@statewalker/webrun-http-streams 0.3.0 → 0.3.2

package/dist/async-dispose.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Makes `target` disposable with `await using`: installs `dispose` as its
+ * `[Symbol.asyncDispose]`, where the runtime defines the symbol. Hand-written
+ * iterators lose what a native generator gets from `AsyncIteratorPrototype`;
+ * this gives it back. A no-op where the symbol is missing. Kept off the
+ * declared types, which would require consumers to compile with the
+ * `esnext.disposable` lib.
+ */
+export declare function asyncDisposable<T extends object>(target: T, dispose: () => Promise<unknown>): T;
+//# sourceMappingURL=async-dispose.d.ts.map

package/dist/async-dispose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-dispose.d.ts","sourceRoot":"","sources":["../src/async-dispose.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAa/F"}

package/dist/fetch.d.ts

@@ -11,4 +11,6 @@ export declare function fetchOverDuplex(call: Duplex, request: Request, options?
  * registered with any `webrun-streams-*` adapter's `serve`.
  */
 export declare function serveFetchOverDuplex(handler: (request: Request) => Promise<Response>, options?: HttpDataOptions): Duplex;
+/** How long a request body may sit unread after the response before it is abandoned. */
+export declare const DEFAULT_REQUEST_IDLE_MS = 30000;
 //# sourceMappingURL=fetch.d.ts.map

package/dist/fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAE1D,OAAO,EAAE,KAAK,eAAe,EAAwB,MAAM,gBAAgB,CAAC;AAsF5E;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAiDnB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,EAChD,OAAO,GAAE,eAAoB,GAC5B,MAAM,CAqDR"}
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAG1D,OAAO,EAAe,KAAK,eAAe,EAAwB,MAAM,gBAAgB,CAAC;AAsFzF;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,QAAQ,CAAC,CA4DnB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,EAChD,OAAO,GAAE,eAAoB,GAC5B,MAAM,CAwER;AAED,wFAAwF;AACxF,eAAO,MAAM,uBAAuB,QAAS,CAAC"}

package/dist/http-data.d.ts

@@ -5,6 +5,24 @@ export declare const PEER_ERROR_HEADER = "x-webrun-error";
 export type HttpDataOptions = {
     /** Wire format. Defaults to `defaultCodec`: writes HTTP/1.1, accepts either. */
     codec?: MessageCodec;
+    /**
+     * `httpFetch` only: aborting it while the response head is awaited releases
+     * the call and rejects with the signal's reason. (Once the head is in, the
+     * body is the caller's to leave.)
+     */
+    signal?: AbortSignal;
+    /**
+     * `serveFetchOverDuplex` only: once the response is out, how long the request
+     * body may go unread before it is abandoned and the exchange ends (default
+     * 30 s). A handler that answers first and reads the upload afterwards keeps
+     * it as long as it keeps reading — the time it spends on one chunk before it
+     * asks for the next counts as idle, so a handler that pauses longer between
+     * reads (one slow write per chunk) needs a larger bound; one that took the
+     * body and dropped it would otherwise keep the exchange — on a multiplexed
+     * transport, its port — open for good. `Infinity` waits for as long as it
+     * takes.
+     */
+    requestIdleMs?: number;
 };
 export interface HttpFetchResult {
     envelope: ResponseEnvelope;
@@ -17,17 +35,35 @@ export interface HttpFetchResult {
      * custom transports) still type-check; `httpFetch` always sets it.
      */
     release?(): Promise<void>;
+    /**
+     * The caller is done with a response it took in full — read to its end, or
+     * one with no body to read (HEAD, 204, 304...): the call is read to its end
+     * in the background, so the peer ends it once its side is over (it may still
+     * be reading the request body). Reading `body` to its end does this by
+     * itself. Optional, like `release`; `httpFetch` always sets it.
+     */
+    finish?(): void;
 }
 export interface HttpDataHandlerResult {
     envelope: ResponseEnvelope;
     body?: ByteSource;
     /**
-     * Called when the caller abandons the response before its end. A body the
-     * codec never started pulling cannot be released through the iterator
-     * protocol (`.return()` on a generator in suspended start does nothing), so
-     * a producer that holds resources says here how to let them go.
+     * Called when the caller abandons the response before its end — never once
+     * the response went out in full. A body the codec never started pulling
+     * cannot be released through the iterator protocol (`.return()` on a
+     * generator in suspended start does nothing), so a producer that holds
+     * resources says here how to let them go.
      */
     release?: () => unknown;
+    /**
+     * Awaited once the response went out in full: the exchange — and with it
+     * the call, and on a multiplexed transport its port — ends when it
+     * resolves. A handler that answers before it has read the request body, and
+     * goes on reading it, resolves this once it is done with it; until then the
+     * caller keeps sending. Left out, the exchange ends with the response, and
+     * the rest of the request is dropped.
+     */
+    settled?: () => Promise<unknown>;
 }
 /**
  * Low-level HTTP-over-Duplex handler. Takes the request envelope plus body
@@ -47,6 +83,8 @@ export type HttpDataHandler = (env: RequestEnvelope, body: AsyncIterable<Uint8Ar
  * calls is the adapter's concern (native or `emulateMux`).
  */
 export declare function httpFetch(call: Duplex, env: RequestEnvelope, body?: ByteSource, options?: HttpDataOptions): Promise<HttpFetchResult>;
+/** The signal's reason as an `Error` (`AbortError` when it gave none). */
+export declare function abortReason(signal: AbortSignal): Error;
 /**
  * Wrap an HTTP handler as a `Duplex` so it can be registered with any
  * `webrun-streams-*` adapter's `serve`.

