@statewalker/webrun-rpc 0.7.0 → 0.8.0

package/README.md

@@ -298,6 +298,7 @@ port cannot grow memory here.
 | `signal` | The transport's life. On abort the mux closes with `signal.reason`; an already-aborted signal gives a closed mux. See below. |
 | `window` | Per-port flow control in bytes, off when unset. See "A port with a window holds only its own bytes" below. |
 | `frameSize` | Fair framing in bytes, off when unset; needs `window`. See "Large messages take turns with small ones" below. |
+| `maxReassembledBytes` | Ceiling on what the peer's framed messages hold past their ports' windows, summed over all ports, default `DEFAULT_MAX_REASSEMBLED_BYTES` (64 MiB). Past it, or past what a port's window leaves, the port closes. See "Large messages take turns with small ones" below. |
 | `keepalive` | `{ intervalMs, misses? }`, off when unset: ping the peer and close the mux after `misses` unanswered pings from a peer that answered before. See "A port lives until its transport or its user lets go" below. |
 | `onLeak` | Development aid, off when unset: called with a port's `PortInfo` when its consumer dropped it without `close()`, and the port is freed. See "A port lives until its transport or its user lets go" below. |
 
@@ -374,11 +375,35 @@ frames of messages posted together interleave.
 It also needs `window` and byte codecs (`encode` / `decode`) on both ends. A side frames only on a
 port whose window is in force with exact sizes agreed (`exact: true` in the `open` and in its
 acknowledgement), and accepts frames only there; a frame anywhere else is dropped. An older peer,
-or one whose codec cannot decode, gets whole messages. A frame sequence buffers no more than the
-same message sent whole would. If the pipe's `whenDrained()` rejects, the mux closes with that
+or one whose codec cannot decode, gets whole messages. If the pipe's `whenDrained()` rejects, the mux closes with that
 error, so the ports waiting behind it fail instead of hanging. 16-64 KiB frames cost one small envelope each (about 15 bytes with
 `msgpackCodec`).
 
+**A peer cannot make this side hold frames without limit.** Two limits apply as frames arrive:
+
+- a message begun while this side still owed the port credit (delivered or consumed bytes not yet
+  granted back) must fit what the window left, since an honest sender counts at least that much as
+  outstanding; one begun with nothing owed may be larger than the window, as a whole message may;
+- what messages larger than the window hold past it, summed across every port, is at most
+  `maxReassembledBytes` (64 MiB by default), so opening many ports does not multiply it. A partial
+  message within its window is not charged: the window bounds it already, as it bounds unframed
+  traffic, so many ports framing honest messages at once never trip the cap.
+
+A frame past either limit closes its port: the partial message is dropped, the port's close signal
+aborts with a `RangeError` ("webrun-rpc: a framed message passed what the window left …" or
+"… passed maxReassembledBytes …"), and the peer's port closes as on any peer close. On the wire
+the close carries reason `"max-reassembled-bytes"`. A port that closes with messages still queued
+sends them whole, not framed, so they never trip the window check on the way out.
+
+The cap is the receiver's: a sender with `frameSize` that frames a message more than the
+peer's `maxReassembledBytes` past the window has its port closed, where the same message sent whole would arrive.
+Set it above the largest message the peer legitimately frames; a message just past it looks like
+a closed port, not a lost message.
+
+Frames carry no sequence number. Reassembly relies on what every `MessageTarget` already
+promises: an ordered, reliable pipe. Each port's frames leave from its own queue in order, and
+other ports' frames interleave but are told apart by port id.
+
 `openPort(meta?)` allocates a port, announces it and returns the local end without waiting for the
 peer to accept. That keeps layer 1 free of round trips: messages posted before a rejection are
 dropped at the far end and the port goes inert. It is asynchronous because a natively multiplexed
@@ -589,6 +614,12 @@ caller without one does not.
 An abort unwinds a producing handler through `iter.return()`, not by throwing into it. A handler's
 `catch` never sees the abort reason; only `finally` runs. Put cleanup in `finally`.
 
