@independo/capacitor-inderun 1.0.1-dev.1 → 1.1.0-dev.10

package/dist/web.js

@@ -1,15 +1,36 @@
 import { WebPlugin } from "@capacitor/core";
 import { createIndeRunWeb, createUnavailable, toIndeRunException } from "@independo/inderun-web";
+import { STREAM_ERROR_NAME, STREAM_EVENT_NAME } from "./streaming.js";
 export class IndeRunWeb extends WebPlugin {
     engine = null;
+    // Deliberately the bridge's StreamRun, not the web SDK's: the engine's run is
+    // assigned straight into this map, so the two shapes staying identical is checked
+    // by the compiler rather than by convention.
+    activeStreams = new Map();
+    startingStreams = new Set();
+    pendingCancels = new Map();
     async configure(options) {
-        if (!options?.openAI) {
-            throw createUnavailable("Capacitor web execution requires OpenAI provider registration. Configure with openAI bootstrap options before calling run(request).").toContractError();
+        // The web SDK requires at least one provider, not specifically the cloud one. Held
+        // here as well as there so the failure is an `Unavailable` contract error rather than
+        // a raw SDK throw, which is what the facade's callers expect.
+        if (!options?.openAI && !options?.systemModel && !options?.onnx) {
+            throw createUnavailable("Capacitor web execution requires at least one provider registration. Configure with openAI, systemModel and/or onnx bootstrap options before calling run(request).").toContractError();
         }
         try {
-            const webOptions = {
-                openAI: compactOpenAIOptions(options)
-            };
+            // The SDK's own option type, not a hand-written copy of it: an upstream rename
+            // then fails at the type level instead of silently dropping a field. This is
+            // deliberately the *outbound* shape only — `ConfigureOptions` stays a narrower,
+            // JSON-serializable subset, because it has to cross the native bridge hop.
+            const webOptions = {};
+            if (options.openAI !== undefined) {
+                webOptions.openAI = compactOpenAIOptions(options.openAI);
+            }
+            if (options.systemModel !== undefined) {
+                webOptions.systemModel = compactSystemModelOptions(options.systemModel);
+            }
+            if (options.onnx !== undefined) {
+                webOptions.onnx = compactOnnxOptions(options.onnx);
+            }
             if (options.allowDirectOpenAIEndpoint !== undefined) {
                 webOptions.allowDirectOpenAIEndpoint = options.allowDirectOpenAIEndpoint;
             }
@@ -30,9 +51,95 @@ export class IndeRunWeb extends WebPlugin {
             throw toIndeRunException(error).toContractError();
         }
     }
+    async checkCapabilities() {
+        if (!this.engine) {
+            throw createUnavailable("Capacitor IndeRun has not been configured. Configure providers before calling checkCapabilities().").toContractError();
+        }
+        try {
+            // Deliberately uncast: the engine's snapshots are assigned straight into the
+            // bridge's own `ProviderCapabilitySnapshot`, so the two declarations staying
+            // identical is a compile error rather than a convention. See definitions.ts.
+            return { providers: await this.engine.checkCapabilities() };
+        }
+        catch (error) {
+            throw toIndeRunException(error).toContractError();
+        }
+    }
+    /**
+     * The web path deliberately round-trips through `notifyListeners` rather than
+     * handing the engine's `StreamRun` straight back.
+     *
+     * Short-circuiting would require the facade to branch on the platform and would
+     * leave two reassembly paths whose equivalence is only a convention — while this
+     * way there is exactly one, exercised on every platform. It also equalizes the
+     * loss of generator backpressure that the native paths have regardless.
+     */
+    async startStream(options) {
+        if (!this.engine) {
+            throw createUnavailable("Capacitor IndeRun has not been configured. Configure providers before calling stream(request).").toContractError();
+        }
+        this.startingStreams.add(options.streamId);
+        let run;
+        try {
+            run = await this.engine.stream(options.request);
+        }
+        catch (error) {
+            this.startingStreams.delete(options.streamId);
+            this.pendingCancels.delete(options.streamId);
+            throw toIndeRunException(error).toContractError();
+        }
+        this.startingStreams.delete(options.streamId);
+        this.activeStreams.set(options.streamId, run);
+        if (this.pendingCancels.has(options.streamId)) {
+            const reason = this.pendingCancels.get(options.streamId);
+            this.pendingCancels.delete(options.streamId);
+            run.cancel(reason);
+        }
+        // Pump on a later microtask so this call's handle settles first.
+        queueMicrotask(() => void this.pump(options.streamId, run));
+        return run.handle;
+    }
+    async cancelStream(options) {
+        const run = this.activeStreams.get(options.streamId);
+        if (run !== undefined) {
+            // Never abandon the generator: the engine must stay free to emit its one
+            // `cancelled` terminal event.
+            run.cancel(options.reason);
+            return;
+        }
+        if (this.startingStreams.has(options.streamId)) {
+            // Cancel raced startStream's route selection; applied once the run attaches.
+            this.pendingCancels.set(options.streamId, options.reason);
+            return;
+        }
+        // Unknown or already-finished run: cancelling after the terminal is a no-op,
+        // not an error.
+    }
+    async pump(streamId, run) {
+        try {
+            for await (const event of run.events) {
+                this.notifyListeners(STREAM_EVENT_NAME, { streamId, event }, true);
+            }
+        }
+        catch (error) {
+            this.notifyListeners(STREAM_ERROR_NAME, { streamId, error: toIndeRunException(error).toContractError() }, true);
+        }
+        finally {
+            this.activeStreams.delete(streamId);
+        }
+    }
 }
-function compactOpenAIOptions(options) {
-    const openAI = options.openAI;
+/**
+ * Assigns only the fields the caller actually set. `exactOptionalPropertyTypes` makes
+ * this incremental style mandatory rather than cosmetic: assigning `undefined` to an
+ * optional property is an error, and an explicit `undefined` on the wire is not the same
+ * thing as an absent key to the provider that reads it.
+ *
+ * `id`, `healthCheckTimeoutMs` and `healthCheckCacheMs` are deliberately not bridged —
+ * all optional, and the bridge has no reason to expose provider-tuning knobs it cannot
+ * also offer on native.
+ */
+function compactOpenAIOptions(openAI) {
     const result = {
         model: openAI.model
     };
@@ -50,3 +157,25 @@ function compactOpenAIOptions(options) {
     }
     return result;
 }
+function compactSystemModelOptions(systemModel) {
+    const result = {};
+    if (systemModel.id !== undefined) {
+        result.id = systemModel.id;
+    }
+    if (systemModel.timeoutMs !== undefined) {
+        result.timeoutMs = systemModel.timeoutMs;
+    }
+    return result;
+}
+function compactOnnxOptions(onnx) {
+    const result = {
+        modelPackage: onnx.modelPackage
+    };
+    if (onnx.id !== undefined) {
+        result.id = onnx.id;
+    }
+    if (onnx.timeoutMs !== undefined) {
+        result.timeoutMs = onnx.timeoutMs;
+    }
+    return result;
+}