package/dist/http-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-data.d.ts","sourceRoot":"","sources":["../src/http-data.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAK1D,OAAO,KAAK,EACV,UAAU,EAEV,YAAY,EACZ,eAAe,EACf,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAEtB,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAElD,MAAM,MAAM,eAAe,GAAG;IAC5B,gFAAgF;IAChF,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAChC;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,KAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAgGpC;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,eAAe,EACpB,IAAI,CAAC,EAAE,UAAU,EACjB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,eAAe,CAAC,CAkB1B;AA0BD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,GAAE,eAAoB,GAAG,MAAM,CAoDzF"}
+{"version":3,"file":"http-data.d.ts","sourceRoot":"","sources":["../src/http-data.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAK1D,OAAO,KAAK,EACV,UAAU,EAEV,YAAY,EACZ,eAAe,EACf,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAEtB,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAElD,MAAM,MAAM,eAAe,GAAG;IAC5B,gFAAgF;IAChF,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAChC;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC;IACxB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,KAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAgGpC;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,eAAe,EACpB,IAAI,CAAC,EAAE,UAAU,EACjB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,eAAe,CAAC,CA0D1B;AAsBD,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,KAAK,CAMtD;AA4CD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,GAAE,eAAoB,GAAG,MAAM,CAqDzF"}

package/dist/http-stubs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-stubs.d.ts","sourceRoot":"","sources":["../src/http-stubs.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,sBAAsB,CAAC,OAAO;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;OAUG;IACH,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CACpC;AAED,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAK7E,eAAO,MAAM,kBAAkB,aAAqC,CAAC;AAsBrE;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,CACJ,QAAQ,EAAE,sBAAsB,CAAC,qBAAqB,CAAC,KACpD,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,GAAG,SAAS,CAAC,GACvE,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAmD5D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,WAAW,GACnB,CACD,QAAQ,EACJ,sBAAsB,CAAC,qBAAqB,CAAC,GAC7C,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,CAAC,KACvD,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,CAAC,CA0D3D"}
+{"version":3,"file":"http-stubs.d.ts","sourceRoot":"","sources":["../src/http-stubs.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,sBAAsB,CAAC,OAAO;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;OAUG;IACH,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CACpC;AAED,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAK7E,eAAO,MAAM,kBAAkB,aAAqD,CAAC;AAsBrF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,CACJ,QAAQ,EAAE,sBAAsB,CAAC,qBAAqB,CAAC,KACpD,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,GAAG,SAAS,CAAC,GACvE,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAmD5D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,WAAW,GACnB,CACD,QAAQ,EACJ,sBAAsB,CAAC,qBAAqB,CAAC,GAC7C,OAAO,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,CAAC,KACvD,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,CAAC,CA0D3D"}