+`serve` forwards that `return()` to the handler's output at once, even while the handler is still
+working on its first chunk, with or without `maxMessageSize` (whose chunker would queue it too). Its own tracking wrapper would otherwise queue it behind that pending
+`next()`, as any async generator does. A handler that wraps its output to watch for `return()`
+therefore sees the abandonment when it happens, not when it next yields:
+`@statewalker/webrun-http-streams` aborts the served `Request.signal` that way.
+
 ### `transferPortMux` moves real ports
 
 Each `openPort` creates a `MessageChannel`, posts `{ type: PORT_TRANSFER, meta }` with one end in

package/dist/connect-serve.d.ts

@@ -86,6 +86,8 @@ export interface OverPipeOptions {
     window?: number;
     /** Fair framing in bytes — see `PortMuxOptions.frameSize`. */
     frameSize?: number;
+    /** Ceiling on a message reassembled from frames — see `PortMuxOptions.maxReassembledBytes`. */
+    maxReassembledBytes?: number;
     /** Liveness of the peer by ping/pong — see `PortMuxOptions.keepalive`. */
     keepalive?: {
         intervalMs: number;

package/dist/connect-serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-serve.d.ts","sourceRoot":"","sources":["../src/connect-serve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAU,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAM1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAW1E,uEAAuE;AACvE,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7E,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;OAUG;IACH,GAAG,EAAE,cAAc,CAAC;IACpB;;;yEAGqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,EAAE,OAAO,CAAC,UAAU,CAyCvC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,UAAU,CAqDnC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,KAAK,EAAE,SAAS,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,WAAW,GAAG,WAAW,CAAC;IACjC,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,SAAS,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,6FAA6F;IAC7F,MAAM,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;CACnC;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,GAAG,cAAc,CAEtF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,CAEjE"}
+{"version":3,"file":"connect-serve.d.ts","sourceRoot":"","sources":["../src/connect-serve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAU,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAM1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAW1E,uEAAuE;AACvE,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7E,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;OAUG;IACH,GAAG,EAAE,cAAc,CAAC;IACpB;;;yEAGqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,EAAE,OAAO,CAAC,UAAU,CAyCvC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,UAAU,CA8DnC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,KAAK,EAAE,SAAS,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,WAAW,GAAG,WAAW,CAAC;IACjC,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,SAAS,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,6FAA6F;IAC7F,MAAM,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;CACnC;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,GAAG,cAAc,CAEtF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,CAEjE"}

package/dist/index.d.ts

@@ -10,7 +10,7 @@ export * from "./io-send.js";
 export * from "./listen-bidi.js";
 export * from "./listen-port.js";
 export * from "./message-target.js";
-export { DEFAULT_MAX_PORTS, MUX_CLOSED_MESSAGE, multiplexPort } from "./multiplex-port.js";
+export { DEFAULT_MAX_PORTS, DEFAULT_MAX_REASSEMBLED_BYTES, MUX_CLOSED_MESSAGE, multiplexPort, } from "./multiplex-port.js";
 export { type PortSendState, portBufferedAmount, whenPortReady } from "./port-credit.js";
 export type { OpenPortOptions, PortCodec, PortEnvelope, PortInfo, PortMux, PortMuxOptions, } from "./port-types.js";
 export * from "./recieve.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EACL,OAAO,EACP,KAAK,MAAM,EACX,KAAK,eAAe,EACpB,QAAQ,EACR,SAAS,EACT,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,GACN,MAAM,oBAAoB,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAAE,KAAK,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzF,YAAY,EACV,eAAe,EACf,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,OAAO,EACP,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,cAAc,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EACL,OAAO,EACP,KAAK,MAAM,EACX,KAAK,eAAe,EACpB,QAAQ,EACR,SAAS,EACT,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,GACN,MAAM,oBAAoB,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,kBAAkB,EAClB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzF,YAAY,EACV,eAAe,EACf,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,OAAO,EACP,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,cAAc,wBAAwB,CAAC"}

