@statewalker/webrun-http-browser 0.7.1 → 0.10.0

package/dist/sw-worker.js

@@ -1394,7 +1394,11 @@
 	*/
 	function httpServe(handler, options = {}) {
 		const codec = options.codec ?? defaultCodec;
-		return async function* httpHandlerDuplex(input) {
+		return (input) => {
+			const abandoned = new AbortController();
+			return abortingOnReturn(exchange(input, { signal: abandoned.signal }), (reason) => abandoned.abort(reason ?? /* @__PURE__ */ new Error("webrun-http-streams: the exchange was abandoned before it was over")));
+		};
+		async function* exchange(input, context) {
 			let decoded;
 			try {
 				decoded = await codec.decodeRequest(input);
@@ -1406,7 +1410,7 @@
 			const replyCodec = decoded.codec ?? codec;
 			let result;
 			try {
-				result = await handler(decoded.envelope, decoded.body);
+				result = await handler(decoded.envelope, decoded.body, context);
 			} catch (error) {
 				yield* encodeErrorResponse(replyCodec, error, decoded.envelope.method);
 				return;
@@ -1421,7 +1425,36 @@
 					await result.release?.();
 				} catch {}
 			}
+		}
+	}
+	/**
+	* `gen`, except that `return()` and `throw()` from its consumer call `abandon`
+	* at once — before they are queued behind a `next()` still parked inside the
+	* generator (the handler's `await`) — unless the generator already finished.
+	*/
+	function abortingOnReturn(gen, abandon) {
+		let finished = false;
+		const settle = (r) => {
+			if (r.done) finished = true;
+			return r;
+		};
+		const wrapped = {
+			next: (...args) => gen.next(...args).then(settle),
+			return(value) {
+				if (!finished) abandon();
+				finished = true;
+				return gen.return(value);
+			},
+			throw(error) {
+				if (!finished) abandon(error);
+				finished = true;
+				return gen.throw(error);
+			},
+			[Symbol.asyncIterator]() {
+				return wrapped;
+			}
 		};
+		return asyncDisposable$2(wrapped, () => wrapped.return(void 0));
 	}
 	/**
 	* The one place that knows a runtime may not implement request body streams,
@@ -1653,17 +1686,18 @@
 			else await release?.();
 			return new Response(null, responseInit);
 		}
-		return new Response(asyncIterableToReadable(withAbort(respBody, request.signal)), responseInit);
+		return new Response(responseBody(respBody, request.signal, release), responseInit);
 	}
 	/**
 	* Wrap a `(Request) => Promise<Response>` handler as a `Duplex` so it can be
 	* registered with any `webrun-streams-*` adapter's `serve`.
 	*/
 	function serveFetchOverDuplex(handler, options = {}) {
-		return httpServe(async (env, body) => {
+		return httpServe(async (env, body, exchange) => {
 			const reqInit = {
 				method: env.method,
-				headers: forwardableHeaders(env.headers)
+				headers: forwardableHeaders(env.headers),
+				signal: exchange?.signal
 			};
 			let upload;
 			if (env.method !== "GET" && env.method !== "HEAD") {
@@ -1784,15 +1818,78 @@
 			settle
 		};
 	}
-	async function* withAbort(iter, signal) {
-		if (!signal) {
-			yield* iter;
-			return;
-		}
-		for await (const chunk of iter) {
-			if (signal.aborted) throw abortReason$1(signal);
-			yield chunk;
-		}
+	/**
+	* How long a cancelled body waits for the read in flight before it abandons the call anyway.
+	* The read's answer tells a body that has ended (the call is finished: an upload the handler
+	* reads after answering goes on) from one that has not; a peer that sends nothing more never
+	* answers it. A body whose end comes later than this after the cancel is abandoned too, so a
+	* handler still streaming its response and still reading the upload then loses the upload.
+	*/
+	const CANCEL_GRACE_MS = 1e3;
+	/**
+	* The response body as a stream that the request's signal can end at any time.
+	*
+	* An abort errors the stream with the abort's reason at once — a read waiting
+	* for a peer that sends nothing more rejects then, not when a next chunk
+	* arrives, which may be never — and abandons the call (`release`), so on a
+	* multiplexed transport its port is given back whether or not anyone still
+	* reads the body. The listener is removed once the body ends, however it ends:
+	* read to its end, cancelled, failed or aborted. A body nobody reads or cancels
+	* keeps it until the signal aborts (and keeps the call open until then anyway).
