@cortexkit/opencode-openai-auth 1.3.0 → 1.5.0

package/src/tui-compiled/runtime/shared/375d9cca2def037d-private-files.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { lstat, readFile, rename, unlink } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
 export const windowsPrivateFiles = process.platform === 'win32';
 const migrationNotices = new Set();
 function ioCode(detail) {
@@ -20,8 +21,51 @@ let backend;
 export function setPrivateFilesBackendForTest(api) {
     backend = api ? Promise.resolve(api) : undefined;
 }
+/** The fixed `reason` of a refusal because the Windows native addon did not load. */
+export const PRIVATE_FILES_UNAVAILABLE_REASON = 'native-addon-unavailable';
+function privateFilesUnavailable(cause) {
+    return Object.assign(new Error('Windows private-files native addon is unavailable', { cause }), {
+        code: 'ERR_PRIVATE_FILES_UNAVAILABLE',
+        reason: PRIVATE_FILES_UNAVAILABLE_REASON,
+    });
+}
+function isUnavailable(api, error) {
+    return (error instanceof api.PrivateFilesUnavailableError ||
+        error?.code ===
+            'ERR_PRIVATE_FILES_UNAVAILABLE');
+}
+/**
+ * Importing @cortexkit/private-files succeeds even when its Windows addon
+ * cannot load: the package loads the addon on first use, and some of its
+ * checks then report the failure as an ordinary refusal such as
+ * `unsupported-filesystem`. So prove the addon loads before handing the
+ * package out. Verifying a path that does not exist loads the addon first and
+ * then fails harmlessly; only the package's own "unavailable" error means the
+ * addon is missing.
+ */
+async function assertNativeAddonLoads(api) {
+    try {
+        await api.verifyPrivatePath(join(tmpdir(), `.common-auth-private-files-probe-${randomUUID()}`), 'file');
+    }
+    catch (error) {
+        if (isUnavailable(api, error))
+            throw privateFilesUnavailable(error);
+    }
+}
+/**
+ * Load the package once per process. On Windows a failed import or addon load
+ * is kept, so every later private-file operation refuses at once with
+ * ERR_PRIVATE_FILES_UNAVAILABLE. There is no fallback to permission bits:
+ * they do not protect files on Windows.
+ */
 function loadBackend() {
-    backend ??= import("@cortexkit/private-files");
+    backend ??= import("@cortexkit/private-files").then(async (api) => {
+        if (windowsPrivateFiles)
+            await assertNativeAddonLoads(api);
+        return api;
+    }, (cause) => {
+        throw windowsPrivateFiles ? privateFilesUnavailable(cause) : cause;
+    });
     return backend;
 }
 export class PrivateFileError extends Error {
@@ -38,7 +82,9 @@ export class PrivateFileError extends Error {
     orphanPath;
     constructor(path, stage, cause) {
         const detail = cause;
-        super(`Private file refused at ${stage}: ${path} (${detail?.reason ?? detail?.code ?? 'io-error'}). Use a safe parent directory. Repair only a named secret file in safe ancestry whose owner the published policy trusts, without changing its owner or any existing directory. Previously exposed credentials may need rotation. Windows requires the private-files native prebuild and an ACL-persisting local filesystem such as NTFS.`, { cause });
+        super(detail?.code === 'ERR_PRIVATE_FILES_UNAVAILABLE'
+            ? `Private file refused at ${stage}: ${path} (${PRIVATE_FILES_UNAVAILABLE_REASON}). The Windows native addon of @cortexkit/private-files could not be loaded, so owner-only access cannot be enforced and nothing was read or written. Reinstall the plugin so the private-files Windows prebuild for this architecture is present; Windows has no safe fallback to permission bits.`
+            : `Private file refused at ${stage}: ${path} (${detail?.reason ?? detail?.code ?? 'io-error'}). Keep this file in a folder that only you, the system or administrators can change, such as a folder in your home directory. If other users could read the file before, sign in again to replace the credentials it held. On Windows the file must also be on a local drive that keeps Windows file permissions, such as NTFS.`, { cause });
         this.path = path;
         this.stage = stage;
         this.name = 'PrivateFileError';