package/dist/index.js

@@ -825,7 +825,11 @@ function receiveChunks(port, channelName, controller, touch) {
 * outstanding at a time (spec D11/D12), with no per-chunk deadline (spec D8).
 */
 async function sendChunks(port, channelName, output, { maxMessageSize, log }, signal, touch) {
-	const stream = throughAbort(maxMessageSize ? toChunks(maxMessageSize)(output) : output, signal);
+	const framed = maxMessageSize ? toChunks(maxMessageSize)(output) : output;
+	const stream = throughAbort(framed, signal);
+	const producer = output;
+	const returnProducer = () => void Promise.resolve(producer.return?.()).catch(() => {});
+	if (framed !== output) signal.addEventListener("abort", returnProducer, { once: true });
 	try {
 		await sendIterator(async ({ done, value, error }) => {
 			if (signal.aborted) return;
@@ -849,6 +853,8 @@ async function sendChunks(port, channelName, output, { maxMessageSize, log }, si
 	} catch (err) {
 		if (signal.aborted) return;
 		throw err;
+	} finally {
+		signal.removeEventListener("abort", returnProducer);
 	}
 }
 //#endregion
@@ -984,6 +990,8 @@ const KEEPALIVE_ID = Number.MAX_SAFE_INTEGER;
 const MAX_TIMER_MS = 2 ** 31 - 1;
 /** Ceiling on concurrently open virtual ports. Bounds the id table only. */
 const DEFAULT_MAX_PORTS = 1024;
+/** Default ceiling on one message reassembled from frames (`maxReassembledBytes`). */
+const DEFAULT_MAX_REASSEMBLED_BYTES = 67108864;
 /**
 * What a message costs a port's window when the codec cannot say
 * (`PortCodec.encode`): its bytes and string lengths, found in its values up
@@ -1013,10 +1021,18 @@ function estimateMessageSize(payload) {
 */
 function multiplexPort(port, options) {
 	const { codec, onPort, side = "initiator", maxPorts = DEFAULT_MAX_PORTS, maxMessageSize, signal, window, frameSize, keepalive, onLeak } = options;
+	const maxReassembledBytes = options.maxReassembledBytes ?? 67108864;
 	const misses = keepalive?.misses ?? 3;
 	if (keepalive && !(Number.isFinite(keepalive.intervalMs) && keepalive.intervalMs > 0 && keepalive.intervalMs <= MAX_TIMER_MS && Number.isSafeInteger(misses) && misses > 0)) throw new RangeError(`webrun-rpc: keepalive needs an intervalMs in (0, ${MAX_TIMER_MS}] and a positive integer misses`);
 	if (frameSize != null && !(Number.isSafeInteger(frameSize) && frameSize > 0)) throw new RangeError(`webrun-rpc: frameSize must be a positive integer, got ${frameSize}`);
+	if (!(Number.isSafeInteger(maxReassembledBytes) && maxReassembledBytes > 0)) throw new RangeError(`webrun-rpc: maxReassembledBytes must be a positive integer, got ${maxReassembledBytes}`);
 	const open = /* @__PURE__ */ new Map();
+	let reassembling = 0;
+	const freePartial = (entry) => {
+		if (!entry?.partial) return;
+		reassembling -= entry.partial.charged;
+		entry.partial = void 0;
+	};
 	const leaks = onLeak ? new FinalizationRegistry(({ id, record, release }) => {
 		const entry = open.get(id);
 		if (entry?.handle !== record) return;
@@ -1164,12 +1180,12 @@ function multiplexPort(port, options) {
 				...envelope,
 				payload: structuredClone(payload, { transfer })
 			} : void 0;
-			const send = () => {
+			const send = (whole = false) => {
 				if (!bytes) {
 					sendOnPort(id, held ? () => post(held) : () => post(envelope, transfer));
 					return;
 				}
-				if (frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
+				if (!whole && frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
 					for (let at = 0; at < bytes.byteLength; at += frameSize) {
 						const data = bytes.subarray(at, at + frameSize);
 						const frame = at + frameSize >= bytes.byteLength ? {
@@ -1199,10 +1215,11 @@ function multiplexPort(port, options) {
 			record.markClosed(reason);
 		});
 		function release(reason) {
+			freePartial(open.get(id));
 			open.delete(id);
 			leaks?.unregister(record);
 			if (c?.queue.length) {
-				for (const item of c.queue.splice(0)) item.send();