+	* A cancel abandons the call too — unless the read in flight comes back with the
+	* body's end, which finishes it instead (see `cancel`).
+	*/
+	function responseBody(body, signal, release) {
+		const it = body[Symbol.asyncIterator]();
+		let controller;
+		let ended = false;
+		let reading = false;
+		const end = () => {
+			ended = true;
+			signal?.removeEventListener("abort", onAbort);
+		};
+		const onAbort = () => {
+			if (ended) return;
+			end();
+			try {
+				controller.error(abortReason$1(signal));
+			} catch {}
+			release?.();
+		};
+		return new ReadableStream({
+			start(c) {
+				controller = c;
+				if (signal?.aborted) onAbort();
+				else signal?.addEventListener("abort", onAbort, { once: true });
+			},
+			async pull(c) {
+				try {
+					reading = true;
+					const { done, value } = await it.next().finally(() => {
+						reading = false;
+					});
+					if (ended) return;
+					if (done) {
+						end();
+						c.close();
+						return;
+					}
+					c.enqueue(value);
+				} catch (err) {
+					if (ended) return;
+					end();
+					c.error(err);
+				}
+			},
+			cancel() {
+				end();
+				const returned = Promise.resolve(it.return?.()).catch(() => {});
+				if (!reading) return;
+				const grace = setTimeout(() => void release?.(), CANCEL_GRACE_MS);
+				grace.unref?.();
+				returned.finally(() => clearTimeout(grace));
+			}
+		});
 	}
 	//#endregion
 	//#region src/core/data-channels.ts
@@ -2120,8 +2217,11 @@
 				error
 			});
 		};
-		port.addEventListener("message", onMessage);
-		return () => port.removeEventListener("message", onMessage);
+		const listener = (event) => {
+			onMessage(event);
+		};
+		port.addEventListener("message", listener);
+		return () => port.removeEventListener("message", listener);
 	}
 	/**
 	* Wraps an async iterable so that an `AbortSignal` firing causes the wrapper
@@ -2499,7 +2599,11 @@
 	* outstanding at a time (spec D11/D12), with no per-chunk deadline (spec D8).
 	*/
 	async function sendChunks(port, channelName, output, { maxMessageSize, log }, signal, touch) {
-		const stream = throughAbort(maxMessageSize ? toChunks(maxMessageSize)(output) : output, signal);
+		const framed = maxMessageSize ? toChunks(maxMessageSize)(output) : output;
+		const stream = throughAbort(framed, signal);
+		const producer = output;
+		const returnProducer = () => void Promise.resolve(producer.return?.()).catch(() => {});
+		if (framed !== output) signal.addEventListener("abort", returnProducer, { once: true });
 		try {
 			await sendIterator(async ({ done, value, error }) => {
 				if (signal.aborted) return;
@@ -2523,9 +2627,38 @@
 		} catch (err) {
 			if (signal.aborted) return;
 			throw err;
+		} finally {
+			signal.removeEventListener("abort", returnProducer);
 		}
 	}
 	/**
+	* Runs `fn` on a later task, never a microtask: a producer looping on
+	* `whenPortReady` must let the transport's own events run. `setImmediate`
+	* where it exists; elsewhere a `MessageChannel`, because nested `setTimeout`s
+	* are clamped to 4 ms in browsers.
+	*/
+	const setImmediateFn = globalThis.setImmediate;
+	/** @internal */
+	const nextTask = setImmediateFn ? (fn) => {
+		setImmediateFn(fn);
+	} : (() => {
+		let channel;
+		const queue = [];
+		return (fn) => {
+			if (!channel) {
+				channel = new MessageChannel();
+				channel.port1.onmessage = () => queue.shift()?.();
+			}
+			queue.push(fn);
+			channel.port2.postMessage(0);
+		};
+	})();
+	const states = /* @__PURE__ */ new WeakMap();
+	/** @internal Registered by the multiplexer for each port with a window. */
+	function setPortSendState(port, state) {
+		states.set(port, state);
+	}
+	/**
 	* One virtual port.
