@statewalker/webrun-http-browser 0.3.3 → 0.4.2

package/dist/sw-worker.js

@@ -0,0 +1,1597 @@
+(function() {
+	//#region ../webrun-streams/dist/index.js
+	function serializeError(error) {
+		if (error instanceof Error) {
+			const out = {
+				message: error.message,
+				stack: error.stack
+			};
+			const bag = error;
+			for (const key of Object.keys(bag)) out[key] = bag[key];
+			return out;
+		}
+		if (typeof error === "object" && error !== null) {
+			const bag = error;
+			return {
+				message: String(bag.message ?? error),
+				...bag
+			};
+		}
+		return { message: String(error) };
+	}
+	function deserializeError(error) {
+		const payload = typeof error === "string" ? { message: error } : error;
+		return Object.assign(new Error(payload.message), payload);
+	}
+	new TextEncoder();
+	new TextDecoder();
+	/**
+	* The newAsyncGenerator function creates async generators from callback-based initialization
+	* functions, providing a bridge between imperative event handling and declarative async
+	* iteration patterns.
+	*
+	* The initialization function receives two callback functions that control the generator's
+	* behavior. The `next` function yields values to consumers, while the `done` function
+	* signals completion or error conditions. The initialization function can return a cleanup
+	* function that will be called when the generator is closed or an error occurs.
+	*
+	* The generator manages an internal queue of values and completion signals, ensuring that
+	* producers can yield values without overwhelming consumers. Proper backpressure is implemented
+	* by having the `next` and `done` functions return promises that resolve only after the
+	* consumer has processed the values. This prevents memory leaks and ensures that producers
+	* are aware of whether their values were successfully handled.
+	* The generator also handles cleanup by draining any remaining items in the queue and notifying
+	* producers that their values were not processed if the generator is closed early. This ensures
+	* that resources are properly managed and that no memory leaks occur.
+	*
+	* Example usage:
+	* ```typescript
+	* const asyncGen = newAsyncGenerator<number>((next, done) => {
+	*   let count = 0;
+	*   const interval = setInterval(() => {
+	*     if (count < 5) {
+	*       next(count++);
+	*     } else {
+	*       done();
+	*       clearInterval(interval);
+	*     }
+	*   }, 1000);
+	*   return () => clearInterval(interval); // Cleanup function
+	* });
+	* (async () => {
+	*   for await (const num of asyncGen) {
+	*     console.log(num); // Logs numbers 0 to 4 at 1 second intervals
+	*   }
+	*   console.log("Completed");
+	* })();
+	* ```
+	* @template T The type of values yielded by the generator
+	* @template E The type of errors that can be thrown; defaults to Error
+	* @param init Initialization function that sets up the generator behavior with next/done callbacks;
+	*  The first parameter - `next` function - is used to yield values to consumers;
+	*  It returns a Promise<boolean> indicating whether the value was successfully handled;
+	*  The second parameter - `done` function - is used to signal completion or error;
+	*  It returns a Promise<boolean> indicating whether the completion was successfully handled;
+	*  The initialization function can optionally return a cleanup function that will be called
+	*  when the generator is closed or an error occurs;
+	* @param skipValues If true, only the most recent value is kept in the queue,
+	* skipping intermediate values (not consumed values are considered skipped);
+	* This is useful for scenarios where only the latest value matters, such as UI updates.
+	* Defaults to false, meaning all values are queued and processed in order.
+	* @returns AsyncGenerator that properly manages backpressure and resource cleanup
+	*/
+	async function* newAsyncGenerator(init, skipValues = false) {
+		let head;
+		let tail;
+		/** Flag to prevent new values from being queued after generator closes */
+		let closed = false;
+		/** Wake-up function to notify the generator loop of new items */
+		let wakeUp;
+		/**
+		* Drains the internal queue, notifying all pending producers that their values
+		* were not processed due to generator closure. This prevents memory leaks and
+		* ensures proper backpressure signaling.
+		*/
+		const drainQueue = () => {
+			for (; head; head = head.next) {
+				closed = closed || head.done;
+				head.resolve(false);
+			}
+			tail = void 0;
+		};
+		/**
+		* Enqueues a value or completion signal with a promise that resolves when the item
+		* is processed. This enables backpressure by allowing producers to know when their
+		* values have been consumed.
+		*/
+		const enqueue = (params) => {
+			if (skipValues) drainQueue();
+			return !closed ? new Promise((resolve) => {
+				const next = {
+					...params,
+					next: void 0,
+					resolve
+				};
+				if (tail) tail.next = next;
+				tail = next;
+				if (!head) head = tail;
+				wakeUp?.();
+			}) : Promise.resolve(false);
+		};
+		/**
+		* Producer function to yield a value to consumers. Returns a promise that resolves
+		* to true if the value was successfully processed, false if the generator is closed
+		* or the value was skipped due to backpressure.
+		*/
+		const next = (value) => enqueue({
+			done: false,
+			value
+		});
+		/**
+		* Producer function to signal completion or error. Optional error parameter will
+		* cause the generator to throw that error to consumers.
+		*/
+		const done = (error) => enqueue({
+			done: true,
+			error
+		});
+		const unsubscribe = init(next, done);
+		try {
+			while (!closed) {
+				if (!head) {
+					await new Promise((resolve) => {
+						wakeUp = resolve;
+					}).then(() => {
+						wakeUp = void 0;
+					});
+					continue;
+				}
+				const slot = head;
+				head = head.next;
+				if (tail === slot) tail = head;
+				try {
+					if (slot.done) {
+						closed = true;
+						if (slot.error !== void 0) throw slot.error;
+						break;
+					}
+					yield slot.value;
+				} finally {
+					slot.resolve(true);
+				}
+			}
+		} finally {
+			/**
+			* Cleanup phase - ensures proper resource management and notification of any
+			* remaining producers. This runs whether the generator completes normally,
+			* encounters an error, or is closed early by the consumer.
+			*/
+			closed = true;
+			wakeUp?.();
+			if (typeof unsubscribe === "function") await unsubscribe();
+			/**
+			* Drain any remaining items in the queue and notify their producers that
+			* the values were not processed. This prevents memory leaks and ensures
+			* proper backpressure signaling.
+			*/
+			drainQueue();
+		}
+	}
+	new TextEncoder();
+	/**
+	* The iterator ↔ `ReadableStream` boundary.
+	*
+	* Both adapters must carry CANCELLATION, not just data: a response body leaves
+	* a handler as a `ReadableStream`, crosses a transport as an iterator, and
+	* becomes a `ReadableStream` again at the caller — so when the caller walks
+	* away, the only path back to the handler's producer runs through both of
+	* these functions. Teardown that stops at an adapter leaves a producer running
+	* for ever.
+	*/
+	function toReadableStream(it) {
+		return new ReadableStream({
+			/**
+			* One chunk per pull. An earlier version drained the whole iterator inside
+			* a single `pull`, which defeated the stream's own backpressure (every
+			* chunk was enqueued as fast as the producer could make them, however slow
+			* the reader was) and left no point between chunks at which a cancellation
+			* could take effect.
+			*/
+			async pull(controller) {
+				try {
+					const slot = await it.next();
+					if (!slot || slot.done) {
+						controller.close();
+						return;
+					}
+					controller.enqueue(await slot.value);
+				} catch (error) {
+					controller.error(error);
+				}
+			},
+			/**
+			* Release the source. NOT awaited: `.return()` on an async generator that
+			* is parked awaiting its own source is queued behind that pending
+			* `next()`, so awaiting it here would hang `reader.cancel()` on exactly
+			* the producers that most need cancelling.
