@statewalker/webrun-http-browser 0.7.1 → 0.10.0

package/dist/sw.js

@@ -1266,7 +1266,11 @@ async function drain(output) {
 */
 function httpServe(handler, options = {}) {
 	const codec = options.codec ?? defaultCodec;
-	return async function* httpHandlerDuplex(input) {
+	return (input) => {
+		const abandoned = new AbortController();
+		return abortingOnReturn(exchange(input, { signal: abandoned.signal }), (reason) => abandoned.abort(reason ?? /* @__PURE__ */ new Error("webrun-http-streams: the exchange was abandoned before it was over")));
+	};
+	async function* exchange(input, context) {
 		let decoded;
 		try {
 			decoded = await codec.decodeRequest(input);
@@ -1278,7 +1282,7 @@ function httpServe(handler, options = {}) {
 		const replyCodec = decoded.codec ?? codec;
 		let result;
 		try {
-			result = await handler(decoded.envelope, decoded.body);
+			result = await handler(decoded.envelope, decoded.body, context);
 		} catch (error) {
 			yield* encodeErrorResponse(replyCodec, error, decoded.envelope.method);
 			return;
@@ -1293,7 +1297,36 @@ function httpServe(handler, options = {}) {
 				await result.release?.();
 			} catch {}
 		}
+	}
+}
+/**
+* `gen`, except that `return()` and `throw()` from its consumer call `abandon`
+* at once — before they are queued behind a `next()` still parked inside the
+* generator (the handler's `await`) — unless the generator already finished.
+*/
+function abortingOnReturn(gen, abandon) {
+	let finished = false;
+	const settle = (r) => {
+		if (r.done) finished = true;
+		return r;
+	};
+	const wrapped = {
+		next: (...args) => gen.next(...args).then(settle),
+		return(value) {
+			if (!finished) abandon();
+			finished = true;
+			return gen.return(value);
+		},
+		throw(error) {
+			if (!finished) abandon(error);
+			finished = true;
+			return gen.throw(error);
+		},
+		[Symbol.asyncIterator]() {
+			return wrapped;
+		}
 	};
+	return asyncDisposable$2(wrapped, () => wrapped.return(void 0));
 }
 /**
 * The one place that knows a runtime may not implement request body streams,
@@ -1525,17 +1558,18 @@ async function fetchOverDuplex(call, request, options = {}) {
 		else await release?.();
 		return new Response(null, responseInit);
 	}
-	return new Response(asyncIterableToReadable(withAbort(respBody, request.signal)), responseInit);
+	return new Response(responseBody(respBody, request.signal, release), responseInit);
 }
 /**
 * Wrap a `(Request) => Promise<Response>` handler as a `Duplex` so it can be
 * registered with any `webrun-streams-*` adapter's `serve`.
 */
 function serveFetchOverDuplex(handler, options = {}) {
-	return httpServe(async (env, body) => {
+	return httpServe(async (env, body, exchange) => {
 		const reqInit = {
 			method: env.method,
-			headers: forwardableHeaders(env.headers)
+			headers: forwardableHeaders(env.headers),
+			signal: exchange?.signal
 		};
 		let upload;
 		if (env.method !== "GET" && env.method !== "HEAD") {
@@ -1656,15 +1690,78 @@ function trackingEnd(source) {
 		settle
 	};
 }
-async function* withAbort(iter, signal) {
-	if (!signal) {
-		yield* iter;
-		return;
-	}
-	for await (const chunk of iter) {
-		if (signal.aborted) throw abortReason$1(signal);
-		yield chunk;
-	}
+/**
+* How long a cancelled body waits for the read in flight before it abandons the call anyway.
+* The read's answer tells a body that has ended (the call is finished: an upload the handler
+* reads after answering goes on) from one that has not; a peer that sends nothing more never
+* answers it. A body whose end comes later than this after the cancel is abandoned too, so a
+* handler still streaming its response and still reading the upload then loses the upload.
+*/
+const CANCEL_GRACE_MS = 1e3;
+/**
+* The response body as a stream that the request's signal can end at any time.
+*
+* An abort errors the stream with the abort's reason at once — a read waiting
+* for a peer that sends nothing more rejects then, not when a next chunk
+* arrives, which may be never — and abandons the call (`release`), so on a
+* multiplexed transport its port is given back whether or not anyone still
+* reads the body. The listener is removed once the body ends, however it ends:
+* read to its end, cancelled, failed or aborted. A body nobody reads or cancels
+* keeps it until the signal aborts (and keeps the call open until then anyway).
+* A cancel abandons the call too — unless the read in flight comes back with the
+* body's end, which finishes it instead (see `cancel`).
