@statewalker/webrun-http-browser 0.7.0 → 0.9.0

package/dist/relay-sw.js

@@ -23,8 +23,6 @@
 		const payload = typeof error === "string" ? { message: error } : error;
 		return Object.assign(new Error(payload.message), payload);
 	}
-	new TextEncoder();
-	new TextDecoder();
 	/**
 	* The newAsyncGenerator function creates async generators from callback-based initialization
 	* functions, providing a bridge between imperative event handling and declarative async
@@ -177,7 +175,6 @@
 			drainQueue();
 		}
 	}
-	new TextEncoder();
 	/**
 	* The iterator ↔ `ReadableStream` boundary.
 	*
@@ -447,8 +444,8 @@
 	const NEWLINE = 10;
 	/** Mirrors the HTTP/1.1 codec's default `maxHeaderBytes`. */
 	const MAX_ENVELOPE_BYTES = 65536;
-	const encoder$1 = new TextEncoder();
-	const decoder = new TextDecoder();
+	const encoder$1 = /* @__PURE__ */ new TextEncoder();
+	const decoder = /* @__PURE__ */ new TextDecoder();
 	/**
 	* Encode an HTTP envelope plus optional body as one continuous byte stream:
 	*
@@ -702,15 +699,15 @@
 		};
 		return { kind: "none" };
 	}
-	const CRLF = new Uint8Array([13, 10]);
-	const LAST_CHUNK = new Uint8Array([
+	const CRLF = /* @__PURE__ */ new Uint8Array([13, 10]);
+	const LAST_CHUNK = /* @__PURE__ */ new Uint8Array([
 		48,
 		13,
 		10,
 		13,
 		10
 	]);
-	const encoder = new TextEncoder();
+	const encoder = /* @__PURE__ */ new TextEncoder();
 	/**
 	* Chunk sizes are written in HEXADECIMAL — a 21-byte chunk is `15`. Writing
 	* them in decimal is the defect note 15 found in @libp2p/http, and it is the
@@ -1015,7 +1012,7 @@
 			decodeResponse: (input, o) => decodeResponse(input, opts, o.method)
 		};
 	}
-	const httpCodec = newHttpCodec();
+	const httpCodec = /* @__PURE__ */ newHttpCodec();
 	/**
 	* Dispatches on byte 0. The formats are self-identifying — a JSON envelope
 	* always begins `{`, which is not a token character and so can never begin an
@@ -1065,7 +1062,7 @@
 	* Writes HTTP/1.1; accepts HTTP/1.1 or the legacy JSON envelope. Used whenever
 	* no `codec` option is supplied.
 	*/
-	const defaultCodec = newSniffingCodec({
+	const defaultCodec = /* @__PURE__ */ newSniffingCodec({
 		write: httpCodec,
 		accept: [httpCodec, jsonEnvelopeCodec]
 	});
@@ -1119,41 +1116,105 @@
 	*/
 	async function httpFetch(call, env, body, options = {}) {
 		const codec = options.codec ?? defaultCodec;
+		const { signal } = options;
+		if (signal?.aborted) throw abortReason$1(signal);
 		const output = call(codec.encodeRequest(env, body));
-		const decoded = await codec.decodeResponse(output, { method: env.method });
-		const release = async () => {
-			try {
-				await output.return?.(void 0);
-			} catch {}
+		let released;
+		const release = () => {
+			released ??= (async () => {
+				try {
+					await output.return?.(void 0);
+				} catch {}
+			})();
+			return released;
 		};
+		let finished = false;
+		const finish = () => {
+			if (finished || released) return;
+			finished = true;
+			if (signal?.aborted) {
+				release();
+				return;
+			}
+			const onAbort = () => void release();
+			signal?.addEventListener("abort", onAbort, { once: true });
+			drain(output).finally(() => signal?.removeEventListener("abort", onAbort));
+		};
+		let decoded;
+		try {
+			decoded = await untilAborted(codec.decodeResponse(output, { method: env.method }), signal);
+		} catch (error) {
+			if (signal?.aborted) release();
+			else await release();
+			throw error;
+		}
 		const result = {
 			envelope: decoded.envelope,
-			body: releasingOnExit(decoded.body, release),
-			release
+			body: releasingOnExit(decoded.body, finish, release),
+			release,
+			finish
 		};
 		await throwIfPeerError(result, output);
 		return result;
 	}
+	/** `promise`, rejected with the signal's reason if it aborts first. */
+	function untilAborted(promise, signal) {
+		if (!signal) return promise;
+		return new Promise((resolve, reject) => {
+			const onAbort = () => reject(abortReason$1(signal));
+			if (signal.aborted) return onAbort();
+			signal.addEventListener("abort", onAbort, { once: true });
+			promise.then((value) => {
+				signal.removeEventListener("abort", onAbort);
+				resolve(value);
+			}, (error) => {
+				signal.removeEventListener("abort", onAbort);
+				reject(error);
+			});
+		});
+	}
+	/** The signal's reason as an `Error` (`AbortError` when it gave none). */
+	function abortReason$1(signal) {
+		const reason = signal.reason;
+		if (reason instanceof Error) return reason;
+		const err = new Error(reason === void 0 ? "Aborted" : String(reason));
+		err.name = "AbortError";
+		return err;
+	}
 	/**
-	* `body`, but leaving it before its end releases the call.
+	* `body`, ending the call however it is left: read to its end, or left early.
