webloom-framework 0.4.1 → 0.4.2

package/dist/{chunk-ANA6GBEI.js → chunk-XVD7ALPV.js}

@@ -1,4 +1,171 @@
-import { createRuntimeMessageCodec, normalizeRuntimeLimits, createRuntimeBudget, WebLoomError, validateTransferList, DEFAULT_RUNTIME_LIMITS, capabilityKey, createReceivePortLedger, RUNTIME_CALL_TYPE, RUNTIME_CANCEL_TYPE, RUNTIME_CREDIT_TYPE, RUNTIME_SNAPSHOT_TYPE, RUNTIME_ERROR_TYPE, RUNTIME_RESULT_TYPE, RUNTIME_ERROR_MESSAGE_TYPE, RUNTIME_NEXT_TYPE, RUNTIME_PROTOCOL_VERSION, validateDto, cloneFrozenAttributes, hostForWindowApp, RuntimeUnavailableError, validateRawDto, validateTransferListWithStats, assertReceivedPortSet } from './chunk-HJKPKWI7.js';
+import { createRuntimeMessageCodec, normalizeRuntimeLimits, createRuntimeBudget, WebLoomError, validateTransferList, DEFAULT_RUNTIME_LIMITS, capabilityKey, RUNTIME_PROTOCOL_VERSION, RUNTIME_CLOSE_TYPE, createReceivePortLedger, RUNTIME_CLOSE_ACK_TYPE, RUNTIME_CALL_TYPE, RUNTIME_CANCEL_TYPE, RUNTIME_CREDIT_TYPE, RUNTIME_SNAPSHOT_TYPE, RUNTIME_ERROR_TYPE, RUNTIME_RESULT_TYPE, RUNTIME_ERROR_MESSAGE_TYPE, RUNTIME_NEXT_TYPE, validateDto, cloneFrozenAttributes, hostForWindowApp, RuntimeUnavailableError, validateRawDto, validateTransferListWithStats, assertReceivedPortSet } from './chunk-CKML74MG.js';
+
+// src/runtime/runtimeSession.ts
+var DEFAULT_RUNTIME_DRAIN_TIMEOUT_MS = 2e3;
+function validText(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= 256;
+}
+function isRuntimeEndpointBinding(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const candidate = value;
+  return validText(candidate.runtimeInstanceId) && validText(candidate.connectionId);
+}
+function sameRuntimeEndpointBinding(left, right) {
+  return left !== void 0 && right !== void 0 && left.runtimeInstanceId === right.runtimeInstanceId && left.connectionId === right.connectionId;
+}
+function copyBinding(value) {
+  return Object.freeze({ runtimeInstanceId: value.runtimeInstanceId, connectionId: value.connectionId });
+}
+function createRuntimeEndpointBinding(runtimeInstanceId) {
+  let connectionId;
+  try {
+    connectionId = typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? `connection:${crypto.randomUUID()}` : `connection:${Date.now().toString(36)}:${Math.random().toString(36).slice(2)}`;
+  } catch {
+    connectionId = `connection:${Date.now().toString(36)}:${Math.random().toString(36).slice(2)}`;
+  }
+  if (!validText(runtimeInstanceId)) throw new TypeError("Runtime endpoint requires a valid runtimeInstanceId");
+  return copyBinding({ runtimeInstanceId, connectionId });
+}
+function createRuntimeEndpointSession(binding, options = {}) {
+  if (!isRuntimeEndpointBinding(binding)) throw new TypeError("Runtime endpoint binding is invalid");
+  const localBinding = copyBinding(binding);
+  const beginCloseListeners = /* @__PURE__ */ new Set();
+  const closedListeners = /* @__PURE__ */ new Set();
+  const participants = /* @__PURE__ */ new Set();
+  const defaultTimeout = options.defaultDrainTimeoutMs ?? DEFAULT_RUNTIME_DRAIN_TIMEOUT_MS;
+  if (!Number.isFinite(defaultTimeout) || defaultTimeout < 1 || defaultTimeout > 3e5) {
+    throw new TypeError("defaultDrainTimeoutMs must be a finite number from 1 to 300000");
+  }
+  let state = "active";
+  let remoteBindingValue;
+  let closeReasonValue;
+  let drainPromise;
+  const session = {
+    binding: localBinding,
+    maxDrainTimeoutMs: defaultTimeout,
+    get remoteBinding() {
+      return remoteBindingValue;
+    },
+    get state() {
+      return state;
+    },
+    get closeReason() {
+      return closeReasonValue;
+    },
+    acceptRemoteBinding(value) {
+      if (!isRuntimeEndpointBinding(value) || state === "closed") return false;
+      const next = copyBinding(value);
+      if (remoteBindingValue === void 0) {
+        remoteBindingValue = next;
+        return true;
+      }
+      return sameRuntimeEndpointBinding(remoteBindingValue, next);
+    },
+    beginClose(reason = "Runtime endpoint closing") {
+      if (state !== "active") return;
+      state = "closing";
+      closeReasonValue = reason.slice(0, 256);
+      for (const listener of [...beginCloseListeners]) {
+        try {
+          listener(closeReasonValue);
+        } catch {
+        }
+      }
+    },
+    drain(timeoutMs2 = defaultTimeout) {
+      if (!Number.isFinite(timeoutMs2) || timeoutMs2 < 1 || timeoutMs2 > 3e5) {
+        return Promise.reject(new TypeError("drain timeoutMs must be a finite number from 1 to 300000"));
+      }
+      if (drainPromise) return drainPromise;
+      const currentParticipants = [...participants];
+      if (state === "closed") {
+        const pendingExecutions = currentParticipants.reduce((total, participant) => {
+          try {
+            return total + Math.max(0, participant.pending());
+          } catch {
+            return total;
+          }
+        }, 0);
+        const result = {
+          state,
+          drained: pendingExecutions === 0,
+          timedOut: pendingExecutions !== 0,
+          pendingExecutions
+        };
+        drainPromise = Promise.resolve(result);
+        return drainPromise;
+      }
+      if (state === "active") session.beginClose("Runtime endpoint drain requested");
+      drainPromise = new Promise((resolve) => {
+        let settled = false;
+        const settle = (timedOut, failed) => {
+          if (settled) return;
+          settled = true;
+          if (timer !== void 0) clearTimeout(timer);
+          const pendingExecutions = currentParticipants.reduce((total, participant) => {
+            try {
+              return total + Math.max(0, participant.pending());
+            } catch {
+              return total;
+            }
+          }, 0);