+			*/
+			cancel(reason) {
+				Promise.resolve(it.return?.(reason)).catch(() => {});
+			}
+		});
+	}
+	async function* fromReadableStream(stream) {
+		const reader = stream.getReader();
+		let drained = false;
+		try {
+			while (true) {
+				const { done, value } = await reader.read();
+				if (done) {
+					drained = true;
+					break;
+				}
+				if (value !== void 0) yield value;
+			}
+		} finally {
+			if (drained) reader.releaseLock();
+			else await reader.cancel().catch(() => {});
+		}
+	}
+	/**
+	* Inverse of {@link sendIterator}: turns a sequence of `{done, value, error}`
+	* chunks (delivered to the supplied callback by `installer`) into an async
+	* generator.
+	*
+	* The `installer` is given a `deliver` function. It should call `deliver`
+	* once for each incoming chunk and may return a cleanup callback that
+	* runs when the consumer stops iterating.
+	*/
+	function recieveIterator(installer) {
+		return newAsyncGenerator((next, done) => {
+			const cleanup = installer(async (chunk = { done: true }) => {
+				const { done: isDone = true, value, error } = chunk;
+				if (error) return await done(error);
+				if (isDone) return await done();
+				return await next(value);
+			});
+			if (cleanup) return async () => {
+				await cleanup();
+			};
+		});
+	}
+	/**
+	* Drain an async iterator into a sink that consumes one chunk at a time.
+	*
+	* Each yielded value becomes `{ done: false, value }`. Completion emits
+	* `{ done: true }`. If the iterator throws, the error is caught and the
+	* final `done` chunk carries it so the peer can rethrow on its side.
+	*/
+	async function sendIterator(send, it) {
+		let error;
+		try {
+			for await (const value of it) await send({
+				done: false,
+				value
+			});
+		} catch (err) {
+			error = err;
+		} finally {
+			await send({
+				done: true,
+				error
+			});
+		}
+	}
+	//#endregion
+	//#region ../webrun-http-streams/dist/index.js
+	const CR = 13;
+	const LF = 10;
+	const EMPTY = /* @__PURE__ */ new Uint8Array(0);
+	var ByteStreamError = class extends Error {
+		name = "ByteStreamError";
+	};
+	function toAsyncIterator(input) {
+		const asyncIter = input[Symbol.asyncIterator];
+		if (asyncIter) return asyncIter.call(input);
+		const syncIter = input[Symbol.iterator]();
+		return { next() {
+			return Promise.resolve(syncIter.next());
+		} };
+	}
+	/**
+	* Discard an iterable we are contractually forbidden from consuming — a body
+	* skipped for HEAD/204, or one abandoned because the peer reported an error.
+	*
+	* The `.next()` is not optional: `.return()` on a generator still in suspended
+	* start is a no-op, so the body never runs and its `try/finally` never unwinds.
+	* Without it a wrapped ReadableStream or socket is never cancelled.
+	*/
+	async function discard(source) {
+		if (source === void 0) return;
+		const it = toAsyncIterator(source);
+		try {
+			await it.next();
+			await it.return?.();
+		} catch {}
+	}
+	function concatChunks(parts, totalLen) {
+		if (parts.length === 1) {
+			const only = parts[0];
+			if (only !== void 0) return only;
+		}
+		const out = new Uint8Array(totalLen);
+		let off = 0;
+		for (const p of parts) {
+			out.set(p, off);
+			off += p.byteLength;
+		}
+		return out;
+	}
+	/**
+	* Pull-based reader over a byte source. Holds at most one pending buffer, and
+	* hands out `subarray` views rather than copies — a body never passes through
+	* an allocation here.
+	*/
+	var ByteReader = class {
+		#iter;
+		#buf = EMPTY;
+		#done = false;
+		constructor(input) {
+			this.#iter = toAsyncIterator(input);
+		}
+		/** Bytes already pulled from the source but not yet consumed. */
+		bufferedLength() {
+			return this.#buf.byteLength;
+		}
+		/** Pull one more non-empty chunk. Returns false at end of stream. */
+		async #pull() {
+			if (this.#done) return false;
+			while (true) {
+				const next = await this.#iter.next();
+				if (next.done) {
+					this.#done = true;
+					return false;
+				}
+				const chunk = next.value;
+				if (chunk.byteLength === 0) continue;
+				this.#buf = this.#buf.byteLength === 0 ? chunk : concatChunks([this.#buf, chunk], this.#buf.byteLength + chunk.byteLength);
+				return true;
+			}
+		}
+		async peekByte() {
+			while (this.#buf.byteLength === 0) if (!await this.#pull()) return void 0;
+			return this.#buf[0];
+		}
+		/** Up to `max` bytes. `undefined` means end of stream. */
+		async readSome(max) {
+			while (this.#buf.byteLength === 0) if (!await this.#pull()) return void 0;
+			const take = Math.min(max, this.#buf.byteLength);
+			const out = this.#buf.subarray(0, take);
+			this.#buf = this.#buf.subarray(take);
+			return out;
+		}
+		/**
+		* One CRLF-terminated line, without the CRLF. A bare LF is rejected: real
+		* peers always send CRLF, and tolerating a bare LF is precisely the lenience
+		* that lets request smuggling through a proxy pair.
+		*
+		* The `maxBytes` bound is best-effort: it only rejects a line if the check
+		* happens to run before the line is fully buffered. A line already sitting in
+		* the buffer bypasses the check. Callers needing a hard per-line limit or
+		* aggregate bounds must keep their own running total.
+		*/
+		async readLine(maxBytes) {
+			let searched = 0;
+			while (true) {
+				const idx = this.#buf.indexOf(LF, searched);
+				if (idx !== -1) {
+					if (idx === 0 || this.#buf[idx - 1] !== CR) throw new ByteStreamError("bare LF line terminator; CRLF required");
+					const line = this.#buf.subarray(0, idx - 1);
+					this.#buf = this.#buf.subarray(idx + 1);
+					return line;
+				}
+				searched = this.#buf.byteLength;
+				if (searched > maxBytes) throw new ByteStreamError(`line exceeds ${maxBytes} bytes without CRLF`);
+				if (!await this.#pull()) throw new ByteStreamError(`stream ended after ${searched} bytes without CRLF`);
+			}
+		}
+		/** Everything not yet consumed, lazily. */
+		async *rest() {
+			while (true) {
+				if (this.#buf.byteLength > 0) {
+					const out = this.#buf;
+					this.#buf = EMPTY;
+					yield out;
+					continue;
+				}
+				if (!await this.#pull()) return;
+			}
+		}
+	};
+	/**
+	* Raised for any byte sequence this codec refuses to interpret. Every case is
+	* a refusal to guess: HTTP/1.1 parsers that guess are how request smuggling
+	* works.
+	*/
+	var HttpParseError = class extends Error {
+		name = "HttpParseError";
+	};
+	const NEWLINE = 10;
+	/** Mirrors the HTTP/1.1 codec's default `maxHeaderBytes`. */
+	const MAX_ENVELOPE_BYTES = 65536;
+	const encoder$1 = new TextEncoder();
+	const decoder = new TextDecoder();
+	/**
+	* Encode an HTTP envelope plus optional body as one continuous byte stream:
+	*
+	*     <JSON.stringify(envelope)>\n<body bytes...>
+	*
+	* `JSON.stringify` with default whitespace never emits a literal `\n`, so the
+	* first `0x0a` byte unambiguously terminates the envelope.
+	*
+	* This is the same wire shape used by the legacy `webrun-http-port` package.
+	*/
+	async function* encodeMessage(envelope, body) {
+		yield encoder$1.encode(`${JSON.stringify(envelope)}\n`);
+		if (!body) return;
+		for await (const chunk of body) if (chunk.byteLength > 0) yield chunk;
+	}
+	/**
+	* Consume an envelope-then-body byte stream. Returns the parsed envelope and
+	* an async iterable over the remaining body bytes.
