (_event, _params, port) => {
+				await this._setCommunicationPort(port);
+				return this._getRegistrationInfo();
+			}));
+			this._serviceWorker = await getServiceWorkerController();
+			await awaitServiceWorkerActivation(this._serviceWorker);
+			await this._updateCommunicationChannel();
+		})();
+		return this._registrationPromise;
+	}
+	async stop() {
+		this._cleanupRegistrations?.();
+		const registrations = await navigator.serviceWorker.getRegistrations();
+		for (const registration of registrations) try {
+			await registration.unregister();
+		} catch (error) {
+			console.log("Service Worker registration failed: ", error);
+		}
+	}
+};
+function getServiceWorkerController() {
+	return new Promise((resolve) => {
+		const container = navigator.serviceWorker;
+		if (container.controller) {
+			resolve(container.controller);
+			return;
+		}
+		const onChange = () => {
+			if (!container.controller) return;
+			resolve(container.controller);
+			container.removeEventListener("controllerchange", onChange);
+		};
+		container.addEventListener("controllerchange", onChange);
+	});
+}
+function awaitServiceWorkerActivation(worker) {
+	return new Promise((resolve) => {
+		if (worker.state === "activated") {
+			resolve();
+			return;
+		}
+		const onStateChange = () => {
+			if (worker.state !== "activated") return;
+			worker.removeEventListener("statechange", onStateChange);
+			resolve();
+		};
+		worker.addEventListener("statechange", onStateChange);
+	});
+}
+/**
+* ServiceWorker-side counterpart: maintains an index of connected clients keyed by
+* clientId, persisted in IndexedDB so it can reclaim ports across SW restarts.
+*/
+var SwPortDispatcher = class {
+	self;
+	log;
+	handlersIndex = /* @__PURE__ */ new Map();
+	/**
+	* Set of keys that were registered at some point on this SW (sticky —
+	* survives client closures + SW wake-ups via IndexedDB). Lets the fetch
+	* handler distinguish "site URL whose owner is gone → 404" from
+	* "unknown URL under scope → pass through to the network".
+	*/
+	claimedKeys = /* @__PURE__ */ new Set();
+	_cleanup;
+	_activationPromise;
+	constructor({ self, log = () => {} }) {
+		this.self = self;
+		this.log = log;
+	}
+	get scope() {
+		return `${new URL("./", this.self.location.href)}`;
+	}
+	/**
+	* Look up the active channel for a key. Returns `undefined` when there
+	* is no registration (or the registering client has gone away — stale
+	* entries are pruned in place).
+	*/
+	async loadChannelInfo(key) {
+		await this._checkActivation();
+		for (const channelInfo of this.handlersIndex.values()) {
+			if (channelInfo.key !== key) continue;
+			const clientId = channelInfo.clientId;
+			if (!clientId) continue;
+			if (!await this.self.clients.get(clientId)) {
+				this.handlersIndex.delete(clientId);
+				continue;
+			}
+			return channelInfo;
+		}
+	}
+	/** Whether `key` has ever been registered on this SW. */
+	isClaimedKey(key) {
+		return this.claimedKeys.has(key);
+	}
+	start() {
+		this._cleanup = handleChannelCalls(this.self, "UPDATE_COMMUNICATION_PORT", async (event, channelInfo, port) => {
+			const clientId = event.source?.id;
+			this.log("[UPDATE_COMMUNICATION_PORT]", clientId, channelInfo);
+			await this._updateChannelInfo({
+				...channelInfo,
+				port,
+				clientId
+			});
+			return { ...channelInfo };
+		});
+		this.self.addEventListener("install", (event) => {
+			this.log("Skip waiting on install.", event);
+			this.self.skipWaiting();
+		});
+		this.self.addEventListener("activate", (event) => {
+			this.log("Claim control over all clients.", event);
+			event.waitUntil((async () => {
+				await this.self.clients.claim();
+				await this._checkActivation();
+			})());
+		});
+	}
+	async stop() {
+		if (this._cleanup) {
+			this._cleanup();
+			this._cleanup = void 0;
+		}
+	}
+	_checkActivation() {
+		if (!this._activationPromise) this._activationPromise = this._activate();
+		return this._activationPromise;
+	}
+	async _activate() {
+		this.log("[checkActivation]");
+		const clientsIndex = await this._loadClientIds();
+		for (const [clientId, client] of clientsIndex.entries()) {
+			const messageChannel = new MessageChannel();
+			const port = messageChannel.port1;
+			const channelInfo = await callChannel(client, "UPDATE_COMMUNICATION_PORT", {}, messageChannel.port2);