+*/
+function responseBody(body, signal, release) {
+	const it = body[Symbol.asyncIterator]();
+	let controller;
+	let ended = false;
+	let reading = false;
+	const end = () => {
+		ended = true;
+		signal?.removeEventListener("abort", onAbort);
+	};
+	const onAbort = () => {
+		if (ended) return;
+		end();
+		try {
+			controller.error(abortReason$1(signal));
+		} catch {}
+		release?.();
+	};
+	return new ReadableStream({
+		start(c) {
+			controller = c;
+			if (signal?.aborted) onAbort();
+			else signal?.addEventListener("abort", onAbort, { once: true });
+		},
+		async pull(c) {
+			try {
+				reading = true;
+				const { done, value } = await it.next().finally(() => {
+					reading = false;
+				});
+				if (ended) return;
+				if (done) {
+					end();
+					c.close();
+					return;
+				}
+				c.enqueue(value);
+			} catch (err) {
+				if (ended) return;
+				end();
+				c.error(err);
+			}
+		},
+		cancel() {
+			end();
+			const returned = Promise.resolve(it.return?.()).catch(() => {});
+			if (!reading) return;
+			const grace = setTimeout(() => void release?.(), CANCEL_GRACE_MS);
+			grace.unref?.();
+			returned.finally(() => clearTimeout(grace));
+		}
+	});
 }
 //#endregion
 //#region ../webrun-rpc/dist/index.js
@@ -1789,8 +1886,11 @@ function listenPort(port, handler, { channelName = "", log = () => {} } = {}) {
 			error
 		});
 	};
-	port.addEventListener("message", onMessage);
-	return () => port.removeEventListener("message", onMessage);
+	const listener = (event) => {
+		onMessage(event);
+	};
+	port.addEventListener("message", listener);
+	return () => port.removeEventListener("message", listener);
 }
 /**
 * Wraps an async iterable so that an `AbortSignal` firing causes the wrapper
@@ -2168,7 +2268,11 @@ function receiveChunks(port, channelName, controller, touch) {
 * outstanding at a time (spec D11/D12), with no per-chunk deadline (spec D8).
 */
 async function sendChunks(port, channelName, output, { maxMessageSize, log }, signal, touch) {
-	const stream = throughAbort(maxMessageSize ? toChunks(maxMessageSize)(output) : output, signal);
+	const framed = maxMessageSize ? toChunks(maxMessageSize)(output) : output;
+	const stream = throughAbort(framed, signal);
+	const producer = output;
+	const returnProducer = () => void Promise.resolve(producer.return?.()).catch(() => {});
+	if (framed !== output) signal.addEventListener("abort", returnProducer, { once: true });
 	try {
 		await sendIterator(async ({ done, value, error }) => {
 			if (signal.aborted) return;
@@ -2192,9 +2296,38 @@ async function sendChunks(port, channelName, output, { maxMessageSize, log }, si
 	} catch (err) {
 		if (signal.aborted) return;
 		throw err;
+	} finally {
+		signal.removeEventListener("abort", returnProducer);
 	}
 }
 /**
+* Runs `fn` on a later task, never a microtask: a producer looping on
+* `whenPortReady` must let the transport's own events run. `setImmediate`
+* where it exists; elsewhere a `MessageChannel`, because nested `setTimeout`s
+* are clamped to 4 ms in browsers.
+*/
+const setImmediateFn = globalThis.setImmediate;
+/** @internal */
+const nextTask = setImmediateFn ? (fn) => {
+	setImmediateFn(fn);
+} : (() => {
+	let channel;
+	const queue = [];
+	return (fn) => {
+		if (!channel) {
+			channel = new MessageChannel();
+			channel.port1.onmessage = () => queue.shift()?.();
+		}
+		queue.push(fn);
+		channel.port2.postMessage(0);
+	};
+})();
+const states = /* @__PURE__ */ new WeakMap();
+/** @internal Registered by the multiplexer for each port with a window. */
+function setPortSendState(port, state) {
+	states.set(port, state);
+}
+/**
 * One virtual port.