+	*/
+	async function decodeMessage(input) {
+		const iter = toAsyncIterator(input);
+		const accum = [];
+		let accumLen = 0;
+		let before;
+		let tail;
+		while (true) {
+			const next = await iter.next();
+			if (next.done) throw new HttpParseError(`decodeMessage: stream ended after ${accumLen} bytes without delimiter (\\n)`);
+			const chunk = next.value;
+			if (chunk.byteLength === 0) continue;
+			const nl = chunk.indexOf(NEWLINE);
+			if (nl === -1) {
+				accum.push(chunk);
+				accumLen += chunk.byteLength;
+				if (accumLen > MAX_ENVELOPE_BYTES) throw new HttpParseError(`decodeMessage: envelope exceeds ${MAX_ENVELOPE_BYTES} bytes without delimiter (\\n)`);
+				continue;
+			}
+			accum.push(chunk.subarray(0, nl));
+			accumLen += nl;
+			before = concatChunks(accum, accumLen);
+			tail = chunk.subarray(nl + 1);
+			break;
+		}
+		let envelope;
+		try {
+			envelope = JSON.parse(decoder.decode(before));
+		} catch (err) {
+			throw new HttpParseError(`decodeMessage: malformed envelope JSON at bytes 0..${before.byteLength}: ${err.message}`);
+		}
+		async function* body() {
+			if (tail.byteLength > 0) yield tail;
+			while (true) {
+				const next = await iter.next();
+				if (next.done) return;
+				if (next.value.byteLength > 0) yield next.value;
+			}
+		}
+		return {
+			envelope,
+			body: body()
+		};
+	}
+	const OPEN_BRACE = 123;
+	/**
+	* The original wire format — `<JSON.stringify(envelope)>\n<body bytes…>` —
+	* expressed as a `MessageCodec`. Direction-agnostic: requests and responses
+	* serialise identically.
+	*
+	* Retained so a peer pair can be upgraded in either order; see ADR-0006.
+	*/
+	const jsonEnvelopeCodec = {
+		name: "json-envelope",
+		sniff: (byte) => byte === OPEN_BRACE,
+		encodeRequest: (env, body) => encodeMessage(env, body),
+		encodeResponse: (env, body) => encodeMessage(env, body),
+		decodeRequest: (input) => decodeMessage(input),
+		decodeResponse: (input) => decodeMessage(input)
+	};
+	const TCHAR = /* @__PURE__ */ new Set("!#$%&'*+-.^_`|~0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ");
+	const SP = 32;
+	const HTAB = 9;
+	function isTokenChar(byte) {
+		return byte > SP && byte < 127 && TCHAR.has(String.fromCharCode(byte));
+	}
+	function isToken(value) {
+		if (value.length === 0) return false;
+		for (const ch of value) if (!TCHAR.has(ch)) return false;
+		return true;
+	}
+	/**
+	* Header bytes are latin-1: byte-preserving, matching Node, and lossless
+	* across a decode/encode round-trip. Control characters are rejected
+	* separately by `assertValidHeaderValue`.
+	*/
+	function decodeLatin1(bytes) {
+		let out = "";
+		for (const byte of bytes) out += String.fromCharCode(byte);
+		return out;
+	}
+	function encodeLatin1(text) {
+		const out = new Uint8Array(text.length);
+		for (let i = 0; i < text.length; i++) {
+			const code = text.charCodeAt(i);
+			if (code > 255) throw new HttpParseError(`not latin-1 encodable: ${JSON.stringify(text)}`);
+			out[i] = code;
+		}
+		return out;
+	}
+	const HOST_IP_LITERAL = /^\[[0-9A-Fa-f:.]+\](:\d{1,5})?$/;
+	const HOST_REG_NAME = /^[A-Za-z0-9._~-]+(:\d{1,5})?$/;
+	/**
+	* Validates a value that is about to become (or was read as) a `Host`
+	* header: untrusted input either way, so an unrecognised shape is a refusal,
+	* not a guess. Rejects a present-but-empty value, one carrying userinfo
+	* (`evil.com@good.com`), and — the reason this also runs on encode — one
+	* smuggling a CRLF-terminated line into the authority of a caller-supplied
+	* url. Never applied to trusted configuration (a codec's `opts.host`).
+	*/
+	function assertValidHost(host) {
+		if (!HOST_IP_LITERAL.test(host) && !HOST_REG_NAME.test(host)) throw new HttpParseError(`invalid Host header: ${JSON.stringify(host)}`);
+	}
+	/**
+	* A request-target must be entirely visible ASCII (RFC 9110 VCHAR) — nothing
+	* `<= 0x20` (space and every control character, CR/LF included) and nothing
+	* `>= 0x7F` (DEL and beyond). Applied on encode (`splitTarget`, so a
+	* caller-supplied url can never inject a second request line) and on decode
+	* (so a relay that decodes then re-encodes can never put an embedded control
+	* character back on the wire).
+	*/
+	function assertValidTarget(target) {
+		for (let i = 0; i < target.length; i++) {
+			const code = target.charCodeAt(i);
+			if (code <= SP || code >= 127) throw new HttpParseError(`invalid request-target: ${JSON.stringify(target)}`);
+		}
+	}
+	/**
+	* Shared control-character check behind both `assertValidHeaderValue` and
+	* `assertValidStatusText` — the two were previously checked by different,
+	* looser rules (statusText only rejected CR/LF), which is exactly the
+	* asymmetry class C1 and M5 are both instances of. `label` is prepended
+	* verbatim to each message, so callers keep their own wording.
+	*/
+	function assertNoControlChars(label, value) {
+		for (let i = 0; i < value.length; i++) {
+			const code = value.charCodeAt(i);
+			if (code === 13 || code === 10) throw new HttpParseError(`${label} contains CR or LF`);
+			if (code < SP && code !== HTAB || code === 127) throw new HttpParseError(`${label} contains a control character`);
+			if (code > 255) throw new HttpParseError(`${label} is not latin-1 encodable`);
+		}
+	}
+	function assertValidHeaderValue(name, value) {
+		assertNoControlChars(`header "${name}" value`, value);
+	}
+	/** Same character class as a header value (M5) — CR/LF, every C0 control, and DEL. */
+	function assertValidStatusText(value) {
+		assertNoControlChars("statusText", value);
+	}
+	function encodeHeaderLines(headers) {
+		let out = "";
+		for (const [name, value] of headers) {
+			if (!isToken(name)) throw new HttpParseError(`invalid header name: ${JSON.stringify(name)}`);
+			assertValidHeaderValue(name, value);
+			out += `${name}: ${value}\r\n`;
+		}
+		return out;
+	}
+	/**
+	* Read to the blank line. `alreadyUsed` is the byte count of the start line,
+	* so the bound covers the whole head section rather than the headers alone.
+	*/
+	async function readHeaderSection(reader, maxHeaderBytes, alreadyUsed) {
+		const headers = [];
+		let used = alreadyUsed;
+		while (true) {
+			const remaining = maxHeaderBytes - used;
+			if (remaining <= 0) throw new HttpParseError(`head section exceeds ${maxHeaderBytes} bytes`);
+			const lineBytes = await reader.readLine(remaining);
+			used += lineBytes.byteLength + 2;
+			if (used > maxHeaderBytes) throw new HttpParseError(`head section exceeds ${maxHeaderBytes} bytes`);
+			if (lineBytes.byteLength === 0) return headers;
+			if (lineBytes[0] === SP || lineBytes[0] === HTAB) throw new HttpParseError("obs-fold header continuation is not accepted");
+			const line = decodeLatin1(lineBytes);
+			const colon = line.indexOf(":");
+			if (colon <= 0) throw new HttpParseError(`malformed header line: ${JSON.stringify(line)}`);
+			const name = line.slice(0, colon);
+			if (!isToken(name)) throw new HttpParseError(`invalid header name: ${JSON.stringify(name)}`);
+			const value = line.slice(colon + 1).replace(/^[ \t]+/, "").replace(/[ \t]+$/, "");
+			assertValidHeaderValue(name, value);
+			headers.push([name, value]);
+		}
+	}
+	function getAll(headers, name) {
+		const lower = name.toLowerCase();
+		return headers.filter(([k]) => k.toLowerCase() === lower).map(([, v]) => v);
+	}
+	function withoutHeaders(headers, names) {
+		const drop = new Set(names.map((n) => n.toLowerCase()));
+		return headers.filter(([k]) => !drop.has(k.toLowerCase()));
+	}
+	/**
+	* Parse a `Content-Length` field into a single validated value.