 	*
 	* The body the codec hands back is a generator of its own over a `ByteReader`,
-	* and `.return()` on it never reaches the call's `output` (see
-	* `throwIfPeerError` for why the codec must not do that itself). So a caller
-	* that stopped reading — an aborted `fetch`, a cancelled response stream —
-	* left the peer's producer parked forever, holding its handler open. Safe here
-	* for the same reason it is safe in `throwIfPeerError`: `output` is this
-	* call's own response-only generator, and the request was fully sent.
-	*/
-	async function* releasingOnExit(body, release) {
+	* and its ending never reaches the call's `output` (see `throwIfPeerError` for
+	* why the codec must not do that itself). A caller that stopped reading — an
+	* aborted `fetch`, a cancelled response stream — left the peer's producer
+	* parked forever; and one that read the body to its end left the call itself
+	* open, which on a multiplexed transport is one port per exchange until the
+	* multiplexer refuses to open more (`maxPorts`).
+	*
+	* Left early, the call is abandoned (`.return()`): the peer's producer is
+	* released. Read to its end, the call is not cut short but read to ITS end, in
+	* the background: the peer ends it once its side of the exchange is over,
+	* which may be later than the response — a handler that answered before it
+	* read the request body is still receiving it (`HttpDataHandlerResult.settled`),
+	* and abandoning the call would abort that upload.
+	*/
+	async function* releasingOnExit(body, finish, release) {
 		let completed = false;
 		try {
 			yield* body;
 			completed = true;
 		} finally {
-			if (!completed) await release();
+			if (completed) finish();
+			else await release();
 		}
 	}
+	/** Reads `output` to its end, discarding what is left, ignoring a failure. */
+	async function drain(output) {
+		try {
+			for (let r = await output.next(); !r.done; r = await output.next());
+		} catch {}
+	}
 	/**
 	* The one place that knows a runtime may not implement request body streams,
 	* and the buffering both fallbacks need. `fetch.ts` and `http-stubs.ts` each
@@ -1307,26 +1368,6 @@
 			} catch {}
 		}
 	}
-	function asyncIterableToReadable(iter) {
-		const it = iter[Symbol.asyncIterator]();
-		return new ReadableStream({
-			async pull(controller) {
-				try {
-					const { done, value } = await it.next();
-					if (done) {
-						controller.close();
-						return;
-					}
-					controller.enqueue(value);
-				} catch (err) {
-					controller.error(err);
-				}
-			},
-			async cancel() {
-				await it.return?.();
-			}
-		});
-	}
 	/**
 	* Run a `Request` through a `Duplex` call and reconstruct the `Response` on
 	* the other side. The request's `signal` is plumbed into the body iteration —
@@ -1345,34 +1386,94 @@
 			const buffered = new Uint8Array(await request.arrayBuffer());
 			if (buffered.byteLength > 0) body = [buffered];
 		}
-		const { envelope, body: respBody, release } = await httpFetch(call, env, body, options);
+		const { envelope, body: respBody, release, finish } = await httpFetch(call, env, body, {
+			...options,
+			signal: request.signal ?? void 0
+		});
 		const responseInit = {
 			status: envelope.status,
 			statusText: envelope.statusText,
 			headers: forwardableHeaders(envelope.headers)
 		};
 		if (request.method === "HEAD" || request.method === "OPTIONS" || NULL_BODY_STATUSES.has(envelope.status)) {
-			await release?.();
+			if (finish) finish();
+			else await release?.();
 			return new Response(null, responseInit);
 		}
-		return new Response(asyncIterableToReadable(withAbort(respBody, request.signal)), responseInit);
+		return new Response(responseBody(respBody, request.signal, release), responseInit);
 	}
-	async function* withAbort(iter, signal) {
-		if (!signal) {
-			yield* iter;
-			return;
-		}
-		for await (const chunk of iter) {
-			if (signal.aborted) throw abortReason$1(signal);
-			yield chunk;
-		}
-	}
-	function abortReason$1(signal) {
-		const reason = signal.reason;
-		if (reason instanceof Error) return reason;
-		const err = new Error(reason === void 0 ? "Aborted" : String(reason));
-		err.name = "AbortError";
-		return err;
+	/**
+	* How long a cancelled body waits for the read in flight before it abandons the call anyway.
+	* The read's answer tells a body that has ended (the call is finished: an upload the handler
+	* reads after answering goes on) from one that has not; a peer that sends nothing more never
+	* answers it. A body whose end comes later than this after the cancel is abandoned too, so a
+	* handler still streaming its response and still reading the upload then loses the upload.
+	*/
+	const CANCEL_GRACE_MS = 1e3;
+	/**
+	* The response body as a stream that the request's signal can end at any time.
+	*
+	* An abort errors the stream with the abort's reason at once — a read waiting
+	* for a peer that sends nothing more rejects then, not when a next chunk
+	* arrives, which may be never — and abandons the call (`release`), so on a
+	* multiplexed transport its port is given back whether or not anyone still
+	* reads the body. The listener is removed once the body ends, however it ends:
+	* read to its end, cancelled, failed or aborted. A body nobody reads or cancels
+	* keeps it until the signal aborts (and keeps the call open until then anyway).
+	* A cancel abandons the call too — unless the read in flight comes back with the
+	* body's end, which finishes it instead (see `cancel`).
