memeloop 0.2.8 → 0.2.9

package/dist/index.cjs

@@ -16496,10 +16496,54 @@ function createExternalOrchestrationController(store, options) {
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const onError = options.onError ?? (() => {
   });
-  const active = /* @__PURE__ */ new Set();
+  const active = /* @__PURE__ */ new Map();
   const activeByDriver = /* @__PURE__ */ new Map();
   const watchAbort = new AbortController();
+  const stoppedError = new OrchestrationError({
+    code: "CANCELLED",
+    message: "external orchestration controller stopped",
+    retryable: false
+  });
+  let resolveStopped;
+  const stoppedBoundary = new Promise((resolve) => {
+    resolveStopped = resolve;
+  });
   let stopped = false;
+  let stopPromise;
+  function throwIfStopped() {
+    if (stopped) throw stoppedError;
+  }
+  async function whileRunning(operation) {
+    throwIfStopped();
+    const operationResult = Promise.resolve().then(operation).then(
+      (value) => ({ kind: "value", value }),
+      (error2) => ({
+        kind: "error",
+        error: error2 instanceof Error ? error2 : new Error(safeErrorMessageFromUnknown(error2))
+      })
+    );
+    const result = await Promise.race([operationResult, stoppedBoundary]);
+    if (result.kind === "stopped") throw stoppedError;
+    if (result.kind === "error") throw result.error;
+    return result.value;
+  }
+  function reportUnlessStopped(error2) {
+    if (!stopped && error2 !== stoppedError) onError(error2);
+  }
+  async function drainWithDeadline(tasks) {
+    let timeout;
+    try {
+      await Promise.race([
+        Promise.allSettled(tasks).then(() => {
+        }),
+        new Promise((resolve) => {
+          timeout = setTimeout(resolve, 1e3);
+        })
+      ]);
+    } finally {
+      if (timeout) clearTimeout(timeout);
+    }
+  }
   async function acquireDriverSlot(entry) {
     const limit = entry.capabilities.maxConcurrency;
     while (!stopped) {
@@ -16508,7 +16552,7 @@ function createExternalOrchestrationController(store, options) {
         activeByDriver.set(entry.name, current + 1);
         return true;
       }
-      await sleep(pollIntervalMs);
+      await whileRunning(() => sleep(pollIntervalMs));
     }
     return false;
   }
@@ -16538,7 +16582,7 @@ function createExternalOrchestrationController(store, options) {
   }
   async function ensureRun(workload) {
     const reference = runReferenceOf(workload);
-    if (await store.get(reference)) return reference;
+    if (await whileRunning(() => store.get(reference))) return reference;
     const manifest2 = createAgentRunManifest(reference.name, {
       workloadRef: {
         apiVersion: workload.apiVersion,
@@ -16550,7 +16594,7 @@ function createExternalOrchestrationController(store, options) {
     });
     manifest2.metadata.namespace = workload.metadata.namespace;
     try {
-      await store.create(options.actor, manifest2);
+      await whileRunning(() => store.create(options.actor, manifest2));
     } catch (error2) {
       if (!(error2 instanceof OrchestrationError) || error2.code !== "CONFLICT") throw error2;
     }
@@ -16558,12 +16602,14 @@ function createExternalOrchestrationController(store, options) {
   }
   async function updateStatus(reference, patch) {
     for (let attempt = 0; attempt < statusWriteAttempts; attempt += 1) {
-      const current = await store.get(reference);
+      const current = await whileRunning(() => store.get(reference));
       if (!current) return;
       try {
-        await store.updateStatus(options.actor, reference, patch(current.status), {
-          resourceVersion: current.metadata.resourceVersion
-        });
+        await whileRunning(
+          () => store.updateStatus(options.actor, reference, patch(current.status), {
+            resourceVersion: current.metadata.resourceVersion
+          })
+        );
         return;
       } catch (error2) {
         if (error2 instanceof OrchestrationError && error2.code === "CONFLICT") continue;
@@ -16603,6 +16649,7 @@ function createExternalOrchestrationController(store, options) {
     return entry;
   }
   async function fail5(resource, error2) {
+    throwIfStopped();
     const message = safeErrorMessageFromUnknown(error2, { fallback: "External orchestration failed" });
     if (resource.kind === AGENT_WORKLOAD_KIND) {
       await updateStatus(runReferenceOf(resource), () => ({
@@ -16675,6 +16722,7 @@ function createExternalOrchestrationController(store, options) {
     return terminal;
   }
   async function reconcileWorkload(resource) {
+    throwIfStopped();
     const entry = findDriver(resource);
     const runtime = resolveExternalWorkloadRuntime(
       resource,
@@ -16683,7 +16731,7 @@ function createExternalOrchestrationController(store, options) {
     resolveExternalWorkloadResources(resource, runtime);
     const reference = referenceOf(resource);
     const runReference = await ensureRun(resource);
-    const latest = await store.get(reference);
+    const latest = await whileRunning(() => store.get(reference));
     let externalId = latest?.status?.externalId ?? resource.status?.externalId;
     if (!externalId) {
       if (!options.authorizeWorkloadPlacement) {
@@ -16693,8 +16741,8 @@ function createExternalOrchestrationController(store, options) {
           retryable: false
         });
       }
-      const authorization = await options.authorizeWorkloadPlacement(resource, entry);
-      const health = await entry.driver.getHealth();
+      const authorization = await whileRunning(() => options.authorizeWorkloadPlacement(resource, entry, watchAbort.signal));
+      const health = await whileRunning(() => entry.driver.getHealth());
       if (!health.healthy) {
         throw new OrchestrationError({ code: "UNAVAILABLE", message: `external orchestrator '${entry.name}' is unhealthy`, retryable: true });
       }
@@ -16707,21 +16755,25 @@ function createExternalOrchestrationController(store, options) {
         placementPolicyDigest: authorization.policyDigest
       }));
       let scriptSource;
-      if (resource.spec.scriptReference) {
-        scriptSource = await options.resolveScriptSource?.(resource.spec.scriptReference);
+      const scriptReference = resource.spec.scriptReference;
+      if (scriptReference) {
+        scriptSource = await whileRunning(async () => options.resolveScriptSource?.(scriptReference));
         if (scriptSource === void 0) {
           throw new OrchestrationError({
             code: "NOT_FOUND",
-            message: `script artifact '${resource.spec.scriptReference}' is unavailable for external placement`,
+            message: `script artifact '${scriptReference}' is unavailable for external placement`,
             retryable: false
           });
         }
       }
