@statewalker/webrun-http-browser 0.7.0 → 0.9.0

package/dist/relay-worker.js

@@ -22,8 +22,6 @@ function deserializeError(error) {
 	const payload = typeof error === "string" ? { message: error } : error;
 	return Object.assign(new Error(payload.message), payload);
 }
-new TextEncoder();
-new TextDecoder();
 /**
 * The newAsyncGenerator function creates async generators from callback-based initialization
 * functions, providing a bridge between imperative event handling and declarative async
@@ -176,7 +174,6 @@ async function* newAsyncGenerator(init, skipValues = false) {
 		drainQueue();
 	}
 }
-new TextEncoder();
 /**
 * The iterator ↔ `ReadableStream` boundary.
 *
@@ -446,8 +443,8 @@ var HttpParseError = class extends Error {
 const NEWLINE = 10;
 /** Mirrors the HTTP/1.1 codec's default `maxHeaderBytes`. */
 const MAX_ENVELOPE_BYTES = 65536;
-const encoder$1 = new TextEncoder();
-const decoder = new TextDecoder();
+const encoder$1 = /* @__PURE__ */ new TextEncoder();
+const decoder = /* @__PURE__ */ new TextDecoder();
 /**
 * Encode an HTTP envelope plus optional body as one continuous byte stream:
 *
@@ -701,15 +698,15 @@ function resolveFraming(headers, version) {
 	};
 	return { kind: "none" };
 }
-const CRLF = new Uint8Array([13, 10]);
-const LAST_CHUNK = new Uint8Array([
+const CRLF = /* @__PURE__ */ new Uint8Array([13, 10]);
+const LAST_CHUNK = /* @__PURE__ */ new Uint8Array([
 	48,
 	13,
 	10,
 	13,
 	10
 ]);
-const encoder = new TextEncoder();
+const encoder = /* @__PURE__ */ new TextEncoder();
 /**
 * Chunk sizes are written in HEXADECIMAL — a 21-byte chunk is `15`. Writing
 * them in decimal is the defect note 15 found in @libp2p/http, and it is the
@@ -1014,7 +1011,7 @@ function newHttpCodec(options = {}) {
 		decodeResponse: (input, o) => decodeResponse(input, opts, o.method)
 	};
 }
-const httpCodec = newHttpCodec();
+const httpCodec = /* @__PURE__ */ newHttpCodec();
 /**
 * Dispatches on byte 0. The formats are self-identifying — a JSON envelope
 * always begins `{`, which is not a token character and so can never begin an
@@ -1064,7 +1061,7 @@ function newSniffingCodec(options) {
 * Writes HTTP/1.1; accepts HTTP/1.1 or the legacy JSON envelope. Used whenever
 * no `codec` option is supplied.
 */
-const defaultCodec = newSniffingCodec({
+const defaultCodec = /* @__PURE__ */ newSniffingCodec({
 	write: httpCodec,
 	accept: [httpCodec, jsonEnvelopeCodec]
 });
@@ -1118,41 +1115,105 @@ async function throwIfPeerError(result, output) {
 */
 async function httpFetch(call, env, body, options = {}) {
 	const codec = options.codec ?? defaultCodec;
+	const { signal } = options;
+	if (signal?.aborted) throw abortReason$1(signal);
 	const output = call(codec.encodeRequest(env, body));
-	const decoded = await codec.decodeResponse(output, { method: env.method });
-	const release = async () => {
-		try {
-			await output.return?.(void 0);
-		} catch {}
+	let released;
+	const release = () => {
+		released ??= (async () => {
+			try {
+				await output.return?.(void 0);
+			} catch {}
+		})();
+		return released;
 	};
+	let finished = false;
+	const finish = () => {
+		if (finished || released) return;
+		finished = true;
+		if (signal?.aborted) {
+			release();
+			return;
+		}
+		const onAbort = () => void release();
+		signal?.addEventListener("abort", onAbort, { once: true });
+		drain(output).finally(() => signal?.removeEventListener("abort", onAbort));
+	};
+	let decoded;
+	try {
+		decoded = await untilAborted(codec.decodeResponse(output, { method: env.method }), signal);
+	} catch (error) {
+		if (signal?.aborted) release();
+		else await release();
+		throw error;
+	}
 	const result = {
 		envelope: decoded.envelope,
-		body: releasingOnExit(decoded.body, release),
-		release
+		body: releasingOnExit(decoded.body, finish, release),
+		release,
+		finish
 	};
 	await throwIfPeerError(result, output);
 	return result;
 }
+/** `promise`, rejected with the signal's reason if it aborts first. */
+function untilAborted(promise, signal) {
+	if (!signal) return promise;
+	return new Promise((resolve, reject) => {
+		const onAbort = () => reject(abortReason$1(signal));
+		if (signal.aborted) return onAbort();
+		signal.addEventListener("abort", onAbort, { once: true });
+		promise.then((value) => {
+			signal.removeEventListener("abort", onAbort);
+			resolve(value);
+		}, (error) => {
+			signal.removeEventListener("abort", onAbort);
+			reject(error);
+		});
+	});
+}
+/** The signal's reason as an `Error` (`AbortError` when it gave none). */
+function abortReason$1(signal) {
+	const reason = signal.reason;
+	if (reason instanceof Error) return reason;
+	const err = new Error(reason === void 0 ? "Aborted" : String(reason));
+	err.name = "AbortError";
+	return err;
+}
 /**
-* `body`, but leaving it before its end releases the call.
+* `body`, ending the call however it is left: read to its end, or left early.