+          resolve({ state, drained: !timedOut && !failed && pendingExecutions === 0, timedOut, pendingExecutions });
+        };
+        const effectiveTimeout = Math.min(timeoutMs2, defaultTimeout);
+        const timer = setTimeout(() => settle(true, false), effectiveTimeout);
+        void Promise.allSettled(currentParticipants.map((participant) => {
+          try {
+            return participant.drain();
+          } catch (error) {
+            return Promise.reject(error);
+          }
+        })).then((results) => settle(false, results.some((result) => result.status === "rejected")));
+      });
+      return drainPromise;
+    },
+    close() {
+      if (state === "closed") return;
+      if (state === "active") session.beginClose("Runtime endpoint physically closed");
+      state = "closed";
+      for (const listener of [...closedListeners]) {
+        try {
+          listener();
+        } catch {
+        }
+      }
+      beginCloseListeners.clear();
+      closedListeners.clear();
+    },
+    onBeginClose(listener) {
+      if (state !== "active") {
+        try {
+          listener(closeReasonValue ?? "Runtime endpoint closing");
+        } catch {
+        }
+        return () => void 0;
+      }
+      beginCloseListeners.add(listener);
+      return () => beginCloseListeners.delete(listener);
+    },
+    onClosed(listener) {
+      if (state === "closed") {
+        try {
+          listener();
+        } catch {
+        }
+        return () => void 0;
+      }
+      closedListeners.add(listener);
+      return () => closedListeners.delete(listener);
+    },
+    registerDrainParticipant(participant) {
+      if (state === "closed") return () => void 0;
+      participants.add(participant);
+      return () => participants.delete(participant);
+    }
+  };
+  return session;
+}
 
 // src/transport/serviceBridge.ts
 function id(prefix) {
@@ -73,11 +240,15 @@ function createCapabilityBridge(options) {
   const codec = createRuntimeMessageCodec();
   const limits = normalizeRuntimeLimits(options.limits);
   const budget = options.budget ?? createRuntimeBudget(limits);
+  const session = options.session ?? createRuntimeEndpointSession(options.binding ?? createRuntimeEndpointBinding(`bridge:${id("runtime")}`), { defaultDrainTimeoutMs: options.drainTimeoutMs });
+  if (options.binding && !sameRuntimeEndpointBinding(options.binding, session.binding)) throw new TypeError("Capability bridge binding disagrees with endpoint session");
+  const localBinding = session.binding;
   const listeners = /* @__PURE__ */ new Set();
   const pending = /* @__PURE__ */ new Map();
   const streams = /* @__PURE__ */ new Map();
   const waitingCalls = /* @__PURE__ */ new Set();
   const callbackExecutions = /* @__PURE__ */ new Set();
+  const executionDrainWaiters = /* @__PURE__ */ new Set();
   const proxies = /* @__PURE__ */ new Map();
   const clients = /* @__PURE__ */ new Map();
   let pendingCount = 0;
@@ -91,6 +262,11 @@ function createCapabilityBridge(options) {
   let appliedSnapshotFingerprint;
   let currentServices = [];
   let disposed = false;
+  let closeMessageSent = false;
+  let closeAckWaiter;
+  let receivedCloseAck;
+  let closeAckSent = false;
+  let drainPromise;
   let reservedStreamCount = 0;
   const defaultTimeout = timeoutMs(options.defaultCallTimeoutMs, 3e4);
   const emit = () => {
@@ -143,6 +319,10 @@ function createCapabilityBridge(options) {
     peerRetainedPayloadBytes = Math.max(0, peerRetainedPayloadBytes - record.item.budgetBytes);
     budget.retainedPayloadBytes = Math.max(0, budget.retainedPayloadBytes - record.item.budgetBytes);
     budget.releaseExecutionSlot();
+    if (callbackExecutions.size === 0) {
+      for (const resolve of [...executionDrainWaiters]) resolve();
+      executionDrainWaiters.clear();
+    }
     emit();
   };
   const releaseQueueItem = (item) => {
@@ -165,7 +345,7 @@ function createCapabilityBridge(options) {
     if (entry.cancelSent) return;
     entry.cancelSent = true;
     try {
-      options.transport.send({ type: RUNTIME_CANCEL_TYPE, protocolVersion: RUNTIME_PROTOCOL_VERSION, callId: entry.callId, serviceInstanceId: entry.reference.serviceInstanceId });
+      options.transport.send({ type: RUNTIME_CANCEL_TYPE, protocolVersion: RUNTIME_PROTOCOL_VERSION, binding: localBinding, callId: entry.callId, serviceInstanceId: entry.reference.serviceInstanceId });
     } catch {
     }
     try {
@@ -244,6 +424,7 @@ function createCapabilityBridge(options) {
   const findService = (capability) => currentServices.find((service) => serviceMatches(service, capability));
   const terminalError = (proxy, capability) => {
     if (terminalFailure && !disposed) return frameworkError(terminalFailure.code, terminalFailure.phase, contextFor(capability, proxy.bound));
+    if (session.state !== "active") return frameworkError("service_revoked", "dispose", contextFor(capability, proxy.bound));
     if (disposed || proxy.revoked) return frameworkError("service_revoked", "dispatch", contextFor(capability, proxy.bound));
     if (currentState === "stale" || currentState === "disposed") return frameworkError("service_revoked", "dispatch", contextFor(capability, proxy.bound));
     if (proxy.bound && !currentServices.some((service) => serviceKey(service) === serviceKey(proxy.bound) && service.serviceInstanceId === proxy.bound?.serviceInstanceId)) {
@@ -334,7 +515,7 @@ function createCapabilityBridge(options) {
         return;
       }
       try {
-        sendWire({ type: RUNTIME_CALL_TYPE, protocolVersion: RUNTIME_PROTOCOL_VERSION, callId, capabilityId: entry.capability.id, contractVersion: entry.capability.version, serviceInstanceId: reference.serviceInstanceId, mode: "unary", timeoutMs: timeout, request: prepared.value, ...callOptions.operationId !== void 0 ? { operationId: callOptions.operationId } : {} }, prepared.transfer);