+	*/
+	function responseBody(body, signal, release) {
+		const it = body[Symbol.asyncIterator]();
+		let controller;
+		let ended = false;
+		let reading = false;
+		const end = () => {
+			ended = true;
+			signal?.removeEventListener("abort", onAbort);
+		};
+		const onAbort = () => {
+			if (ended) return;
+			end();
+			try {
+				controller.error(abortReason$1(signal));
+			} catch {}
+			release?.();
+		};
+		return new ReadableStream({
+			start(c) {
+				controller = c;
+				if (signal?.aborted) onAbort();
+				else signal?.addEventListener("abort", onAbort, { once: true });
+			},
+			async pull(c) {
+				try {
+					reading = true;
+					const { done, value } = await it.next().finally(() => {
+						reading = false;
+					});
+					if (ended) return;
+					if (done) {
+						end();
+						c.close();
+						return;
+					}
+					c.enqueue(value);
+				} catch (err) {
+					if (ended) return;
+					end();
+					c.error(err);
+				}
+			},
+			cancel() {
+				end();
+				const returned = Promise.resolve(it.return?.()).catch(() => {});
+				if (!reading) return;
+				const grace = setTimeout(() => void release?.(), CANCEL_GRACE_MS);
+				grace.unref?.();
+				returned.finally(() => clearTimeout(grace));
+			}
+		});
 	}
 	var HttpError = class HttpError extends Error {
 		status;
@@ -1717,8 +1818,11 @@
 				error
 			});
 		};
-		port.addEventListener("message", onMessage);
-		return () => port.removeEventListener("message", onMessage);
+		const listener = (event) => {
+			onMessage(event);
+		};
+		port.addEventListener("message", listener);
+		return () => port.removeEventListener("message", listener);
 	}
 	/**
 	* Wraps an async iterable so that an `AbortSignal` firing causes the wrapper
@@ -1748,6 +1852,69 @@
 		}
 	}
 	/**
+	* Makes `target` disposable with `await using`: installs `dispose` as its
+	* `[Symbol.asyncDispose]`, where the runtime defines the symbol. Hand-written
+	* iterators lose what a native generator gets from `AsyncIteratorPrototype`;
+	* this gives it back. A no-op where the symbol is missing. Kept off the
+	* declared types, which would require consumers to compile with the
+	* `esnext.disposable` lib.
+	*/
+	function asyncDisposable$1(target, dispose) {
+		const asyncDispose = Symbol.asyncDispose;
+		if (asyncDispose && !(asyncDispose in target)) Object.defineProperty(target, asyncDispose, {
+			value: async () => {
+				await dispose();
+			},
+			configurable: true,
+			writable: true
+		});
+		return target;
+	}
+	/**
+	* `gen`, except that `return()` and `throw()` take effect at once.
+	*
+	* On an async generator both are queued behind a `next()` that is still
+	* pending: a consumer that gives up on a stream while it waits for the peer's
+	* next chunk — an aborted fetch whose response head has not come, say — cannot
+	* end it until that chunk arrives, which for a peer that never answers is
+	* never. The stream's `finally` (which closes its port and tells the peer)
+	* then never runs, and on a multiplexer the port is kept for good.
+	*
+	* So `abandon` runs first, synchronously: it must make the pending `next()`
+	* settle (abort the stream), which then resolves done, after which the
+	* generator's own `return()` / `throw()` proceeds as usual. On a generator
+	* suspended at a `yield` it is the same ending, a step earlier. `abandon` runs once, whichever comes first.
+	*/
+	function returningAtOnce(gen, abandon) {
+		let abandoned = false;
+		const giveUp = (reason) => {
+			if (abandoned) return;
+			abandoned = true;
+			abandon(reason);
+		};
+		const wrapped = {
+			next: (...args) => gen.next(...args).catch((error) => {
+				if (abandoned) return {
+					done: true,
+					value: void 0
+				};
+				throw error;
+			}),
+			return(value) {
+				giveUp();
+				return gen.return(value);
+			},
+			throw(error) {
+				giveUp(error);
+				return gen.throw(error);
+			},
+			[Symbol.asyncIterator]() {
+				return wrapped;
+			}
+		};
+		return asyncDisposable$1(wrapped, () => wrapped.return(void 0));
+	}
+	/**
 	* The `type` of the out-of-band notice a side posts when it abandons a stream.
 	*
 	* Layer 1's `close` is not observable to layer 2 — a closed virtual port drops
@@ -1784,7 +1951,7 @@
 		const inbound = receiveChunks(port, CHANNEL_OUT, controller, clock.touch);
 		const pump = sendChunks(port, CHANNEL_IN, input, options, controller.signal, clock.touch);
 		pump.catch(() => {});
-		return (async function* () {
+		return returningAtOnce((async function* () {
 			try {
 				yield* inbound.stream;
 			} finally {
@@ -1798,7 +1965,9 @@
 					await port.close?.();
 				} catch {}
 			}
-		})();
+		})(), () => {
+			if (!controller.signal.aborted) controller.abort(/* @__PURE__ */ new Error("webrun-rpc: the caller abandoned the stream"));
+		});
 	}
 	/**
 	* Listens for the peer's abort notice, and can post our own. The notice is a
@@ -1999,6 +2168,33 @@
 		}
 	}
 	/**
+	* Runs `fn` on a later task, never a microtask: a producer looping on
+	* `whenPortReady` must let the transport's own events run. `setImmediate`
+	* where it exists; elsewhere a `MessageChannel`, because nested `setTimeout`s
+	* are clamped to 4 ms in browsers.