 *
 * The body the codec hands back is a generator of its own over a `ByteReader`,
-* and `.return()` on it never reaches the call's `output` (see
-* `throwIfPeerError` for why the codec must not do that itself). So a caller
-* that stopped reading — an aborted `fetch`, a cancelled response stream —
-* left the peer's producer parked forever, holding its handler open. Safe here
-* for the same reason it is safe in `throwIfPeerError`: `output` is this
-* call's own response-only generator, and the request was fully sent.
-*/
-async function* releasingOnExit(body, release) {
+* and its ending never reaches the call's `output` (see `throwIfPeerError` for
+* why the codec must not do that itself). A caller that stopped reading — an
+* aborted `fetch`, a cancelled response stream — left the peer's producer
+* parked forever; and one that read the body to its end left the call itself
+* open, which on a multiplexed transport is one port per exchange until the
+* multiplexer refuses to open more (`maxPorts`).
+*
+* Left early, the call is abandoned (`.return()`): the peer's producer is
+* released. Read to its end, the call is not cut short but read to ITS end, in
+* the background: the peer ends it once its side of the exchange is over,
+* which may be later than the response — a handler that answered before it
+* read the request body is still receiving it (`HttpDataHandlerResult.settled`),
+* and abandoning the call would abort that upload.
+*/
+async function* releasingOnExit(body, finish, release) {
 	let completed = false;
 	try {
 		yield* body;
 		completed = true;
 	} finally {
-		if (!completed) await release();
+		if (completed) finish();
+		else await release();
 	}
 }
+/** Reads `output` to its end, discarding what is left, ignoring a failure. */
+async function drain(output) {
+	try {
+		for (let r = await output.next(); !r.done; r = await output.next());
+	} catch {}
+}
 /**
 * The one place that knows a runtime may not implement request body streams,
 * and the buffering both fallbacks need. `fetch.ts` and `http-stubs.ts` each
@@ -1306,26 +1367,6 @@ async function* readableToAsyncIterable(stream) {
 		} catch {}
 	}
 }
-function asyncIterableToReadable(iter) {
-	const it = iter[Symbol.asyncIterator]();
-	return new ReadableStream({
-		async pull(controller) {
-			try {
-				const { done, value } = await it.next();
-				if (done) {
-					controller.close();
-					return;
-				}
-				controller.enqueue(value);
-			} catch (err) {
-				controller.error(err);
-			}
-		},
-		async cancel() {
-			await it.return?.();
-		}
-	});
-}
 /**
 * Run a `Request` through a `Duplex` call and reconstruct the `Response` on
 * the other side. The request's `signal` is plumbed into the body iteration —
@@ -1344,34 +1385,94 @@ async function fetchOverDuplex(call, request, options = {}) {
 		const buffered = new Uint8Array(await request.arrayBuffer());
 		if (buffered.byteLength > 0) body = [buffered];
 	}
-	const { envelope, body: respBody, release } = await httpFetch(call, env, body, options);
+	const { envelope, body: respBody, release, finish } = await httpFetch(call, env, body, {
+		...options,
+		signal: request.signal ?? void 0
+	});
 	const responseInit = {
 		status: envelope.status,
 		statusText: envelope.statusText,
 		headers: forwardableHeaders(envelope.headers)
 	};
 	if (request.method === "HEAD" || request.method === "OPTIONS" || NULL_BODY_STATUSES.has(envelope.status)) {
-		await release?.();
+		if (finish) finish();
+		else await release?.();
 		return new Response(null, responseInit);
 	}
-	return new Response(asyncIterableToReadable(withAbort(respBody, request.signal)), responseInit);
+	return new Response(responseBody(respBody, request.signal, release), responseInit);
 }
-async function* withAbort(iter, signal) {
-	if (!signal) {
-		yield* iter;
-		return;
-	}
-	for await (const chunk of iter) {
-		if (signal.aborted) throw abortReason$1(signal);
-		yield chunk;
-	}
-}
-function abortReason$1(signal) {
-	const reason = signal.reason;
-	if (reason instanceof Error) return reason;
-	const err = new Error(reason === void 0 ? "Aborted" : String(reason));
-	err.name = "AbortError";
-	return err;
+/**
+* How long a cancelled body waits for the read in flight before it abandons the call anyway.
+* The read's answer tells a body that has ended (the call is finished: an upload the handler
+* reads after answering goes on) from one that has not; a peer that sends nothing more never
+* answers it. A body whose end comes later than this after the cancel is abandoned too, so a
+* handler still streaming its response and still reading the upload then loses the upload.
+*/
+const CANCEL_GRACE_MS = 1e3;
+/**
+* The response body as a stream that the request's signal can end at any time.
+*
+* An abort errors the stream with the abort's reason at once — a read waiting
+* for a peer that sends nothing more rejects then, not when a next chunk
+* arrives, which may be never — and abandons the call (`release`), so on a
+* multiplexed transport its port is given back whether or not anyone still
+* reads the body. The listener is removed once the body ends, however it ends:
+* read to its end, cancelled, failed or aborted. A body nobody reads or cancels
+* keeps it until the signal aborts (and keeps the call open until then anyway).
+* A cancel abandons the call too — unless the read in flight comes back with the
+* body's end, which finishes it instead (see `cancel`).
