agents
Version:
A home for your AI agents
3,398 lines • 138 kB
JavaScript
import { i as normalizeToolInput, n as getPartialStreamText, r as isReplayChunk, t as applyChunkToParts } from "../message-builder-BymO4N_D.js";
import { i as interceptAgentToolBroadcast, n as applyAgentToolEvent, r as createAgentToolEventState, t as AgentToolProgressEmitter } from "../agent-tools-y7zLfw4Q.js";
import { t as truncateToolOutput } from "../tool-output-truncation-CNnnGZQ3.js";
import { a as StreamAccumulator, i as transition, n as CHAT_MESSAGE_TYPES, r as STREAM_RESUME_NONE_REASONS, t as MessageType } from "../wire-types-CU9rLoeS.js";
import { jsonSchema, tool } from "ai";
import { nanoid } from "nanoid";
//#region src/chat/sanitize.ts
const textEncoder$1 = new TextEncoder();
/** Maximum serialized message size before compaction (bytes). 1.8MB with headroom below SQLite's 2MB limit. */
const ROW_MAX_BYTES = 18e5;
/** Measure UTF-8 byte length of a string. */
function byteLength(s) {
return textEncoder$1.encode(s).byteLength;
}
/**
* Sanitize a message for persistence by removing ephemeral provider-specific
* data that should not be stored or sent back in subsequent requests.
*
* 1. Strips OpenAI ephemeral fields (itemId, reasoningEncryptedContent)
* 2. Filters truly empty reasoning parts (no text, no remaining providerMetadata)
*/
function sanitizeMessage(message) {
const sanitizedParts = message.parts.map((part) => {
let sanitizedPart = part;
if ("providerMetadata" in sanitizedPart && sanitizedPart.providerMetadata && typeof sanitizedPart.providerMetadata === "object" && "openai" in sanitizedPart.providerMetadata) sanitizedPart = stripOpenAIMetadata(sanitizedPart, "providerMetadata");
if ("callProviderMetadata" in sanitizedPart && sanitizedPart.callProviderMetadata && typeof sanitizedPart.callProviderMetadata === "object" && "openai" in sanitizedPart.callProviderMetadata) sanitizedPart = stripOpenAIMetadata(sanitizedPart, "callProviderMetadata");
return sanitizedPart;
}).filter((part) => {
if (part.type === "reasoning") {
const reasoningPart = part;
if (!reasoningPart.text || reasoningPart.text.trim() === "") {
if ("providerMetadata" in reasoningPart && reasoningPart.providerMetadata && typeof reasoningPart.providerMetadata === "object" && Object.keys(reasoningPart.providerMetadata).length > 0) return true;
return false;
}
}
return true;
});
return {
...message,
parts: sanitizedParts
};
}
function stripOpenAIMetadata(part, metadataKey) {
const metadata = part[metadataKey];
if (!metadata?.openai) return part;
const { itemId: _itemId, reasoningEncryptedContent: _rec, ...restOpenai } = metadata.openai;
const hasOtherOpenaiFields = Object.keys(restOpenai).length > 0;
const { openai: _openai, ...restMetadata } = metadata;
let newMetadata;
if (hasOtherOpenaiFields) newMetadata = {
...restMetadata,
openai: restOpenai
};
else if (Object.keys(restMetadata).length > 0) newMetadata = restMetadata;
const { [metadataKey]: _oldMeta, ...restPart } = part;
if (newMetadata) return {
...restPart,
[metadataKey]: newMetadata
};
return restPart;
}
/**
* Enforce SQLite row size limits by compacting tool outputs and text parts
* when a serialized message exceeds the safety threshold (1.8MB). Shared by
* `@cloudflare/ai-chat` and `@cloudflare/think` so both compact identically.
*
* Compaction strategy:
* 1. Compact tool outputs over 1KB with {@link truncateToolOutput}, preserving
* the structured output shape, and annotate `metadata.compactedToolOutputs`
* with the compacted tool-call IDs.
* 2. If still too big, truncate text parts from oldest to newest, annotating
* `metadata.compactedTextParts` with the truncated part indices.
*/
function enforceRowSizeLimit(message, options) {
let json = JSON.stringify(message);
let size = byteLength(json);
if (size <= 18e5) return message;
if (message.role !== "assistant") {
options?.warn?.(`Non-assistant message ${message.id} is ${size} bytes, exceeds row limit. Truncating text parts.`);
return truncateTextParts(message);
}
options?.warn?.(`Message ${message.id} is ${size} bytes, compacting tool outputs to fit SQLite row limit`);
const compactedToolCallIds = [];
const compactedParts = message.parts.map((part) => {
if ("output" in part && "toolCallId" in part && "state" in part && part.state === "output-available") {
const output = part.output;
const truncated = truncateToolOutput(output, 1e3);
if (truncated.truncated) {
compactedToolCallIds.push(part.toolCallId);
return {
...part,
output: truncated.output
};
}
}
return part;
});
const result = {
...message,
parts: compactedParts
};
if (compactedToolCallIds.length > 0) result.metadata = {
...result.metadata ?? {},
compactedToolOutputs: compactedToolCallIds
};
json = JSON.stringify(result);
size = byteLength(json);
if (size <= 18e5) return result;
options?.warn?.(`Message ${message.id} still ${size} bytes after tool compaction, truncating text parts`);
return truncateTextParts(result);
}
function truncateTextParts(message) {
const compactedTextPartIndices = [];
const parts = [...message.parts];
for (let i = 0; i < parts.length; i++) {
const part = parts[i];
if (part.type === "text" && "text" in part) {
const text = part.text;
if (text.length > 1e3) {
compactedTextPartIndices.push(i);
parts[i] = {
...part,
text: `[Text truncated for storage (${text.length} chars). First 500 chars: ${text.slice(0, 500)}...]`
};
const candidate = {
...message,
parts
};
if (byteLength(JSON.stringify(candidate)) <= 18e5) break;
}
}
}
const result = {
...message,
parts
};
if (compactedTextPartIndices.length > 0) result.metadata = {
...result.metadata ?? {},
compactedTextParts: compactedTextPartIndices
};
return result;
}
//#endregion
//#region src/chat/turn-queue.ts
var TurnQueue = class {
constructor() {
this._queue = Promise.resolve();
this._generation = 0;
this._activeRequestId = null;
this._countsByGeneration = /* @__PURE__ */ new Map();
}
get generation() {
return this._generation;
}
get activeRequestId() {
return this._activeRequestId;
}
get isActive() {
return this._activeRequestId !== null;
}
async enqueue(requestId, fn, options) {
const previousTurn = this._queue;
let releaseTurn;
const capturedGeneration = options?.generation ?? this._generation;
this._countsByGeneration.set(capturedGeneration, (this._countsByGeneration.get(capturedGeneration) ?? 0) + 1);
this._queue = new Promise((resolve) => {
releaseTurn = resolve;
});
await previousTurn;
if (this._generation !== capturedGeneration) {
this._decrementCount(capturedGeneration);
releaseTurn();
return { status: "stale" };
}
this._activeRequestId = requestId;
try {
return {
status: "completed",
value: await fn()
};
} finally {
this._activeRequestId = null;
this._decrementCount(capturedGeneration);
releaseTurn();
}
}
/**
* Advance the generation counter. All turns enqueued under older
* generations will be skipped when they reach the front of the queue.
*/
reset() {
this._generation++;
}
/**
* Wait until the queue is fully drained (no pending or active turns).
*/
async waitForIdle() {
let queue;
do {
queue = this._queue;
await queue;
} while (this._queue !== queue);
}
/**
* Number of active + queued turns for a given generation.
* Defaults to the current generation.
*/
queuedCount(generation) {
return this._countsByGeneration.get(generation ?? this._generation) ?? 0;
}
_decrementCount(generation) {
const count = (this._countsByGeneration.get(generation) ?? 1) - 1;
if (count <= 0) this._countsByGeneration.delete(generation);
else this._countsByGeneration.set(generation, count);
}
};
//#endregion
//#region src/chat/submit-concurrency.ts
var SubmitConcurrencyController = class {
constructor(options) {
this.options = options;
this._submitSequence = 0;
this._latestOverlappingSubmitSequence = 0;
this._pendingEnqueueCount = 0;
this._resetEpoch = 0;
this._activeDebounceTimers = /* @__PURE__ */ new Set();
this._activeDebounceResolves = /* @__PURE__ */ new Set();
}
get pendingEnqueueCount() {
return this._pendingEnqueueCount;
}
get overlappingSubmitCount() {
return this._latestOverlappingSubmitSequence;
}
decide(options) {
const queuedTurnsInCurrentEpoch = options.queuedTurns + this._pendingEnqueueCount;
if (!options.isSubmitMessage || queuedTurnsInCurrentEpoch === 0) return {
action: "execute",
strategy: null,
submitSequence: null,
debounceUntilMs: null
};
const concurrency = this.normalize(options.concurrency);
if (concurrency === "drop") return {
action: "drop",
strategy: concurrency,
submitSequence: null,
debounceUntilMs: null
};
if (concurrency === "queue") return {
action: "execute",
strategy: concurrency,
submitSequence: null,
debounceUntilMs: null
};
const submitSequence = ++this._submitSequence;
this._latestOverlappingSubmitSequence = submitSequence;
if (concurrency === "latest" || concurrency === "merge") return {
action: "execute",
strategy: concurrency,
submitSequence,
debounceUntilMs: null
};
return {
action: "execute",
strategy: concurrency,
submitSequence,
debounceUntilMs: Date.now() + concurrency.debounceMs
};
}
/**
* Mark a submit as accepted and in-flight between admission and turn
* queue registration. Returns an idempotent `release()` function that
* must be called when the submit either reaches the turn queue or is
* abandoned. The returned function is bound to the controller's reset
* epoch — releases from before the most recent `reset()` are no-ops,
* so post-reset submits keep an accurate count.
*/
beginEnqueue() {
this._pendingEnqueueCount++;
const epoch = this._resetEpoch;
let released = false;
return () => {
if (released) return;
released = true;
if (this._resetEpoch !== epoch) return;
this._pendingEnqueueCount = Math.max(0, this._pendingEnqueueCount - 1);
};
}
isSuperseded(submitSequence) {
return submitSequence !== null && submitSequence < this._latestOverlappingSubmitSequence;
}
async waitForTimestamp(timestampMs) {
const remainingMs = timestampMs - Date.now();
if (remainingMs <= 0) return;
await new Promise((resolve) => {
const wrappedResolve = () => {
this._activeDebounceResolves.delete(wrappedResolve);
resolve();
};
const timer = setTimeout(() => {
this._activeDebounceTimers.delete(timer);
wrappedResolve();
}, remainingMs);
this._activeDebounceTimers.add(timer);
this._activeDebounceResolves.add(wrappedResolve);
});
}
cancelActiveDebounce() {
for (const timer of this._activeDebounceTimers) clearTimeout(timer);
this._activeDebounceTimers.clear();
const resolves = [...this._activeDebounceResolves];
this._activeDebounceResolves.clear();
for (const resolve of resolves) resolve();
}
reset() {
this._resetEpoch++;
this._pendingEnqueueCount = 0;
this.cancelActiveDebounce();
}
async waitForIdle(waitForQueueIdle) {
while (true) {
await waitForQueueIdle();
if (this._pendingEnqueueCount === 0) return;
await new Promise((resolve) => setTimeout(resolve, 5));
}
}
normalize(concurrency) {
if (typeof concurrency === "string") return concurrency;
const debounceMs = concurrency.debounceMs;
return {
strategy: "debounce",
debounceMs: typeof debounceMs === "number" && Number.isFinite(debounceMs) && debounceMs >= 0 ? debounceMs : this.options.defaultDebounceMs
};
}
};
//#endregion
//#region src/chat/connection.ts
/**
* Send a message on a connection, swallowing the specific
* "send after close" error a racing disconnect produces. Returns `true` if the
* send went out, `false` if the socket was already closed. Any other error
* rethrows.
*/
function sendIfOpen(connection, message) {
try {
connection.send(message);
return true;
} catch (error) {
if (isWebSocketClosedSendError(error)) return false;
throw error;
}
}
/** Whether an error is the "WebSocket send() after close" `TypeError`. */
function isWebSocketClosedSendError(error) {
return error instanceof TypeError && error.message.includes("WebSocket send() after close");
}
//#endregion
//#region src/chat/resumable-stream.ts
/**
* ResumableStream: Standalone class for buffering, persisting, and replaying
* stream chunks in SQLite. Extracted from AIChatAgent to separate concerns.
*
* Handles:
* - Chunk buffering (batched writes to SQLite for performance)
* - Stream lifecycle (start, complete, error)
* - Chunk replay for reconnecting clients
* - Stale stream cleanup
* - Active stream restoration after agent restart
*/
/** Number of chunks to pack into a single SQLite row before flushing */
const CHUNK_BUFFER_SIZE = 10;
/** Maximum buffer size to prevent memory issues on rapid reconnections */
const CHUNK_BUFFER_MAX_SIZE = 100;
/**
* Max accumulated raw chunk bytes packed into one row before forcing a flush.
* The SQLite row limit is 2 MB; packing serializes bodies into a JSON array,
* which re-escapes their contents (quotes/backslashes), so we keep the raw
* total well under the limit to leave generous headroom for escaping overhead.
* A chunk larger than this is flushed as its own (unwrapped) row.
*/
const SEGMENT_MAX_BYTES = 512e3;
/** Default cleanup interval for old streams (ms) - every 10 minutes */
const CLEANUP_INTERVAL_MS = 600 * 1e3;
/**
* Retention for completed/errored stream buffers, measured from completion.
*
* The assistant message is persisted separately (`cf_ai_chat_agent_messages`),
* so once a stream completes its buffer is no longer the source of truth — it
* is only a brief reconnect-and-replay grace window: long enough to cover a
* client that dropped at the completion boundary and reconnects to replay the
* just-finished stream, and to deliver a pending terminal error frame on a
* resumed stream (#1645). It is deliberately short (not the chat's lifetime)
* so idle/one-off chat DOs don't accumulate stale buffers (#1706).