 *
 * `deliver` and `markClosed` are deliberately not on `port`: the consumer holds
@@ -2209,6 +2342,14 @@ function newVirtualPort(send, requestClose) {
 		if (closing.signal.aborted) return;
 		closing.abort(reason ?? /* @__PURE__ */ new Error("webrun-rpc: the port was closed"));
 	};
+	const close = (reason) => {
+		if (closed) return;
+		closed = true;
+		const notify = requestClose;
+		listeners.clear();
+		notify(reason);
+		abort(reason);
+	};
 	const port = {
 		addEventListener(_type, listener) {
 			listeners.add(listener);
@@ -2220,24 +2361,28 @@ function newVirtualPort(send, requestClose) {
 			if (closed) return;
 			send(message, transfer);
 		},
-		close() {
-			if (closed) return;
-			closed = true;
-			const notify = requestClose;
-			listeners.clear();
-			notify();
-			abort();
-		}
+		close
 	};
 	setPortCloseSignal(port, closing.signal);
+	const dispose = Symbol.dispose;
+	if (dispose) Object.defineProperty(port, dispose, {
+		value: () => close(),
+		configurable: true
+	});
 	return {
 		port,
 		deliver(payload) {
 			if (closed) return;
 			const event = new MessageEvent("message", { data: payload });
+			let pending;
 			for (const listener of [...listeners]) try {
-				listener(event);
+				const result = listener(event);
+				if (result && typeof result.then === "function") {
+					pending ??= [];
+					pending.push(result);
+				}
 			} catch {}
+			return pending ? Promise.allSettled(pending) : void 0;
 		},
 		markClosed(reason) {
 			closed = true;
@@ -2246,53 +2391,318 @@ function newVirtualPort(send, requestClose) {
 		},
 		isClosed() {
 			return closed;
+		},
+		hasListeners() {
+			return listeners.size > 0;
 		}
 	};
 }
 /**
-* The message of the error that fails the calls still in flight on a
-* multiplexer when it is closed (`PortMux.close()`).
+* The id of keepalive's `ping` / `pong`: one no port ever takes. An older mux
+* whose codec passes unknown envelopes through reads them as a close of that
+* id, which must therefore not be a real port (0 is the initiator's first).
 */
-const MUX_CLOSED_MESSAGE = "webrun-rpc: the multiplexer was closed";
+const KEEPALIVE_ID = Number.MAX_SAFE_INTEGER;
+/** The longest delay a timer holds; past it `setInterval` fires at once. */
+const MAX_TIMER_MS = 2 ** 31 - 1;
 /** Ceiling on concurrently open virtual ports. Bounds the id table only. */
 const DEFAULT_MAX_PORTS = 1024;
 /**
+* What a message costs a port's window when the codec cannot say
+* (`PortCodec.encode`): its bytes and string lengths, found in its values up
+* to 4 levels deep (at most 256 values), and at least 64. Both ends compute it
+* from the same structured value, so they agree.
+*/
+function estimateMessageSize(payload) {
+	let budget = 256;
+	const walk = (v, depth) => {
+		if (budget-- <= 0) return 0;
+		if (typeof v === "string") return v.length;
+		if (v instanceof ArrayBuffer) return v.byteLength;
+		if (ArrayBuffer.isView(v)) return v.byteLength;
+		if (v === null || typeof v !== "object" || depth >= 4) return 8;
+		let n = 16;
+		if (Array.isArray(v)) for (const x of v) n += walk(x, depth + 1);
+		else for (const k in v) n += k.length + walk(v[k], depth + 1);
+		return n;
+	};
+	return Math.max(64, walk(payload, 0));
+}
+/**
 * The default `PortMux`: emulates multiplexing over a single port.
 *
 * A transport that already multiplexes natively supplies its own `PortMux`
 * instead — this implementation is for transports that offer one pipe.
 */
 function multiplexPort(port, options) {
-	const { codec, onPort, side = "initiator", maxPorts = DEFAULT_MAX_PORTS, maxMessageSize } = options;
+	const { codec, onPort, side = "initiator", maxPorts = DEFAULT_MAX_PORTS, maxMessageSize, signal, window, frameSize, keepalive, onLeak } = options;
+	const maxReassembledBytes = options.maxReassembledBytes ?? 67108864;
+	const misses = keepalive?.misses ?? 3;
+	if (keepalive && !(Number.isFinite(keepalive.intervalMs) && keepalive.intervalMs > 0 && keepalive.intervalMs <= MAX_TIMER_MS && Number.isSafeInteger(misses) && misses > 0)) throw new RangeError(`webrun-rpc: keepalive needs an intervalMs in (0, ${MAX_TIMER_MS}] and a positive integer misses`);
+	if (frameSize != null && !(Number.isSafeInteger(frameSize) && frameSize > 0)) throw new RangeError(`webrun-rpc: frameSize must be a positive integer, got ${frameSize}`);
+	if (!(Number.isSafeInteger(maxReassembledBytes) && maxReassembledBytes > 0)) throw new RangeError(`webrun-rpc: maxReassembledBytes must be a positive integer, got ${maxReassembledBytes}`);