+        sendWire({ type: RUNTIME_CALL_TYPE, protocolVersion: RUNTIME_PROTOCOL_VERSION, binding: localBinding, callId, capabilityId: entry.capability.id, contractVersion: entry.capability.version, serviceInstanceId: reference.serviceInstanceId, mode: "unary", timeoutMs: timeout, request: prepared.value, ...reference.grantId !== void 0 ? { grantId: reference.grantId } : {}, ...callOptions.operationId !== void 0 ? { operationId: callOptions.operationId } : {} }, prepared.transfer);
       } catch {
         settleUnary(entry, frameworkError("request_clone_failed", "dispatch", contextFor(entry.capability, reference)));
       }
@@ -509,7 +690,7 @@ function createCapabilityBridge(options) {
       return { ready, closed, cancel };
     }
     try {
-      sendWire({ type: RUNTIME_CALL_TYPE, protocolVersion: RUNTIME_PROTOCOL_VERSION, callId, capabilityId: entry.capability.id, contractVersion: entry.capability.version, serviceInstanceId: reference.serviceInstanceId, mode: "stream", timeoutMs: timeout, request: prepared.value, initialCredit: window, ...optionsForSubscribe.operationId !== void 0 ? { operationId: optionsForSubscribe.operationId } : {} }, prepared.transfer);
+      sendWire({ type: RUNTIME_CALL_TYPE, protocolVersion: RUNTIME_PROTOCOL_VERSION, binding: localBinding, callId, capabilityId: entry.capability.id, contractVersion: entry.capability.version, serviceInstanceId: reference.serviceInstanceId, mode: "stream", timeoutMs: timeout, request: prepared.value, initialCredit: window, ...reference.grantId !== void 0 ? { grantId: reference.grantId } : {}, ...optionsForSubscribe.operationId !== void 0 ? { operationId: optionsForSubscribe.operationId } : {} }, prepared.transfer);
     } catch {
       terminateStream(entry, frameworkError("request_clone_failed", "dispatch", contextFor(entry.capability, reference)), false);
     }
@@ -652,7 +833,7 @@ function createCapabilityBridge(options) {
             if (stream.state === "active" && !stream.doneReceived) {
               stream.credit += 1;
               try {
-                sendWire({ type: RUNTIME_CREDIT_TYPE, protocolVersion: RUNTIME_PROTOCOL_VERSION, callId: stream.callId, serviceInstanceId: stream.reference.serviceInstanceId, count: 1 });
+                sendWire({ type: RUNTIME_CREDIT_TYPE, protocolVersion: RUNTIME_PROTOCOL_VERSION, binding: localBinding, callId: stream.callId, serviceInstanceId: stream.reference.serviceInstanceId, count: 1 });
               } catch {
                 terminateStream(stream, frameworkError("transport_unavailable", "dispatch", contextFor(stream.capability, stream.reference)), true);
                 break;
@@ -682,6 +863,14 @@ function createCapabilityBridge(options) {
       terminateStream(stream, frameworkError("handler_failed", "execute", contextFor(stream.capability, stream.reference)), true);
     });
   };
+  const drainCallbackExecutions = () => {
+    if (callbackExecutions.size === 0) return Promise.resolve();
+    return new Promise((resolve) => executionDrainWaiters.add(resolve));
+  };
+  session.registerDrainParticipant({
+    drain: drainCallbackExecutions,
+    pending: () => callbackExecutions.size
+  });
   const invalidate = (reason = "remote service directory replaced", terminalCause) => {
     if (terminalCause) {
       for (const record of [...waitingCalls]) record.fail(errorWithTerminalCause(terminalCause, record.proxy.capability, record.proxy.bound));
@@ -706,10 +895,81 @@ function createCapabilityBridge(options) {
     if (disposed) return;
     terminalFailure = frameworkError(code, "receive");
     invalidate(reason, terminalFailure);
+    session.beginClose(reason);
     try {
       options.transport.close?.();
     } catch {
     }
+    session.close();
+  };
+  const removeSessionBeginClose = session.onBeginClose((reason) => {
+    if (!disposed) invalidate(reason);
+  });
+  const bounded = async (promise, fallback, deadline) => {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) return fallback;
+    return Promise.race([promise, new Promise((resolve) => setTimeout(() => resolve(fallback), remaining))]);
+  };
+  const beginClose = (reason = "Runtime bridge closing") => {
+    session.beginClose(reason);
+  };
+  const drain = (requestedTimeoutMs = DEFAULT_RUNTIME_DRAIN_TIMEOUT_MS) => {
+    if (drainPromise) return drainPromise;
+    if (!Number.isFinite(requestedTimeoutMs) || requestedTimeoutMs < 1 || requestedTimeoutMs > 3e5) {
+      return Promise.reject(new TypeError("drain timeoutMs must be a finite number from 1 to 300000"));
+    }
+    const alreadyClosed = session.state === "closed";
+    beginClose("Runtime bridge drain requested");
+    const effectiveTimeout = Math.min(requestedTimeoutMs, session.maxDrainTimeoutMs);
+    const deadline = Date.now() + effectiveTimeout;
+    const localDrain = session.drain(effectiveTimeout);
+    if (alreadyClosed) {
+      drainPromise = (async () => {
+        const localFallback = {
+          state: session.state,
+          drained: false,
+          timedOut: true,
+          pendingExecutions: callbackExecutions.size
+        };
+        return bounded(localDrain, localFallback, deadline);
+      })();
+      return drainPromise;
+    }
+    const ackPromise = receivedCloseAck ? Promise.resolve(receivedCloseAck) : new Promise((resolve) => {
+      closeAckWaiter = { resolve };
+    });
+    if (!closeMessageSent) {
+      try {
+        sendWire({
+          type: RUNTIME_CLOSE_TYPE,
+          protocolVersion: RUNTIME_PROTOCOL_VERSION,