*/
const COMPLETED_RETENTION_MS = 600 * 1e3;
/**
* Retention for abandoned `streaming` rows, measured from LAST chunk activity.
*
* Generous relative to {@link COMPLETED_RETENTION_MS}: an interrupted turn must
* have ample time to be resumed by a reconnecting client or healed by fiber
* recovery before its buffer is reaped. Only a stream that has produced no
* chunk for this long is treated as truly dead. Keyed off last activity (not
* start time) so a long but still-active stream is never swept mid-flight.
*/
const ABANDONED_STREAM_RETENTION_MS = 3600 * 1e3;
/** Shared encoder for UTF-8 byte length measurement */
const textEncoder = new TextEncoder();
/**
* How far ahead (seconds) to schedule the resumable-stream buffer cleanup
* alarm. Set to the short completion-grace window ({@link COMPLETED_RETENTION_MS},
* 10m) so a finished buffer is reclaimed promptly. The re-arm-while-reclaimable
* loop (see {@link cleanupStreamBuffers}) revisits any longer-lived rows — e.g.
* an abandoned in-flight buffer on its 1h window — by waking again each interval
* until they age out, then stops. Driving cleanup from an alarm (rather than
* only piggybacking on the next stream completion) ensures idle/one-off chat
* DOs still reclaim their buffers without waking forever (#1706). Shared by
* `AIChatAgent` and `Think`.
*/
const STREAM_CLEANUP_DELAY_SECONDS = 600;
/**
* A stored row body is either a single chunk body (a JSON object string —
* legacy per-chunk rows and single-chunk segments) or a packed segment (a JSON
* array of chunk body strings). Unpack to the individual chunk bodies in order.
*
* Stored chunk bodies are always serialized JSON *objects*, never arrays, so
* `Array.isArray` reliably distinguishes a packed segment from a single body.
*/
function unpackSegmentBody(rowBody) {
try {
const parsed = JSON.parse(rowBody);
if (Array.isArray(parsed)) return parsed;
} catch {}
return [rowBody];
}
function isMissingMetadataColumnError(error) {
const message = error instanceof Error ? error.message : String(error);
return (message.includes("message_id") || message.includes("is_continuation")) && (message.toLowerCase().includes("no such column") || message.toLowerCase().includes("has no column named"));
}
var ResumableStream = class ResumableStream {
constructor(sql) {
this.sql = sql;
this._activeStreamId = null;
this._activeRequestId = null;
this._segmentIndex = 0;
this._isLive = false;
this._activeIsContinuation = false;
this._chunkBuffer = [];
this._chunkBufferBytes = 0;
this._isFlushingChunks = false;
this._lastCleanupTime = 0;
this.sql`create table if not exists cf_ai_chat_stream_chunks (
id text primary key,
stream_id text not null,
body text not null,
chunk_index integer not null,
created_at integer not null
)`;
this.sql`create table if not exists cf_ai_chat_stream_metadata (
id text primary key,
request_id text not null,
status text not null,
created_at integer not null,
completed_at integer,
message_id text,
is_continuation integer
)`;
this.sql`create index if not exists idx_stream_chunks_stream_id
on cf_ai_chat_stream_chunks(stream_id, chunk_index)`;
this.restore();
}
/**
* Add metadata columns for rows created before they existed. Constructors
* intentionally do not run this: most wakes never start a stream, so paying a
* schema-introspection read every time is wasteful. New tables include these
* columns in CREATE TABLE; legacy tables migrate lazily only if a write/read
* discovers the columns are missing.
*/
_migrateMetadataColumns() {
const columns = this.sql`
select name from pragma_table_info('cf_ai_chat_stream_metadata')
` ?? [];
if (!columns.some((column) => column.name === "message_id")) this.sql`alter table cf_ai_chat_stream_metadata add column message_id text`;
if (!columns.some((column) => column.name === "is_continuation")) this.sql`alter table cf_ai_chat_stream_metadata add column is_continuation integer`;
}
get activeStreamId() {
return this._activeStreamId;
}
get activeRequestId() {
return this._activeRequestId;
}
hasActiveStream() {
return this._activeStreamId !== null;
}
/**
* Whether the active stream has a live LLM reader (started in this
* instance) vs being restored from SQLite after hibernation (orphaned).
*/
get isLive() {
return this._isLive;
}
/**
* Start tracking a new stream for resumable streaming.
* Creates metadata entry in SQLite and sets up tracking state.
* @param requestId - The unique ID of the chat request
* @returns The generated stream ID
*/
start(requestId, options = {}) {
this.flushBuffer();
const streamId = nanoid();
this._activeStreamId = streamId;
this._activeRequestId = requestId;
this._segmentIndex = 0;
this._isLive = true;
this._activeIsContinuation = options.continuation ?? false;
const messageId = options.messageId ?? null;
try {
this.sql`
insert into cf_ai_chat_stream_metadata (id, request_id, status, created_at, message_id, is_continuation)
values (${streamId}, ${requestId}, 'streaming', ${Date.now()}, ${messageId}, ${this._activeIsContinuation ? 1 : 0})
`;
} catch (error) {
if (!isMissingMetadataColumnError(error)) throw error;
this._migrateMetadataColumns();
this.sql`
insert into cf_ai_chat_stream_metadata (id, request_id, status, created_at, message_id, is_continuation)
values (${streamId}, ${requestId}, 'streaming', ${Date.now()}, ${messageId}, ${this._activeIsContinuation ? 1 : 0})
`;
}
return streamId;
}
/**
* The assistant message id an orphaned stream was producing — the same id the
* live path persists under, so recovery re-associates reconstructed chunks
* with the correct message (#1691). Returns null when the row is missing or
* is a legacy row written before the `message_id` column existed.
*/
getStreamMessageId(streamId) {
let rows;
try {
rows = this.sql`
select message_id from cf_ai_chat_stream_metadata
where id = ${streamId}
`;
} catch (error) {
if (!isMissingMetadataColumnError(error)) throw error;
return null;
}
if (!rows || rows.length === 0) return null;
return rows[0].message_id ?? null;
}
/**
* Mark a stream as completed and flush any pending chunks.
* @param streamId - The stream to mark as completed
*/
complete(streamId) {
this.flushBuffer();
this.sql`
update cf_ai_chat_stream_metadata
set status = 'completed', completed_at = ${Date.now()}
where id = ${streamId}
`;
this._activeStreamId = null;
this._activeRequestId = null;
this._segmentIndex = 0;
this._isLive = false;
this._activeIsContinuation = false;
this._maybeCleanupOldStreams();
}
/**
* Mark a stream as errored and clean up state.
* @param streamId - The stream to mark as errored
*/
markError(streamId) {
this.flushBuffer();
this.sql`
update cf_ai_chat_stream_metadata
set status = 'error', completed_at = ${Date.now()}
where id = ${streamId}
`;
this._activeStreamId = null;
this._activeRequestId = null;
this._segmentIndex = 0;
this._isLive = false;
this._activeIsContinuation = false;
}
/**
* Buffer a stream chunk for batch write to SQLite.
* Chunks exceeding the row size limit are skipped to prevent crashes.
* The chunk is still broadcast to live clients (caller handles that),
* but will be missing from replay on reconnection.
* @param streamId - The stream this chunk belongs to
* @param body - The serialized chunk body
*/
storeChunk(streamId, body) {
const bodyBytes = textEncoder.encode(body).byteLength;
if (bodyBytes > ResumableStream.CHUNK_MAX_BYTES) {
console.warn(`[ResumableStream] Skipping oversized chunk (${bodyBytes} bytes) to prevent SQLite row limit crash. Live clients still receive it.`);
return;
}
if (this._chunkBuffer.length >= CHUNK_BUFFER_MAX_SIZE) this.flushBuffer();
if (this._chunkBuffer.length > 0 && this._chunkBufferBytes + bodyBytes > SEGMENT_MAX_BYTES) this.flushBuffer();
this._chunkBuffer.push({
streamId,
body
});
this._chunkBufferBytes += bodyBytes;
if (this._chunkBuffer.length >= CHUNK_BUFFER_SIZE) this.flushBuffer();
}
/**
* Flush the buffered chunks to SQLite as a single packed row.
* Uses a lock to prevent concurrent flush operations.
*
* The whole buffer becomes one row: a single-chunk segment is stored
* unwrapped (legacy object format) so a large chunk avoids array-escaping
* inflation, while a multi-chunk segment stores a JSON array of bodies. This
* collapses N chunk rows into one, cutting rows written / stored / scanned.
*/
flushBuffer() {
if (this._isFlushingChunks || this._chunkBuffer.length === 0) return;
this._isFlushingChunks = true;
try {
const chunks = this._chunkBuffer;
this._chunkBuffer = [];
this._chunkBufferBytes = 0;
const streamId = chunks[0].streamId;
const segmentBody = chunks.length === 1 ? chunks[0].body : JSON.stringify(chunks.map((chunk) => chunk.body));
this.sql`
insert into cf_ai_chat_stream_chunks (id, stream_id, body, chunk_index, created_at)
values (${nanoid()}, ${streamId}, ${segmentBody}, ${this._segmentIndex}, ${Date.now()})
`;
this._segmentIndex++;
} finally {
this._isFlushingChunks = false;
}
}
/**
* Send stored stream chunks to a connection for replay.
* Chunks are marked with replay: true so the client can batch-apply them.
*
* Three outcomes:
* - **Live stream**: sends chunks + `replayComplete` — client flushes and
* continues receiving live chunks from the LLM reader.
* - **Orphaned stream** (restored from SQLite after hibernation, no reader):
* sends chunks + `done` and completes the stream. The caller should
* reconstruct and persist the partial message from the stored chunks.
* - **Completed during replay** (defensive): sends chunks + `done`.
*
* All sends use {@link sendIfOpen}, so a WebSocket closing mid-replay
* does not throw. If the connection drops while iterating chunks the
* stream is left active so the next reconnect can retry.
*
* @param connection - The WebSocket connection
* @param requestId - The original request ID
* @returns The stream ID if the stream was orphaned and finalized, null otherwise.
* When non-null the caller should reconstruct the message from chunks.
*/
replayChunks(connection, requestId) {
const streamId = this._activeStreamId;
if (!streamId) return null;
this.flushBuffer();
const continuation = this._activeIsContinuation;
const chunks = this.sql`
select * from cf_ai_chat_stream_chunks
where stream_id = ${streamId}
order by chunk_index asc
`;
for (const chunk of chunks || []) for (const body of unpackSegmentBody(chunk.body)) if (!sendIfOpen(connection, JSON.stringify({
body,
done: false,
id: requestId,
type: CHAT_MESSAGE_TYPES.USE_CHAT_RESPONSE,
replay: true,
...continuation && { continuation: true }
}))) return null;
if (this._activeStreamId !== streamId) {
sendIfOpen(connection, JSON.stringify({
body: "",
done: true,
id: requestId,
type: CHAT_MESSAGE_TYPES.USE_CHAT_RESPONSE,
replay: true,
...continuation && { continuation: true }
}));
return null;
}
if (!this._isLive) {
sendIfOpen(connection, JSON.stringify({
body: "",
done: true,
id: requestId,
type: CHAT_MESSAGE_TYPES.USE_CHAT_RESPONSE,
replay: true,
...continuation && { continuation: true }
}));
this.complete(streamId);
return streamId;
}
sendIfOpen(connection, JSON.stringify({
body: "",
done: false,
id: requestId,
type: CHAT_MESSAGE_TYPES.USE_CHAT_RESPONSE,
replay: true,
replayComplete: true,
...continuation && { continuation: true }
}));
return null;
}
replayCompletedChunksByRequestId(connection, requestId) {
const stream = this._latestStreamForRequest(requestId, "completed");
if (!stream) return false;
const continuation = stream.is_continuation === 1;
if (!this._replayStoredChunks(connection, stream.id, requestId, continuation)) return false;
return sendIfOpen(connection, JSON.stringify({
body: "",
done: true,
id: requestId,
type: CHAT_MESSAGE_TYPES.USE_CHAT_RESPONSE,
replay: true,
...continuation && { continuation: true }
}));
}
/**
* Replay the stored chunks of an errored stream for a request, WITHOUT a
* terminal frame — the caller follows up with the `done: true, error: true`
* frame carrying the durable terminal record's error text, mirroring what a
* live client observed (content chunks, then the error). Without this, a
* client that missed broadcast frames while disconnected has no other
* channel to the pre-error partial content: the server does not push
* messages on connect, and {@link replayCompletedChunksByRequestId} only
* serves `completed` streams (#1575).
*
* Returns true when the caller should proceed to send its terminal frame:
* either no errored stream existed (nothing to replay) or its chunks were
* replayed successfully. Returns false only when a send failed mid-replay,
* signalling the caller to skip the terminal frame — the connection is gone
* and the next reconnect retries the whole sequence.
*/
replayErroredChunksByRequestId(connection, requestId) {
const stream = this._latestStreamForRequest(requestId, "error");
if (!stream) return true;
return this._replayStoredChunks(connection, stream.id, requestId, stream.is_continuation === 1);
}
/** Latest stream row for a request with the given terminal status. */
_latestStreamForRequest(requestId, status) {
this.flushBuffer();
return this.sql`
select * from cf_ai_chat_stream_metadata
where request_id = ${requestId}
and status = ${status}
order by created_at desc
limit 1
`[0];
}
/**
* Send a finished stream's stored chunks to a connection as replay frames.
* Returns false if the connection closed mid-replay.
*/
_replayStoredChunks(connection, streamId, requestId, continuation = false) {
const chunks = this.sql`
select * from cf_ai_chat_stream_chunks
where stream_id = ${streamId}
order by chunk_index asc
`;
for (const chunk of chunks || []) for (const body of unpackSegmentBody(chunk.body)) if (!sendIfOpen(connection, JSON.stringify({
body,
done: false,
id: requestId,
type: CHAT_MESSAGE_TYPES.USE_CHAT_RESPONSE,
replay: true,
...continuation && { continuation: true }
}))) return false;
return true;
}
/**
* Restore active stream state if the agent was restarted during streaming.