-      const workerBootstrap = await options.createWorkerBootstrap?.(resource, runReference);
-      const placed = await entry.driver.placeWorkload(resource, options.actor, {
-        ...scriptSource !== void 0 ? { scriptSource } : {},
-        ...workerBootstrap !== void 0 ? { workerBootstrap } : {}
-      });
+      const workerBootstrap = await whileRunning(async () => options.createWorkerBootstrap?.(resource, runReference));
+      const placed = await whileRunning(
+        () => entry.driver.placeWorkload(resource, options.actor, {
+          ...scriptSource !== void 0 ? { scriptSource } : {},
+          ...workerBootstrap !== void 0 ? { workerBootstrap } : {},
+          signal: watchAbort.signal
+        })
+      );
       externalId = placed.externalId;
       await updateStatus(reference, (current) => ({
         ...current,
@@ -16735,12 +16787,13 @@ function createExternalOrchestrationController(store, options) {
       await updateStatus(runReference, () => ({ phase: "Running" }));
     }
     while (!stopped) {
-      const external = await entry.driver.getWorkloadStatus(externalId);
+      const external = await whileRunning(() => entry.driver.getWorkloadStatus(externalId));
       if (await reflectWorkloadStatus(resource, external)) return;
-      await sleep(pollIntervalMs);
+      await whileRunning(() => sleep(pollIntervalMs));
     }
   }
   async function reconcileToolOperation(resource) {
+    throwIfStopped();
     const entry = findDriver(resource);
     const runtimeImage = resource.metadata.annotations?.["memeloop.io/runtime-image"];
     const contract = assertExternalToolOperationContract(
@@ -16749,10 +16802,10 @@ function createExternalOrchestrationController(store, options) {
       runtimeImage
     );
     const reference = referenceOf(resource);
-    const latest = await store.get(reference);
+    const latest = await whileRunning(() => store.get(reference));
     let externalId = latest?.status?.externalId ?? resource.status?.externalId;
     if (!externalId) {
-      const health = await entry.driver.getHealth();
+      const health = await whileRunning(() => entry.driver.getHealth());
       if (!health.healthy) {
         throw new OrchestrationError({ code: "UNAVAILABLE", message: `external orchestrator '${entry.name}' is unhealthy`, retryable: true });
       }
@@ -16768,14 +16821,14 @@ function createExternalOrchestrationController(store, options) {
           retryable: false
         });
       }
-      const authorization = await options.authorizeToolOperation(resource);
+      const authorization = await whileRunning(() => options.authorizeToolOperation(resource, watchAbort.signal));
       if (authorization.approval) {
         await updateStatus(reference, (current) => ({
           ...current,
           approval: authorization.approval
         }));
       }
-      const placed = await entry.driver.executeToolOperation(resource, options.actor);
+      const placed = await whileRunning(() => entry.driver.executeToolOperation(resource, options.actor));
       externalId = placed.externalId;
       await updateStatus(reference, (current) => ({
         ...current,
@@ -16788,27 +16841,28 @@ function createExternalOrchestrationController(store, options) {
       }));
     }
     while (!stopped) {
-      const external = await entry.driver.getToolOperationStatus(externalId);
+      const external = await whileRunning(() => entry.driver.getToolOperationStatus(externalId));
       if (await reflectToolStatus(resource, external, contract)) return;
-      await sleep(pollIntervalMs);
+      await whileRunning(() => sleep(pollIntervalMs));
     }
   }
   function maybeStart(resource) {
+    if (stopped) return;
     const routed = resource;
     if (!routeOf(routed)) return;
     const phase = routed.status?.phase;
     if (phase === "Completed" || phase === "Failed" || phase === "Cancelled") return;
     if (active.has(routed.metadata.uid)) return;
-    active.add(routed.metadata.uid);
-    void (async () => {
+    const task = (async () => {
       let slot;
       try {
         const entry = findDriver(routed);
         if (!await acquireDriverSlot(entry)) return;
         slot = entry.name;
       } catch (error2) {
+        if (stopped || error2 === stoppedError) return;
         onError(error2);
-        await fail5(routed, error2).catch(onError);
+        await fail5(routed, error2).catch(reportUnlessStopped);
         return;
       }
       try {
@@ -16821,18 +16875,25 @@ function createExternalOrchestrationController(store, options) {
             }
             return;
           } catch (error2) {
+            if (stopped || error2 === stoppedError) return;
             onError(error2);
             if (!(error2 instanceof OrchestrationError) || !error2.retryable) {
-              await fail5(routed, error2).catch(onError);
+              await fail5(routed, error2).catch(reportUnlessStopped);
               return;
             }
-            await sleep(pollIntervalMs);
+            await whileRunning(() => sleep(pollIntervalMs));
           }
         }
       } finally {
         if (slot) releaseDriverSlot(slot);
       }
-    })().finally(() => active.delete(routed.metadata.uid));
+    })();
+    active.set(routed.metadata.uid, task);
+    void task.finally(() => {
+      if (active.get(routed.metadata.uid) === task) active.delete(routed.metadata.uid);
+    }).catch((error2) => {
+      if (!stopped && error2 !== stoppedError) onError(error2);
+    });
   }
   async function cancelDeleted(resource) {
     const driverName = resource.status?.assignedDriver ?? routeOf(resource);
@@ -16853,7 +16914,7 @@ function createExternalOrchestrationController(store, options) {
           { apiVersion, kind },
           { signal: watchAbort.signal }
         )[Symbol.asyncIterator]();
-        const existing = await store.list({ apiVersion, kind });
+        const existing = await whileRunning(() => store.list({ apiVersion, kind }));
         for (const resource of existing.items) maybeStart(resource);
         while (!stopped) {
           const next = await iterator.next();
@@ -16861,30 +16922,35 @@ function createExternalOrchestrationController(store, options) {
           const event = next.value;
           if (stopped) break;
           if (event.type === "DELETED") {
-            await cancelDeleted(event.resource).catch(onError);
+            await cancelDeleted(event.resource).catch(reportUnlessStopped);
           } else if (event.type === "ADDED" || event.type === "MODIFIED") {
             maybeStart(event.resource);
           }
         }
       } catch (error2) {
-        onError(error2);
+        if (!stopped && error2 !== stoppedError) onError(error2);
+      }
+      if (!stopped) {
+        await whileRunning(() => sleep(1e3)).catch((error2) => {