+          binding: localBinding,
+          timeoutMs: effectiveTimeout
+        });
+        closeMessageSent = true;
+      } catch {
+        closeAckWaiter = void 0;
+      }
+    }
+    drainPromise = (async () => {
+      const localFallback = {
+        state: session.state,
+        drained: false,
+        timedOut: true,
+        pendingExecutions: callbackExecutions.size
+      };
+      const local = await bounded(localDrain, localFallback, deadline);
+      const ack = await bounded(ackPromise, void 0, deadline);
+      if (ack === void 0) closeAckWaiter = void 0;
+      const timedOut = local.timedOut || !ack || ack.timedOut;
+      return {
+        state: session.state,
+        drained: local.drained && !!ack && ack.drained,
+        timedOut,
+        pendingExecutions: local.pendingExecutions + (ack?.pendingExecutions ?? 0)
+      };
+    })();
+    return drainPromise;
   };
   const onMessage = (message, metadata) => {
     const ledger = metadata?.ledger ?? createReceivePortLedger(metadata?.ports, { limits, phase: "receive" });
@@ -718,9 +978,7 @@ function createCapabilityBridge(options) {
       return;
     }
     try {
-      if (!metadata?.decoded) {
-        message = codec.decode(message);
-      }
+      if (!metadata?.decoded) message = codec.decode(message);
     } catch (error) {
       ledger.closeUndelivered();
       if (error instanceof WebLoomError && error.code === "protocol_mismatch") {
@@ -731,6 +989,60 @@ function createCapabilityBridge(options) {
       return;
     }
     try {
+      const bindingAccepted = session.acceptRemoteBinding(message.binding);
+      const closedKnownCloseAck = !bindingAccepted && session.state === "closed" && message.type === RUNTIME_CLOSE_ACK_TYPE && sameRuntimeEndpointBinding(session.remoteBinding, message.binding);
+      if (!bindingAccepted && !closedKnownCloseAck) {
+        ledger.closeUndelivered();
+        failClose("Runtime endpoint binding mismatch", "invalid_message");
+        return;
+      }
+      if (message.type === RUNTIME_CLOSE_TYPE) {
+        ledger.closeUndelivered();
+        session.beginClose("Remote Runtime endpoint closing");
+        const timeout = Math.min(message.timeoutMs ?? session.maxDrainTimeoutMs, session.maxDrainTimeoutMs);
+        void session.drain(timeout).then((result) => {
+          if (closeAckSent) return;
+          closeAckSent = true;
+          try {
+            sendWire({
+              type: RUNTIME_CLOSE_ACK_TYPE,
+              protocolVersion: RUNTIME_PROTOCOL_VERSION,
+              binding: localBinding,
+              acknowledgedBinding: message.binding,
+              drained: result.drained,
+              timedOut: result.timedOut,
+              pendingExecutions: result.pendingExecutions
+            });
+          } catch {
+          }
+          session.close();
+          setTimeout(() => {
+            try {
+              options.transport.close?.();
+            } catch {
+            }
+          }, 10);
+        });
+        return;
+      }
+      if (message.type === RUNTIME_CLOSE_ACK_TYPE) {
+        ledger.closeUndelivered();
+        if (!sameRuntimeEndpointBinding(message.acknowledgedBinding, localBinding)) {
+          failClose("Runtime close acknowledgement binding mismatch", "invalid_message");
+          return;
+        }
+        const result = {
+          state: session.state,
+          drained: message.drained,
+          timedOut: message.timedOut,
+          pendingExecutions: message.pendingExecutions
+        };
+        receivedCloseAck = result;
+        const waiter = closeAckWaiter;
+        closeAckWaiter = void 0;
+        waiter?.resolve(result);
+        return;
+      }
       if (message.type === RUNTIME_CALL_TYPE || message.type === RUNTIME_CANCEL_TYPE || message.type === RUNTIME_CREDIT_TYPE) return;
       if (message.type === RUNTIME_SNAPSHOT_TYPE) {
         if (ledger.ports.length > 0) throw frameworkError("transfer_invalid", "receive");
@@ -886,10 +1198,13 @@ function createCapabilityBridge(options) {
     if (disposed) return { accepted: false, reason: "disposed" };
     if (!snapshot || typeof snapshot !== "object") return { accepted: false, reason: "invalid-snapshot" };
     if (snapshot.protocolVersion !== RUNTIME_PROTOCOL_VERSION) return { accepted: false, reason: "protocol-mismatch" };
+    const binding = snapshot.binding;
+    if (!session.acceptRemoteBinding(binding)) return { accepted: false, reason: "invalid-snapshot" };
     try {
       if (snapshot.units.length > limits.maxSnapshotUnits || snapshot.services.length > limits.maxSnapshotServices) return { accepted: false, reason: "invalid-snapshot" };
-      codec.encode({ ...snapshot, type: RUNTIME_SNAPSHOT_TYPE });
-      validateDto(snapshot, { limits: { maxDepth: limits.maxDtoDepth, maxNodes: limits.maxDtoNodes, maxEdges: limits.maxDtoEdges, maxBudgetBytes: limits.maxMessageBudgetBytes }, phase: "receive" });
+      const wireSnapshot = { ...snapshot, type: RUNTIME_SNAPSHOT_TYPE };
+      codec.encode(wireSnapshot);
+      validateDto(wireSnapshot, { limits: { maxDepth: limits.maxDtoDepth, maxNodes: limits.maxDtoNodes, maxEdges: limits.maxDtoEdges, maxBudgetBytes: limits.maxMessageBudgetBytes }, phase: "receive" });
     } catch {
       return { accepted: false, reason: "invalid-snapshot" };
     }
@@ -953,6 +1268,12 @@ function createCapabilityBridge(options) {
     get runtimeKind() {
       return remoteRuntimeKind;
     },
+    get binding() {
+      return localBinding;
+    },
+    get endpointState() {
+      return session.state;
+    },
     getClient(capability, scope) {
       const key = `${capability.kind}\0${capability.id}\0${capability.version}\0${scope?.identity.scopeId ?? "root"}`;