 	*
 	* `deliver` and `markClosed` are deliberately not on `port`: the consumer holds
@@ -2540,6 +2673,14 @@
 			if (closing.signal.aborted) return;
 			closing.abort(reason ?? /* @__PURE__ */ new Error("webrun-rpc: the port was closed"));
 		};
+		const close = (reason) => {
+			if (closed) return;
+			closed = true;
+			const notify = requestClose;
+			listeners.clear();
+			notify(reason);
+			abort(reason);
+		};
 		const port = {
 			addEventListener(_type, listener) {
 				listeners.add(listener);
@@ -2551,24 +2692,28 @@
 				if (closed) return;
 				send(message, transfer);
 			},
-			close() {
-				if (closed) return;
-				closed = true;
-				const notify = requestClose;
-				listeners.clear();
-				notify();
-				abort();
-			}
+			close
 		};
 		setPortCloseSignal(port, closing.signal);
+		const dispose = Symbol.dispose;
+		if (dispose) Object.defineProperty(port, dispose, {
+			value: () => close(),
+			configurable: true
+		});
 		return {
 			port,
 			deliver(payload) {
 				if (closed) return;
 				const event = new MessageEvent("message", { data: payload });
+				let pending;
 				for (const listener of [...listeners]) try {
-					listener(event);
+					const result = listener(event);
+					if (result && typeof result.then === "function") {
+						pending ??= [];
+						pending.push(result);
+					}
 				} catch {}
+				return pending ? Promise.allSettled(pending) : void 0;
 			},
 			markClosed(reason) {
 				closed = true;
@@ -2577,53 +2722,318 @@
 			},
 			isClosed() {
 				return closed;
+			},
+			hasListeners() {
+				return listeners.size > 0;
 			}
 		};
 	}
 	/**
-	* The message of the error that fails the calls still in flight on a
-	* multiplexer when it is closed (`PortMux.close()`).
+	* The id of keepalive's `ping` / `pong`: one no port ever takes. An older mux
+	* whose codec passes unknown envelopes through reads them as a close of that
+	* id, which must therefore not be a real port (0 is the initiator's first).
 	*/
-	const MUX_CLOSED_MESSAGE = "webrun-rpc: the multiplexer was closed";
+	const KEEPALIVE_ID = Number.MAX_SAFE_INTEGER;
+	/** The longest delay a timer holds; past it `setInterval` fires at once. */
+	const MAX_TIMER_MS = 2 ** 31 - 1;
 	/** Ceiling on concurrently open virtual ports. Bounds the id table only. */
 	const DEFAULT_MAX_PORTS = 1024;
 	/**
+	* What a message costs a port's window when the codec cannot say
+	* (`PortCodec.encode`): its bytes and string lengths, found in its values up
+	* to 4 levels deep (at most 256 values), and at least 64. Both ends compute it
+	* from the same structured value, so they agree.
+	*/
+	function estimateMessageSize(payload) {
+		let budget = 256;
+		const walk = (v, depth) => {
+			if (budget-- <= 0) return 0;
+			if (typeof v === "string") return v.length;
+			if (v instanceof ArrayBuffer) return v.byteLength;
+			if (ArrayBuffer.isView(v)) return v.byteLength;
+			if (v === null || typeof v !== "object" || depth >= 4) return 8;
+			let n = 16;
+			if (Array.isArray(v)) for (const x of v) n += walk(x, depth + 1);
+			else for (const k in v) n += k.length + walk(v[k], depth + 1);
+			return n;
+		};
+		return Math.max(64, walk(payload, 0));
+	}
+	/**
 	* The default `PortMux`: emulates multiplexing over a single port.
 	*
 	* A transport that already multiplexes natively supplies its own `PortMux`
 	* instead — this implementation is for transports that offer one pipe.