package/ios/Sources/IndeRunCapacitorPlugin/IndeRunCapacitorBridge.swift

@@ -36,9 +36,49 @@ struct CapacitorRunOptions: Codable {
     let allowDirectOpenAIEndpoint: Bool? // web-only, no-op on native
 }
 
+/// Unlike `run(request)`, which takes the request at the options root, `startStream`
+/// nests it under `request` so the envelope can also carry the bridge-local
+/// `streamId`. See `StartStreamOptions` in src/definitions.ts.
+struct CapacitorStartStreamOptions: Codable {
+    let streamId: String
+    let request: TaskRequest
+}
+
+struct CapacitorCancelStreamOptions: Codable {
+    let streamId: String
+    let reason: String?
+}
+
+/// IndeRunCore's `ProviderCapabilitySnapshot` is `Sendable` but not `Codable`, even
+/// though both of its members are. This mirror exists only to get it through
+/// `JSONEncoder`; see the upstream follow-up asking for `Codable` (and a schema) on
+/// the snapshot itself.
+private struct EncodableCapabilitySnapshot: Encodable {
+    let providerId: String
+    let descriptor: ProviderDescriptor
+    let capabilities: ProviderDynamicCapabilities
+}
+
+/// A Capacitor plugin method must resolve an object, never a top-level array, so the
+/// snapshots travel wrapped. `IndeRunCapacitor` unwraps them on the JS side.
+private struct CapabilitiesEnvelope: Encodable {
+    let providers: [EncodableCapabilitySnapshot]
+}
+
+/// Called with an already-encoded event/error for one run. The plugin turns these
+/// into `notifyListeners` calls; taking them as closures keeps the pump testable
+/// without Capacitor.
+typealias StreamEventSink = @Sendable (String, JSObject) -> Void
+typealias StreamErrorSink = @Sendable (String, JSObject) -> Void
+
 final class IndeRunCapacitorBridge {
     private var configuredRegistry: ProviderRegistry?
     private var configuredHostServices: HostServices?
+    let streams = StreamRegistry()
+
+    deinit {
+        streams.cancelAll(reason: "Capacitor bridge deallocated.")
+    }
 