+          if (!stopped && error2 !== stoppedError) onError(error2);
+        });
       }
-      if (!stopped) await sleep(1e3);
     }
   }
   const watchers = [
     runKind(AGENT_WORKLOAD_API_VERSION, AGENT_WORKLOAD_KIND),
     runKind(TOOL_OPERATION_API_VERSION, TOOL_OPERATION_KIND)
   ];
-  for (const watcher of watchers) void watcher.catch(onError);
+  for (const watcher of watchers) void watcher.catch(reportUnlessStopped);
   return {
     async stop() {
-      stopped = true;
-      watchAbort.abort();
-      await Promise.race([
-        Promise.allSettled(watchers),
-        new Promise((resolve) => setTimeout(resolve, 50))
-      ]);
+      if (!stopPromise) {
+        stopped = true;
+        resolveStopped({ kind: "stopped" });
+        watchAbort.abort(stoppedError);
+        stopPromise = drainWithDeadline([...watchers, ...active.values()]);
+      }
+      await stopPromise;
     }
   };
 }
@@ -37656,15 +37722,64 @@ function createWorkloadExecutionController(store, driver, options) {
     });
   }
   const active = /* @__PURE__ */ new Map();
+  const executions = /* @__PURE__ */ new Map();
+  const cancellationRequested = /* @__PURE__ */ new Set();
+  const watchAbort = new AbortController();
+  const stoppedError = new OrchestrationError({
+    code: "CANCELLED",
+    message: "workload execution controller stopped",
+    retryable: false
+  });
+  let resolveStopped;
+  const stoppedBoundary = new Promise((resolve) => {
+    resolveStopped = resolve;
+  });
   let stopped = false;
+  let stopPromise;
+  function throwIfStopped() {
+    if (stopped) throw stoppedError;
+  }
+  async function whileRunning(operation) {
+    throwIfStopped();
+    const operationResult = Promise.resolve().then(operation).then(
+      (value) => ({ kind: "value", value }),
+      (error2) => ({
+        kind: "error",
+        error: error2 instanceof Error ? error2 : new Error(safeErrorMessageFromUnknown(error2))
+      })
+    );
+    const result = await Promise.race([operationResult, stoppedBoundary]);
+    if (result.kind === "stopped") throw stoppedError;
+    if (result.kind === "error") throw result.error;
+    return result.value;
+  }
+  function reportUnlessStopped(error2) {
+    if (!stopped && error2 !== stoppedError) onError(error2);
+  }
+  async function drainWithDeadline(tasks) {
+    let timeout;
+    try {
+      await Promise.race([
+        Promise.allSettled(tasks).then(() => {
+        }),
+        new Promise((resolve) => {
+          timeout = setTimeout(resolve, 1e3);
+        })
+      ]);
+    } finally {
+      if (timeout) clearTimeout(timeout);
+    }
+  }
   async function updateStatusWithRetry(reference, patch) {
     for (let attempt = 0; attempt < statusWriteAttempts; attempt += 1) {
-      const current = await store.get(reference);
+      const current = await whileRunning(() => store.get(reference));
       if (!current) return;
       try {
-        await store.updateStatus(options.actor, reference, patch(current.status), {
-          resourceVersion: current.metadata.resourceVersion
-        });
+        await whileRunning(
+          () => store.updateStatus(options.actor, reference, patch(current.status), {
+            resourceVersion: current.metadata.resourceVersion
+          })
+        );
         return;
       } catch (error2) {
         if (error2 instanceof OrchestrationError && error2.code === "CONFLICT") continue;
@@ -37699,22 +37814,26 @@ function createWorkloadExecutionController(store, driver, options) {
   }
   async function claimRuntimeExecution(reference) {
     for (let attempt = 0; attempt < statusWriteAttempts; attempt += 1) {
-      const current = await store.get(reference);
+      const current = await whileRunning(
+        () => store.get(reference)
+      );
       if (!current) return null;
       if (current.status?.runtimeExecutionClaim) return null;
       try {
-        return await store.updateStatus(
-          options.actor,
-          reference,
-          {
-            ...current.status,
-            phase: "Starting",
-            runtimeExecutionClaim: {
-              controllerInstanceId,
-              claimedAt: (/* @__PURE__ */ new Date()).toISOString()
-            }
-          },
-          { resourceVersion: current.metadata.resourceVersion }
+        return await whileRunning(
+          () => store.updateStatus(
+            options.actor,
+            reference,
+            {
+              ...current.status,
+              phase: "Starting",
+              runtimeExecutionClaim: {
+                controllerInstanceId,
+                claimedAt: (/* @__PURE__ */ new Date()).toISOString()
+              }
+            },
+            { resourceVersion: current.metadata.resourceVersion }
+          )
         );
       } catch (error2) {
         if (error2 instanceof OrchestrationError && error2.code === "CONFLICT") {
@@ -37739,8 +37858,10 @@ function createWorkloadExecutionController(store, driver, options) {
           retryable: false
         });
       }
-      const current = await store.get(
-        runReference
+      const current = await whileRunning(
+        () => store.get(
+          runReference
+        )
       );
       if (!current) {
         throw new OrchestrationError({
@@ -37752,12 +37873,14 @@ function createWorkloadExecutionController(store, driver, options) {
       if (!workload.spec.modelPolicy?.modelClass) return { run: current };
       const binding = current.status?.assignedModelEndpoint;
       if (binding) {
-        const endpoint = await store.get({
-          apiVersion: binding.apiVersion || MODEL_ENDPOINT_API_VERSION,
-          kind: binding.kind || MODEL_ENDPOINT_KIND,
-          name: binding.name,
-          namespace: binding.namespace
-        });
+        const endpoint = await whileRunning(
+          () => store.get({
+            apiVersion: binding.apiVersion || MODEL_ENDPOINT_API_VERSION,
+            kind: binding.kind || MODEL_ENDPOINT_KIND,
+            name: binding.name,
+            namespace: binding.namespace
+          })
+        );
         if (endpoint && endpoint.metadata.uid === binding.uid && endpoint.status?.healthy === true && Number.isFinite(Date.parse(endpoint.status.heartbeat ?? "")) && Date.now() - Date.parse(endpoint.status.heartbeat ?? "") <= modelEndpointHeartbeatTtlMs && endpoint.spec.modelClassRef.name === workload.spec.modelPolicy.modelClass) {
           return { run: current, endpoint };
         }
@@ -37769,7 +37892,7 @@ function createWorkloadExecutionController(store, driver, options) {
           retryable: true
         });
       }
-      await sleep(dependencyPollIntervalMs);
+      await whileRunning(() => sleep(dependencyPollIntervalMs));
     }
   }
   async function ensureNetworkAttachment(workload, runReference, runUid) {