package/dist/http1/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http1/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAKlD,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAgB,YAAY,CAAC,OAAO,GAAE,gBAAqB,GAAG,YAAY,CAiBzE;AAED,eAAO,MAAM,SAAS,EAAE,YAA6B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http1/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAKlD,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAgB,YAAY,CAAC,OAAO,GAAE,gBAAqB,GAAG,YAAY,CAiBzE;AAED,eAAO,MAAM,SAAS,EAAE,YAA6C,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -139,8 +139,8 @@ var HttpParseError = class extends Error {
 const NEWLINE = 10;
 /** Mirrors the HTTP/1.1 codec's default `maxHeaderBytes`. */
 const MAX_ENVELOPE_BYTES = 65536;
-const encoder$1 = new TextEncoder();
-const decoder = new TextDecoder();
+const encoder$1 = /* @__PURE__ */ new TextEncoder();
+const decoder = /* @__PURE__ */ new TextDecoder();
 /**
 * Encode an HTTP envelope plus optional body as one continuous byte stream:
 *
@@ -398,15 +398,15 @@ function resolveFraming(headers, version) {
 }
 //#endregion
 //#region src/http1/chunked.ts
-const CRLF = new Uint8Array([13, 10]);
-const LAST_CHUNK = new Uint8Array([
+const CRLF = /* @__PURE__ */ new Uint8Array([13, 10]);
+const LAST_CHUNK = /* @__PURE__ */ new Uint8Array([
 	48,
 	13,
 	10,
 	13,
 	10
 ]);
-const encoder = new TextEncoder();
+const encoder = /* @__PURE__ */ new TextEncoder();
 /**
 * Chunk sizes are written in HEXADECIMAL — a 21-byte chunk is `15`. Writing
 * them in decimal is the defect note 15 found in @libp2p/http, and it is the
@@ -717,7 +717,7 @@ function newHttpCodec(options = {}) {
 		decodeResponse: (input, o) => decodeResponse(input, opts, o.method)
 	};
 }
-const httpCodec = newHttpCodec();
+const httpCodec = /* @__PURE__ */ newHttpCodec();
 //#endregion
 //#region src/sniff.ts
 /**
@@ -771,11 +771,32 @@ function newSniffingCodec(options) {
 * Writes HTTP/1.1; accepts HTTP/1.1 or the legacy JSON envelope. Used whenever
 * no `codec` option is supplied.
 */
-const defaultCodec = newSniffingCodec({
+const defaultCodec = /* @__PURE__ */ newSniffingCodec({
 	write: httpCodec,
 	accept: [httpCodec, jsonEnvelopeCodec]
 });
 //#endregion
+//#region src/async-dispose.ts
+/**
+* Makes `target` disposable with `await using`: installs `dispose` as its
+* `[Symbol.asyncDispose]`, where the runtime defines the symbol. Hand-written
+* iterators lose what a native generator gets from `AsyncIteratorPrototype`;
+* this gives it back. A no-op where the symbol is missing. Kept off the
+* declared types, which would require consumers to compile with the
+* `esnext.disposable` lib.
+*/
+function asyncDisposable(target, dispose) {
+	const asyncDispose = Symbol.asyncDispose;
+	if (asyncDispose && !(asyncDispose in target)) Object.defineProperty(target, asyncDispose, {
+		value: async () => {
+			await dispose();
+		},
+		configurable: true,
+		writable: true
+	});
+	return target;
+}
+//#endregion
 //#region src/http-data.ts
 /** Carries the serialized JS error between two webrun peers. */
 const PEER_ERROR_HEADER = "x-webrun-error";
@@ -854,41 +875,105 @@ async function throwIfPeerError(result, output) {
 */
 async function httpFetch(call, env, body, options = {}) {
 	const codec = options.codec ?? defaultCodec;
+	const { signal } = options;
+	if (signal?.aborted) throw abortReason(signal);
 	const output = call(codec.encodeRequest(env, body));
-	const decoded = await codec.decodeResponse(output, { method: env.method });
-	const release = async () => {
-		try {
-			await output.return?.(void 0);
-		} catch {}
+	let released;
+	const release = () => {
+		released ??= (async () => {
+			try {
+				await output.return?.(void 0);
+			} catch {}
+		})();
+		return released;
+	};
+	let finished = false;
+	const finish = () => {
+		if (finished || released) return;
+		finished = true;
+		if (signal?.aborted) {
+			release();
+			return;
+		}
+		const onAbort = () => void release();
+		signal?.addEventListener("abort", onAbort, { once: true });
+		drain(output).finally(() => signal?.removeEventListener("abort", onAbort));
 	};
+	let decoded;
+	try {
+		decoded = await untilAborted(codec.decodeResponse(output, { method: env.method }), signal);
+	} catch (error) {
+		if (signal?.aborted) release();
+		else await release();
+		throw error;
+	}
 	const result = {
 		envelope: decoded.envelope,
-		body: releasingOnExit(decoded.body, release),
-		release
+		body: releasingOnExit(decoded.body, finish, release),
+		release,
+		finish
 	};
 	await throwIfPeerError(result, output);
 	return result;
 }
+/** `promise`, rejected with the signal's reason if it aborts first. */
+function untilAborted(promise, signal) {
+	if (!signal) return promise;
+	return new Promise((resolve, reject) => {
+		const onAbort = () => reject(abortReason(signal));
+		if (signal.aborted) return onAbort();
+		signal.addEventListener("abort", onAbort, { once: true });
+		promise.then((value) => {
+			signal.removeEventListener("abort", onAbort);
+			resolve(value);
+		}, (error) => {
+			signal.removeEventListener("abort", onAbort);
+			reject(error);
+		});
+	});
+}
+/** The signal's reason as an `Error` (`AbortError` when it gave none). */
+function abortReason(signal) {
+	const reason = signal.reason;
+	if (reason instanceof Error) return reason;
+	const err = new Error(reason === void 0 ? "Aborted" : String(reason));
+	err.name = "AbortError";
+	return err;
+}
 /**
-* `body`, but leaving it before its end releases the call.
+* `body`, ending the call however it is left: read to its end, or left early.
 *
 * The body the codec hands back is a generator of its own over a `ByteReader`,
-* and `.return()` on it never reaches the call's `output` (see
-* `throwIfPeerError` for why the codec must not do that itself). So a caller
-* that stopped reading — an aborted `fetch`, a cancelled response stream —
-* left the peer's producer parked forever, holding its handler open. Safe here
-* for the same reason it is safe in `throwIfPeerError`: `output` is this
-* call's own response-only generator, and the request was fully sent.
+* and its ending never reaches the call's `output` (see `throwIfPeerError` for
+* why the codec must not do that itself). A caller that stopped reading — an
+* aborted `fetch`, a cancelled response stream — left the peer's producer
+* parked forever; and one that read the body to its end left the call itself
+* open, which on a multiplexed transport is one port per exchange until the
+* multiplexer refuses to open more (`maxPorts`).
+*
+* Left early, the call is abandoned (`.return()`): the peer's producer is
+* released. Read to its end, the call is not cut short but read to ITS end, in
+* the background: the peer ends it once its side of the exchange is over,
+* which may be later than the response — a handler that answered before it
+* read the request body is still receiving it (`HttpDataHandlerResult.settled`),
+* and abandoning the call would abort that upload.
 */
-async function* releasingOnExit(body, release) {
+async function* releasingOnExit(body, finish, release) {
 	let completed = false;
 	try {
 		yield* body;
 		completed = true;
 	} finally {
-		if (!completed) await release();
+		if (completed) finish();
+		else await release();
 	}
 }
+/** Reads `output` to its end, discarding what is left, ignoring a failure. */
+async function drain(output) {
+	try {
+		for (let r = await output.next(); !r.done; r = await output.next());
+	} catch {}
+}
 /**
 * Wrap an HTTP handler as a `Duplex` so it can be registered with any
 * `webrun-streams-*` adapter's `serve`.
@@ -916,6 +1001,7 @@ function httpServe(handler, options = {}) {
 		try {
 			yield* replyCodec.encodeResponse(result.envelope, result.body, { method: decoded.envelope.method });
 			completed = true;
+			await result.settled?.();
 		} finally {
 			if (!completed) try {
 				await result.release?.();
@@ -1178,17 +1264,21 @@ async function fetchOverDuplex(call, request, options = {}) {
