@statewalker/webrun-http-browser 0.9.0 → 0.10.0

package/dist/index.js

@@ -2126,6 +2126,12 @@ function asyncDisposable$2(target, dispose) {
 }
 /** Carries the serialized JS error between two webrun peers. */
 const PEER_ERROR_HEADER = "x-webrun-error";
+/**
+* The reason of `HttpExchange.signal` when the exchange is abandoned with no
+* error of its own (`return()`); one abandoned by `throw(error)` aborts with
+* that error.
+*/
+const EXCHANGE_ABANDONED_MESSAGE = "webrun-http-streams: the exchange was abandoned before it was over";
 /** Hard cap on the peer-error header (M3): see `encodeErrorResponse`. */
 const MAX_DETAIL_CHARS = 4096;
 /**
@@ -2306,7 +2312,11 @@ async function drain(output) {
 */
 function httpServe(handler, options = {}) {
 	const codec = options.codec ?? defaultCodec;
-	return async function* httpHandlerDuplex(input) {
+	return (input) => {
+		const abandoned = new AbortController();
+		return abortingOnReturn(exchange(input, { signal: abandoned.signal }), (reason) => abandoned.abort(reason ?? /* @__PURE__ */ new Error("webrun-http-streams: the exchange was abandoned before it was over")));
+	};
+	async function* exchange(input, context) {
 		let decoded;
 		try {
 			decoded = await codec.decodeRequest(input);
@@ -2318,7 +2328,7 @@ function httpServe(handler, options = {}) {
 		const replyCodec = decoded.codec ?? codec;
 		let result;
 		try {
-			result = await handler(decoded.envelope, decoded.body);
+			result = await handler(decoded.envelope, decoded.body, context);
 		} catch (error) {
 			yield* encodeErrorResponse(replyCodec, error, decoded.envelope.method);
 			return;
@@ -2333,7 +2343,36 @@ function httpServe(handler, options = {}) {
 				await result.release?.();
 			} catch {}
 		}
+	}
+}
+/**
+* `gen`, except that `return()` and `throw()` from its consumer call `abandon`
+* at once — before they are queued behind a `next()` still parked inside the
+* generator (the handler's `await`) — unless the generator already finished.
+*/
+function abortingOnReturn(gen, abandon) {
+	let finished = false;
+	const settle = (r) => {
+		if (r.done) finished = true;
+		return r;
+	};
+	const wrapped = {
+		next: (...args) => gen.next(...args).then(settle),
+		return(value) {
+			if (!finished) abandon();
+			finished = true;
+			return gen.return(value);
+		},
+		throw(error) {
+			if (!finished) abandon(error);
+			finished = true;
+			return gen.throw(error);
+		},
+		[Symbol.asyncIterator]() {
+			return wrapped;
+		}
 	};
+	return asyncDisposable$2(wrapped, () => wrapped.return(void 0));
 }
 /**
 * The one place that knows a runtime may not implement request body streams,
@@ -2605,10 +2644,11 @@ async function fetchOverDuplex(call, request, options = {}) {
 * registered with any `webrun-streams-*` adapter's `serve`.
 */
 function serveFetchOverDuplex(handler, options = {}) {
-	return httpServe(async (env, body) => {
+	return httpServe(async (env, body, exchange) => {
 		const reqInit = {
 			method: env.method,
-			headers: forwardableHeaders(env.headers)
+			headers: forwardableHeaders(env.headers),
+			signal: exchange?.signal
 		};
 		let upload;
 		if (env.method !== "GET" && env.method !== "HEAD") {
@@ -3469,7 +3509,11 @@ function receiveChunks(port, channelName, controller, touch) {
 * outstanding at a time (spec D11/D12), with no per-chunk deadline (spec D8).
 */
 async function sendChunks(port, channelName, output, { maxMessageSize, log }, signal, touch) {
-	const stream = throughAbort(maxMessageSize ? toChunks(maxMessageSize)(output) : output, signal);
+	const framed = maxMessageSize ? toChunks(maxMessageSize)(output) : output;
+	const stream = throughAbort(framed, signal);
+	const producer = output;
+	const returnProducer = () => void Promise.resolve(producer.return?.()).catch(() => {});
+	if (framed !== output) signal.addEventListener("abort", returnProducer, { once: true });
 	try {
 		await sendIterator(async ({ done, value, error }) => {
 			if (signal.aborted) return;
@@ -3493,6 +3537,8 @@ async function sendChunks(port, channelName, output, { maxMessageSize, log }, si
 	} catch (err) {
 		if (signal.aborted) return;
 		throw err;
+	} finally {
+		signal.removeEventListener("abort", returnProducer);
 	}
 }
 /**
@@ -3631,10 +3677,18 @@ function estimateMessageSize(payload) {
 */
 function multiplexPort(port, options) {
 	const { codec, onPort, side = "initiator", maxPorts = DEFAULT_MAX_PORTS, maxMessageSize, signal, window, frameSize, keepalive, onLeak } = options;
+	const maxReassembledBytes = options.maxReassembledBytes ?? 67108864;
 	const misses = keepalive?.misses ?? 3;
 	if (keepalive && !(Number.isFinite(keepalive.intervalMs) && keepalive.intervalMs > 0 && keepalive.intervalMs <= MAX_TIMER_MS && Number.isSafeInteger(misses) && misses > 0)) throw new RangeError(`webrun-rpc: keepalive needs an intervalMs in (0, ${MAX_TIMER_MS}] and a positive integer misses`);
 	if (frameSize != null && !(Number.isSafeInteger(frameSize) && frameSize > 0)) throw new RangeError(`webrun-rpc: frameSize must be a positive integer, got ${frameSize}`);
+	if (!(Number.isSafeInteger(maxReassembledBytes) && maxReassembledBytes > 0)) throw new RangeError(`webrun-rpc: maxReassembledBytes must be a positive integer, got ${maxReassembledBytes}`);
 	const open = /* @__PURE__ */ new Map();
+	let reassembling = 0;
+	const freePartial = (entry) => {
+		if (!entry?.partial) return;
+		reassembling -= entry.partial.charged;
+		entry.partial = void 0;
+	};
 	const leaks = onLeak ? new FinalizationRegistry(({ id, record, release }) => {
 		const entry = open.get(id);
 		if (entry?.handle !== record) return;
@@ -3782,12 +3836,12 @@ function multiplexPort(port, options) {
 				...envelope,
 				payload: structuredClone(payload, { transfer })
 			} : void 0;
-			const send = () => {
+			const send = (whole = false) => {
 				if (!bytes) {
 					sendOnPort(id, held ? () => post(held) : () => post(envelope, transfer));
 					return;
 				}
-				if (frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
+				if (!whole && frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
 					for (let at = 0; at < bytes.byteLength; at += frameSize) {
 						const data = bytes.subarray(at, at + frameSize);
 						const frame = at + frameSize >= bytes.byteLength ? {
@@ -3817,10 +3871,11 @@ function multiplexPort(port, options) {
 			record.markClosed(reason);
 		});
 		function release(reason) {
+			freePartial(open.get(id));
 			open.delete(id);
 			leaks?.unregister(record);
 			if (c?.queue.length) {
-				for (const item of c.queue.splice(0)) item.send();
+				for (const item of c.queue.splice(0)) item.send(true);
 				c.queued = 0;
 			}
 			sendOnPort(id, () => post({
@@ -3959,15 +4014,38 @@ function multiplexPort(port, options) {