+	*/
+	const setImmediateFn = globalThis.setImmediate;
+	/** @internal */
+	const nextTask = setImmediateFn ? (fn) => {
+		setImmediateFn(fn);
+	} : (() => {
+		let channel;
+		const queue = [];
+		return (fn) => {
+			if (!channel) {
+				channel = new MessageChannel();
+				channel.port1.onmessage = () => queue.shift()?.();
+			}
+			queue.push(fn);
+			channel.port2.postMessage(0);
+		};
+	})();
+	const states = /* @__PURE__ */ new WeakMap();
+	/** @internal Registered by the multiplexer for each port with a window. */
+	function setPortSendState(port, state) {
+		states.set(port, state);
+	}
+	/**
 	* One virtual port.
 	*
 	* `deliver` and `markClosed` are deliberately not on `port`: the consumer holds
@@ -2013,6 +2209,14 @@
 			if (closing.signal.aborted) return;
 			closing.abort(reason ?? /* @__PURE__ */ new Error("webrun-rpc: the port was closed"));
 		};
+		const close = (reason) => {
+			if (closed) return;
+			closed = true;
+			const notify = requestClose;
+			listeners.clear();
+			notify(reason);
+			abort(reason);
+		};
 		const port = {
 			addEventListener(_type, listener) {
 				listeners.add(listener);
@@ -2024,24 +2228,28 @@
 				if (closed) return;
 				send(message, transfer);
 			},
-			close() {
-				if (closed) return;
-				closed = true;
-				const notify = requestClose;
-				listeners.clear();
-				notify();
-				abort();
-			}
+			close
 		};
 		setPortCloseSignal(port, closing.signal);
+		const dispose = Symbol.dispose;
+		if (dispose) Object.defineProperty(port, dispose, {
+			value: () => close(),
+			configurable: true
+		});
 		return {
 			port,
 			deliver(payload) {
 				if (closed) return;
 				const event = new MessageEvent("message", { data: payload });
+				let pending;
 				for (const listener of [...listeners]) try {
-					listener(event);
+					const result = listener(event);
+					if (result && typeof result.then === "function") {
+						pending ??= [];
+						pending.push(result);
+					}
 				} catch {}
+				return pending ? Promise.allSettled(pending) : void 0;
 			},
 			markClosed(reason) {
 				closed = true;
@@ -2050,53 +2258,309 @@
 			},
 			isClosed() {
 				return closed;
+			},
+			hasListeners() {
+				return listeners.size > 0;
 			}
 		};
 	}
 	/**
-	* The message of the error that fails the calls still in flight on a
-	* multiplexer when it is closed (`PortMux.close()`).
+	* The id of keepalive's `ping` / `pong`: one no port ever takes. An older mux
+	* whose codec passes unknown envelopes through reads them as a close of that
+	* id, which must therefore not be a real port (0 is the initiator's first).
 	*/
-	const MUX_CLOSED_MESSAGE = "webrun-rpc: the multiplexer was closed";
+	const KEEPALIVE_ID = Number.MAX_SAFE_INTEGER;
+	/** The longest delay a timer holds; past it `setInterval` fires at once. */
+	const MAX_TIMER_MS = 2 ** 31 - 1;
 	/** Ceiling on concurrently open virtual ports. Bounds the id table only. */
 	const DEFAULT_MAX_PORTS = 1024;
 	/**
+	* What a message costs a port's window when the codec cannot say
+	* (`PortCodec.encode`): its bytes and string lengths, found in its values up
+	* to 4 levels deep (at most 256 values), and at least 64. Both ends compute it
+	* from the same structured value, so they agree.
+	*/
+	function estimateMessageSize(payload) {
+		let budget = 256;
+		const walk = (v, depth) => {
+			if (budget-- <= 0) return 0;
+			if (typeof v === "string") return v.length;
+			if (v instanceof ArrayBuffer) return v.byteLength;
+			if (ArrayBuffer.isView(v)) return v.byteLength;
+			if (v === null || typeof v !== "object" || depth >= 4) return 8;
+			let n = 16;
+			if (Array.isArray(v)) for (const x of v) n += walk(x, depth + 1);
+			else for (const k in v) n += k.length + walk(v[k], depth + 1);
+			return n;
+		};
+		return Math.max(64, walk(payload, 0));
+	}
+	/**
 	* The default `PortMux`: emulates multiplexing over a single port.
 	*
 	* A transport that already multiplexes natively supplies its own `PortMux`
 	* instead — this implementation is for transports that offer one pipe.