package/src/tui-compiled/runtime/shared/39c3cb05738fcf6d-projection.js

@@ -6,7 +6,7 @@
 // scope, orders the result the way the primitives expect, and carries each
 // entry's (scope, label) so a decision names the limit it judged rather than
 // the position it occupied.
-import { ALL_SCOPE, readQuotaCounters, } from "./905bffc0220f43d0-map.js";
+import { ALL_SCOPE, isQuotaCredits, readQuotaCounters, } from "./905bffc0220f43d0-map.js";
 function project(entry) {
     if (entry.kind === 'retired') {
         return {
@@ -95,12 +95,14 @@ export function projectQuota(map, scope = ALL_SCOPE) {
         : undefined;
     const budget = map?.budget?.kind === 'reading' ? projectBudget(map.budget) : undefined;
     const counters = readQuotaCounters(map?.counters);
+    const credits = isQuotaCredits(map?.credits) ? map.credits : undefined;
     return {
         scope,
         limits,
         ...(checkedAt === undefined ? {} : { checkedAt }),
         ...(budget === undefined ? {} : { budget }),
         ...(counters === undefined ? {} : { counters }),
+        ...(credits === undefined ? {} : { credits }),
     };
 }
 /**

package/src/tui-compiled/runtime/shared/42ae93ab554fcec2-open-url.js

@@ -1,8 +1,5 @@
-import {
-  execFileSync as defaultExecFileSync,
-  spawn as defaultSpawn
-} from "node:child_process";
-export function openUrl(url, platform = process.platform, execFileSync = defaultExecFileSync, spawn = defaultSpawn) {
+import { spawn as defaultSpawn } from "node:child_process";
+export function openUrl(url, platform = process.platform, spawn = defaultSpawn) {
   try {
     if (platform === "win32") {
       const command = `Start-Process '${url.replaceAll("'", "''")}'`, encodedCommand = Buffer.from(command, "utf16le").toString("base64"), child = spawn("powershell.exe", [
@@ -17,11 +14,12 @@ export function openUrl(url, platform = process.platform, execFileSync = default
       child.unref();
       return child.pid !== void 0;
     }
-    execFileSync(platform === "darwin" ? "open" : "xdg-open", [url], {
-      stdio: "ignore",
-      timeout: 3000
+    const child = spawn(platform === "darwin" ? "open" : "xdg-open", [url], {
+      stdio: "ignore"
     });
-    return !0;
+    child.on("error", () => {});
+    child.unref();
+    return child.pid !== void 0;
   } catch {
     return !1;
   }

package/src/tui-compiled/runtime/shared/4825e03209d6ae3e-with-lock.js

@@ -21,6 +21,7 @@ export class LockOwnershipError extends Error {
 export async function withLock(target, options, fn) {
     const started = performance.now();
     for (;;) {
+        options.signal?.throwIfAborted();
         const lock = await acquireRefreshFileLock({
             path: target,
             name: options.name,
@@ -33,6 +34,7 @@ export async function withLock(target, options, fn) {
         });
         if (lock) {
             try {
+                options.signal?.throwIfAborted();
                 return await fn(lock);
             }
             finally {