 		if (envelope.type === "frame") {
 			if (!entry?.credit?.exact || !codec.decode || !(envelope.data instanceof Uint8Array)) return;
 			touch(envelope.id);
+			const c = entry.credit;
+			const owed = c.unconsumed + c.toGrant;
 			const partial = entry.partial ?? {
 				chunks: [],
-				bytes: 0
+				bytes: 0,
+				owed,
+				charged: 0,
+				...owed > 0 ? { room: c.window - owed } : {}
 			};
 			entry.partial = partial;
+			const size = envelope.data.byteLength;
+			const charged = partial.room == null ? Math.max(0, partial.bytes + size - c.window) : 0;
+			const overrun = partial.room != null && partial.bytes + size > partial.room ? `what the window left (${partial.room} of ${c.window} bytes, ${partial.owed} still owed)` : reassembling - partial.charged + charged > maxReassembledBytes ? `maxReassembledBytes (${maxReassembledBytes} bytes past the window, across all ports)` : void 0;
+			if (overrun) {
+				freePartial(entry);
+				dropOutgoing(envelope.id);
+				open.delete(envelope.id);
+				releaseWaiters(c);
+				entry.handle.markClosed(/* @__PURE__ */ new RangeError(`webrun-rpc: a framed message passed ${overrun}`));
+				post({
+					type: "close",
+					id: envelope.id,
+					reason: "max-reassembled-bytes"
+				});
+				return;
+			}
+			partial.bytes += size;
+			reassembling += charged - partial.charged;
+			partial.charged = charged;
 			partial.chunks.push(envelope.data);
-			partial.bytes += envelope.data.byteLength;
 			if (!envelope.last) return;
-			entry.partial = void 0;
+			freePartial(entry);
 			const whole = new Uint8Array(partial.bytes);
 			let at = 0;
 			for (const chunk of partial.chunks) {
@@ -3981,6 +4059,7 @@ function multiplexPort(port, options) {
 		}
 		dropOutgoing(envelope.id);
 		if (!entry) return;
+		freePartial(entry);
 		open.delete(envelope.id);
 		releaseWaiters(entry.credit);
 		entry.handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the peer closed the port"));
@@ -4171,14 +4250,17 @@ const serve = async ({ mux: factory, timeout }, handler) => {
 	const mux = await factory((port) => {
 		let off;
 		let finished = false;
-		const tracked = (input) => (async function* () {
-			try {
-				yield* handler(input);
-			} finally {
-				finished = true;
-				if (off) live.delete(off);
-			}
-		})();
+		const tracked = (input) => {
+			const output = handler(input);
+			return returningAtOnce((async function* () {
+				try {
+					yield* output;
+				} finally {
+					finished = true;
+					if (off) live.delete(off);
+				}
+			})(), () => void output.return(void 0).catch(() => {}));
+		};
 		off = serveDuplexOverPort(port, tracked, streamOptions);
 		if (!finished) live.add(off);
 	});
@@ -7408,4 +7490,4 @@ function serveHttpInWorker(handler, options = {}) {
 	};
 }
 //#endregion
-export { CLAIM_CALL, DEFAULT_CLOSE_TIMEOUT_MS, DEFAULT_HEARTBEAT_MS, DEFAULT_SERVICE_WORKER_TIMEOUT, DuplexSiteBuilder, HANDLER_LOST_MESSAGE, HTTP_LINK_PROTOCOL, HandlerEndpoint, HandlerTable, HttpError, HttpParseError, LinkLostError, PEER_ERROR_HEADER, PortRendezvous, ROUTER_LOST_MESSAGE, ServerWebSocket, ServiceWorkerControlError, SwHttpAdapter, SwHttpDispatcher, SwPortDispatcher, SwPortHandler, TransportClosedError, WS_PORT_PROTOCOL_VERSION, WS_VERSION_HEADER, WsCloseEvent, answerConnect, awaitActiveServiceWorker, awaitServiceWorkerControl, callChannel, callChannelWithin, callHttpService, callWebSocketService, collect, collectBytes, collectString, connectHttpLink, connectWebSocketThroughServiceWorker, createWebSocketClass, decodeJsonl, decodeMessage, decodeText, defaultCodec, deserializeError, emulateMux, encodeJsonl, encodeMessage, encodeText, fetchOverDuplex, fromReadableStream, getRelayWindowMessageHandler, handleChannelCalls, handleClaimRequests, handleHttpRequests, handleStreams, holdLock, httpCodec, httpFetch, httpServe, initHttpService, initServiceWorker, initializeConnection, isWebSocketUpgrade, joinLines, jsonEnvelopeCodec, leastInflightRoute, locksAvailable, map, newAsyncGenerator, newCreditGrantor, newCreditLedger, newHttpClientStub, newHttpCodec, newHttpServerStub, newInvokationChannel, newLockName, newRegistry, newRemoteRelayChannel, newServiceWorkerPort, newSniffingCodec, newWebSocketUpgradeRequest, normalizeToUint8Array, recieveIterator, registerConnectionsHandler, relayWebSocketClass, requestedProtocols, sendHttpRequest, sendIterator, sendOverConnection, sendStream, serializeError, serveFetchOverDuplex, serveHttpInWorker, serveHttpLink, serveWebSocketUpgrade, serviceWorkerWebSocketClass, splitLines, splitServiceUrl, startHttpDispatcher, takePort, takeUpgrade, toChunks, toReadableStream, trackedLink, unwrapTransfer, upgradeWebSocket, watchLock, withHeaders, withTransfer };
+export { CLAIM_CALL, DEFAULT_CLOSE_TIMEOUT_MS, DEFAULT_HEARTBEAT_MS, DEFAULT_SERVICE_WORKER_TIMEOUT, DuplexSiteBuilder, EXCHANGE_ABANDONED_MESSAGE, HANDLER_LOST_MESSAGE, HTTP_LINK_PROTOCOL, HandlerEndpoint, HandlerTable, HttpError, HttpParseError, LinkLostError, PEER_ERROR_HEADER, PortRendezvous, ROUTER_LOST_MESSAGE, ServerWebSocket, ServiceWorkerControlError, SwHttpAdapter, SwHttpDispatcher, SwPortDispatcher, SwPortHandler, TransportClosedError, WS_PORT_PROTOCOL_VERSION, WS_VERSION_HEADER, WsCloseEvent, answerConnect, awaitActiveServiceWorker, awaitServiceWorkerControl, callChannel, callChannelWithin, callHttpService, callWebSocketService, collect, collectBytes, collectString, connectHttpLink, connectWebSocketThroughServiceWorker, createWebSocketClass, decodeJsonl, decodeMessage, decodeText, defaultCodec, deserializeError, emulateMux, encodeJsonl, encodeMessage, encodeText, fetchOverDuplex, fromReadableStream, getRelayWindowMessageHandler, handleChannelCalls, handleClaimRequests, handleHttpRequests, handleStreams, holdLock, httpCodec, httpFetch, httpServe, initHttpService, initServiceWorker, initializeConnection, isWebSocketUpgrade, joinLines, jsonEnvelopeCodec, leastInflightRoute, locksAvailable, map, newAsyncGenerator, newCreditGrantor, newCreditLedger, newHttpClientStub, newHttpCodec, newHttpServerStub, newInvokationChannel, newLockName, newRegistry, newRemoteRelayChannel, newServiceWorkerPort, newSniffingCodec, newWebSocketUpgradeRequest, normalizeToUint8Array, recieveIterator, registerConnectionsHandler, relayWebSocketClass, requestedProtocols, sendHttpRequest, sendIterator, sendOverConnection, sendStream, serializeError, serveFetchOverDuplex, serveHttpInWorker, serveHttpLink, serveWebSocketUpgrade, serviceWorkerWebSocketClass, splitLines, splitServiceUrl, startHttpDispatcher, takePort, takeUpgrade, toChunks, toReadableStream, trackedLink, unwrapTransfer, upgradeWebSocket, watchLock, withHeaders, withTransfer };

package/dist/relay-sw.js

@@ -2141,7 +2141,11 @@
 	* outstanding at a time (spec D11/D12), with no per-chunk deadline (spec D8).
