agents 0.17.0 → 0.17.3

package/dist/mcp/client.d.ts

@@ -14,7 +14,7 @@ import {
   wt as MCPDiscoverResult,
   xt as MCPClientOAuthCallbackConfig,
   yt as MCPClientManager
-} from "../agent-tool-types-Cd1TZPfB.js";
+} from "../agent-tool-types-CNyE1iz_.js";
 export {
   MCPAITool,
   MCPAIToolSet,

package/dist/mcp/index.d.ts

@@ -28,7 +28,7 @@ import {
   wt as MCPDiscoverResult,
   xt as MCPClientOAuthCallbackConfig,
   zt as ElicitResult
-} from "../agent-tool-types-Cd1TZPfB.js";
+} from "../agent-tool-types-CNyE1iz_.js";
 export {
   type ClearableEventStore,
   type CreateMcpHandlerOptions,

package/dist/observability/index.d.ts

@@ -5,7 +5,7 @@ import {
   o as subscribe,
   r as ObservabilityEvent,
   t as ChannelEventMap
-} from "../index-CcbnKkNh.js";
+} from "../index-BRnybD6X.js";
 export {
   ChannelEventMap,
   Observability,

package/dist/react.d.ts

@@ -2,7 +2,7 @@ import {
   Y as MCPServersState,
   _ as AgentToolRunState,
   g as AgentToolRunPart
-} from "./agent-tool-types-Cd1TZPfB.js";
+} from "./agent-tool-types-CNyE1iz_.js";
 import { ClientParameters } from "./serializable.js";
 import {
   AgentConnectionError,

package/dist/react.js

@@ -1,7 +1,7 @@
 import "./types.js";
 import { camelCaseToKebabCase } from "./utils.js";
 import { AgentConnectionError, createStubProxy, isTerminalCloseEvent } from "./client.js";
-import { n as applyAgentToolEvent, r as createAgentToolEventState } from "./agent-tools-BXlsuX0d.js";
+import { n as applyAgentToolEvent, r as createAgentToolEventState } from "./agent-tools-y7zLfw4Q.js";
 import { usePartySocket } from "partysocket/react";
 import { use, useCallback, useEffect, useMemo, useRef, useState } from "react";
 //#region src/react.tsx

package/dist/{retries-CwlpAGet.d.ts → retries-CvHJwSuh.d.ts}

@@ -75,6 +75,14 @@ declare function isErrorRetryable(err: unknown): boolean;
  * invocation, which runs the new code and succeeds.
  */
 declare function isDurableObjectCodeUpdateReset(error: unknown): boolean;
+/**
+ * Whether an error (or anything in its `cause` chain, or a raw error-message
+ * string) is a Durable Object memory-limit reset — see
+ * {@link MEMORY_LIMIT_RESET_PATTERN}. Unlike {@link isPlatformTransientError},
+ * re-running the same work re-OOMs deterministically, so callers must NOT defer
+ * it like a transient; they should bound retries tightly and then seal (#1825).
+ */
+declare function isDurableObjectMemoryLimitReset(error: unknown): boolean;
 /**
  * Whether an error (or anything in its `cause` chain) is a transient failure
  * of the PLATFORM rather than of the code that threw it:
@@ -98,12 +106,13 @@ declare function isDurableObjectCodeUpdateReset(error: unknown): boolean;
 declare function isPlatformTransientError(error: unknown): boolean;
 //#endregion
 export {
-  jitterBackoff as a,
-  isPlatformTransientError as i,
+  isPlatformTransientError as a,
+  validateRetryOptions as c,
+  isErrorRetryable as i,
   isDurableObjectCodeUpdateReset as n,
-  tryN as o,
-  isErrorRetryable as r,
-  validateRetryOptions as s,
+  jitterBackoff as o,
+  isDurableObjectMemoryLimitReset as r,
+  tryN as s,
   RetryOptions as t
 };
-//# sourceMappingURL=retries-CwlpAGet.d.ts.map
+//# sourceMappingURL=retries-CvHJwSuh.d.ts.map

package/dist/retries.d.ts

@@ -1,15 +1,17 @@
 import {
-  a as jitterBackoff,
-  i as isPlatformTransientError,
+  a as isPlatformTransientError,
+  c as validateRetryOptions,
+  i as isErrorRetryable,
   n as isDurableObjectCodeUpdateReset,
-  o as tryN,
-  r as isErrorRetryable,
-  s as validateRetryOptions,
+  o as jitterBackoff,
+  r as isDurableObjectMemoryLimitReset,
+  s as tryN,
   t as RetryOptions
-} from "./retries-CwlpAGet.js";
+} from "./retries-CvHJwSuh.js";
 export {
   RetryOptions,
   isDurableObjectCodeUpdateReset,
+  isDurableObjectMemoryLimitReset,
   isErrorRetryable,
   isPlatformTransientError,
   jitterBackoff,

package/dist/retries.js

@@ -107,6 +107,38 @@ const SUPERSEDED_ISOLATE_PATTERN = /reset because its code was updated|this scri
 * as the platform's failure, not the callback's.
 */
 const CONNECTION_LOST_PATTERN = /network connection lost/i;
+/**
+* The Durable Object memory-limit reset — the isolate exceeded its 128 MB limit
+* and was reset by the platform (workerd surfaces this verbatim as
+* "Durable Object's isolate exceeded its memory limit and was reset."; the D1
+* sibling is "D1 DB's isolate exceeded its memory limit and was reset.").
+*
+* The match is the broad shared fragment "exceeded its memory limit" rather than
+* the full "...and was reset" sentence: real-world surfacings truncate or reword
+* the tail (some log pipelines clip the message; D1/storage wrappers re-prefix
+* it), and a customer-reported loop (#1825) showed lines carrying only the
+* "exceeded its memory limit" fragment. Missing a surfacing here means the
+* circuit breaker never engages, so we err toward the broader match — and even a
+* false positive is fail-safe (a tightly-bounded retry-then-seal, not data loss).
+*
+* This is DELIBERATELY a separate class from `SUPERSEDED_ISOLATE_PATTERN` /
+* {@link isPlatformTransientError}, and is NOT folded into them. A supersede or
+* connection-lost transient means "re-run the same work and it succeeds on a
+* healthy isolate" — those classes can be deferred and retried *indefinitely*. A
+* memory-limit reset is the opposite: re-running the SAME memory-heavy work
+* deterministically re-OOMs (the footprint, not the platform, is the cause), so
+* deferring it indefinitely would PRESERVE the one-shot row and re-run the
+* doomed work forever (amplifying the loop and cost — see #1825). It is a
+* poison-pill signal: callers must bound retries tightly and then SEAL.
+*
+* Accordingly the schedule executor (`_executeScheduleCallback`) and the
+* alarm-boundary circuit breaker (`Agent.alarm`) treat it as its OWN class: a
+* memory-limit reset is re-thrown (row preserved) so it reaches the breaker,
+* which tolerates a few strikes (`maxAlarmMemoryLimitStrikes`) and then seals +
+* purges the looping row — i.e. *bounded* deferral, never the unbounded deferral
+* the transient classes get.
+*/
+const MEMORY_LIMIT_RESET_PATTERN = /exceeded its memory limit/i;
 function errorMessageOf(error) {
 	return error instanceof Error ? error.message : typeof error === "string" ? error : "";
 }
@@ -134,6 +166,17 @@ function isDurableObjectCodeUpdateReset(error) {
 	return false;
 }
 /**
+* Whether an error (or anything in its `cause` chain, or a raw error-message
+* string) is a Durable Object memory-limit reset — see
+* {@link MEMORY_LIMIT_RESET_PATTERN}. Unlike {@link isPlatformTransientError},
+* re-running the same work re-OOMs deterministically, so callers must NOT defer
+* it like a transient; they should bound retries tightly and then seal (#1825).
+*/
+function isDurableObjectMemoryLimitReset(error) {
+	for (const e of selfAndCauses(error)) if (MEMORY_LIMIT_RESET_PATTERN.test(errorMessageOf(e))) return true;
+	return false;
+}
+/**
 * Whether an error (or anything in its `cause` chain) is a transient failure
 * of the PLATFORM rather than of the code that threw it:
 *
@@ -163,6 +206,6 @@ function isPlatformTransientError(error) {
 	return false;
 }
 //#endregion
-export { isDurableObjectCodeUpdateReset, isErrorRetryable, isPlatformTransientError, jitterBackoff, tryN, validateRetryOptions };
+export { isDurableObjectCodeUpdateReset, isDurableObjectMemoryLimitReset, isErrorRetryable, isPlatformTransientError, jitterBackoff, tryN, validateRetryOptions };
 