+	*
+	* RFC 9110 §8.6 permits the value to be a comma-separated list of identical
+	* numbers (a relay may have appended one), so the list is folded; differing
+	* values are a refusal, not a choice. Shared by `resolveFraming` on decode and
+	* by the encoder's declared-length check, which previously carried its own
+	* copy that did NOT split on commas — so decode accepted `5, 5` while encode
+	* rejected it, and a relay that decoded then re-encoded threw.
+	*
+	* Returns undefined when the field is absent.
+	*/
+	function parseContentLength(values) {
+		if (values.length === 0) return void 0;
+		const unique = new Set(values.flatMap((v) => v.split(",").map((s) => s.trim())));
+		if (unique.size !== 1) throw new HttpParseError(`conflicting Content-Length values: ${[...unique].join(", ")}`);
+		const raw = [...unique][0];
+		if (!/^\d{1,15}$/.test(raw)) throw new HttpParseError(`invalid Content-Length: ${JSON.stringify(raw)}`);
+		return Number(raw);
+	}
+	/**
+	* Statuses that carry no body whatever the headers say (RFC 9110 §8.6): 1xx,
+	* 204 and 304. Defined once because the encoder must not frame a body for
+	* them and the decoder must not try to read one — two lists that agreed today
+	* and were free to drift tomorrow.
+	*
+	* A response to HEAD is also bodyless, but that depends on the request rather
+	* than the status, so callers test it separately.
+	*/
+	function isBodylessStatus(status) {
+		return status < 200 || status === 204 || status === 304;
+	}
+	/**
+	* RFC 9112 §6.3, with every ambiguity turned into a refusal. In particular a
+	* message declaring both Content-Length and Transfer-Encoding is rejected
+	* rather than resolved — disagreeing on which one wins is request smuggling.
+	*/
+	function resolveFraming(headers, version) {
+		const te = getAll(headers, "transfer-encoding");
+		const cl = getAll(headers, "content-length");
+		if (te.length > 0 && cl.length > 0) throw new HttpParseError("message declares both Content-Length and Transfer-Encoding; refusing (request smuggling)");
+		if (te.length > 0) {
+			const encodings = te.join(",").split(",").map((s) => s.trim().toLowerCase()).filter((s) => s !== "");
+			if (encodings.length !== 1 || encodings[0] !== "chunked") throw new HttpParseError(`unsupported Transfer-Encoding: ${JSON.stringify(te.join(", "))}`);
+			if (version === "HTTP/1.0") throw new HttpParseError("Transfer-Encoding is not valid in HTTP/1.0");
+			return { kind: "chunked" };
+		}
+		const length = parseContentLength(cl);
+		if (length !== void 0) return {
+			kind: "length",
+			length
+		};
+		return { kind: "none" };
+	}
+	const CRLF = new Uint8Array([13, 10]);
+	const LAST_CHUNK = new Uint8Array([
+		48,
+		13,
+		10,
+		13,
+		10
+	]);
+	const encoder = new TextEncoder();
+	/**
+	* Chunk sizes are written in HEXADECIMAL — a 21-byte chunk is `15`. Writing
+	* them in decimal is the defect note 15 found in @libp2p/http, and it is the
+	* one that cannot be caught downstream: decimal digits are also valid hex, so
+	* a conforming parser silently reads the wrong length.
+	*
+	* Zero-length source chunks are skipped; a zero-sized chunk on the wire is the
+	* body terminator.
+	*/
+	async function* encodeChunked(body) {
+		for await (const chunk of body) {
+			if (chunk.byteLength === 0) continue;
+			yield encoder.encode(`${chunk.byteLength.toString(16)}\r\n`);
+			yield chunk;
+			yield CRLF;
+		}
+		yield LAST_CHUNK;
+	}
+	/**
+	* Decode a chunked body, yielding data chunks as they arrive. Nothing is
+	* accumulated: a chunk larger than the transport's frame is yielded in pieces.
+	*/
+	async function* decodeChunked(reader, maxLineBytes) {
+		while (true) {
+			const sizeLine = decodeLatin1(await reader.readLine(maxLineBytes));
+			const semicolon = sizeLine.indexOf(";");
+			const sizeText = semicolon === -1 ? sizeLine : sizeLine.slice(0, semicolon);
+			if (!/^[0-9a-fA-F]{1,32}$/.test(sizeText)) throw new HttpParseError(`invalid chunk size: ${JSON.stringify(sizeLine)}`);
+			const size = Number.parseInt(sizeText, 16);
+			if (!Number.isSafeInteger(size)) throw new HttpParseError(`chunk size is too large: ${JSON.stringify(sizeLine)}`);
+			if (size === 0) {
+				let used = 0;
+				while (true) {
+					const remaining = maxLineBytes - used;
+					if (remaining <= 0) throw new HttpParseError(`trailer section exceeds ${maxLineBytes} bytes`);
+					const lineBytes = await reader.readLine(remaining);
+					used += lineBytes.byteLength + 2;
+					if (used > maxLineBytes) throw new HttpParseError(`trailer section exceeds ${maxLineBytes} bytes`);
+					if (lineBytes.byteLength === 0) break;
+				}
+				return;
+			}
+			let remaining = size;
+			while (remaining > 0) {
+				const part = await reader.readSome(remaining);
+				if (part === void 0) throw new HttpParseError(`chunk truncated: ${remaining} of ${size} bytes missing`);
+				remaining -= part.byteLength;
+				yield part;
+			}
+			try {
+				if ((await reader.readLine(2)).byteLength !== 0) throw new HttpParseError("chunk data not terminated by CRLF");
+			} catch (err) {
+				if (err instanceof ByteStreamError) throw new HttpParseError("chunk data not terminated by CRLF");
+				throw err;
+			}
+		}
+	}
+	const VERSIONS = /* @__PURE__ */ new Set(["HTTP/1.1", "HTTP/1.0"]);
+	const ABSOLUTE_FORM = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//;
+	/**
+	* One message per Duplex call (ADR-0006), so bytes after a complete message
+	* are an error. Checked against what is ALREADY BUFFERED rather than by
+	* awaiting end-of-stream: a live socket from a keep-alive peer never reaches
+	* EOF, so awaiting one would hang instead of failing.
+	*/
+	function assertNoBufferedBytes(reader) {
+		const extra = reader.bufferedLength();
+		if (extra > 0) throw new HttpParseError(`${extra} trailing bytes after a complete message`);
+	}
+	/**
+	* The public error contract (I2): everything leaving `decodeRequest` /
+	* `decodeResponse` is an `HttpParseError`, whether the refusal happened
+	* synchronously (a malformed start line or header) or lazily while the body
+	* is later drained. `ByteStreamError` — the `ByteReader`'s own class, never
+	* exported — is the one thing converted here, message and all preserved via
+	* `cause`. Anything else is a genuine failure of the underlying source (a
+	* dropped socket, say) and must reach the caller unchanged: blanket-catching
+	* would hide that distinction.