     func configure(options: JSObject) throws {
         let runOptions = try decodeConfigureOptions(from: options)
@@ -58,10 +98,125 @@ final class IndeRunCapacitorBridge {
         return try encode(result)
     }
 
+    func checkCapabilities() async throws -> JSObject {
+        guard let registry = configuredRegistry, let hostServices = configuredHostServices else {
+            throw createUnavailable(message: "Capacitor IndeRun has not been configured. Configure providers before calling checkCapabilities().")
+        }
+
+        // IndeRun is a stateless coordinator; new per call is intentional — registry is cached above.
+        let engine = IndeRun(registry: registry, hostServices: hostServices)
+        return try encode(capabilities: await engine.checkCapabilities())
+    }
+
+    func startStream(
+        options: JSObject,
+        onEvent: @escaping StreamEventSink,
+        onError: @escaping StreamErrorSink
+    ) async throws -> JSObject {
+        guard let registry = configuredRegistry, let hostServices = configuredHostServices else {
+            throw createUnavailable(message: "Capacitor IndeRun has not been configured. Configure providers before calling stream(request).")
+        }
+
+        let start = try decodeStartStreamOptions(from: options)
+        // Reserved before the engine is reached, so a cancel arriving during route
+        // selection is recorded rather than dropped as an unknown id.
+        streams.open(streamId: start.streamId)
+
+        let run: StreamRun
+        do {
+            // IndeRun is a stateless coordinator; new per call is intentional — registry is cached above.
+            let engine = IndeRun(registry: registry, hostServices: hostServices)
+            run = try await engine.stream(request: start.request)
+        } catch {
+            streams.finish(streamId: start.streamId)
+            throw error
+        }
+
+        if case .cancelRequested(let reason) = streams.attach(streamId: start.streamId, run: run) {
+            run.cancel(reason: reason)
+        }
+
+        let streamId = start.streamId
+        // Weak, so a live run cannot keep the bridge alive past the plugin's deinit;
+        // the plugin's teardown cancels these tasks, which then release the bridge.
+        let task = Task { [weak self] in
+            guard let self else { return }
+            await self.pump(streamId: streamId, run: run, onEvent: onEvent, onError: onError)
+        }
+        streams.store(task: task, for: streamId)
+
+        return try encode(handle: run.handle)
+    }
+
+    func cancelStream(options: JSObject) throws {
+        let cancel = try decodeCancelStreamOptions(from: options)
+        streams.requestCancel(streamId: cancel.streamId, reason: cancel.reason)
+    }
+
+    func teardownStreams() {
+        streams.cancelAll(reason: "Capacitor plugin torn down.")
+    }
+
+    /// Forwards one run's canonical events to the sink until the stream ends.
+    ///
+    /// A provider failure has already become a terminal `error` event by the time it
+    /// reaches here — the engine's Event Gate owns that. Anything thrown out of the
+    /// sequence is a failure of this bridge, and is reported as one.
+    func pump(
+        streamId: String,
+        run: StreamRun,
+        onEvent: @escaping StreamEventSink,
+        onError: @escaping StreamErrorSink
+    ) async {
+        do {
+            for try await event in run.events {
+                onEvent(streamId, try encode(streamEvent: event))
+            }
+        } catch is CancellationError {
+            // Our own task cancellation, from teardown. The webview is going away and
+            // no one is left to receive a terminal event; not a bridge fault.
+        } catch {
+            let contractError = toIndeRunException(error).toContractError()
+            if let encoded = try? encode(error: contractError) {
+                onError(streamId, encoded)
+            }
+        }
+        streams.finish(streamId: streamId)
+    }
+
     func encode(error: IndeRunError) throws -> JSObject {
         try encodeObject(error)
     }
 