 	*/
 	function multiplexPort(port, options) {
-		const { codec, onPort, side = "initiator", maxPorts = DEFAULT_MAX_PORTS, maxMessageSize } = options;
+		const { codec, onPort, side = "initiator", maxPorts = DEFAULT_MAX_PORTS, maxMessageSize, signal, window, frameSize, keepalive, onLeak } = options;
+		const maxReassembledBytes = options.maxReassembledBytes ?? 67108864;
+		const misses = keepalive?.misses ?? 3;
+		if (keepalive && !(Number.isFinite(keepalive.intervalMs) && keepalive.intervalMs > 0 && keepalive.intervalMs <= MAX_TIMER_MS && Number.isSafeInteger(misses) && misses > 0)) throw new RangeError(`webrun-rpc: keepalive needs an intervalMs in (0, ${MAX_TIMER_MS}] and a positive integer misses`);
+		if (frameSize != null && !(Number.isSafeInteger(frameSize) && frameSize > 0)) throw new RangeError(`webrun-rpc: frameSize must be a positive integer, got ${frameSize}`);
+		if (!(Number.isSafeInteger(maxReassembledBytes) && maxReassembledBytes > 0)) throw new RangeError(`webrun-rpc: maxReassembledBytes must be a positive integer, got ${maxReassembledBytes}`);
 		const open = /* @__PURE__ */ new Map();
+		let reassembling = 0;
+		const freePartial = (entry) => {
+			if (!entry?.partial) return;
+			reassembling -= entry.partial.charged;
+			entry.partial = void 0;
+		};
+		const leaks = onLeak ? new FinalizationRegistry(({ id, record, release }) => {
+			const entry = open.get(id);
+			if (entry?.handle !== record) return;
+			const { handle: _, credit: __, partial: ___, ...info } = entry;
+			if (!record.hasListeners()) {
+				release("leaked");
+				record.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the port was dropped without close()"));
+			}
+			try {
+				onLeak?.(info);
+			} catch {}
+		}) : void 0;
+		const touch = (id) => {
+			const entry = open.get(id);
+			if (entry) entry.lastActivity = Date.now();
+		};
 		let nextId = side === "initiator" ? 0 : 1;
 		let muxClosed = false;
+		/** This end counts encoded bytes and reassembles frames. */
+		const exactCodec = codec.encode != null && codec.decode != null;
 		const post = (envelope, transfer) => {
 			if (muxClosed) return;
+			codecPost(envelope, transfer);
+		};
+		/** Like `post`, also while closing: the mux's own close notices. */
+		const codecPost = (envelope, transfer) => {
 			try {
 				codec.post(port, envelope, transfer);
 			} catch {}
 		};
-		const attach = (id) => {
-			let self;
-			self = newVirtualPort((payload, transfer) => post({
-				type: "message",
-				id,
-				payload
-			}, transfer), (reason) => {
+		const outgoing = /* @__PURE__ */ new Map();
+		const ring = [];
+		let pumping = false;
+		const pump = async () => {
+			pumping = true;
+			try {
+				while (ring.length && !muxClosed) {
+					if (port.whenDrained) await port.whenDrained();
+					if (muxClosed) break;
+					const id = ring.shift();
+					const queue = outgoing.get(id);
+					const item = queue?.shift();
+					if (queue?.length) ring.push(id);
+					else outgoing.delete(id);
+					item?.();
+				}
+			} catch (err) {
+				close(err).catch(() => {});
+			} finally {
+				pumping = false;
+			}
+		};
+		const sendOnPort = (id, item) => {
+			if (frameSize == null) {
+				item();
+				return;
+			}
+			let queue = outgoing.get(id);
+			if (!queue) {
+				queue = [];
+				outgoing.set(id, queue);
+				ring.push(id);
+			}
+			queue.push(item);
+			if (!pumping) pump();
+		};
+		const dropOutgoing = (id) => {
+			if (!outgoing.delete(id)) return;
+			const at = ring.indexOf(id);
+			if (at >= 0) ring.splice(at, 1);
+		};
+		const postBytes = (bytes) => {
+			if (muxClosed) return;
+			try {
+				port.postMessage(bytes);
+			} catch {}
+		};
+		const releaseWaiters = (c) => {
+			for (const w of c?.waiters.splice(0) ?? []) w.resolve();
+		};
+		const flush = (c) => {
+			while (c.queue.length) {
+				const next = c.queue[0];
+				if (c.enforced && c.outstanding > 0 && c.outstanding + next.size > c.window) break;
+				c.queue.shift();
+				c.queued -= next.size;
+				c.outstanding += next.size;
+				next.send();
+			}
+			for (const w of [...c.waiters]) if (c.queued <= w.below) {
+				c.waiters.splice(c.waiters.indexOf(w), 1);
+				w.resolve();
+			}