+	*/
+	function toHttpParseError(err) {
+		if (err instanceof ByteStreamError) throw new HttpParseError(err.message, { cause: err });
+		throw err;
+	}
+	/** Applies `toHttpParseError` across the whole lifetime of a body generator. */
+	async function* convertBodyErrors(source) {
+		try {
+			yield* source;
+		} catch (err) {
+			toHttpParseError(err);
+		}
+	}
+	async function* readBody(reader, framing, opts, noneMeansEof) {
+		if (framing.kind === "chunked") {
+			yield* decodeChunked(reader, opts.maxHeaderBytes);
+			assertNoBufferedBytes(reader);
+			return;
+		}
+		if (framing.kind === "length") {
+			let remaining = framing.length;
+			while (remaining > 0) {
+				const part = await reader.readSome(remaining);
+				if (part === void 0) throw new HttpParseError(`body truncated: ${remaining} of ${framing.length} bytes missing`);
+				remaining -= part.byteLength;
+				yield part;
+			}
+			assertNoBufferedBytes(reader);
+			return;
+		}
+		if (noneMeansEof) {
+			yield* reader.rest();
+			return;
+		}
+		assertNoBufferedBytes(reader);
+	}
+	/**
+	* `readLine`'s bound is best-effort — it is skipped when the line is already
+	* buffered — so a very long start line can reach these messages intact. Since
+	* a refusal is now echoed back to the sender in a 400 body, quote only enough
+	* to diagnose rather than reflecting the whole thing.
+	*/
+	function quoteLine(line) {
+		const MAX = 120;
+		return line.length <= MAX ? JSON.stringify(line) : `${JSON.stringify(line.slice(0, MAX))} (truncated from ${line.length} chars)`;
+	}
+	async function decodeRequest(input, opts) {
+		const reader = new ByteReader(input);
+		try {
+			const startBytes = await reader.readLine(opts.maxHeaderBytes);
+			const startLine = decodeLatin1(startBytes);
+			const parts = startLine.split(" ");
+			if (parts.length !== 3) throw new HttpParseError(`malformed request line: ${quoteLine(startLine)}`);
+			const [method, target, version] = parts;
+			if (!isToken(method)) throw new HttpParseError(`invalid method: ${JSON.stringify(method)}`);
+			if (!VERSIONS.has(version)) throw new HttpParseError(`unsupported HTTP version: ${JSON.stringify(version)}`);
+			if (target === "*") throw new HttpParseError("asterisk-form request target is not supported");
+			assertValidTarget(target);
+			const headers = await readHeaderSection(reader, opts.maxHeaderBytes, startBytes.byteLength + 2);
+			const hosts = getAll(headers, "host");
+			if (hosts.length > 1) throw new HttpParseError("multiple Host headers");
+			const host = hosts[0];
+			let url;
+			if (target.startsWith("/")) {
+				if (version === "HTTP/1.1" && host === void 0) throw new HttpParseError("HTTP/1.1 request has no Host header");
+				if (host !== void 0) assertValidHost(host);
+				url = `${opts.scheme}://${host ?? opts.host}${target}`;
+			} else if (ABSOLUTE_FORM.test(target)) url = target;
+			else throw new HttpParseError(`unsupported request target: ${JSON.stringify(target)}`);
+			try {
+				new URL(url);
+			} catch {
+				throw new HttpParseError(`decoded url is not a valid URL: ${JSON.stringify(url)}`);
+			}
+			return {
+				envelope: {
+					url,
+					method,
+					headers
+				},
+				body: convertBodyErrors(readBody(reader, resolveFraming(headers, version), opts, false))
+			};
+		} catch (err) {
+			toHttpParseError(err);
+		}
+	}
+	async function decodeResponse(input, opts, method) {
+		const reader = new ByteReader(input);
+		try {
+			const startBytes = await reader.readLine(opts.maxHeaderBytes);
+			const startLine = decodeLatin1(startBytes);
+			const firstSp = startLine.indexOf(" ");
+			if (firstSp === -1) throw new HttpParseError(`malformed status line: ${quoteLine(startLine)}`);
+			const version = startLine.slice(0, firstSp);
+			if (!VERSIONS.has(version)) throw new HttpParseError(`unsupported HTTP version: ${JSON.stringify(version)}`);
+			const afterVersion = startLine.slice(firstSp + 1);
+			const secondSp = afterVersion.indexOf(" ");
+			const codeText = secondSp === -1 ? afterVersion : afterVersion.slice(0, secondSp);
+			if (!/^\d{3}$/.test(codeText)) throw new HttpParseError(`invalid status code: ${JSON.stringify(codeText)}`);
+			const status = Number(codeText);
+			const statusText = secondSp === -1 ? "" : afterVersion.slice(secondSp + 1);
+			const headers = await readHeaderSection(reader, opts.maxHeaderBytes, startBytes.byteLength + 2);
+			const bodyless = isBodylessStatus(status) || method.toUpperCase() === "HEAD";
+			const framing = bodyless ? { kind: "none" } : resolveFraming(headers, version);
+			return {
+				envelope: {
+					status,
+					statusText,
+					headers
+				},
+				body: convertBodyErrors(readBody(reader, framing, opts, !bodyless))
+			};
+		} catch (err) {
+			toHttpParseError(err);
+		}
+	}
+	/** Headers the codec owns: a caller-supplied copy is dropped and re-derived. */
+	const REQUEST_OWNED = [
+		"host",
+		"connection",
+		"transfer-encoding"
+	];
+	const RESPONSE_OWNED = ["connection", "transfer-encoding"];
+	/**
+	* Split a URL into an origin-form request target and an authority *without*
+	* going through `new URL()`. `URL` normalises percent-encoding and would
+	* re-serialise the target — which is the exact class of defect note 15 found
+	* in @libp2p/http, where rebuilding the request line silently dropped
+	* `url.search`. Here the target is a verbatim slice of the caller's string.
+	*/
+	function splitTarget(url, opts) {
+		if (url.startsWith("/")) {
+			assertValidTarget(url);
+			return {
+				target: url,
+				authority: opts.host
+			};
+		}
+		const match = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/([^/?#]*)([^#]*)/.exec(url);
+		if (!match) throw new HttpParseError(`cannot derive a request target from url: ${JSON.stringify(url)}`);
+		const rawAuthority = match[1];
+		if (rawAuthority === "") throw new HttpParseError(`url has no authority: ${JSON.stringify(url)}`);
+		const at = rawAuthority.lastIndexOf("@");
+		const authority = at === -1 ? rawAuthority : rawAuthority.slice(at + 1);
+		assertValidHost(authority);
+		const rawTarget = match[2];
+		const target = rawTarget === "" ? "/" : rawTarget.startsWith("/") ? rawTarget : `/${rawTarget}`;
+		assertValidTarget(target);
+		return {
+			target,
+			authority
+		};
+	}
+	async function* emitBody(body, declared) {
+		if (declared === void 0) {
+			yield* encodeChunked(body);
+			return;
+		}
+		let sent = 0;
+		for await (const chunk of body) {
+			if (chunk.byteLength === 0) continue;
+			sent += chunk.byteLength;
+			if (sent > declared) throw new HttpParseError(`body exceeds declared Content-Length ${declared} (${sent} bytes so far)`);
+			yield chunk;
+		}
+		if (sent !== declared) throw new HttpParseError(`body is ${sent} bytes but Content-Length declares ${declared}`);
+	}
+	async function* encodeRequest(env, body, opts) {
+		if (!isToken(env.method)) throw new HttpParseError(`invalid method: ${JSON.stringify(env.method)}`);
+		const { target, authority } = splitTarget(env.url, opts);
+		if (authority === "") throw new HttpParseError("no Host available: url has no authority and no host is configured");
+		const carried = withoutHeaders(env.headers, REQUEST_OWNED);
+		const declared = parseContentLength(getAll(carried, "content-length"));
+		let head = `${env.method} ${target} HTTP/1.1\r\n`;