 	*/
 	async function sendChunks(port, channelName, output, { maxMessageSize, log }, signal, touch) {
-		const stream = throughAbort(maxMessageSize ? toChunks(maxMessageSize)(output) : output, signal);
+		const framed = maxMessageSize ? toChunks(maxMessageSize)(output) : output;
+		const stream = throughAbort(framed, signal);
+		const producer = output;
+		const returnProducer = () => void Promise.resolve(producer.return?.()).catch(() => {});
+		if (framed !== output) signal.addEventListener("abort", returnProducer, { once: true });
 		try {
 			await sendIterator(async ({ done, value, error }) => {
 				if (signal.aborted) return;
@@ -2165,6 +2169,8 @@
 		} catch (err) {
 			if (signal.aborted) return;
 			throw err;
+		} finally {
+			signal.removeEventListener("abort", returnProducer);
 		}
 	}
 	/**
@@ -2303,10 +2309,18 @@
 	*/
 	function multiplexPort(port, options) {
 		const { codec, onPort, side = "initiator", maxPorts = DEFAULT_MAX_PORTS, maxMessageSize, signal, window, frameSize, keepalive, onLeak } = options;
+		const maxReassembledBytes = options.maxReassembledBytes ?? 67108864;
 		const misses = keepalive?.misses ?? 3;
 		if (keepalive && !(Number.isFinite(keepalive.intervalMs) && keepalive.intervalMs > 0 && keepalive.intervalMs <= MAX_TIMER_MS && Number.isSafeInteger(misses) && misses > 0)) throw new RangeError(`webrun-rpc: keepalive needs an intervalMs in (0, ${MAX_TIMER_MS}] and a positive integer misses`);
 		if (frameSize != null && !(Number.isSafeInteger(frameSize) && frameSize > 0)) throw new RangeError(`webrun-rpc: frameSize must be a positive integer, got ${frameSize}`);
+		if (!(Number.isSafeInteger(maxReassembledBytes) && maxReassembledBytes > 0)) throw new RangeError(`webrun-rpc: maxReassembledBytes must be a positive integer, got ${maxReassembledBytes}`);
 		const open = /* @__PURE__ */ new Map();
+		let reassembling = 0;
+		const freePartial = (entry) => {
+			if (!entry?.partial) return;
+			reassembling -= entry.partial.charged;
+			entry.partial = void 0;
+		};
 		const leaks = onLeak ? new FinalizationRegistry(({ id, record, release }) => {
 			const entry = open.get(id);
 			if (entry?.handle !== record) return;
@@ -2454,12 +2468,12 @@
 					...envelope,
 					payload: structuredClone(payload, { transfer })
 				} : void 0;
-				const send = () => {
+				const send = (whole = false) => {
 					if (!bytes) {
 						sendOnPort(id, held ? () => post(held) : () => post(envelope, transfer));
 						return;
 					}
-					if (frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
+					if (!whole && frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
 						for (let at = 0; at < bytes.byteLength; at += frameSize) {
 							const data = bytes.subarray(at, at + frameSize);
 							const frame = at + frameSize >= bytes.byteLength ? {
@@ -2489,10 +2503,11 @@
 				record.markClosed(reason);
 			});
 			function release(reason) {
+				freePartial(open.get(id));
 				open.delete(id);
 				leaks?.unregister(record);
 				if (c?.queue.length) {
-					for (const item of c.queue.splice(0)) item.send();
+					for (const item of c.queue.splice(0)) item.send(true);
 					c.queued = 0;
 				}
 				sendOnPort(id, () => post({
@@ -2631,15 +2646,38 @@
 			if (envelope.type === "frame") {
 				if (!entry?.credit?.exact || !codec.decode || !(envelope.data instanceof Uint8Array)) return;
 				touch(envelope.id);
+				const c = entry.credit;
+				const owed = c.unconsumed + c.toGrant;
 				const partial = entry.partial ?? {
 					chunks: [],
-					bytes: 0
+					bytes: 0,
+					owed,
+					charged: 0,
+					...owed > 0 ? { room: c.window - owed } : {}
 				};
 				entry.partial = partial;
+				const size = envelope.data.byteLength;
+				const charged = partial.room == null ? Math.max(0, partial.bytes + size - c.window) : 0;
+				const overrun = partial.room != null && partial.bytes + size > partial.room ? `what the window left (${partial.room} of ${c.window} bytes, ${partial.owed} still owed)` : reassembling - partial.charged + charged > maxReassembledBytes ? `maxReassembledBytes (${maxReassembledBytes} bytes past the window, across all ports)` : void 0;
+				if (overrun) {
+					freePartial(entry);
+					dropOutgoing(envelope.id);
+					open.delete(envelope.id);
+					releaseWaiters(c);
+					entry.handle.markClosed(/* @__PURE__ */ new RangeError(`webrun-rpc: a framed message passed ${overrun}`));
+					post({
+						type: "close",
+						id: envelope.id,
+						reason: "max-reassembled-bytes"
+					});
+					return;
+				}
+				partial.bytes += size;
+				reassembling += charged - partial.charged;
+				partial.charged = charged;
 				partial.chunks.push(envelope.data);
-				partial.bytes += envelope.data.byteLength;
 				if (!envelope.last) return;
-				entry.partial = void 0;
+				freePartial(entry);
 				const whole = new Uint8Array(partial.bytes);
 				let at = 0;
 				for (const chunk of partial.chunks) {
@@ -2653,6 +2691,7 @@
 			}
 			dropOutgoing(envelope.id);
 			if (!entry) return;
+			freePartial(entry);
 			open.delete(envelope.id);
 			releaseWaiters(entry.credit);
 			entry.handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the peer closed the port"));

package/dist/relay-worker.js

@@ -2140,7 +2140,11 @@ function receiveChunks(port, channelName, controller, touch) {
 * outstanding at a time (spec D11/D12), with no per-chunk deadline (spec D8).