* All streams are restored regardless of age — stale cleanup happens
* lazily in _maybeCleanupOldStreams after recovery has had its chance.
*/
restore() {
const activeStreams = this.sql`
select * from cf_ai_chat_stream_metadata
where status = 'streaming'
order by created_at desc
limit 1
`;
if (activeStreams && activeStreams.length > 0) {
const stream = activeStreams[0];
this._activeStreamId = stream.id;
this._activeRequestId = stream.request_id;
this._activeIsContinuation = stream.is_continuation === 1;
const lastChunk = this.sql`
select max(chunk_index) as max_index
from cf_ai_chat_stream_chunks
where stream_id = ${this._activeStreamId}
`;
this._segmentIndex = lastChunk && lastChunk[0]?.max_index != null ? lastChunk[0].max_index + 1 : 0;
}
}
/**
* Clear all stream data (called on chat history clear).
*/
clearAll() {
this._chunkBuffer = [];
this._chunkBufferBytes = 0;
this.sql`delete from cf_ai_chat_stream_chunks`;
this.sql`delete from cf_ai_chat_stream_metadata`;
this._activeStreamId = null;
this._activeRequestId = null;
this._segmentIndex = 0;
this._activeIsContinuation = false;
}
/**
* Drop all stream tables (called on destroy).
*/
destroy() {
this.flushBuffer();
this.sql`drop table if exists cf_ai_chat_stream_chunks`;
this.sql`drop table if exists cf_ai_chat_stream_metadata`;
this._activeStreamId = null;
this._activeRequestId = null;
this._activeIsContinuation = false;
}
/**
* Force a sweep of aged stream buffers now, bypassing the lazy interval
* gate used by {@link _maybeCleanupOldStreams}. Intended to be driven by an
* alarm so idle/hibernated chat DOs still reclaim buffers even when no
* further stream ever completes to trigger the lazy path.
*/
cleanup(now = Date.now()) {
this._lastCleanupTime = now;
this._sweepOldStreams(now);
}
/**
* True if any stream rows remain at all. Used by alarm-driven cleanup to
* decide whether to re-arm: once no rows remain there is nothing left to
* sweep, so the DO can stop waking itself.
*/
hasReclaimableStreams() {
return (this.sql`
select count(*) as n from cf_ai_chat_stream_metadata
`?.[0]?.n ?? 0) > 0;
}
_maybeCleanupOldStreams() {
const now = Date.now();
if (now - this._lastCleanupTime < CLEANUP_INTERVAL_MS) return;
this._lastCleanupTime = now;
this._sweepOldStreams(now);
}
/** Delete completed/errored buffers past the completion grace window, plus
* abandoned "streaming" rows past the stale-in-flight window. The two use
* different retentions: a completed buffer is redundant with the persisted
* message and needs only a brief replay grace, whereas an in-flight buffer
* must outlive resume/recovery before it is presumed dead. */
_sweepOldStreams(now) {
const completedCutoff = now - COMPLETED_RETENTION_MS;
this.sql`
delete from cf_ai_chat_stream_chunks
where stream_id in (
select id from cf_ai_chat_stream_metadata
where status in ('completed', 'error') and completed_at < ${completedCutoff}
)
`;
this.sql`
delete from cf_ai_chat_stream_metadata
where status in ('completed', 'error') and completed_at < ${completedCutoff}
`;
const abandonedCutoff = now - ABANDONED_STREAM_RETENTION_MS;
this.sql`
delete from cf_ai_chat_stream_chunks
where stream_id in (
select m.id from cf_ai_chat_stream_metadata m
where m.status = 'streaming'
and coalesce(
(select max(c.created_at) from cf_ai_chat_stream_chunks c
where c.stream_id = m.id),
m.created_at
) < ${abandonedCutoff}
)
`;
this.sql`
delete from cf_ai_chat_stream_metadata
where id in (
select m.id from cf_ai_chat_stream_metadata m
where m.status = 'streaming'
and coalesce(
(select max(c.created_at) from cf_ai_chat_stream_chunks c
where c.stream_id = m.id),
m.created_at
) < ${abandonedCutoff}
)
`;
}
/**
* Return the stored chunks for a stream as individual chunk bodies in order,
* unpacking packed segment rows. The returned `chunk_index` is a running
* per-chunk sequence (0, 1, 2, …) — stable across calls because rows are
* append-only — so callers can use it as a monotonic chunk sequence.
*/
getStreamChunks(streamId) {
const rows = this.sql`
select body from cf_ai_chat_stream_chunks
where stream_id = ${streamId}
order by chunk_index asc
` || [];
const out = [];
let index = 0;
for (const row of rows) for (const body of unpackSegmentBody(row.body)) {
out.push({
body,
chunk_index: index
});
index++;
}
return out;
}
/** @internal For testing only */
getStreamMetadata(streamId) {
const result = this.sql`
select status, request_id from cf_ai_chat_stream_metadata
where id = ${streamId}
`;
return result && result.length > 0 ? result[0] : null;
}
/** @internal For testing only */
getAllStreamMetadata() {
return this.sql`select id, status, request_id, created_at from cf_ai_chat_stream_metadata` || [];
}
/** @internal For testing only */
insertStaleStream(streamId, requestId, ageMs) {
const createdAt = Date.now() - ageMs;
this.sql`
insert into cf_ai_chat_stream_metadata (id, request_id, status, created_at)
values (${streamId}, ${requestId}, 'streaming', ${createdAt})
`;
}
/**
* Append a chunk to a stream dated `ageMs` in the past. Used to exercise the
* last-activity sweep threshold: a long-running streaming row with a *recent*
* chunk must survive even when its start time is older than the cutoff.
* @internal For testing only
*/
insertChunkAt(streamId, body, ageMs) {
const createdAt = Date.now() - ageMs;
this.sql`
insert into cf_ai_chat_stream_chunks (id, stream_id, body, chunk_index, created_at)
values (${nanoid()}, ${streamId}, ${body}, 0, ${createdAt})
`;
}
};
ResumableStream.CHUNK_MAX_BYTES = 18e5;
/**
* The buffer-cleanup alarm body: sweep aged stream buffers, then re-arm only
* while rows remain so a fully-swept DO stops waking itself. `rearm` schedules
* the next sweep — it MUST schedule a non-idempotent alarm, because this runs
* INSIDE the currently-executing one-shot schedule row, which `alarm()` deletes
* only after it returns; an idempotent reschedule would dedup onto that row and
* be deleted with it, so the re-arm would silently never fire and buffers that
* survived this sweep (e.g. a younger turn) would go uncollected. A fresh
* delayed row survives the deletion. Shared by `AIChatAgent` and `Think`.
*
* `@internal`
*/
async function cleanupStreamBuffers(stream, rearm) {
stream.cleanup();
if (stream.hasReclaimableStreams()) await rearm();
}
//#endregion
//#region src/chat/sql-batch.ts
/**
* Helpers for building batched SQLite statements that run through the Agent's
* `sql` tagged template (which interleaves a `?` placeholder between every
* string fragment). Used to collapse per-row INSERT/DELETE loops into a small
* number of multi-row statements.
*
* SQLite (Durable Object / D1) caps bound parameters at 100 per query, so
* callers must chunk their inputs to stay within {@link MAX_BOUND_PARAMS}.
* See https://developers.cloudflare.com/d1/platform/limits/
*/
/** Maximum bound parameters allowed in a single SQLite (DO / D1) query. */
const MAX_BOUND_PARAMS = 100;
/**
* Attach a self-referential `raw` property so a plain string[] satisfies the
* TemplateStringsArray shape. `sql` only reads indexed string fragments, so
* `raw` is never consumed — this just keeps the type system happy.
*/
function asTemplateStringsArray(parts) {
parts.raw = parts;
return parts;
}
/**
* Build a TemplateStringsArray for a single-column `IN (...)` clause. Produces
* fragments for:
* `${prefix}(?, ?, ...)`
*
* @throws if `count` is less than 1.
*/
function buildInClauseStrings(prefix, count) {
if (count < 1) throw new Error(`buildInClauseStrings requires count >= 1 (got ${count})`);
const parts = new Array(count + 1);
parts[0] = `${prefix}(`;
for (let i = 1; i < count; i++) parts[i] = ", ";
parts[count] = ")";
return asTemplateStringsArray(parts);
}
//#endregion
//#region src/chat/client-tools.ts
/**
* Converts client tool schemas to AI SDK tool format.
*
* By default these tools have no `execute` function — when the AI model calls
* them, the tool call is sent back to the client for execution.
*
* When `options.execute` is provided, each tool is built WITH an `execute` that
* delegates to it. This is used by the RPC path (e.g. a parent agent driving a
* Think sub-agent) so the model's client-tool call is resolved inline within
* the same turn.
*
* @param clientTools - Array of tool schemas from the client
* @param options - Optional `execute` delegate to run the tools inline
* @returns Record of AI SDK tools that can be spread into your tools object
*/
function createToolsFromClientSchemas(clientTools, options) {
if (!clientTools || clientTools.length === 0) return {};
const seenNames = /* @__PURE__ */ new Set();
for (const t of clientTools) {
if (seenNames.has(t.name)) console.warn(`[createToolsFromClientSchemas] Duplicate tool name "${t.name}" found. Later definitions will override earlier ones.`);
seenNames.add(t.name);
}
const execute = options?.execute;
const createTool = tool;
return Object.fromEntries(clientTools.map((t) => [t.name, createTool({
description: typeof t.description === "function" ? "" : t.description ?? "",
inputSchema: jsonSchema(t.parameters ?? { type: "object" }),
...execute ? { execute: (input, executeOptions) => execute({
toolName: t.name,
input,
toolCallId: executeOptions?.toolCallId ?? ""
}) } : {}
})]));
}
//#endregion
//#region src/chat/continuation-state.ts
/**
* ContinuationState — shared state container for auto-continuation lifecycle.
*
* Tracks pending, deferred, and active continuation state for the
* tool-result → auto-continue flow. Both AIChatAgent and Think use this
* to manage which connection/tools/body a continuation turn should use
* and to coordinate with clients requesting stream resume.
*
* The scheduling algorithm (prerequisite chaining, debounce, TurnQueue
* enrollment) stays in the host — this class only manages the data.
*/
const MSG_STREAM_RESUME_NONE$1 = CHAT_MESSAGE_TYPES.STREAM_RESUME_NONE;
var ContinuationState = class {
constructor() {
this.pending = null;
this.deferred = null;
this.activeRequestId = null;
this.activeConnectionId = null;
this.awaitingConnections = /* @__PURE__ */ new Map();
}
/** Clear pending state and awaiting connections (without sending RESUME_NONE). */
clearPending() {
this.pending = null;
this.awaitingConnections.clear();
}
clearDeferred() {
this.deferred = null;
}
clearAll() {
this.clearPending();
this.clearDeferred();
this.activeRequestId = null;
this.activeConnectionId = null;
}
/**
* Mark a connection as no longer available without canceling the
* continuation it initiated.
*/
releaseConnection(connectionId) {
this.awaitingConnections.delete(connectionId);
if (this.pending?.connectionId === connectionId) this.pending = {
...this.pending,
connectionId: null
};
if (this.deferred?.connectionId === connectionId) this.deferred = {
...this.deferred,
connectionId: null
};
if (this.activeConnectionId === connectionId) this.activeConnectionId = null;
}
/**
* Send STREAM_RESUME_NONE to all connections waiting for a
* continuation stream to start, then clear the map.
*/
sendResumeNone() {
const msg = JSON.stringify({ type: MSG_STREAM_RESUME_NONE$1 });
for (const connection of this.awaitingConnections.values()) sendIfOpen(connection, msg);
this.awaitingConnections.clear();
}
/**
* Flush awaiting connections by notifying each one via the provided
* callback (typically sends STREAM_RESUMING), then clear.
*/
flushAwaitingConnections(notify) {
for (const connection of this.awaitingConnections.values()) notify(connection);
this.awaitingConnections.clear();
}
/**
* Transition pending → active. Called when the continuation stream
* actually starts. Moves request/connection IDs to active slots,
* clears pending fields.
*/
activatePending() {
if (!this.pending) return;
this.activeRequestId = this.pending.requestId;
this.activeConnectionId = this.pending.connectionId;
this.pending = null;
}
/**
* Transition deferred → pending. Called when a continuation turn
* completes and there's a deferred follow-up waiting.
*
* Returns the new pending state (so the host can enqueue the turn),
* or null if there was nothing deferred.
*/
activateDeferred(generateRequestId) {
if (this.pending || !this.deferred) return null;
const d = this.deferred;
this.deferred = null;
this.activeRequestId = null;
this.activeConnectionId = null;
this.pending = {
connection: d.connection,
connectionId: d.connectionId,
requestId: generateRequestId(),
clientTools: d.clientTools,
body: d.body,
errorPrefix: d.errorPrefix,
prerequisite: d.prerequisite,
pastCoalesce: false
};
if (d.connectionId !== null) this.awaitingConnections.set(d.connectionId, d.connection);
return this.pending;
}
};
//#endregion
//#region src/chat/pre-stream-turns.ts
/**
* PreStreamTurns — tracks accepted chat turns that have not yet started a
* resumable stream, and the connections parked waiting for one.
*
* The resume handshake can resume an ACTIVE stream (chunks buffering) and can
* replay a TERMINAL outcome, but a normal turn spends a window between "request
* accepted" and "first chunk produced" in neither state: it is queued, waiting
* on `waitForMcpConnections`, debouncing, or simply running async setup inside
* `onChatMessage` before a stream object exists. A client that reconnects or
* re-mounts in that window used to get `cf_agent_stream_resume_none` and give
* up, so the turn the server went on to complete normally never drove the
* client's AI-SDK `status` (issue #1784).