+		head += `Host: ${authority}\r\n`;
+		head += encodeHeaderLines(carried);
+		head += "Connection: close\r\n";
+		if (body !== void 0 && declared === void 0) head += "Transfer-Encoding: chunked\r\n";
+		head += "\r\n";
+		yield encodeLatin1(head);
+		if (body === void 0) {
+			if (declared !== void 0 && declared !== 0) throw new HttpParseError(`body is 0 bytes but Content-Length declares ${declared}`);
+			return;
+		}
+		yield* emitBody(body, declared);
+	}
+	async function* encodeResponse(env, body, _opts, requestMethod) {
+		if (!Number.isInteger(env.status) || env.status < 100 || env.status > 599) throw new HttpParseError(`invalid status: ${env.status}`);
+		const reason = env.statusText ?? "";
+		assertValidStatusText(reason);
+		const bodylessStatus = isBodylessStatus(env.status);
+		const bodyless = bodylessStatus || requestMethod?.toUpperCase() === "HEAD";
+		const owned = bodylessStatus ? [...RESPONSE_OWNED, "content-length"] : RESPONSE_OWNED;
+		const carried = withoutHeaders(env.headers, owned);
+		const declared = parseContentLength(getAll(carried, "content-length"));
+		let head = `HTTP/1.1 ${env.status} ${reason}\r\n`;
+		head += encodeHeaderLines(carried);
+		head += "Connection: close\r\n";
+		if (!bodyless && body !== void 0 && declared === void 0) head += "Transfer-Encoding: chunked\r\n";
+		head += "\r\n";
+		yield encodeLatin1(head);
+		if (bodyless) {
+			await discard(body);
+			return;
+		}
+		if (body === void 0) {
+			if (declared !== void 0 && declared !== 0) throw new HttpParseError(`body is 0 bytes but Content-Length declares ${declared}`);
+			return;
+		}
+		yield* emitBody(body, declared);
+	}
+	function newHttpCodec(options = {}) {
+		const opts = {
+			scheme: options.scheme ?? "http",
+			host: options.host ?? "localhost",
+			maxHeaderBytes: options.maxHeaderBytes ?? 65536
+		};
+		return {
+			name: "http/1.1",
+			sniff: (byte) => isTokenChar(byte),
+			encodeRequest: (env, body) => encodeRequest(env, body, opts),
+			encodeResponse: (env, body, o) => encodeResponse(env, body, opts, o?.method),
+			decodeRequest: (input) => decodeRequest(input, opts),
+			decodeResponse: (input, o) => decodeResponse(input, opts, o.method)
+		};
+	}
+	const httpCodec = newHttpCodec();
+	/**
+	* Dispatches on byte 0. The formats are self-identifying — a JSON envelope
+	* always begins `{`, which is not a token character and so can never begin an
+	* HTTP start-line — so no negotiation handshake, magic prefix, or version byte
+	* is needed.
+	*
+	* This is what makes a mixed-version peer pair safe: readers accept either
+	* format, so the two ends can be upgraded in any order.
+	*/
+	function newSniffingCodec(options) {
+		const { write, accept } = options;
+		async function pick(input) {
+			const reader = new ByteReader(input);
+			const first = await reader.peekByte();
+			if (first === void 0) throw new HttpParseError("sniff: stream ended before any bytes arrived");
+			const codec = accept.find((c) => c.sniff(first));
+			if (!codec) throw new HttpParseError(`sniff: no accepted codec recognises a message starting with byte 0x${first.toString(16).padStart(2, "0")}`);
+			return {
+				codec,
+				input: reader.rest()
+			};
+		}
+		return {
+			name: `sniff(write=${write.name}; accept=${accept.map((c) => c.name).join(",")})`,
+			sniff: (byte) => accept.some((c) => c.sniff(byte)),
+			encodeRequest: (env, body) => write.encodeRequest(env, body),
+			encodeResponse: (env, body, o) => write.encodeResponse(env, body, o),
+			decodeRequest: async (input) => {
+				const picked = await pick(input);
+				try {
+					return {
+						...await picked.codec.decodeRequest(picked.input),
+						codec: picked.codec
+					};
+				} catch (error) {
+					if (error !== null && typeof error === "object") error.codec = picked.codec;
+					throw error;
+				}
+			},
+			decodeResponse: async (input, o) => {
+				const picked = await pick(input);
+				return picked.codec.decodeResponse(picked.input, o);
+			}
+		};
+	}
+	newSniffingCodec({
+		write: httpCodec,
+		accept: [httpCodec, jsonEnvelopeCodec]
+	});
+	/**
+	* The one place that knows a runtime may not implement request body streams,
+	* and the buffering both fallbacks need. `fetch.ts` and `http-stubs.ts` each
+	* carry a client and a server direction that must agree on the answer, so the
+	* predicate lives here rather than being written out four times.
+	*/
+	/**
+	* Whether `Request.prototype` exposes a `body` accessor. Two call sites read
+	* that property, and two more depend on the constructor accepting a
+	* `ReadableStream` as `init.body`; this predicate answers for all four.
+	*
+	* What was verified, and all that is claimed here: Firefox (146 at the time of
+	* writing) has *neither*, and Chromium and Node have *both*. On Firefox it is
+	* not that `body` is `undefined` on the instance —
+	* `Object.getOwnPropertyDescriptor(Request.prototype, "body")` is `null`, the
+	* accessor is genuinely absent — and because a `ReadableStream` is then not a
+	* recognised `BodyInit`, the constructor falls through to the string branch and
+	* stores the literal text `[object ReadableStream]`.
+	*
+	* The two halves are NOT guaranteed to ship together, so do not read this as a
+	* test for "request streams" in general. Safari is the counterexample: it has
+	* had `Request.body` since 11.1 but only accepts a stream as `init.body` from
+	* Technology Preview 250, so a shipping Safari has the reader half without the
+	* upload half and this returns `true` there. That looks benign — WebKit appears
+	* to store the stream on the `Request` rather than stringify it, and its error
+	* comes from `fetch()`, which this package never calls on the objects it builds
+	* — but it is untested, and it is the case to look at first if a Safari report
+	* arrives. The sharper probe, if one is ever needed, is whether
+	* `new Request(url, {method:"POST", body:new ReadableStream(), duplex:"half"})`
+	* has a `content-type` of `text/plain;charset=UTF-8` (stringified) or `null`
+	* (stored); it is not used here because it costs a `Request` and a
+	* `ReadableStream` per call and agrees with the descriptor check on every
+	* runtime measured.
+	*
+	* A capability check, never a user-agent test: the question is what this
+	* runtime does, and the answer flips on its own the day Firefox ships request
+	* streams. Evaluated per call rather than cached at module load so that a test
+	* can install a `Request` without the capability and exercise the real branch
+	* under Node.
+	*/
+	function supportsRequestStreams() {
+		return typeof Request === "function" && Object.getOwnPropertyDescriptor(Request.prototype, "body") != null;
+	}
+	const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([
+		101,
+		103,
+		204,
+		205,
+		304
+	]);
+	const REQUEST_FIELDS = [
+		"url",
+		"method",
+		"mode",
+		"credentials",
+		"cache",
+		"redirect",
+		"referrer",
+		"referrerPolicy",
+		"integrity",
+		"keepalive"
+	];
+	/** `SerializedHttpEnvelope.content` is never absent, only empty. */
+	async function* noBytes() {}
+	async function* oneChunk(chunk) {
+		yield chunk;
+	}
+	/**
+	* Returns an HTTP handler that serializes a Request, hands the envelope to
+	* `send` for transport, and deserializes the reply into a Response. Used on
+	* the caller side.