@@ -37782,7 +37905,9 @@ function createWorkloadExecutionController(store, driver, options) {
       name: attachmentName,
       namespace: workload.metadata.namespace
     };
-    let attachment = await store.get(reference);
+    let attachment = await whileRunning(
+      () => store.get(reference)
+    );
     if (!attachment) {
       const manifest2 = createNetworkAttachmentManifest(attachmentName, {
         networkClassRef: {
@@ -37806,7 +37931,7 @@ function createWorkloadExecutionController(store, driver, options) {
         nodeId: options.nodeId
       });
       manifest2.metadata.namespace = workload.metadata.namespace;
-      attachment = await store.create(options.actor, manifest2);
+      attachment = await whileRunning(() => store.create(options.actor, manifest2));
     }
     await updateStatusWithRetry(runReference, (current) => ({
       ...current,
@@ -37827,7 +37952,9 @@ function createWorkloadExecutionController(store, driver, options) {
           retryable: false
         });
       }
-      const current = await store.get(reference);
+      const current = await whileRunning(
+        () => store.get(reference)
+      );
       if (!current || current.metadata.uid !== attachment.metadata.uid) {
         throw new OrchestrationError({
           code: "NOT_FOUND",
@@ -37843,7 +37970,9 @@ function createWorkloadExecutionController(store, driver, options) {
         });
       }
       if (current.status?.phase === "Attached" && current.status.handle) {
-        const networkClass = await store.get(current.spec.networkClassRef);
+        const networkClass = await whileRunning(
+          () => store.get(current.spec.networkClassRef)
+        );
         if (networkClass && current.status.binding?.networkClassResourceVersion === networkClass.metadata.resourceVersion && current.status.assignedNode === options.nodeId && current.status.assignedDriver === networkClass.spec.driver) {
           return current;
         }
@@ -37855,14 +37984,16 @@ function createWorkloadExecutionController(store, driver, options) {
           retryable: true
         });
       }
-      await sleep(dependencyPollIntervalMs);
+      await whileRunning(() => sleep(dependencyPollIntervalMs));
     }
   }
   async function waitForVolumeBindings(workload, runReference) {
     const expected = workload.spec.storagePolicy?.volumes ?? [];
     if (expected.length === 0) {
-      const run5 = await store.get(
-        runReference
+      const run5 = await whileRunning(
+        () => store.get(
+          runReference
+        )
       );
       return { run: run5 };
     }
@@ -37875,8 +38006,10 @@ function createWorkloadExecutionController(store, driver, options) {
           retryable: false
         });
       }
-      const run5 = await store.get(
-        runReference
+      const run5 = await whileRunning(
+        () => store.get(
+          runReference
+        )
       );
       if (!run5) {
         throw new OrchestrationError({
@@ -37903,7 +38036,7 @@ function createWorkloadExecutionController(store, driver, options) {
             retryable: false
           });
         }
-        return { run: run5, mounts: await options.resolveVolumeMounts(workload, run5) };
+        return { run: run5, mounts: await whileRunning(() => options.resolveVolumeMounts(workload, run5)) };
       }
       if (Date.now() >= deadline) {
         throw new OrchestrationError({
@@ -37912,12 +38045,14 @@ function createWorkloadExecutionController(store, driver, options) {
           retryable: true
         });
       }
-      await sleep(dependencyPollIntervalMs);
+      await whileRunning(() => sleep(dependencyPollIntervalMs));
     }
   }
   async function requestDependencyRelease(runReference) {
-    const run5 = await store.get(
-      runReference
+    const run5 = await whileRunning(
+      () => store.get(
+        runReference
+      )
     );
     if (!run5) return;
     const requestedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -37944,6 +38079,7 @@ function createWorkloadExecutionController(store, driver, options) {
     }
   }
   async function execute(workload) {
+    throwIfStopped();
     const workloadReference_ = workloadReference(workload);
     const runName = `${workload.metadata.name}-run`;
     const runReference = {
@@ -37955,18 +38091,19 @@ function createWorkloadExecutionController(store, driver, options) {
     let runtimeClaimed = false;
     try {
       let scriptSource;
-      if (workload.spec.scriptReference) {
-        scriptSource = await options.resolveScriptSource?.(workload.spec.scriptReference);
+      const scriptReference = workload.spec.scriptReference;
+      if (scriptReference) {
+        scriptSource = await whileRunning(async () => options.resolveScriptSource?.(scriptReference));
         if (!scriptSource) {
           await updateStatusWithRetry(workloadReference_, (current) => ({
             ...current,
             phase: "Failed",
-            lastRunResult: `script artifact '${workload.spec.scriptReference}' unavailable`
+            lastRunResult: `script artifact '${scriptReference}' unavailable`
           }));
           return;
         }
       }
-      let run5 = await store.get(runReference);
+      let run5 = await whileRunning(() => store.get(runReference));
       if (!run5) {
         const manifest2 = createAgentRunManifest(runName, {
           workloadRef: {
@@ -37979,15 +38116,19 @@ function createWorkloadExecutionController(store, driver, options) {
         });
         manifest2.metadata.namespace = workload.metadata.namespace;
         try {
-          run5 = await store.create(
-            options.actor,
-            manifest2
+          run5 = await whileRunning(
+            () => store.create(
+              options.actor,
+              manifest2
+            )
           );
         } catch (error2) {
           if (!(error2 instanceof OrchestrationError) || error2.code !== "CONFLICT") {
             throw error2;
           }
-          run5 = await store.get(runReference);
+          run5 = await whileRunning(
+            () => store.get(runReference)
+          );
           if (!run5) throw error2;
         }
       }
@@ -38007,8 +38148,10 @@ function createWorkloadExecutionController(store, driver, options) {
         waitForVolumeBindings(workload, runReference)
       ]);
       run5 = volumeDependencies.run;
-      run5 = await store.get(
-        runReference
+      run5 = await whileRunning(
+        () => store.get(
+          runReference
+        )
       ) ?? run5;
       await updateStatusWithRetry(workloadReference_, (current) => ({
         ...current,
@@ -38019,21 +38162,27 @@ function createWorkloadExecutionController(store, driver, options) {
       if (!claimedRun) return;
       runtimeClaimed = true;
       run5 = claimedRun;