+				for (const item of c.queue.splice(0)) item.send(true);
 				c.queued = 0;
 			}
 			sendOnPort(id, () => post({
@@ -1341,15 +1358,38 @@ function multiplexPort(port, options) {
 		if (envelope.type === "frame") {
 			if (!entry?.credit?.exact || !codec.decode || !(envelope.data instanceof Uint8Array)) return;
 			touch(envelope.id);
+			const c = entry.credit;
+			const owed = c.unconsumed + c.toGrant;
 			const partial = entry.partial ?? {
 				chunks: [],
-				bytes: 0
+				bytes: 0,
+				owed,
+				charged: 0,
+				...owed > 0 ? { room: c.window - owed } : {}
 			};
 			entry.partial = partial;
+			const size = envelope.data.byteLength;
+			const charged = partial.room == null ? Math.max(0, partial.bytes + size - c.window) : 0;
+			const overrun = partial.room != null && partial.bytes + size > partial.room ? `what the window left (${partial.room} of ${c.window} bytes, ${partial.owed} still owed)` : reassembling - partial.charged + charged > maxReassembledBytes ? `maxReassembledBytes (${maxReassembledBytes} bytes past the window, across all ports)` : void 0;
+			if (overrun) {
+				freePartial(entry);
+				dropOutgoing(envelope.id);
+				open.delete(envelope.id);
+				releaseWaiters(c);
+				entry.handle.markClosed(/* @__PURE__ */ new RangeError(`webrun-rpc: a framed message passed ${overrun}`));
+				post({
+					type: "close",
+					id: envelope.id,
+					reason: "max-reassembled-bytes"
+				});
+				return;
+			}
+			partial.bytes += size;
+			reassembling += charged - partial.charged;
+			partial.charged = charged;
 			partial.chunks.push(envelope.data);
-			partial.bytes += envelope.data.byteLength;
 			if (!envelope.last) return;
-			entry.partial = void 0;
+			freePartial(entry);
 			const whole = new Uint8Array(partial.bytes);
 			let at = 0;
 			for (const chunk of partial.chunks) {
@@ -1363,6 +1403,7 @@ function multiplexPort(port, options) {
 		}
 		dropOutgoing(envelope.id);
 		if (!entry) return;
+		freePartial(entry);
 		open.delete(envelope.id);
 		releaseWaiters(entry.credit);
 		entry.handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the peer closed the port"));
@@ -1555,14 +1596,17 @@ const serve = async ({ mux: factory, timeout }, handler) => {
 	const mux = await factory((port) => {
 		let off;
 		let finished = false;
-		const tracked = (input) => (async function* () {
-			try {
-				yield* handler(input);
-			} finally {
-				finished = true;
-				if (off) live.delete(off);
-			}
-		})();
+		const tracked = (input) => {
+			const output = handler(input);
+			return returningAtOnce((async function* () {
+				try {
+					yield* output;
+				} finally {
+					finished = true;
+					if (off) live.delete(off);
+				}
+			})(), () => void output.return(void 0).catch(() => {}));
+		};
 		off = serveDuplexOverPort(port, tracked, streamOptions);
 		if (!finished) live.add(off);
 	});
@@ -1780,4 +1824,4 @@ function transferPortMux(target, options = {}) {
 	};
 }
 //#endregion
-export { CANCEL_CHANNEL_TYPE, DEFAULT_MAX_PORTS, MUX_CLOSED_MESSAGE, NO_TIMEOUT, PORT_TRANSFER, STREAM_ABORT, byteChannelFromMessagePort, callBidi, callPort, connect, duplexOverPort, getPortCloseSignal, ioHandle, ioSend, listenBidi, listenCancelChannel, listenPort, multiplexPort, overPipe, overPorts, portBufferedAmount, postCancelChannel, recieve, send, serve, serveDuplexOverPort, setPortCloseSignal, structuredCodec, transferPortMux, whenPortReady };
+export { CANCEL_CHANNEL_TYPE, DEFAULT_MAX_PORTS, DEFAULT_MAX_REASSEMBLED_BYTES, MUX_CLOSED_MESSAGE, NO_TIMEOUT, PORT_TRANSFER, STREAM_ABORT, byteChannelFromMessagePort, callBidi, callPort, connect, duplexOverPort, getPortCloseSignal, ioHandle, ioSend, listenBidi, listenCancelChannel, listenPort, multiplexPort, overPipe, overPorts, portBufferedAmount, postCancelChannel, recieve, send, serve, serveDuplexOverPort, setPortCloseSignal, structuredCodec, transferPortMux, whenPortReady };