       let proxy = proxies.get(key);
@@ -973,13 +1294,18 @@ function createCapabilityBridge(options) {
       invalidate(reason);
       currentState = "stale";
     },
+    beginClose,
+    drain,
     dispose(reason = "Runtime bridge disposed") {
       if (disposed) return;
+      session.beginClose(reason);
       disposed = true;
       invalidate(reason);
       removeTransport();
       removeTransportError?.();
       options.transport.close?.();
+      session.close();
+      removeSessionBeginClose();
       currentState = "disposed";
       emit();
     },
@@ -1116,9 +1442,14 @@ function createMessagePortServiceProvider(options) {
   const configuredTransport = options.transport ?? (options.port ? createMessagePortRuntimeTransport(options.port, { limits }) : void 0);
   if (!configuredTransport) throw new TypeError("MessagePort service provider requires transport or port");
   const transport = configuredTransport;
+  const ownsSession = options.session === void 0;
+  const session = options.session ?? createRuntimeEndpointSession(options.binding ?? createRuntimeEndpointBinding(`provider:${Date.now().toString(36)}`), { defaultDrainTimeoutMs: options.drainTimeoutMs });
+  if (options.binding && !sameRuntimeEndpointBinding(options.binding, session.binding)) throw new TypeError("MessagePort service provider binding disagrees with endpoint session");
+  const localBinding = session.binding;
   const activeCalls = /* @__PURE__ */ new Map();
   const streams = /* @__PURE__ */ new Map();
   const executionSlots = /* @__PURE__ */ new Map();
+  const executionDrainWaiters = /* @__PURE__ */ new Set();
   let peerRetainedPayloadBytes = 0;
   let disposed = false;
   const serviceFor = (message) => options.services().find((service) => service.kind === (message.mode === "stream" ? "stream" : "rpc") && service.capabilityId === message.capabilityId && service.contractVersion === message.contractVersion && service.serviceInstanceId === message.serviceInstanceId);
@@ -1130,6 +1461,7 @@ function createMessagePortServiceProvider(options) {
     post(transport, codec, {
       type: RUNTIME_ERROR_MESSAGE_TYPE,
       protocolVersion: RUNTIME_PROTOCOL_VERSION,
+      binding: localBinding,
       callId: call.callId,
       serviceInstanceId: call.serviceInstanceId,
       error: { code, message: safeErrorMessage(code), phase }
@@ -1144,6 +1476,10 @@ function createMessagePortServiceProvider(options) {
     budget.retainedPayloadBytes = Math.max(0, budget.retainedPayloadBytes - active.requestBytes);
     active.removePeerRevoke?.();
     active.removePeerRevoke = void 0;
+    if (executionSlots.size === 0) {
+      for (const resolve of [...executionDrainWaiters]) resolve();
+      executionDrainWaiters.clear();
+    }
   };
   const releaseStreamReservation = (active) => {
     if (!active.streamReserved) return;
@@ -1297,7 +1633,7 @@ function createMessagePortServiceProvider(options) {
         if (entry.closed || entry.active.cancelled) break;
         if (next.done) {
           entry.iteratorDone = true;
-          if (post(transport, codec, { type: RUNTIME_RESULT_TYPE, protocolVersion: RUNTIME_PROTOCOL_VERSION, callId: entry.call.callId, serviceInstanceId: entry.reference.serviceInstanceId, done: true })) closeStream(entry, true);
+          if (post(transport, codec, { type: RUNTIME_RESULT_TYPE, protocolVersion: RUNTIME_PROTOCOL_VERSION, binding: localBinding, callId: entry.call.callId, serviceInstanceId: entry.reference.serviceInstanceId, done: true })) closeStream(entry, true);
           else {
             sendError(entry.call, "transport_unavailable", "receive");
             closeStream(entry, true);
@@ -1307,7 +1643,7 @@ function createMessagePortServiceProvider(options) {
         try {
           const prepared = options.prepareItem?.(next.value, entry.call) ?? { value: next.value };
           const output = prepareOutput(prepared);
-          if (!post(transport, codec, { type: RUNTIME_NEXT_TYPE, protocolVersion: RUNTIME_PROTOCOL_VERSION, callId: entry.call.callId, serviceInstanceId: entry.reference.serviceInstanceId, sequence: entry.sequence, item: output.value }, output.transfer)) {
+          if (!post(transport, codec, { type: RUNTIME_NEXT_TYPE, protocolVersion: RUNTIME_PROTOCOL_VERSION, binding: localBinding, callId: entry.call.callId, serviceInstanceId: entry.reference.serviceInstanceId, sequence: entry.sequence, item: output.value }, output.transfer)) {
             sendError(entry.call, "response_clone_failed", "receive");
             closeStream(entry);
             break;
@@ -1332,6 +1668,20 @@ function createMessagePortServiceProvider(options) {
       failClose();
       return;
     }
+    try {
+      if (!metadata?.decoded) message = codec.decode(message);
+    } catch {
+      ledger.closeUndelivered();
+      failClose();
+      return;
+    }
+    const bindingAccepted = session.acceptRemoteBinding(message.binding);
+    const closedKnownControl = !bindingAccepted && session.state === "closed" && sameRuntimeEndpointBinding(session.remoteBinding, message.binding);
+    if (!bindingAccepted && !closedKnownControl) {
+      ledger.closeUndelivered();
+      failClose();
+      return;
+    }
     if (message.type === RUNTIME_CANCEL_TYPE) {
       ledger.closeUndelivered();
       const active2 = activeCalls.get(message.callId) ?? streams.get(message.callId)?.active;
@@ -1353,6 +1703,11 @@ function createMessagePortServiceProvider(options) {
       return;
     }
     if (message.type !== RUNTIME_CALL_TYPE) return;
+    if (session.state !== "active" || disposed) {
+      ledger.closeUndelivered();