 	*/
 	function multiplexPort(port, options) {
-		const { codec, onPort, side = "initiator", maxPorts = DEFAULT_MAX_PORTS, maxMessageSize } = options;
+		const { codec, onPort, side = "initiator", maxPorts = DEFAULT_MAX_PORTS, maxMessageSize, signal, window, frameSize, keepalive, onLeak } = options;
+		const misses = keepalive?.misses ?? 3;
+		if (keepalive && !(Number.isFinite(keepalive.intervalMs) && keepalive.intervalMs > 0 && keepalive.intervalMs <= MAX_TIMER_MS && Number.isSafeInteger(misses) && misses > 0)) throw new RangeError(`webrun-rpc: keepalive needs an intervalMs in (0, ${MAX_TIMER_MS}] and a positive integer misses`);
+		if (frameSize != null && !(Number.isSafeInteger(frameSize) && frameSize > 0)) throw new RangeError(`webrun-rpc: frameSize must be a positive integer, got ${frameSize}`);
 		const open = /* @__PURE__ */ new Map();
+		const leaks = onLeak ? new FinalizationRegistry(({ id, record, release }) => {
+			const entry = open.get(id);
+			if (entry?.handle !== record) return;
+			const { handle: _, credit: __, partial: ___, ...info } = entry;
+			if (!record.hasListeners()) {
+				release("leaked");
+				record.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the port was dropped without close()"));
+			}
+			try {
+				onLeak?.(info);
+			} catch {}
+		}) : void 0;
+		const touch = (id) => {
+			const entry = open.get(id);
+			if (entry) entry.lastActivity = Date.now();
+		};
 		let nextId = side === "initiator" ? 0 : 1;
 		let muxClosed = false;
+		/** This end counts encoded bytes and reassembles frames. */
+		const exactCodec = codec.encode != null && codec.decode != null;
 		const post = (envelope, transfer) => {
 			if (muxClosed) return;
+			codecPost(envelope, transfer);
+		};
+		/** Like `post`, also while closing: the mux's own close notices. */
+		const codecPost = (envelope, transfer) => {
 			try {
 				codec.post(port, envelope, transfer);
 			} catch {}
 		};
-		const attach = (id) => {
-			let self;
-			self = newVirtualPort((payload, transfer) => post({
-				type: "message",
-				id,
-				payload
-			}, transfer), (reason) => {
+		const outgoing = /* @__PURE__ */ new Map();
+		const ring = [];
+		let pumping = false;
+		const pump = async () => {
+			pumping = true;
+			try {
+				while (ring.length && !muxClosed) {
+					if (port.whenDrained) await port.whenDrained();
+					if (muxClosed) break;
+					const id = ring.shift();
+					const queue = outgoing.get(id);
+					const item = queue?.shift();
+					if (queue?.length) ring.push(id);
+					else outgoing.delete(id);
+					item?.();
+				}
+			} catch (err) {
+				close(err).catch(() => {});
+			} finally {
+				pumping = false;
+			}
+		};
+		const sendOnPort = (id, item) => {
+			if (frameSize == null) {
+				item();
+				return;
+			}
+			let queue = outgoing.get(id);
+			if (!queue) {
+				queue = [];
+				outgoing.set(id, queue);
+				ring.push(id);
+			}
+			queue.push(item);
+			if (!pumping) pump();
+		};
+		const dropOutgoing = (id) => {
+			if (!outgoing.delete(id)) return;
+			const at = ring.indexOf(id);
+			if (at >= 0) ring.splice(at, 1);
+		};
+		const postBytes = (bytes) => {
+			if (muxClosed) return;
+			try {
+				port.postMessage(bytes);
+			} catch {}
+		};
+		const releaseWaiters = (c) => {
+			for (const w of c?.waiters.splice(0) ?? []) w.resolve();
+		};
+		const flush = (c) => {
+			while (c.queue.length) {
+				const next = c.queue[0];
+				if (c.enforced && c.outstanding > 0 && c.outstanding + next.size > c.window) break;
+				c.queue.shift();
+				c.queued -= next.size;
+				c.outstanding += next.size;
+				next.send();
+			}
+			for (const w of [...c.waiters]) if (c.queued <= w.below) {
+				c.waiters.splice(c.waiters.indexOf(w), 1);
+				w.resolve();
+			}
+		};
+		const grant = (id, c, bytes) => {
+			c.unconsumed -= bytes;
+			c.toGrant += bytes;
+			const send = () => {
+				c.grantScheduled = false;
+				if (!c.toGrant || !open.has(id)) return;
 				post({
+					type: "credit",
+					id,
+					bytes: c.toGrant
+				});
+				c.toGrant = 0;
+			};
+			if (c.toGrant >= c.window / 4) {
+				send();
+				return;
+			}
+			if (c.grantScheduled) return;
+			c.grantScheduled = true;
+			setTimeout(send, 0);
+		};
+		const attach = (id, meta, portWindow, opener, exact) => {
+			const c = typeof portWindow === "number" && Number.isSafeInteger(portWindow) && portWindow > 0 ? {
+				window: portWindow,
+				enforced: false,
+				opener,
+				exact,
+				outstanding: 0,
+				queue: [],
+				queued: 0,
+				unconsumed: 0,
+				waiters: [],
+				toGrant: 0,
+				grantScheduled: false
+			} : void 0;
+			const self = newVirtualPort((payload, transfer) => {
+				touch(id);
+				const envelope = {
+					type: "message",
+					id,
+					payload
+				};
+				if (!c) {
+					post(envelope, transfer);
+					return;
+				}
+				const bytes = c.exact ? codec.encode?.(envelope) : void 0;
+				const size = bytes?.byteLength ?? estimateMessageSize(payload);
+				const waits = frameSize != null || c.queue.length > 0 || c.enforced && c.outstanding > 0 && c.outstanding + size > c.window;