 */
 async function sendChunks(port, channelName, output, { maxMessageSize, log }, signal, touch) {
-	const stream = throughAbort(maxMessageSize ? toChunks(maxMessageSize)(output) : output, signal);
+	const framed = maxMessageSize ? toChunks(maxMessageSize)(output) : output;
+	const stream = throughAbort(framed, signal);
+	const producer = output;
+	const returnProducer = () => void Promise.resolve(producer.return?.()).catch(() => {});
+	if (framed !== output) signal.addEventListener("abort", returnProducer, { once: true });
 	try {
 		await sendIterator(async ({ done, value, error }) => {
 			if (signal.aborted) return;
@@ -2164,6 +2168,8 @@ async function sendChunks(port, channelName, output, { maxMessageSize, log }, si
 	} catch (err) {
 		if (signal.aborted) return;
 		throw err;
+	} finally {
+		signal.removeEventListener("abort", returnProducer);
 	}
 }
 /**
@@ -2302,10 +2308,18 @@ function estimateMessageSize(payload) {
 */
 function multiplexPort(port, options) {
 	const { codec, onPort, side = "initiator", maxPorts = DEFAULT_MAX_PORTS, maxMessageSize, signal, window, frameSize, keepalive, onLeak } = options;
+	const maxReassembledBytes = options.maxReassembledBytes ?? 67108864;
 	const misses = keepalive?.misses ?? 3;
 	if (keepalive && !(Number.isFinite(keepalive.intervalMs) && keepalive.intervalMs > 0 && keepalive.intervalMs <= MAX_TIMER_MS && Number.isSafeInteger(misses) && misses > 0)) throw new RangeError(`webrun-rpc: keepalive needs an intervalMs in (0, ${MAX_TIMER_MS}] and a positive integer misses`);
 	if (frameSize != null && !(Number.isSafeInteger(frameSize) && frameSize > 0)) throw new RangeError(`webrun-rpc: frameSize must be a positive integer, got ${frameSize}`);
+	if (!(Number.isSafeInteger(maxReassembledBytes) && maxReassembledBytes > 0)) throw new RangeError(`webrun-rpc: maxReassembledBytes must be a positive integer, got ${maxReassembledBytes}`);
 	const open = /* @__PURE__ */ new Map();
+	let reassembling = 0;
+	const freePartial = (entry) => {
+		if (!entry?.partial) return;
+		reassembling -= entry.partial.charged;
+		entry.partial = void 0;
+	};
 	const leaks = onLeak ? new FinalizationRegistry(({ id, record, release }) => {
 		const entry = open.get(id);
 		if (entry?.handle !== record) return;
@@ -2453,12 +2467,12 @@ function multiplexPort(port, options) {
 				...envelope,
 				payload: structuredClone(payload, { transfer })
 			} : void 0;
-			const send = () => {
+			const send = (whole = false) => {
 				if (!bytes) {
 					sendOnPort(id, held ? () => post(held) : () => post(envelope, transfer));
 					return;
 				}
-				if (frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
+				if (!whole && frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
 					for (let at = 0; at < bytes.byteLength; at += frameSize) {
 						const data = bytes.subarray(at, at + frameSize);
 						const frame = at + frameSize >= bytes.byteLength ? {
@@ -2488,10 +2502,11 @@ function multiplexPort(port, options) {
 			record.markClosed(reason);
 		});
 		function release(reason) {
+			freePartial(open.get(id));
 			open.delete(id);
 			leaks?.unregister(record);
 			if (c?.queue.length) {
-				for (const item of c.queue.splice(0)) item.send();
+				for (const item of c.queue.splice(0)) item.send(true);
 				c.queued = 0;
 			}
 			sendOnPort(id, () => post({
@@ -2630,15 +2645,38 @@ function multiplexPort(port, options) {
 		if (envelope.type === "frame") {
 			if (!entry?.credit?.exact || !codec.decode || !(envelope.data instanceof Uint8Array)) return;
 			touch(envelope.id);
+			const c = entry.credit;
+			const owed = c.unconsumed + c.toGrant;
 			const partial = entry.partial ?? {
 				chunks: [],
-				bytes: 0
+				bytes: 0,
+				owed,
+				charged: 0,
+				...owed > 0 ? { room: c.window - owed } : {}
 			};
 			entry.partial = partial;
+			const size = envelope.data.byteLength;
+			const charged = partial.room == null ? Math.max(0, partial.bytes + size - c.window) : 0;
+			const overrun = partial.room != null && partial.bytes + size > partial.room ? `what the window left (${partial.room} of ${c.window} bytes, ${partial.owed} still owed)` : reassembling - partial.charged + charged > maxReassembledBytes ? `maxReassembledBytes (${maxReassembledBytes} bytes past the window, across all ports)` : void 0;
+			if (overrun) {
+				freePartial(entry);
+				dropOutgoing(envelope.id);
+				open.delete(envelope.id);
+				releaseWaiters(c);
+				entry.handle.markClosed(/* @__PURE__ */ new RangeError(`webrun-rpc: a framed message passed ${overrun}`));
+				post({
+					type: "close",
+					id: envelope.id,
+					reason: "max-reassembled-bytes"
+				});
+				return;
+			}
+			partial.bytes += size;
+			reassembling += charged - partial.charged;
+			partial.charged = charged;
 			partial.chunks.push(envelope.data);
-			partial.bytes += envelope.data.byteLength;
 			if (!envelope.last) return;
-			entry.partial = void 0;
+			freePartial(entry);
 			const whole = new Uint8Array(partial.bytes);
 			let at = 0;
 			for (const chunk of partial.chunks) {
@@ -2652,6 +2690,7 @@ function multiplexPort(port, options) {
 		}
 		dropOutgoing(envelope.id);
 		if (!entry) return;
+		freePartial(entry);
 		open.delete(envelope.id);
 		releaseWaiters(entry.credit);
 		entry.handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the peer closed the port"));

package/dist/sw-worker.js

@@ -1394,7 +1394,11 @@
 	*/
 	function httpServe(handler, options = {}) {
 		const codec = options.codec ?? defaultCodec;
-		return async function* httpHandlerDuplex(input) {
+		return (input) => {
+			const abandoned = new AbortController();
+			return abortingOnReturn(exchange(input, { signal: abandoned.signal }), (reason) => abandoned.abort(reason ?? /* @__PURE__ */ new Error("webrun-http-streams: the exchange was abandoned before it was over")));
+		};
+		async function* exchange(input, context) {
 			let decoded;
 			try {
 				decoded = await codec.decodeRequest(input);
@@ -1406,7 +1410,7 @@
 			const replyCodec = decoded.codec ?? codec;
 			let result;
 			try {
-				result = await handler(decoded.envelope, decoded.body);
+				result = await handler(decoded.envelope, decoded.body, context);
 			} catch (error) {
 				yield* encodeErrorResponse(replyCodec, error, decoded.envelope.method);
 				return;
@@ -1421,7 +1425,36 @@
 					await result.release?.();
 				} catch {}
 			}
+		}
+	}
+	/**
+	* `gen`, except that `return()` and `throw()` from its consumer call `abandon`
+	* at once — before they are queued behind a `next()` still parked inside the
+	* generator (the handler's `await`) — unless the generator already finished.