 //# sourceMappingURL=retries.js.map

package/dist/retries.js.map

@@ -1 +1 @@
-{"version":3,"file":"retries.js","names":[],"sources":["../src/retries.ts"],"sourcesContent":["/**\n * Retry options for schedule(), scheduleEvery(), queue(), and this.retry().\n */\nexport interface RetryOptions {\n  /** Max number of attempts (including the first). Default: 3 */\n  maxAttempts?: number;\n  /** Base delay in ms for exponential backoff. Default: 100 */\n  baseDelayMs?: number;\n  /** Max delay cap in ms. Default: 3000 */\n  maxDelayMs?: number;\n}\n\n/**\n * Internal options for tryN -- extends RetryOptions with a shouldRetry predicate.\n */\ninterface TryNOptions extends RetryOptions {\n  /**\n   * Predicate to determine if an error should be retried.\n   * Receives the error and the next attempt number (so callers can\n   * make attempt-aware decisions).\n   * If not provided, all errors are retried.\n   */\n  shouldRetry?: (err: unknown, nextAttempt: number) => boolean;\n}\n\n/**\n * Validate retry options eagerly so invalid config fails at enqueue/schedule time\n * rather than at execution time. Checks individual field ranges, enforces integer\n * maxAttempts, and validates cross-field constraints after resolving against\n * defaults when provided.\n */\nexport function validateRetryOptions(\n  options: RetryOptions,\n  defaults?: Required<RetryOptions>\n): void {\n  if (options.maxAttempts !== undefined) {\n    if (!Number.isFinite(options.maxAttempts) || options.maxAttempts < 1) {\n      throw new Error(\"retry.maxAttempts must be >= 1\");\n    }\n    if (!Number.isInteger(options.maxAttempts)) {\n      throw new Error(\"retry.maxAttempts must be an integer\");\n    }\n  }\n  if (options.baseDelayMs !== undefined) {\n    if (!Number.isFinite(options.baseDelayMs) || options.baseDelayMs <= 0) {\n      throw new Error(\"retry.baseDelayMs must be > 0\");\n    }\n  }\n  if (options.maxDelayMs !== undefined) {\n    if (!Number.isFinite(options.maxDelayMs) || options.maxDelayMs <= 0) {\n      throw new Error(\"retry.maxDelayMs must be > 0\");\n    }\n  }\n\n  // Resolve against defaults (when provided) so that cross-field checks\n  // catch e.g. { baseDelayMs: 5000 } against default maxDelayMs: 3000.\n  const resolvedBase = options.baseDelayMs ?? defaults?.baseDelayMs;\n  const resolvedMax = options.maxDelayMs ?? defaults?.maxDelayMs;\n  if (\n    resolvedBase !== undefined &&\n    resolvedMax !== undefined &&\n    resolvedBase > resolvedMax\n  ) {\n    throw new Error(\"retry.baseDelayMs must be <= retry.maxDelayMs\");\n  }\n}\n\n/**\n * Returns the number of milliseconds to wait before retrying a request.\n * Uses the \"Full Jitter\" approach from\n * https://aws.amazon.com/blogs/architecture/exponential-backoff-and-jitter/\n *\n * @param attempt The current attempt number (1-indexed).\n * @param baseDelayMs Base delay multiplier in ms.\n * @param maxDelayMs Maximum delay cap in ms.\n * @returns Milliseconds to wait before retrying.\n */\nexport function jitterBackoff(\n  attempt: number,\n  baseDelayMs: number,\n  maxDelayMs: number\n): number {\n  const upperBoundMs = Math.min(2 ** attempt * baseDelayMs, maxDelayMs);\n  return Math.floor(Math.random() * upperBoundMs);\n}\n\n/**\n * Retry an async function up to `n` total attempts with jittered exponential backoff.\n *\n * @param n Total number of attempts (must be a finite integer >= 1).\n * @param fn The async function to retry. Receives the current attempt number (1-indexed).\n * @param options Retry configuration.\n * @returns The result of `fn` on success.\n * @throws The last error if all attempts fail or `shouldRetry` returns false.\n */\nexport async function tryN<T>(\n  n: number,\n  fn: (attempt: number) => Promise<T>,\n  options?: TryNOptions\n): Promise<T> {\n  if (!Number.isFinite(n) || n < 1) {\n    throw new Error(\"retry.maxAttempts must be >= 1\");\n  }\n  n = Math.floor(n);\n\n  const rawBase = options?.baseDelayMs ?? 100;\n  const rawMax = options?.maxDelayMs ?? 3000;\n\n  if (!Number.isFinite(rawBase) || rawBase <= 0) {\n    throw new Error(\"retry.baseDelayMs must be > 0\");\n  }\n  if (!Number.isFinite(rawMax) || rawMax <= 0) {\n    throw new Error(\"retry.maxDelayMs must be > 0\");\n  }\n\n  const baseDelayMs = Math.floor(rawBase);\n  const maxDelayMs = Math.floor(rawMax);\n\n  if (baseDelayMs > maxDelayMs) {\n    throw new Error(\"retry.baseDelayMs must be <= retry.maxDelayMs\");\n  }\n\n  let attempt = 1;\n  while (true) {\n    try {\n      return await fn(attempt);\n    } catch (err) {\n      const nextAttempt = attempt + 1;\n      if (\n        nextAttempt > n ||\n        (options?.shouldRetry && !options.shouldRetry(err, nextAttempt))\n      ) {\n        throw err;\n      }\n      const delay = jitterBackoff(attempt, baseDelayMs, maxDelayMs);\n      await new Promise((resolve) => setTimeout(resolve, delay));\n      attempt = nextAttempt;\n    }\n  }\n}\n\n/**\n * Returns true if the given error is retryable according to Durable Object error handling.\n * See https://developers.cloudflare.com/durable-objects/best-practices/error-handling/\n *\n * An error is retryable if it has `retryable: true` but is NOT an overloaded error.\n */\nexport function isErrorRetryable(err: unknown): boolean {\n  if (typeof err !== \"object\" || err === null) {\n    return false;\n  }\n  const msg = String(err);\n  const typed = err as { retryable?: boolean; overloaded?: boolean };\n  return (\n    Boolean(typed.retryable) &&\n    !typed.overloaded &&\n    !msg.includes(\"Durable Object is overloaded\")\n  );\n}\n\n/**\n * The \"superseded isolate\" platform messages — the invocation is running on an\n * isolate the platform has replaced with a new version (a deploy / code\n * update). For the rest of that invocation every operation throws the same\n * error (code never reloads mid-invocation), so in-process retries are futile;\n * but the next fresh invocation runs the new code and succeeds.\n *\n * workerd surfaces this as a plain `Error` with one of a few messages, all the\n * same failure class — a message match is the only signal:\n *   - \"Durable Object reset because its code was updated.\"  (DO storage op on a\n *     superseded isolate / deploy bounce)\n *   - \"This script has been upgraded. Please send a new request to connect to\n *     the new version.\"  (a stub/connection to a superseded script; the message\n *     literally instructs the caller to retry on the new version)\n *\n * The match stays close to the verbatim platform strings (rather than a loose\n * \"upgraded\"/\"reset\" substring) so an ordinary application error that happens\n * to mention those words is NOT misclassified as a supersede.\n */\nconst SUPERSEDED_ISOLATE_PATTERN =\n  /reset because its code was updated|this script has been upgraded/i;\n\n/**\n * The \"Network connection lost.\" platform transient — the connection between\n * the isolate and its storage (or another DO) dropped. Unlike a supersede this\n * MAY succeed on an in-process retry (a momentary blip), so it must not skip\n * the in-process retry budget — but during a deploy-reset window it never\n * succeeds in-process and surfaces interleaved with the supersede messages\n * (SQL ops throw `SqlError: SQL query failed: Network connection lost.` while\n * KV ops throw the reset message), so on retry exhaustion it must be treated\n * as the platform's failure, not the callback's.\n */\nconst CONNECTION_LOST_PATTERN = /network connection lost/i;\n\nfunction errorMessageOf(error: unknown): string {\n  return error instanceof Error\n    ? error.message\n    : typeof error === \"string\"\n      ? error\n      : \"\";\n}\n\n/**\n * Iterate an error and its `cause` chain (depth-limited so a cyclic chain\n * can't spin). Wrappers like `SqlError` carry the original platform error in\n * `cause` and may not propagate signal properties (e.g. the CF `retryable`\n * flag), so classification must look through them.\n */\nfunction* selfAndCauses(error: unknown): Generator<unknown> {\n  let current = error;\n  for (let depth = 0; depth < 8 && current != null; depth++) {\n    yield current;\n    current =\n      typeof current === \"object\"\n        ? (current as { cause?: unknown }).cause\n        : undefined;\n  }\n}\n\n/**\n * Whether an error (or anything in its `cause` chain) is a transient\n * \"superseded isolate\" failure — see `SUPERSEDED_ISOLATE_PATTERN`. In-process\n * retries are futile for this class; the work must be deferred to a fresh\n * invocation, which runs the new code and succeeds.\n */\nexport function isDurableObjectCodeUpdateReset(error: unknown): boolean {\n  for (const e of selfAndCauses(error)) {\n    if (SUPERSEDED_ISOLATE_PATTERN.test(errorMessageOf(e))) return true;\n  }\n  return false;\n}\n\n/**\n * Whether an error (or anything in its `cause` chain) is a transient failure\n * of the PLATFORM rather than of the code that threw it:\n *\n *   - a superseded-isolate reset (\"reset because its code was updated\" /\n *     \"this script has been upgraded\") — a deploy replaced the isolate;\n *   - an error the platform itself flags `retryable: true` (excluding\n *     overloaded errors, where retrying the same object won't help) — see\n *     `isErrorRetryable`;\n *   - \"Network connection lost.