 	const open = /* @__PURE__ */ new Map();
+	let reassembling = 0;
+	const freePartial = (entry) => {
+		if (!entry?.partial) return;
+		reassembling -= entry.partial.charged;
+		entry.partial = void 0;
+	};
+	const leaks = onLeak ? new FinalizationRegistry(({ id, record, release }) => {
+		const entry = open.get(id);
+		if (entry?.handle !== record) return;
+		const { handle: _, credit: __, partial: ___, ...info } = entry;
+		if (!record.hasListeners()) {
+			release("leaked");
+			record.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the port was dropped without close()"));
+		}
+		try {
+			onLeak?.(info);
+		} catch {}
+	}) : void 0;
+	const touch = (id) => {
+		const entry = open.get(id);
+		if (entry) entry.lastActivity = Date.now();
+	};
 	let nextId = side === "initiator" ? 0 : 1;
 	let muxClosed = false;
+	/** This end counts encoded bytes and reassembles frames. */
+	const exactCodec = codec.encode != null && codec.decode != null;
 	const post = (envelope, transfer) => {
 		if (muxClosed) return;
+		codecPost(envelope, transfer);
+	};
+	/** Like `post`, also while closing: the mux's own close notices. */
+	const codecPost = (envelope, transfer) => {
 		try {
 			codec.post(port, envelope, transfer);
 		} catch {}
 	};
-	const attach = (id) => {
-		let self;
-		self = newVirtualPort((payload, transfer) => post({
-			type: "message",
-			id,
-			payload
-		}, transfer), (reason) => {
+	const outgoing = /* @__PURE__ */ new Map();
+	const ring = [];
+	let pumping = false;
+	const pump = async () => {
+		pumping = true;
+		try {
+			while (ring.length && !muxClosed) {
+				if (port.whenDrained) await port.whenDrained();
+				if (muxClosed) break;
+				const id = ring.shift();
+				const queue = outgoing.get(id);
+				const item = queue?.shift();
+				if (queue?.length) ring.push(id);
+				else outgoing.delete(id);
+				item?.();
+			}
+		} catch (err) {
+			close(err).catch(() => {});
+		} finally {
+			pumping = false;
+		}
+	};
+	const sendOnPort = (id, item) => {
+		if (frameSize == null) {
+			item();
+			return;
+		}
+		let queue = outgoing.get(id);
+		if (!queue) {
+			queue = [];
+			outgoing.set(id, queue);
+			ring.push(id);
+		}
+		queue.push(item);
+		if (!pumping) pump();
+	};
+	const dropOutgoing = (id) => {
+		if (!outgoing.delete(id)) return;
+		const at = ring.indexOf(id);
+		if (at >= 0) ring.splice(at, 1);
+	};
+	const postBytes = (bytes) => {
+		if (muxClosed) return;
+		try {
+			port.postMessage(bytes);
+		} catch {}
+	};
+	const releaseWaiters = (c) => {
+		for (const w of c?.waiters.splice(0) ?? []) w.resolve();
+	};
+	const flush = (c) => {
+		while (c.queue.length) {
+			const next = c.queue[0];
+			if (c.enforced && c.outstanding > 0 && c.outstanding + next.size > c.window) break;
+			c.queue.shift();
+			c.queued -= next.size;
+			c.outstanding += next.size;
+			next.send();
+		}
+		for (const w of [...c.waiters]) if (c.queued <= w.below) {
+			c.waiters.splice(c.waiters.indexOf(w), 1);
+			w.resolve();
+		}
+	};
+	const grant = (id, c, bytes) => {
+		c.unconsumed -= bytes;
+		c.toGrant += bytes;
+		const send = () => {
+			c.grantScheduled = false;
+			if (!c.toGrant || !open.has(id)) return;
 			post({
+				type: "credit",
+				id,
+				bytes: c.toGrant
+			});
+			c.toGrant = 0;
+		};
+		if (c.toGrant >= c.window / 4) {
+			send();
+			return;
+		}
+		if (c.grantScheduled) return;
+		c.grantScheduled = true;
+		setTimeout(send, 0);
+	};
+	const attach = (id, meta, portWindow, opener, exact) => {
+		const c = typeof portWindow === "number" && Number.isSafeInteger(portWindow) && portWindow > 0 ? {
+			window: portWindow,
+			enforced: false,
+			opener,
+			exact,
+			outstanding: 0,
+			queue: [],
+			queued: 0,
+			unconsumed: 0,
+			waiters: [],
+			toGrant: 0,
+			grantScheduled: false
+		} : void 0;
+		const self = newVirtualPort((payload, transfer) => {
+			touch(id);
+			const envelope = {
+				type: "message",
+				id,
+				payload
+			};
+			if (!c) {
+				post(envelope, transfer);
+				return;
+			}
+			const bytes = c.exact ? codec.encode?.(envelope) : void 0;
+			const size = bytes?.byteLength ?? estimateMessageSize(payload);
+			const waits = frameSize != null || c.queue.length > 0 || c.enforced && c.outstanding > 0 && c.outstanding + size > c.window;
+			const held = !bytes && waits ? {
+				...envelope,
+				payload: structuredClone(payload, { transfer })