+	*/
+	function newHttpClientStub(send) {
+		return async (requestOrPromise) => {
+			const request = await requestOrPromise;
+			const headers = [...request.headers].map(([k, v]) => [k, v]);
+			const options = {
+				url: request.url,
+				headers
+			};
+			for (const field of REQUEST_FIELDS) {
+				const val = request[field];
+				if (val !== void 0 && field !== "url") options[field] = val;
+			}
+			let content;
+			if (request.body != null) content = fromReadableStream(request.body);
+			else if (!supportsRequestStreams()) content = oneChunk(new Uint8Array(await request.arrayBuffer()));
+			else content = noBytes();
+			const result = await send({
+				options,
+				content
+			});
+			if (!result) return new Response(null, {
+				status: 404,
+				statusText: "Error 404: Not Found"
+			});
+			const responseOptions = result.options;
+			const method = options.method;
+			if (method === "HEAD" || method === "OPTIONS" || NULL_BODY_STATUSES.has(responseOptions.status)) {
+				await discard(result.content);
+				return new Response(null, responseOptions);
+			}
+			return new Response(toReadableStream(result.content[Symbol.asyncIterator]()), responseOptions);
+		};
+	}
+	//#endregion
+	//#region src/core/data-channels.ts
+	const MESSAGE_TYPE_REQUEST = "REQUEST";
+	const MESSAGE_TYPE_RESPONSE = "RESPONSE";
+	let __invocationCounter = 0;
+	function newInvokationChannel({ port, handler = () => {
+		throw new Error("Handler not implemented");
+	}, onError = console.error, newCallId = () => ++__invocationCounter }) {
+		const requests = {};
+		const listener = async (event) => {
+			const data = event.data ?? {};
+			if (data.type === MESSAGE_TYPE_REQUEST) try {
+				const result = await handler(data.request, ...event.ports);
+				const [response, ...transfers] = Array.isArray(result) ? result : result !== void 0 ? [result] : [];
+				port.postMessage({
+					type: MESSAGE_TYPE_RESPONSE,
+					callId: data.callId,
+					response
+				}, transfers);
+			} catch (error) {
+				port.postMessage({
+					type: MESSAGE_TYPE_RESPONSE,
+					callId: data.callId,
+					error: serializeError(error)
+				});
+			}
+			else if (data.type === MESSAGE_TYPE_RESPONSE) {
+				const pending = requests[data.callId];
+				delete requests[data.callId];
+				if (!pending) return;
+				if (data.error) pending.reject(deserializeError(data.error));
+				else pending.resolve(data.response);
+			}
+		};
+		const start = async () => {
+			try {
+				port.addEventListener("message", listener);
+				await port.start?.();
+			} catch (e) {
+				onError(e);
+			}
+		};
+		const close = async () => {
+			try {
+				port.removeEventListener("message", listener);
+				await port.close?.();
+			} catch (e) {
+				onError(e);
+			}
+		};
+		const invoke = (request = {}, ...transfers) => {
+			const callId = newCallId();
+			return new Promise((resolve, reject) => {
+				try {
+					requests[callId] = {
+						resolve,
+						reject
+					};
+					port.postMessage({
+						type: MESSAGE_TYPE_REQUEST,
+						callId,
+						request
+					}, transfers);
+				} catch (error) {
+					delete requests[callId];
+					reject(error);
+				}
+			});
+		};
+		return {
+			start,
+			close,
+			invoke
+		};
+	}
+	async function* sendStream(communicationPort, input, params = {}) {
+		const messageChannel = new MessageChannel();
+		communicationPort.postMessage({
+			type: "START_CALL",
+			params
+		}, [messageChannel.port2]);
+		const channel = newStreamChannel(messageChannel.port1);
+		let drained = false;
+		try {
+			await channel.start();
+			channel.sendAll(input);
+			yield* channel.recieveAll();
+			drained = true;
+		} finally {
+			if (!drained) channel.cancel();
+			await channel.close();
+		}
+	}
+	function newStreamChannel(port) {
+		let listeners = [];
+		let iterators = [];
+		const notifyAll = async (data) => {
+			for (const listener of listeners) await listener(data);
+		};
+		/**
+		* Release whatever we are sending. NOT awaited: `.return()` on an async
+		* generator parked awaiting its own source is queued behind that pending
+		* `next()`, so awaiting it here would block the message handler — and the
+		* chunk that would unblock it can only arrive through that same handler.
+		*/
+		const cancelOutgoing = () => {
+			for (const it of [...iterators]) {
+				const iterable = it;
+				Promise.resolve(iterable.return?.()).catch(() => {});
+			}
+		};
+		const channel = newInvokationChannel({
+			port,
+			handler: (data) => {
+				const message = data;
+				if (message?.cancel) {
+					cancelOutgoing();
+					return;
+				}
+				return notifyAll(message);
+			}
+		});
+		const start = () => channel.start();
+		const cancel = () => {
+			channel.invoke({ cancel: true }).catch(() => {});
+		};
+		const close = async () => {
+			await notifyAll({ done: true });
+			for (const it of [...iterators]) await it.return?.();
+			await channel.close();
+		};
+		async function* recieveAll() {
+			yield* recieveIterator((deliver) => {
+				listeners.push(deliver);
+				return () => {
+					listeners = listeners.filter((l) => l !== deliver);
+				};
+			});
+		}
+		async function sendAll(it) {
+			await sendIterator((chunk) => void channel.invoke(chunk), (async function* () {
+				try {
+					iterators.push(it);
+					yield* it;
+				} finally {
+					iterators = iterators.filter((i) => i !== it);
+				}
+			})());
+		}
+		return {
+			start,
+			close,
+			cancel,
+			recieveAll,
+			sendAll
+		};
+	}
+	//#endregion
+	//#region src/http/http-send-recieve.ts
+	async function* httpToIterator(envelopeOrPromise) {
+		const { options, content } = await envelopeOrPromise;
+		yield new TextEncoder().encode(JSON.stringify(options));
+		yield* content;
+	}
+	async function httpFromIterator(iterable) {
+		const it = (await iterable)[Symbol.asyncIterator]();
+		const { done, value } = await it.next();
+		let options = {};
+		if (!done && value) {
+			const str = new TextDecoder().decode(value);
+			options = JSON.parse(str);
+		}
+		return {
+			options,
+			content: { [Symbol.asyncIterator]() {
+				return it;
+			} }
+		};
+	}
+	/**
+	* Ship a `Request` over a `MessageTarget` and await the `Response`, using this
+	* package's own `sendStream` transport.
+	*
+	* @deprecated Prefer the port stack in `@statewalker/webrun-rpc`: open a port
+	* (`multiplexPort` over one pipe, or `transferPortMux` where the platform can
+	* transfer a real `MessagePort`), turn it into a `Duplex` with
+	* `duplexOverPort`, and drive HTTP over it with `httpFetch` from
+	* `@statewalker/webrun-http-streams`.
+	*
+	* Same caveat as {@link handleHttpRequests}: the transport underneath this
+	* helper has no backpressure, no per-stream timeout, and no chunking to a
+	* transport's message ceiling. Kept for existing ServiceWorker setups.
+	*/
+	async function sendHttpRequest(communicationPort, request) {
+		return await newHttpClientStub(async (req) => {
+			return await httpFromIterator(sendStream(communicationPort, httpToIterator(req)));
+		})(request);
+	}
+	//#endregion
+	//#region ../../../../node_modules/.pnpm/idb-keyval@6.3.0/node_modules/idb-keyval/dist/index.js
+	function promisifyRequest(request) {
+		return new Promise((resolve, reject) => {
+			request.oncomplete = request.onsuccess = () => resolve(request.result);
+			request.onabort = request.onerror = () => reject(request.error);
+		});
+	}
+	function createStore(dbName, storeName) {
+		let dbp;
+		const getDB = () => {
+			if (dbp) return dbp;
+			const request = indexedDB.open(dbName);
+			request.onupgradeneeded = () => request.result.createObjectStore(storeName);
+			dbp = promisifyRequest(request);
+			dbp.then((db) => {
+				db.onclose = () => dbp = void 0;
+			}, () => {
+				dbp = void 0;
+			});
+			return dbp;
+		};
+		return (txMode, callback) => getDB().then((db) => callback(db.transaction(storeName, txMode).objectStore(storeName)));
+	}
+	let defaultGetStoreFunc;
+	function defaultGetStore() {
+		if (!defaultGetStoreFunc) defaultGetStoreFunc = createStore("keyval-store", "keyval");
+		return defaultGetStoreFunc;
+	}
+	/**
+	* Get a value by its key.