package/dist/multiplex-port.d.ts

@@ -7,6 +7,8 @@ import type { PortInfo, PortMux, PortMuxOptions } from "./port-types.js";
 export declare const MUX_CLOSED_MESSAGE = "webrun-rpc: the multiplexer was closed";
 /** Ceiling on concurrently open virtual ports. Bounds the id table only. */
 export declare const DEFAULT_MAX_PORTS = 1024;
+/** Default ceiling on one message reassembled from frames (`maxReassembledBytes`). */
+export declare const DEFAULT_MAX_REASSEMBLED_BYTES: number;
 /**
  * What a message costs a port's window when the codec cannot say
  * (`PortCodec.encode`): its bytes and string lengths, found in its values up

package/dist/multiplex-port.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"multiplex-port.d.ts","sourceRoot":"","sources":["../src/multiplex-port.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAGV,QAAQ,EACR,OAAO,EACP,cAAc,EACf,MAAM,iBAAiB,CAAC;AAGzB;;;GAGG;AACH,eAAO,MAAM,kBAAkB,2CAA2C,CAAC;AAY3E,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAEtC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAc5D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,cAAc,GACtB,OAAO,GAAG;IAAE,KAAK,IAAI,QAAQ,EAAE,CAAA;CAAE,CAqnBnC"}
+{"version":3,"file":"multiplex-port.d.ts","sourceRoot":"","sources":["../src/multiplex-port.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAGV,QAAQ,EACR,OAAO,EACP,cAAc,EACf,MAAM,iBAAiB,CAAC;AAGzB;;;GAGG;AACH,eAAO,MAAM,kBAAkB,2CAA2C,CAAC;AAY3E,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAEtC,sFAAsF;AACtF,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAc5D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,cAAc,GACtB,OAAO,GAAG;IAAE,KAAK,IAAI,QAAQ,EAAE,CAAA;CAAE,CA0rBnC"}

package/dist/port-types.d.ts

@@ -147,6 +147,19 @@ export interface PortMuxOptions {
      * whole. 16-64 KiB is a reasonable range.
      */
     frameSize?: number;
+    /**
+     * Ceiling, in bytes, on what this side holds of a peer's framed messages
+     * past their ports' windows, summed over all ports (default 64 MiB).
+     * A partial message counts against its port's window as it arrives: one
+     * begun while this side still owed credit must fit what the window left,
+     * and one begun with nothing owed may pass the window, its excess charged
+     * to this cap. A frame past either limit makes the mux drop that port's
+     * partial message, close the port with a `RangeError` and send the peer a
+     * close with reason `"max-reassembled-bytes"`. A framed message more than
+     * this cap past the window never arrives, though the same message sent
+     * whole would.
+     */
+    maxReassembledBytes?: number;
     /**
      * Liveness of the peer (off when unset). Every `intervalMs` the mux pings
      * and the peer answers; anything from it counts as an answer. After `misses`

package/dist/port-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"port-types.d.ts","sourceRoot":"","sources":["../src/port-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE;AACjD,gFAAgF;GAC9E;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE;AAChE,8EAA8E;GAC5E;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE;AACjE,oGAAoG;GAClG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,iDAAiD;IACjD,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACnF,6EAA6E;IAC7E,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,GAAG,SAAS,CAAC;IACpD;;;;;OAKG;IACH,MAAM,CAAC,CAAC,QAAQ,EAAE,YAAY,GAAG,UAAU,CAAC;IAC5C,gFAAgF;IAChF,MAAM,CAAC,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAAC;CAClD;AAED,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,KAAK,EAAE,SAAS,CAAC;IACjB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;IACtE;;;OAGG;IACH,IAAI,CAAC,EAAE,WAAW,GAAG,WAAW,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;CACnC;AAED,wDAAwD;AACxD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,mCAAmC;AACnC,MAAM,WAAW,OAAO;IACtB,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5E;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,0DAA0D;IAC1D,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;IACrB,iDAAiD;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC"}
+{"version":3,"file":"port-types.d.ts","sourceRoot":"","sources":["../src/port-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE;AACjD,gFAAgF;GAC9E;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE;AAChE,8EAA8E;GAC5E;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE;AACjE,oGAAoG;GAClG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,iDAAiD;IACjD,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACnF,6EAA6E;IAC7E,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,GAAG,SAAS,CAAC;IACpD;;;;;OAKG;IACH,MAAM,CAAC,CAAC,QAAQ,EAAE,YAAY,GAAG,UAAU,CAAC;IAC5C,gFAAgF;IAChF,MAAM,CAAC,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAAC;CAClD;AAED,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,KAAK,EAAE,SAAS,CAAC;IACjB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;IACtE;;;OAGG;IACH,IAAI,CAAC,EAAE,WAAW,GAAG,WAAW,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;CACnC;AAED,wDAAwD;AACxD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,mCAAmC;AACnC,MAAM,WAAW,OAAO;IACtB,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5E;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,0DAA0D;IAC1D,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;IACrB,iDAAiD;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@statewalker/webrun-rpc",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "private": false,
   "type": "module",
   "description": "Ports and RPC over them: a port multiplexer, and typed request/response and streaming primitives over any MessageTarget.",