+*/
+function responseBody(body, signal, release) {
+	const it = body[Symbol.asyncIterator]();
+	let controller;
+	let ended = false;
+	let reading = false;
+	const end = () => {
+		ended = true;
+		signal?.removeEventListener("abort", onAbort);
+	};
+	const onAbort = () => {
+		if (ended) return;
+		end();
+		try {
+			controller.error(abortReason$1(signal));
+		} catch {}
+		release?.();
+	};
+	return new ReadableStream({
+		start(c) {
+			controller = c;
+			if (signal?.aborted) onAbort();
+			else signal?.addEventListener("abort", onAbort, { once: true });
+		},
+		async pull(c) {
+			try {
+				reading = true;
+				const { done, value } = await it.next().finally(() => {
+					reading = false;
+				});
+				if (ended) return;
+				if (done) {
+					end();
+					c.close();
+					return;
+				}
+				c.enqueue(value);
+			} catch (err) {
+				if (ended) return;
+				end();
+				c.error(err);
+			}
+		},
+		cancel() {
+			end();
+			const returned = Promise.resolve(it.return?.()).catch(() => {});
+			if (!reading) return;
+			const grace = setTimeout(() => void release?.(), CANCEL_GRACE_MS);
+			grace.unref?.();
+			returned.finally(() => clearTimeout(grace));
+		}
+	});
 }
 var HttpError = class HttpError extends Error {
 	status;
@@ -1716,8 +1817,11 @@ function listenPort(port, handler, { channelName = "", log = () => {} } = {}) {
 			error
 		});
 	};
-	port.addEventListener("message", onMessage);
-	return () => port.removeEventListener("message", onMessage);
+	const listener = (event) => {
+		onMessage(event);
+	};
+	port.addEventListener("message", listener);
+	return () => port.removeEventListener("message", listener);
 }
 /**
 * Wraps an async iterable so that an `AbortSignal` firing causes the wrapper
@@ -1747,6 +1851,69 @@ async function* throughAbort(input, signal) {
 	}
 }
 /**
+* Makes `target` disposable with `await using`: installs `dispose` as its
+* `[Symbol.asyncDispose]`, where the runtime defines the symbol. Hand-written
+* iterators lose what a native generator gets from `AsyncIteratorPrototype`;
+* this gives it back. A no-op where the symbol is missing. Kept off the
+* declared types, which would require consumers to compile with the
+* `esnext.disposable` lib.
+*/
+function asyncDisposable$1(target, dispose) {
+	const asyncDispose = Symbol.asyncDispose;
+	if (asyncDispose && !(asyncDispose in target)) Object.defineProperty(target, asyncDispose, {
+		value: async () => {
+			await dispose();
+		},
+		configurable: true,
+		writable: true
+	});
+	return target;
+}
+/**
+* `gen`, except that `return()` and `throw()` take effect at once.
+*
+* On an async generator both are queued behind a `next()` that is still
+* pending: a consumer that gives up on a stream while it waits for the peer's
+* next chunk — an aborted fetch whose response head has not come, say — cannot
+* end it until that chunk arrives, which for a peer that never answers is
+* never. The stream's `finally` (which closes its port and tells the peer)
+* then never runs, and on a multiplexer the port is kept for good.
+*
+* So `abandon` runs first, synchronously: it must make the pending `next()`
+* settle (abort the stream), which then resolves done, after which the
+* generator's own `return()` / `throw()` proceeds as usual. On a generator
+* suspended at a `yield` it is the same ending, a step earlier. `abandon` runs once, whichever comes first.
+*/
+function returningAtOnce(gen, abandon) {
+	let abandoned = false;
+	const giveUp = (reason) => {
+		if (abandoned) return;
+		abandoned = true;
+		abandon(reason);
+	};
+	const wrapped = {
+		next: (...args) => gen.next(...args).catch((error) => {
+			if (abandoned) return {
+				done: true,
+				value: void 0
+			};
+			throw error;
+		}),
+		return(value) {
+			giveUp();
+			return gen.return(value);
+		},
+		throw(error) {
+			giveUp(error);
+			return gen.throw(error);
+		},
+		[Symbol.asyncIterator]() {
+			return wrapped;
+		}
+	};
+	return asyncDisposable$1(wrapped, () => wrapped.return(void 0));
+}
+/**
 * The `type` of the out-of-band notice a side posts when it abandons a stream.
 *
 * Layer 1's `close` is not observable to layer 2 — a closed virtual port drops
@@ -1783,7 +1950,7 @@ function runCallerSide(port, input, options) {
 	const inbound = receiveChunks(port, CHANNEL_OUT, controller, clock.touch);
 	const pump = sendChunks(port, CHANNEL_IN, input, options, controller.signal, clock.touch);
 	pump.catch(() => {});
-	return (async function* () {
+	return returningAtOnce((async function* () {
 		try {
 			yield* inbound.stream;
 		} finally {
@@ -1797,7 +1964,9 @@ function runCallerSide(port, input, options) {
 				await port.close?.();
 			} catch {}
 		}
-	})();
+	})(), () => {
+		if (!controller.signal.aborted) controller.abort(/* @__PURE__ */ new Error("webrun-rpc: the caller abandoned the stream"));
+	});
 }
 /**
 * Listens for the peer's abort notice, and can post our own. The notice is a
@@ -1998,6 +2167,33 @@ async function sendChunks(port, channelName, output, { maxMessageSize, log }, si
 	}
 }
 /**
+* Runs `fn` on a later task, never a microtask: a producer looping on
+* `whenPortReady` must let the transport's own events run. `setImmediate`
+* where it exists; elsewhere a `MessageChannel`, because nested `setTimeout`s
+* are clamped to 4 ms in browsers.