+    // JSONEncoder omits nil optionals, so "emit only the fields this event actually
+    // has" — which is what reconstitutes the right union branch on the JS side —
+    // comes for free from the generated Codable conformances.
+    func encode(streamEvent: StreamEvent) throws -> JSObject {
+        try encodeObject(streamEvent)
+    }
+
+    func encode(handle: StreamRunHandle) throws -> JSObject {
+        try encodeObject(handle)
+    }
+
+    /// The descriptor's enums carry explicit raw values (`in_process`, not `inProcess`),
+    /// and JSONEncoder omits nil optionals — so an unset `streamingAvailable` arrives as
+    /// an absent key rather than a null, which is what lets the JS side read absence as
+    /// "inherit `descriptor.supports.streaming`".
+    func encode(capabilities: [ProviderCapabilitySnapshot]) throws -> JSObject {
+        try encodeObject(
+            CapabilitiesEnvelope(
+                providers: capabilities.map {
+                    EncodableCapabilitySnapshot(
+                        providerId: $0.providerId,
+                        descriptor: $0.descriptor,
+                        capabilities: $0.capabilities
+                    )
+                }
+            )
+        )
+    }
+
     private func makeRegistry(openAI: OpenAIProviderBootstrapOptions?) throws -> ProviderRegistry {
         let registry = ProviderRegistry()
         try registry.register(AppleFoundationModelsProvider())
@@ -89,6 +244,16 @@ final class IndeRunCapacitorBridge {
         return try JSONDecoder().decode(CapacitorRunOptions.self, from: data)
     }
 
+    private func decodeStartStreamOptions(from object: JSObject) throws -> CapacitorStartStreamOptions {
+        let data = try JSONSerialization.data(withJSONObject: object, options: [])
+        return try JSONDecoder().decode(CapacitorStartStreamOptions.self, from: data)
+    }
+
+    private func decodeCancelStreamOptions(from object: JSObject) throws -> CapacitorCancelStreamOptions {
+        let data = try JSONSerialization.data(withJSONObject: object, options: [])
+        return try JSONDecoder().decode(CapacitorCancelStreamOptions.self, from: data)
+    }
+
     private func decodeRequest(from object: JSObject) throws -> TaskRequest {
         let data = try JSONSerialization.data(withJSONObject: object, options: [])
         return try JSONDecoder().decode(TaskRequest.self, from: data)
@@ -101,10 +266,26 @@ final class IndeRunCapacitorBridge {
     private func encodeObject<T: Encodable>(_ value: T) throws -> JSObject {
         let data = try JSONEncoder().encode(value)
         let object = try JSONSerialization.jsonObject(with: data, options: [])
+
+        #if canImport(Capacitor)
+        // Capacitor's JSObject is [String: any JSValue], and a plain `as?` cast cannot
+        // produce one: JSONSerialization hands back NSDictionary/NSArray values, which do
+        // not conform to JSValue, so anything with a nested object or array — a TaskResult's
+        // `output`, a stream event's `payload`, the providers array — failed the cast and
+        // surfaced as "Capacitor bridge failed to encode a JSON object". JSTypes coerces the
+        // tree recursively, which is what the cast was standing in for.
+        guard let dictionary = object as? [AnyHashable: Any],
+              let coerced = JSTypes.coerceDictionaryToJSObject(dictionary) else {
+            throw createInternal(message: "Capacitor bridge failed to encode a JSON object.")
+        }
+        return coerced
+        #else
+        // Standalone builds alias JSObject to [String: Any], where the cast is exact.
         guard let dictionary = object as? JSObject else {
             throw createInternal(message: "Capacitor bridge failed to encode a JSON object.")
         }
         return dictionary
+        #endif
     }
 
     func mapAuthMode(_ value: String?) -> OpenAIAuthMode {

package/ios/Sources/IndeRunCapacitorPlugin/IndeRunCapacitorPlugin.swift

@@ -9,14 +9,24 @@ public final class IndeRunCapacitorPlugin: CAPPlugin, CAPBridgedPlugin {
     public let jsName = "IndeRunCapacitor"
     public let pluginMethods: [CAPPluginMethod] = [
         CAPPluginMethod(name: "configure", returnType: CAPPluginReturnPromise),
-        CAPPluginMethod(name: "run", returnType: CAPPluginReturnPromise)
+        CAPPluginMethod(name: "run", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "checkCapabilities", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "startStream", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "cancelStream", returnType: CAPPluginReturnPromise)
     ]
 
     private let implementation = IndeRunCapacitorBridge()
 