 		const buffered = new Uint8Array(await request.arrayBuffer());
 		if (buffered.byteLength > 0) body = [buffered];
 	}
-	const { envelope, body: respBody, release } = await httpFetch(call, env, body, options);
+	const { envelope, body: respBody, release, finish } = await httpFetch(call, env, body, {
+		...options,
+		signal: request.signal ?? void 0
+	});
 	const responseInit = {
 		status: envelope.status,
 		statusText: envelope.statusText,
 		headers: forwardableHeaders(envelope.headers)
 	};
 	if (request.method === "HEAD" || request.method === "OPTIONS" || NULL_BODY_STATUSES.has(envelope.status)) {
-		await release?.();
+		if (finish) finish();
+		else await release?.();
 		return new Response(null, responseInit);
 	}
-	return new Response(asyncIterableToReadable(withAbort(respBody, request.signal)), responseInit);
+	return new Response(responseBody(respBody, request.signal, release), responseInit);
 }
 /**
 * Wrap a `(Request) => Promise<Response>` handler as a `Duplex` so it can be
@@ -1200,13 +1290,21 @@ function serveFetchOverDuplex(handler, options = {}) {
 			method: env.method,
 			headers: forwardableHeaders(env.headers)
 		};
+		let upload;
 		if (env.method !== "GET" && env.method !== "HEAD") {
 			if (supportsRequestStreams()) {
-				reqInit.body = asyncIterableToReadable(body);
+				upload = trackingEnd(body);
+				reqInit.body = asyncIterableToReadable(upload.source);
 				reqInit.duplex = "half";
 			} else reqInit.body = await collectBytes(body);
 		}
-		const response = await handler(new Request(env.url, reqInit));
+		const request = new Request(env.url, reqInit);
+		const response = await handler(request);
+		const settled = async () => {
+			if (!upload) return;
+			if (!request.bodyUsed && !request.body?.locked) request.body?.cancel().catch(() => {});
+			await upload.settle(options.requestIdleMs ?? 3e4);
+		};
 		const respEnv = {
 			status: response.status,
 			statusText: response.statusText,
@@ -1216,32 +1314,173 @@ function serveFetchOverDuplex(handler, options = {}) {
 			await response.body?.cancel();
 			return {
 				envelope: respEnv,
-				body: void 0
+				body: void 0,
+				settled
 			};
 		}
 		return {
 			envelope: respEnv,
 			body: response.body ? readableToAsyncIterable(response.body) : void 0,
-			release: () => response.body?.cancel()
+			release: () => response.body?.cancel(),
+			settled
 		};
 	}, options);
 }
-async function* withAbort(iter, signal) {
-	if (!signal) {
-		yield* iter;
-		return;
-	}
-	for await (const chunk of iter) {
-		if (signal.aborted) throw abortReason(signal);
-		yield chunk;
-	}
+/**
+* `source`, and `settle(idleMs)`: resolves once it is done — read to its end,
+* failed, or abandoned (`return()` included before the first `next()`, which a
+* generator's `finally` would not see) — or once nobody has asked it for a
+* chunk for `idleMs`, in which case it is abandoned: later reads fail.
+*
+* Idle counts only while no `next()` is pending: a reader waiting for a slow
+* sender is still reading.
+*/
+function trackingEnd(source) {
+	let end = () => {};
+	let isEnded = false;
+	const ended = new Promise((resolve) => {
+		end = () => {
+			isEnded = true;
+			resolve();
+		};
+	});
+	let abandoned;
+	let pending = 0;
+	let idleSince = Date.now();
+	const it = source[Symbol.asyncIterator]();
+	const abandon = (reason) => {
+		abandoned ??= reason;
+		end();
+		Promise.resolve(it.return?.(void 0)).catch(() => {});
+	};
+	const tracked = {
+		[Symbol.asyncIterator]() {
+			return tracked;
+		},
+		async next() {
+			if (abandoned) throw abandoned;
+			pending++;
+			try {
+				const r = await it.next();
+				if (r.done) end();
+				return r;
+			} catch (error) {
+				end();
+				throw error;
+			} finally {
+				if (--pending === 0) idleSince = Date.now();
+			}
+		},
+		async return(value) {
+			end();
+			try {
+				await it.return?.(value);
+			} catch {}
+			return {
+				done: true,
+				value: void 0
+			};
+		}
+	};
+	asyncDisposable(tracked, () => tracked.return?.() ?? Promise.resolve());
+	const settle = (idleMs) => {
+		if (isEnded || !Number.isFinite(idleMs)) return ended;
+		return new Promise((resolve) => {
+			let timer;
+			const check = () => {
+				if (isEnded) return resolve();
+				const idle = pending === 0 ? Date.now() - idleSince : 0;
+				if (idle >= idleMs) {
+					abandon(/* @__PURE__ */ new Error(`webrun-http-streams: the request body was left unread for ${idleMs} ms after the response; abandoned`));
+					return resolve();
+				}
+				timer = setTimeout(check, Math.max(1, Math.min(idleMs - idle, 1e3)));
+				timer.unref?.();
+			};
+			ended.then(() => {
+				clearTimeout(timer);
+				resolve();
+			});
+			check();
+		});
+	};
+	return {
+		source: tracked,
+		settle
+	};
 }
-function abortReason(signal) {
-	const reason = signal.reason;
-	if (reason instanceof Error) return reason;
-	const err = new Error(reason === void 0 ? "Aborted" : String(reason));
-	err.name = "AbortError";
-	return err;
+/**
+* How long a cancelled body waits for the read in flight before it abandons the call anyway.
+* The read's answer tells a body that has ended (the call is finished: an upload the handler
+* reads after answering goes on) from one that has not; a peer that sends nothing more never
+* answers it. A body whose end comes later than this after the cancel is abandoned too, so a
+* handler still streaming its response and still reading the upload then loses the upload.
+*/
+const CANCEL_GRACE_MS = 1e3;
+/**
+* The response body as a stream that the request's signal can end at any time.
+*
+* An abort errors the stream with the abort's reason at once — a read waiting
+* for a peer that sends nothing more rejects then, not when a next chunk
+* arrives, which may be never — and abandons the call (`release`), so on a
+* multiplexed transport its port is given back whether or not anyone still
+* reads the body. The listener is removed once the body ends, however it ends:
+* read to its end, cancelled, failed or aborted. A body nobody reads or cancels
+* keeps it until the signal aborts (and keeps the call open until then anyway).
+* A cancel abandons the call too — unless the read in flight comes back with the
+* body's end, which finishes it instead (see `cancel`).
+*/
+function responseBody(body, signal, release) {
+	const it = body[Symbol.asyncIterator]();
+	let controller;
+	let ended = false;
+	let reading = false;
+	const end = () => {
+		ended = true;
+		signal?.removeEventListener("abort", onAbort);
+	};
+	const onAbort = () => {
+		if (ended) return;
+		end();
+		try {
+			controller.error(abortReason(signal));
+		} catch {}
+		release?.();
+	};
+	return new ReadableStream({
+		start(c) {
+			controller = c;
+			if (signal?.aborted) onAbort();
+			else signal?.addEventListener("abort", onAbort, { once: true });
+		},
+		async pull(c) {
+			try {
+				reading = true;
+				const { done, value } = await it.next().finally(() => {
+					reading = false;
+				});
+				if (ended) return;
+				if (done) {
+					end();
+					c.close();
+					return;
+				}
+				c.enqueue(value);
+			} catch (err) {
+				if (ended) return;
+				end();
+				c.error(err);
+			}
+		},
+		cancel() {
+			end();
+			const returned = Promise.resolve(it.return?.()).catch(() => {});
+			if (!reading) return;
+			const grace = setTimeout(() => void release?.(), CANCEL_GRACE_MS);
+			grace.unref?.();
+			returned.finally(() => clearTimeout(grace));
+		}
+	});
 }
 //#endregion
 //#region src/duplex-site-builder.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@statewalker/webrun-http-streams",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "private": false,
   "type": "module",
   "description": "HTTP request/response over a webrun-streams Duplex, encoded as HTTP/1.1, plus transport-agnostic fetch stubs",
@@ -30,7 +30,7 @@
     "src"
   ],
   "dependencies": {
-    "@statewalker/webrun-streams": "^0.2.2"
+    "@statewalker/webrun-streams": "^0.2.3"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.15",