+			} : void 0;
+			const send = (whole = false) => {
+				if (!bytes) {
+					sendOnPort(id, held ? () => post(held) : () => post(envelope, transfer));
+					return;
+				}
+				if (!whole && frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
+					for (let at = 0; at < bytes.byteLength; at += frameSize) {
+						const data = bytes.subarray(at, at + frameSize);
+						const frame = at + frameSize >= bytes.byteLength ? {
+							type: "frame",
+							id,
+							data,
+							last: true
+						} : {
+							type: "frame",
+							id,
+							data
+						};
+						sendOnPort(id, () => post(frame));
+					}
+					return;
+				}
+				sendOnPort(id, () => postBytes(bytes));
+			};
+			c.queue.push({
+				send,
+				size
+			});
+			c.queued += size;
+			flush(c);
+		}, (reason) => {
+			release(reason);
+			record.markClosed(reason);
+		});
+		function release(reason) {
+			freePartial(open.get(id));
+			open.delete(id);
+			leaks?.unregister(record);
+			if (c?.queue.length) {
+				for (const item of c.queue.splice(0)) item.send(true);
+				c.queued = 0;
+			}
+			sendOnPort(id, () => post({
 				type: "close",
 				id,
 				reason
+			}));
+			releaseWaiters(c);
+		}
+		const { markClosed, isClosed, hasListeners } = self;
+		if (c) {
+			const deliver = self.deliver;
+			self.deliver = (payload, size = estimateMessageSize(payload)) => {
+				c.unconsumed += size;
+				const done = deliver(payload);
+				if (done) done.then(() => grant(id, c, size));
+				else grant(id, c, size);
+				return done;
+			};
+			setPortSendState(self.port, {
+				bufferedAmount: () => c.queued,
+				ready: (below = 0) => new Promise((resolve) => {
+					if (c.queued <= below || isClosed()) nextTask(resolve);
+					else c.waiters.push({
+						below,
+						resolve: () => nextTask(resolve)
+					});
+				})
 			});
-			open.delete(id);
-			self.markClosed();
+		}
+		const record = {
+			deliver: self.deliver,
+			markClosed,
+			isClosed,
+			hasListeners,
+			close: (reason) => {
+				if (isClosed()) return;
+				release(reason);
+				markClosed(reason);
+			}
+		};
+		leaks?.register(self.port, {
+			id,
+			record,
+			release
+		}, record);
+		const now = Date.now();
+		open.set(id, {
+			id,
+			meta,
+			openedAt: now,
+			lastActivity: now,
+			handle: record,
+			credit: c
 		});
-		open.set(id, self);
 		return self;
 	};
-	const handleEnvelope = (envelope) => {
+	const handleEnvelope = (envelope, event) => {
 		if (muxClosed) return;
+		heardSincePing = true;
+		if (envelope.type === "ping" || envelope.type === "pong") {
+			peerKeepsAlive = true;
+			if (envelope.type === "ping") post({
+				type: "pong",
+				id: KEEPALIVE_ID
+			});
+			return;
+		}
 		if (envelope.type === "open") {
 			if (open.has(envelope.id)) return;
 			if (open.size >= maxPorts) {
@@ -2303,7 +2713,18 @@ function multiplexPort(port, options) {
 				});
 				return;
 			}
-			const handle = attach(envelope.id);
+			const handle = attach(envelope.id, envelope.meta, envelope.window, false, envelope.exact === true && exactCodec);
+			const credit = open.get(envelope.id)?.credit;
+			if (credit) post(credit.exact ? {
+				type: "credit",
+				id: envelope.id,
+				bytes: 0,
+				exact: true
+			} : {
+				type: "credit",
+				id: envelope.id,
+				bytes: 0
+			});
 			let accepted = false;
 			if (onPort) try {
 				accepted = onPort(handle.port, envelope.meta) !== false;
@@ -2318,57 +2739,215 @@ function multiplexPort(port, options) {
 					id: envelope.id,
 					reason: "rejected"
 				});
+				return;
 			}
 			return;
 		}
-		const handle = open.get(envelope.id);
+		const entry = open.get(envelope.id);
+		if (envelope.type === "credit") {
+			const c = entry?.credit;
+			if (!c || !(envelope.bytes >= 0)) return;
+			if (!c.enforced && c.opener) {
+				if (c.exact && envelope.exact !== true) {
+					c.exact = false;
+					c.outstanding = 0;
+				}
+				post({
+					type: "credit",
+					id: envelope.id,
+					bytes: 0
+				});
+			}
+			c.enforced = true;
+			c.outstanding = Math.max(0, c.outstanding - envelope.bytes);
+			flush(c);
+			return;
+		}
 		if (envelope.type === "message") {
-			if (!handle) return;
-			handle.deliver(envelope.payload);
+			const sizeOf = (c) => (c.exact ? byteLengthOf(event.data) : void 0) ?? estimateMessageSize(envelope.payload);
+			if (!entry) return;
+			touch(envelope.id);
+			entry.handle.deliver(envelope.payload, entry.credit ? sizeOf(entry.credit) : void 0);
+			return;