+      sendError(message, "service_revoked", "dispose");
+      return;
+    }
     const reference = serviceFor(message);
     if (!reference) {
       ledger.closeUndelivered();
@@ -1364,7 +1719,7 @@ function createMessagePortServiceProvider(options) {
       sendError(message, "invalid_message", "dispatch");
       return;
     }
-    if (message.grantId !== void 0 && message.grantId !== reference.grantId) {
+    if (message.grantId !== reference.grantId) {
       ledger.closeUndelivered();
       sendError(message, "permission_denied", "dispatch");
       return;
@@ -1403,7 +1758,7 @@ function createMessagePortServiceProvider(options) {
           releaseExecution(active);
           return;
         }
-        const result = await options.handleCall({ message: active.call, request: request.value, reference, signal: controller.signal, deadlineAt: active.deadlineAt, peer: callPeer });
+        const result = await options.handleCall({ message: active.call, request: request.value, reference, signal: controller.signal, deadlineAt: active.deadlineAt, binding: active.call.binding, peer: callPeer });
         if (active.cancelled || disposed || executionSlots.get(message.callId) !== active) {
           if (message.mode === "stream") await closeLateIterable(result);
           releaseExecution(active);
@@ -1412,7 +1767,7 @@ function createMessagePortServiceProvider(options) {
         if (message.mode === "unary") {
           try {
             const output = prepareOutput(options.prepareResult?.(result, active.call) ?? { value: result });
-            if (!active.cancelled && !post(transport, codec, { type: RUNTIME_RESULT_TYPE, protocolVersion: RUNTIME_PROTOCOL_VERSION, callId: message.callId, serviceInstanceId: reference.serviceInstanceId, result: output.value }, output.transfer)) sendError(message, "response_clone_failed", "receive");
+            if (!active.cancelled && !post(transport, codec, { type: RUNTIME_RESULT_TYPE, protocolVersion: RUNTIME_PROTOCOL_VERSION, binding: localBinding, callId: message.callId, serviceInstanceId: reference.serviceInstanceId, result: output.value }, output.transfer)) sendError(message, "response_clone_failed", "receive");
           } catch (error) {
             if (!active.cancelled) sendError(message, safeErrorCode(error, "response_validation_failed"), "receive");
           }
@@ -1424,7 +1779,7 @@ function createMessagePortServiceProvider(options) {
         const iterator = result[Symbol.asyncIterator]();
         stream = { active, call: active.call, controller, reference, window: message.initialCredit ?? 16, iterator, credit: message.initialCredit ?? 16, sequence: 1, running: false, closed: false, iteratorDone: false, returnStarted: false, returnDone: false, pumpDone: false };
         streams.set(message.callId, stream);
-        if (!post(transport, codec, { type: RUNTIME_RESULT_TYPE, protocolVersion: RUNTIME_PROTOCOL_VERSION, callId: message.callId, serviceInstanceId: reference.serviceInstanceId, streamReady: true })) {
+        if (!post(transport, codec, { type: RUNTIME_RESULT_TYPE, protocolVersion: RUNTIME_PROTOCOL_VERSION, binding: localBinding, callId: message.callId, serviceInstanceId: reference.serviceInstanceId, streamReady: true })) {
           sendError(message, "transport_unavailable", "dispatch");
           closeStream(stream);
           return;
@@ -1448,12 +1803,22 @@ function createMessagePortServiceProvider(options) {
       }
     });
   };
+  const drainExecutions = () => {
+    if (executionSlots.size === 0) return Promise.resolve();
+    return new Promise((resolve) => executionDrainWaiters.add(resolve));
+  };
+  session.registerDrainParticipant({
+    drain: drainExecutions,
+    pending: () => executionSlots.size
+  });
+  let removeTransport = () => void 0;
   function dispose() {
     if (disposed) return;
     disposed = true;
     for (const active of [...activeCalls.values()]) cancelActive(active, "service_revoked");
     for (const stream of [...streams.values()]) closeStream(stream);
     removeTransport();
+    if (ownsSession) session.close();
   }
   function failClose() {
     dispose();
@@ -1461,12 +1826,30 @@ function createMessagePortServiceProvider(options) {
       transport.close?.();
     } catch {
     }
+    session.close();
   }
-  const removeTransport = transport.subscribe(onMessage);
+  removeTransport = transport.subscribe(onMessage);
+  let removeSessionBeginClose = () => void 0;
+  removeSessionBeginClose = session.onBeginClose(() => dispose());
+  session.onClosed(() => {
+    removeSessionBeginClose();
+  });
   return {
     setServices() {
     },
     dispose,
+    get binding() {
+      return localBinding;
+    },
+    get endpointState() {
+      return session.state;
+    },
+    beginClose(reason = "Runtime endpoint closing") {
+      session.beginClose(reason);
+    },
+    drain(timeoutMs2) {
+      return session.drain(timeoutMs2);
+    },
     pendingCount() {
       return activeCalls.size;
     },
@@ -1498,6 +1881,7 @@ function createCapabilityPeerView(options) {
   const allowed = options.allowed === void 0 ? void 0 : new Set(options.allowed.map((descriptor) => capabilityKey(descriptor)));
   return Object.freeze({
     peerId: options.peerId,
+    binding: Object.freeze({ ...options.binding ?? options.bridge.binding }),
     get runtime() {
       return options.bridge.runtimeKind;
     },
@@ -1523,7 +1907,7 @@ function makeWorker(options) {
   if (!WorkerConstructor) throw new RuntimeUnavailableError("SharedWorker is not supported by this browser");
   return new WorkerConstructor(options.url, workerOptions);
 }
-function snapshotForClient(app, runtimeId, runtimeInstanceId, exposed, revision) {