-      const handle = await driver.start({
-        workload,
-        run: run5,
-        ...dependencies.endpoint ? { modelEndpoint: dependencies.endpoint } : {},
-        ...networkAttachment ? { networkAttachment } : {},
-        ...volumeDependencies.mounts ? { volumeMounts: volumeDependencies.mounts } : {},
-        scriptSource,
-        message: options.messageForWorkload?.(workload) ?? workload.metadata.name
-      });
+      const handle = await whileRunning(
+        () => driver.start({
+          workload,
+          run: run5,
+          ...dependencies.endpoint ? { modelEndpoint: dependencies.endpoint } : {},
+          ...networkAttachment ? { networkAttachment } : {},
+          ...volumeDependencies.mounts ? { volumeMounts: volumeDependencies.mounts } : {},
+          scriptSource,
+          message: options.messageForWorkload?.(workload) ?? workload.metadata.name
+        })
+      );
       active.set(workload.metadata.uid, handle);
+      if (cancellationRequested.has(workload.metadata.uid)) {
+        await handle.cancel().catch(reportUnlessStopped);
+        return;
+      }
       await updateStatusWithRetry(runReference, (current) => ({
         ...current,
         phase: "Running"
       }));
-      const outcome = await handle.wait();
+      const outcome = await whileRunning(() => handle.wait());
       await requestDependencyRelease(runReference);
       await updateStatusWithRetry(runReference, (current) => ({
         ...current,
@@ -38047,7 +38196,8 @@ function createWorkloadExecutionController(store, driver, options) {
         lastRunResult: outcome.summary ?? outcome.error?.message
       }));
     } catch (error2) {
-      await requestDependencyRelease(runReference).catch(onError);
+      if (stopped || error2 === stoppedError) return;
+      await requestDependencyRelease(runReference).catch(reportUnlessStopped);
       const cause = safeErrorMessageFromUnknown(error2, { fallback: "Runtime execution failed" });
       const message = runtimeClaimed ? `UNKNOWN_EFFECT: runtime execution failed after the durable pre-effect claim; verify external state before retrying: ${cause}` : cause;
       await updateStatusWithRetry(runReference, (current) => ({
@@ -38057,19 +38207,20 @@ function createWorkloadExecutionController(store, driver, options) {
           summary: message,
           exitCode: 1
         }
-      })).catch(onError);
-      if (stopped) return;
+      })).catch(reportUnlessStopped);
       onError(error2);
       await updateStatusWithRetry(workloadReference_, (current) => ({
         ...current,
         phase: "Failed",
         lastRunResult: message
-      })).catch(onError);
+      })).catch(reportUnlessStopped);
     } finally {
       active.delete(workload.metadata.uid);
+      cancellationRequested.delete(workload.metadata.uid);
     }
   }
   async function recoverRunning(workload) {
+    throwIfStopped();
     const runReference = {
       apiVersion: AGENT_RUN_API_VERSION,
       kind: AGENT_RUN_KIND,
@@ -38077,8 +38228,10 @@ function createWorkloadExecutionController(store, driver, options) {
       namespace: workload.metadata.namespace
     };
     try {
-      const run5 = await store.get(
-        runReference
+      const run5 = await whileRunning(
+        () => store.get(
+          runReference
+        )
       );
       if (run5) {
         try {
@@ -38136,12 +38289,14 @@ function createWorkloadExecutionController(store, driver, options) {
         })
       );
     } catch (error2) {
-      onError(error2);
+      if (!stopped && error2 !== stoppedError) onError(error2);
     } finally {
       active.delete(workload.metadata.uid);
+      cancellationRequested.delete(workload.metadata.uid);
     }
   }
   function maybeStart(resource) {
+    if (stopped) return;
     const workload = resource;
     const status = workload.status;
     if (!status || status.phase !== "Scheduling" && status.phase !== "Running") return;
@@ -38149,39 +38304,57 @@ function createWorkloadExecutionController(store, driver, options) {
     if (active.has(workload.metadata.uid)) return;
     active.set(workload.metadata.uid, { cancel: async () => {
     } });
-    if (status.phase === "Running") {
-      void recoverRunning(workload);
-    } else {
-      void execute(workload).catch(onError);
-    }
+    const execution = status.phase === "Running" ? recoverRunning(workload) : execute(workload);
+    executions.set(workload.metadata.uid, execution);
+    void execution.finally(() => {
+      if (executions.get(workload.metadata.uid) === execution) {
+        executions.delete(workload.metadata.uid);
+      }
+    }).catch((error2) => {
+      if (!stopped && error2 !== stoppedError) onError(error2);
+    });
   }
-  void (async () => {
+  const watcher = (async () => {
     while (!stopped) {
       try {
         for await (const event of store.watch(
           { apiVersion: AGENT_WORKLOAD_API_VERSION, kind: AGENT_WORKLOAD_KIND },
-          { sendInitialEvents: true }
+          { sendInitialEvents: true, signal: watchAbort.signal }
         )) {
           if (stopped) break;
           if (event.type === "ADDED" || event.type === "MODIFIED") {
             maybeStart(event.resource);
           } else if (event.type === "DELETED") {
             const workload = event.resource;
-            await active.get(workload.metadata.uid)?.cancel().catch(onError);
+            cancellationRequested.add(workload.metadata.uid);
+            await active.get(workload.metadata.uid)?.cancel().catch(reportUnlessStopped);
           }
         }
       } catch (error2) {
-        onError(error2);
+        if (!stopped && error2 !== stoppedError) onError(error2);
+      }
+      if (!stopped) {
+        await whileRunning(() => sleep(1e3)).catch((error2) => {
+          if (!stopped && error2 !== stoppedError) onError(error2);
+        });
       }
-      if (!stopped) await sleep(1e3);
     }
-  })().catch(onError);
+  })();
+  void watcher.catch((error2) => {
+    if (!stopped && error2 !== stoppedError) onError(error2);
+  });
   return {
     async stop() {
-      stopped = true;
-      for (const handle of active.values()) {
-        await handle.cancel().catch(() => void 0);
+      if (!stopPromise) {
+        stopped = true;
+        resolveStopped({ kind: "stopped" });
+        watchAbort.abort(stoppedError);
+        const cancellations = [...active.values()].map(async (handle) => {
+          await handle.cancel().catch(() => void 0);
+        });
+        stopPromise = drainWithDeadline([...cancellations, watcher, ...executions.values()]);
       }
+      await stopPromise;
     }
   };
 }
@@ -38955,6 +39128,7 @@ __export(src_exports, {
   DEVICE_HEARTBEAT_DEFAULT_MAX_CLOCK_SKEW_MS: () => DEVICE_HEARTBEAT_DEFAULT_MAX_CLOCK_SKEW_MS,