+		};
+		const grant = (id, c, bytes) => {
+			c.unconsumed -= bytes;
+			c.toGrant += bytes;
+			const send = () => {
+				c.grantScheduled = false;
+				if (!c.toGrant || !open.has(id)) return;
 				post({
+					type: "credit",
+					id,
+					bytes: c.toGrant
+				});
+				c.toGrant = 0;
+			};
+			if (c.toGrant >= c.window / 4) {
+				send();
+				return;
+			}
+			if (c.grantScheduled) return;
+			c.grantScheduled = true;
+			setTimeout(send, 0);
+		};
+		const attach = (id, meta, portWindow, opener, exact) => {
+			const c = typeof portWindow === "number" && Number.isSafeInteger(portWindow) && portWindow > 0 ? {
+				window: portWindow,
+				enforced: false,
+				opener,
+				exact,
+				outstanding: 0,
+				queue: [],
+				queued: 0,
+				unconsumed: 0,
+				waiters: [],
+				toGrant: 0,
+				grantScheduled: false
+			} : void 0;
+			const self = newVirtualPort((payload, transfer) => {
+				touch(id);
+				const envelope = {
+					type: "message",
+					id,
+					payload
+				};
+				if (!c) {
+					post(envelope, transfer);
+					return;
+				}
+				const bytes = c.exact ? codec.encode?.(envelope) : void 0;
+				const size = bytes?.byteLength ?? estimateMessageSize(payload);
+				const waits = frameSize != null || c.queue.length > 0 || c.enforced && c.outstanding > 0 && c.outstanding + size > c.window;
+				const held = !bytes && waits ? {
+					...envelope,
+					payload: structuredClone(payload, { transfer })
+				} : void 0;
+				const send = (whole = false) => {
+					if (!bytes) {
+						sendOnPort(id, held ? () => post(held) : () => post(envelope, transfer));
+						return;
+					}
+					if (!whole && frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
+						for (let at = 0; at < bytes.byteLength; at += frameSize) {
+							const data = bytes.subarray(at, at + frameSize);
+							const frame = at + frameSize >= bytes.byteLength ? {
+								type: "frame",
+								id,
+								data,
+								last: true
+							} : {
+								type: "frame",
+								id,
+								data
+							};
+							sendOnPort(id, () => post(frame));
+						}
+						return;
+					}
+					sendOnPort(id, () => postBytes(bytes));
+				};
+				c.queue.push({
+					send,
+					size
+				});
+				c.queued += size;
+				flush(c);
+			}, (reason) => {
+				release(reason);
+				record.markClosed(reason);
+			});
+			function release(reason) {
+				freePartial(open.get(id));
+				open.delete(id);
+				leaks?.unregister(record);
+				if (c?.queue.length) {
+					for (const item of c.queue.splice(0)) item.send(true);
+					c.queued = 0;
+				}
+				sendOnPort(id, () => post({
 					type: "close",
 					id,
 					reason
+				}));
+				releaseWaiters(c);
+			}
+			const { markClosed, isClosed, hasListeners } = self;
+			if (c) {
+				const deliver = self.deliver;
+				self.deliver = (payload, size = estimateMessageSize(payload)) => {
+					c.unconsumed += size;
+					const done = deliver(payload);
+					if (done) done.then(() => grant(id, c, size));
+					else grant(id, c, size);
+					return done;
+				};
+				setPortSendState(self.port, {
+					bufferedAmount: () => c.queued,
+					ready: (below = 0) => new Promise((resolve) => {
+						if (c.queued <= below || isClosed()) nextTask(resolve);
+						else c.waiters.push({
+							below,
+							resolve: () => nextTask(resolve)
+						});
+					})
 				});
-				open.delete(id);
-				self.markClosed();
+			}
+			const record = {
+				deliver: self.deliver,
+				markClosed,
+				isClosed,
+				hasListeners,
+				close: (reason) => {
+					if (isClosed()) return;
+					release(reason);
+					markClosed(reason);
+				}
+			};
+			leaks?.register(self.port, {
+				id,
+				record,
+				release
+			}, record);
+			const now = Date.now();
+			open.set(id, {
+				id,
+				meta,
+				openedAt: now,
+				lastActivity: now,
+				handle: record,
+				credit: c
 			});
-			open.set(id, self);
 			return self;
 		};
-		const handleEnvelope = (envelope) => {
+		const handleEnvelope = (envelope, event) => {
 			if (muxClosed) return;
+			heardSincePing = true;
+			if (envelope.type === "ping" || envelope.type === "pong") {
+				peerKeepsAlive = true;
+				if (envelope.type === "ping") post({