+		}
+		if (envelope.type === "frame") {
+			if (!entry?.credit?.exact || !codec.decode || !(envelope.data instanceof Uint8Array)) return;
+			touch(envelope.id);
+			const c = entry.credit;
+			const owed = c.unconsumed + c.toGrant;
+			const partial = entry.partial ?? {
+				chunks: [],
+				bytes: 0,
+				owed,
+				charged: 0,
+				...owed > 0 ? { room: c.window - owed } : {}
+			};
+			entry.partial = partial;
+			const size = envelope.data.byteLength;
+			const charged = partial.room == null ? Math.max(0, partial.bytes + size - c.window) : 0;
+			const overrun = partial.room != null && partial.bytes + size > partial.room ? `what the window left (${partial.room} of ${c.window} bytes, ${partial.owed} still owed)` : reassembling - partial.charged + charged > maxReassembledBytes ? `maxReassembledBytes (${maxReassembledBytes} bytes past the window, across all ports)` : void 0;
+			if (overrun) {
+				freePartial(entry);
+				dropOutgoing(envelope.id);
+				open.delete(envelope.id);
+				releaseWaiters(c);
+				entry.handle.markClosed(/* @__PURE__ */ new RangeError(`webrun-rpc: a framed message passed ${overrun}`));
+				post({
+					type: "close",
+					id: envelope.id,
+					reason: "max-reassembled-bytes"
+				});
+				return;
+			}
+			partial.bytes += size;
+			reassembling += charged - partial.charged;
+			partial.charged = charged;
+			partial.chunks.push(envelope.data);
+			if (!envelope.last) return;
+			freePartial(entry);
+			const whole = new Uint8Array(partial.bytes);
+			let at = 0;
+			for (const chunk of partial.chunks) {
+				whole.set(chunk, at);
+				at += chunk.byteLength;
+			}
+			const inner = codec.decode(whole);
+			if (inner?.type !== "message" || inner.id !== envelope.id) return;
+			entry.handle.deliver(inner.payload, whole.byteLength);
 			return;
 		}
-		if (!handle) return;
+		dropOutgoing(envelope.id);
+		if (!entry) return;
+		freePartial(entry);
 		open.delete(envelope.id);
-		handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the peer closed the port"));
+		releaseWaiters(entry.credit);
+		entry.handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the peer closed the port"));
 	};
 	const listener = (event) => {
 		const envelope = codec.read(event);
-		if (envelope) handleEnvelope(envelope);
+		if (envelope) handleEnvelope(envelope, event);
+	};
+	let peerKeepsAlive = false;
+	let heardSincePing = true;
+	let unanswered = 0;
+	let pinger;
+	const tick = () => {
+		if (!keepalive) return;
+		const backlogged = (port.bufferedAmount ?? 0) > 0;
+		if (heardSincePing) unanswered = 0;
+		else if (peerKeepsAlive && !backlogged) unanswered++;
+		if (unanswered >= misses) {
+			close(/* @__PURE__ */ new Error(`webrun-rpc: the peer did not answer ${misses} keepalive pings, ${keepalive.intervalMs} ms apart`)).catch(() => {});
+			return;
+		}
+		heardSincePing = false;
+		post({
+			type: "ping",
+			id: KEEPALIVE_ID
+		});
+	};
+	const close = async (reason) => {
+		if (muxClosed) return;
+		clearInterval(pinger);
+		muxClosed = true;
+		signal?.removeEventListener("abort", onTransportAbort);
+		port.removeEventListener("message", listener);
+		const closedNow = /* @__PURE__ */ new Set();
+		for (const [id, { handle, credit }] of [...open]) {
+			closedNow.add(id);
+			codecPost({
+				type: "close",
+				id
+			});
+			open.delete(id);
+			releaseWaiters(credit);
+			handle.markClosed(reason ?? /* @__PURE__ */ new Error("webrun-rpc: the multiplexer was closed"));
+		}
+		for (const id of outgoing.keys()) if (!closedNow.has(id)) codecPost({
+			type: "close",
+			id
+		});
+		outgoing.clear();
+		ring.length = 0;
+		await port.close?.();
+	};
+	const onTransportAbort = () => {
+		close(signal?.reason).catch(() => {});
 	};
 	port.addEventListener("message", listener);
 	port.start?.();
+	if (keepalive) {
+		pinger = setInterval(tick, keepalive.intervalMs);
+		pinger.unref?.();
+	}
+	if (signal?.aborted) close(signal.reason).catch(() => {});
+	else signal?.addEventListener("abort", onTransportAbort, { once: true });
 	return {
 		maxMessageSize,
-		async openPort(meta) {
+		async openPort(meta, { signal: portSignal } = {}) {
 			if (muxClosed) throw new Error("webrun-rpc: the multiplexer is closed");
-			if (open.size >= maxPorts) throw new RangeError(`webrun-rpc: maxPorts (${maxPorts}) reached`);
+			if (portSignal?.aborted) throw portSignal.reason;
+			if (open.size >= maxPorts) throw new RangeError(`webrun-rpc: maxPorts (${maxPorts}) reached; open ports by kind: ${describeKinds(open.values())}`);