   DEVICE_HEARTBEAT_LIMITS: () => DEVICE_HEARTBEAT_LIMITS,
   DEVICE_HEARTBEAT_SIGNATURE_DOMAIN: () => DEVICE_HEARTBEAT_SIGNATURE_DOMAIN,
+  DEVICE_ORCHESTRATION_FRAME_LIMITS: () => DEVICE_ORCHESTRATION_FRAME_LIMITS,
   DEVICE_ORCHESTRATION_PROTOCOL: () => DEVICE_ORCHESTRATION_PROTOCOL,
   DEVICE_PAIRING_INVITE_MAX_CLOCK_SKEW_MS: () => DEVICE_PAIRING_INVITE_MAX_CLOCK_SKEW_MS,
   DEVICE_PAIRING_INVITE_PROTOCOL: () => DEVICE_PAIRING_INVITE_PROTOCOL,
@@ -48296,14 +48470,28 @@ var MemoryDeviceCloudTokenStorage = class {
   loadConnectionGrant(input) {
     return this.grants.get(connectionGrantCacheKey(input));
   }
-  saveConnectionGrant(input, grant) {
-    this.grants.set(connectionGrantCacheKey(input), grant);
+  saveConnectionGrant(input, grant, fence) {
+    const write = () => {
+      this.grants.set(connectionGrantCacheKey(input), grant);
+    };
+    if (!fence) {
+      write();
+      return;
+    }
+    if (!fence.commitSynchronous(write)) fence.throwIfStale();
   }
   loadRelayReservation(peerId) {
     return this.relayReservations.get(peerId);
   }
-  saveRelayReservation(peerId, token) {
-    this.relayReservations.set(peerId, token);
+  saveRelayReservation(peerId, token, fence) {
+    const write = () => {
+      this.relayReservations.set(peerId, token);
+    };
+    if (!fence) {
+      write();
+      return;
+    }
+    if (!fence.commitSynchronous(write)) fence.throwIfStale();
   }
   clear() {
     this.grants.clear();
@@ -48418,13 +48606,16 @@ var CloudDeviceFetchClient = class {
     }
     return { issuer: value.issuer, publicKeyMultibase: value.publicKeyMultibase };
   }
-  async createConnectionGrant(input, signal) {
+  async createConnectionGrant(input, signal, fence) {
+    assertFenceSignal(signal, fence);
+    fence?.throwIfStale();
     if (!isCanonicalConnectionGrantRequest(input)) {
       throw new TypeError("invalid_connection_grant_scope");
     }
     const cacheInput = normalizedConnectionGrantRequest(input);
     const cached = await this.loadCachedGrant(cacheInput);
     throwIfAborted(signal);
+    fence?.throwIfStale();
     if (isUsableConnectionGrant(cached, cacheInput, this.now() + this.tokenSafetyMarginMs)) {
       return cached;
     }
@@ -48433,12 +48624,17 @@ var CloudDeviceFetchClient = class {
       body: JSON.stringify(input)
     }, signal);
     if (!isUsableConnectionGrant(value, cacheInput, this.now())) throw invalidShape();
-    await this.saveCachedGrant(cacheInput, value);
+    fence?.throwIfStale();
+    await this.saveCachedGrant(cacheInput, value, fence);
+    fence?.throwIfStale();
     return value;
   }
-  async createRelayReservation(input, signal) {
+  async createRelayReservation(input, signal, fence) {
+    assertFenceSignal(signal, fence);
+    fence?.throwIfStale();
     const cached = await this.loadCachedRelayReservation(input.peerId);
     throwIfAborted(signal);
+    fence?.throwIfStale();
     if (isUsableRelayReservation(cached, input.peerId, this.now() + this.tokenSafetyMarginMs)) {
       return cached;
     }
@@ -48447,7 +48643,9 @@ var CloudDeviceFetchClient = class {
       body: JSON.stringify(input)
     }, signal);
     if (!isUsableRelayReservation(value, input.peerId, this.now())) throw invalidShape();
-    await this.saveCachedRelayReservation(input.peerId, value);
+    fence?.throwIfStale();
+    await this.saveCachedRelayReservation(input.peerId, value, fence);
+    fence?.throwIfStale();
     return value;
   }
   async heartbeat(input, signal) {
@@ -48521,10 +48719,11 @@ var CloudDeviceFetchClient = class {
       return void 0;
     }
   }
-  async saveCachedGrant(input, grant) {
+  async saveCachedGrant(input, grant, fence) {
     try {
-      await this.tokenStorage.saveConnectionGrant(input, grant);
+      await this.tokenStorage.saveConnectionGrant(input, grant, fence);
     } catch (error2) {
+      if (fence && !fence.isCurrent()) fence.throwIfStale();
       this.options.onTokenStorageError?.("save", error2);
     }
   }
@@ -48536,14 +48735,20 @@ var CloudDeviceFetchClient = class {
       return void 0;
     }
   }
-  async saveCachedRelayReservation(peerId, token) {
+  async saveCachedRelayReservation(peerId, token, fence) {
     try {
-      await this.tokenStorage.saveRelayReservation(peerId, token);
+      await this.tokenStorage.saveRelayReservation(peerId, token, fence);
     } catch (error2) {
+      if (fence && !fence.isCurrent()) fence.throwIfStale();
       this.options.onTokenStorageError?.("save", error2);
     }
   }
 };
+function assertFenceSignal(signal, fence) {
+  if (fence && signal && fence.signal !== signal) {
+    throw new TypeError("device_cloud_generation_signal_mismatch");
+  }
+}
 function normalizeCloudDeviceBaseUrl(value) {
   const baseUrl = value.trim();
   if (!baseUrl || baseUrl.length > CLOUD_URL_MAX_CHARACTERS) throw new Error("invalid_cloud_url");
@@ -48970,16 +49175,16 @@ var DeviceCloudConnectionCoordinator = class {
     try {
       if (this.snapshotValue.components.authorizer !== "ready") {
         activeComponent = "authorizer";
-        await this.runStep(activeComponent, generation, signal, () => this.options.adapter.ensureAuthorizer(configuration, signal));
+        await this.runStep(activeComponent, generation, signal, (fence) => this.options.adapter.ensureAuthorizer(configuration, signal, fence));
       }
       if (this.snapshotValue.components.registration !== "ready") {
         activeComponent = "registration";
-        await this.runStep(activeComponent, generation, signal, () => this.options.adapter.registerDevice(configuration, signal));
+        await this.runStep(activeComponent, generation, signal, (fence) => this.options.adapter.registerDevice(configuration, signal, fence));
       }
       let relayFailure;
       try {
         activeComponent = "relay";
-        await this.runStep(activeComponent, generation, signal, () => this.options.adapter.ensureRelay(configuration, signal));
+        await this.runStep(activeComponent, generation, signal, (fence) => this.options.adapter.ensureRelay(configuration, signal, fence));
       } catch (error2) {
         const classification = this.classify(error2);
         if (classification === "registration-invalid") throw error2;
@@ -48987,11 +49192,11 @@ var DeviceCloudConnectionCoordinator = class {
         this.warn("Device Cloud relay maintenance failed", relayFailure);
       }
       activeComponent = "heartbeat";
-      await this.runStep(activeComponent, generation, signal, () => this.options.adapter.heartbeat(configuration, signal));
+      await this.runStep(activeComponent, generation, signal, (fence) => this.options.adapter.heartbeat(configuration, signal, fence));
       let directoryFailure;
       try {
         activeComponent = "directory";