package/src/connect-serve.ts

@@ -139,15 +139,24 @@ export const serve: Serve<PortParams> = async ({ mux: factory, timeout }, handle
     // reaches it as `return()` through `throughAbort`, so the `finally` runs
     // on every ending — normal exhaustion, handler throw, peer abort, local
     // teardown. `serveDuplexOverPort` reports no completion of its own.
-    const tracked: Duplex = (input) =>
-      (async function* () {
-        try {
-          yield* handler(input);
-        } finally {
-          finished = true;
-          if (off) live.delete(off);
-        }
-      })();
+    const tracked: Duplex = (input) => {
+      const output = handler(input);
+      // `return()` on this wrapper is queued behind its pending `next()`, as on
+      // any async generator, so the abandonment would reach the handler only
+      // once it answers. Forwarded at once, a handler still waiting (an HTTP
+      // long poll) learns now that its caller left.
+      return returningAtOnce(
+        (async function* () {
+          try {
+            yield* output;
+          } finally {
+            finished = true;
+            if (off) live.delete(off);
+          }
+        })(),
+        () => void output.return(undefined).catch(() => {}),
+      );
+    };
     off = serveDuplexOverPort(port, tracked, streamOptions);
     // `serveDuplexOverPort` invokes the handler synchronously. The generator
     // body above is lazy, so today it cannot have finished by the time `off`
@@ -201,6 +210,8 @@ export interface OverPipeOptions {
   window?: number;
   /** Fair framing in bytes — see `PortMuxOptions.frameSize`. */
   frameSize?: number;
+  /** Ceiling on a message reassembled from frames — see `PortMuxOptions.maxReassembledBytes`. */
+  maxReassembledBytes?: number;
   /** Liveness of the peer by ping/pong — see `PortMuxOptions.keepalive`. */
   keepalive?: { intervalMs: number; misses?: number };
   /** Development aid: report ports dropped without `close()` — see `PortMuxOptions.onLeak`. */

package/src/duplex-over-port.ts

@@ -481,6 +481,12 @@ async function sendChunks(
 ): Promise<void> {
   const framed = maxMessageSize ? toChunks(maxMessageSize)(output) : output;
   const stream = throughAbort(framed, signal);
+  // `throughAbort` returns `framed`; when chunking wraps the output, that
+  // `return()` is queued behind the chunker's pending `next()`, so the abort
+  // would reach the producer only once it yields. Return the producer itself.
+  const producer = output as Partial<AsyncIterator<Uint8Array>>;
+  const returnProducer = () => void Promise.resolve(producer.return?.()).catch(() => {});
+  if (framed !== output) signal.addEventListener("abort", returnProducer, { once: true });
   try {
     await sendIterator<Uint8Array>(async ({ done, value, error }) => {
       if (signal.aborted) return;
@@ -502,5 +508,7 @@ async function sendChunks(
     // anything else is a genuine transport failure worth surfacing.
     if (signal.aborted) return;
     throw err;
+  } finally {
+    signal.removeEventListener("abort", returnProducer);
   }
 }

package/src/index.ts

@@ -21,7 +21,12 @@ export * from "./io-send.js";
 export * from "./listen-bidi.js";
 export * from "./listen-port.js";
 export * from "./message-target.js";
-export { DEFAULT_MAX_PORTS, MUX_CLOSED_MESSAGE, multiplexPort } from "./multiplex-port.js";
+export {
+  DEFAULT_MAX_PORTS,
+  DEFAULT_MAX_REASSEMBLED_BYTES,
+  MUX_CLOSED_MESSAGE,
+  multiplexPort,
+} from "./multiplex-port.js";
 export { type PortSendState, portBufferedAmount, whenPortReady } from "./port-credit.js";
 export type {
   OpenPortOptions,

package/src/multiplex-port.ts

@@ -29,6 +29,9 @@ const MAX_TIMER_MS = 2 ** 31 - 1;
 /** Ceiling on concurrently open virtual ports. Bounds the id table only. */
 export const DEFAULT_MAX_PORTS = 1024;
 