+	*
+	* @param key
+	* @param customStore Method to get a custom store. Use with caution (see the docs).
+	*/
+	function get(key, customStore = defaultGetStore()) {
+		return customStore("readonly", (store) => promisifyRequest(store.get(key)));
+	}
+	/**
+	* Set a value with a key.
+	*
+	* @param key
+	* @param value
+	* @param customStore Method to get a custom store. Use with caution (see the docs).
+	*/
+	function set(key, value, customStore = defaultGetStore()) {
+		return customStore("readwrite", (store) => {
+			store.put(value, key);
+			return promisifyRequest(store.transaction);
+		});
+	}
+	//#endregion
+	//#region src/core/data-calls.ts
+	function callChannel(target, callType, params, ...transfers) {
+		return new Promise((resolve, reject) => {
+			const channel = new MessageChannel();
+			channel.port1.onmessage = (ev) => {
+				const { result, error } = ev.data;
+				if (error) reject(deserializeError(error));
+				else resolve(result);
+			};
+			target.postMessage({
+				type: callType,
+				params
+			}, [channel.port2, ...transfers]);
+		});
+	}
+	function handleChannelCalls(target, callType, handler) {
+		const listener = async (event) => {
+			if (!event.data || event.data.type !== callType) return;
+			const [port, ...transfers] = event.ports ?? [];
+			const response = {};
+			try {
+				response.result = await handler(event, event.data.params, ...transfers);
+			} catch (error) {
+				response.error = serializeError(error);
+			}
+			port?.postMessage(response);
+		};
+		target.addEventListener("message", listener);
+		target.start?.();
+		return () => target.removeEventListener("message", listener);
+	}
+	//#endregion
+	//#region src/sw/sw-dispatcher.ts
+	/**
+	* ServiceWorker-side counterpart: maintains an index of connected clients keyed by
+	* clientId, persisted in IndexedDB so it can reclaim ports across SW restarts.
+	*/
+	var SwPortDispatcher = class {
+		self;
+		log;
+		handlersIndex = /* @__PURE__ */ new Map();
+		/**
+		* Set of keys that were registered at some point on this SW (sticky —
+		* survives client closures + SW wake-ups via IndexedDB). Lets the fetch
+		* handler distinguish "site URL whose owner is gone → 404" from
+		* "unknown URL under scope → pass through to the network".
+		*/
+		claimedKeys = /* @__PURE__ */ new Set();
+		_cleanup;
+		_activationPromise;
+		constructor({ self, log = () => {} }) {
+			this.self = self;
+			this.log = log;
+		}
+		get scope() {
+			return `${new URL("./", this.self.location.href)}`;
+		}
+		/**
+		* Look up the active channel for a key. Returns `undefined` when there
+		* is no registration (or the registering client has gone away — stale
+		* entries are pruned in place).
+		*/
+		async loadChannelInfo(key) {
+			await this._checkActivation();
+			for (const channelInfo of this.handlersIndex.values()) {
+				if (channelInfo.key !== key) continue;
+				const clientId = channelInfo.clientId;
+				if (!clientId) continue;
+				if (!await this.self.clients.get(clientId)) {
+					this.handlersIndex.delete(clientId);
+					continue;
+				}
+				return channelInfo;
+			}
+		}
+		/** Whether `key` has ever been registered on this SW. */
+		isClaimedKey(key) {
+			return this.claimedKeys.has(key);
+		}
+		start() {
+			this._cleanup = handleChannelCalls(this.self, "UPDATE_COMMUNICATION_PORT", async (event, channelInfo, port) => {
+				const clientId = event.source?.id;
+				this.log("[UPDATE_COMMUNICATION_PORT]", clientId, channelInfo);
+				await this._updateChannelInfo({
+					...channelInfo,
+					port,
+					clientId
+				});
+				return { ...channelInfo };
+			});
+			this.self.addEventListener("install", (event) => {
+				this.log("Skip waiting on install.", event);
+				this.self.skipWaiting();
+			});
+			this.self.addEventListener("activate", (event) => {
+				this.log("Claim control over all clients.", event);
+				event.waitUntil((async () => {
+					await this.self.clients.claim();
+					await this._checkActivation();
+				})());
+			});
+		}
+		async stop() {
+			if (this._cleanup) {
+				this._cleanup();
+				this._cleanup = void 0;
+			}
+		}
+		_checkActivation() {
+			if (!this._activationPromise) this._activationPromise = this._activate();
+			return this._activationPromise;
+		}
+		async _activate() {
+			this.log("[checkActivation]");
+			const clientsIndex = await this._loadClientIds();
+			for (const [clientId, client] of clientsIndex.entries()) {
+				const messageChannel = new MessageChannel();
+				const port = messageChannel.port1;
+				const channelInfo = await callChannel(client, "UPDATE_COMMUNICATION_PORT", {}, messageChannel.port2);
+				await this._updateChannelInfo({
+					...channelInfo,
+					port,
+					clientId
+				});
+			}
+		}
+		async _updateChannelInfo(channelInfo) {
+			this.log("[updateClientInfo]", channelInfo);
+			if (!channelInfo.clientId) return;
+			this.handlersIndex.set(channelInfo.clientId, channelInfo);
+			if (channelInfo.key && !this.claimedKeys.has(channelInfo.key)) {
+				this.claimedKeys.add(channelInfo.key);
+				await set("claimedKeys", [...this.claimedKeys].sort());
+			}
+			await this._updateClientIds([]);
+		}
+		async _loadClientIds() {
+			const storedKeys = await get("claimedKeys") ?? [];
+			for (const key of storedKeys) this.claimedKeys.add(key);
+			const stored = await get("clientIds") ?? [];
+			return await this._updateClientIds(new Set(stored));
+		}
+		async _updateClientIds(clientIds) {
+			const ids = new Set(clientIds);
+			for (const clientId of this.handlersIndex.keys()) ids.add(clientId);
+			const index = /* @__PURE__ */ new Map();
+			for (const clientId of ids) {
+				const client = await this.self.clients.get(clientId);
+				if (client) index.set(clientId, client);
+				else this.handlersIndex.delete(clientId);
+			}
+			await set("clientIds", [...index.keys()].sort());
+			return index;
+		}
+	};
+	//#endregion
+	//#region src/sw/http-sw-dispatcher.ts
+	var SwHttpDispatcher = class extends SwPortDispatcher {
+		start() {
+			super.start();
+			this.self.addEventListener("fetch", this._handleFetchEvent.bind(this));
+		}
+		_handleFetchEvent(event) {
+			event.respondWith((async () => {
+				const request = event.request;
+				try {
+					const requestUrl = request.url;
+					const rootUrl = this.scope;
+					if (requestUrl.indexOf(rootUrl) === 0) {
+						const key = requestUrl.substring(rootUrl.length).replace(/^\/?([^/]+).*$/, "$1");
+						const channelInfo = await this.loadChannelInfo(key);
+						if (channelInfo?.port) return await sendHttpRequest(channelInfo.port, request);
+						if (this.isClaimedKey(key)) return new Response(null, {
+							status: 404,
+							statusText: "Not Found (no active handler)"
+						});
+					}
+					return await fetch(request);
+				} catch (error) {
+					console.error(error);
+					return new Response(null, {
+						status: 500,
+						statusText: "Error 500: Internal error"
+					});
+				}
+			})());
+		}
+	};
+	function startHttpDispatcher(options) {
+		const dispatcher = new SwHttpDispatcher(options);
+		dispatcher.start();
+		return () => {
+			dispatcher.stop();
+		};
+	}
+	//#endregion
+	//#region src/sw-worker.ts
+	startHttpDispatcher({
+		self,
+		log: console.log
+	});
+	//#endregion
+})();