*
* This container lets a host represent that window as resumable: the handshake
* parks the reconnecting connection here (and tells it to keep waiting), and the
* host flushes the parked connections into the normal `STREAM_RESUMING` path the
* moment a stream actually starts — or releases them with `resume_none` if the
* turn settles without ever streaming.
*
* Concurrency-safe under queued turns via an accepted-request set: parked
* connections are only released with `resume_none` once EVERY accepted turn has
* settled with no active stream, so a client parked during the gap between one
* turn finishing and the next starting still resumes onto the next stream.
*
* Pure data + send-through-callback, mirroring {@link ContinuationState}: the
* host owns the actual frame sends and the stream-start / turn-settle wiring.
*
* @internal Sibling-package support for `@cloudflare/ai-chat` and
* `@cloudflare/think`, not a public API.
*/
const MSG_STREAM_PENDING = CHAT_MESSAGE_TYPES.STREAM_PENDING;
const MSG_STREAM_RESUME_NONE = CHAT_MESSAGE_TYPES.STREAM_RESUME_NONE;
var PreStreamTurns = class {
constructor() {
this._accepted = /* @__PURE__ */ new Set();
this.awaitingConnections = /* @__PURE__ */ new Map();
this._latestRequestId = null;
}
/** Mark a freshly-accepted turn as in flight (pre-stream). */
begin(requestId) {
this._accepted.add(requestId);
this._latestRequestId = requestId;
}
/**
* Mark an accepted turn as settled. Returns `true` when no accepted turn
* remains in flight (the caller should release parked connections if no
* stream is active).
*/
settle(requestId) {
this._accepted.delete(requestId);
if (this._accepted.size === 0) {
this._latestRequestId = null;
return true;
}
return false;
}
/** Whether any accepted turn is still pre-stream. */
hasInFlight() {
return this._accepted.size > 0;
}
/** The request id to advertise in the keep-waiting frame, if known. */
get latestRequestId() {
return this._latestRequestId;
}
/**
* Park a reconnecting connection and tell it to keep waiting (so its
* transport does not resolve `reconnectToStream` early). No-op when nothing
* is in flight. Parked connections are deliberately NOT added to the host's
* `pendingResumeConnections` — they must keep receiving any live broadcast —
* until the host flushes them through `notifyStreamResuming` on stream start.
*/
park(connection, probeId) {
if (!this.hasInFlight()) return false;
this.awaitingConnections.set(connection.id, connection);
sendIfOpen(connection, JSON.stringify({
type: MSG_STREAM_PENDING,
...this._latestRequestId ? { id: this._latestRequestId } : {},
...probeId ? { probeId } : {}
}));
return true;
}
/** Drop a single connection (e.g. on socket close) without releasing others. */
release(connectionId) {
this.awaitingConnections.delete(connectionId);
}
/**
* A stream has started: hand every parked connection to `notify` (the host's
* `notifyStreamResuming`, which sends `STREAM_RESUMING` and excludes the
* connection from live broadcast until it ACKs), then clear the awaiting map.
* The accepted set is untouched — the turn is still running.
*/
flushOnStreamStart(notify) {
for (const connection of this.awaitingConnections.values()) notify(connection);
this.awaitingConnections.clear();
}
/**
* Release every parked connection with `STREAM_RESUME_NONE` (the turn settled
* without ever starting a stream) and clear the awaiting map. Safe to call
* when the map is empty (no-op), so the host can call it liberally from a
* turn-settle path.
*/
releaseAwaiting() {
const msg = JSON.stringify({ type: MSG_STREAM_RESUME_NONE });
for (const connection of this.awaitingConnections.values()) sendIfOpen(connection, msg);
this.awaitingConnections.clear();
}
/** Drop all state (chat clear / destroy). Does not send any frames. */
reset() {
this._accepted.clear();
this.awaitingConnections.clear();
this._latestRequestId = null;
}
};
//#endregion
//#region src/chat/auto-continuation-controller.ts
var AutoContinuationController = class AutoContinuationController {
constructor(host) {
this.host = host;
this._timer = null;
this._barrierActive = false;
}
/**
* Schedule an auto-continuation for a tool result/approval that opted in with
* `autoContinue` (#1650). Coalesces rapid sibling results into a single
* continuation via the debounce timer; the actual fire is gated by
* {@link fireWhenStable}. If a continuation is already running
* (`pastCoalesce`), the new result is stored as the deferred follow-up
* instead of re-arming.
*/
schedule(spec) {
const c = this.host.continuation;
if (c.pending?.pastCoalesce) {
c.deferred = {
connection: spec.connection,
connectionId: spec.connection.id,
clientTools: spec.clientTools,
body: spec.body,
errorPrefix: spec.errorPrefix,
prerequisite: null
};
return;
}
if (c.pending) {
c.pending.connection = spec.connection;
c.pending.connectionId = spec.connection.id;
c.pending.clientTools = spec.clientTools;
c.pending.body = spec.body;
c.pending.errorPrefix = spec.errorPrefix;
c.awaitingConnections.set(spec.connection.id, spec.connection);
this.armTimer();
return;
}
c.pending = {
connection: spec.connection,
connectionId: spec.connection.id,
requestId: this.host.generateRequestId(),
clientTools: spec.clientTools,
body: spec.body,
errorPrefix: spec.errorPrefix,
prerequisite: null,
pastCoalesce: false
};
c.awaitingConnections.set(spec.connection.id, spec.connection);
this.armTimer();
}
/**
* Re-arm the barrier for a result/approval that arrived WITHOUT `autoContinue`
* (#1650). A standalone errored result declines to continue on its own, but in
* a parallel batch a SIBLING may already have opted in — and this result can
* be the one that completes the batch, so we must re-run the barrier check.
* Unlike {@link schedule} this NEVER creates a pending continuation, and
* no-ops once the continuation is running (`pastCoalesce`).
*/
rearmForBatch() {
const pending = this.host.continuation.pending;
if (!pending || pending.pastCoalesce) return;
this.armTimer();
}
/** (Re)arm the coalesce timer; on fire, run {@link fireWhenStable}. */
armTimer() {
if (this._timer) clearTimeout(this._timer);
this._timer = setTimeout(() => {
this._timer = null;
if (!this.host.continuation.pending) return;
this.fireWhenStable();
}, AutoContinuationController.COALESCE_MS);
}
/**
* Fire an auto-continuation, but only once the model's parallel tool-call
* batch is fully answered (#1649) and no assistant turn is mid-stream (#1650).
* The barrier is event-driven with NO orphan timeout: when the batch is still
* incomplete we drain the in-flight applies, re-check, and — if still
* incomplete — return WITHOUT firing and WITHOUT holding the isolate, leaving
* `continuation.pending` in place. The next sibling's result re-arms the
* coalesce timer and re-runs this check; the continuation fires once the final
* sibling lands. A true orphan (a sibling that never arrives) simply never
* auto-continues — a later user turn / chat recovery repairs the transcript.
*/
fireWhenStable() {
const c = this.host.continuation;
if (!c.pending) return;
if (c.pending.pastCoalesce) return;
if (this._barrierActive) return;
if (this.host.isStreamActive()) return;
if (!this.host.hasPendingInteraction() && !this.host.hasIncompleteToolBatch()) {
this.cancelTimer();
this.host.fire();
return;
}
this._barrierActive = true;
this.host.keepAliveWhile(() => this.host.drainInteractionApplies()).catch(() => {}).finally(() => {
this._barrierActive = false;
const pending = c.pending;
if (!pending || pending.pastCoalesce) return;
if (this.host.isStreamActive()) return;
if (this.host.hasIncompleteToolBatch()) return;
this.cancelTimer();
this.host.fire();
});
}
/**
* Transition the deferred follow-up (stored while a continuation was running)
* to pending and re-run the barrier — its batch may still be incomplete (or a
* stream active), in which case it parks and re-arms instead of firing blind.
*/
activateDeferredAndReschedule() {
if (!this.host.continuation.activateDeferred(() => this.host.generateRequestId())) return;
this.fireWhenStable();
}
/**
* Cancel any still-armed coalesce timer. Called on the fire path so a sibling
* result that re-armed it during a barrier wait can't fire a duplicate
* continuation after this one starts (#1649 / #1650).
*/
cancelTimer() {
if (this._timer) {
clearTimeout(this._timer);
this._timer = null;
}
}
/**
* `true` when the barrier is going to fire on its own — its coalesce timer is
* still pending or its completeness drain is in progress. The host combines
* this with its own pending/`pastCoalesce` checks to decide idle/stable.
*/
isArmed() {
return this._timer !== null || this._barrierActive;
}
/**
* Tear down the controller-owned barrier state (timer + double-fire guard).
* Scoped to ONLY this controller's fields — the host clears the rest of its
* turn state (stream gate, interaction tail, continuation data) separately.
*/
reset() {
this.cancelTimer();
this._barrierActive = false;
}
};
AutoContinuationController.COALESCE_MS = 50;
//#endregion
//#region src/chat/abort-registry.ts
/**
* AbortRegistry — manages per-request AbortControllers.
*
* Shared between AIChatAgent and Think for chat turn cancellation.
* Each request gets its own AbortController keyed by request ID.
* Controllers are created lazily on first signal access.
*/
const NOOP = () => {};
var AbortRegistry = class {
constructor() {
this.controllers = /* @__PURE__ */ new Map();
}
/**
* Get or create an AbortController for the given ID and return its signal.
* Creates the controller lazily on first access.
*/
getSignal(id) {
if (typeof id !== "string") return;
if (!this.controllers.has(id)) this.controllers.set(id, new AbortController());
return this.controllers.get(id).signal;
}
/**
* Get the signal for an existing controller without creating one.
* Returns undefined if no controller exists for this ID.
*/
getExistingSignal(id) {
return this.controllers.get(id)?.signal;
}
/**
* Cancel a specific request by aborting its controller. Optionally
* propagate a reason — surfaces as `signal.reason` on the registry's
* controller and through any `AbortError` it produces downstream.
*/
cancel(id, reason) {
this.controllers.get(id)?.abort(reason);
}
/** Remove a controller after the request completes. */
remove(id) {
this.controllers.delete(id);
}
/**
* Abort all pending requests and clear the registry. Optionally propagate a
* reason — surfaces as `signal.reason` on each controller and through any
* `AbortError` it produces downstream, exactly like {@link cancel}.
*/
destroyAll(reason) {
for (const controller of this.controllers.values()) controller.abort(reason);
this.controllers.clear();
}
/** Check if a controller exists for the given ID. */
has(id) {
return this.controllers.has(id);
}
/** Number of tracked controllers. */
get size() {
return this.controllers.size;
}
/**
* Link an external `AbortSignal` to the controller for `id`. When the
* external signal aborts, the registry's controller is cancelled —
* propagating the abort reason — exactly the same way an internal
* cancel would (e.g. via a `chat-request-cancel` WebSocket message).
*
* This is the integration point for callers that drive a chat turn
* programmatically and want to cancel it from outside without knowing
* the internally-generated request id (e.g. the helper-as-sub-agent
* pattern, where a parent's `AbortSignal` from the AI SDK tool
* `execute` needs to land inside a `Think.saveMessages` call running
* on a child DO).
*
* Behavior:
*
* - Passing `undefined` is a no-op and returns a no-op detacher, so
* callers can unconditionally call this with `options?.signal`.
* - If the external signal is already aborted, the registry's
* controller is created (if needed) and cancelled synchronously.
* - Otherwise a one-shot `abort` listener is attached. The returned
* function detaches it.
*
* **Always call the returned detacher in a `finally` block** — the
* external signal may outlive the request (a parent chat turn that
* drives many helper turns reuses one signal across all of them) and
* leaving listeners attached pins closures and grows the listener
* list on each turn.
*
* @returns A detacher function. Call it after the request finishes
* (success or failure) to remove the abort listener from `signal`.
*/
linkExternal(id, signal) {
if (!signal) return NOOP;
if (signal.aborted) {
this.getSignal(id);
this.cancel(id, signal.reason);
return NOOP;
}
const listener = () => this.cancel(id, signal.reason);
signal.addEventListener("abort", listener, { once: true });
return () => signal.removeEventListener("abort", listener);
}
};
//#endregion
//#region src/chat/async-helpers.ts
/**
* @internal Small async control-flow helpers shared by the chat hosts
* (`@cloudflare/ai-chat` and `@cloudflare/think`) — not a public API. Extracted
* so the host idle/stable waits and the interaction-apply completeness drain
* stay byte-identical across both. See `design/chat-shared-layer.md`.
*/
/**
* Sentinel returned by {@link awaitWithDeadline} when the deadline elapses
* before the awaited promise settles. A single shared symbol so both hosts
* compare against the same identity.
*/
const TIMED_OUT = Symbol("timed-out");
/**
* Await `promise`, but give up and resolve to {@link TIMED_OUT} once `deadline`
* (an absolute `Date.now()` ms timestamp) passes. A `null` deadline waits
* indefinitely (the promise is returned unchanged). The timeout timer is always
* cleared so it can't pin the isolate awake past resolution.
*/
async function awaitWithDeadline(promise, deadline) {
if (deadline == null) return promise;
const remainingMs = Math.max(0, deadline - Date.now());
let timer;
const result = await Promise.race([promise, new Promise((resolve) => {
timer = setTimeout(() => resolve(TIMED_OUT), remainingMs);
})]);
clearTimeout(timer);
return result;
}
/**
* Drain the host's interaction-apply chain so a subsequent completeness check
* (e.g. `hasIncompleteToolBatch`) sees every tool result that has ALREADY
* arrived.
*
* Bounded by real apply activity (a storage write each), never a fixed timer:
* `getTail` is re-read after every await because a sibling can extend the tail
* mid-drain, and the loop stops once the tail stops advancing. Bails early when
* `hasPending()` goes false (the pending continuation was cleared by a chat
* clear / turn reset) so a stale drain can't hold the isolate awake.