package/src/tui-compiled/runtime/shared/4f36d333d081d040-merge.js

@@ -11,7 +11,7 @@
 // no entry gets an absence record. A pair outside the coverage is never
 // touched, so a header-shaped partial observation (which covers only what it
 // carries) cannot erase a family limit or the budget.
-import { ALL_SCOPE, decodeQuotaMap, entryTime, isQuotaCounters, limitKey, } from "./905bffc0220f43d0-map.js";
+import { ALL_SCOPE, decodeQuotaMap, entryTime, isQuotaCounters, isQuotaCredits, limitKey, } from "./905bffc0220f43d0-map.js";
 /** Thrown by `mergeQuotaObservation` when either argument is malformed. */
 export class QuotaCodecError extends TypeError {
     constructor(message) {
@@ -84,7 +84,8 @@ export function isQuotaObservation(value) {
     if (!coverage.every(isObservedPair))
         return false;
     return ((value.budget === undefined || isObservedBudget(value.budget)) &&
-        (value.counters === undefined || isQuotaCounters(value.counters)));
+        (value.counters === undefined || isQuotaCounters(value.counters)) &&
+        (value.credits === undefined || isQuotaCredits(value.credits)));
 }
 function compareEntries(left, right) {
     if (left.scope !== right.scope)
@@ -110,6 +111,17 @@ function mergeCounters(stored, observed) {
     }
     return counters.size === 0 ? undefined : Object.fromEntries(counters);
 }
+// Credits merge like a single counter: the newer record wins, an equal time
+// applies (the observation applied last wins), and an observation without
+// credits leaves the stored record alone.
+function mergeCredits(stored, observed) {
+    if (observed === undefined)
+        return stored;
+    if (stored !== undefined && observed.checkedAt < stored.checkedAt) {
+        return stored;
+    }
+    return { ...observed };
+}
 /**
  * Applies `observation` to `stored` (undefined for a row with no map yet) and
  * returns the new map. Pure: neither argument is modified. Throws
@@ -166,13 +178,15 @@ export function mergeQuotaObservation(stored, observation) {
             : { scope, label: pair.label, kind: 'retired', retiredAt: at });
     }
     // Keys this module does not recognise are carried over untouched.
-    const { limits: _limits, budget: _budget, counters: _counters, ...unknownKeys } = base;
+    const { limits: _limits, budget: _budget, counters: _counters, credits: _credits, ...unknownKeys } = base;
     const budget = mergeBudget(base.budget, observation.budget, at);
     const counters = mergeCounters(base.counters, observation.counters);
+    const credits = mergeCredits(base.credits, observation.credits);
     return {
         ...unknownKeys,
         limits: [...entries.values()].sort(compareEntries),
         ...(budget === undefined ? {} : { budget }),
         ...(counters === undefined ? {} : { counters }),
+        ...(credits === undefined ? {} : { credits }),
     };
 }