+*/
+const setImmediateFn = globalThis.setImmediate;
+/** @internal */
+const nextTask = setImmediateFn ? (fn) => {
+	setImmediateFn(fn);
+} : (() => {
+	let channel;
+	const queue = [];
+	return (fn) => {
+		if (!channel) {
+			channel = new MessageChannel();
+			channel.port1.onmessage = () => queue.shift()?.();
+		}
+		queue.push(fn);
+		channel.port2.postMessage(0);
+	};
+})();
+const states = /* @__PURE__ */ new WeakMap();
+/** @internal Registered by the multiplexer for each port with a window. */
+function setPortSendState(port, state) {
+	states.set(port, state);
+}
+/**
 * One virtual port.
 *
 * `deliver` and `markClosed` are deliberately not on `port`: the consumer holds
@@ -2012,6 +2208,14 @@ function newVirtualPort(send, requestClose) {
 		if (closing.signal.aborted) return;
 		closing.abort(reason ?? /* @__PURE__ */ new Error("webrun-rpc: the port was closed"));
 	};
+	const close = (reason) => {
+		if (closed) return;
+		closed = true;
+		const notify = requestClose;
+		listeners.clear();
+		notify(reason);
+		abort(reason);
+	};
 	const port = {
 		addEventListener(_type, listener) {
 			listeners.add(listener);
@@ -2023,24 +2227,28 @@ function newVirtualPort(send, requestClose) {
 			if (closed) return;
 			send(message, transfer);
 		},
-		close() {
-			if (closed) return;
-			closed = true;
-			const notify = requestClose;
-			listeners.clear();
-			notify();
-			abort();
-		}
+		close
 	};
 	setPortCloseSignal(port, closing.signal);
+	const dispose = Symbol.dispose;
+	if (dispose) Object.defineProperty(port, dispose, {
+		value: () => close(),
+		configurable: true
+	});
 	return {
 		port,
 		deliver(payload) {
 			if (closed) return;
 			const event = new MessageEvent("message", { data: payload });
+			let pending;
 			for (const listener of [...listeners]) try {
-				listener(event);
+				const result = listener(event);
+				if (result && typeof result.then === "function") {
+					pending ??= [];
+					pending.push(result);
+				}
 			} catch {}
+			return pending ? Promise.allSettled(pending) : void 0;
 		},
 		markClosed(reason) {
 			closed = true;
@@ -2049,53 +2257,309 @@ function newVirtualPort(send, requestClose) {
 		},
 		isClosed() {
 			return closed;
+		},
+		hasListeners() {
+			return listeners.size > 0;
 		}
 	};
 }
 /**
-* The message of the error that fails the calls still in flight on a
-* multiplexer when it is closed (`PortMux.close()`).
+* The id of keepalive's `ping` / `pong`: one no port ever takes. An older mux
+* whose codec passes unknown envelopes through reads them as a close of that
+* id, which must therefore not be a real port (0 is the initiator's first).
 */
-const MUX_CLOSED_MESSAGE = "webrun-rpc: the multiplexer was closed";
+const KEEPALIVE_ID = Number.MAX_SAFE_INTEGER;
+/** The longest delay a timer holds; past it `setInterval` fires at once. */
+const MAX_TIMER_MS = 2 ** 31 - 1;
 /** Ceiling on concurrently open virtual ports. Bounds the id table only. */
 const DEFAULT_MAX_PORTS = 1024;
 /**
+* What a message costs a port's window when the codec cannot say
+* (`PortCodec.encode`): its bytes and string lengths, found in its values up
+* to 4 levels deep (at most 256 values), and at least 64. Both ends compute it
+* from the same structured value, so they agree.
+*/
+function estimateMessageSize(payload) {
+	let budget = 256;
+	const walk = (v, depth) => {
+		if (budget-- <= 0) return 0;
+		if (typeof v === "string") return v.length;
+		if (v instanceof ArrayBuffer) return v.byteLength;
+		if (ArrayBuffer.isView(v)) return v.byteLength;
+		if (v === null || typeof v !== "object" || depth >= 4) return 8;
+		let n = 16;
+		if (Array.isArray(v)) for (const x of v) n += walk(x, depth + 1);
+		else for (const k in v) n += k.length + walk(v[k], depth + 1);
+		return n;
+	};
+	return Math.max(64, walk(payload, 0));
+}
+/**
 * The default `PortMux`: emulates multiplexing over a single port.
 *
 * A transport that already multiplexes natively supplies its own `PortMux`
 * instead — this implementation is for transports that offer one pipe.