*/
async function drainInteractionApplies(hasPending, getTail) {
let tail = getTail();
for (;;) {
if (!hasPending()) return;
try {
await tail;
} catch {}
if (getTail() === tail) return;
tail = getTail();
}
}
//#endregion
//#region src/chat/tool-state.ts
/**
* Apply a tool part update to a parts array.
* Finds the first part matching `update.toolCallId` in one of `update.matchStates`,
* applies the update immutably, and returns the new parts array with the index.
*
* Returns `null` if no matching part was found.
*/
function applyToolUpdate(parts, update) {
for (let i = 0; i < parts.length; i++) {
const part = parts[i];
if ("toolCallId" in part && part.toolCallId === update.toolCallId && "state" in part && update.matchStates.includes(part.state)) {
const updatedParts = [...parts];
updatedParts[i] = update.apply(part);
return {
parts: updatedParts,
index: i
};
}
}
return null;
}
/**
* Build an update descriptor for applying a tool result.
*
* Matches parts in `input-available`, `approval-requested`, or `approval-responded` state.
* Sets state to `output-available` (with output) or `output-error` (with errorText).
*/
function toolResultUpdate(toolCallId, output, overrideState, errorText) {
return {
toolCallId,
matchStates: [
"input-available",
"approval-requested",
"approval-responded"
],
apply: (part) => ({
...part,
...overrideState === "output-error" ? {
state: "output-error",
errorText: errorText ?? "Tool execution denied by user"
} : {
state: "output-available",
output,
preliminary: false
}
})
};
}
/**
* Build an update descriptor for a terminal tool result that belongs to a
* tool part in a *different* (earlier) assistant message than the one
* currently being streamed.
*
* This is the "cross-message" case: an approved server tool executes during a
* continuation stream, but its tool part lives in the assistant message that
* originally requested it. `StreamAccumulator` surfaces this as a
* `cross-message-tool-update` action because the accumulator only owns the
* current turn's new content and cannot mutate a part from a prior message.
*
* Compared to {@link toolResultUpdate} this builder is deliberately more
* defensive, mirroring the equivalent fallback in `@cloudflare/ai-chat`:
*
* - It matches the broad set of pre-terminal **and** terminal states, so a
* provider that replays the entire prior tool round-trip during a
* continuation (notably the OpenAI Responses API — issue #1404) still
* resolves to the same part instead of silently missing it.
* - It is **first-write-wins**: a chunk arriving for a tool that already holds
* a terminal result is treated as a replay and the existing output is never
* overwritten. In that case `apply` returns the *same part reference*, which
* callers use as an idempotent-no-op signal to skip the durable write and a
* redundant `MESSAGE_UPDATED` broadcast.
* - It preserves a streamed `preliminary` flag when one is present, otherwise
* marks the result final (`preliminary: false`).
*/
function crossMessageToolResultUpdate(toolCallId, updateType, output, errorText, preliminary) {
return {
toolCallId,
matchStates: [
"input-streaming",
"input-available",
"approval-requested",
"approval-responded",
"output-available",
"output-error",
"output-denied"
],
apply: (part) => {
if (part.state === "output-available" || part.state === "output-error" || part.state === "output-denied") return part;
if (updateType === "output-error") return {
...part,
state: "output-error",
errorText: errorText ?? "Tool execution failed"
};
return {
...part,
state: "output-available",
output,
preliminary: preliminary ?? false
};
}
};
}
/**
* Build an update descriptor that replaces the output of a *paused durable
* execution* tool part (e.g. a codemode runtime tool that paused for
* approval).
*
* A paused execution completes its tool call normally — the part is already
* `output-available` with an output of `{ status: "paused", executionId }`.
* When the host later approves/rejects the execution, the new outcome
* (completed / rejected / paused-again) must replace that output in place.
*
* Matching is deliberately narrow and idempotent:
*
* - only `output-available` parts are considered;
* - the existing output must be a paused-execution object carrying the same
* `executionId` — anything else (already replaced, different execution)
* returns the *same part reference*, which callers treat as a no-op signal
* (skip persist + broadcast), mirroring {@link crossMessageToolResultUpdate}.
*/
function pausedExecutionUpdate(toolCallId, executionId, output) {
return {
toolCallId,
matchStates: ["output-available"],
apply: (part) => {
const current = part.output;
if (current == null || typeof current !== "object" || current.status !== "paused" || current.executionId !== executionId) return part;
return {
...part,
output,
preliminary: false
};
}
};
}
/**
* Build an update descriptor for applying a tool approval.
*
* Matches parts in `input-available` or `approval-requested` state.
* Sets state to `approval-responded` (if approved) or `output-denied` (if denied).
*/
function toolApprovalUpdate(toolCallId, approved) {
return {
toolCallId,
matchStates: ["input-available", "approval-requested"],
apply: (part) => {
const approval = typeof part.approval === "object" && part.approval !== null && !Array.isArray(part.approval) ? part.approval : void 0;
const approvalId = typeof approval?.id === "string" ? approval.id : toolCallId;
return {
...part,
state: approved ? "approval-responded" : "output-denied",
approval: {
...approval,
id: approvalId,
approved
}
};
}
};
}
/** Extract a tool part's name from its `tool-<name>` / `dynamic-tool` shape. */
function toolPartName(record) {
const type = typeof record.type === "string" ? record.type : "";
if (type === "dynamic-tool") return typeof record.toolName === "string" ? record.toolName : void 0;
if (type.startsWith("tool-")) return type.slice(5);
}
/**
* Whether a part is still awaiting a CLIENT interaction that can genuinely
* arrive after a restart: an `approval-requested` part (a reconnecting client
* replays the approval) or an `input-available` part for a CLIENT tool (the SPA
* replays the `tool-result`). A SERVER tool's `input-available` is NOT pending —
* its `execute()` died with the isolate.
*/
function partAwaitsClientInteraction(part, clientResolvable) {
if (typeof part !== "object" || part === null || !("state" in part)) return false;
const record = part;
const state = record.state;
if (state === "approval-requested") return true;
if (state !== "input-available") return false;
const toolName = toolPartName(record);
return toolName != null && clientResolvable.has(toolName);
}
/**
* Names of the CLIENT-resolvable tools — the client-provided schemas from the
* last request, which have no server `execute`. An interrupted `input-available`
* part for one of these can still be resolved by the client replaying a
* `tool-result`; a server tool's cannot.
*/
function clientResolvableToolNames(tools) {
const names = /* @__PURE__ */ new Set();
for (const tool of tools ?? []) if (tool?.name) names.add(tool.name);
return names;
}
/**
* `true` when the latest assistant message is mid-batch: it carries at least
* one settled tool result AND at least one tool call/approval still awaiting a
* client result. That is the #1649 signature — the model fanned out parallel
* tool calls and only some have been answered. Scoped to the leaf (the step the
* continuation answers) so an unrelated dangling tool in an earlier message
* doesn't block a legitimate follow-up continuation.
*/
function hasIncompleteToolBatch(messages) {
let leaf;
for (let i = messages.length - 1; i >= 0; i--) if (messages[i].role === "assistant") {
leaf = messages[i];
break;
}
if (!leaf) return false;
let hasPending = false;
let hasSettled = false;
for (const part of leaf.parts) {
const record = part;
const state = record.state;
if (state === "input-available" || state === "approval-requested") hasPending = true;
else if (typeof record.type === "string" && (record.type.startsWith("tool-") || record.type === "dynamic-tool") && (state === "output-available" || state === "output-error" || state === "output-denied" || state === "approval-responded")) hasSettled = true;
if (hasPending && hasSettled) return true;
}
return false;
}
//#endregion
//#region src/chat/parse-protocol.ts
/**
* Protocol Message Parser — typed parsing of cf_agent_chat_* WebSocket messages.
*
* Parses raw WebSocket messages into a discriminated union of protocol events.
* Both AIChatAgent and Think can use this instead of manual JSON.parse + type checking.
*/
/**
* Parse a raw WebSocket message string into a typed protocol event.
*
* Returns `null` if the message is not valid JSON or not a recognized
* protocol message type. Callers should fall through to the user's
* `onMessage` handler when `null` is returned.
*
* @example
* ```typescript
* const event = parseProtocolMessage(rawMessage);
* if (!event) return userOnMessage(connection, rawMessage);
*
* switch (event.type) {
* case "chat-request": { ... }
* case "clear": { ... }
* case "tool-result": { ... }
* }
* ```
*/
function parseProtocolMessage(raw) {
let data;
try {
data = JSON.parse(raw);
} catch {
return null;
}
const wireType = data.type;
if (!wireType) return null;
switch (wireType) {
case CHAT_MESSAGE_TYPES.USE_CHAT_REQUEST: return {
type: "chat-request",
id: data.id,
init: data.init ?? {}
};
case CHAT_MESSAGE_TYPES.CHAT_CLEAR: return { type: "clear" };
case CHAT_MESSAGE_TYPES.CHAT_REQUEST_CANCEL: return {
type: "cancel",
id: data.id
};
case CHAT_MESSAGE_TYPES.TOOL_RESULT: return {
type: "tool-result",
toolCallId: data.toolCallId,
toolName: data.toolName ?? "",
output: data.output,
state: data.state,
errorText: data.errorText,
autoContinue: data.autoContinue,
clientTools: data.clientTools
};
case CHAT_MESSAGE_TYPES.TOOL_APPROVAL: return {
type: "tool-approval",
toolCallId: data.toolCallId,
approved: data.approved,
autoContinue: data.autoContinue
};
case CHAT_MESSAGE_TYPES.STREAM_RESUME_REQUEST: return {
type: "stream-resume-request",
...typeof data.probeId === "string" ? { probeId: data.probeId } : {}
};
case CHAT_MESSAGE_TYPES.STREAM_RESUME_ACK: return {
type: "stream-resume-ack",
id: data.id
};
case CHAT_MESSAGE_TYPES.CHAT_MESSAGES: return {
type: "messages",
messages: data.messages ?? []
};
default: return null;
}
}
//#endregion
//#region src/chat/message-reconciler.ts
/**
* Reconcile incoming client messages against server state.
*
* 1. Merges server-known tool outputs into incoming messages that still
* show stale states (input-available, approval-requested, approval-responded)
* 2. Reconciles assistant IDs: exact match → content-key match → toolCallId match
*
* @param incoming - Messages from the client
* @param serverMessages - Current server-side messages (source of truth)
* @param sanitizeForContentKey - Function to sanitize a message before computing
* its content key (typically strips ephemeral provider metadata)
* @returns Reconciled messages ready for persistence
*/
function reconcileMessages(incoming, serverMessages, sanitizeForContentKey) {
return reconcileAssistantIds(mergeServerToolOutputs(incoming, serverMessages), serverMessages, sanitizeForContentKey);
}
/**
* For a single message, resolve its ID by matching toolCallId against server state.
* Prevents duplicate DB rows when client IDs differ from server IDs.
* Tool call IDs are unique per conversation, so matching is safe regardless of state.
*/
function resolveToolMergeId(message, serverMessages) {
if (message.role !== "assistant") return message;
for (const part of message.parts) if ("toolCallId" in part && part.toolCallId) {
const toolCallId = part.toolCallId;
const existing = findMessageByToolCallId(serverMessages, toolCallId);
if (existing && existing.id !== message.id) return {
...message,
id: existing.id
};
}
return message;
}
/**
* Merge a freshly-reconstructed orphaned partial onto the assistant message
* that already owns its target id (the orphan-persist **(c)** step).
*
* Used by hosts whose store can hold an assistant row for the SAME id BEFORE
* the stream finalizes — e.g. an early persist at tool-approval time, or a
* continuation resuming the prior assistant message. On recovery the engine
* replays the same chunks, so a naive append would leave two parts per tool
* call. The merge therefore:
*
* - keeps ALL existing parts (the persisted row is authoritative for tool
* parts that had a client result applied IN PLACE — that result lives only
* in storage, never in the chunk stream, so a whole-message replace would
* clobber it);
* - appends only the reconstructed parts whose `toolCallId` is NOT already
* present (dedup by tool-call identity);
* - overlays the incoming metadata onto the existing metadata (incoming wins
* on conflicts), falling back to whichever side is present.
*
* The result carries the INCOMING message's id/role (the caller has already
* resolved the incoming id to the existing row's id via the (b) target-id
* step), so it is safe to write straight back through `updateMessage`.
*
* Hosts whose orphan persist only ever runs at stream finalize (no early/
* mid-stream row for the same id) never hit the merge branch and don't need
* this — a plain append/replace is already dedup-safe because the shared
* reconstruction (`StreamAccumulator` / `applyChunkToParts`) is idempotent by
* `toolCallId`.
*/
function reconcileOrphanPartial(existing, incoming) {
const existingToolCallIds = new Set(existing.parts.filter((p) => "toolCallId" in p).map((p) => p.toolCallId));
const newParts = incoming.parts.filter((p) => !("toolCallId" in p && existingToolCallIds.has(p.toolCallId)));
const merged = {
...incoming,
parts: [...existing.parts, ...newParts]
};
if (existing.metadata) merged.metadata = incoming.metadata ? {
...existing.metadata,
...incoming.metadata
} : existing.metadata;
return merged;
}
/**
* Content key for assistant messages used for dedup of identical short replies.
* Returns JSON of sanitized parts, or undefined for non-assistant messages.