\" — the storage/stub connection dropped. The\n *     CF `retryable` flag does not survive error wrappers (e.g. `SqlError`\n *     copies only the message + `cause`) and is absent in some local-dev\n *     shapes, so the verbatim message is matched as well.\n *\n * Used to decide whether failed work should be RE-RUN LATER (platform\n * transient — the same work succeeds once the platform recovers, typically\n * seconds after a deploy) versus ABANDONED as genuinely failing (application\n * error — re-running yields the same failure). A genuine application error\n * carries none of these signals, so it is never misclassified by this check.\n */\nexport function isPlatformTransientError(error: unknown): boolean {\n  for (const e of selfAndCauses(error)) {\n    const message = errorMessageOf(e);\n    if (SUPERSEDED_ISOLATE_PATTERN.test(message)) return true;\n    if (CONNECTION_LOST_PATTERN.test(message)) return true;\n    if (isErrorRetryable(e)) return true;\n  }\n  return false;\n}\n"],"mappings":";;;;;;;AA+BA,SAAgB,qBACd,SACA,UACM;CACN,IAAI,QAAQ,gBAAgB,KAAA,GAAW;EACrC,IAAI,CAAC,OAAO,SAAS,QAAQ,WAAW,KAAK,QAAQ,cAAc,GACjE,MAAM,IAAI,MAAM,gCAAgC;EAElD,IAAI,CAAC,OAAO,UAAU,QAAQ,WAAW,GACvC,MAAM,IAAI,MAAM,sCAAsC;CAE1D;CACA,IAAI,QAAQ,gBAAgB,KAAA;MACtB,CAAC,OAAO,SAAS,QAAQ,WAAW,KAAK,QAAQ,eAAe,GAClE,MAAM,IAAI,MAAM,+BAA+B;CAAA;CAGnD,IAAI,QAAQ,eAAe,KAAA;MACrB,CAAC,OAAO,SAAS,QAAQ,UAAU,KAAK,QAAQ,cAAc,GAChE,MAAM,IAAI,MAAM,8BAA8B;CAAA;CAMlD,MAAM,eAAe,QAAQ,eAAe,UAAU;CACtD,MAAM,cAAc,QAAQ,cAAc,UAAU;CACpD,IACE,iBAAiB,KAAA,KACjB,gBAAgB,KAAA,KAChB,eAAe,aAEf,MAAM,IAAI,MAAM,+CAA+C;AAEnE;;;;;;;;;;;AAYA,SAAgB,cACd,SACA,aACA,YACQ;CACR,MAAM,eAAe,KAAK,IAAI,KAAK,UAAU,aAAa,UAAU;CACpE,OAAO,KAAK,MAAM,KAAK,OAAO,IAAI,YAAY;AAChD;;;;;;;;;;AAWA,eAAsB,KACpB,GACA,IACA,SACY;CACZ,IAAI,CAAC,OAAO,SAAS,CAAC,KAAK,IAAI,GAC7B,MAAM,IAAI,MAAM,gCAAgC;CAElD,IAAI,KAAK,MAAM,CAAC;CAEhB,MAAM,UAAU,SAAS,eAAe;CACxC,MAAM,SAAS,SAAS,cAAc;CAEtC,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,WAAW,GAC1C,MAAM,IAAI,MAAM,+BAA+B;CAEjD,IAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GACxC,MAAM,IAAI,MAAM,8BAA8B;CAGhD,MAAM,cAAc,KAAK,MAAM,OAAO;CACtC,MAAM,aAAa,KAAK,MAAM,MAAM;CAEpC,IAAI,cAAc,YAChB,MAAM,IAAI,MAAM,+CAA+C;CAGjE,IAAI,UAAU;CACd,OAAO,MACL,IAAI;EACF,OAAO,MAAM,GAAG,OAAO;CACzB,SAAS,KAAK;EACZ,MAAM,cAAc,UAAU;EAC9B,IACE,cAAc,KACb,SAAS,eAAe,CAAC,QAAQ,YAAY,KAAK,WAAW,GAE9D,MAAM;EAER,MAAM,QAAQ,cAAc,SAAS,aAAa,UAAU;EAC5D,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,KAAK,CAAC;EACzD,UAAU;CACZ;AAEJ;;;;;;;AAQA,SAAgB,iBAAiB,KAAuB;CACtD,IAAI,OAAO,QAAQ,YAAY,QAAQ,MACrC,OAAO;CAET,MAAM,MAAM,OAAO,GAAG;CACtB,MAAM,QAAQ;CACd,OACE,QAAQ,MAAM,SAAS,KACvB,CAAC,MAAM,cACP,CAAC,IAAI,SAAS,8BAA8B;AAEhD;;;;;;;;;;;;;;;;;;;;AAqBA,MAAM,6BACJ;;;;;;;;;;;AAYF,MAAM,0BAA0B;AAEhC,SAAS,eAAe,OAAwB;CAC9C,OAAO,iBAAiB,QACpB,MAAM,UACN,OAAO,UAAU,WACf,QACA;AACR;;;;;;;AAQA,UAAU,cAAc,OAAoC;CAC1D,IAAI,UAAU;CACd,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,WAAW,MAAM,SAAS;EACzD,MAAM;EACN,UACE,OAAO,YAAY,WACd,QAAgC,QACjC,KAAA;CACR;AACF;;;;;;;AAQA,SAAgB,+BAA+B,OAAyB;CACtE,KAAK,MAAM,KAAK,cAAc,KAAK,GACjC,IAAI,2BAA2B,KAAK,eAAe,CAAC,CAAC,GAAG,OAAO;CAEjE,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,yBAAyB,OAAyB;CAChE,KAAK,MAAM,KAAK,cAAc,KAAK,GAAG;EACpC,MAAM,UAAU,eAAe,CAAC;EAChC,IAAI,2BAA2B,KAAK,OAAO,GAAG,OAAO;EACrD,IAAI,wBAAwB,KAAK,OAAO,GAAG,OAAO;EAClD,IAAI,iBAAiB,CAAC,GAAG,OAAO;CAClC;CACA,OAAO;AACT"}
+{"version":3,"file":"retries.js","names":[],"sources":["../src/retries.ts"],"sourcesContent":["/**\n * Retry options for schedule(), scheduleEvery(), queue(), and this.retry().\n */\nexport interface RetryOptions {\n  /** Max number of attempts (including the first). Default: 3 */\n  maxAttempts?: number;\n  /** Base delay in ms for exponential backoff. Default: 100 */\n  baseDelayMs?: number;\n  /** Max delay cap in ms. Default: 3000 */\n  maxDelayMs?: number;\n}\n\n/**\n * Internal options for tryN -- extends RetryOptions with a shouldRetry predicate.\n */\ninterface TryNOptions extends RetryOptions {\n  /**\n   * Predicate to determine if an error should be retried.\n   * Receives the error and the next attempt number (so callers can\n   * make attempt-aware decisions).\n   * If not provided, all errors are retried.\n   */\n  shouldRetry?: (err: unknown, nextAttempt: number) => boolean;\n}\n\n/**\n * Validate retry options eagerly so invalid config fails at enqueue/schedule time\n * rather than at execution time. Checks individual field ranges, enforces integer\n * maxAttempts, and validates cross-field constraints after resolving against\n * defaults when provided.\n */\nexport function validateRetryOptions(\n  options: RetryOptions,\n  defaults?: Required<RetryOptions>\n): void {\n  if (options.maxAttempts !== undefined) {\n    if (!Number.isFinite(options.maxAttempts) || options.maxAttempts < 1) {\n      throw new Error(\"retry.maxAttempts must be >= 1\");\n    }\n    if (!Number.isInteger(options.maxAttempts)) {\n      throw new Error(\"retry.maxAttempts must be an integer\");\n    }\n  }\n  if (options.baseDelayMs !== undefined) {\n    if (!Number.isFinite(options.baseDelayMs) || options.baseDelayMs <= 0) {\n      throw new Error(\"retry.baseDelayMs must be > 0\");\n    }\n  }\n  if (options.maxDelayMs !== undefined) {\n    if (!Number.isFinite(options.maxDelayMs) || options.maxDelayMs <= 0) {\n      throw new Error(\"retry.maxDelayMs must be > 0\");\n    }\n  }\n\n  // Resolve against defaults (when provided) so that cross-field checks\n  // catch e.g. { baseDelayMs: 5000 } against default maxDelayMs: 3000.\n  const resolvedBase = options.baseDelayMs ?? defaults?.baseDelayMs;\n  const resolvedMax = options.maxDelayMs ?? defaults?.maxDelayMs;\n  if (\n    resolvedBase !== undefined &&\n    resolvedMax !== undefined &&\n    resolvedBase > resolvedMax\n  ) {\n    throw new Error(\"retry.baseDelayMs must be <= retry.maxDelayMs\");\n  }\n}\n\n/**\n * Returns the number of milliseconds to wait before retrying a request.\n * Uses the \"Full Jitter\" approach from\n * https://aws.amazon.com/blogs/architecture/exponential-backoff-and-jitter/\n *\n * @param attempt The current attempt number (1-indexed).\n * @param baseDelayMs Base delay multiplier in ms.\n * @param maxDelayMs Maximum delay cap in ms.\n * @returns Milliseconds to wait before retrying.\n */\nexport function jitterBackoff(\n  attempt: number,\n  baseDelayMs: number,\n  maxDelayMs: number\n): number {\n  const upperBoundMs = Math.min(2 ** attempt * baseDelayMs, maxDelayMs);\n  return Math.floor(Math.random() * upperBoundMs);\n}\n\n/**\n * Retry an async function up to `n` total attempts with jittered exponential backoff.\n *\n * @param n Total number of attempts (must be a finite integer >= 1).\n * @param fn The async function to retry. Receives the current attempt number (1-indexed).\n * @param options Retry configuration.\n * @returns The result of `fn` on success.\n * @throws The last error if all attempts fail or `shouldRetry` returns false.\n */\nexport async function tryN<T>(\n  n: number,\n  fn: (attempt: number) => Promise<T>,\n  options?: TryNOptions\n): Promise<T> {\n  if (!Number.isFinite(n) || n < 1) {\n    throw new Error(\"retry.maxAttempts must be >= 1\");\n  }\n  n = Math.floor(n);\n\n  const rawBase = options?.baseDelayMs ?? 100;\n  const rawMax = options?.maxDelayMs ?? 3000;\n\n  if (!Number.isFinite(rawBase) || rawBase <= 0) {\n    throw new Error(\"retry.baseDelayMs must be > 0\");\n  }\n  if (!Number.isFinite(rawMax) || rawMax <= 0) {\n    throw new Error(\"retry.maxDelayMs must be > 0\");\n  }\n\n  const baseDelayMs = Math.floor(rawBase);\n  const maxDelayMs = Math.floor(rawMax);\n\n  if (baseDelayMs > maxDelayMs) {\n    throw new Error(\"retry.baseDelayMs must be <= retry.maxDelayMs\");\n  }\n\n  let attempt = 1;\n  while (true) {\n    try {\n      return await fn(attempt);\n    } catch (err) {\n      const nextAttempt = attempt + 1;\n      if (\n        nextAttempt > n ||\n        (options?.shouldRetry && !options.shouldRetry(err, nextAttempt))\n      ) {\n        throw err;\n      }\n      const delay = jitterBackoff(attempt, baseDelayMs, maxDelayMs);\n      await new Promise((resolve) => setTimeout(resolve, delay));\n      attempt = nextAttempt;\n    }\n  }\n}\n\n/**\n * Returns true if the given error is retryable according to Durable Object error handling.\n * See https://developers.cloudflare.com/durable-objects/best-practices/error-handling/\n *\n * An error is retryable if it has `retryable: true` but is NOT an overloaded error.\n */\nexport function isErrorRetryable(err: unknown): boolean {\n  if (typeof err !== \"object\" || err === null) {\n    return false;\n  }\n  const msg = String(err);\n  const typed = err as { retryable?: boolean; overloaded?: boolean };\n  return (\n    Boolean(typed.retryable) &&\n    !typed.overloaded &&\n    !msg.includes(\"Durable Object is overloaded\")\n  );\n}\n\n/**\n * The \"superseded isolate\" platform messages — the invocation is running on an\n * isolate the platform has replaced with a new version (a deploy / code\n * update). For the rest of that invocation every operation throws the same\n * error (code never reloads mid-invocation), so in-process retries are futile;\n * but the next fresh invocation runs the new code and succeeds.\n *\n * workerd surfaces this as a plain `Error` with one of a few messages, all the\n * same failure class — a message match is the only signal:\n *   - \"Durable Object reset because its code was updated.