+	*/
+	function abortingOnReturn(gen, abandon) {
+		let finished = false;
+		const settle = (r) => {
+			if (r.done) finished = true;
+			return r;
+		};
+		const wrapped = {
+			next: (...args) => gen.next(...args).then(settle),
+			return(value) {
+				if (!finished) abandon();
+				finished = true;
+				return gen.return(value);
+			},
+			throw(error) {
+				if (!finished) abandon(error);
+				finished = true;
+				return gen.throw(error);
+			},
+			[Symbol.asyncIterator]() {
+				return wrapped;
+			}
 		};
+		return asyncDisposable$2(wrapped, () => wrapped.return(void 0));
 	}
 	/**
 	* The one place that knows a runtime may not implement request body streams,
@@ -1660,10 +1693,11 @@
 	* registered with any `webrun-streams-*` adapter's `serve`.
 	*/
 	function serveFetchOverDuplex(handler, options = {}) {
-		return httpServe(async (env, body) => {
+		return httpServe(async (env, body, exchange) => {
 			const reqInit = {
 				method: env.method,
-				headers: forwardableHeaders(env.headers)
+				headers: forwardableHeaders(env.headers),
+				signal: exchange?.signal
 			};
 			let upload;
 			if (env.method !== "GET" && env.method !== "HEAD") {
@@ -2565,7 +2599,11 @@
 	* outstanding at a time (spec D11/D12), with no per-chunk deadline (spec D8).
 	*/
 	async function sendChunks(port, channelName, output, { maxMessageSize, log }, signal, touch) {
-		const stream = throughAbort(maxMessageSize ? toChunks(maxMessageSize)(output) : output, signal);
+		const framed = maxMessageSize ? toChunks(maxMessageSize)(output) : output;
+		const stream = throughAbort(framed, signal);
+		const producer = output;
+		const returnProducer = () => void Promise.resolve(producer.return?.()).catch(() => {});
+		if (framed !== output) signal.addEventListener("abort", returnProducer, { once: true });
 		try {
 			await sendIterator(async ({ done, value, error }) => {
 				if (signal.aborted) return;
@@ -2589,6 +2627,8 @@
 		} catch (err) {
 			if (signal.aborted) return;
 			throw err;
+		} finally {
+			signal.removeEventListener("abort", returnProducer);
 		}
 	}
 	/**
@@ -2727,10 +2767,18 @@
 	*/
 	function multiplexPort(port, options) {
 		const { codec, onPort, side = "initiator", maxPorts = DEFAULT_MAX_PORTS, maxMessageSize, signal, window, frameSize, keepalive, onLeak } = options;
+		const maxReassembledBytes = options.maxReassembledBytes ?? 67108864;
 		const misses = keepalive?.misses ?? 3;
 		if (keepalive && !(Number.isFinite(keepalive.intervalMs) && keepalive.intervalMs > 0 && keepalive.intervalMs <= MAX_TIMER_MS && Number.isSafeInteger(misses) && misses > 0)) throw new RangeError(`webrun-rpc: keepalive needs an intervalMs in (0, ${MAX_TIMER_MS}] and a positive integer misses`);
 		if (frameSize != null && !(Number.isSafeInteger(frameSize) && frameSize > 0)) throw new RangeError(`webrun-rpc: frameSize must be a positive integer, got ${frameSize}`);
+		if (!(Number.isSafeInteger(maxReassembledBytes) && maxReassembledBytes > 0)) throw new RangeError(`webrun-rpc: maxReassembledBytes must be a positive integer, got ${maxReassembledBytes}`);
 		const open = /* @__PURE__ */ new Map();
+		let reassembling = 0;
+		const freePartial = (entry) => {
+			if (!entry?.partial) return;
+			reassembling -= entry.partial.charged;
+			entry.partial = void 0;
+		};
 		const leaks = onLeak ? new FinalizationRegistry(({ id, record, release }) => {
 			const entry = open.get(id);
 			if (entry?.handle !== record) return;
@@ -2878,12 +2926,12 @@
 					...envelope,
 					payload: structuredClone(payload, { transfer })
 				} : void 0;
-				const send = () => {
+				const send = (whole = false) => {
 					if (!bytes) {
 						sendOnPort(id, held ? () => post(held) : () => post(envelope, transfer));
 						return;
 					}
-					if (frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
+					if (!whole && frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
 						for (let at = 0; at < bytes.byteLength; at += frameSize) {
 							const data = bytes.subarray(at, at + frameSize);
 							const frame = at + frameSize >= bytes.byteLength ? {
@@ -2913,10 +2961,11 @@
 				record.markClosed(reason);
 			});
 			function release(reason) {
+				freePartial(open.get(id));
 				open.delete(id);
 				leaks?.unregister(record);
 				if (c?.queue.length) {
-					for (const item of c.queue.splice(0)) item.send();
+					for (const item of c.queue.splice(0)) item.send(true);
 					c.queued = 0;
 				}
 				sendOnPort(id, () => post({
@@ -3055,15 +3104,38 @@
 			if (envelope.type === "frame") {
 				if (!entry?.credit?.exact || !codec.decode || !(envelope.data instanceof Uint8Array)) return;
 				touch(envelope.id);
+				const c = entry.credit;
+				const owed = c.unconsumed + c.toGrant;
 				const partial = entry.partial ?? {
 					chunks: [],
-					bytes: 0
+					bytes: 0,
+					owed,
+					charged: 0,
+					...owed > 0 ? { room: c.window - owed } : {}
 				};
 				entry.partial = partial;
+				const size = envelope.data.byteLength;
+				const charged = partial.room == null ? Math.max(0, partial.bytes + size - c.window) : 0;
+				const overrun = partial.room != null && partial.bytes + size > partial.room ? `what the window left (${partial.room} of ${c.window} bytes, ${partial.owed} still owed)` : reassembling - partial.charged + charged > maxReassembledBytes ? `maxReassembledBytes (${maxReassembledBytes} bytes past the window, across all ports)` : void 0;
+				if (overrun) {
+					freePartial(entry);
+					dropOutgoing(envelope.id);
+					open.delete(envelope.id);
+					releaseWaiters(c);
+					entry.handle.markClosed(/* @__PURE__ */ new RangeError(`webrun-rpc: a framed message passed ${overrun}`));
+					post({
+						type: "close",
+						id: envelope.id,
+						reason: "max-reassembled-bytes"
+					});
+					return;
+				}
+				partial.bytes += size;
+				reassembling += charged - partial.charged;
+				partial.charged = charged;
 				partial.chunks.push(envelope.data);
-				partial.bytes += envelope.data.byteLength;
 				if (!envelope.last) return;
-				entry.partial = void 0;
+				freePartial(entry);
 				const whole = new Uint8Array(partial.bytes);
 				let at = 0;
 				for (const chunk of partial.chunks) {
@@ -3077,6 +3149,7 @@
 			}