+/** Default ceiling on one message reassembled from frames (`maxReassembledBytes`). */
+export const DEFAULT_MAX_REASSEMBLED_BYTES = 64 * 1024 * 1024;
+
 /**
  * What a message costs a port's window when the codec cannot say
  * (`PortCodec.encode`): its bytes and string lengths, found in its values up
@@ -73,6 +76,7 @@ export function multiplexPort(
     keepalive,
     onLeak,
   } = options;
+  const maxReassembledBytes = options.maxReassembledBytes ?? DEFAULT_MAX_REASSEMBLED_BYTES;
   const misses = keepalive?.misses ?? 3;
   if (
     keepalive &&
@@ -92,6 +96,11 @@ export function multiplexPort(
   if (frameSize != null && !(Number.isSafeInteger(frameSize) && frameSize > 0)) {
     throw new RangeError(`webrun-rpc: frameSize must be a positive integer, got ${frameSize}`);
   }
+  if (!(Number.isSafeInteger(maxReassembledBytes) && maxReassembledBytes > 0)) {
+    throw new RangeError(
+      `webrun-rpc: maxReassembledBytes must be a positive integer, got ${maxReassembledBytes}`,
+    );
+  }
 
   /**
    * Flow control of one port (`PortMuxOptions.window`): the send side's queue
@@ -117,7 +126,7 @@ export function multiplexPort(
      */
     exact: boolean;
     outstanding: number;
-    queue: { send: () => void; size: number }[];
+    queue: { send: (whole?: boolean) => void; size: number }[];
     queued: number;
     unconsumed: number;
     waiters: { below: number; resolve: () => void }[];
@@ -138,10 +147,28 @@ export function multiplexPort(
   interface Entry extends PortInfo {
     handle: PortRecord;
     credit?: Credit;
-    /** The frames of a message still arriving. */
-    partial?: { chunks: Uint8Array[]; bytes: number };
+    /**
+     * The frames of a message still arriving. `room`: what the window left
+     * when the first came, if anything was still owed back then. `charged`:
+     * its bytes past the window, counted in `reassembling`.
+     */
+    partial?: {
+      chunks: Uint8Array[];
+      bytes: number;
+      room?: number;
+      owed: number;
+      charged: number;
+    };
   }
   const open = new Map<number, Entry>();
+  // Bytes of partial messages held past their port's window, across every
+  // port (`maxReassembledBytes`). What fits a window is bounded by it already.
+  let reassembling = 0;
+  const freePartial = (entry: Entry | undefined): void => {
+    if (!entry?.partial) return;
+    reassembling -= entry.partial.charged;
+    entry.partial = undefined;
+  };
   // A port collected while still open: report it, then free its slot on both
   // ends as its close would. Only with `onLeak` — a registry costs per port.
   const leaks = onLeak
@@ -346,14 +373,22 @@ export function multiplexPort(
           !bytes && waits
             ? { ...envelope, payload: structuredClone(payload, { transfer }) }
             : undefined;
-        const send = (): void => {
+        // `whole`: at close, what is still queued leaves past the window, and
+        // a frame past the window is what the peer refuses (`maxReassembledBytes`).
+        const send = (whole = false): void => {
           if (!bytes) {
             sendOnPort(id, held ? () => post(held) : () => post(envelope, transfer));
             return;
           }
           // Frames only once the peer has acknowledged exact sizing: before
           // that, it may be a peer that cannot reassemble them.
-          if (frameSize != null && c.enforced && c.exact && bytes.byteLength > frameSize) {
+          if (
+            !whole &&
+            frameSize != null &&
+            c.enforced &&
+            c.exact &&
+            bytes.byteLength > frameSize
+          ) {
             for (let at = 0; at < bytes.byteLength; at += frameSize) {
               const data = bytes.subarray(at, at + frameSize);
               const frame: PortEnvelope =
@@ -376,6 +411,7 @@ export function multiplexPort(
       },
     );
     function release(reason: unknown): void {
+      freePartial(open.get(id));
       open.delete(id);
       leaks?.unregister(record);
       // What is queued goes out now, before the close and regardless of the
@@ -384,7 +420,7 @@ export function multiplexPort(
       // kept for a port nobody holds. Without a window it would all have
       // gone out at once anyway.
       if (c?.queue.length) {
-        for (const item of c.queue.splice(0)) item.send();
+        for (const item of c.queue.splice(0)) item.send(true);
         c.queued = 0;
       }
       // Behind this port's frames, so the peer gets the whole message first.
@@ -520,16 +556,51 @@ export function multiplexPort(
 