\"  (DO storage op on a\n *     superseded isolate / deploy bounce)\n *   - \"This script has been upgraded. Please send a new request to connect to\n *     the new version.\"  (a stub/connection to a superseded script; the message\n *     literally instructs the caller to retry on the new version)\n *\n * The match stays close to the verbatim platform strings (rather than a loose\n * \"upgraded\"/\"reset\" substring) so an ordinary application error that happens\n * to mention those words is NOT misclassified as a supersede.\n */\nconst SUPERSEDED_ISOLATE_PATTERN =\n  /reset because its code was updated|this script has been upgraded/i;\n\n/**\n * The \"Network connection lost.\" platform transient — the connection between\n * the isolate and its storage (or another DO) dropped. Unlike a supersede this\n * MAY succeed on an in-process retry (a momentary blip), so it must not skip\n * the in-process retry budget — but during a deploy-reset window it never\n * succeeds in-process and surfaces interleaved with the supersede messages\n * (SQL ops throw `SqlError: SQL query failed: Network connection lost.` while\n * KV ops throw the reset message), so on retry exhaustion it must be treated\n * as the platform's failure, not the callback's.\n */\nconst CONNECTION_LOST_PATTERN = /network connection lost/i;\n\n/**\n * The Durable Object memory-limit reset — the isolate exceeded its 128 MB limit\n * and was reset by the platform (workerd surfaces this verbatim as\n * \"Durable Object's isolate exceeded its memory limit and was reset.\"; the D1\n * sibling is \"D1 DB's isolate exceeded its memory limit and was reset.\").\n *\n * The match is the broad shared fragment \"exceeded its memory limit\" rather than\n * the full \"...and was reset\" sentence: real-world surfacings truncate or reword\n * the tail (some log pipelines clip the message; D1/storage wrappers re-prefix\n * it), and a customer-reported loop (#1825) showed lines carrying only the\n * \"exceeded its memory limit\" fragment. Missing a surfacing here means the\n * circuit breaker never engages, so we err toward the broader match — and even a\n * false positive is fail-safe (a tightly-bounded retry-then-seal, not data loss).\n *\n * This is DELIBERATELY a separate class from `SUPERSEDED_ISOLATE_PATTERN` /\n * {@link isPlatformTransientError}, and is NOT folded into them. A supersede or\n * connection-lost transient means \"re-run the same work and it succeeds on a\n * healthy isolate\" — those classes can be deferred and retried *indefinitely*. A\n * memory-limit reset is the opposite: re-running the SAME memory-heavy work\n * deterministically re-OOMs (the footprint, not the platform, is the cause), so\n * deferring it indefinitely would PRESERVE the one-shot row and re-run the\n * doomed work forever (amplifying the loop and cost — see #1825). It is a\n * poison-pill signal: callers must bound retries tightly and then SEAL.\n *\n * Accordingly the schedule executor (`_executeScheduleCallback`) and the\n * alarm-boundary circuit breaker (`Agent.alarm`) treat it as its OWN class: a\n * memory-limit reset is re-thrown (row preserved) so it reaches the breaker,\n * which tolerates a few strikes (`maxAlarmMemoryLimitStrikes`) and then seals +\n * purges the looping row — i.e. *bounded* deferral, never the unbounded deferral\n * the transient classes get.\n */\nconst MEMORY_LIMIT_RESET_PATTERN = /exceeded its memory limit/i;\n\nfunction errorMessageOf(error: unknown): string {\n  return error instanceof Error\n    ? error.message\n    : typeof error === \"string\"\n      ? error\n      : \"\";\n}\n\n/**\n * Iterate an error and its `cause` chain (depth-limited so a cyclic chain\n * can't spin). Wrappers like `SqlError` carry the original platform error in\n * `cause` and may not propagate signal properties (e.g. the CF `retryable`\n * flag), so classification must look through them.\n */\nfunction* selfAndCauses(error: unknown): Generator<unknown> {\n  let current = error;\n  for (let depth = 0; depth < 8 && current != null; depth++) {\n    yield current;\n    current =\n      typeof current === \"object\"\n        ? (current as { cause?: unknown }).cause\n        : undefined;\n  }\n}\n\n/**\n * Whether an error (or anything in its `cause` chain) is a transient\n * \"superseded isolate\" failure — see `SUPERSEDED_ISOLATE_PATTERN`. In-process\n * retries are futile for this class; the work must be deferred to a fresh\n * invocation, which runs the new code and succeeds.\n */\nexport function isDurableObjectCodeUpdateReset(error: unknown): boolean {\n  for (const e of selfAndCauses(error)) {\n    if (SUPERSEDED_ISOLATE_PATTERN.test(errorMessageOf(e))) return true;\n  }\n  return false;\n}\n\n/**\n * Whether an error (or anything in its `cause` chain, or a raw error-message\n * string) is a Durable Object memory-limit reset — see\n * {@link MEMORY_LIMIT_RESET_PATTERN}. Unlike {@link isPlatformTransientError},\n * re-running the same work re-OOMs deterministically, so callers must NOT defer\n * it like a transient; they should bound retries tightly and then seal (#1825).\n */\nexport function isDurableObjectMemoryLimitReset(error: unknown): boolean {\n  for (const e of selfAndCauses(error)) {\n    if (MEMORY_LIMIT_RESET_PATTERN.test(errorMessageOf(e))) return true;\n  }\n  return false;\n}\n\n/**\n * Whether an error (or anything in its `cause` chain) is a transient failure\n * of the PLATFORM rather than of the code that threw it:\n *\n *   - a superseded-isolate reset (\"reset because its code was updated\" /\n *     \"this script has been upgraded\") — a deploy replaced the isolate;\n *   - an error the platform itself flags `retryable: true` (excluding\n *     overloaded errors, where retrying the same object won't help) — see\n *     `isErrorRetryable`;\n *   - \"Network connection lost.\" — the storage/stub connection dropped. The\n *     CF `retryable` flag does not survive error wrappers (e.g. `SqlError`\n *     copies only the message + `cause`) and is absent in some local-dev\n *     shapes, so the verbatim message is matched as well.\n *\n * Used to decide whether failed work should be RE-RUN LATER (platform\n * transient — the same work succeeds once the platform recovers, typically\n * seconds after a deploy) versus ABANDONED as genuinely failing (application\n * error — re-running yields the same failure). A genuine application error\n * carries none of these signals, so it is never misclassified by this check.\n */\nexport function isPlatformTransientError(error: unknown): boolean {\n  for (const e of selfAndCauses(error)) {\n    const message = errorMessageOf(e);\n    if (SUPERSEDED_ISOLATE_PATTERN.test(message)) return true;\n    if (CONNECTION_LOST_PATTERN.test(message)) return true;\n    if (isErrorRetryable(e)) return true;\n  }\n  return false;\n}\n"],"mappings":";;;;;;;AA+BA,SAAgB,qBACd,SACA,UACM;CACN,IAAI,QAAQ,gBAAgB,KAAA,GAAW;EACrC,IAAI,CAAC,OAAO,SAAS,QAAQ,WAAW,KAAK,QAAQ,cAAc,GACjE,MAAM,IAAI,MAAM,gCAAgC;EAElD,IAAI,CAAC,OAAO,UAAU,QAAQ,WAAW,GACvC,MAAM,IAAI,MAAM,sCAAsC;CAE1D;CACA,IAAI,QAAQ,gBAAgB,KAAA;MACtB,CAAC,OAAO,SAAS,QAAQ,WAAW,KAAK,QAAQ,eAAe,GAClE,MAAM,IAAI,MAAM,+BAA+B;CAAA;CAGnD,IAAI,QAAQ,eAAe,KAAA;MACrB,CAAC,OAAO,SAAS,QAAQ,UAAU,KAAK,QAAQ,cAAc,GAChE,MAAM,IAAI,MAAM,8BAA8B;CAAA;CAMlD,MAAM,eAAe,QAAQ,eAAe,UAAU;CACtD,MAAM,cAAc,QAAQ,cAAc,UAAU;CACpD,IACE,iBAAiB,KAAA,KACjB,gBAAgB,KAAA,KAChB,eAAe,aAEf,MAAM,IAAI,MAAM,+CAA+C;AAEnE;;;;;;;;;;;AAYA,SAAgB,cACd,SACA,aACA,YACQ;CACR,MAAM,eAAe,KAAK,IAAI,KAAK,UAAU,aAAa,UAAU;CACpE,OAAO,KAAK,MAAM,KAAK,OAAO,IAAI,YAAY;AAChD;;;;;;;;;;AAWA,eAAsB,KACpB,GACA,IACA,SACY;CACZ,IAAI,CAAC,OAAO,SAAS,CAAC,KAAK,IAAI,GAC7B,MAAM,IAAI,MAAM,gCAAgC;CAElD,IAAI,KAAK,MAAM,CAAC;CAEhB,MAAM,UAAU,SAAS,eAAe;CACxC,MAAM,SAAS,SAAS,cAAc;CAEtC,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,WAAW,GAC1C,MAAM,IAAI,MAAM,+BAA+B;CAEjD,IAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GACxC,MAAM,IAAI,MAAM,8BAA8B;CAGhD,MAAM,cAAc,KAAK,MAAM,OAAO;CACtC,MAAM,aAAa,KAAK,MAAM,MAAM;CAEpC,IAAI,cAAc,YAChB,MAAM,IAAI,MAAM,+CAA+C;CAGjE,IAAI,UAAU;CACd,OAAO,MACL,IAAI;EACF,OAAO,MAAM,GAAG,OAAO;CACzB,SAAS,KAAK;EACZ,MAAM,cAAc,UAAU;EAC9B,IACE,cAAc,KACb,SAAS,eAAe,CAAC,QAAQ,YAAY,KAAK,WAAW,GAE9D,MAAM;EAER,MAAM,QAAQ,cAAc,SAAS,aAAa,UAAU;EAC5D,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,KAAK,CAAC;EACzD,UAAU;CACZ;AAEJ;;;;;;;AAQA,SAAgB,iBAAiB,KAAuB;CACtD,IAAI,OAAO,QAAQ,YAAY,QAAQ,MACrC,OAAO;CAET,MAAM,MAAM,OAAO,GAAG;CACtB,MAAM,QAAQ;CACd,OACE,QAAQ,MAAM,SAAS,KACvB,CAAC,MAAM,cACP,CAAC,IAAI,SAAS,8BAA8B;AAEhD;;;;;;;;;;;;;;;;;;;;AAqBA,MAAM,6BACJ;;;;;;;;;;;AAYF,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiChC,MAAM,6BAA6B;AAEnC,SAAS,eAAe,OAAwB;CAC9C,OAAO,iBAAiB,QACpB,MAAM,UACN,OAAO,UAAU,WACf,QACA;AACR;;;;;;;AAQA,UAAU,cAAc,OAAoC;CAC1D,IAAI,UAAU;CACd,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,WAAW,MAAM,SAAS;EACzD,MAAM;EACN,UACE,OAAO,YAAY,WACd,QAAgC,QACjC,KAAA;CACR;AACF;;;;;;;AAQA,SAAgB,+BAA+B,OAAyB;CACtE,KAAK,MAAM,KAAK,cAAc,KAAK,GACjC,IAAI,2BAA2B,KAAK,eAAe,CAAC,CAAC,GAAG,OAAO;CAEjE,OAAO;AACT;;;;;;;;AASA,SAAgB,gCAAgC,OAAyB;CACvE,KAAK,MAAM,KAAK,cAAc,KAAK,GACjC,IAAI,2BAA2B,KAAK,eAAe,CAAC,CAAC,GAAG,OAAO;CAEjE,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,yBAAyB,OAAyB;CAChE,KAAK,MAAM,KAAK,cAAc,KAAK,GAAG;EACpC,MAAM,UAAU,eAAe,CAAC;EAChC,IAAI,2BAA2B,KAAK,OAAO,GAAG,OAAO;EACrD,IAAI,wBAAwB,KAAK,OAAO,GAAG,OAAO;EAClD,IAAI,iBAAiB,CAAC,GAAG,OAAO;CAClC;CACA,OAAO;AACT"}