+function snapshotForClient(app, runtimeId, runtimeInstanceId, binding, exposed, revision) {
   const allowed = new Set(exposed.map((capability) => capabilityKey(capability)));
   const state = app.state();
   const runtimeState = state.state === "disconnected" ? "failed" : state.state;
@@ -1536,7 +1920,8 @@ function snapshotForClient(app, runtimeId, runtimeInstanceId, exposed, revision)
     revision,
     state: runtimeState,
     units: state.units,
-    services: runtimeState === "ready" ? state.services.filter((service) => allowed.has(capabilityKey({ kind: service.kind, id: service.capabilityId, version: service.contractVersion }))).map((service) => ({ kind: service.kind, capabilityId: service.capabilityId, contractVersion: service.contractVersion, serviceInstanceId: service.serviceInstanceId, attributes: cloneFrozenAttributes(service.attributes), ...service.grantId !== void 0 ? { grantId: service.grantId } : {}, ...service.authorizationRevision !== void 0 ? { authorizationRevision: service.authorizationRevision } : {} })) : []
+    services: runtimeState === "ready" ? state.services.filter((service) => allowed.has(capabilityKey({ kind: service.kind, id: service.capabilityId, version: service.contractVersion }))).map((service) => ({ kind: service.kind, capabilityId: service.capabilityId, contractVersion: service.contractVersion, serviceInstanceId: service.serviceInstanceId, attributes: cloneFrozenAttributes(service.attributes), ...service.grantId !== void 0 ? { grantId: service.grantId } : {}, ...service.authorizationRevision !== void 0 ? { authorizationRevision: service.authorizationRevision } : {} })) : [],
+    binding
   };
 }
 function connectInternal(options) {
@@ -1573,18 +1958,22 @@ function connectInternal(options) {
   }, { limits });
   const outboundBudget = createRuntimeBudget(limits);
   const inboundBudget = createRuntimeBudget(limits);
-  const bridge = createCapabilityBridge({ transport, remoteRuntimeKind: "shared-worker", remoteRuntimeId: options.id, defaultCallTimeoutMs: options.defaultCallTimeoutMs, limits, budget: outboundBudget });
+  const localRuntimeInstanceId = options.client?.app.runtimeInstanceId ?? `window:${Date.now().toString(36)}`;
+  const binding = createRuntimeEndpointBinding(localRuntimeInstanceId);
+  const session = createRuntimeEndpointSession(binding);
+  const bridge = createCapabilityBridge({ transport, remoteRuntimeKind: "shared-worker", remoteRuntimeId: options.id, defaultCallTimeoutMs: options.defaultCallTimeoutMs, limits, budget: outboundBudget, binding, session });
   const listeners = /* @__PURE__ */ new Set();
   const workerInstanceId = { value: "" };
-  const localRuntimeInstanceId = options.client?.app.runtimeInstanceId ?? `window:${Date.now().toString(36)}`;
   let revision = 0;
   let disposed = false;
+  let disposePromise;
   let current = Object.freeze({ protocolVersion: RUNTIME_PROTOCOL_VERSION, runtimeId: options.id, runtimeKind: "shared-worker", runtimeInstanceId: "", state: "starting", revision: 0, units: [], services: [] });
   const clientHost = requestedClientHost;
   const clientPeerScope = options.client && clientHost ? clientHost.rootScope.child("peer", { attributes: { peerId: `peer:${Date.now().toString(36)}:${Math.random().toString(36).slice(2)}` } }) : void 0;
   const clientPeerScopeView = clientPeerScope ? createPeerScopeView(clientPeerScope) : void 0;
   const clientPeer = clientPeerScope && clientPeerScopeView ? createCapabilityPeerView({
     peerId: clientPeerScope.identity.attributes.peerId,
+    binding,
     scope: clientPeerScopeView,
     bridge,
     capabilityScope: clientPeerScope
@@ -1593,6 +1982,8 @@ function connectInternal(options) {
     transport,
     peerScope: clientPeerScope,
     peer: clientPeer,
+    binding,
+    session,
     budget: inboundBudget,
     limits,
     services: () => clientHost.serviceReferences().filter((service) => exposed.some((capability) => capabilityKey(capability) === capabilityKey({ kind: service.kind, id: service.capabilityId, version: service.contractVersion }))),
@@ -1600,6 +1991,7 @@ function connectInternal(options) {
       const registration = clientHost.capabilities.registration({ kind: reference.kind, id: reference.capabilityId, version: reference.contractVersion });
       return clientPeerScope && clientPeerScopeView ? createCapabilityPeerView({
         peerId: clientPeerScope.identity.attributes.peerId,
+        binding,
         scope: clientPeerScopeView,
         bridge,
         allowed: registration?.peerDependencies ?? [],
@@ -1618,12 +2010,12 @@ function connectInternal(options) {
       }
       return { value, transfer: capability.transfer?.request?.(value) };
     },
-    handleCall: async ({ request, reference, signal, deadlineAt, peer }) => {
+    handleCall: async ({ request, reference, signal, deadlineAt, binding: callBinding, peer }) => {
       const registration = clientHost.capabilities.registration({ kind: reference.kind, id: reference.capabilityId, version: reference.contractVersion });
       if (!registration) throw new WebLoomError("service_stale", "Window exposure is no longer available", "dispatch");
       const handler = registration.handler;
       if (!handler) throw new WebLoomError("service_stale", "Window service handler is unavailable", "dispatch");
-      return handler(request, { signal, deadlineAt, reference, origin: "remote", peer });
+      return handler(request, { signal, deadlineAt, reference, binding: callBinding, origin: "remote", peer });
     },
     prepareResult: (value, call) => {
       const registration = clientHost.capabilities.registration({ kind: "rpc", id: call.capabilityId, version: call.contractVersion });