*/
function assistantContentKey(message, sanitize) {
if (message.role !== "assistant") return;
const sanitized = sanitize ? sanitize(message) : message;
return JSON.stringify(sanitized.parts);
}
function mergeServerToolOutputs(incoming, serverMessages) {
const serverResolvedParts = /* @__PURE__ */ new Map();
for (const msg of serverMessages) {
if (msg.role !== "assistant") continue;
for (const part of msg.parts) {
const record = part;
if ("toolCallId" in record && "state" in record && (record.state === "output-available" || record.state === "output-error" || record.state === "output-denied")) serverResolvedParts.set(record.toolCallId, record);
}
}
if (serverResolvedParts.size === 0) return incoming;
return incoming.map((msg) => {
if (msg.role !== "assistant") return msg;
let hasChanges = false;
const updatedParts = msg.parts.map((part) => {
const record = part;
if ("toolCallId" in record && "state" in record && (record.state === "input-available" || record.state === "approval-requested" || record.state === "approval-responded") && serverResolvedParts.has(record.toolCallId)) {
hasChanges = true;
const server = serverResolvedParts.get(record.toolCallId);
const merged = {
...part,
state: server.state
};
if (server.state === "output-available") {
if ("output" in server) merged.output = server.output;
} else if (server.state === "output-error") {
if ("errorText" in server) merged.errorText = server.errorText;
} else if (server.state === "output-denied") {
if ("approval" in server) merged.approval = server.approval;
}
return merged;
}
return part;
});
return hasChanges ? {
...msg,
parts: updatedParts
} : msg;
});
}
function reconcileAssistantIds(incoming, serverMessages, sanitize) {
if (serverMessages.length === 0) return incoming;
const claimedServerIndices = /* @__PURE__ */ new Set();
const exactMatchMap = /* @__PURE__ */ new Map();
for (let i = 0; i < incoming.length; i++) {
const serverIdx = serverMessages.findIndex((sm, si) => !claimedServerIndices.has(si) && sm.id === incoming[i].id);
if (serverIdx !== -1) {
claimedServerIndices.add(serverIdx);
exactMatchMap.set(i, serverIdx);
}
}
return incoming.map((incomingMessage, incomingIdx) => {
if (exactMatchMap.has(incomingIdx)) return incomingMessage;
if (incomingMessage.role !== "assistant" || hasToolCallPart(incomingMessage)) return incomingMessage;
const incomingKey = assistantContentKey(incomingMessage, sanitize);
if (!incomingKey) return incomingMessage;
for (let i = 0; i < serverMessages.length; i++) {
if (claimedServerIndices.has(i)) continue;
const serverMessage = serverMessages[i];
if (serverMessage.role !== "assistant" || hasToolCallPart(serverMessage)) continue;
if (assistantContentKey(serverMessage, sanitize) === incomingKey) {
claimedServerIndices.add(i);
return {
...incomingMessage,
id: serverMessage.id
};
}
}
return incomingMessage;
});
}
function hasToolCallPart(message) {
return message.parts.some((part) => "toolCallId" in part);
}
function findMessageByToolCallId(messages, toolCallId) {
for (const msg of messages) {
if (msg.role !== "assistant") continue;
for (const part of msg.parts) if ("toolCallId" in part && part.toolCallId === toolCallId) return msg;
}
}
//#endregion
//#region src/chat/repair-transcript.ts
/**
* Whether a tool part already has a settled result the provider accepts, so it
* must NOT be re-repaired into an errored result.
*
* Single source of truth for the terminal tool states. Mirrors the AI SDK's
* terminal states: `convertToModelMessages` emits a `tool-result` for
* `output-available`, `output-error`, AND `output-denied` (a user-denied
* approval — its denial reason becomes the tool-result). Omitting any of these
* makes repair re-flip the part every turn — clobbering a real `errorText` /
* denial with the generic "interrupted" message.
*/
function toolPartHasSettledResult(record) {
if ("output" in record || "result" in record) return true;
const state = typeof record.state === "string" ? record.state : "";
return state === "output-available" || state === "output-error" || state === "output-denied";
}
/**
* Repair interrupted tool calls and normalize malformed tool inputs across a
* transcript. Behavior mirrors `@cloudflare/think`'s original
* `_repairToolTranscriptParts`:
*
* - a tool part with NO settled result and state `approval-responded` is kept
* verbatim (an approved server tool waiting for its continuation to run
* `execute()` — not abandoned);
* - a tool part with NO settled result for which `shouldRepair` returns false
* is kept verbatim (a part still awaiting a CLIENT interaction; see option);
* - any other tool part with no settled result is normalized then handed to
* `repairPart` (default: flipped to an errored result);
* - a tool part WITH a settled result only has its `input` normalized.
*
* Messages with no changed part keep their original object reference so callers
* can cheaply detect what to persist.
*/
function repairInterruptedToolParts(messages, options) {
const isSettled = options.isSettled ?? toolPartHasSettledResult;
const normalizeInput = options.normalizeInput ?? normalizeToolInput;
const { repairPart } = options;
const shouldRepair = options.shouldRepair ?? (() => true);
let removedToolCalls = 0;
let normalizedInputs = 0;
const toolCallIds = [];
const repaired = [];
for (const message of messages) {
const parts = [];
let messageChanged = false;
for (const part of message.parts) {
const record = part;
const toolCallId = typeof record.toolCallId === "string" ? record.toolCallId : void 0;
if (!(typeof record.type === "string" && (record.type.startsWith("tool-") || record.type === "dynamic-tool") && toolCallId)) {
parts.push(part);
continue;
}
if (!isSettled(record)) {
if ((typeof record.state === "string" ? record.state : "") === "approval-responded") {
parts.push(part);
continue;
}
if (!shouldRepair(part)) {
parts.push(part);
continue;
}
const normalized = normalizeInput("input" in record ? record.input : void 0);
parts.push(repairPart({
...part,
input: normalized.input
}));
if (normalized.changed) normalizedInputs++;
removedToolCalls++;
messageChanged = true;
toolCallIds.push(toolCallId);
continue;
}
const normalized = normalizeInput("input" in record ? record.input : void 0);
if (normalized.changed) {
parts.push({
...part,
input: normalized.input
});
normalizedInputs++;
messageChanged = true;
continue;
}
parts.push(part);
}
repaired.push(messageChanged ? {
...message,
parts
} : message);
}
return {
messages: repaired,
removedToolCalls,
normalizedInputs,
toolCallIds
};
}
//#endregion
//#region src/chat/orphan-persist.ts
/**
* Reconstruct a message from `chunks` and upsert it via the store. Returns
* `true` when a write happened (so a caller that broadcasts after — Think — can
* gate its broadcast on it), `false` when there was nothing to persist (no
* parts, or `prepare` returned `null`).
*/
async function persistReconstructedOrphan(chunks, options) {
if (chunks.length === 0) return false;
const accumulator = new StreamAccumulator({ messageId: options.fallbackId });
for (const chunk of chunks) try {
accumulator.applyChunk(JSON.parse(chunk.body));
} catch {}
if (accumulator.parts.length === 0) return false;
const prepared = options.prepare(accumulator.toMessage());
if (prepared === null) return false;
const existing = await options.store.getMessage(prepared.id);
if (existing) await options.store.updateMessage(options.merge(existing, prepared));
else await options.store.appendMessage(prepared);
return true;
}
//#endregion
//#region src/chat/recovery.ts
function createChatFiberSnapshot({ kind, requestId, recoveryRootRequestId, continuation, messages, lastBody, lastClientTools }) {
const latestMessage = messages.length > 0 ? messages[messages.length - 1] : void 0;
let latestUser;
for (let index = messages.length - 1; index >= 0; index--) if (messages[index].role === "user") {
latestUser = messages[index];
break;
}
return {
kind,
version: 1,
requestId,
recoveryRootRequestId,
continuation,
latestMessageId: latestMessage?.id,
latestMessageRole: latestMessage?.role,
latestUserMessageId: latestUser?.id,
startedAt: Date.now(),
lastBody,
lastClientTools
};
}
function wrapChatFiberSnapshot(key, snapshot, user) {
return {
[key]: snapshot,
user
};
}
function unwrapChatFiberSnapshot(key, value, expectedKind) {
if (typeof value !== "object" || value === null || !(key in value)) return {
snapshot: null,
user: value
};
const envelope = value;
const snapshot = envelope[key];
if (typeof snapshot !== "object" || snapshot === null) return {
snapshot: null,
user: value
};
const candidate = snapshot;
if (candidate.version !== 1 || expectedKind !== void 0 && candidate.kind !== expectedKind || typeof candidate.requestId !== "string" || typeof candidate.continuation !== "boolean") return {
snapshot: null,
user: value
};
return {
snapshot,
user: envelope.user ?? null
};
}
//#endregion
//#region src/chat/recovery-codec.ts
/**
* `ChatRecoveryCodec` — the streaming-codec seam the recovery engine replays an
* interrupted turn's durable buffer through to reconstruct its partial assistant
* state. The engine and hosts only ever see the wire-agnostic `RecoveryPartial`
* shape (`{ text, parts }`); the codec owns the chunk-vocabulary differences.
*
* Two implementations exist today: {@link AISDKRecoveryCodec} (AI SDK SSE chunks,
* used by `@cloudflare/ai-chat` and `@cloudflare/think`) and `PiRecoveryCodec`
* (the pi `AgentEvent` vocabulary, in the `experimental/pi-recovery` fixture).
* Formalizing the interface here is the proof that the codec — not the engine —
* carries the chunk-shape contract.
*
* @internal Shared chat-recovery internals; not a public API.
*/
/**
* Whether a reconstructed AI SDK `UIMessage` parts array carries any settled
* (provider-accepted) tool result — the completed, often non-idempotent work
* that a `{ persist: false }` recovery return would otherwise silently discard
* (#1631). A part counts as settled when it is a tool part (`tool-*` /
* `dynamic-tool`) carrying an `output`/`result`, or whose state reached a
* terminal `output-{available,error,denied}`.
*
* This is the AI SDK codec's implementation of the per-vocabulary "did this
* partial settle a tool?" question. It lives with {@link AISDKRecoveryCodec}
* (not in the engine) because the codec owns the part vocabulary — the engine
* only ever reads the precomputed `RecoveryPartial.hasSettledToolResults`
* boolean and never names a part type. Foreign codecs (e.g. AG-UI) compute the
* same boolean from their own chunk vocabulary without producing AI SDK parts.
*/
function partialHasSettledToolResults(parts) {
return parts.some((part) => {
const record = part;
const type = typeof record.type === "string" ? record.type : "";
if (!(type.startsWith("tool-") || type === "dynamic-tool")) return false;
if ("output" in record || "result" in record) return true;
const state = typeof record.state === "string" ? record.state : "";
return state === "output-available" || state === "output-error" || state === "output-denied";
});
}
/**
* The single, host-agnostic rule for crediting recovery forward progress from a
* stored stream chunk — the convergence of what `AIChatAgent` and `Think`
* previously each decided on their own (ai-chat keyed on chunk type only; Think
* keyed on its flush cadence). Both hosts now call this at chunk-store time so
* the bump TIMING is identical:
*
* - a **milestone** ({@link ChatRecoveryCodec.isProgressChunk}) always credits;
* - **streaming content** ({@link ChatRecoveryCodec.isStreamingContentChunk})
* credits at most once per throttle window, so a long single segment still
* registers progress across crashes without writing storage per token;
* - anything else never credits.
*
* Finer than either host's prior cadence in the worst case and never coarser, so
* it can only delay/avoid a false `no_progress_timeout`, never hasten give-up.
*/
function shouldCreditStreamProgress(input) {
const { codec, type, throttle, now } = input;
if (codec.isProgressChunk(type)) return true;
if (codec.isStreamingContentChunk(type)) return throttle.shouldCredit(now);
return false;
}
/**
* The AI SDK codec: replays SSE chunk bodies through {@link getPartialStreamText}
* (`applyChunkToParts` under the hood). Stateless — share the
* {@link aiSdkRecoveryCodec} singleton rather than constructing per call.
*/
var AISDKRecoveryCodec = class {
toRecoveryPartial(bodies) {
const { text, parts } = getPartialStreamText(bodies.map((body) => ({ body })));
return {
text,
parts,
hasSettledToolResults: partialHasSettledToolResults(parts)
};
}
isProgressChunk(type) {
return type === "text-start" || type === "reasoning-start" || type === "tool-input-available" || type === "tool-output-available" || type === "tool-output-error" || type === "tool-output-denied";
}
isStreamingContentChunk(type) {
return type === "text-delta" || type === "reasoning-delta" || type === "tool-input-delta";
}
};
/** Shared stateless {@link AISDKRecoveryCodec} instance. */
const aiSdkRecoveryCodec = new AISDKRecoveryCodec();
//#endregion
//#region src/chat/resume-handshake.ts
/**
* Drives the server side of the stream-resume protocol over a
* {@link ResumeHandshakeHost}. Construct once per agent (the host wires its
* `ResumableStream` / `ContinuationState` / pending set in) and call the three
* public methods from the host's existing onConnect / onMessage wiring, so
* handler registration timing stays host-owned.
*/
var ResumeHandshake = class {
constructor(host) {
this.host = host;
}
/**
* Notify a connection that an active stream can be resumed; it should reply
* with `STREAM_RESUME_ACK` to receive the replay.
*
* A connection can legitimately be notified more than once for the same
* request — proactively from onConnect AND in response to its explicit
* `STREAM_RESUME_REQUEST` (#1733). This is intentional and must NOT be deduped
* here: an explicit request always deserves a response (else the client's
* `reconnectToStream` hangs to its timeout with no replay), and the proactive
* notify is required for clients that never send a request. The notify is one
* tiny frame; the client dedupes its ACK so the buffer is not replayed twice.
* Direct responses echo the opaque probe id; proactive notifications omit it.
*/
notifyStreamResuming(connection, probeId) {
const { resumableStream, pendingResumeConnections } = this.host;
if (!resumableStream.hasActiveStream()) return;
if (sendIfOpen(connection, JSON.stringify({
type: CHAT_MESSAGE_TYPES.STREAM_RESUMING,
id: resumableStream.activeRequestId,
...probeId ? { probeId } : {}
}))) pendingResumeConnections.add(connection.id);
}
/**
* Handle a client `STREAM_RESUME_REQUEST`. The client sends this after its
* message handler is registered, avoiding the race where a proactive
* `STREAM_RESUMING` from onConnect arrives before the handler is ready.