 */
 function multiplexPort(port, options) {
-	const { codec, onPort, side = "initiator", maxPorts = DEFAULT_MAX_PORTS, maxMessageSize } = options;
+	const { codec, onPort, side = "initiator", maxPorts = DEFAULT_MAX_PORTS, maxMessageSize, signal, window, frameSize, keepalive, onLeak } = options;
+	const misses = keepalive?.misses ?? 3;
+	if (keepalive && !(Number.isFinite(keepalive.intervalMs) && keepalive.intervalMs > 0 && keepalive.intervalMs <= MAX_TIMER_MS && Number.isSafeInteger(misses) && misses > 0)) throw new RangeError(`webrun-rpc: keepalive needs an intervalMs in (0, ${MAX_TIMER_MS}] and a positive integer misses`);
+	if (frameSize != null && !(Number.isSafeInteger(frameSize) && frameSize > 0)) throw new RangeError(`webrun-rpc: frameSize must be a positive integer, got ${frameSize}`);
 	const open = /* @__PURE__ */ new Map();
+	const leaks = onLeak ? new FinalizationRegistry(({ id, record, release }) => {
+		const entry = open.get(id);
+		if (entry?.handle !== record) return;
+		const { handle: _, credit: __, partial: ___, ...info } = entry;
+		if (!record.hasListeners()) {
+			release("leaked");
+			record.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the port was dropped without close()"));
+		}
+		try {
+			onLeak?.(info);
+		} catch {}
+	}) : void 0;
+	const touch = (id) => {
+		const entry = open.get(id);
+		if (entry) entry.lastActivity = Date.now();
+	};
 	let nextId = side === "initiator" ? 0 : 1;
 	let muxClosed = false;
+	/** This end counts encoded bytes and reassembles frames. */
+	const exactCodec = codec.encode != null && codec.decode != null;
 	const post = (envelope, transfer) => {
 		if (muxClosed) return;
+		codecPost(envelope, transfer);
+	};
+	/** Like `post`, also while closing: the mux's own close notices. */
+	const codecPost = (envelope, transfer) => {
 		try {
 			codec.post(port, envelope, transfer);
 		} catch {}
 	};
-	const attach = (id) => {
-		let self;
-		self = newVirtualPort((payload, transfer) => post({
-			type: "message",
-			id,
-			payload
-		}, transfer), (reason) => {
+	const outgoing = /* @__PURE__ */ new Map();
+	const ring = [];
+	let pumping = false;
+	const pump = async () => {
+		pumping = true;
+		try {
+			while (ring.length && !muxClosed) {
+				if (port.whenDrained) await port.whenDrained();
+				if (muxClosed) break;
+				const id = ring.shift();
+				const queue = outgoing.get(id);
+				const item = queue?.shift();
+				if (queue?.length) ring.push(id);
+				else outgoing.delete(id);
+				item?.();
+			}
+		} catch (err) {
+			close(err).catch(() => {});
+		} finally {
+			pumping = false;
+		}
+	};
+	const sendOnPort = (id, item) => {
+		if (frameSize == null) {
+			item();
+			return;
+		}
+		let queue = outgoing.get(id);
+		if (!queue) {
+			queue = [];
+			outgoing.set(id, queue);
+			ring.push(id);
+		}
+		queue.push(item);
+		if (!pumping) pump();
+	};
+	const dropOutgoing = (id) => {
+		if (!outgoing.delete(id)) return;
+		const at = ring.indexOf(id);
+		if (at >= 0) ring.splice(at, 1);
+	};
+	const postBytes = (bytes) => {
+		if (muxClosed) return;
+		try {
+			port.postMessage(bytes);
+		} catch {}
+	};
+	const releaseWaiters = (c) => {
+		for (const w of c?.waiters.splice(0) ?? []) w.resolve();
+	};
+	const flush = (c) => {
+		while (c.queue.length) {
+			const next = c.queue[0];
+			if (c.enforced && c.outstanding > 0 && c.outstanding + next.size > c.window) break;
+			c.queue.shift();
+			c.queued -= next.size;
+			c.outstanding += next.size;
+			next.send();
+		}
+		for (const w of [...c.waiters]) if (c.queued <= w.below) {
+			c.waiters.splice(c.waiters.indexOf(w), 1);
+			w.resolve();
+		}
+	};
+	const grant = (id, c, bytes) => {
+		c.unconsumed -= bytes;
+		c.toGrant += bytes;
+		const send = () => {
+			c.grantScheduled = false;
+			if (!c.toGrant || !open.has(id)) return;
 			post({
+				type: "credit",
+				id,
+				bytes: c.toGrant
+			});
+			c.toGrant = 0;
+		};
+		if (c.toGrant >= c.window / 4) {
+			send();
+			return;
+		}
+		if (c.grantScheduled) return;
+		c.grantScheduled = true;
+		setTimeout(send, 0);
+	};
+	const attach = (id, meta, portWindow, opener, exact) => {
+		const c = typeof portWindow === "number" && Number.isSafeInteger(portWindow) && portWindow > 0 ? {
+			window: portWindow,
+			enforced: false,
+			opener,
+			exact,
+			outstanding: 0,
+			queue: [],
+			queued: 0,
+			unconsumed: 0,
+			waiters: [],
+			toGrant: 0,
+			grantScheduled: false
+		} : void 0;
+		const self = newVirtualPort((payload, transfer) => {
+			touch(id);
+			const envelope = {
+				type: "message",
+				id,
+				payload
+			};
+			if (!c) {
+				post(envelope, transfer);
+				return;
+			}
+			const bytes = c.exact ? codec.encode?.(envelope) : void 0;
+			const size = bytes?.byteLength ?? estimateMessageSize(payload);
+			const waits = frameSize != null || c.queue.length > 0 || c.enforced && c.outstanding > 0 && c.outstanding + size > c.window;