package/dist/serializable.d.ts

@@ -1,4 +1,4 @@
-import { st as StreamingResponse } from "./agent-tool-types-Cd1TZPfB.js";
+import { st as StreamingResponse } from "./agent-tool-types-CNyE1iz_.js";
 
 //#region src/serializable.d.ts
 type SerializablePrimitive = undefined | null | string | number | boolean;

package/dist/sub-routing.d.ts

@@ -4,7 +4,7 @@ import {
   nn as SubAgentPathMatch,
   rn as getSubAgentByName,
   tn as SUB_PREFIX
-} from "./agent-tool-types-Cd1TZPfB.js";
+} from "./agent-tool-types-CNyE1iz_.js";
 export {
   SUB_PREFIX,
   SubAgentPathMatch,

package/dist/workflows.d.ts

@@ -1,4 +1,4 @@
-import { O as Agent } from "./agent-tool-types-Cd1TZPfB.js";
+import { O as Agent } from "./agent-tool-types-CNyE1iz_.js";
 import {
   C as WorkflowStatus,
   S as WorkflowRejectedError,

package/docs/chat-agents.md

@@ -669,9 +669,14 @@ override chatRecovery = {
   // Primary stuck-turn bound. Resets on every progress-bearing attempt, so a
   // turn that keeps producing content survives unbounded interruption.
   noProgressTimeoutMs: 5 * 60 * 1000,
-  // Runaway-loop guard. Defaults to Infinity (no cap). Set a finite value to
-  // seal a turn that keeps emitting content but never converges.
+  // Runaway-loop guard. Defaults to a finite backstop (1000). Set a different
+  // value to tune when a turn that keeps emitting content but never converges
+  // is sealed.
   maxRecoveryWork: 200,
+  // Tight retry budget for a Durable Object memory-limit reset (the isolate
+  // exceeded its 128 MB limit). Defaults to 3; an OOM usually re-OOMs on
+  // re-run, so recovery seals it with `out_of_memory` after a few attempts.
+  maxOomRetries: 3,
   // Caller policy consulted from the second recovery attempt onward. Return
   // false to stop recovery. This is where you enforce a token/cost budget.
   // Note: this is called as `config.shouldKeepRecovering(ctx)`, so it is not
@@ -688,15 +693,16 @@ override chatRecovery = {
 
 **`chatRecovery` configuration:**
 
-| Field                  | Default           | Description                                                                                                                                                                                                                                                                                                |
-| ---------------------- | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `maxAttempts`          | `10`              | Attempt cap before terminal exhaustion. Resets on forward progress, so it catches a tight no-progress alarm loop, not a healthy long turn.                                                                                                                                                                 |
-| `stableTimeoutMs`      | `10_000`          | How long a recovery attempt waits for the isolate to reach stable state before rescheduling.                                                                                                                                                                                                               |
-| `terminalMessage`      | generic message   | The message shown to the user when recovery is given up on.                                                                                                                                                                                                                                                |
-| `noProgressTimeoutMs`  | `300_000` (5 min) | Primary stuck-turn bound: how long an incident may go without forward progress before it is sealed (`no_progress_timeout`). **Resets on every progress-bearing attempt**, so a turn that keeps producing content survives unbounded interruption.                                                          |
-| `maxRecoveryWork`      | `Infinity`        | Runaway-loop guard. Maximum produced content/tool units since the incident began before a still-progressing turn is sealed. Defaults to no cap.                                                                                                                                                            |
-| `shouldKeepRecovering` | —                 | Caller policy consulted from the second recovery attempt onward (never on the first detection, never once a hard bound has sealed the incident). Return `false` to stop recovery. The hook point for a token/cost budget — `ctx.work` is a coarse segment count, not tokens, so track real spend yourself. |
-| `onExhausted`          | —                 | Called once when recovery is given up on, before the terminal message is delivered. Inspect `ctx.reason` for why.                                                                                                                                                                                          |
+| Field                  | Default           | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| ---------------------- | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `maxAttempts`          | `10`              | Attempt cap before terminal exhaustion. Resets on forward progress, so it catches a tight no-progress alarm loop, not a healthy long turn.                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `stableTimeoutMs`      | `10_000`          | How long a recovery attempt waits for the isolate to reach stable state before rescheduling.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `terminalMessage`      | generic message   | The message shown to the user when recovery is given up on.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `noProgressTimeoutMs`  | `300_000` (5 min) | Primary stuck-turn bound: how long an incident may go without forward progress before it is sealed (`no_progress_timeout`). **Resets on every progress-bearing attempt**, so a turn that keeps producing content survives unbounded interruption.                                                                                                                                                                                                                                                                                                                                                              |
+| `maxRecoveryWork`      | `1000`            | Runaway-loop guard. Maximum produced content/tool units since the incident began before a still-progressing turn is sealed (`work_budget_exceeded`). A generous finite backstop so an agent that keeps emitting a little content but never converges (for example an isolate that runs out of memory mid-stream on every recovery) cannot loop forever. Work only accrues from the first interruption until the turn completes. Set a higher value, or `Infinity`, for a very long agentic turn that legitimately needs more.                                                                                  |
+| `maxOomRetries`        | `3`               | Tight retry budget for the specific case of a Durable Object isolate exceeding its memory limit and being reset mid-turn. An OOM is usually deterministic (the turn's working set no longer fits in 128 MB) so re-running re-OOMs, but a single OOM can be a transient spike — so recovery retries this many times before sealing with `out_of_memory`. Counts only attempts that ended in an OOM (not total attempts), so a turn interrupted by deploys is unaffected. Set `0` to seal on the first OOM. Far tighter than `maxRecoveryWork` because an OOM is attributable and each re-run re-runs the model. |
+| `shouldKeepRecovering` | —                 | Caller policy consulted from the second recovery attempt onward (never on the first detection, never once a hard bound has sealed the incident). Return `false` to stop recovery. The hook point for a token/cost budget — `ctx.work` is a coarse segment count, not tokens, so track real spend yourself.                                                                                                                                                                                                                                                                                                     |
+| `onExhausted`          | —                 | Called once when recovery is given up on, before the terminal message is delivered. Inspect `ctx.reason` for why.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 
 **`ChatRecoveryProgressContext`** (the `ctx` passed to `shouldKeepRecovering`):
 
@@ -711,15 +717,18 @@ override chatRecovery = {
 | `work`                  | `number`                | Coarse, monotonic count of content/tool segments produced since the incident opened (not tokens). |
 | `ageMs`                 | `number`                | Wall-clock ms since the incident's first interruption.                                            |
 
-A progressing turn is never terminated by the framework on its own — it survives unbounded interruption (for example a dense deploy window) as long as it keeps making forward progress. Recovery is sealed only by one of these `ctx.reason` values:
+A progressing turn survives unbounded interruption (for example a dense deploy window) as long as it keeps making forward progress and stays under the `maxRecoveryWork` backstop. Recovery is sealed only by one of these `ctx.reason` values:
 
 - `no_progress_timeout` — no forward progress within the no-progress window (a stuck turn).
 - `max_attempts_exceeded` — the attempt cap was spent on a tight no-progress alarm loop.
 - `work_budget_exceeded` — the turn kept producing content but exceeded `maxRecoveryWork` (a runaway loop).
+- `out_of_memory` — recovery attempts kept hitting a Durable Object memory-limit reset until the tight `maxOomRetries` budget drained.
 - `recovery_aborted` — your `shouldKeepRecovering` hook returned `false`.
 - `stable_timeout` — recovery attempts kept timing out waiting for stable state until the budget drained (extreme churn).
 
-> Setting a finite `maxRecoveryWork` reintroduces a false-positive risk for a legitimately long turn — pick a cap well above what a healthy turn produces, or prefer `shouldKeepRecovering` with real token/cost accounting for a precise budget.
+> `maxRecoveryWork` defaults to a generous finite backstop (`1000`) rather than no cap, so a runaway turn cannot loop forever out of the box. The default is far above what a healthy interrupted turn produces; if you lower it, pick a cap well above a healthy turn's output, and for a precise budget prefer `shouldKeepRecovering` with real token/cost accounting. A very long agentic turn that legitimately produces a large amount of content under heavy interruption can raise the cap or set it to `Infinity` to restore fully-unbounded recovery.
+
+> **Out-of-memory crash loops have a last-resort backstop.** A severe memory-limit reset can bypass the recovery budgets above entirely — for example if the Durable Object out-of-memories while _loading its state on wake_, before recovery even evaluates, or if the budget's own bookkeeping writes also out-of-memory. Left unhandled, the platform auto-retries the alarm forever, re-running the doomed (billable) turn each cycle. The SDK guards this at the alarm boundary: after `maxAlarmMemoryLimitStrikes` (a base `Agent` static option, default `3`) consecutive alarms end in a memory-limit reset, it seals the interrupted turn with `out_of_memory` and stops the loop, emitting an `alarm:memory_limit_reset` observability event. This bounds the blast radius (and the bill); it does not shrink the working set — a turn whose context genuinely no longer fits in 128 MB needs a smaller transcript/fewer or smaller tool results.
 