+					type: "pong",
+					id: KEEPALIVE_ID
+				});
+				return;
+			}
 			if (envelope.type === "open") {
 				if (open.has(envelope.id)) return;
 				if (open.size >= maxPorts) {
@@ -2634,7 +3044,18 @@
 					});
 					return;
 				}
-				const handle = attach(envelope.id);
+				const handle = attach(envelope.id, envelope.meta, envelope.window, false, envelope.exact === true && exactCodec);
+				const credit = open.get(envelope.id)?.credit;
+				if (credit) post(credit.exact ? {
+					type: "credit",
+					id: envelope.id,
+					bytes: 0,
+					exact: true
+				} : {
+					type: "credit",
+					id: envelope.id,
+					bytes: 0
+				});
 				let accepted = false;
 				if (onPort) try {
 					accepted = onPort(handle.port, envelope.meta) !== false;
@@ -2649,57 +3070,215 @@
 						id: envelope.id,
 						reason: "rejected"
 					});
+					return;
 				}
 				return;
 			}
-			const handle = open.get(envelope.id);
+			const entry = open.get(envelope.id);
+			if (envelope.type === "credit") {
+				const c = entry?.credit;
+				if (!c || !(envelope.bytes >= 0)) return;
+				if (!c.enforced && c.opener) {
+					if (c.exact && envelope.exact !== true) {
+						c.exact = false;
+						c.outstanding = 0;
+					}
+					post({
+						type: "credit",
+						id: envelope.id,
+						bytes: 0
+					});
+				}
+				c.enforced = true;
+				c.outstanding = Math.max(0, c.outstanding - envelope.bytes);
+				flush(c);
+				return;
+			}
 			if (envelope.type === "message") {
-				if (!handle) return;
-				handle.deliver(envelope.payload);
+				const sizeOf = (c) => (c.exact ? byteLengthOf(event.data) : void 0) ?? estimateMessageSize(envelope.payload);
+				if (!entry) return;
+				touch(envelope.id);
+				entry.handle.deliver(envelope.payload, entry.credit ? sizeOf(entry.credit) : void 0);
 				return;
 			}
-			if (!handle) return;
+			if (envelope.type === "frame") {
+				if (!entry?.credit?.exact || !codec.decode || !(envelope.data instanceof Uint8Array)) return;
+				touch(envelope.id);
+				const c = entry.credit;
+				const owed = c.unconsumed + c.toGrant;
+				const partial = entry.partial ?? {
+					chunks: [],
+					bytes: 0,
+					owed,
+					charged: 0,
+					...owed > 0 ? { room: c.window - owed } : {}
+				};
+				entry.partial = partial;
+				const size = envelope.data.byteLength;
+				const charged = partial.room == null ? Math.max(0, partial.bytes + size - c.window) : 0;
+				const overrun = partial.room != null && partial.bytes + size > partial.room ? `what the window left (${partial.room} of ${c.window} bytes, ${partial.owed} still owed)` : reassembling - partial.charged + charged > maxReassembledBytes ? `maxReassembledBytes (${maxReassembledBytes} bytes past the window, across all ports)` : void 0;
+				if (overrun) {
+					freePartial(entry);
+					dropOutgoing(envelope.id);
+					open.delete(envelope.id);
+					releaseWaiters(c);
+					entry.handle.markClosed(/* @__PURE__ */ new RangeError(`webrun-rpc: a framed message passed ${overrun}`));
+					post({
+						type: "close",
+						id: envelope.id,
+						reason: "max-reassembled-bytes"
+					});
+					return;
+				}
+				partial.bytes += size;
+				reassembling += charged - partial.charged;
+				partial.charged = charged;
+				partial.chunks.push(envelope.data);
+				if (!envelope.last) return;
+				freePartial(entry);
+				const whole = new Uint8Array(partial.bytes);
+				let at = 0;
+				for (const chunk of partial.chunks) {
+					whole.set(chunk, at);
+					at += chunk.byteLength;
+				}
+				const inner = codec.decode(whole);
+				if (inner?.type !== "message" || inner.id !== envelope.id) return;
+				entry.handle.deliver(inner.payload, whole.byteLength);
+				return;
+			}
+			dropOutgoing(envelope.id);
+			if (!entry) return;
+			freePartial(entry);
 			open.delete(envelope.id);
-			handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the peer closed the port"));
+			releaseWaiters(entry.credit);
+			entry.handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the peer closed the port"));
 		};
 		const listener = (event) => {
 			const envelope = codec.read(event);
-			if (envelope) handleEnvelope(envelope);
+			if (envelope) handleEnvelope(envelope, event);