*/
async handleResumeRequest(connection, probeId) {
const { resumableStream, continuation, preStream } = this.host;
if (resumableStream.hasActiveStream()) if (continuation.activeRequestId === resumableStream.activeRequestId && continuation.activeConnectionId !== null && continuation.activeConnectionId !== connection.id && this._ownerStillPresent(continuation.activeConnectionId)) this._sendResumeNone(connection, STREAM_RESUME_NONE_REASONS.CONTINUATION_OWNED, probeId);
else this.notifyStreamResuming(connection, probeId);
else if (continuation.pending !== null && (continuation.pending.connectionId === null || continuation.pending.connectionId === connection.id)) {
continuation.awaitingConnections.set(connection.id, connection);
this._sendStreamPending(connection, continuation.pending.requestId, probeId);
} else if (await this._replayTerminalOnResume(connection, probeId)) {} else if (preStream?.park(connection, probeId)) {} else this._sendResumeNone(connection, STREAM_RESUME_NONE_REASONS.IDLE, probeId);
}
_sendResumeNone(connection, reason, probeId) {
sendIfOpen(connection, JSON.stringify({
type: CHAT_MESSAGE_TYPES.STREAM_RESUME_NONE,
reason,
...probeId ? { probeId } : {}
}));
}
/** Send a keep-waiting `STREAM_PENDING` frame (#1784). */
_sendStreamPending(connection, requestId, probeId) {
sendIfOpen(connection, JSON.stringify({
type: CHAT_MESSAGE_TYPES.STREAM_PENDING,
...requestId ? { id: requestId } : {},
...probeId ? { probeId } : {}
}));
}
/** Whether the active continuation's owner connection is still present. */
_ownerStillPresent(connectionId) {
return this.host.isConnectionPresent ? this.host.isConnectionPresent(connectionId) : true;
}
/** Handle a client `STREAM_RESUME_ACK` for `requestId`. */
async handleResumeAck(connection, requestId) {
const { resumableStream, pendingResumeConnections, responseMessageType } = this.host;
pendingResumeConnections.delete(connection.id);
if (resumableStream.hasActiveStream() && resumableStream.activeRequestId === requestId) {
const orphanedStreamId = resumableStream.replayChunks(connection, resumableStream.activeRequestId);
if (orphanedStreamId) await this.host.persistOrphanedStream(orphanedStreamId);
} else if (resumableStream.hasActiveStream()) {} else if (await this._replayTerminalOnAck(connection, requestId)) {} else if (!resumableStream.replayCompletedChunksByRequestId(connection, requestId)) sendIfOpen(connection, JSON.stringify({
body: "",
done: true,
id: requestId,
type: responseMessageType,
replay: true
}));
}
/**
* Replay a pending terminal outcome (#1645) over the resume handshake so a
* reconnecting client surfaces it exactly like a live exhaustion. The bare
* terminal frame is dropped by the client unless it arrives on a resumed
* stream — the only path that reaches the transport's stream reader and
* becomes `useChat.error` — so we drive `STREAM_RESUMING` here and deliver the
* error frame once the client ACKs (see {@link _replayTerminalOnAck}). Returns
* `true` if a terminal was pending (and `STREAM_RESUMING` was sent).
*/
async _replayTerminalOnResume(connection, probeId) {
const pending = await this.host.pendingChatTerminal();
if (!pending) return false;
sendIfOpen(connection, JSON.stringify({
type: CHAT_MESSAGE_TYPES.STREAM_RESUMING,
id: pending.requestId,
...probeId ? { probeId } : {}
}));
return true;
}
/**
* Deliver the pending terminal error frame on the resumed stream the client
* ACKed (#1645). The record is retained (not cleared) so concurrent reconnects
* (e.g. multiple tabs) each learn the outcome; it is cleared when a later turn
* supersedes it.
*/
async _replayTerminalOnAck(connection, requestId) {
const { resumableStream, responseMessageType } = this.host;
const pending = await this.host.pendingChatTerminal();
if (!pending || pending.requestId !== requestId) return false;
if (!resumableStream.replayErroredChunksByRequestId(connection, pending.requestId)) return true;
sendIfOpen(connection, JSON.stringify({
body: pending.body,
done: true,
error: true,
id: pending.requestId,
type: responseMessageType
}));
return true;
}
};
//#endregion
//#region src/chat/recovery-incident.ts
const CHAT_RECOVERY_INCIDENT_KEY_PREFIX = "cf:chat-recovery:incident:";
/**
* Durable, monotonic forward-progress counter for recovery budget resets.
* Bumped at production time when new content is streamed, so it reflects
* genuinely new content and is immune to reconnects/re-persists; never
* recomputed from the (compactable) transcript.
*/
const CHAT_RECOVERY_PROGRESS_KEY = "cf:chat-recovery:progress";
/**
* Durable record of an in-progress recovery so a "recovering…" status (#1620)
* can be broadcast live and survive the set/clear happening in different
* isolates (a continuation runs in a later alarm invocation).
*/
const CHAT_RECOVERING_KEY = "cf:chat:recovering";
/**
* Durable record of the last turn that ended in a terminal error / abandoned
* recovery (#1645). Replayed on the next reconnect via the resume handshake;
* cleared when a later turn supersedes it.
*/
const CHAT_LAST_TERMINAL_KEY = "cf:chat:last-terminal";
/**
* Secondary backstop only. The primary recovery bound is the no-progress wall
* clock; with alarm debounce this cap rarely binds (it catches a pathological
* tight alarm-loop). Kept high so the no-progress window seals first under
* normal deploy cadence (#1637).
*/
const DEFAULT_CHAT_RECOVERY_MAX_ATTEMPTS = 10;
/**
* Runaway-loop guard default — the framework-imposed backstop on cumulative
* recovery WORK (produced content/tool units) since an incident opened.
*
* Originally `Infinity` (rfc-chat-recovery-work-budget): the SDK shipped the
* *mechanism* but no default cap, so a progressing turn was never terminated on
* its own. Production issue #1825 showed that this is a footgun: an isolate that
* OOMs mid-stream still credits a little progress before it dies, which resets
* BOTH progress-keyed bounds (the attempt cap and the no-progress window) on
* every wake — and a fast crash loop (each attempt inside the alarm-debounce
* window) pins the attempt counter too. With `maxRecoveryWork = Infinity` the
* ONLY instrument whose meter still climbs across such a loop is disabled, so
* recovery re-runs the turn (and its LLM calls) forever.
*
* A finite default closes that loop out of the box: work climbs regardless of
* debounce/progress resets, so a content-emitting runaway is always sealed with
* `reason="work_budget_exceeded"`. The value is deliberately generous — it
* bounds wasted re-run cost without clipping a normal interrupted turn (work
* only accrues from the first interruption until the turn completes, after which
* the incident is deleted). A very long agentic turn under heavy interruption
* that legitimately needs more should raise `maxRecoveryWork` (or set it to
* `Infinity` to restore the pre-#1825 unbounded behavior).
*/
const DEFAULT_CHAT_RECOVERY_MAX_WORK = 1e3;
/**
* Tight, OOM-specific retry budget (#1825). A Durable Object memory-limit reset
* (`isDurableObjectMemoryLimitReset`) is usually deterministic — the turn's
* working set no longer fits in the isolate's 128 MB — so re-running it re-OOMs.
* But a single OOM CAN be a transient spike (the isolate's 128 MB is shared
* across the global scope / noisy neighbors), so recovery retries a small number
* of times before sealing with `reason="out_of_memory"` rather than abandoning a
* turn that one more attempt might have completed. Far tighter than the generic
* `maxRecoveryWork` backstop because an OOM is attributable and re-running it is
* expensive (it re-runs the model). Counts attempts that ended in an OOM, not
* total attempts, so a turn interrupted by deploys (no OOM) is unaffected.
*/
const DEFAULT_CHAT_RECOVERY_MAX_OOM_RETRIES = 3;
const DEFAULT_CHAT_RECOVERY_STABLE_TIMEOUT_MS = 1e4;
/**
* Delay before retrying a recovery that timed out waiting for stable state.
* Gives an actively-churning isolate (e.g. a deploy in flight) time to settle.
*/
const CHAT_RECOVERY_STABLE_RETRY_DELAY_SECONDS = 3;
const DEFAULT_CHAT_RECOVERY_TERMINAL_MESSAGE = "The assistant was interrupted and could not recover. Please try again.";
/**
* Incidents that have not seen a new attempt within this window are assumed
* abandoned and swept so durable storage does not grow without bound.
*/
const CHAT_RECOVERY_INCIDENT_TTL_MS = 3600 * 1e3;
/** Max keys per Durable Object KV `delete([...])` call. */
const KV_DELETE_MAX_KEYS = 128;
/**
* PRIMARY recovery bound (#1637): seal an incident that has made no forward
* progress for this long. Keyed to `lastProgressAt`, which resets on every
* progress-bearing attempt — so a turn that keeps producing content survives
* deploy churn indefinitely, while a genuinely stuck turn dies within 5 min.
*/
const DEFAULT_CHAT_RECOVERY_NO_PROGRESS_TIMEOUT_MS = 300 * 1e3;
/**
* Alarm debounce: recovery alarms bunched within this window collapse into a
* single attempt. A deploy rollout drops/reconnects the socket several times
* over ~11–22s; without this, one logical deploy would burn several attempts.
*/
const CHAT_RECOVERY_ALARM_DEBOUNCE_MS = 30 * 1e3;
/**
* Staleness bound for the live "recovering…" flag (#1620). A flag older than
* this is treated as abandoned so it can neither pin the indicator on forever
* nor suppress a genuinely-new recovering signal. NOT a recovery budget.
*/
const CHAT_RECOVERING_FLAG_TTL_MS = 900 * 1e3;
/**
* Resolve a raw `chatRecovery` config field into the fully-defaulted form the
* engine reasons about. Identical defaulting in both packages today.
*/
function resolveChatRecoveryConfig(raw) {
const custom = typeof raw === "object" && raw !== null ? raw : void 0;
return {
enabled: raw !== false,
maxAttempts: Math.max(1, Math.floor(custom?.maxAttempts ?? 10)),
stableTimeoutMs: Math.max(0, Math.floor(custom?.stableTimeoutMs ?? 1e4)),
terminalMessage: custom?.terminalMessage ?? "The assistant was interrupted and could not recover. Please try again.",
noProgressTimeoutMs: Math.max(0, Math.floor(custom?.noProgressTimeoutMs ?? 3e5)),
maxRecoveryWork: typeof custom?.maxRecoveryWork === "number" && custom.maxRecoveryWork >= 0 ? custom.maxRecoveryWork : DEFAULT_CHAT_RECOVERY_MAX_WORK,
maxOomRetries: typeof custom?.maxOomRetries === "number" && custom.maxOomRetries >= 0 ? Math.floor(custom.maxOomRetries) : 3,
...custom?.shouldKeepRecovering ? { shouldKeepRecovering: custom.shouldKeepRecovering } : {},
...custom?.onExhausted ? { onExhausted: custom.onExhausted } : {}
};
}
/**
* Stable identifier for a recovery incident.
*
* `recoveryKind` is intentionally NOT part of the identity: a single
* interrupted turn can flip between "retry" (no chunks persisted) and
* "continue" (partial chunks exist) across restarts, and the attempt budget
* must be shared so recovery stays bounded by `maxAttempts`. This formula is a
* cutover invariant.
*/
function chatRecoveryIncidentId(input) {
return [input.recoveryRootRequestId ?? input.requestId, input.latestUserMessageId ?? ""].join(":");
}
/** Durable storage key for an incident record. */
function chatRecoveryIncidentKey(incidentId) {
return `${CHAT_RECOVERY_INCIDENT_KEY_PREFIX}${encodeURIComponent(incidentId)}`;
}
/**
* Select incident keys that have been inactive past the TTL. Pure over a map of
* stored incidents; the caller performs the batched delete.
*/
function selectStaleIncidentKeys(entries, now) {
const staleKeys = [];
for (const [key, incident] of entries) if (now - (incident?.lastAttemptAt ?? incident?.firstSeenAt ?? 0) > 36e5) staleKeys.push(key);
return staleKeys;
}
/**
* Sweep recovery incidents inactive past the TTL from durable storage. Lists by
* the incident key prefix, selects stale keys (`selectStaleIncidentKeys`), and
* batch-deletes them — the DO KV `delete([...])` accepts up to
* `KV_DELETE_MAX_KEYS` per call, collapsing N awaited round-trips into
* ceil(N / 128). Shared by `AIChatAgent` and `Think` so the sweep policy lives in
* one place. See `design/rfc-chat-recovery-foundation.md`.
*/
async function sweepStaleChatRecoveryIncidents(storage, now) {
const staleKeys = selectStaleIncidentKeys(await storage.list({ prefix: CHAT_RECOVERY_INCIDENT_KEY_PREFIX }), now);
for (let i = 0; i < staleKeys.length; i += 128) await storage.delete(staleKeys.slice(i, i + 128));
}
/**
* List the persisted recovery incidents that are still live (status
* `detected` / `scheduled` / `attempting`) — i.e. NOT yet terminalized
* (`exhausted` / `failed`). Used by the alarm-boundary OOM circuit breaker
* (#1825) to find the incident(s) it must seal when the in-DO budgets could not.
* Lists by the incident key prefix so the storage layout stays encapsulated.
*/
async function listActiveChatRecoveryIncidents(storage) {
const entries = await storage.list({ prefix: CHAT_RECOVERY_INCIDENT_KEY_PREFIX });
const active = [];
for (const [key, incident] of entries) if (incident && (incident.status === "detected" || incident.status === "scheduled" || incident.status === "attempting")) active.push({
key,
incident
});
return active;
}
/**
* Summarize a child agent's persisted recovery incidents for the parent's
* agent-tool reattach decision: `"in-progress"` if any incident is still live
* (detected/scheduled/attempting), else `"failed"` if any terminalized
* (exhausted/failed), else `"none"`. In-progress takes precedence so a parent
* never gives up on a child that is still recovering. Shared by `AIChatAgent`
* and `Think`. See `design/rfc-chat-recovery-foundation.md`.