@@ -1653,7 +2045,7 @@ function connectInternal(options) {
     if (!options.client || disposed) return;
     revision += 1;
     try {
-      transport.send(snapshotForClient(options.client.app, `${options.client.app.runtimeId}`, localRuntimeInstanceId, exposed, revision));
+      transport.send(snapshotForClient(options.client.app, `${options.client.app.runtimeId}`, localRuntimeInstanceId, binding, exposed, revision));
     } catch {
     }
   };
@@ -1662,7 +2054,7 @@ function connectInternal(options) {
       const applied = bridge.applySnapshot(messageValue);
       if (applied.accepted) {
         workerInstanceId.value = messageValue.runtimeInstanceId;
-        emit({ protocolVersion: RUNTIME_PROTOCOL_VERSION, runtimeId: messageValue.runtimeId, runtimeKind: messageValue.runtimeKind, runtimeInstanceId: messageValue.runtimeInstanceId, state: messageValue.state, revision: messageValue.revision, units: messageValue.units, services: messageValue.services });
+        emit({ protocolVersion: RUNTIME_PROTOCOL_VERSION, runtimeId: messageValue.runtimeId, runtimeKind: messageValue.runtimeKind, runtimeInstanceId: messageValue.runtimeInstanceId, state: messageValue.state, revision: messageValue.revision, units: messageValue.units, services: messageValue.services, binding: messageValue.binding });
       }
     } else if (messageValue.type === RUNTIME_ERROR_TYPE) {
       bridge.invalidate(messageValue.message);
@@ -1670,12 +2062,13 @@ function connectInternal(options) {
     }
   });
   const onError = () => {
-    if (!disposed) {
-      clientPeerScope?.revoke("SharedWorker disconnected");
-      provider?.dispose();
-      bridge.disconnect("SharedWorker disconnected");
-      emit({ ...current, state: "disconnected", runtimeInstanceId: "", revision: 0, units: [], services: [], error: "SharedWorker disconnected" });
-    }
+    if (disposed) return;
+    session.beginClose("SharedWorker disconnected");
+    clientPeerScope?.revoke("SharedWorker disconnected");
+    provider?.dispose();
+    bridge.disconnect("SharedWorker disconnected");
+    session.close();
+    emit({ ...current, state: "disconnected", runtimeInstanceId: "", revision: 0, units: [], services: [], binding: void 0, error: "SharedWorker disconnected" });
   };
   port.addEventListener("messageerror", onError);
   if (worker.addEventListener) worker.addEventListener("error", onError);
@@ -1685,6 +2078,10 @@ function connectInternal(options) {
   const handle = {
     runtimeKind: "shared-worker",
     runtimeId: options.id,
+    binding,
+    get endpointState() {
+      return session.state;
+    },
     get runtimeInstanceId() {
       return workerInstanceId.value;
     },
@@ -1701,20 +2098,38 @@ function connectInternal(options) {
       listener(current);
       return () => listeners.delete(listener);
     },
+    beginClose(reason = "SharedWorker connection closing") {
+      if (disposed) return;
+      session.beginClose(reason);
+      clientPeerScope?.revoke(reason);
+    },
+    drain(timeoutMs2) {
+      session.beginClose("SharedWorker connection drain requested");
+      clientPeerScope?.revoke("SharedWorker connection drain requested");
+      return bridge.drain(timeoutMs2);
+    },
     dispose(reason = "SharedWorker connection disposed") {
       if (disposed) return Promise.resolve();
-      disposed = true;
-      emit({ ...current, state: "stopping" });
-      removeClient?.();
-      removeRaw();
-      clientPeerScope?.revoke(reason);
-      provider?.dispose();
-      bridge.dispose(reason);
-      port.removeEventListener("messageerror", onError);
-      worker.removeEventListener?.("error", onError);
-      transport.close?.();
-      emit({ ...current, state: "disposed", runtimeInstanceId: "", revision: 0, units: [], services: [] });
-      return clientPeerScope ? clientPeerScope.dispose({ reason }).then(() => void 0) : Promise.resolve();
+      if (disposePromise) return disposePromise;
+      disposePromise = (async () => {
+        emit({ ...current, state: "stopping" });
+        removeClient?.();
+        removeRaw();
+        clientPeerScope?.revoke(reason);
+        session.beginClose(reason);
+        const drainResult = bridge.drain();
+        await drainResult.catch(() => void 0);
+        disposed = true;
+        provider?.dispose();
+        bridge.dispose(reason);
+        port.removeEventListener("messageerror", onError);
+        worker.removeEventListener?.("error", onError);
+        transport.close?.();
+        session.close();
+        emit({ ...current, state: "disposed", runtimeInstanceId: "", revision: 0, units: [], services: [], binding: void 0 });
+        if (clientPeerScope) await clientPeerScope.dispose({ reason });
+      })();
+      return disposePromise;
     }
   };
   handleBridges.set(handle, bridge);
@@ -1732,6 +2147,6 @@ function bridgeForRuntimeHandle(handle) {
   return bridge;
 }
 
-export { bridgeForRuntimeHandle, connectSharedWorker, connectSharedWorkerForTesting, createCapabilityBridge, createCapabilityPeerView, createMessagePortRuntimeTransport, createMessagePortServiceProvider, createPeerScopeView, validateTransferables };
-//# sourceMappingURL=chunk-ANA6GBEI.js.map
-//# sourceMappingURL=chunk-ANA6GBEI.js.map
+export { DEFAULT_RUNTIME_DRAIN_TIMEOUT_MS, bridgeForRuntimeHandle, connectSharedWorker, connectSharedWorkerForTesting, createCapabilityBridge, createCapabilityPeerView, createMessagePortRuntimeTransport, createMessagePortServiceProvider, createPeerScopeView, createRuntimeEndpointBinding, createRuntimeEndpointSession, isRuntimeEndpointBinding, sameRuntimeEndpointBinding, validateTransferables };
+//# sourceMappingURL=chunk-XVD7ALPV.js.map
+//# sourceMappingURL=chunk-XVD7ALPV.js.map