 			dropOutgoing(envelope.id);
 			if (!entry) return;
+			freePartial(entry);
 			open.delete(envelope.id);
 			releaseWaiters(entry.credit);
 			entry.handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the peer closed the port"));
@@ -3267,14 +3340,17 @@
 		const mux = await factory((port) => {
 			let off;
 			let finished = false;
-			const tracked = (input) => (async function* () {
-				try {
-					yield* handler(input);
-				} finally {
-					finished = true;
-					if (off) live.delete(off);
-				}
-			})();
+			const tracked = (input) => {
+				const output = handler(input);
+				return returningAtOnce((async function* () {
+					try {
+						yield* output;
+					} finally {
+						finished = true;
+						if (off) live.delete(off);
+					}
+				})(), () => void output.return(void 0).catch(() => {}));
+			};
 			off = serveDuplexOverPort(port, tracked, streamOptions);
 			if (!finished) live.add(off);
 		});

package/dist/sw.js

@@ -1266,7 +1266,11 @@ async function drain(output) {
 */
 function httpServe(handler, options = {}) {
 	const codec = options.codec ?? defaultCodec;
-	return async function* httpHandlerDuplex(input) {
+	return (input) => {
+		const abandoned = new AbortController();
+		return abortingOnReturn(exchange(input, { signal: abandoned.signal }), (reason) => abandoned.abort(reason ?? /* @__PURE__ */ new Error("webrun-http-streams: the exchange was abandoned before it was over")));
+	};
+	async function* exchange(input, context) {
 		let decoded;
 		try {
 			decoded = await codec.decodeRequest(input);
@@ -1278,7 +1282,7 @@ function httpServe(handler, options = {}) {
 		const replyCodec = decoded.codec ?? codec;
 		let result;
 		try {
-			result = await handler(decoded.envelope, decoded.body);
+			result = await handler(decoded.envelope, decoded.body, context);
 		} catch (error) {
 			yield* encodeErrorResponse(replyCodec, error, decoded.envelope.method);
 			return;
@@ -1293,7 +1297,36 @@ function httpServe(handler, options = {}) {
 				await result.release?.();
 			} catch {}
 		}
+	}
+}
+/**
+* `gen`, except that `return()` and `throw()` from its consumer call `abandon`
+* at once — before they are queued behind a `next()` still parked inside the
+* generator (the handler's `await`) — unless the generator already finished.
+*/
+function abortingOnReturn(gen, abandon) {
+	let finished = false;
+	const settle = (r) => {
+		if (r.done) finished = true;
+		return r;
+	};
+	const wrapped = {
+		next: (...args) => gen.next(...args).then(settle),
+		return(value) {
+			if (!finished) abandon();
+			finished = true;
+			return gen.return(value);
+		},
+		throw(error) {
+			if (!finished) abandon(error);
+			finished = true;
+			return gen.throw(error);
+		},
+		[Symbol.asyncIterator]() {
+			return wrapped;
+		}
 	};
+	return asyncDisposable$2(wrapped, () => wrapped.return(void 0));
 }
 /**
 * The one place that knows a runtime may not implement request body streams,
@@ -1532,10 +1565,11 @@ async function fetchOverDuplex(call, request, options = {}) {
 * registered with any `webrun-streams-*` adapter's `serve`.
 */
 function serveFetchOverDuplex(handler, options = {}) {
-	return httpServe(async (env, body) => {
+	return httpServe(async (env, body, exchange) => {
 		const reqInit = {
 			method: env.method,
-			headers: forwardableHeaders(env.headers)
+			headers: forwardableHeaders(env.headers),
+			signal: exchange?.signal
 		};
 		let upload;
 		if (env.method !== "GET" && env.method !== "HEAD") {
@@ -2234,7 +2268,11 @@ function receiveChunks(port, channelName, controller, touch) {
 * outstanding at a time (spec D11/D12), with no per-chunk deadline (spec D8).
 */
 async function sendChunks(port, channelName, output, { maxMessageSize, log }, signal, touch) {
-	const stream = throughAbort(maxMessageSize ? toChunks(maxMessageSize)(output) : output, signal);
+	const framed = maxMessageSize ? toChunks(maxMessageSize)(output) : output;
+	const stream = throughAbort(framed, signal);
+	const producer = output;
+	const returnProducer = () => void Promise.resolve(producer.return?.()).catch(() => {});
+	if (framed !== output) signal.addEventListener("abort", returnProducer, { once: true });
 	try {
 		await sendIterator(async ({ done, value, error }) => {
 			if (signal.aborted) return;
@@ -2258,6 +2296,8 @@ async function sendChunks(port, channelName, output, { maxMessageSize, log }, si
 	} catch (err) {
 		if (signal.aborted) return;
 		throw err;
+	} finally {
+		signal.removeEventListener("abort", returnProducer);
 	}
 }
 /**
@@ -2396,10 +2436,18 @@ function estimateMessageSize(payload) {
 */
 function multiplexPort(port, options) {
 	const { codec, onPort, side = "initiator", maxPorts = DEFAULT_MAX_PORTS, maxMessageSize, signal, window, frameSize, keepalive, onLeak } = options;
+	const maxReassembledBytes = options.maxReassembledBytes ?? 67108864;
 	const misses = keepalive?.misses ?? 3;
 	if (keepalive && !(Number.isFinite(keepalive.intervalMs) && keepalive.intervalMs > 0 && keepalive.intervalMs <= MAX_TIMER_MS && Number.isSafeInteger(misses) && misses > 0)) throw new RangeError(`webrun-rpc: keepalive needs an intervalMs in (0, ${MAX_TIMER_MS}] and a positive integer misses`);
 	if (frameSize != null && !(Number.isSafeInteger(frameSize) && frameSize > 0)) throw new RangeError(`webrun-rpc: frameSize must be a positive integer, got ${frameSize}`);
+	if (!(Number.isSafeInteger(maxReassembledBytes) && maxReassembledBytes > 0)) throw new RangeError(`webrun-rpc: maxReassembledBytes must be a positive integer, got ${maxReassembledBytes}`);
 	const open = /* @__PURE__ */ new Map();
+	let reassembling = 0;
+	const freePartial = (entry) => {
+		if (!entry?.partial) return;
+		reassembling -= entry.partial.charged;
+		entry.partial = void 0;
+	};
 	const leaks = onLeak ? new FinalizationRegistry(({ id, record, release }) => {
 		const entry = open.get(id);
 		if (entry?.handle !== record) return;
@@ -2547,12 +2595,12 @@ function multiplexPort(port, options) {
 				...envelope,
 				payload: structuredClone(payload, { transfer })
 			} : void 0;
-			const send = () => {
+			const send = (whole = false) => {
 				if (!bytes) {
 					sendOnPort(id, held ? () => post(held) : () => post(envelope, transfer));