+				const held = !bytes && waits ? {
+					...envelope,
+					payload: structuredClone(payload, { transfer })
+				} : void 0;
+				const send = () => {
+					if (!bytes) {
+						sendOnPort(id, held ? () => post(held) : () => post(envelope, transfer));
+						return;
+					}
+					if (frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
+						for (let at = 0; at < bytes.byteLength; at += frameSize) {
+							const data = bytes.subarray(at, at + frameSize);
+							const frame = at + frameSize >= bytes.byteLength ? {
+								type: "frame",
+								id,
+								data,
+								last: true
+							} : {
+								type: "frame",
+								id,
+								data
+							};
+							sendOnPort(id, () => post(frame));
+						}
+						return;
+					}
+					sendOnPort(id, () => postBytes(bytes));
+				};
+				c.queue.push({
+					send,
+					size
+				});
+				c.queued += size;
+				flush(c);
+			}, (reason) => {
+				release(reason);
+				record.markClosed(reason);
+			});
+			function release(reason) {
+				open.delete(id);
+				leaks?.unregister(record);
+				if (c?.queue.length) {
+					for (const item of c.queue.splice(0)) item.send();
+					c.queued = 0;
+				}
+				sendOnPort(id, () => post({
 					type: "close",
 					id,
 					reason
+				}));
+				releaseWaiters(c);
+			}
+			const { markClosed, isClosed, hasListeners } = self;
+			if (c) {
+				const deliver = self.deliver;
+				self.deliver = (payload, size = estimateMessageSize(payload)) => {
+					c.unconsumed += size;
+					const done = deliver(payload);
+					if (done) done.then(() => grant(id, c, size));
+					else grant(id, c, size);
+					return done;
+				};
+				setPortSendState(self.port, {
+					bufferedAmount: () => c.queued,
+					ready: (below = 0) => new Promise((resolve) => {
+						if (c.queued <= below || isClosed()) nextTask(resolve);
+						else c.waiters.push({
+							below,
+							resolve: () => nextTask(resolve)
+						});
+					})
 				});
-				open.delete(id);
-				self.markClosed();
+			}
+			const record = {
+				deliver: self.deliver,
+				markClosed,
+				isClosed,
+				hasListeners,
+				close: (reason) => {
+					if (isClosed()) return;
+					release(reason);
+					markClosed(reason);
+				}
+			};
+			leaks?.register(self.port, {
+				id,
+				record,
+				release
+			}, record);
+			const now = Date.now();
+			open.set(id, {
+				id,
+				meta,
+				openedAt: now,
+				lastActivity: now,
+				handle: record,
+				credit: c
 			});
-			open.set(id, self);
 			return self;
 		};
-		const handleEnvelope = (envelope) => {
+		const handleEnvelope = (envelope, event) => {
 			if (muxClosed) return;
+			heardSincePing = true;
+			if (envelope.type === "ping" || envelope.type === "pong") {
+				peerKeepsAlive = true;
+				if (envelope.type === "ping") post({
+					type: "pong",
+					id: KEEPALIVE_ID
+				});
+				return;
+			}
 			if (envelope.type === "open") {
 				if (open.has(envelope.id)) return;
 				if (open.size >= maxPorts) {
@@ -2107,7 +2571,18 @@
 					});
 					return;
 				}
-				const handle = attach(envelope.id);
+				const handle = attach(envelope.id, envelope.meta, envelope.window, false, envelope.exact === true && exactCodec);
+				const credit = open.get(envelope.id)?.credit;
+				if (credit) post(credit.exact ? {
+					type: "credit",
+					id: envelope.id,
+					bytes: 0,
+					exact: true
+				} : {
+					type: "credit",
+					id: envelope.id,
+					bytes: 0
+				});
 				let accepted = false;
 				if (onPort) try {
 					accepted = onPort(handle.port, envelope.meta) !== false;
@@ -2122,57 +2597,191 @@
 						id: envelope.id,
 						reason: "rejected"
 					});
+					return;
 				}
 				return;
 			}
-			const handle = open.get(envelope.id);
+			const entry = open.get(envelope.id);
+			if (envelope.type === "credit") {
+				const c = entry?.credit;
+				if (!c || !(envelope.bytes >= 0)) return;
+				if (!c.enforced && c.opener) {
+					if (c.exact && envelope.exact !== true) {
+						c.exact = false;
+						c.outstanding = 0;
+					}
+					post({
+						type: "credit",
+						id: envelope.id,
+						bytes: 0
+					});
+				}
+				c.enforced = true;
+				c.outstanding = Math.max(0, c.outstanding - envelope.bytes);
+				flush(c);
+				return;
+			}
 			if (envelope.type === "message") {
-				if (!handle) return;
-				handle.deliver(envelope.payload);
+				const sizeOf = (c) => (c.exact ? byteLengthOf(event.data) : void 0) ?? estimateMessageSize(envelope.payload);
+				if (!entry) return;
+				touch(envelope.id);
+				entry.handle.deliver(envelope.payload, entry.credit ? sizeOf(entry.credit) : void 0);
+				return;
+			}
+			if (envelope.type === "frame") {
+				if (!entry?.credit?.exact || !codec.decode || !(envelope.data instanceof Uint8Array)) return;
+				touch(envelope.id);
+				const partial = entry.partial ?? {
+					chunks: [],
+					bytes: 0
+				};
+				entry.partial = partial;
+				partial.chunks.push(envelope.data);
+				partial.bytes += envelope.data.byteLength;
+				if (!envelope.last) return;
+				entry.partial = void 0;