 			while (open.has(nextId)) nextId += 2;
 			const id = nextId;
 			nextId += 2;
-			const handle = attach(id);
-			post({
+			const handle = attach(id, meta, window, true, exactCodec);
+			post(window ? exactCodec ? {
+				type: "open",
+				id,
+				meta,
+				window,
+				exact: true
+			} : {
+				type: "open",
+				id,
+				meta,
+				window
+			} : {
 				type: "open",
 				id,
 				meta
 			});
+			if (portSignal) {
+				const record = open.get(id)?.handle;
+				const onAbort = () => {
+					if (record && open.get(id)?.handle === record) record.close(portSignal.reason);
+				};
+				portSignal.addEventListener("abort", onAbort, { once: true });
+				getPortCloseSignal(handle.port)?.addEventListener("abort", () => portSignal.removeEventListener("abort", onAbort), { once: true });
+			}
 			return handle.port;
 		},
-		async close() {
-			if (muxClosed) return;
-			for (const [id, handle] of [...open]) {
-				post({
-					type: "close",
-					id
-				});
-				open.delete(id);
-				handle.markClosed(/* @__PURE__ */ new Error(MUX_CLOSED_MESSAGE));
-			}
-			muxClosed = true;
-			port.removeEventListener("message", listener);
-			await port.close?.();
+		close,
+		ports() {
+			return [...open.values()].map(({ handle: _, credit, ...info }) => credit ? {
+				...info,
+				...credit.enforced ? { window: credit.window } : {},
+				queued: credit.queued,
+				outstanding: credit.outstanding,
+				unconsumed: credit.unconsumed
+			} : info);
 		}
 	};
 }
+/** The byte length of a received message's data, or `undefined` if it is not bytes. */
+function byteLengthOf(data) {
+	if (data instanceof ArrayBuffer || ArrayBuffer.isView(data)) return data.byteLength;
+}
+/**
+* `"http: 1000, ws: 24"`: the three commonest `meta.kind`s among `entries`, so
+* a full table names who filled it. A port without a kind counts as `"?"`.
+*/
+function describeKinds(entries) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const { meta } of entries) {
+		const kind = meta?.kind;
+		const name = typeof kind === "string" ? kind : "?";
+		counts.set(name, (counts.get(name) ?? 0) + 1);
+	}
+	if (!counts.size) return "none";
+	return [...counts].sort((x, y) => y[1] - x[1]).slice(0, 3).map(([name, n]) => `${name}: ${n}`).join(", ");
+}
 /**
 * Announced with every port this pair opens. Layer 1 never reads `meta` — it is
 * here so a peer running something else over the same multiplexer can tell a
@@ -2430,14 +3009,17 @@ const serve = async ({ mux: factory, timeout }, handler) => {
 	const mux = await factory((port) => {
 		let off;
 		let finished = false;
-		const tracked = (input) => (async function* () {
-			try {
-				yield* handler(input);
-			} finally {
-				finished = true;
-				if (off) live.delete(off);
-			}
-		})();
+		const tracked = (input) => {
+			const output = handler(input);
+			return returningAtOnce((async function* () {
+				try {
+					yield* output;
+				} finally {
+					finished = true;
+					if (off) live.delete(off);
+				}
+			})(), () => void output.return(void 0).catch(() => {}));
+		};
 		off = serveDuplexOverPort(port, tracked, streamOptions);
 		if (!finished) live.add(off);
 	});
@@ -2475,7 +3057,7 @@ function isEnvelope(value) {
 	const candidate = value;
 	if (typeof candidate.id !== "number") return false;
 	if (!Number.isInteger(candidate.id) || candidate.id < 0) return false;
-	return candidate.type === "open" || candidate.type === "message" || candidate.type === "close";
+	return candidate.type === "open" || candidate.type === "message" || candidate.type === "close" || candidate.type === "credit" || candidate.type === "frame" || candidate.type === "ping" || candidate.type === "pong";
 }
 /**
 * For ports whose messages are structured values — a real `MessagePort`, a
@@ -2637,7 +3219,7 @@ function trackedLink(send, release) {
 				finish();
 				return response;
 			}
-			return new Response(guardBody(response.body, lost, () => lostReason, finish), {
+			return new Response(guardBody(response.body, lost, () => lostReason, finish, request.signal), {
 				status: response.status,
 				statusText: response.statusText,
 				headers: response.headers
@@ -2656,33 +3238,65 @@ function trackedLink(send, release) {
 	return asyncDisposable(link, () => link.close());
 }
 /**
-* A response body that reports its end (done, cancelled or failed) and fails
-* with the link's reason when the link is lost mid-stream.