 					return;
 				}
-				if (frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
+				if (!whole && frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
 					for (let at = 0; at < bytes.byteLength; at += frameSize) {
 						const data = bytes.subarray(at, at + frameSize);
 						const frame = at + frameSize >= bytes.byteLength ? {
@@ -2582,10 +2630,11 @@ function multiplexPort(port, options) {
 			record.markClosed(reason);
 		});
 		function release(reason) {
+			freePartial(open.get(id));
 			open.delete(id);
 			leaks?.unregister(record);
 			if (c?.queue.length) {
-				for (const item of c.queue.splice(0)) item.send();
+				for (const item of c.queue.splice(0)) item.send(true);
 				c.queued = 0;
 			}
 			sendOnPort(id, () => post({
@@ -2724,15 +2773,38 @@ function multiplexPort(port, options) {
 		if (envelope.type === "frame") {
 			if (!entry?.credit?.exact || !codec.decode || !(envelope.data instanceof Uint8Array)) return;
 			touch(envelope.id);
+			const c = entry.credit;
+			const owed = c.unconsumed + c.toGrant;
 			const partial = entry.partial ?? {
 				chunks: [],
-				bytes: 0
+				bytes: 0,
+				owed,
+				charged: 0,
+				...owed > 0 ? { room: c.window - owed } : {}
 			};
 			entry.partial = partial;
+			const size = envelope.data.byteLength;
+			const charged = partial.room == null ? Math.max(0, partial.bytes + size - c.window) : 0;
+			const overrun = partial.room != null && partial.bytes + size > partial.room ? `what the window left (${partial.room} of ${c.window} bytes, ${partial.owed} still owed)` : reassembling - partial.charged + charged > maxReassembledBytes ? `maxReassembledBytes (${maxReassembledBytes} bytes past the window, across all ports)` : void 0;
+			if (overrun) {
+				freePartial(entry);
+				dropOutgoing(envelope.id);
+				open.delete(envelope.id);
+				releaseWaiters(c);
+				entry.handle.markClosed(/* @__PURE__ */ new RangeError(`webrun-rpc: a framed message passed ${overrun}`));
+				post({
+					type: "close",
+					id: envelope.id,
+					reason: "max-reassembled-bytes"
+				});
+				return;
+			}
+			partial.bytes += size;
+			reassembling += charged - partial.charged;
+			partial.charged = charged;
 			partial.chunks.push(envelope.data);
-			partial.bytes += envelope.data.byteLength;
 			if (!envelope.last) return;
-			entry.partial = void 0;
+			freePartial(entry);
 			const whole = new Uint8Array(partial.bytes);
 			let at = 0;
 			for (const chunk of partial.chunks) {
@@ -2746,6 +2818,7 @@ function multiplexPort(port, options) {
 		}
 		dropOutgoing(envelope.id);
 		if (!entry) return;
+		freePartial(entry);
 		open.delete(envelope.id);
 		releaseWaiters(entry.credit);
 		entry.handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the peer closed the port"));
@@ -2936,14 +3009,17 @@ const serve = async ({ mux: factory, timeout }, handler) => {
 	const mux = await factory((port) => {
 		let off;
 		let finished = false;
-		const tracked = (input) => (async function* () {
-			try {
-				yield* handler(input);
-			} finally {
-				finished = true;
-				if (off) live.delete(off);
-			}
-		})();
+		const tracked = (input) => {
+			const output = handler(input);
+			return returningAtOnce((async function* () {
+				try {
+					yield* output;
+				} finally {
+					finished = true;
+					if (off) live.delete(off);
+				}
+			})(), () => void output.return(void 0).catch(() => {}));
+		};
 		off = serveDuplexOverPort(port, tracked, streamOptions);
 		if (!finished) live.add(off);
 	});

package/dist/worker.js

@@ -1207,7 +1207,11 @@ async function drain(output) {
 */
 function httpServe(handler, options = {}) {
 	const codec = options.codec ?? defaultCodec;
-	return async function* httpHandlerDuplex(input) {
+	return (input) => {
+		const abandoned = new AbortController();
+		return abortingOnReturn(exchange(input, { signal: abandoned.signal }), (reason) => abandoned.abort(reason ?? /* @__PURE__ */ new Error("webrun-http-streams: the exchange was abandoned before it was over")));
+	};
+	async function* exchange(input, context) {
 		let decoded;
 		try {
 			decoded = await codec.decodeRequest(input);
@@ -1219,7 +1223,7 @@ function httpServe(handler, options = {}) {
 		const replyCodec = decoded.codec ?? codec;
 		let result;
 		try {
-			result = await handler(decoded.envelope, decoded.body);
+			result = await handler(decoded.envelope, decoded.body, context);
 		} catch (error) {
 			yield* encodeErrorResponse(replyCodec, error, decoded.envelope.method);
 			return;
@@ -1234,7 +1238,36 @@ function httpServe(handler, options = {}) {
 				await result.release?.();
 			} catch {}
 		}
+	}
+}
+/**
+* `gen`, except that `return()` and `throw()` from its consumer call `abandon`
+* at once — before they are queued behind a `next()` still parked inside the
+* generator (the handler's `await`) — unless the generator already finished.
+*/
+function abortingOnReturn(gen, abandon) {
+	let finished = false;
+	const settle = (r) => {
+		if (r.done) finished = true;
+		return r;
+	};
+	const wrapped = {
+		next: (...args) => gen.next(...args).then(settle),
+		return(value) {
+			if (!finished) abandon();
+			finished = true;
+			return gen.return(value);
+		},
+		throw(error) {
+			if (!finished) abandon(error);
+			finished = true;
+			return gen.throw(error);
+		},
+		[Symbol.asyncIterator]() {
+			return wrapped;
+		}
 	};
+	return asyncDisposable$2(wrapped, () => wrapped.return(void 0));
 }
 /**
 * The one place that knows a runtime may not implement request body streams,
@@ -1418,10 +1451,11 @@ async function fetchOverDuplex(call, request, options = {}) {
 * registered with any `webrun-streams-*` adapter's `serve`.
 */
 function serveFetchOverDuplex(handler, options = {}) {
-	return httpServe(async (env, body) => {
+	return httpServe(async (env, body, exchange) => {
 		const reqInit = {
 			method: env.method,
-			headers: forwardableHeaders(env.headers)
+			headers: forwardableHeaders(env.headers),
+			signal: exchange?.signal
 		};
 		let upload;
 		if (env.method !== "GET" && env.method !== "HEAD") {
@@ -2120,7 +2154,11 @@ function receiveChunks(port, channelName, controller, touch) {
 * outstanding at a time (spec D11/D12), with no per-chunk deadline (spec D8).