-        await this.runStep(activeComponent, generation, signal, () => this.options.adapter.syncDirectory(configuration, signal));
+        await this.runStep(activeComponent, generation, signal, (fence) => this.options.adapter.syncDirectory(configuration, signal, fence));
       } catch (error2) {
         const classification = this.classify(error2);
         if (classification === "registration-invalid") throw error2;
@@ -49031,9 +49236,9 @@ var DeviceCloudConnectionCoordinator = class {
     if (!this.isCurrent(generation, signal)) return;
     await this.setComponent(component, "pending", generation);
     try {
-      const result = await operation();
-      if (!this.isCurrent(generation, signal)) return;
       const fence = this.createCommitFence(generation, signal);
+      const result = await operation(fence);
+      if (!this.isCurrent(generation, signal)) return;
       await result?.commit?.(fence);
       if (!this.isCurrent(generation, signal)) return;
       await this.setComponent(component, "ready", generation);
@@ -49737,11 +49942,18 @@ function createJsonFrameReader(source, options) {
 
 // src/device-network/deviceOrchestrationTransport.ts
 var DEVICE_ORCHESTRATION_PROTOCOL = "/memeloop/orchestration/2.0.0";
-var DEFAULT_MAX_FRAME_BYTES = 1024 * 1024;
-var REQUEST_IDLE_TIMEOUT_MS = 1e4;
-var REQUEST_TOTAL_TIMEOUT_MS = 3e4;
-var WATCH_IDLE_TIMEOUT_MS = 9e4;
-var WATCH_BOOKMARK_INTERVAL_MS = 3e4;
+var DEVICE_ORCHESTRATION_FRAME_LIMITS = Object.freeze({
+  maxPayloadBytes: 1024 * 1024,
+  requestIdleTimeoutMs: 1e4,
+  requestTotalTimeoutMs: 3e4,
+  watchIdleTimeoutMs: 9e4,
+  watchBookmarkIntervalMs: 3e4
+});
+var DEFAULT_MAX_FRAME_BYTES = DEVICE_ORCHESTRATION_FRAME_LIMITS.maxPayloadBytes;
+var REQUEST_IDLE_TIMEOUT_MS = DEVICE_ORCHESTRATION_FRAME_LIMITS.requestIdleTimeoutMs;
+var REQUEST_TOTAL_TIMEOUT_MS = DEVICE_ORCHESTRATION_FRAME_LIMITS.requestTotalTimeoutMs;
+var WATCH_IDLE_TIMEOUT_MS = DEVICE_ORCHESTRATION_FRAME_LIMITS.watchIdleTimeoutMs;
+var WATCH_BOOKMARK_INTERVAL_MS = DEVICE_ORCHESTRATION_FRAME_LIMITS.watchBookmarkIntervalMs;
 function orchestrationTransportError(code, message) {
   return new OrchestrationError({
     code,
@@ -50022,6 +50234,13 @@ function createDeviceOrchestrationStreamHandler(options) {
   assertFrameLimit(maxFrameBytes);
   return async ({ remotePeerId, stream, authorize }) => {
     const abort = new AbortController();
+    const abortFromStream = () => {
+      if (!abort.signal.aborted) {
+        abort.abort(stream.signal?.reason ?? new Error("device orchestration stream closed"));
+      }
+    };
+    stream.signal?.addEventListener("abort", abortFromStream, { once: true });
+    if (stream.signal?.aborted) abortFromStream();
     try {
       const envelope = await readSingleRequest(stream, maxFrameBytes);
       if (authorize && !await authorize(envelope.grant)) {
@@ -50045,7 +50264,8 @@ function createDeviceOrchestrationStreamHandler(options) {
         await stream.sink(encodeJsonFrames([response], maxFrameBytes));
       }
     } finally {
-      abort.abort();
+      stream.signal?.removeEventListener("abort", abortFromStream);
+      if (!abort.signal.aborted) abort.abort();
       await stream.close().catch(() => void 0);
     }
   };
@@ -50777,6 +50997,23 @@ function sameTrustedDevice(left, right) {
 
 // src/device-network/standardDeviceCloudConnectionAdapter.ts
 var DEFAULT_RELAY_TOKEN_SAFETY_MARGIN_MS = 2 * 6e4;
+var REGISTRATION_INVALID_ERROR_CODES = /* @__PURE__ */ new Set([
+  "device_not_found",
+  "device_registration_invalid",
+  "device_registration_not_found",
+  "invalid_device_registration",
+  "registration_invalid"
+]);
+var DeviceCloudRegistrationInvalidError = class extends Error {
+  code = "DEVICE_CLOUD_REGISTRATION_INVALID";
+  constructor(cause) {
+    super(
+      "cloud device heartbeat rejected",
+      cause === void 0 ? void 0 : { cause }
+    );
+    this.name = "DeviceCloudRegistrationInvalidError";
+  }
+};
 var StandardDeviceCloudConnectionAdapter = class {
   constructor(options) {
     this.options = options;
@@ -50796,9 +51033,9 @@ var StandardDeviceCloudConnectionAdapter = class {
   }
   relayRequiredForOnline(_configuration) {
     const addresses = this.options.network.getMultiaddrs();
-    return this.options.relayRequiredForOnline?.(addresses) ?? !hasValidDirectCloudDeviceAddress(addresses);
+    return this.options.relayRequiredForOnline?.(addresses) ?? !hasValidDirectCloudDeviceAddress(addresses, this.options.identity.peerId);
   }
-  async ensureAuthorizer(client, signal) {
+  async ensureAuthorizer(client, signal, _fence) {
     const publicKey = await client.getConnectionGrantPublicKey(signal);
     return {
       commit: async (fence) => {
@@ -50808,7 +51045,7 @@ var StandardDeviceCloudConnectionAdapter = class {
       }
     };
   }
-  async registerDevice(client, signal) {
+  async registerDevice(client, signal, _fence) {
     const nonce = await client.createBindingNonce(signal);
     throwIfAborted3(signal);
     const signature = await this.options.signDeviceBinding({
@@ -50836,27 +51073,28 @@ var StandardDeviceCloudConnectionAdapter = class {
     }
     return void 0;
   }
-  async ensureRelay(client, signal) {
+  async ensureRelay(client, signal, fence) {
     if (this.relayReservationClient === client && this.relayReservation && this.relayReservation.expiresAt > this.now() + this.relayTokenSafetyMarginMs) {
       return void 0;
     }
     const relayReservation = await client.createRelayReservation(
       { peerId: this.options.identity.peerId },
-      signal
+      signal,
+      fence
     );
     return {
-      commit: async (fence) => {
-        fence.throwIfStale();
-        await this.options.network.configureRelayReservation(relayReservation, signal, fence);
-        fence.throwIfStale();
-        fence.commitSynchronous(() => {
+      commit: async (fence2) => {
+        fence2.throwIfStale();
+        await this.options.network.configureRelayReservation(relayReservation, signal, fence2);
+        fence2.throwIfStale();
+        fence2.commitSynchronous(() => {
           this.relayReservation = relayReservation;
           this.relayReservationClient = client;
         });
       }
     };
   }
-  async heartbeat(client, signal) {
+  async heartbeat(client, signal, _fence) {
     throwIfAborted3(signal);
     const capabilities = await this.options.capabilities();
     throwIfAborted3(signal);
@@ -50874,8 +51112,16 @@ var StandardDeviceCloudConnectionAdapter = class {
     if (!boundedProofSignature(heartbeat.signature)) {
       throw new Error("invalid device heartbeat signature");
     }
-    const result = await client.heartbeat(heartbeat, signal);
-    if (!result.ok) throw new Error("cloud device heartbeat rejected");
+    let result;
+    try {
+      result = await client.heartbeat(heartbeat, signal);
+    } catch (error2) {