package/src/tui-compiled/runtime/shared/754d6017f8e419cf-builtins.js

@@ -4,7 +4,7 @@
 // the same locks as any other writer of those files.
 import { formatQuota, isQuotaMap, projectQuota, quotaWindowName, } from "./d5a8f1061ee2f114-index.js";
 import { DEFAULT_FORMER_MAIN_ID, orderForPlacement, resolveRoutingMode, } from "./3e7d45a77c6ad4d5-index.js";
-import { projectFailure, } from "./94820e324f2b4c09-seam.js";
+import { CommandError, projectFailure, } from "./94820e324f2b4c09-seam.js";
 /** `disabledReason` recorded when the user disables an account from the menu. */
 export const MENU_DISABLED_REASON = 'disabled from the command menu';
 function isRecord(value) {
@@ -65,13 +65,16 @@ function addedText(name, result) {
 function failureMessage(error) {
     return projectFailure(error).text;
 }
-async function snapshot(store) {
+async function snapshot(options) {
+    const { store } = options;
     const load = await store.read();
     const read = await store.readSettings();
+    const vault = await options.routing?.vaultOrder?.();
     return {
         load,
         rows: distinctRows(load),
         settings: read.status === 'error' ? {} : read.settings,
+        ...(vault ? { vault } : {}),
     };
 }
 function accountView(row, options) {
@@ -323,6 +326,73 @@ function quotaSection(options, snap) {
         },
     };
 }
+/**
+ * Sets the vault order. The roster's own refusal of the list (`invalid-order`:
+ * an account left out, which it counts without naming) is shown with its own
+ * message; any other failure is projected as usual. The kind is read from
+ * the error object so the menu does not import the vault client.
+ */
+async function reorderVault(vault, order) {
+    try {
+        return await vault.reorder(order);
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            error.name === 'ClaustrumConsumerError' &&
+            error.kind === 'invalid-order')
+            throw new CommandError('vault-invalid-order', error.message, {
+                cause: error,
+            });
+        throw error;
+    }
+}
+function invalidVaultOrder(message) {
+    return new CommandError('vault-invalid-order', message);
+}
+/**
+ * How the Routing section names vault accounts: by label, since route ids
+ * are long and opaque. A typed entry may be a label or a route id, and must
+ * name exactly one account. Refusals quote only the entry the user typed.
+ */
+function vaultNames(vault) {
+    const rows = vault.rows.map((row) => ({
+        id: row.id,
+        label: row.label.trim() || row.id,
+    }));
+    const matches = (entry) => rows.filter((row) => row.id === entry || row.label === entry);
+    return {
+        ids: rows.map((row) => row.id),
+        nameOf: (id) => rows.find((row) => row.id === id)?.label ?? id,
+        /**
+         * What the order input starts with for an account: its label when
+         * typing that label back names this account alone, else its route id
+         * (two accounts sharing a label, or a label with a comma or line break
+         * in it, either of which would split it into two entries).
+         */
+        entryOf: (id) => {
+            const row = rows.find((entry) => entry.id === id);
+            return row && !/[,\n]/.test(row.label) && matches(row.label).length === 1
+                ? row.label
+                : id;
+        },
+        /** The route ids the typed entries name, in order; refuses before any write. */
+        resolve: (entries) => {
+            const ids = [];
+            for (const entry of entries) {
+                const found = matches(entry);
+                if (found.length === 0)
+                    throw invalidVaultOrder(`"${entry}" is not a vault account.`);
+                if (found.length > 1)
+                    throw invalidVaultOrder(`"${entry}" matches more than one vault account; enter those accounts by route id.`);
+                const id = found[0].id;
+                if (ids.includes(id))
+                    throw invalidVaultOrder(`"${entry}" names an account already in the order.`);
+                ids.push(id);
+            }
+            return ids;
+        },
+    };
+}
 function routingSection(options, snap) {
     const { store, extraLocks } = options;
     const locks = extraLocks ? { extraLocks } : {};
@@ -336,14 +406,18 @@ function routingSection(options, snap) {
         ? raw
         : 'ordered';
     const resolved = resolveRoutingMode(current);
-    const ids = snap.rows.map((row) => row.id);
+    // In vault mode routing tries the vault accounts, so their order is the
+    // one shown and set here; the pool roster's order is not used.
+    const vault = snap.vault ? vaultNames(snap.vault) : undefined;
+    const ids = vault ? vault.ids : snap.rows.map((row) => row.id);
+    const nameOf = (id) => (vault ? vault.nameOf(id) : id);
     const tried = orderForPlacement(ids, resolved.placement, options.routing?.formerMainId ?? DEFAULT_FORMER_MAIN_ID);
     const label = choices.find((choice) => choice.value === current)?.label ?? current;
     const lines = [`Mode: ${label}`];
     if (ids.length > 0)
-        lines.push(`Roster order: ${ids.join(', ')}`);
+        lines.push(`${vault ? 'Vault account order' : 'Roster order'}: ${ids.map(nameOf).join(', ')}`);
     if (resolved.mode === 'ordered' && tried.join() !== ids.join())
-        lines.push(`Tried in order: ${tried.join(', ')}`);
+        lines.push(`Tried in order: ${tried.map(nameOf).join(', ')}`);
     const actions = [
         {
             id: 'mode',
@@ -371,19 +445,27 @@ function routingSection(options, snap) {
                 {
                     kind: 'text',
                     id: 'order',
-                    label: 'Account ids, first to last',
-                    value: ids.join(', '),
+                    label: vault
+                        ? 'Vault accounts, first to last, separated by commas'
+                        : 'Account ids, first to last',
+                    value: vault ? ids.map(vault.entryOf).join(', ') : ids.join(', '),
                     required: true,
                 },
             ],
             run: async ({ values }) => {
-                const order = String(values.order)
-                    .split(/[\s,]+/)
-                    .filter((id) => id.length > 0);
-                const result = await store.reorder(order, locks);
+                const text = String(values.order);
+                // A vault label may contain spaces, so vault entries are separated by
+                // commas or line breaks, not spaces; pool ids never contain spaces.
+                const entries = text
+                    .split(vault ? /[,\n]+/ : /[\s,]+/)
+                    .map((entry) => entry.trim())
+                    .filter((entry) => entry.length > 0);
+                const result = snap.vault && vault
+                    ? await reorderVault(snap.vault, vault.resolve(entries))
+                    : await store.reorder(entries, locks);
                 return result.outcome === 'unchanged'
                     ? 'The order is unchanged.'
-                    : `Order set to ${result.ids.join(', ')}.`;
+                    : `Order set to ${result.ids.map(nameOf).join(', ')}.`;
             },
         });
     return {
@@ -524,7 +606,7 @@ function limitsSection(options, snap) {
 }
 /** The four built-in sections, in their fixed order, from one read of the store. */
 export async function builtinSections(options) {
-    const snap = await snapshot(options.store);
+    const snap = await snapshot(options);
     return [
         accountsSection(options, snap),
         quotaSection(options, snap),