+    /// CAPPlugin has no teardown hook — `load()` has no counterpart — so deinit is
+    /// the only place left to stop runs the webview can no longer receive. The pump
+    /// tasks hold `self` weakly precisely so this can run.
+    deinit {
+        implementation.teardownStreams()
+    }
+
     @objc func configure(_ call: CAPPluginCall) {
         do {
-            try implementation.configure(options: call.options)
+            try implementation.configure(options: call.jsObjectRepresentation)
             call.resolve()
         } catch let error as IndeRunException {
             let contractError = error.toContractError()
@@ -33,7 +43,7 @@ public final class IndeRunCapacitorPlugin: CAPPlugin, CAPBridgedPlugin {
     @objc func run(_ call: CAPPluginCall) {
         Task {
             do {
-                let result = try await implementation.run(requestObject: call.options)
+                let result = try await implementation.run(requestObject: call.jsObjectRepresentation)
                 call.resolve(result)
             } catch let error as IndeRunException {
                 let contractError = error.toContractError()
@@ -47,5 +57,85 @@ public final class IndeRunCapacitorPlugin: CAPPlugin, CAPBridgedPlugin {
             }
         }
     }
+
+    /// Reports every registered provider's static declaration and live availability
+    /// without executing a task. Availability changes between calls — a local model can
+    /// unload, cloud credentials can expire — so callers must not cache it across a run.
+    @objc func checkCapabilities(_ call: CAPPluginCall) {
+        Task {
+            do {
+                call.resolve(try await implementation.checkCapabilities())
+            } catch let error as IndeRunException {
+                let contractError = error.toContractError()
+                let details = try? implementation.encode(error: contractError)
+                call.reject(contractError.message, contractError.errorClass.rawValue, error, details)
+            } catch {
+                let normalized = toIndeRunException(error)
+                let contractError = normalized.toContractError()
+                let details = try? implementation.encode(error: contractError)
+                call.reject(contractError.message, contractError.errorClass.rawValue, normalized, details)
+            }
+        }
+    }
+
+    /// Resolves with the run handle. Only validation and route-selection failures
+    /// reject here; a provider failure, a cancellation, or completion all arrive as
+    /// the single terminal event on `indeRunStreamEvent`.
+    ///
+    /// `retainUntilConsumed` closes the listener-registration race from the native
+    /// side: an event emitted before the JS listener is attached is retained and
+    /// replayed rather than lost.
+    @objc func startStream(_ call: CAPPluginCall) {
+        Task { [weak self] in
+            guard let self else { return }
+            do {
+                let handle = try await self.implementation.startStream(
+                    options: call.jsObjectRepresentation,
+                    onEvent: { [weak self] streamId, event in
+                        self?.notifyListeners(
+                            "indeRunStreamEvent",
+                            data: ["streamId": streamId, "event": event],
+                            retainUntilConsumed: true
+                        )
+                    },
+                    onError: { [weak self] streamId, error in
+                        self?.notifyListeners(
+                            "indeRunStreamError",
+                            data: ["streamId": streamId, "error": error],
+                            retainUntilConsumed: true
+                        )
+                    }
+                )
+                call.resolve(handle)
+            } catch let error as IndeRunException {
+                let contractError = error.toContractError()
+                let details = try? self.implementation.encode(error: contractError)
+                call.reject(contractError.message, contractError.errorClass.rawValue, error, details)
+            } catch {
+                let normalized = toIndeRunException(error)
+                let contractError = normalized.toContractError()
+                let details = try? self.implementation.encode(error: contractError)
+                call.reject(contractError.message, contractError.errorClass.rawValue, normalized, details)
+            }
+        }
+    }
+
+    /// Resolves for an unknown or already-finished run: cancelling after the terminal
+    /// is a no-op by contract, not an error.
+    @objc func cancelStream(_ call: CAPPluginCall) {
+        do {
+            try implementation.cancelStream(options: call.jsObjectRepresentation)
+            call.resolve()
+        } catch let error as IndeRunException {
+            let contractError = error.toContractError()
+            let details = try? implementation.encode(error: contractError)
+            call.reject(contractError.message, contractError.errorClass.rawValue, error, details)
+        } catch {
+            let normalized = toIndeRunException(error)
+            let contractError = normalized.toContractError()
+            let details = try? implementation.encode(error: contractError)
+            call.reject(contractError.message, contractError.errorClass.rawValue, normalized, details)
+        }
+    }
 }
 #endif