+				const whole = new Uint8Array(partial.bytes);
+				let at = 0;
+				for (const chunk of partial.chunks) {
+					whole.set(chunk, at);
+					at += chunk.byteLength;
+				}
+				const inner = codec.decode(whole);
+				if (inner?.type !== "message" || inner.id !== envelope.id) return;
+				entry.handle.deliver(inner.payload, whole.byteLength);
 				return;
 			}
-			if (!handle) return;
+			dropOutgoing(envelope.id);
+			if (!entry) return;
 			open.delete(envelope.id);
-			handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the peer closed the port"));
+			releaseWaiters(entry.credit);
+			entry.handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the peer closed the port"));
 		};
 		const listener = (event) => {
 			const envelope = codec.read(event);
-			if (envelope) handleEnvelope(envelope);
+			if (envelope) handleEnvelope(envelope, event);
+		};
+		let peerKeepsAlive = false;
+		let heardSincePing = true;
+		let unanswered = 0;
+		let pinger;
+		const tick = () => {
+			if (!keepalive) return;
+			const backlogged = (port.bufferedAmount ?? 0) > 0;
+			if (heardSincePing) unanswered = 0;
+			else if (peerKeepsAlive && !backlogged) unanswered++;
+			if (unanswered >= misses) {
+				close(/* @__PURE__ */ new Error(`webrun-rpc: the peer did not answer ${misses} keepalive pings, ${keepalive.intervalMs} ms apart`)).catch(() => {});
+				return;
+			}
+			heardSincePing = false;
+			post({
+				type: "ping",
+				id: KEEPALIVE_ID
+			});
+		};
+		const close = async (reason) => {
+			if (muxClosed) return;
+			clearInterval(pinger);
+			muxClosed = true;
+			signal?.removeEventListener("abort", onTransportAbort);
+			port.removeEventListener("message", listener);
+			const closedNow = /* @__PURE__ */ new Set();
+			for (const [id, { handle, credit }] of [...open]) {
+				closedNow.add(id);
+				codecPost({
+					type: "close",
+					id
+				});
+				open.delete(id);
+				releaseWaiters(credit);
+				handle.markClosed(reason ?? /* @__PURE__ */ new Error("webrun-rpc: the multiplexer was closed"));
+			}
+			for (const id of outgoing.keys()) if (!closedNow.has(id)) codecPost({
+				type: "close",
+				id
+			});
+			outgoing.clear();
+			ring.length = 0;
+			await port.close?.();
+		};
+		const onTransportAbort = () => {
+			close(signal?.reason).catch(() => {});
 		};
 		port.addEventListener("message", listener);
 		port.start?.();
+		if (keepalive) {
+			pinger = setInterval(tick, keepalive.intervalMs);
+			pinger.unref?.();
+		}
+		if (signal?.aborted) close(signal.reason).catch(() => {});
+		else signal?.addEventListener("abort", onTransportAbort, { once: true });
 		return {
 			maxMessageSize,
-			async openPort(meta) {
+			async openPort(meta, { signal: portSignal } = {}) {
 				if (muxClosed) throw new Error("webrun-rpc: the multiplexer is closed");
-				if (open.size >= maxPorts) throw new RangeError(`webrun-rpc: maxPorts (${maxPorts}) reached`);
+				if (portSignal?.aborted) throw portSignal.reason;
+				if (open.size >= maxPorts) throw new RangeError(`webrun-rpc: maxPorts (${maxPorts}) reached; open ports by kind: ${describeKinds(open.values())}`);
 				while (open.has(nextId)) nextId += 2;
 				const id = nextId;
 				nextId += 2;
-				const handle = attach(id);
-				post({
+				const handle = attach(id, meta, window, true, exactCodec);
+				post(window ? exactCodec ? {
+					type: "open",
+					id,
+					meta,
+					window,
+					exact: true
+				} : {
+					type: "open",
+					id,
+					meta,
+					window
+				} : {
 					type: "open",
 					id,
 					meta
 				});
+				if (portSignal) {
+					const record = open.get(id)?.handle;
+					const onAbort = () => {
+						if (record && open.get(id)?.handle === record) record.close(portSignal.reason);
+					};
+					portSignal.addEventListener("abort", onAbort, { once: true });
+					getPortCloseSignal(handle.port)?.addEventListener("abort", () => portSignal.removeEventListener("abort", onAbort), { once: true });
+				}
 				return handle.port;
 			},
-			async close() {
-				if (muxClosed) return;
-				for (const [id, handle] of [...open]) {
-					post({
-						type: "close",
-						id
-					});
-					open.delete(id);
-					handle.markClosed(/* @__PURE__ */ new Error(MUX_CLOSED_MESSAGE));
-				}
-				muxClosed = true;
-				port.removeEventListener("message", listener);
-				await port.close?.();
+			close,
+			ports() {
+				return [...open.values()].map(({ handle: _, credit, ...info }) => credit ? {
+					...info,
+					...credit.enforced ? { window: credit.window } : {},
+					queued: credit.queued,
+					outstanding: credit.outstanding,
+					unconsumed: credit.unconsumed
+				} : info);
 			}
 		};
 	}
+	/** The byte length of a received message's data, or `undefined` if it is not bytes. */
+	function byteLengthOf(data) {
+		if (data instanceof ArrayBuffer || ArrayBuffer.isView(data)) return data.byteLength;
+	}
+	/**
+	* `"http: 1000, ws: 24"`: the three commonest `meta.kind`s among `entries`, so
+	* a full table names who filled it. A port without a kind counts as `"?"`.