     if (envelope.type === "frame") {
       // Only where this end advertised exact sizing — the one place a peer may
-      // frame. A frame sequence buffers no more than the same message sent
-      // whole, which a byte transport would also have to hold entire.
+      // frame. What a partial message may hold is bounded below, so frames
+      // that never end cannot make this side buffer without limit.
       if (!entry?.credit?.exact || !codec.decode || !(envelope.data instanceof Uint8Array)) return;
       touch(envelope.id);
-      const partial = entry.partial ?? { chunks: [], bytes: 0 };
+      const c = entry.credit;
+      // What this side still owes back (delivered and unconsumed, or consumed
+      // and not yet granted) is never more than what the sender counted as
+      // outstanding. So an honest sender starts a message only when owed plus
+      // the message fits the window, or when nothing is owed at all: a message
+      // larger than the window, bounded by `maxReassembledBytes` alone.
+      const owed = c.unconsumed + c.toGrant;
+      const partial = entry.partial ?? {
+        chunks: [],
+        bytes: 0,
+        owed,
+        charged: 0,
+        ...(owed > 0 ? { room: c.window - owed } : {}),
+      };
       entry.partial = partial;
+      const size = envelope.data.byteLength;
+      // Only a message begun with nothing owed may pass the window; what it
+      // holds past it is what the cap, shared by all ports, bounds.
+      const charged = partial.room == null ? Math.max(0, partial.bytes + size - c.window) : 0;
+      const overrun =
+        partial.room != null && partial.bytes + size > partial.room
+          ? `what the window left (${partial.room} of ${c.window} bytes, ${partial.owed} still owed)`
+          : reassembling - partial.charged + charged > maxReassembledBytes
+            ? `maxReassembledBytes (${maxReassembledBytes} bytes past the window, across all ports)`
+            : undefined;
+      if (overrun) {
+        // A peer that frames past what it may send: hold none of it.
+        freePartial(entry);
+        dropOutgoing(envelope.id);
+        open.delete(envelope.id);
+        releaseWaiters(c);
+        entry.handle.markClosed(new RangeError(`webrun-rpc: a framed message passed ${overrun}`));
+        post({ type: "close", id: envelope.id, reason: "max-reassembled-bytes" });
+        return;
+      }
+      partial.bytes += size;
+      reassembling += charged - partial.charged;
+      partial.charged = charged;
       partial.chunks.push(envelope.data);
-      partial.bytes += envelope.data.byteLength;
       if (!envelope.last) return;
-      entry.partial = undefined;
+      freePartial(entry);
       const whole = new Uint8Array(partial.bytes);
       let at = 0;
       for (const chunk of partial.chunks) {
@@ -545,6 +616,7 @@ export function multiplexPort(
     // The peer closed the port: whatever it still had to receive is moot.
     dropOutgoing(envelope.id);
     if (!entry) return;
+    freePartial(entry);
     open.delete(envelope.id);
     releaseWaiters(entry.credit);
     entry.handle.markClosed(new Error("webrun-rpc: the peer closed the port"));

package/src/port-types.ts

@@ -124,6 +124,19 @@ export interface PortMuxOptions {
    * whole. 16-64 KiB is a reasonable range.
    */
   frameSize?: number;
+  /**
+   * Ceiling, in bytes, on what this side holds of a peer's framed messages
+   * past their ports' windows, summed over all ports (default 64 MiB).
+   * A partial message counts against its port's window as it arrives: one
+   * begun while this side still owed credit must fit what the window left,
+   * and one begun with nothing owed may pass the window, its excess charged
+   * to this cap. A frame past either limit makes the mux drop that port's
+   * partial message, close the port with a `RangeError` and send the peer a
+   * close with reason `"max-reassembled-bytes"`. A framed message more than
+   * this cap past the window never arrives, though the same message sent
+   * whole would.
+   */
+  maxReassembledBytes?: number;
   /**
    * Liveness of the peer (off when unset). Every `intervalMs` the mux pings
    * and the peer answers; anything from it counts as an answer. After `misses`