package/src/async-dispose.ts

@@ -0,0 +1,22 @@
+/**
+ * Makes `target` disposable with `await using`: installs `dispose` as its
+ * `[Symbol.asyncDispose]`, where the runtime defines the symbol. Hand-written
+ * iterators lose what a native generator gets from `AsyncIteratorPrototype`;
+ * this gives it back. A no-op where the symbol is missing. Kept off the
+ * declared types, which would require consumers to compile with the
+ * `esnext.disposable` lib.
+ */
+export function asyncDisposable<T extends object>(target: T, dispose: () => Promise<unknown>): T {
+  // Read here, not at module level: a top-level read is code a bundler keeps.
+  const asyncDispose = (Symbol as { asyncDispose?: symbol }).asyncDispose;
+  if (asyncDispose && !(asyncDispose in target)) {
+    Object.defineProperty(target, asyncDispose, {
+      value: async () => {
+        await dispose();
+      },
+      configurable: true,
+      writable: true,
+    });
+  }
+  return target;
+}

package/src/bytes.ts

@@ -2,7 +2,7 @@ import type { ByteSource } from "./message.js";
 
 const CR = 0x0d;
 const LF = 0x0a;
-const EMPTY = new Uint8Array(0);
+const EMPTY = /* @__PURE__ */ new Uint8Array(0);
 
 export class ByteStreamError extends Error {
   override readonly name = "ByteStreamError";

package/src/codec-default.ts

@@ -7,7 +7,7 @@ import { newSniffingCodec } from "./sniff.js";
  * Writes HTTP/1.1; accepts HTTP/1.1 or the legacy JSON envelope. Used whenever
  * no `codec` option is supplied.
  */
-export const defaultCodec: MessageCodec = newSniffingCodec({
+export const defaultCodec: MessageCodec = /* @__PURE__ */ newSniffingCodec({
   write: httpCodec,
   accept: [httpCodec, jsonEnvelopeCodec],
 });

package/src/envelope.ts

@@ -15,8 +15,8 @@ const NEWLINE = 0x0a;
 
 /** Mirrors the HTTP/1.1 codec's default `maxHeaderBytes`. */
 const MAX_ENVELOPE_BYTES = 65536;
-const encoder = new TextEncoder();
-const decoder = new TextDecoder();
+const encoder = /* @__PURE__ */ new TextEncoder();
+const decoder = /* @__PURE__ */ new TextDecoder();
 
 /**
  * Encode an HTTP envelope plus optional body as one continuous byte stream:

package/src/fetch.ts

@@ -1,6 +1,7 @@
 import type { Duplex } from "@statewalker/webrun-streams";
+import { asyncDisposable } from "./async-dispose.js";
 import type { RequestEnvelope, ResponseEnvelope } from "./envelope.js";
-import { type HttpDataOptions, httpFetch, httpServe } from "./http-data.js";
+import { abortReason, type HttpDataOptions, httpFetch, httpServe } from "./http-data.js";
 import { NULL_BODY_STATUSES } from "./http-stubs.js";
 import type { ByteSource } from "./message.js";
 import { collectBytes, supportsRequestStreams } from "./request-streams.js";
@@ -10,7 +11,7 @@ import { collectBytes, supportsRequestStreams } from "./request-streams.js";
  * but they are meaningless to a `Request`/`Response`, and re-emitting them
  * from a relay would corrupt its framing.
  */
-const HOP_BY_HOP = new Set([
+const HOP_BY_HOP = /* @__PURE__ */ new Set([
   "connection",
   "host",
   "keep-alive",
@@ -126,24 +127,35 @@ export async function fetchOverDuplex(
     const buffered = new Uint8Array(await request.arrayBuffer());
     if (buffered.byteLength > 0) body = [buffered];
   }
-  const { envelope, body: respBody, release } = await httpFetch(call, env, body, options);
+  const {
+    envelope,
+    body: respBody,
+    release,
+    finish,
+  } = await httpFetch(call, env, body, {
+    ...options,
+    signal: request.signal ?? undefined,
+  });
   const responseInit: ResponseInit = {
     status: envelope.status,
     statusText: envelope.statusText,
     headers: forwardableHeaders(envelope.headers),
   };
   // `new Response(body, { status })` throws for the null-body-status set, and
-  // HEAD/OPTIONS carry no body either, so return a bodyless Response and
-  // release the call: nobody will read the body, so leaving it cannot.
+  // HEAD/OPTIONS carry no body either, so return a bodyless Response. The
+  // caller has taken it in full: the call is finished as for any body read to
+  // its end — not abandoned, which would cut off an upload the handler is
+  // still reading.
   if (
     request.method === "HEAD" ||
     request.method === "OPTIONS" ||
     NULL_BODY_STATUSES.has(envelope.status)
   ) {
-    await release?.();
+    if (finish) finish();
+    else await release?.();
     return new Response(null, responseInit);
   }
-  return new Response(asyncIterableToReadable(withAbort(respBody, request.signal)), responseInit);
+  return new Response(responseBody(respBody, request.signal, release), responseInit);
 }
 
 /**
@@ -159,9 +171,11 @@ export function serveFetchOverDuplex(
       method: env.method,
       headers: forwardableHeaders(env.headers),
     };
+    let upload: ReturnType<typeof trackingEnd> | undefined;
     if (env.method !== "GET" && env.method !== "HEAD") {
       if (supportsRequestStreams()) {
-        reqInit.body = asyncIterableToReadable(body);
+        upload = trackingEnd(body);
+        reqInit.body = asyncIterableToReadable(upload.source);
         (reqInit as RequestInit & { duplex?: string }).duplex = "half";
       } else {
         // Firefox again, and this is the half that fails *silently*. The
@@ -180,6 +194,22 @@ export function serveFetchOverDuplex(
     }
     const request = new Request(env.url, reqInit);
     const response = await handler(request);
+    // Once the response is out, the exchange ends when the handler is done
+    // with the request body too: a handler may answer first and read the
+    // upload afterwards (`202`, then store it). One it never took — not used,
+    // not locked — it will not read: cancel it, and the exchange ends now. One
+    // it took and stopped reading (a reader dropped, a clone nobody reads) is
+    // abandoned once nothing has asked it for a chunk for `requestIdleMs`.
+    const settled = async () => {
+      if (!upload) return;
+      if (!request.bodyUsed && !request.body?.locked) {
+        // Not awaited: the cancel of one branch of a tee (`request.clone()`)
+        // settles only once the other branch is cancelled too, and a clone
+        // nobody reads never is. The idle bound below ends that one.
+        void request.body?.cancel().catch(() => {});
+      }
+      await upload.settle(options.requestIdleMs ?? DEFAULT_REQUEST_IDLE_MS);
+    };
     const respEnv: ResponseEnvelope = {
       status: response.status,
       statusText: response.statusText,
@@ -195,7 +225,7 @@ export function serveFetchOverDuplex(
       NULL_BODY_STATUSES.has(response.status)
     ) {
       await response.body?.cancel();
-      return { envelope: respEnv, body: undefined };
+      return { envelope: respEnv, body: undefined, settled };
     }
     return {
       envelope: respEnv,
@@ -204,28 +234,183 @@ export function serveFetchOverDuplex(
       // through; cancel the stream itself. Once read, it is locked and this
       // rejects, harmlessly: the reader's own cancellation has run.
       release: () => response.body?.cancel(),
+      settled,
     };
   }, options);
 }
 