 */
 async function sendChunks(port, channelName, output, { maxMessageSize, log }, signal, touch) {
-	const stream = throughAbort(maxMessageSize ? toChunks(maxMessageSize)(output) : output, signal);
+	const framed = maxMessageSize ? toChunks(maxMessageSize)(output) : output;
+	const stream = throughAbort(framed, signal);
+	const producer = output;
+	const returnProducer = () => void Promise.resolve(producer.return?.()).catch(() => {});
+	if (framed !== output) signal.addEventListener("abort", returnProducer, { once: true });
 	try {
 		await sendIterator(async ({ done, value, error }) => {
 			if (signal.aborted) return;
@@ -2144,6 +2182,8 @@ async function sendChunks(port, channelName, output, { maxMessageSize, log }, si
 	} catch (err) {
 		if (signal.aborted) return;
 		throw err;
+	} finally {
+		signal.removeEventListener("abort", returnProducer);
 	}
 }
 /**
@@ -2282,10 +2322,18 @@ function estimateMessageSize(payload) {
 */
 function multiplexPort(port, options) {
 	const { codec, onPort, side = "initiator", maxPorts = DEFAULT_MAX_PORTS, maxMessageSize, signal, window, frameSize, keepalive, onLeak } = options;
+	const maxReassembledBytes = options.maxReassembledBytes ?? 67108864;
 	const misses = keepalive?.misses ?? 3;
 	if (keepalive && !(Number.isFinite(keepalive.intervalMs) && keepalive.intervalMs > 0 && keepalive.intervalMs <= MAX_TIMER_MS && Number.isSafeInteger(misses) && misses > 0)) throw new RangeError(`webrun-rpc: keepalive needs an intervalMs in (0, ${MAX_TIMER_MS}] and a positive integer misses`);
 	if (frameSize != null && !(Number.isSafeInteger(frameSize) && frameSize > 0)) throw new RangeError(`webrun-rpc: frameSize must be a positive integer, got ${frameSize}`);
+	if (!(Number.isSafeInteger(maxReassembledBytes) && maxReassembledBytes > 0)) throw new RangeError(`webrun-rpc: maxReassembledBytes must be a positive integer, got ${maxReassembledBytes}`);
 	const open = /* @__PURE__ */ new Map();
+	let reassembling = 0;
+	const freePartial = (entry) => {
+		if (!entry?.partial) return;
+		reassembling -= entry.partial.charged;
+		entry.partial = void 0;
+	};
 	const leaks = onLeak ? new FinalizationRegistry(({ id, record, release }) => {
 		const entry = open.get(id);
 		if (entry?.handle !== record) return;
@@ -2433,12 +2481,12 @@ function multiplexPort(port, options) {
 				...envelope,
 				payload: structuredClone(payload, { transfer })
 			} : void 0;
-			const send = () => {
+			const send = (whole = false) => {
 				if (!bytes) {
 					sendOnPort(id, held ? () => post(held) : () => post(envelope, transfer));
 					return;
 				}
-				if (frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
+				if (!whole && frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
 					for (let at = 0; at < bytes.byteLength; at += frameSize) {
 						const data = bytes.subarray(at, at + frameSize);
 						const frame = at + frameSize >= bytes.byteLength ? {
@@ -2468,10 +2516,11 @@ function multiplexPort(port, options) {
 			record.markClosed(reason);
 		});
 		function release(reason) {
+			freePartial(open.get(id));
 			open.delete(id);
 			leaks?.unregister(record);
 			if (c?.queue.length) {
-				for (const item of c.queue.splice(0)) item.send();
+				for (const item of c.queue.splice(0)) item.send(true);
 				c.queued = 0;
 			}
 			sendOnPort(id, () => post({
@@ -2610,15 +2659,38 @@ function multiplexPort(port, options) {
 		if (envelope.type === "frame") {
 			if (!entry?.credit?.exact || !codec.decode || !(envelope.data instanceof Uint8Array)) return;
 			touch(envelope.id);
+			const c = entry.credit;
+			const owed = c.unconsumed + c.toGrant;
 			const partial = entry.partial ?? {
 				chunks: [],
-				bytes: 0
+				bytes: 0,
+				owed,
+				charged: 0,
+				...owed > 0 ? { room: c.window - owed } : {}
 			};
 			entry.partial = partial;
+			const size = envelope.data.byteLength;
+			const charged = partial.room == null ? Math.max(0, partial.bytes + size - c.window) : 0;
+			const overrun = partial.room != null && partial.bytes + size > partial.room ? `what the window left (${partial.room} of ${c.window} bytes, ${partial.owed} still owed)` : reassembling - partial.charged + charged > maxReassembledBytes ? `maxReassembledBytes (${maxReassembledBytes} bytes past the window, across all ports)` : void 0;
+			if (overrun) {
+				freePartial(entry);
+				dropOutgoing(envelope.id);
+				open.delete(envelope.id);
+				releaseWaiters(c);
+				entry.handle.markClosed(/* @__PURE__ */ new RangeError(`webrun-rpc: a framed message passed ${overrun}`));
+				post({
+					type: "close",
+					id: envelope.id,
+					reason: "max-reassembled-bytes"
+				});
+				return;
+			}
+			partial.bytes += size;
+			reassembling += charged - partial.charged;
+			partial.charged = charged;
 			partial.chunks.push(envelope.data);
-			partial.bytes += envelope.data.byteLength;
 			if (!envelope.last) return;
-			entry.partial = void 0;
+			freePartial(entry);
 			const whole = new Uint8Array(partial.bytes);
 			let at = 0;
 			for (const chunk of partial.chunks) {
@@ -2632,6 +2704,7 @@ function multiplexPort(port, options) {
 		}
 		dropOutgoing(envelope.id);
 		if (!entry) return;
+		freePartial(entry);
 		open.delete(envelope.id);
 		releaseWaiters(entry.credit);
 		entry.handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the peer closed the port"));
@@ -2822,14 +2895,17 @@ const serve = async ({ mux: factory, timeout }, handler) => {
 	const mux = await factory((port) => {
 		let off;
 		let finished = false;
-		const tracked = (input) => (async function* () {
-			try {
-				yield* handler(input);
-			} finally {
-				finished = true;
-				if (off) live.delete(off);
-			}
-		})();
+		const tracked = (input) => {
+			const output = handler(input);
+			return returningAtOnce((async function* () {
+				try {
+					yield* output;
+				} finally {
+					finished = true;
+					if (off) live.delete(off);
+				}
+			})(), () => void output.return(void 0).catch(() => {}));
+		};
 		off = serveDuplexOverPort(port, tracked, streamOptions);
 		if (!finished) live.add(off);
 	});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@statewalker/webrun-http-browser",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "private": false,
   "type": "module",
   "description": "ServiceWorker-based HTTP and WebSocket server for browsers: handlers in pages and Dedicated Workers, same-origin and relay modes, streams with backpressure",
@@ -58,9 +58,9 @@
   ],
   "dependencies": {
     "idb-keyval": "^6.3.0",
-    "@statewalker/webrun-http-streams": "^0.3.2",
+    "@statewalker/webrun-rpc": "^0.8.0",
     "@statewalker/webrun-streams": "^0.2.3",
-    "@statewalker/webrun-rpc": "^0.7.0"
+    "@statewalker/webrun-http-streams": "^0.4.0"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.15",