+			const held = !bytes && waits ? {
+				...envelope,
+				payload: structuredClone(payload, { transfer })
+			} : void 0;
+			const send = () => {
+				if (!bytes) {
+					sendOnPort(id, held ? () => post(held) : () => post(envelope, transfer));
+					return;
+				}
+				if (frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
+					for (let at = 0; at < bytes.byteLength; at += frameSize) {
+						const data = bytes.subarray(at, at + frameSize);
+						const frame = at + frameSize >= bytes.byteLength ? {
+							type: "frame",
+							id,
+							data,
+							last: true
+						} : {
+							type: "frame",
+							id,
+							data
+						};
+						sendOnPort(id, () => post(frame));
+					}
+					return;
+				}
+				sendOnPort(id, () => postBytes(bytes));
+			};
+			c.queue.push({
+				send,
+				size
+			});
+			c.queued += size;
+			flush(c);
+		}, (reason) => {
+			release(reason);
+			record.markClosed(reason);
+		});
+		function release(reason) {
+			open.delete(id);
+			leaks?.unregister(record);
+			if (c?.queue.length) {
+				for (const item of c.queue.splice(0)) item.send();
+				c.queued = 0;
+			}
+			sendOnPort(id, () => post({
 				type: "close",
 				id,
 				reason
+			}));
+			releaseWaiters(c);
+		}
+		const { markClosed, isClosed, hasListeners } = self;
+		if (c) {
+			const deliver = self.deliver;
+			self.deliver = (payload, size = estimateMessageSize(payload)) => {
+				c.unconsumed += size;
+				const done = deliver(payload);
+				if (done) done.then(() => grant(id, c, size));
+				else grant(id, c, size);
+				return done;
+			};
+			setPortSendState(self.port, {
+				bufferedAmount: () => c.queued,
+				ready: (below = 0) => new Promise((resolve) => {
+					if (c.queued <= below || isClosed()) nextTask(resolve);
+					else c.waiters.push({
+						below,
+						resolve: () => nextTask(resolve)
+					});
+				})
 			});
-			open.delete(id);
-			self.markClosed();
+		}
+		const record = {
+			deliver: self.deliver,
+			markClosed,
+			isClosed,
+			hasListeners,
+			close: (reason) => {
+				if (isClosed()) return;
+				release(reason);
+				markClosed(reason);
+			}
+		};
+		leaks?.register(self.port, {
+			id,
+			record,
+			release
+		}, record);
+		const now = Date.now();
+		open.set(id, {
+			id,
+			meta,
+			openedAt: now,
+			lastActivity: now,
+			handle: record,
+			credit: c
 		});
-		open.set(id, self);
 		return self;
 	};
-	const handleEnvelope = (envelope) => {
+	const handleEnvelope = (envelope, event) => {
 		if (muxClosed) return;
+		heardSincePing = true;
+		if (envelope.type === "ping" || envelope.type === "pong") {
+			peerKeepsAlive = true;
+			if (envelope.type === "ping") post({
+				type: "pong",
+				id: KEEPALIVE_ID
+			});
+			return;
+		}
 		if (envelope.type === "open") {
 			if (open.has(envelope.id)) return;
 			if (open.size >= maxPorts) {
@@ -2106,7 +2570,18 @@ function multiplexPort(port, options) {
 				});
 				return;
 			}
-			const handle = attach(envelope.id);
+			const handle = attach(envelope.id, envelope.meta, envelope.window, false, envelope.exact === true && exactCodec);
+			const credit = open.get(envelope.id)?.credit;
+			if (credit) post(credit.exact ? {
+				type: "credit",
+				id: envelope.id,
+				bytes: 0,
+				exact: true
+			} : {
+				type: "credit",
+				id: envelope.id,
+				bytes: 0
+			});
 			let accepted = false;
 			if (onPort) try {
 				accepted = onPort(handle.port, envelope.meta) !== false;
@@ -2121,57 +2596,191 @@ function multiplexPort(port, options) {
 					id: envelope.id,
 					reason: "rejected"
 				});
+				return;
 			}
 			return;
 		}
-		const handle = open.get(envelope.id);
+		const entry = open.get(envelope.id);
+		if (envelope.type === "credit") {
+			const c = entry?.credit;
+			if (!c || !(envelope.bytes >= 0)) return;
+			if (!c.enforced && c.opener) {
+				if (c.exact && envelope.exact !== true) {
+					c.exact = false;
+					c.outstanding = 0;
+				}
+				post({
+					type: "credit",
+					id: envelope.id,
+					bytes: 0
+				});
+			}
+			c.enforced = true;
+			c.outstanding = Math.max(0, c.outstanding - envelope.bytes);
+			flush(c);
+			return;
+		}
 		if (envelope.type === "message") {
-			if (!handle) return;
-			handle.deliver(envelope.payload);
+			const sizeOf = (c) => (c.exact ? byteLengthOf(event.data) : void 0) ?? estimateMessageSize(envelope.payload);
+			if (!entry) return;
+			touch(envelope.id);
+			entry.handle.deliver(envelope.payload, entry.credit ? sizeOf(entry.credit) : void 0);
+			return;
+		}
+		if (envelope.type === "frame") {
+			if (!entry?.credit?.exact || !codec.decode || !(envelope.data instanceof Uint8Array)) return;
+			touch(envelope.id);
+			const partial = entry.partial ?? {
+				chunks: [],
+				bytes: 0
+			};
+			entry.partial = partial;
+			partial.chunks.push(envelope.data);
+			partial.bytes += envelope.data.byteLength;
+			if (!envelope.last) return;