 #### Turns waiting on a human are not sealed
 

package/package.json

@@ -9,7 +9,7 @@
     "durable objects"
   ],
   "type": "module",
-  "version": "0.17.0",
+  "version": "0.17.3",
   "license": "MIT",
   "repository": {
     "directory": "packages/agents",
@@ -41,12 +41,12 @@
   "devDependencies": {
     "@ai-sdk/react": "^3.0.204",
     "@modelcontextprotocol/conformance": "0.1.16",
-    "@tanstack/ai": "0.32.0",
+    "@tanstack/ai": "0.38.0",
     "@types/react": "^19.2.17",
     "@types/yargs": "^17.0.35",
     "@vitest/browser-playwright": "^4.1.9",
-    "@x402/core": "^2.16.0",
-    "@x402/evm": "^2.16.0",
+    "@x402/core": "^2.17.0",
+    "@x402/evm": "^2.17.0",
     "ai": "^6.0.202",
     "chat": "^4.31.0",
     "glob": "^13.0.6",

package/dist/agent-tools-BXlsuX0d.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-tools-BXlsuX0d.js","names":[],"sources":["../src/chat/agent-tools.ts"],"sourcesContent":["import { applyChunkToParts, type MessagePart } from \"./message-builder\";\nimport {\n  AGENT_TOOL_MILESTONE_PART,\n  AGENT_TOOL_PROGRESS_PART\n} from \"../agent-tool-types\";\nimport type {\n  AgentToolEventMessage,\n  AgentToolEventState,\n  AgentToolMilestone,\n  AgentToolProgress,\n  AgentToolProgressSnapshot,\n  AgentToolRunPart,\n  AgentToolRunState,\n  AgentToolStoredChunk\n} from \"../agent-tool-types\";\n\n/**\n * Pull a reserved `data-agent-progress` chunk (emitted by a running sub-agent's\n * `reportProgress`) into a latest-wins snapshot. Returns `undefined` for any\n * other chunk so the caller keeps the prior snapshot.\n */\nfunction readAgentToolProgressChunk(\n  chunk: unknown\n): AgentToolProgressSnapshot | undefined {\n  if (\n    typeof chunk !== \"object\" ||\n    chunk === null ||\n    (chunk as { type?: unknown }).type !== AGENT_TOOL_PROGRESS_PART\n  ) {\n    return undefined;\n  }\n  const data = (chunk as { data?: AgentToolProgress }).data ?? {};\n  return {\n    ...(typeof data.fraction === \"number\" ? { fraction: data.fraction } : {}),\n    ...(typeof data.message === \"string\" ? { message: data.message } : {}),\n    ...(typeof data.phase === \"string\" ? { phase: data.phase } : {}),\n    ...(data.data !== undefined ? { data: data.data } : {}),\n    at: Date.now()\n  };\n}\n\n/**\n * Pull a reserved `data-agent-milestone` chunk into a durable milestone record,\n * or `undefined` for any other chunk. Milestones carry their own monotonic\n * `sequence` so the caller can dedupe replay-vs-live races.\n */\nfunction readAgentToolMilestoneChunk(\n  chunk: unknown\n): AgentToolMilestone | undefined {\n  if (\n    typeof chunk !== \"object\" ||\n    chunk === null ||\n    (chunk as { type?: unknown }).type !== AGENT_TOOL_MILESTONE_PART\n  ) {\n    return undefined;\n  }\n  const data = (chunk as { data?: Partial<AgentToolMilestone> }).data ?? {};\n  if (typeof data.name !== \"string\") return undefined;\n  return {\n    name: data.name,\n    sequence: typeof data.sequence === \"number\" ? data.sequence : 0,\n    at: typeof data.at === \"number\" ? data.at : Date.now(),\n    ...(data.data !== undefined ? { data: data.data } : {})\n  };\n}\n\n/**\n * Merge a milestone into a run's ordered milestone list, deduping on `sequence`\n * (idempotent across replay + live races) and keeping the list sorted.\n */\nfunction mergeMilestone(\n  existing: AgentToolMilestone[] | undefined,\n  milestone: AgentToolMilestone\n): AgentToolMilestone[] {\n  // Returns `existing` unchanged (same reference) when the milestone is a dup,\n  // so callers can identity-compare to detect a genuinely new milestone.\n  if (existing?.some((m) => m.sequence === milestone.sequence)) return existing;\n  const list = existing ? [...existing, milestone] : [milestone];\n  list.sort((a, b) => a.sequence - b.sequence);\n  return list;\n}\n\n/** Latest-wins coalescing window for `reportProgress` emits (per run). */\nconst AGENT_TOOL_PROGRESS_COALESCE_MS = 200;\n\nexport type AgentToolProgressEmitResult = \"emitted\" | \"coalesced\" | \"inactive\";\n\n/**\n * Host-injected seams the shared progress emitter needs. Keeps the per-host\n * `reportProgress` thin: Think / AIChatAgent supply how to resolve the active\n * agent-tool run, how to broadcast a chat-response frame, and how to persist the\n * latest snapshot on their own child-run table.\n */\nexport type AgentToolProgressEmitHooks = {\n  /** The agent-tool run currently executing in this turn, or null. */\n  resolveActiveRun: () => { runId: string; requestId: string } | null;\n  /** Broadcast a chat-response frame (id = requestId) to clients/tailers. */\n  broadcast: (requestId: string, chunkBody: string) => void;\n  /** Persist the latest snapshot + signal timestamp on the child run row. */\n  persistSnapshot: (\n    runId: string,\n    snapshot: {\n      fraction?: number;\n      message?: string;\n      phase?: string;\n      data?: unknown;\n    },\n    at: number\n  ) => void;\n  /**\n   * Persist a durable milestone row, bump the run's signal timestamp, and return\n   * the assigned monotonic per-run `sequence` (used to dedupe replay/live races).\n   */\n  persistMilestone: (\n    runId: string,\n    name: string,\n    data: unknown,\n    at: number\n  ) => number;\n};\n\n/**\n * Shared implementation of `reportProgress` for chat hosts. Builds the reserved\n * transient `data-agent-progress` wire frame, coalesces bursts to a bounded\n * cadence (latest-wins; a `fraction >= 1` \"done\" frame always flushes), and\n * persists a latest snapshot. `data` rides the live frame but is only persisted\n * when the caller opts in via `{ persist: true }`.\n */\nexport class AgentToolProgressEmitter {\n  private readonly _lastEmitAt = new Map<string, number>();\n\n  constructor(private readonly hooks: AgentToolProgressEmitHooks) {}\n\n  report(\n    progress: AgentToolProgress,\n    options?: { persist?: boolean }\n  ): AgentToolProgressEmitResult {\n    const active = this.hooks.resolveActiveRun();\n    if (!active) return \"inactive\";\n    const { runId, requestId } = active;\n    const now = Date.now();\n\n    // Durable milestone: never coalesced (each named boundary must land,\n    // persist, and replay). Rides the stream as a PERSISTED data part.\n    if (typeof progress.milestone === \"string\" && progress.milestone) {\n      this._lastEmitAt.set(runId, now);\n      const sequence = this.hooks.persistMilestone(\n        runId,\n        progress.milestone,\n        progress.data,\n        now\n      );\n      this.hooks.broadcast(\n        requestId,\n        JSON.stringify({\n          type: AGENT_TOOL_MILESTONE_PART,\n          data: {\n            name: progress.milestone,\n            sequence,\n            at: now,\n            ...(typeof progress.fraction === \"number\"\n              ? { fraction: progress.fraction }\n              : {}),\n            ...(typeof progress.message === \"string\"\n              ? { message: progress.message }\n              : {}),\n            ...(typeof progress.phase === \"string\"\n              ? { phase: progress.phase }\n              : {}),\n            ...(progress.data !== undefined ? { data: progress.data } : {})\n          }\n        })\n      );\n      return \"emitted\";\n    }\n\n    const last = this._lastEmitAt.get(runId) ?? 0;\n    const isDone =\n      typeof progress.fraction === \"number\" && progress.fraction >= 1;\n    if (now - last < AGENT_TOOL_PROGRESS_COALESCE_MS && !isDone) {\n      return \"coalesced\";\n    }\n    this._lastEmitAt.set(runId, now);\n\n    const wire: AgentToolProgress = {\n      ...(typeof progress.fraction === \"number\"\n        ? { fraction: progress.fraction }\n        : {}),\n      ...(typeof progress.message === \"string\"\n        ? { message: progress.message }\n        : {}),\n      ...(typeof progress.phase === \"string\" ? { phase: progress.phase } : {}),\n      ...(progress.data !== undefined ? { data: progress.data } : {})\n    };\n    this.hooks.broadcast(\n      requestId,\n      JSON.stringify({\n        type: AGENT_TOOL_PROGRESS_PART,\n        transient: true,\n        data: wire\n      })\n    );\n    this.hooks.persistSnapshot(\n      runId,\n      {\n        ...