-async function* withAbort(
-  iter: AsyncIterable<Uint8Array>,
-  signal: AbortSignal | undefined,
-): AsyncGenerator<Uint8Array> {
-  if (!signal) {
-    yield* iter;
-    return;
-  }
-  for await (const chunk of iter) {
-    if (signal.aborted) throw abortReason(signal);
-    yield chunk;
-  }
+/** How long a request body may sit unread after the response before it is abandoned. */
+export const DEFAULT_REQUEST_IDLE_MS = 30_000;
+
+/**
+ * `source`, and `settle(idleMs)`: resolves once it is done — read to its end,
+ * failed, or abandoned (`return()` included before the first `next()`, which a
+ * generator's `finally` would not see) — or once nobody has asked it for a
+ * chunk for `idleMs`, in which case it is abandoned: later reads fail.
+ *
+ * Idle counts only while no `next()` is pending: a reader waiting for a slow
+ * sender is still reading.
+ */
+function trackingEnd(source: AsyncIterable<Uint8Array>): {
+  source: AsyncIterable<Uint8Array>;
+  settle(idleMs: number): Promise<void>;
+} {
+  let end: () => void = () => {};
+  let isEnded = false;
+  const ended = new Promise<void>((resolve) => {
+    end = () => {
+      isEnded = true;
+      resolve();
+    };
+  });
+  let abandoned: Error | undefined;
+  let pending = 0;
+  let idleSince = Date.now();
+  const it = source[Symbol.asyncIterator]();
+  const abandon = (reason: Error) => {
+    abandoned ??= reason;
+    end();
+    void Promise.resolve(it.return?.(undefined)).catch(() => {});
+  };
+  const tracked: AsyncIterableIterator<Uint8Array> = {
+    [Symbol.asyncIterator]() {
+      return tracked;
+    },
+    async next() {
+      if (abandoned) throw abandoned;
+      pending++;
+      try {
+        const r = await it.next();
+        if (r.done) end();
+        return r;
+      } catch (error) {
+        end();
+        throw error;
+      } finally {
+        if (--pending === 0) idleSince = Date.now();
+      }
+    },
+    async return(value?: unknown) {
+      end();
+      try {
+        await it.return?.(value);
+      } catch {
+        /* abandoned either way */
+      }
+      return { done: true, value: undefined };
+    },
+  };
+  asyncDisposable(tracked, () => tracked.return?.() ?? Promise.resolve());
+  const settle = (idleMs: number): Promise<void> => {
+    if (isEnded || !Number.isFinite(idleMs)) return ended;
+    return new Promise<void>((resolve) => {
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      const check = () => {
+        if (isEnded) return resolve();
+        const idle = pending === 0 ? Date.now() - idleSince : 0;
+        if (idle >= idleMs) {
+          abandon(
+            new Error(
+              `webrun-http-streams: the request body was left unread for ${idleMs} ms after the response; abandoned`,
+            ),
+          );
+          return resolve();
+        }
+        timer = setTimeout(check, Math.max(1, Math.min(idleMs - idle, 1_000)));
+        (timer as { unref?: () => void }).unref?.();
+      };
+      void ended.then(() => {
+        clearTimeout(timer);
+        resolve();
+      });
+      check();
+    });
+  };
+  return { source: tracked, settle };
 }
 
-function abortReason(signal: AbortSignal): Error {
-  const reason = (signal as unknown as { reason?: unknown }).reason;
-  if (reason instanceof Error) return reason;
-  const err = new Error(reason === undefined ? "Aborted" : String(reason));
-  err.name = "AbortError";
-  return err;
+/**
+ * How long a cancelled body waits for the read in flight before it abandons the call anyway.
+ * The read's answer tells a body that has ended (the call is finished: an upload the handler
+ * reads after answering goes on) from one that has not; a peer that sends nothing more never
+ * answers it. A body whose end comes later than this after the cancel is abandoned too, so a
+ * handler still streaming its response and still reading the upload then loses the upload.
+ */
+const CANCEL_GRACE_MS = 1_000;
+
+/**
+ * The response body as a stream that the request's signal can end at any time.
+ *
+ * An abort errors the stream with the abort's reason at once — a read waiting
+ * for a peer that sends nothing more rejects then, not when a next chunk
+ * arrives, which may be never — and abandons the call (`release`), so on a
+ * multiplexed transport its port is given back whether or not anyone still
+ * reads the body. The listener is removed once the body ends, however it ends:
+ * read to its end, cancelled, failed or aborted. A body nobody reads or cancels
+ * keeps it until the signal aborts (and keeps the call open until then anyway).
+ * A cancel abandons the call too — unless the read in flight comes back with the
+ * body's end, which finishes it instead (see `cancel`).
+ */
+function responseBody(
+  body: AsyncIterable<Uint8Array>,
+  signal: AbortSignal | undefined,
+  release: (() => Promise<void>) | undefined,
+): ReadableStream<Uint8Array> {
+  const it = body[Symbol.asyncIterator]();
+  let controller!: ReadableStreamDefaultController<Uint8Array>;
+  let ended = false;
+  let reading = false;
+  const end = () => {
+    ended = true;
+    signal?.removeEventListener("abort", onAbort);
+  };
+  const onAbort = () => {
+    if (ended) return;
+    end();
+    try {
+      controller.error(abortReason(signal as AbortSignal));
+    } catch {
+      /* already closed or errored */
+    }
+    void release?.();
+  };
+  return new ReadableStream<Uint8Array>({
+    start(c) {
+      controller = c;
+      if (signal?.aborted) onAbort();
+      else signal?.addEventListener("abort", onAbort, { once: true });
+    },
+    async pull(c) {
+      try {
+        reading = true;
+        const { done, value } = await it.next().finally(() => {
+          reading = false;
+        });
+        if (ended) return; // aborted or cancelled while this read waited
+        if (done) {
+          end();
+          c.close();
+          return;
+        }
+        c.enqueue(value);
+      } catch (err) {
+        if (ended) return;
+        end();
+        c.error(err);
+      }
+    },
+    cancel() {
+      end();
+      const returned = Promise.resolve(it.return?.()).catch(() => {});
+      if (!reading) return; // `it` is at rest: its return abandons the call (releasingOnExit)
+      // A read is in flight, and `it.return()` is queued behind it: that read's answer decides.
+      // The body's end → the call is finished, not abandoned, so an upload the handler reads
+      // after answering goes on; a chunk → the return then abandons the call. A peer that never
+      // answers (sends nothing more, for good) would hold the call forever: abandon it after a
+      // grace, without waiting in `cancel()` either way.
+      const grace = setTimeout(() => void release?.(), CANCEL_GRACE_MS);
+      (grace as { unref?: () => void }).unref?.();
+      void returned.finally(() => clearTimeout(grace));
+    },
+  });
 }