+	*/
+	function describeKinds(entries) {
+		const counts = /* @__PURE__ */ new Map();
+		for (const { meta } of entries) {
+			const kind = meta?.kind;
+			const name = typeof kind === "string" ? kind : "?";
+			counts.set(name, (counts.get(name) ?? 0) + 1);
+		}
+		if (!counts.size) return "none";
+		return [...counts].sort((x, y) => y[1] - x[1]).slice(0, 3).map(([name, n]) => `${name}: ${n}`).join(", ");
+	}
 	/**
 	* Announced with every port this pair opens. Layer 1 never reads `meta` — it is
 	* here so a peer running something else over the same multiplexer can tell a
@@ -2194,9 +2803,22 @@
 			maxMessageSize: mux.maxMessageSize,
 			timeout
 		};
-		const call = (input) => (async function* () {
-			yield* duplexOverPort(await mux.openPort(STREAM_META), streamOptions)(input);
-		})();
+		const call = (input) => {
+			let stream;
+			let abandoned = false;
+			return returningAtOnce((async function* () {
+				const port = await mux.openPort(STREAM_META);
+				if (abandoned) {
+					await port.close?.();
+					return;
+				}
+				stream = duplexOverPort(port, streamOptions)(input);
+				yield* stream;
+			})(), () => {
+				abandoned = true;
+				stream?.return(void 0).catch(() => {});
+			});
+		};
 		return {
 			call,
 			async close() {
@@ -2221,7 +2843,7 @@
 		const candidate = value;
 		if (typeof candidate.id !== "number") return false;
 		if (!Number.isInteger(candidate.id) || candidate.id < 0) return false;
-		return candidate.type === "open" || candidate.type === "message" || candidate.type === "close";
+		return candidate.type === "open" || candidate.type === "message" || candidate.type === "close" || candidate.type === "credit" || candidate.type === "frame" || candidate.type === "ping" || candidate.type === "pong";
 	}
 	/**
 	* For ports whose messages are structured values — a real `MessagePort`, a
@@ -2242,6 +2864,27 @@
 		}
 	};
 	//#endregion
+	//#region src/link/async-dispose.ts
+	/**
+	* Makes `target` disposable with `await using`: installs `dispose` as its
+	* `[Symbol.asyncDispose]`, where the runtime defines the symbol. Hand-written
+	* iterators lose what a native generator gets from `AsyncIteratorPrototype`;
+	* this gives it back. A no-op where the symbol is missing. Kept off the
+	* declared types, which would require consumers to compile with the
+	* `esnext.disposable` lib.
+	*/
+	function asyncDisposable(target, dispose) {
+		const asyncDispose = Symbol.asyncDispose;
+		if (asyncDispose && !(asyncDispose in target)) Object.defineProperty(target, asyncDispose, {
+			value: async () => {
+				await dispose();
+			},
+			configurable: true,
+			writable: true
+		});
+		return target;
+	}
+	//#endregion
 	//#region src/link/http-link.ts
 	/**
 	* The version of the HTTP-over-`MessagePort` protocol this package speaks,
@@ -2271,11 +2914,12 @@
 	*/
 	const LINK_CLOSE = "webrun-http:link-close";
 	/** Opens the calling end of a link on `port` (one port per link). */
-	async function connectHttpLink(port, { streamTimeout } = {}) {
+	async function connectHttpLink(port, { streamTimeout, maxPorts } = {}) {
 		const { call, close } = await connect({
 			mux: overPipe(port, {
 				codec: structuredCodec,
-				side: "initiator"
+				side: "initiator",
+				maxPorts
 			}),
 			timeout: streamTimeout
 		});
@@ -2300,7 +2944,7 @@
 			inflight--;
 			if (inflight === 0) for (const resolve of idleWaiters.splice(0)) resolve();
 		};
-		return {
+		const link = {
 			get inflight() {
 				return inflight;
 			},
@@ -2337,7 +2981,7 @@
 					finish();
 					return response;
 				}
-				return new Response(guardBody(response.body, lost, () => lostReason, finish), {
+				return new Response(guardBody(response.body, lost, () => lostReason, finish, request.signal), {
 					status: response.status,
 					statusText: response.statusText,
 					headers: response.headers
@@ -2353,35 +2997,68 @@
 				} catch {}
 			}
 		};
+		return asyncDisposable(link, () => link.close());
 	}
 	/**
-	* A response body that reports its end (done, cancelled or failed) and fails
-	* with the link's reason when the link is lost mid-stream.
+	* A response body that reports its end (done, cancelled, failed or aborted) and
+	* fails with the link's reason when the link is lost mid-stream. An abort of the
+	* request's signal ends it at once, read or not: the exchange is over (the layer
+	* below has given its port back), so the request leaves `inflight` then.
 	*/
-	function guardBody(body, lost, reason, finish) {
+	function guardBody(body, lost, reason, finish, signal) {
 		const reader = body.getReader();
+		let controller;
+		let ended = false;
+		const end = () => {
+			ended = true;
+			signal?.removeEventListener("abort", onAbort);
+			finish();
+		};
+		const onAbort = () => {
+			if (ended) return;
+			end();
+			reader.cancel().catch(() => {});
+			try {
+				controller.error(abortError(signal));
+			} catch {}
+		};
 		return new ReadableStream({
+			start(c) {
+				controller = c;
+				if (signal?.aborted) onAbort();
+				else signal?.addEventListener("abort", onAbort, { once: true });
+			},
 			async pull(controller) {
 				try {
 					const { done, value } = await Promise.race([reader.read(), lost]);
+					if (ended) return;
 					if (done) {
-						finish();
+						end();
 						controller.close();
 						return;
 					}
 					controller.enqueue(value);
 				} catch (error) {
-					finish();
+					if (ended) return;
+					end();
 					reader.cancel().catch(() => {});
 					controller.error(reason() ?? error);
 				}
 			},
 			async cancel(why) {
-				finish();
+				end();
 				await reader.cancel(why).catch(() => {});
 			}
 		});
 	}
+	/** The signal's reason as an `Error` (`AbortError` when it gave none). */
+	function abortError(signal) {
+		const why = signal.reason;
+		if (why instanceof Error) return why;
+		const err = new Error(why === void 0 ? "Aborted" : String(why));
+		err.name = "AbortError";
+		return err;
+	}
 	//#endregion
 	//#region src/sw/protocol.ts
 	/** Page → ServiceWorker: open a WebSocket to a handler. */