package/src/tui-compiled/runtime/shared/81dddd203f1b92a3-quota-writer.js

@@ -0,0 +1,253 @@
+import { resolve } from "node:path";
+import { createLogger } from "./cc9e0702a752cea7-index.js";
+import { isQuotaObservation } from "./d5a8f1061ee2f114-index.js";
+import { applyVaultQuota, mutateVaultRoster, } from "./30f5bc480f31f51c-roster.js";
+// Every consumer of the same file shares one mailbox and one lock waiter.
+const writers = new Map();
+const logger = createLogger('claustrum');
+const COALESCE_MS = 100;
+function writerFor(path) {
+    const key = resolve(path);
+    let writer = writers.get(key);
+    if (!writer) {
+        writer = {
+            path: key,
+            pending: new Map(),
+            listeners: new Set(),
+            wake: new Set(),
+            abort: new AbortController(),
+            failures: 0,
+            draining: false,
+            order: 0,
+        };
+        writers.set(key, writer);
+    }
+    return writer;
+}
+/** Retain the shared writer; the last consumer's close drains it. */
+export function retainVaultQuotaWriter(path, listener) {
+    const writer = writerFor(path);
+    writer.listeners.add(listener);
+    let released;
+    return () => (released ??= (() => {
+        writer.listeners.delete(listener);
+        return writer.listeners.size ? Promise.resolve() : drainVaultQuota(path);
+    })());
+}
+// Split one observation into its independently dated parts: each rate-limit
+// window (scope and label), each covered-but-unread window, the budget, each
+// counter and the credits record. The mailbox keeps the newest of each part on
+// its own, so a later observation that carries only some parts can't erase an
+// older but still newest reading of another part, which is how
+// mergeQuotaObservation treats them on disk. Each key also carries the
+// receipt's identity, so the identity fence still applies to every part.
+function fields(publication) {
+    const result = new Map();
+    const { observation } = publication;
+    const witness = JSON.stringify([
+        publication.routeId,
+        publication.receipt?.credentialId,
+        publication.receipt?.accountIdentitySource,
+        publication.receipt?.expectedAccountIdentity,
+    ]);
+    const add = (key, at, part) => result.set(`${witness}:${key}`, {
+        at,
+        order: 0,
+        publication: { ...publication, observation: part },
+    });
+    const keyFor = (scope, label) => JSON.stringify([scope ?? 'all', label]);
+    const read = new Set();
+    for (const reading of observation.readings ?? []) {
+        const key = keyFor(reading.scope, reading.label);
+        read.add(key);
+        add(key, observation.checkedAt, {
+            checkedAt: observation.checkedAt,
+            readings: [{ ...reading }],
+        });
+    }
+    for (const pair of observation.coverage ?? []) {
+        const key = keyFor(pair.scope, pair.label);
+        if (!read.has(key))
+            add(key, observation.checkedAt, {
+                checkedAt: observation.checkedAt,
+                coverage: [{ ...pair }],
+            });
+    }
+    if (observation.budget)
+        add('budget', observation.checkedAt, {
+            checkedAt: observation.checkedAt,
+            budget: { ...observation.budget },
+        });
+    for (const [name, counter] of Object.entries(observation.counters ?? {})) {
+        add(`counter:${name}`, counter.checkedAt, {
+            checkedAt: observation.checkedAt,
+            counters: { [name]: { ...counter } },
+        });
+    }
+    if (observation.credits)
+        add('credits', observation.credits.checkedAt, {
+            checkedAt: observation.checkedAt,
+            credits: { ...observation.credits },
+        });
+    // Even an empty observation can bind an account proved by its receipt.
+    if (!result.size)
+        add('empty', observation.checkedAt, { checkedAt: observation.checkedAt });
+    return result;
+}
+/** Enqueue without filesystem work; each quota field retains its own receipt fence. */
+export function enqueueVaultQuota(path, publication) {
+    if (!isQuotaObservation(publication.observation))
+        return Promise.resolve(false);
+    const writer = writerFor(path);
+    const account = JSON.stringify([
+        publication.accountIdentity ?? null,
+        publication.accountIdentity === undefined ? publication.routeId : null,
+    ]);
+    const pending = writer.pending.get(account) ?? new Map();
+    for (const [key, field] of fields(publication)) {
+        const previous = pending.get(key);
+        if (!previous || field.at >= previous.at) {
+            field.order = ++writer.order;
+            // A covered disappearance after an unflushed reading is a retirement,
+            // not an absence. Retain just enough history to preserve that distinction.
+            if (field.publication.observation.coverage)
+                field.priorReading = previous?.publication.observation.readings