package/src/http-data.ts

@@ -17,6 +17,24 @@ export const PEER_ERROR_HEADER = "x-webrun-error";
 export type HttpDataOptions = {
   /** Wire format. Defaults to `defaultCodec`: writes HTTP/1.1, accepts either. */
   codec?: MessageCodec;
+  /**
+   * `httpFetch` only: aborting it while the response head is awaited releases
+   * the call and rejects with the signal's reason. (Once the head is in, the
+   * body is the caller's to leave.)
+   */
+  signal?: AbortSignal;
+  /**
+   * `serveFetchOverDuplex` only: once the response is out, how long the request
+   * body may go unread before it is abandoned and the exchange ends (default
+   * 30 s). A handler that answers first and reads the upload afterwards keeps
+   * it as long as it keeps reading — the time it spends on one chunk before it
+   * asks for the next counts as idle, so a handler that pauses longer between
+   * reads (one slow write per chunk) needs a larger bound; one that took the
+   * body and dropped it would otherwise keep the exchange — on a multiplexed
+   * transport, its port — open for good. `Infinity` waits for as long as it
+   * takes.
+   */
+  requestIdleMs?: number;
 };
 
 export interface HttpFetchResult {
@@ -30,18 +48,36 @@ export interface HttpFetchResult {
    * custom transports) still type-check; `httpFetch` always sets it.
    */
   release?(): Promise<void>;
+  /**
+   * The caller is done with a response it took in full — read to its end, or
+   * one with no body to read (HEAD, 204, 304...): the call is read to its end
+   * in the background, so the peer ends it once its side is over (it may still
+   * be reading the request body). Reading `body` to its end does this by
+   * itself. Optional, like `release`; `httpFetch` always sets it.
+   */
+  finish?(): void;
 }
 
 export interface HttpDataHandlerResult {
   envelope: ResponseEnvelope;
   body?: ByteSource;
   /**
-   * Called when the caller abandons the response before its end. A body the
-   * codec never started pulling cannot be released through the iterator
-   * protocol (`.return()` on a generator in suspended start does nothing), so
-   * a producer that holds resources says here how to let them go.
+   * Called when the caller abandons the response before its end — never once
+   * the response went out in full. A body the codec never started pulling
+   * cannot be released through the iterator protocol (`.return()` on a
+   * generator in suspended start does nothing), so a producer that holds
+   * resources says here how to let them go.
    */
   release?: () => unknown;
+  /**
+   * Awaited once the response went out in full: the exchange — and with it
+   * the call, and on a multiplexed transport its port — ends when it
+   * resolves. A handler that answers before it has read the request body, and
+   * goes on reading it, resolves this once it is done with it; until then the
+   * caller keeps sending. Left out, the exchange ends with the response, and
+   * the rest of the request is dropped.
+   */
+  settled?: () => Promise<unknown>;
 }
 
 /**
@@ -166,37 +202,114 @@ export async function httpFetch(
   options: HttpDataOptions = {},
 ): Promise<HttpFetchResult> {
   const codec = options.codec ?? defaultCodec;
+  const { signal } = options;
+  if (signal?.aborted) throw abortReason(signal);
   const output = call(codec.encodeRequest(env, body));
-  const decoded = await codec.decodeResponse(output, { method: env.method });
-  const release = async () => {
-    try {
-      await output.return?.(undefined);
-    } catch {
-      /* the call is being abandoned; nothing to report */
+  // The call is one Duplex invocation, and only its own generator's ending
+  // ends it: on a multiplexed transport that `finally` is what frees the
+  // call's port. So every way out of an exchange ends it — the body read to
+  // its end (the call is read to its end too), left early, never started
+  // (bodyless), a peer error, a response that could not be decoded, an abort
+  // while waiting for the head (the call is abandoned).
+  let released: Promise<void> | undefined;
+  const release = () => {
+    released ??= (async () => {
+      try {
+        await output.return?.(undefined);
+      } catch {
+        /* the call is being abandoned; nothing to report */
+      }
+    })();
+    return released;
+  };
+  let finished = false;
+  const finish = () => {
+    if (finished || released) return;
+    finished = true;
+    // The peer ends the call; an abort of the request's signal abandons it
+    // instead (a peer that never ends a call, say).
+    if (signal?.aborted) {
+      void release();
+      return;
     }
+    const onAbort = () => void release();
+    signal?.addEventListener("abort", onAbort, { once: true });
+    void drain(output).finally(() => signal?.removeEventListener("abort", onAbort));
   };
+  let decoded: Awaited<ReturnType<MessageCodec["decodeResponse"]>>;
+  try {
+    decoded = await untilAborted(codec.decodeResponse(output, { method: env.method }), signal);
+  } catch (error) {
+    if (signal?.aborted) {
+      // `.return()` on a generator with a `next()` in flight is queued behind
+      // it: the call ends once the peer answers that `next()`, which an abort
+      // must not wait for.
+      void release();
+    } else {
+      await release();
+    }
+    throw error;
+  }
   const result: HttpFetchResult = {
     envelope: decoded.envelope,
-    body: releasingOnExit(decoded.body, release),
+    body: releasingOnExit(decoded.body, finish, release),
     release,
+    finish,
   };
   await throwIfPeerError(result, output);
   return result;
 }
 