(typeof progress.fraction === \"number\"\n          ? { fraction: progress.fraction }\n          : {}),\n        ...(typeof progress.message === \"string\"\n          ? { message: progress.message }\n          : {}),\n        ...(typeof progress.phase === \"string\"\n          ? { phase: progress.phase }\n          : {}),\n        ...(options?.persist && progress.data !== undefined\n          ? { data: progress.data }\n          : {})\n      },\n      now\n    );\n    return \"emitted\";\n  }\n\n  /** Drop coalescing state for a settled run (called on terminal). */\n  forget(runId: string): void {\n    this._lastEmitAt.delete(runId);\n  }\n}\n\nfunction sortRuns<Part extends AgentToolRunPart>(\n  runs: AgentToolRunState<Part>[]\n): AgentToolRunState<Part>[] {\n  return [...runs].sort((a, b) => {\n    if (a.order !== b.order) return a.order - b.order;\n    return a.runId.localeCompare(b.runId);\n  });\n}\n\nfunction rebuildIndexes<Part extends AgentToolRunPart>(\n  runsById: Record<string, AgentToolRunState<Part>>\n): Pick<AgentToolEventState<Part>, \"runsByToolCallId\" | \"unboundRuns\"> {\n  const grouped: Record<string, AgentToolRunState<Part>[]> = {};\n  const unboundRuns: AgentToolRunState<Part>[] = [];\n  for (const run of Object.values(runsById)) {\n    if (run.parentToolCallId) {\n      grouped[run.parentToolCallId] = grouped[run.parentToolCallId] ?? [];\n      grouped[run.parentToolCallId].push(run);\n    } else {\n      unboundRuns.push(run);\n    }\n  }\n  for (const [toolCallId, runs] of Object.entries(grouped)) {\n    grouped[toolCallId] = sortRuns(runs);\n  }\n  return { runsByToolCallId: grouped, unboundRuns: sortRuns(unboundRuns) };\n}\n\nfunction emptyRun<Part extends AgentToolRunPart>(\n  message: AgentToolEventMessage\n): AgentToolRunState<Part> | undefined {\n  const { event } = message;\n  if (event.kind === \"started\") {\n    return {\n      runId: event.runId,\n      agentType: event.agentType,\n      parentToolCallId: message.parentToolCallId,\n      inputPreview: event.inputPreview,\n      order: event.order,\n      display: event.display,\n      status: \"running\",\n      parts: [],\n      subAgent: { agent: event.agentType, name: event.runId }\n    };\n  }\n  return undefined;\n}\n\nfunction applyToRun<Part extends AgentToolRunPart>(\n  prev: AgentToolRunState<Part> | undefined,\n  message: AgentToolEventMessage\n): AgentToolRunState<Part> | undefined {\n  const seeded = prev ?? emptyRun(message);\n  const { event } = message;\n\n  switch (event.kind) {\n    case \"started\":\n      if (\n        seeded?.status === \"completed\" ||\n        seeded?.status === \"error\" ||\n        seeded?.status === \"aborted\" ||\n        seeded?.status === \"interrupted\"\n      ) {\n        return seeded;\n      }\n      return {\n        ...seeded,\n        runId: event.runId,\n        agentType: event.agentType,\n        parentToolCallId: message.parentToolCallId,\n        inputPreview: event.inputPreview,\n        order: event.order,\n        display: event.display,\n        status: \"running\",\n        parts: seeded?.parts ?? [],\n        subAgent: { agent: event.agentType, name: event.runId }\n      };\n    case \"chunk\": {\n      if (!seeded) return undefined;\n      const parts = [...seeded.parts];\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(event.body);\n        applyChunkToParts(\n          parts as MessagePart[],\n          parsed as Parameters<typeof applyChunkToParts>[1]\n        );\n      } catch {\n        return seeded;\n      }\n      // Project a reserved `data-agent-progress` part onto the run's latest\n      // progress snapshot so a tray can render a bar/phase without drilling in.\n      // The part is transient (not persisted into `parts`), so it is read here\n      // off the raw chunk rather than from the reduced parts array.\n      const progress = readAgentToolProgressChunk(parsed);\n      if (progress) {\n        return { ...seeded, parts, progress };\n      }\n      // Durable milestones land as a persisted `data-agent-milestone` part:\n      // append (deduped by sequence) to the run's milestone list, and reflect\n      // any progress fields the milestone carried onto the latest snapshot.\n      const milestone = readAgentToolMilestoneChunk(parsed);\n      if (milestone) {\n        const milestones = mergeMilestone(seeded.milestones, milestone);\n        // Only advance the snapshot for a genuinely new, not-older milestone, so\n        // a late replay of an earlier milestone never rolls `progress` backward.\n        const isNew = milestones !== seeded.milestones;\n        const notOlder =\n          seeded.progress === undefined || milestone.at >= seeded.progress.at;\n        if (!isNew || !notOlder) {\n          return { ...seeded, parts, milestones };\n        }\n        const data = (parsed as { data?: AgentToolProgress }).data ?? {};\n        const snapshot: AgentToolProgressSnapshot = {\n          ...(typeof data.fraction === \"number\"\n            ? { fraction: data.fraction }\n            : {}),\n          ...(typeof data.message === \"string\"\n            ? { message: data.message }\n            : {}),\n          ...(typeof data.phase === \"string\" ? { phase: data.phase } : {}),\n          milestone: milestone.name,\n          at: milestone.at\n        };\n        return { ...seeded, parts, progress: snapshot, milestones };\n      }\n      return { ...seeded, parts };\n    }\n    case \"finished\":\n      if (!seeded) return undefined;\n      return {\n        ...seeded,\n        status: \"completed\",\n        summary: event.summary,\n        error: undefined\n      };\n    case \"error\":\n      if (!seeded) return undefined;\n      return { ...seeded, status: \"error\", error: event.error };\n    case \"aborted\":\n      if (!seeded) return undefined;\n      return { ...seeded, status: \"aborted\", error: event.reason };\n    case \"interrupted\":\n      if (!seeded) return undefined;\n      return {\n        ...seeded,\n        status: \"interrupted\",\n        error: event.error,\n        reason: event.reason,\n        childStillRunning: event.childStillRunning\n      };\n  }\n}\n\nexport function createAgentToolEventState<\n  Part extends AgentToolRunPart = AgentToolRunPart\n>(): AgentToolEventState<Part> {\n  return {\n    runsById: {},\n    runsByToolCallId: {},\n    unboundRuns: []\n  };\n}\n\nexport function applyAgentToolEvent<\n  Part extends AgentToolRunPart = AgentToolRunPart\n>(\n  state: AgentToolEventState<Part>,\n  message: AgentToolEventMessage\n): AgentToolEventState<Part> {\n  if (message.type !== \"agent-tool-event\") return state;\n  const runId = message.event.runId;\n  const nextRun = applyToRun(state.runsById[runId], message);\n  if (!nextRun) return state;\n\n  const runsById = { ...state.runsById, [runId]: nextRun };\n  return { runsById, ...rebuildIndexes(runsById) };\n}\n\nexport type {\n  AgentToolEvent,\n  AgentToolEventMessage,\n  AgentToolEventState,\n  AgentToolRunPart,\n  AgentToolRunState\n} from \"../agent-tool-types\";\n\n/**\n * @internal Host substrate the {@link interceptAgentToolBroadcast} snoop reads,\n * abstracting the divergent per-host run-lookup and response-frame constant.\n */\nexport interface AgentToolBroadcastHooks {\n  /** Live tailers per run; iterated to forward each progress chunk. */\n  forwarders: Map<string, Set<(chunk: AgentToolStoredChunk) => void>>;\n  /** Per-run forwarded-chunk counter; advanced even with no tailer attached. */\n  liveSequences: Map<string, number>;\n  /** Per-run last error body, captured for replay to a late-attaching tailer. */\n  lastErrors: Map<string, string>;\n  /** The host's use-chat-response wire type (`CHAT_MESSAGE_TYPES.USE_CHAT_RESPONSE`). */\n  responseType: string;\n  /** Resolve the agent-tool run that owns a turn request id, or null. */\n  runForRequest: (requestId: string) => string | null;\n}\n\n/**\n * Snoop a host's outgoing chat frames while any agent-tool run is in flight and\n * forward the owning run's streamed body to its live tailers (or capture its\n * error), without altering the frame — the caller still broadcasts it (#1575).