package/ios/Sources/IndeRunCapacitorPlugin/IndeRunCapacitorStreamRegistry.swift

@@ -0,0 +1,121 @@
+import Foundation
+import IndeRunCore
+
+/// Tracks the streaming runs the bridge is currently pumping, keyed by the
+/// bridge-local `streamId`.
+///
+/// Two things make this more than a dictionary. A cancel can arrive before the run
+/// it refers to exists — `startStream` has to reach route selection before there is
+/// anything to cancel — so a cancel requested in that window is recorded and applied
+/// on attach. And cancelling a run is *not* cancelling the pump task: the engine
+/// answers a cancel with its one `cancelled` terminal event, which the pump still has
+/// to deliver. Task cancellation is reserved for teardown, where the webview is going
+/// away and nobody is left to receive a terminal.
+///
+/// Deliberately free of any Capacitor dependency, so it is exercised by `swift test`
+/// on macOS where `canImport(Capacitor)` is false.
+final class StreamRegistry {
+    enum AttachOutcome: Equatable {
+        case attached
+        /// A cancel arrived before the run did; the caller must apply it.
+        case cancelRequested(reason: String?)
+    }
+
+    private struct Entry {
+        var run: StreamRun?
+        var task: Task<Void, Never>?
+        var cancelRequested = false
+        var cancelReason: String?
+    }
+
+    private let lock = NSLock()
+    private var entries: [String: Entry] = [:]
+
+    var activeCount: Int {
+        lock.lock()
+        defer { lock.unlock() }
+        return entries.count
+    }
+
+    /// Reserves the id so a cancel arriving before the run can be recorded rather
+    /// than dropped as unknown.
+    func open(streamId: String) {
+        lock.lock()
+        defer { lock.unlock() }
+        if entries[streamId] == nil {
+            entries[streamId] = Entry()
+        }
+    }
+
+    func attach(streamId: String, run: StreamRun) -> AttachOutcome {
+        lock.lock()
+        guard var entry = entries[streamId] else {
+            // Torn down while the engine was still selecting a route.
+            lock.unlock()
+            return .cancelRequested(reason: nil)
+        }
+        if entry.cancelRequested {
+            let reason = entry.cancelReason
+            lock.unlock()
+            return .cancelRequested(reason: reason)
+        }
+        entry.run = run
+        entries[streamId] = entry
+        lock.unlock()
+        return .attached
+    }
+
+    func store(task: Task<Void, Never>, for streamId: String) {
+        lock.lock()
+        defer { lock.unlock() }
+        guard var entry = entries[streamId] else {
+            task.cancel()
+            return
+        }
+        entry.task = task
+        entries[streamId] = entry
+    }
+
+    /// Cancels the run if it has attached, otherwise records the request for attach.
+    /// An unknown id — already finished, or never started — is a silent no-op, which
+    /// is what makes cancelling after the terminal harmless.
+    func requestCancel(streamId: String, reason: String?) {
+        lock.lock()
+        guard var entry = entries[streamId] else {
+            lock.unlock()
+            return
+        }
+        if entry.cancelRequested {
+            lock.unlock()
+            return
+        }
+        entry.cancelRequested = true
+        entry.cancelReason = reason
+        let run = entry.run
+        entries[streamId] = entry
+        lock.unlock()
+
+        // Never under the lock: cancel reaches into engine code.
+        run?.cancel(reason: reason)
+    }
+
+    func finish(streamId: String) {
+        lock.lock()
+        defer { lock.unlock() }
+        entries.removeValue(forKey: streamId)
+    }
+
+    /// Teardown. Cancels each run first so providers unwind, then the pump tasks,
+    /// which at this point have nobody left to deliver to.
+    func cancelAll(reason: String?) {
+        lock.lock()
+        let draining = entries
+        entries.removeAll()
+        lock.unlock()
+
+        for (_, entry) in draining {
+            entry.run?.cancel(reason: reason)
+            entry.task?.cancel()
+        }
+    }
+}