+      if (isHeartbeatRegistrationInvalid(error2)) {
+        throw new DeviceCloudRegistrationInvalidError(error2);
+      }
+      throw error2;
+    }
+    if (!result.ok) throw new DeviceCloudRegistrationInvalidError();
     return void 0;
   }
   async dispose(client, signal) {
@@ -50911,7 +51157,7 @@ var StandardDeviceCloudConnectionAdapter = class {
       throw new AggregateError(errors, "device cloud generation cleanup failed");
     }
   }
-  async syncDirectory(client, signal) {
+  async syncDirectory(client, signal, _fence) {
     const cloudDevices = await client.listDevices(signal);
     return {
       commit: async (fence) => {
@@ -50939,6 +51185,7 @@ var StandardDeviceCloudConnectionAdapter = class {
     return this.options.syncDevice(client, peerId, signal);
   }
   classifyError(error2) {
+    if (error2 instanceof DeviceCloudRegistrationInvalidError) return "registration-invalid";
     if (error2 instanceof CloudDeviceFetchError) {
       return error2.code === "cloud_request_failed" ? "offline" : "error";
     }
@@ -50949,6 +51196,35 @@ var StandardDeviceCloudConnectionAdapter = class {
     return active.length > 0 ? [...active] : [...this.relayReservation?.relayMultiaddrs ?? []];
   }
 };
+function isHeartbeatRegistrationInvalid(error2) {
+  if (!(error2 instanceof CloudDeviceFetchError) || error2.code !== "cloud_http_error") {
+    return false;
+  }
+  if (error2.status === 404) return true;
+  return error2.status === 401 && hasExplicitRegistrationInvalidCode(error2.responseBody);
+}
+function hasExplicitRegistrationInvalidCode(responseBody) {
+  const body = responseBody?.trim();
+  if (!body) return false;
+  let value;
+  try {
+    value = JSON.parse(body);
+  } catch {
+    return REGISTRATION_INVALID_ERROR_CODES.has(normalizeErrorCode(body));
+  }
+  return registrationInvalidCodeFromValue(value);
+}
+function registrationInvalidCodeFromValue(value) {
+  if (typeof value === "string") {
+    return REGISTRATION_INVALID_ERROR_CODES.has(normalizeErrorCode(value));
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const record2 = value;
+  return registrationInvalidCodeFromValue(record2.code) || registrationInvalidCodeFromValue(record2.errorCode) || registrationInvalidCodeFromValue(record2.error);
+}
+function normalizeErrorCode(value) {
+  return value.trim().toLowerCase().replaceAll("-", "_");
+}
 function toPublicDeviceIdentity(identity) {
   return {
     peerId: identity.peerId,
@@ -50958,21 +51234,42 @@ function toPublicDeviceIdentity(identity) {
     platform: identity.platform
   };
 }
-function hasValidDirectCloudDeviceAddress(addresses) {
-  return addresses.some((address) => {
-    if (address.includes("/p2p-circuit")) return false;
-    const parts = address.split("/");
-    const protocolIndex = parts.findIndex(
-      (part) => part === "ip4" || part === "ip6" || part === "dns" || part === "dns4" || part === "dns6"
-    );
-    if (protocolIndex < 0) return false;
-    const host = parts[protocolIndex + 1]?.toLowerCase();
-    if (!host) return false;
-    const protocol = parts[protocolIndex];
-    if (protocol === "ip4") return isPublicIpv4(host);
-    if (protocol === "ip6") return isPublicIpv6(host);
-    return isPlausiblePublicDnsHost(host);
-  });
+function hasValidDirectCloudDeviceAddress(addresses, expectedPeerId) {
+  return addresses.some((address) => isDialableDirectMultiaddr(address, expectedPeerId));
+}
+function isDialableDirectMultiaddr(address, expectedPeerId) {
+  if (address.length === 0 || address.length > 4096 || address !== address.trim() || !address.startsWith("/") || address.endsWith("/") || address.includes("//") || address.includes("/p2p-circuit")) return false;
+  const parts = address.split("/").slice(1);
+  if (parts.some((part) => part.length === 0 || containsAsciiControlOrSpace4(part))) return false;
+  const hostProtocol = parts[0];
+  const host = parts[1]?.toLowerCase();
+  if (host === void 0 || hostProtocol !== "ip4" && hostProtocol !== "ip6" && hostProtocol !== "dns" && hostProtocol !== "dns4" && hostProtocol !== "dns6") return false;
+  const publicHost = hostProtocol === "ip4" ? isPublicIpv4(host) : hostProtocol === "ip6" ? isPublicIpv6(host) : isPlausiblePublicDnsHost(host);
+  if (!publicHost) return false;
+  const transport = parts[2];
+  const port = parsePort(parts[3]);
+  if (transport !== "tcp" || port === void 0) return false;
+  let index = 4;
+  if (parts[index] === "ws" || parts[index] === "wss") index += 1;
+  if (parts[index] === "p2p") {
+    const peerId = parts[index + 1];
+    if (!peerId || containsAsciiControlOrSpace4(peerId)) return false;
+    if (expectedPeerId !== void 0 && peerId !== expectedPeerId) return false;
+    index += 2;
+  }
+  return index === parts.length;
+}
+function parsePort(value) {
+  if (value === void 0 || !/^\d{1,5}$/u.test(value)) return void 0;
+  const port = Number(value);
+  return port >= 1 && port <= 65535 ? port : void 0;
+}
+function containsAsciiControlOrSpace4(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 32 || code === 127) return true;
+  }
+  return false;
 }
 function isPublicIpv4(host) {
   const octets = host.split(".").map((part) => Number(part));
@@ -51012,7 +51309,17 @@ function isPlausiblePublicDnsHost(host) {
   const normalized = host.endsWith(".") ? host.slice(0, -1) : host;
   if (isIpv4Syntax(normalized)) return isPublicIpv4(normalized);
   if (normalized.includes(":")) return isPublicIpv6(normalized);
-  if (normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local") || normalized.endsWith(".internal")) return false;
+  const specialUseSuffixes = [
+    "example",
+    "home.arpa",
+    "internal",
+    "invalid",
+    "local",
+    "localhost",
+    "onion",
+    "test"
+  ];
+  if (specialUseSuffixes.some((suffix) => normalized === suffix || normalized.endsWith(`.${suffix}`))) return false;
   const labels = normalized.split(".");
   return labels.length > 1 && labels.every(
     (label) => label.length > 0 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label)
@@ -51840,7 +52147,7 @@ function readDataIdentifier(value, property, field) {
 }
 
 // src/plugin/loader.ts
-var MEMELOOP_PLUGIN_API_VERSION = "0.2.8";
+var MEMELOOP_PLUGIN_API_VERSION = "0.2.9";
 var dangerousManifestKeys = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
 var manifestKeys = /* @__PURE__ */ new Set(["name", "version", "description", "exports", "author", "minMemeloopVersion"]);
 var exportKeys = /* @__PURE__ */ new Set([
@@ -53359,6 +53666,7 @@ var ToolDefinitionRegistry = class {
   DEVICE_HEARTBEAT_DEFAULT_MAX_CLOCK_SKEW_MS,
   DEVICE_HEARTBEAT_LIMITS,
   DEVICE_HEARTBEAT_SIGNATURE_DOMAIN,
+  DEVICE_ORCHESTRATION_FRAME_LIMITS,
   DEVICE_ORCHESTRATION_PROTOCOL,
   DEVICE_PAIRING_INVITE_MAX_CLOCK_SKEW_MS,
   DEVICE_PAIRING_INVITE_PROTOCOL,