+			entry.partial = void 0;
+			const whole = new Uint8Array(partial.bytes);
+			let at = 0;
+			for (const chunk of partial.chunks) {
+				whole.set(chunk, at);
+				at += chunk.byteLength;
+			}
+			const inner = codec.decode(whole);
+			if (inner?.type !== "message" || inner.id !== envelope.id) return;
+			entry.handle.deliver(inner.payload, whole.byteLength);
 			return;
 		}
-		if (!handle) return;
+		dropOutgoing(envelope.id);
+		if (!entry) return;
 		open.delete(envelope.id);
-		handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the peer closed the port"));
+		releaseWaiters(entry.credit);
+		entry.handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the peer closed the port"));
 	};
 	const listener = (event) => {
 		const envelope = codec.read(event);
-		if (envelope) handleEnvelope(envelope);
+		if (envelope) handleEnvelope(envelope, event);
+	};
+	let peerKeepsAlive = false;
+	let heardSincePing = true;
+	let unanswered = 0;
+	let pinger;
+	const tick = () => {
+		if (!keepalive) return;
+		const backlogged = (port.bufferedAmount ?? 0) > 0;
+		if (heardSincePing) unanswered = 0;
+		else if (peerKeepsAlive && !backlogged) unanswered++;
+		if (unanswered >= misses) {
+			close(/* @__PURE__ */ new Error(`webrun-rpc: the peer did not answer ${misses} keepalive pings, ${keepalive.intervalMs} ms apart`)).catch(() => {});
+			return;
+		}
+		heardSincePing = false;
+		post({
+			type: "ping",
+			id: KEEPALIVE_ID
+		});
+	};
+	const close = async (reason) => {
+		if (muxClosed) return;
+		clearInterval(pinger);
+		muxClosed = true;
+		signal?.removeEventListener("abort", onTransportAbort);
+		port.removeEventListener("message", listener);
+		const closedNow = /* @__PURE__ */ new Set();
+		for (const [id, { handle, credit }] of [...open]) {
+			closedNow.add(id);
+			codecPost({
+				type: "close",
+				id
+			});
+			open.delete(id);
+			releaseWaiters(credit);
+			handle.markClosed(reason ?? /* @__PURE__ */ new Error("webrun-rpc: the multiplexer was closed"));
+		}
+		for (const id of outgoing.keys()) if (!closedNow.has(id)) codecPost({
+			type: "close",
+			id
+		});
+		outgoing.clear();
+		ring.length = 0;
+		await port.close?.();
+	};
+	const onTransportAbort = () => {
+		close(signal?.reason).catch(() => {});
 	};
 	port.addEventListener("message", listener);
 	port.start?.();
+	if (keepalive) {
+		pinger = setInterval(tick, keepalive.intervalMs);
+		pinger.unref?.();
+	}
+	if (signal?.aborted) close(signal.reason).catch(() => {});
+	else signal?.addEventListener("abort", onTransportAbort, { once: true });
 	return {
 		maxMessageSize,
-		async openPort(meta) {
+		async openPort(meta, { signal: portSignal } = {}) {
 			if (muxClosed) throw new Error("webrun-rpc: the multiplexer is closed");
-			if (open.size >= maxPorts) throw new RangeError(`webrun-rpc: maxPorts (${maxPorts}) reached`);
+			if (portSignal?.aborted) throw portSignal.reason;
+			if (open.size >= maxPorts) throw new RangeError(`webrun-rpc: maxPorts (${maxPorts}) reached; open ports by kind: ${describeKinds(open.values())}`);
 			while (open.has(nextId)) nextId += 2;
 			const id = nextId;
 			nextId += 2;
-			const handle = attach(id);
-			post({
+			const handle = attach(id, meta, window, true, exactCodec);
+			post(window ? exactCodec ? {
+				type: "open",
+				id,
+				meta,
+				window,
+				exact: true
+			} : {
+				type: "open",
+				id,
+				meta,
+				window
+			} : {
 				type: "open",
 				id,
 				meta
 			});
+			if (portSignal) {
+				const record = open.get(id)?.handle;
+				const onAbort = () => {
+					if (record && open.get(id)?.handle === record) record.close(portSignal.reason);
+				};
+				portSignal.addEventListener("abort", onAbort, { once: true });
+				getPortCloseSignal(handle.port)?.addEventListener("abort", () => portSignal.removeEventListener("abort", onAbort), { once: true });
+			}
 			return handle.port;
 		},
-		async close() {
-			if (muxClosed) return;
-			for (const [id, handle] of [...open]) {
-				post({
-					type: "close",
-					id
-				});
-				open.delete(id);
-				handle.markClosed(/* @__PURE__ */ new Error(MUX_CLOSED_MESSAGE));
-			}
-			muxClosed = true;
-			port.removeEventListener("message", listener);
-			await port.close?.();
+		close,
+		ports() {
+			return [...open.values()].map(({ handle: _, credit, ...info }) => credit ? {
+				...info,
+				...credit.enforced ? { window: credit.window } : {},
+				queued: credit.queued,
+				outstanding: credit.outstanding,
+				unconsumed: credit.unconsumed
+			} : info);
 		}
 	};
 }
+/** The byte length of a received message's data, or `undefined` if it is not bytes. */
+function byteLengthOf(data) {
+	if (data instanceof ArrayBuffer || ArrayBuffer.isView(data)) return data.byteLength;
+}
+/**
+* `"http: 1000, ws: 24"`: the three commonest `meta.kind`s among `entries`, so
+* a full table names who filled it. A port without a kind counts as `"?"`.