+/** `promise`, rejected with the signal's reason if it aborts first. */
+function untilAborted<T>(promise: Promise<T>, signal: AbortSignal | undefined): Promise<T> {
+  if (!signal) return promise;
+  return new Promise<T>((resolve, reject) => {
+    const onAbort = () => reject(abortReason(signal));
+    if (signal.aborted) return onAbort();
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then(
+      (value) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error);
+      },
+    );
+  });
+}
+
+/** The signal's reason as an `Error` (`AbortError` when it gave none). */
+export function abortReason(signal: AbortSignal): Error {
+  const reason = (signal as unknown as { reason?: unknown }).reason;
+  if (reason instanceof Error) return reason;
+  const err = new Error(reason === undefined ? "Aborted" : String(reason));
+  err.name = "AbortError";
+  return err;
+}
+
 /**
- * `body`, but leaving it before its end releases the call.
+ * `body`, ending the call however it is left: read to its end, or left early.
  *
  * The body the codec hands back is a generator of its own over a `ByteReader`,
- * and `.return()` on it never reaches the call's `output` (see
- * `throwIfPeerError` for why the codec must not do that itself). So a caller
- * that stopped reading — an aborted `fetch`, a cancelled response stream —
- * left the peer's producer parked forever, holding its handler open. Safe here
- * for the same reason it is safe in `throwIfPeerError`: `output` is this
- * call's own response-only generator, and the request was fully sent.
+ * and its ending never reaches the call's `output` (see `throwIfPeerError` for
+ * why the codec must not do that itself). A caller that stopped reading — an
+ * aborted `fetch`, a cancelled response stream — left the peer's producer
+ * parked forever; and one that read the body to its end left the call itself
+ * open, which on a multiplexed transport is one port per exchange until the
+ * multiplexer refuses to open more (`maxPorts`).
+ *
+ * Left early, the call is abandoned (`.return()`): the peer's producer is
+ * released. Read to its end, the call is not cut short but read to ITS end, in
+ * the background: the peer ends it once its side of the exchange is over,
+ * which may be later than the response — a handler that answered before it
+ * read the request body is still receiving it (`HttpDataHandlerResult.settled`),
+ * and abandoning the call would abort that upload.
  */
 async function* releasingOnExit(
   body: AsyncIterable<Uint8Array>,
+  finish: () => void,
   release: () => Promise<void>,
 ): AsyncGenerator<Uint8Array> {
   let completed = false;
@@ -204,7 +317,17 @@ async function* releasingOnExit(
     yield* body;
     completed = true;
   } finally {
-    if (!completed) await release();
+    if (completed) finish();
+    else await release();
+  }
+}
+
+/** Reads `output` to its end, discarding what is left, ignoring a failure. */
+async function drain(output: AsyncGenerator<Uint8Array>): Promise<void> {
+  try {
+    for (let r = await output.next(); !r.done; r = await output.next());
+  } catch {
+    /* the exchange is over for this side; how the peer ended it is its own */
   }
 }
 
@@ -254,6 +377,7 @@ export function httpServe(handler: HttpDataHandler, options: HttpDataOptions = {
         method: decoded.envelope.method,
       });
       completed = true;
+      await result.settled?.();
     } finally {
       if (!completed) {
         try {

package/src/http-stubs.ts

@@ -44,7 +44,7 @@ export type HttpHandler = (request: Request) => Response | Promise<Response>;
 // Statuses that MUST NOT carry a body — `new Response(body, { status })` throws
 // for these (per the Fetch spec's "null body status" set). Exported so
 // `fetch.ts` mirrors this exact set rather than redefining it.
-export const NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);
+export const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
 
 const REQUEST_FIELDS = [
   "url",

package/src/http1/chunked.ts

@@ -4,9 +4,9 @@ import type { ByteSource } from "../message.js";
 import { HttpParseError } from "./errors.js";
 import { decodeLatin1 } from "./headers.js";
 
-const CRLF = new Uint8Array([0x0d, 0x0a]);
-const LAST_CHUNK = new Uint8Array([0x30, 0x0d, 0x0a, 0x0d, 0x0a]); // "0\r\n\r\n"
-const encoder = new TextEncoder();
+const CRLF = /* @__PURE__ */ new Uint8Array([0x0d, 0x0a]);
+const LAST_CHUNK = /* @__PURE__ */ new Uint8Array([0x30, 0x0d, 0x0a, 0x0d, 0x0a]); // "0\r\n\r\n"
+const encoder = /* @__PURE__ */ new TextEncoder();
 
 /**
  * Chunk sizes are written in HEXADECIMAL — a 21-byte chunk is `15`. Writing

package/src/http1/decode.ts

@@ -15,7 +15,7 @@ import {
   resolveFraming,
 } from "./headers.js";
 
-const VERSIONS = new Set(["HTTP/1.1", "HTTP/1.0"]);
+const VERSIONS = /* @__PURE__ */ new Set(["HTTP/1.1", "HTTP/1.0"]);
 const ABSOLUTE_FORM = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//;
 
 /**

package/src/http1/headers.ts

@@ -3,7 +3,7 @@ import { HttpParseError } from "./errors.js";
 
 export type HeaderList = [string, string][];
 
-const TCHAR = new Set(
+const TCHAR = /* @__PURE__ */ new Set(
   "!#$%&'*+-.^_`|~0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ",
 );
 

package/src/http1/index.ts

@@ -36,5 +36,5 @@ export function newHttpCodec(options: HttpCodecOptions = {}): MessageCodec {
   };
 }
 
-export const httpCodec: MessageCodec = newHttpCodec();
+export const httpCodec: MessageCodec = /* @__PURE__ */ newHttpCodec();
 export { HttpParseError } from "./errors.js";