+                    ? previous.publication
+                    : previous?.priorReading;
+            pending.set(key, field);
+        }
+    }
+    if (pending.size)
+        writer.pending.set(account, pending);
+    for (const listener of writer.listeners)
+        listener(publication);
+    schedule(writer, COALESCE_MS);
+    return Promise.resolve(true);
+}
+function orderedFields(pending) {
+    // Equal observation times are last-enqueue-wins even across different
+    // credentials or account-only readings. Map insertion order cannot prove it.
+    return [...pending.values()]
+        .flatMap((account) => [...account.values()])
+        .sort((a, b) => a.order - b.order);
+}
+/** Overlay uncommitted observations when a consumer reloads the durable roster. */
+export function pendingVaultQuota(path, roster) {
+    const writer = writers.get(resolve(path));
+    if (writer) {
+        for (const field of orderedFields(writer.pending)) {
+            if (field.priorReading)
+                roster = applyVaultQuota(roster, field.priorReading).roster;
+            roster = applyVaultQuota(roster, field.publication).roster;
+        }
+    }
+    return roster;
+}
+function schedule(writer, delay) {
+    if (writer.running ||
+        writer.timer ||
+        !writer.pending.size ||
+        writer.abort.signal.aborted)
+        return;
+    writer.timer = setTimeout(() => {
+        writer.timer = undefined;
+        flush(writer);
+    }, delay);
+    if (!writer.draining)
+        writer.timer.unref?.();
+}
+function flush(writer) {
+    if (writer.running || writer.abort.signal.aborted)
+        return;
+    const batch = new Map([...writer.pending].map(([account, pending]) => [
+        account,
+        new Map(pending),
+    ]));
+    writer.running = (async () => {
+        try {
+            await mutateVaultRoster(writer.path, (current) => {
+                let next = current;
+                for (const field of orderedFields(batch)) {
+                    if (field.priorReading)
+                        next = applyVaultQuota(next, field.priorReading).roster;
+                    next = applyVaultQuota(next, field.publication).roster;
+                }
+                return { ...(next !== current && { next }), result: undefined };
+            }, { signal: writer.abort.signal });
+            for (const [account, fields] of batch) {
+                const pending = writer.pending.get(account);
+                for (const [key, field] of fields) {
+                    // A newer enqueue must survive completion of an older flush.
+                    if (pending?.get(key) === field)
+                        pending.delete(key);
+                }
+                if (!pending?.size)
+                    writer.pending.delete(account);
+            }
+            writer.failures = 0;
+        }
+        catch (error) {
+            if (!writer.abort.signal.aborted && writer.failures++ === 0) {
+                logger.warn('vault quota publication delayed; retrying', {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+            // Keep the batch in the mailbox, including any fresher fields enqueued meanwhile.
+        }
+        finally {
+            writer.running = undefined;
+            for (const wake of writer.wake)
+                wake();
+            const backoff = writer.failures
+                ? Math.min(5_000, 100 * 2 ** Math.min(writer.failures, 6)) *
+                    (0.5 + Math.random())
+                : COALESCE_MS;
+            schedule(writer, backoff);
+        }
+    })();
+}
+/** Wait at most timeoutMs for detached publication; shutdown loss is acceptable. */
+export async function drainVaultQuota(path, timeoutMs = 1_000) {
+    const key = resolve(path);
+    const writer = writers.get(key);
+    if (!writer)
+        return;
+    writer.draining = true;
+    clearTimeout(writer.timer);
+    writer.timer = undefined;
+    let deadline;
+    let wake;
+    const drained = new Promise((done) => {
+        wake = () => {
+            if (!writer.pending.size || writer.abort.signal.aborted)
+                done();
+        };
+        writer.wake.add(wake);
+        wake();
+    });
+    try {
+        if (writer.pending.size)
+            flush(writer);
+        await Promise.race([
+            drained,
+            new Promise((done) => {
+                deadline = setTimeout(done, Math.max(0, timeoutMs));
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(deadline);
+        if (wake)
+            writer.wake.delete(wake);
+        writer.draining = false;
+        // A still-open consumer owns the mailbox, so another consumer's disposal
+        // must not discard its observations or stop its retries.
+        if (!writer.listeners.size) {
+            writer.abort.abort();
+            clearTimeout(writer.timer);
+            writer.pending.clear();
+            if (writers.get(key) === writer)
+                writers.delete(key);
+        }
+    }
+}