+*/
+function describeKinds(entries) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const { meta } of entries) {
+		const kind = meta?.kind;
+		const name = typeof kind === "string" ? kind : "?";
+		counts.set(name, (counts.get(name) ?? 0) + 1);
+	}
+	if (!counts.size) return "none";
+	return [...counts].sort((x, y) => y[1] - x[1]).slice(0, 3).map(([name, n]) => `${name}: ${n}`).join(", ");
+}
 /**
 * Announced with every port this pair opens. Layer 1 never reads `meta` — it is
 * here so a peer running something else over the same multiplexer can tell a
@@ -2193,9 +2802,22 @@ const connect = async ({ mux: factory, timeout }) => {
 		maxMessageSize: mux.maxMessageSize,
 		timeout
 	};
-	const call = (input) => (async function* () {
-		yield* duplexOverPort(await mux.openPort(STREAM_META), streamOptions)(input);
-	})();
+	const call = (input) => {
+		let stream;
+		let abandoned = false;
+		return returningAtOnce((async function* () {
+			const port = await mux.openPort(STREAM_META);
+			if (abandoned) {
+				await port.close?.();
+				return;
+			}
+			stream = duplexOverPort(port, streamOptions)(input);
+			yield* stream;
+		})(), () => {
+			abandoned = true;
+			stream?.return(void 0).catch(() => {});
+		});
+	};
 	return {
 		call,
 		async close() {
@@ -2220,7 +2842,7 @@ function isEnvelope(value) {
 	const candidate = value;
 	if (typeof candidate.id !== "number") return false;
 	if (!Number.isInteger(candidate.id) || candidate.id < 0) return false;
-	return candidate.type === "open" || candidate.type === "message" || candidate.type === "close";
+	return candidate.type === "open" || candidate.type === "message" || candidate.type === "close" || candidate.type === "credit" || candidate.type === "frame" || candidate.type === "ping" || candidate.type === "pong";
 }
 /**
 * For ports whose messages are structured values — a real `MessagePort`, a
@@ -2241,6 +2863,27 @@ const structuredCodec = {
 	}
 };
 //#endregion
+//#region src/link/async-dispose.ts
+/**
+* Makes `target` disposable with `await using`: installs `dispose` as its
+* `[Symbol.asyncDispose]`, where the runtime defines the symbol. Hand-written
+* iterators lose what a native generator gets from `AsyncIteratorPrototype`;
+* this gives it back. A no-op where the symbol is missing. Kept off the
+* declared types, which would require consumers to compile with the
+* `esnext.disposable` lib.
+*/
+function asyncDisposable(target, dispose) {
+	const asyncDispose = Symbol.asyncDispose;
+	if (asyncDispose && !(asyncDispose in target)) Object.defineProperty(target, asyncDispose, {
+		value: async () => {
+			await dispose();
+		},
+		configurable: true,
+		writable: true
+	});
+	return target;
+}
+//#endregion
 //#region src/link/http-link.ts
 /**
 * The version of the HTTP-over-`MessagePort` protocol this package speaks,
@@ -2270,11 +2913,12 @@ var LinkLostError = class extends Error {
 */
 const LINK_CLOSE = "webrun-http:link-close";
 /** Opens the calling end of a link on `port` (one port per link). */
-async function connectHttpLink(port, { streamTimeout } = {}) {
+async function connectHttpLink(port, { streamTimeout, maxPorts } = {}) {
 	const { call, close } = await connect({
 		mux: overPipe(port, {
 			codec: structuredCodec,
-			side: "initiator"
+			side: "initiator",
+			maxPorts
 		}),
 		timeout: streamTimeout
 	});
@@ -2299,7 +2943,7 @@ function trackedLink(send, release) {
 		inflight--;
 		if (inflight === 0) for (const resolve of idleWaiters.splice(0)) resolve();
 	};
-	return {
+	const link = {
 		get inflight() {
 			return inflight;
 		},
@@ -2336,7 +2980,7 @@ function trackedLink(send, release) {
 				finish();
 				return response;
 			}
-			return new Response(guardBody(response.body, lost, () => lostReason, finish), {
+			return new Response(guardBody(response.body, lost, () => lostReason, finish, request.signal), {
 				status: response.status,
 				statusText: response.statusText,
 				headers: response.headers
@@ -2352,35 +2996,68 @@ function trackedLink(send, release) {
 			} catch {}
 		}
 	};
+	return asyncDisposable(link, () => link.close());
 }
 /**
-* A response body that reports its end (done, cancelled or failed) and fails
-* with the link's reason when the link is lost mid-stream.
+* A response body that reports its end (done, cancelled, failed or aborted) and
+* fails with the link's reason when the link is lost mid-stream. An abort of the
+* request's signal ends it at once, read or not: the exchange is over (the layer
+* below has given its port back), so the request leaves `inflight` then.
 */
-function guardBody(body, lost, reason, finish) {
+function guardBody(body, lost, reason, finish, signal) {
 	const reader = body.getReader();
+	let controller;
+	let ended = false;
+	const end = () => {
+		ended = true;
+		signal?.removeEventListener("abort", onAbort);
+		finish();
+	};
+	const onAbort = () => {
+		if (ended) return;
+		end();
+		reader.cancel().catch(() => {});
+		try {
+			controller.error(abortError(signal));
+		} catch {}
+	};
 	return new ReadableStream({
+		start(c) {
+			controller = c;
+			if (signal?.aborted) onAbort();
+			else signal?.addEventListener("abort", onAbort, { once: true });
+		},
 		async pull(controller) {
 			try {
 				const { done, value } = await Promise.race([reader.read(), lost]);
+				if (ended) return;
 				if (done) {
-					finish();
+					end();
 					controller.close();
 					return;
 				}
 				controller.enqueue(value);
 			} catch (error) {
-				finish();
+				if (ended) return;
+				end();
 				reader.cancel().catch(() => {});
 				controller.error(reason() ?? error);
 			}
 		},
 		async cancel(why) {
-			finish();
+			end();
 			await reader.cancel(why).catch(() => {});
 		}
 	});
 }
+/** The signal's reason as an `Error` (`AbortError` when it gave none). */
+function abortError(signal) {
+	const why = signal.reason;
+	if (why instanceof Error) return why;
+	const err = new Error(why === void 0 ? "Aborted" : String(why));
+	err.name = "AbortError";
+	return err;
+}
 //#endregion
 //#region src/sw/protocol.ts
 /** Page → ServiceWorker: open a WebSocket to a handler. */