+		};
+		let peerKeepsAlive = false;
+		let heardSincePing = true;
+		let unanswered = 0;
+		let pinger;
+		const tick = () => {
+			if (!keepalive) return;
+			const backlogged = (port.bufferedAmount ?? 0) > 0;
+			if (heardSincePing) unanswered = 0;
+			else if (peerKeepsAlive && !backlogged) unanswered++;
+			if (unanswered >= misses) {
+				close(/* @__PURE__ */ new Error(`webrun-rpc: the peer did not answer ${misses} keepalive pings, ${keepalive.intervalMs} ms apart`)).catch(() => {});
+				return;
+			}
+			heardSincePing = false;
+			post({
+				type: "ping",
+				id: KEEPALIVE_ID
+			});
+		};
+		const close = async (reason) => {
+			if (muxClosed) return;
+			clearInterval(pinger);
+			muxClosed = true;
+			signal?.removeEventListener("abort", onTransportAbort);
+			port.removeEventListener("message", listener);
+			const closedNow = /* @__PURE__ */ new Set();
+			for (const [id, { handle, credit }] of [...open]) {
+				closedNow.add(id);
+				codecPost({
+					type: "close",
+					id
+				});
+				open.delete(id);
+				releaseWaiters(credit);
+				handle.markClosed(reason ?? /* @__PURE__ */ new Error("webrun-rpc: the multiplexer was closed"));
+			}
+			for (const id of outgoing.keys()) if (!closedNow.has(id)) codecPost({
+				type: "close",
+				id
+			});
+			outgoing.clear();
+			ring.length = 0;
+			await port.close?.();
+		};
+		const onTransportAbort = () => {
+			close(signal?.reason).catch(() => {});
 		};
 		port.addEventListener("message", listener);
 		port.start?.();
+		if (keepalive) {
+			pinger = setInterval(tick, keepalive.intervalMs);
+			pinger.unref?.();
+		}
+		if (signal?.aborted) close(signal.reason).catch(() => {});
+		else signal?.addEventListener("abort", onTransportAbort, { once: true });
 		return {
 			maxMessageSize,
-			async openPort(meta) {
+			async openPort(meta, { signal: portSignal } = {}) {
 				if (muxClosed) throw new Error("webrun-rpc: the multiplexer is closed");
-				if (open.size >= maxPorts) throw new RangeError(`webrun-rpc: maxPorts (${maxPorts}) reached`);
+				if (portSignal?.aborted) throw portSignal.reason;
+				if (open.size >= maxPorts) throw new RangeError(`webrun-rpc: maxPorts (${maxPorts}) reached; open ports by kind: ${describeKinds(open.values())}`);
 				while (open.has(nextId)) nextId += 2;
 				const id = nextId;
 				nextId += 2;
-				const handle = attach(id);
-				post({
+				const handle = attach(id, meta, window, true, exactCodec);
+				post(window ? exactCodec ? {
+					type: "open",
+					id,
+					meta,
+					window,
+					exact: true
+				} : {
+					type: "open",
+					id,
+					meta,
+					window
+				} : {
 					type: "open",
 					id,
 					meta
 				});
+				if (portSignal) {
+					const record = open.get(id)?.handle;
+					const onAbort = () => {
+						if (record && open.get(id)?.handle === record) record.close(portSignal.reason);
+					};
+					portSignal.addEventListener("abort", onAbort, { once: true });
+					getPortCloseSignal(handle.port)?.addEventListener("abort", () => portSignal.removeEventListener("abort", onAbort), { once: true });
+				}
 				return handle.port;
 			},
-			async close() {
-				if (muxClosed) return;
-				for (const [id, handle] of [...open]) {
-					post({
-						type: "close",
-						id
-					});
-					open.delete(id);
-					handle.markClosed(/* @__PURE__ */ new Error(MUX_CLOSED_MESSAGE));
-				}
-				muxClosed = true;
-				port.removeEventListener("message", listener);
-				await port.close?.();
+			close,
+			ports() {
+				return [...open.values()].map(({ handle: _, credit, ...info }) => credit ? {
+					...info,
+					...credit.enforced ? { window: credit.window } : {},
+					queued: credit.queued,
+					outstanding: credit.outstanding,
+					unconsumed: credit.unconsumed
+				} : info);
 			}
 		};
 	}
+	/** The byte length of a received message's data, or `undefined` if it is not bytes. */
+	function byteLengthOf(data) {
+		if (data instanceof ArrayBuffer || ArrayBuffer.isView(data)) return data.byteLength;
+	}
+	/**
+	* `"http: 1000, ws: 24"`: the three commonest `meta.kind`s among `entries`, so
+	* a full table names who filled it. A port without a kind counts as `"?"`.