+			await this._updateChannelInfo({
+				...channelInfo,
+				port,
+				clientId
+			});
+		}
+	}
+	async _updateChannelInfo(channelInfo) {
+		this.log("[updateClientInfo]", channelInfo);
+		if (!channelInfo.clientId) return;
+		this.handlersIndex.set(channelInfo.clientId, channelInfo);
+		if (channelInfo.key && !this.claimedKeys.has(channelInfo.key)) {
+			this.claimedKeys.add(channelInfo.key);
+			await set("claimedKeys", [...this.claimedKeys].sort());
+		}
+		await this._updateClientIds([]);
+	}
+	async _loadClientIds() {
+		const storedKeys = await get("claimedKeys") ?? [];
+		for (const key of storedKeys) this.claimedKeys.add(key);
+		const stored = await get("clientIds") ?? [];
+		return await this._updateClientIds(new Set(stored));
+	}
+	async _updateClientIds(clientIds) {
+		const ids = new Set(clientIds);
+		for (const clientId of this.handlersIndex.keys()) ids.add(clientId);
+		const index = /* @__PURE__ */ new Map();
+		for (const clientId of ids) {
+			const client = await this.self.clients.get(clientId);
+			if (client) index.set(clientId, client);
+			else this.handlersIndex.delete(clientId);
+		}
+		await set("clientIds", [...index.keys()].sort());
+		return index;
+	}
+};
+/**
+* Resolve a `serviceWorkerUrl` option the way a page would: relative to the
+* current document. Absolute urls pass through untouched. A url that cannot
+* be resolved is reported with the option name and the offending value,
+* because the raw `TypeError: Failed to construct 'URL': Invalid URL` says
+* neither.
+*/
+function resolveWorkerUrl(serviceWorkerUrl) {
+	const base = globalThis.location?.href;
+	try {
+		return new URL(serviceWorkerUrl, base);
+	} catch (error) {
+		throw new Error(`Invalid serviceWorkerUrl: ${JSON.stringify(serviceWorkerUrl)}` + (base ? ` (relative to ${base})` : " (no document to resolve it against)"), { cause: error });
+	}
+}
+//#endregion
+//#region src/sw/http-sw-dispatcher.ts
+var SwHttpAdapter = class extends SwPortHandler {
+	_handlers = /* @__PURE__ */ new Map();
+	_cleanupRequestChannel;
+	constructor(options) {
+		super({
+			bindPort: () => {},
+			...options
+		});
+	}
+	async _setCommunicationPort(port) {
+		this._cleanupRequestChannel?.();
+		this._cleanupRequestChannel = handleHttpRequests(port, this._handleHttpRequest.bind(this));
+	}
+	async _handleHttpRequest(request) {
+		const requestUrl = request.url;
+		for (const [urlPrefix, handler] of this._handlers) if (requestUrl.indexOf(urlPrefix) === 0) return handler(request);
+		return new Response(null, {
+			status: 404,
+			statusText: "Error 404: Not found"
+		});
+	}
+	/**
+	* Registers an HTTP handler on a prefix. Returns the resulting base URL and a
+	* disposer.
+	*/
+	async register(prefix, handler) {
+		const cleanPrefix = `./${(prefix ?? "").replace(/^[./]+/, "")}`;
+		const baseUrl = `${new URL(cleanPrefix, this.rootUrl)}`;
+		this._handlers.set(baseUrl, handler);
+		const handlers = this._handlers;
+		return {
+			baseUrl,
+			prefix: cleanPrefix,
+			async remove() {
+				handlers.delete(baseUrl);
+			}
+		};
+	}
+};
+var SwHttpDispatcher = class extends SwPortDispatcher {
+	start() {
+		super.start();
+		this.self.addEventListener("fetch", this._handleFetchEvent.bind(this));
+	}
+	_handleFetchEvent(event) {
+		event.respondWith((async () => {
+			const request = event.request;
+			try {
+				const requestUrl = request.url;
+				const rootUrl = this.scope;
+				if (requestUrl.indexOf(rootUrl) === 0) {
+					const key = requestUrl.substring(rootUrl.length).replace(/^\/?([^/]+).*$/, "$1");
+					const channelInfo = await this.loadChannelInfo(key);
+					if (channelInfo?.port) return await sendHttpRequest(channelInfo.port, request);
+					if (this.isClaimedKey(key)) return new Response(null, {
+						status: 404,
+						statusText: "Not Found (no active handler)"
+					});
+				}
+				return await fetch(request);
+			} catch (error) {
+				console.error(error);
+				return new Response(null, {
+					status: 500,
+					statusText: "Error 500: Internal error"
+				});
+			}
+		})());
+	}
+};
+function startHttpDispatcher(options) {
+	const dispatcher = new SwHttpDispatcher(options);
+	dispatcher.start();
+	return () => {
+		dispatcher.stop();
+	};
+}
+//#endregion
+export { SwHttpAdapter, SwHttpDispatcher, SwPortDispatcher, SwPortHandler, startHttpDispatcher };