+* A response body that reports its end (done, cancelled, failed or aborted) and
+* fails with the link's reason when the link is lost mid-stream. An abort of the
+* request's signal ends it at once, read or not: the exchange is over (the layer
+* below has given its port back), so the request leaves `inflight` then.
 */
-function guardBody(body, lost, reason, finish) {
+function guardBody(body, lost, reason, finish, signal) {
 	const reader = body.getReader();
+	let controller;
+	let ended = false;
+	const end = () => {
+		ended = true;
+		signal?.removeEventListener("abort", onAbort);
+		finish();
+	};
+	const onAbort = () => {
+		if (ended) return;
+		end();
+		reader.cancel().catch(() => {});
+		try {
+			controller.error(abortError(signal));
+		} catch {}
+	};
 	return new ReadableStream({
+		start(c) {
+			controller = c;
+			if (signal?.aborted) onAbort();
+			else signal?.addEventListener("abort", onAbort, { once: true });
+		},
 		async pull(controller) {
 			try {
 				const { done, value } = await Promise.race([reader.read(), lost]);
+				if (ended) return;
 				if (done) {
-					finish();
+					end();
 					controller.close();
 					return;
 				}
 				controller.enqueue(value);
 			} catch (error) {
-				finish();
+				if (ended) return;
+				end();
 				reader.cancel().catch(() => {});
 				controller.error(reason() ?? error);
 			}
 		},
 		async cancel(why) {
-			finish();
+			end();
 			await reader.cancel(why).catch(() => {});
 		}
 	});
 }
+/** The signal's reason as an `Error` (`AbortError` when it gave none). */
+function abortError(signal) {
+	const why = signal.reason;
+	if (why instanceof Error) return why;
+	const err = new Error(why === void 0 ? "Aborted" : String(why));
+	err.name = "AbortError";
+	return err;
+}
 //#endregion
 //#region src/link/locks.ts
 function lockManager() {
@@ -5498,6 +6112,8 @@ var WorkerLinkImpl = class {
 	_ownerLock;
 	_attaching;
 	_detached = false;
+	/** The `seq` of the last link sent to the worker. */
+	_sent = 0;
 	constructor(_adapter, _control, init) {
 		this._adapter = _adapter;
 		this._control = _control;
@@ -5509,6 +6125,7 @@ var WorkerLinkImpl = class {
 		_control.onmessage = (event) => {
 			const message = event.data;
 			if (message?.type === "relink") {
+				if (message.seen !== void 0 && message.seen < this._sent) return;
 				this._adapter._poke(WAKE_MESSAGE);
 				this.attach().catch(() => {});
 			} else if (message?.type === "keepalive") this._adapter._poke(KEEPALIVE_MESSAGE);
@@ -5555,7 +6172,8 @@ var WorkerLinkImpl = class {
 				this._control.postMessage({
 					type: "link",
 					key: this.key,
-					routerLock: reply.routerLock
+					routerLock: reply.routerLock,
+					seq: ++this._sent
 				}, [
 					down.port2,
 					ctl.port2,
@@ -5656,12 +6274,18 @@ function serveHttpInWorker(handler, options = {}) {
 	const ownerLock = newLockName("webrun-http-owner");
 	const held = holdLock(ownerLock);
 	const controls = /* @__PURE__ */ new Set();
+	const seen = /* @__PURE__ */ new Map();
 	const tellPages = (message) => {
 		for (const control of controls) control.postMessage(message);
 	};
 	const endpoint = new HandlerEndpoint(handler, {
 		...options,
-		requestRelink: () => tellPages({ type: "relink" }),
+		requestRelink: () => {
+			for (const control of controls) control.postMessage({
+				type: "relink",
+				seen: seen.get(control) ?? 0
+			});
+		},
 		keepAlive: () => tellPages({ type: "keepalive" })
 	});
 	const onMessage = (event) => {
@@ -5673,6 +6297,7 @@ function serveHttpInWorker(handler, options = {}) {
 		control.onmessage = (message) => {
 			const msg = message.data;
 			if (msg?.type === "link") {
+				if (msg.seq !== void 0) seen.set(control, msg.seq);
 				const [down, ctl, up] = message.ports;
 				if (down) endpoint.link(msg.key, {
 					down,
@@ -5713,6 +6338,7 @@ function serveHttpInWorker(handler, options = {}) {
 			await endpoint.close();
 			for (const control of controls) control.close();
 			controls.clear();
+			seen.clear();
 			(await held)();
 		}
 	};