+	*/
+	function describeKinds(entries) {
+		const counts = /* @__PURE__ */ new Map();
+		for (const { meta } of entries) {
+			const kind = meta?.kind;
+			const name = typeof kind === "string" ? kind : "?";
+			counts.set(name, (counts.get(name) ?? 0) + 1);
+		}
+		if (!counts.size) return "none";
+		return [...counts].sort((x, y) => y[1] - x[1]).slice(0, 3).map(([name, n]) => `${name}: ${n}`).join(", ");
+	}
 	/**
 	* Announced with every port this pair opens. Layer 1 never reads `meta` — it is
 	* here so a peer running something else over the same multiplexer can tell a
@@ -2761,14 +3340,17 @@
 		const mux = await factory((port) => {
 			let off;
 			let finished = false;
-			const tracked = (input) => (async function* () {
-				try {
-					yield* handler(input);
-				} finally {
-					finished = true;
-					if (off) live.delete(off);
-				}
-			})();
+			const tracked = (input) => {
+				const output = handler(input);
+				return returningAtOnce((async function* () {
+					try {
+						yield* output;
+					} finally {
+						finished = true;
+						if (off) live.delete(off);
+					}
+				})(), () => void output.return(void 0).catch(() => {}));
+			};
 			off = serveDuplexOverPort(port, tracked, streamOptions);
 			if (!finished) live.add(off);
 		});
@@ -2806,7 +3388,7 @@
 		const candidate = value;
 		if (typeof candidate.id !== "number") return false;
 		if (!Number.isInteger(candidate.id) || candidate.id < 0) return false;
-		return candidate.type === "open" || candidate.type === "message" || candidate.type === "close";
+		return candidate.type === "open" || candidate.type === "message" || candidate.type === "close" || candidate.type === "credit" || candidate.type === "frame" || candidate.type === "ping" || candidate.type === "pong";
 	}
 	/**
 	* For ports whose messages are structured values — a real `MessagePort`, a
@@ -2968,7 +3550,7 @@
 					finish();
 					return response;
 				}
-				return new Response(guardBody(response.body, lost, () => lostReason, finish), {
+				return new Response(guardBody(response.body, lost, () => lostReason, finish, request.signal), {
 					status: response.status,
 					statusText: response.statusText,
 					headers: response.headers
@@ -2987,33 +3569,65 @@
 		return asyncDisposable(link, () => link.close());
 	}
 	/**
-	* A response body that reports its end (done, cancelled or failed) and fails
-	* with the link's reason when the link is lost mid-stream.
+	* A response body that reports its end (done, cancelled, failed or aborted) and
+	* fails with the link's reason when the link is lost mid-stream. An abort of the
+	* request's signal ends it at once, read or not: the exchange is over (the layer
+	* below has given its port back), so the request leaves `inflight` then.
 	*/
-	function guardBody(body, lost, reason, finish) {
+	function guardBody(body, lost, reason, finish, signal) {
 		const reader = body.getReader();
+		let controller;
+		let ended = false;
+		const end = () => {
+			ended = true;
+			signal?.removeEventListener("abort", onAbort);
+			finish();
+		};
+		const onAbort = () => {
+			if (ended) return;
+			end();
+			reader.cancel().catch(() => {});
+			try {
+				controller.error(abortError(signal));
+			} catch {}
+		};
 		return new ReadableStream({
+			start(c) {
+				controller = c;
+				if (signal?.aborted) onAbort();
+				else signal?.addEventListener("abort", onAbort, { once: true });
+			},
 			async pull(controller) {
 				try {
 					const { done, value } = await Promise.race([reader.read(), lost]);
+					if (ended) return;
 					if (done) {
-						finish();
+						end();
 						controller.close();
 						return;
 					}
 					controller.enqueue(value);
 				} catch (error) {
-					finish();
+					if (ended) return;
+					end();
 					reader.cancel().catch(() => {});
 					controller.error(reason() ?? error);
 				}
 			},
 			async cancel(why) {
-				finish();
+				end();
 				await reader.cancel(why).catch(() => {});
 			}
 		});
 	}
+	/** The signal's reason as an `Error` (`AbortError` when it gave none). */
+	function abortError(signal) {
+		const why = signal.reason;
+		if (why instanceof Error) return why;
+		const err = new Error(why === void 0 ? "Aborted" : String(why));
+		err.name = "AbortError";
+		return err;
+	}
 	//#endregion
 	//#region src/link/locks.ts
 	function lockManager() {