\n *\n * Shared verbatim by `@cloudflare/ai-chat` and `@cloudflare/think`; the only\n * per-host variance (the response-frame type constant and the run-lookup, whose\n * SQL differs) is supplied via {@link AgentToolBroadcastHooks}. Inspection runs\n * for a run's whole lifecycle (live sequences exist even with no tailer), so\n * error capture never depends on tailer timing. A frame belongs to a run iff it\n * carries that run's turn request id, so concurrent runs can't cross-contaminate\n * each other's progress or error state.\n */\nexport function interceptAgentToolBroadcast(\n  msg: string | ArrayBuffer | ArrayBufferView,\n  hooks: AgentToolBroadcastHooks\n): void {\n  if (\n    (hooks.forwarders.size > 0 || hooks.liveSequences.size > 0) &&\n    typeof msg === \"string\"\n  ) {\n    try {\n      const parsed = JSON.parse(msg) as {\n        type?: unknown;\n        body?: unknown;\n        error?: unknown;\n        id?: unknown;\n      };\n      if (parsed.type === hooks.responseType && typeof parsed.id === \"string\") {\n        const runId = hooks.runForRequest(parsed.id);\n        if (runId !== null) {\n          if (parsed.error === true && typeof parsed.body === \"string\") {\n            hooks.lastErrors.set(runId, parsed.body);\n          } else if (\n            typeof parsed.body === \"string\" &&\n            parsed.body.length > 0\n          ) {\n            // Advance the live sequence even with no tailer attached so a tailer\n            // registering mid-run resumes at the right offset.\n            const sequence = hooks.liveSequences.get(runId) ?? 0;\n            hooks.liveSequences.set(runId, sequence + 1);\n            const chunk: AgentToolStoredChunk = { sequence, body: parsed.body };\n            const forwarders = hooks.forwarders.get(runId);\n            if (forwarders) {\n              for (const forward of forwarders) forward(chunk);\n            }\n          }\n        }\n      }\n    } catch {\n      // Non-chat frames pass through unchanged.\n    }\n  }\n}\n"],"mappings":";;;;;;;;AAqBA,SAAS,2BACP,OACuC;CACvC,IACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAA,uBAE9B;CAEF,MAAM,OAAQ,MAAuC,QAAQ,CAAC;CAC9D,OAAO;EACL,GAAI,OAAO,KAAK,aAAa,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;EACvE,GAAI,OAAO,KAAK,YAAY,WAAW,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;EACpE,GAAI,OAAO,KAAK,UAAU,WAAW,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;EAC9D,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;EACrD,IAAI,KAAK,IAAI;CACf;AACF;;;;;;AAOA,SAAS,4BACP,OACgC;CAChC,IACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAA,wBAE9B;CAEF,MAAM,OAAQ,MAAiD,QAAQ,CAAC;CACxE,IAAI,OAAO,KAAK,SAAS,UAAU,OAAO,KAAA;CAC1C,OAAO;EACL,MAAM,KAAK;EACX,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;EAC9D,IAAI,OAAO,KAAK,OAAO,WAAW,KAAK,KAAK,KAAK,IAAI;EACrD,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;CACvD;AACF;;;;;AAMA,SAAS,eACP,UACA,WACsB;CAGtB,IAAI,UAAU,MAAM,MAAM,EAAE,aAAa,UAAU,QAAQ,GAAG,OAAO;CACrE,MAAM,OAAO,WAAW,CAAC,GAAG,UAAU,SAAS,IAAI,CAAC,SAAS;CAC7D,KAAK,MAAM,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;CAC3C,OAAO;AACT;;AAGA,MAAM,kCAAkC;;;;;;;;AA6CxC,IAAa,2BAAb,MAAsC;CAGpC,YAAY,OAAoD;EAAnC,KAAA,QAAA;EAF7B,KAAiB,8BAAc,IAAI,IAAoB;CAEU;CAEjE,OACE,UACA,SAC6B;EAC7B,MAAM,SAAS,KAAK,MAAM,iBAAiB;EAC3C,IAAI,CAAC,QAAQ,OAAO;EACpB,MAAM,EAAE,OAAO,cAAc;EAC7B,MAAM,MAAM,KAAK,IAAI;EAIrB,IAAI,OAAO,SAAS,cAAc,YAAY,SAAS,WAAW;GAChE,KAAK,YAAY,IAAI,OAAO,GAAG;GAC/B,MAAM,WAAW,KAAK,MAAM,iBAC1B,OACA,SAAS,WACT,SAAS,MACT,GACF;GACA,KAAK,MAAM,UACT,WACA,KAAK,UAAU;IACb,MAAM;IACN,MAAM;KACJ,MAAM,SAAS;KACf;KACA,IAAI;KACJ,GAAI,OAAO,SAAS,aAAa,WAC7B,EAAE,UAAU,SAAS,SAAS,IAC9B,CAAC;KACL,GAAI,OAAO,SAAS,YAAY,WAC5B,EAAE,SAAS,SAAS,QAAQ,IAC5B,CAAC;KACL,GAAI,OAAO,SAAS,UAAU,WAC1B,EAAE,OAAO,SAAS,MAAM,IACxB,CAAC;KACL,GAAI,SAAS,SAAS,KAAA,IAAY,EAAE,MAAM,SAAS,KAAK,IAAI,CAAC;IAC/D;GACF,CAAC,CACH;GACA,OAAO;EACT;EAEA,MAAM,OAAO,KAAK,YAAY,IAAI,KAAK,KAAK;EAC5C,MAAM,SACJ,OAAO,SAAS,aAAa,YAAY,SAAS,YAAY;EAChE,IAAI,MAAM,OAAO,mCAAmC,CAAC,QACnD,OAAO;EAET,KAAK,YAAY,IAAI,OAAO,GAAG;EAE/B,MAAM,OAA0B;GAC9B,GAAI,OAAO,SAAS,aAAa,WAC7B,EAAE,UAAU,SAAS,SAAS,IAC9B,CAAC;GACL,GAAI,OAAO,SAAS,YAAY,WAC5B,EAAE,SAAS,SAAS,QAAQ,IAC5B,CAAC;GACL,GAAI,OAAO,SAAS,UAAU,WAAW,EAAE,OAAO,SAAS,MAAM,IAAI,CAAC;GACtE,GAAI,SAAS,SAAS,KAAA,IAAY,EAAE,MAAM,SAAS,KAAK,IAAI,CAAC;EAC/D;EACA,KAAK,MAAM,UACT,WACA,KAAK,UAAU;GACb,MAAM;GACN,WAAW;GACX,MAAM;EACR,CAAC,CACH;EACA,KAAK,MAAM,gBACT,OACA;GACE,GAAI,OAAO,SAAS,aAAa,WAC7B,EAAE,UAAU,SAAS,SAAS,IAC9B,CAAC;GACL,GAAI,OAAO,SAAS,YAAY,WAC5B,EAAE,SAAS,SAAS,QAAQ,IAC5B,CAAC;GACL,GAAI,OAAO,SAAS,UAAU,WAC1B,EAAE,OAAO,SAAS,MAAM,IACxB,CAAC;GACL,GAAI,SAAS,WAAW,SAAS,SAAS,KAAA,IACtC,EAAE,MAAM,SAAS,KAAK,IACtB,CAAC;EACP,GACA,GACF;EACA,OAAO;CACT;;CAGA,OAAO,OAAqB;EAC1B,KAAK,YAAY,OAAO,KAAK;CAC/B;AACF;AAEA,SAAS,SACP,MAC2B;CAC3B,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM;EAC9B,IAAI,EAAE,UAAU,EAAE,OAAO,OAAO,EAAE,QAAQ,EAAE;EAC5C,OAAO,EAAE,MAAM,cAAc,EAAE,KAAK;CACtC,CAAC;AACH;AAEA,SAAS,eACP,UACqE;CACrE,MAAM,UAAqD,CAAC;CAC5D,MAAM,cAAyC,CAAC;CAChD,KAAK,MAAM,OAAO,OAAO,OAAO,QAAQ,GACtC,IAAI,IAAI,kBAAkB;EACxB,QAAQ,IAAI,oBAAoB,QAAQ,IAAI,qBAAqB,CAAC;EAClE,QAAQ,IAAI,iBAAiB,CAAC,KAAK,GAAG;CACxC,OACE,YAAY,KAAK,GAAG;CAGxB,KAAK,MAAM,CAAC,YAAY,SAAS,OAAO,QAAQ,OAAO,GACrD,QAAQ,cAAc,SAAS,IAAI;CAErC,OAAO;EAAE,kBAAkB;EAAS,aAAa,SAAS,WAAW;CAAE;AACzE;AAEA,SAAS,SACP,SACqC;CACrC,MAAM,EAAE,UAAU;CAClB,IAAI,MAAM,SAAS,WACjB,OAAO;EACL,OAAO,MAAM;EACb,WAAW,MAAM;EACjB,kBAAkB,QAAQ;EAC1B,cAAc,MAAM;EACpB,OAAO,MAAM;EACb,SAAS,MAAM;EACf,QAAQ;EACR,OAAO,CAAC;EACR,UAAU;GAAE,OAAO,MAAM;GAAW,MAAM,MAAM;EAAM;CACxD;AAGJ;AAEA,SAAS,WACP,MACA,SACqC;CACrC,MAAM,SAAS,QAAQ,SAAS,OAAO;CACvC,MAAM,EAAE,UAAU;CAElB,QAAQ,MAAM,MAAd;EACE,KAAK;GACH,IACE,QAAQ,WAAW,eACnB,QAAQ,WAAW,WACnB,QAAQ,WAAW,aACnB,QAAQ,WAAW,eAEnB,OAAO;GAET,OAAO;IACL,GAAG;IACH,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,kBAAkB,QAAQ;IAC1B,cAAc,MAAM;IACpB,OAAO,MAAM;IACb,SAAS,MAAM;IACf,QAAQ;IACR,OAAO,QAAQ,SAAS,CAAC;IACzB,UAAU;KAAE,OAAO,MAAM;KAAW,MAAM,MAAM;IAAM;GACxD;EACF,KAAK,SAAS;GACZ,IAAI,CAAC,QAAQ,OAAO,KAAA;GACpB,MAAM,QAAQ,CAAC,GAAG,OAAO,KAAK;GAC9B,IAAI;GACJ,IAAI;IACF,SAAS,KAAK,MAAM,MAAM,IAAI;IAC9B,kBACE,OACA,MACF;GACF,QAAQ;IACN,OAAO;GACT;GAKA,MAAM,WAAW,2BAA2B,MAAM;GAClD,IAAI,UACF,OAAO;IAAE,GAAG;IAAQ;IAAO;GAAS;GAKtC,MAAM,YAAY,4BAA4B,MAAM;GACpD,IAAI,WAAW;IACb,MAAM,aAAa,eAAe,OAAO,YAAY,SAAS;IAG9D,MAAM,QAAQ,eAAe,OAAO;IACpC,MAAM,WACJ,OAAO,aAAa,KAAA,KAAa,UAAU,MAAM,OAAO,SAAS;IACnE,IAAI,CAAC,SAAS,CAAC,UACb,OAAO;KAAE,GAAG;KAAQ;KAAO;IAAW;IAExC,MAAM,OAAQ,OAAwC,QAAQ,CAAC;IAC/D,MAAM,WAAsC;KAC1C,GAAI,OAAO,KAAK,aAAa,WACzB,EAAE,UAAU,KAAK,SAAS,IAC1B,CAAC;KACL,GAAI,OAAO,KAAK,YAAY,WACxB,EAAE,SAAS,KAAK,QAAQ,IACxB,CAAC;KACL,GAAI,OAAO,KAAK,UAAU,WAAW,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;KAC9D,WAAW,UAAU;KACrB,IAAI,UAAU;IAChB;IACA,OAAO;KAAE,GAAG;KAAQ;KAAO,UAAU;KAAU;IAAW;GAC5D;GACA,OAAO;IAAE,GAAG;IAAQ;GAAM;EAC5B;EACA,KAAK;GACH,IAAI,CAAC,QAAQ,OAAO,KAAA;GACpB,OAAO;IACL,GAAG;IACH,QAAQ;IACR,SAAS,MAAM;IACf,OAAO,KAAA;GACT;EACF,KAAK;GACH,IAAI,CAAC,QAAQ,OAAO,KAAA;GACpB,OAAO;IAAE,GAAG;IAAQ,QAAQ;IAAS,OAAO,MAAM;GAAM;EAC1D,KAAK;GACH,IAAI,CAAC,QAAQ,OAAO,KAAA;GACpB,OAAO;IAAE,GAAG;IAAQ,QAAQ;IAAW,OAAO,MAAM;GAAO;EAC7D,KAAK;GACH,IAAI,CAAC,QAAQ,OAAO,KAAA;GACpB,OAAO;IACL,GAAG;IACH,QAAQ;IACR,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,mBAAmB,MAAM;GAC3B;CACJ;AACF;AAEA,SAAgB,4BAEe;CAC7B,OAAO;EACL,UAAU,CAAC;EACX,kBAAkB,CAAC;EACnB,aAAa,CAAC;CAChB;AACF;AAEA,SAAgB,oBAGd,OACA,SAC2B;CAC3B,IAAI,QAAQ,SAAS,oBAAoB,OAAO;CAChD,MAAM,QAAQ,QAAQ,MAAM;CAC5B,MAAM,UAAU,WAAW,MAAM,SAAS,QAAQ,OAAO;CACzD,IAAI,CAAC,SAAS,OAAO;CAErB,MAAM,WAAW;EAAE,GAAG,MAAM;GAAW,QAAQ;CAAQ;CACvD,OAAO;EAAE;EAAU,GAAG,eAAe,QAAQ;CAAE;AACjD;;;;;;;;;;;;;;AAwCA,SAAgB,4BACd,KACA,OACM;CACN,KACG,MAAM,WAAW,OAAO,KAAK,MAAM,cAAc,OAAO,MACzD,OAAO,QAAQ,UAEf,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,GAAG;EAM7B,IAAI,OAAO,SAAS,MAAM,gBAAgB,OAAO,OAAO,OAAO,UAAU;GACvE,MAAM,QAAQ,MAAM,cAAc,OAAO,EAAE;GAC3C,IAAI,UAAU;QACR,OAAO,UAAU,QAAQ,OAAO,OAAO,SAAS,UAClD,MAAM,WAAW,IAAI,OAAO,OAAO,IAAI;SAClC,IACL,OAAO,OAAO,SAAS,YACvB,OAAO,KAAK,SAAS,GACrB;KAGA,MAAM,WAAW,MAAM,cAAc,IAAI,KAAK,KAAK;KACnD,MAAM,cAAc,IAAI,OAAO,WAAW,CAAC;KAC3C,MAAM,QAA8B;MAAE;MAAU,MAAM,OAAO;KAAK;KAClE,MAAM,aAAa,MAAM,WAAW,IAAI,KAAK;KAC7C,IAAI,YACF,KAAK,MAAM,WAAW,YAAY,QAAQ,KAAK;IAEnD;;EAEJ;CACF,QAAQ,CAER;AAEJ"}