*/
async function classifyAgentToolChildRecovery(storage) {
const entries = await storage.list({ prefix: CHAT_RECOVERY_INCIDENT_KEY_PREFIX });
let failed = false;
for (const incident of entries.values()) {
if (incident.status === "detected" || incident.status === "scheduled" || incident.status === "attempting") return "in-progress";
if (incident.status === "exhausted" || incident.status === "failed") failed = true;
}
return failed ? "failed" : "none";
}
/**
* Read the durable monotonic recovery-progress counter (0 when unset). The value
* feeds the no-progress budget decision; shared by `AIChatAgent` and `Think`.
*/
async function readChatRecoveryProgress(storage) {
return await storage.get("cf:chat-recovery:progress") ?? 0;
}
/**
* Advance the durable recovery-progress counter by one. Called when genuinely new
* content is durably flushed (real, reconnect-immune forward progress); shared by
* `AIChatAgent` and `Think`.
*/
async function bumpChatRecoveryProgress(storage) {
const current = await storage.get("cf:chat-recovery:progress") ?? 0;
await storage.put(CHAT_RECOVERY_PROGRESS_KEY, current + 1);
}
/**
* Throttle window for crediting a parent turn's recovery progress from forwarded
* sub-agent (agent-tool) stream chunks (N9). Forwarding a child's chunks IS
* forward progress for the parent, but the credit must not write storage per
* token.
*/
const AGENT_TOOL_STREAM_PROGRESS_BUMP_THROTTLE_MS = 5e3;
/**
* Per-isolate throttle gate for agent-tool stream-progress crediting (N9). The
* `_lastBumpAt` clock is in-memory, so it resets per isolate and the first
* forwarded chunk after a restart always credits. `shouldCredit(now)` returns
* `true` at most once per `AGENT_TOOL_STREAM_PROGRESS_BUMP_THROTTLE_MS` window and
* records the time on each credit. Shared by `AIChatAgent` and `Think`.
*/
var AgentToolStreamProgressThrottle = class {
constructor() {
this._lastBumpAt = 0;
}
shouldCredit(now) {
if (now - this._lastBumpAt < 5e3) return false;
this._lastBumpAt = now;
return true;
}
};
/**
* Throttle window for crediting recovery progress from mid-segment streaming
* content (text/reasoning/tool-input deltas). A milestone chunk credits
* unconditionally; deltas credit at most once per window so a long single
* segment registers forward progress across crashes without writing storage per
* token. 5s is far finer than the 300s no-progress budget, so any crash gap
* longer than this window over an actively-streaming segment still credits.
*/
const CHAT_STREAM_PROGRESS_CREDIT_THROTTLE_MS = 5e3;
/**
* Per-isolate throttle gate for crediting recovery progress from mid-segment
* streaming-content chunks — the delta arm of {@link shouldCreditStreamProgress}.
* The `_lastBumpAt` clock is in-memory, so it resets per isolate and the first
* delta after a restart always credits. Shared by `AIChatAgent` and `Think`.
*/
var StreamProgressCreditThrottle = class {
constructor() {
this._lastBumpAt = 0;
}
shouldCredit(now) {
if (now - this._lastBumpAt < 5e3) return false;
this._lastBumpAt = now;
return true;
}
};
/**
* Persist a durable record of the last terminal turn so a client that
* (re)connects after the turn ended still learns its outcome (#1645). Kept
* until a later turn supersedes it ({@link clearChatTerminal}); a single record
* is sufficient because only the most recent terminal is relevant.
*/
async function recordChatTerminal(storage, requestId, body) {
await storage.put(CHAT_LAST_TERMINAL_KEY, {
requestId,
body
});
}
/** Clear the durable terminal record once a later turn supersedes it (#1645). */
async function clearChatTerminal(storage) {
await storage.delete(CHAT_LAST_TERMINAL_KEY);
}
/** Read the pending terminal record, or `null` if none is stored (#1645). */
async function pendingChatTerminal(storage) {
return await storage.get("cf:chat:last-terminal") ?? null;
}
/**
* Build the on-connect "recovering…" replay frame (#1620), or `null` when no
* (non-stale) recovery is in progress. A client that connects between recovery
* attempts (no active stream) reads the turn as working rather than frozen. A
* record older than the flag TTL is treated as abandoned (its terminal-clear
* never ran) and skipped, so a dead recovery can't show "recovering…" forever.
* `messageType` is the package's recovering wire-type enum.
*/
async function buildChatRecoveringFrame(storage, messageType, now) {
const recovering = await storage.get(CHAT_RECOVERING_KEY);
if (!recovering || now - (recovering.at ?? 0) >= 9e5) return null;
return {
type: messageType,
recovering: true,
...recovering.requestId ? { id: recovering.requestId } : {}
};
}
/**
* Set or clear the live "recovering…" status (#1620). Persists a durable record
* (so set/clear stay consistent across the isolates a recovery spans) and
* broadcasts a recovering frame — but only on a genuine transition, so a
* deploy/reconnect storm (which re-detects recovery many times) doesn't spam
* the wire. A flag older than the TTL is stale: the owning incident was
* abandoned without a terminal (e.g. the DO went idle before recovery could
* resolve), so it is treated as not-recovering and can neither pin the
* indicator on forever nor suppress a genuinely-new recovering signal.
* `messageType` is the package's recovering wire-type enum; `broadcast` is the
* package's chat-broadcast wrapper.
*/
async function setChatRecovering(active, requestId, deps) {
const { storage, messageType, broadcast, now } = deps;
const existing = await storage.get(CHAT_RECOVERING_KEY);
const activeExisting = existing && now - (existing.at ?? 0) < 9e5;
if (active) {
if (activeExisting) return;
await storage.put(CHAT_RECOVERING_KEY, {
...requestId ? { requestId } : {},
at: now
});
} else {
if (!existing) return;
await storage.delete(CHAT_RECOVERING_KEY);
requestId = requestId ?? existing.requestId;
}
broadcast({
type: messageType,
recovering: active,
...requestId ? { id: requestId } : {}
});
}
/**
* Compute the next recovery incident and budget decision.
*
* This is the durable recovery budget — a faithful extraction of
* `_beginChatRecoveryIncident` from both `AIChatAgent` and `Think`. The
* instruments are decoupled by what they catch:
*
* - STUCK — no-progress window: `lastProgressAt` resets on every
* progress-bearing attempt, so a turn that keeps producing content survives
* churn indefinitely; a stuck turn is sealed after `noProgressTimeoutMs`.
* - DEBOUNCE — alarms bunched within `CHAT_RECOVERY_ALARM_DEBOUNCE_MS` collapse
* into one attempt, so a single rollout's reconnect storm isn't N attempts.
* - ALARM-LOOP — the attempt cap (resets on progress) catches a tight
* no-progress alarm loop.
* - RUNAWAY — the work budget seals a loop that keeps emitting content but
* never converges. Keyed to WORK done, not wall-clock. Defaults to no cap.
* - CALLER — `shouldKeepRecovering` lets the integrator express a
* token/cost/step budget the SDK should not hardcode. Consulted only when no
* hard bound has already sealed the incident, and never on first detection.
*
* A turn parked on a pending client interaction is budget-free: every bound is
* suppressed and the no-progress clock kept fresh.
*/
async function evaluateChatRecoveryIncident(input) {
const { identity, config, existing, currentProgress, awaitingClientInteraction, now } = input;
const incidentId = chatRecoveryIncidentId(identity);
const recoveryRootRequestId = identity.recoveryRootRequestId ?? identity.requestId;
const prevProgress = existing?.progress ?? 0;
const madeProgress = existing != null && currentProgress > prevProgress;
const lastProgressAt = madeProgress || awaitingClientInteraction ? now : existing?.lastProgressAt ?? existing?.firstSeenAt ?? now;
const noProgressExceeded = existing != null && !awaitingClientInteraction && now - lastProgressAt > config.noProgressTimeoutMs;
const workBaseline = existing?.workBaseline ?? currentProgress;
const progress = Math.max(prevProgress, currentProgress);
const work = progress - workBaseline;
const workBudgetExceeded = existing != null && Number.isFinite(config.maxRecoveryWork) && work > config.maxRecoveryWork;
const oomAttempts = existing?.oomAttempts ?? 0;
const oomBudgetExceeded = existing != null && !awaitingClientInteraction && oomAttempts > config.maxOomRetries;
const debounced = existing != null && !madeProgress && now - existing.lastAttemptAt < 3e4;
const attempt = madeProgress ? 1 : debounced ? existing?.attempt ?? 1 : (existing?.attempt ?? 0) + 1;
let abortedByCaller = false;
if (existing != null && !awaitingClientInteraction && config.shouldKeepRecovering && !noProgressExceeded && !workBudgetExceeded && !oomBudgetExceeded && attempt <= config.maxAttempts) try {
const ctx = {
incidentId,
requestId: identity.requestId,
recoveryRootRequestId,
attempt,
maxAttempts: config.maxAttempts,
recoveryKind: identity.recoveryKind,
work,
ageMs: now - (existing.firstSeenAt ?? now)
};
abortedByCaller = await config.shouldKeepRecovering(ctx) === false;
} catch (error) {
input.onShouldKeepRecoveringError?.(error);
}
const exhausted = !awaitingClientInteraction && (oomBudgetExceeded || noProgressExceeded || workBudgetExceeded || abortedByCaller || attempt > config.maxAttempts);
const incident = {
incidentId,
requestId: identity.requestId,
recoveryRootRequestId,
recoveryKind: identity.recoveryKind,
attempt,
maxAttempts: config.maxAttempts,
status: exhausted ? "exhausted" : "attempting",
firstSeenAt: existing?.firstSeenAt ?? now,
lastAttemptAt: now,
lastProgressAt,
progress,
workBaseline,
...oomAttempts > 0 ? { oomAttempts } : {},
...exhausted ? { reason: oomBudgetExceeded ? "out_of_memory" : workBudgetExceeded ? "work_budget_exceeded" : noProgressExceeded ? "no_progress_timeout" : abortedByCaller ? "recovery_aborted" : "max_attempts_exceeded" } : {}
};
const events = [];
if (!existing) events.push({
type: "chat:recovery:detected",
incidentId,
requestId: identity.requestId,
attempt,
maxAttempts: config.maxAttempts,
recoveryKind: identity.recoveryKind
});
events.push({
type: "chat:recovery:attempt",
incidentId,
requestId: identity.requestId,
attempt,
maxAttempts: config.maxAttempts,
recoveryKind: identity.recoveryKind
});
return {
incident,
exhausted,
events
};
}
//#endregion
//#region src/chat/recovery-engine.ts
/**
* Resolve the `schedule()` idempotency option for a recovery schedule. Single
* source of truth for both packages; see {@link ChatRecoveryScheduleReason} for
* the rationale behind each case.
*
* This is a cutover invariant: flipping either case silently breaks deploy-storm
* dedup (initial) or stalls stable-timeout retries (reschedule), and neither is
* caught by a type error — only by the recovery suites.
*/
function chatRecoverySchedulePolicy(reason) {
return { idempotent: reason === "initial" };
}
/**
* Drives the shared recovery orchestration over a {@link ChatRecoveryAdapter}.
* The incident *budget math* lives in the pure `evaluateChatRecoveryIncident`;
* this class owns the surrounding sequence and its ordering invariants.
*/
var ChatRecoveryEngine = class {
constructor(adapter) {
this.adapter = adapter;
}
/**
* Open or re-evaluate the recovery incident for `input`, persist the result,
* and broadcast its lifecycle events. Returns the incident, the resolved
* config, and whether the budget is now exhausted.
*/
/**
* Dispatch a recovered fiber to the package's non-chat handler (the
* messenger/workflow seam) before any chat-recovery processing. Returns `true`
* when the package consumed the fiber — the caller must then skip chat
* recovery for it. The engine owns the *ordering* (this runs before the
* chat-fiber gate); the *behavior* is adapter-owned. No-op (`false`) when the
* adapter omits {@link ChatRecoveryAdapter.tryHandleNonChatFiberRecovery}.
*/
async handleNonChatFiber(ctx) {
return await this.adapter.tryHandleNonChatFiberRecovery?.(ctx) ?? false;
}
/**
* The shared wake-recovery LIFECYCLE for an interrupted chat fiber. Both
* packages drove this exact frame; the divergent organs are the
* {@link ChatFiberWakeHooks}. In order:
*
* 1. non-chat dispatch ({@link handleNonChatFiber}) FIRST, then the chat-fiber
* name gate — a non-chat fiber is never misread as an orphaned chat turn;
* 2. parse the request id, unwrap the snapshot, resolve the orphaned stream +
* reconstruct its partial;
* 3. classify the turn (retry/continue + package detail) and open the incident;
* 4. if the budget is already exhausted, persist the settled partial (so
* non-idempotent tool results are not discarded — #1631) and terminalize
* BEFORE consulting `onChatRecovery`;
* 5. otherwise, inside a `failed`-on-throw guard: invoke `onChatRecovery`,
* apply the shared persist gate (base eligibility AND `persist !== false ||
* settled tool results`), complete the live stream, then hand the
* retry/continue/skip DECISION to {@link ChatFiberWakeHooks.dispatchRecoveredTurn}.
*
* Returns `true` when the fiber was a chat (or non-chat) recovery the engine
* handled, `false` when it was not a chat fiber (the caller keeps looking). Any
* throw after the incident opens flips it to `failed` so it is never left
* leaking in `attempting`.
*/
async handleChatFiberRecovery(ctx, wake) {
const { adapter } = this;
if (await this.handleNonChatFiber(ctx)) return true;
const chatPrefix = wake.chatFiberPrefix();
if (!ctx.name.startsWith(chatPrefix)) return false;
const requestId = ctx.name.slice(chatPrefix.length);
const { snapshot, recoveryData } = wake.unwrapRecoverySnapshot(ctx);
const { streamId, streamStillActive, streamStatus } = adapter.resolveRecoveryStream(requestId);
const partial = streamId ? adapter.getPartialStreamText(streamId) : {
text: "",
parts: [],
hasSettledToolResults: false
};
const { recoveryKind, detail } = await wake.classifyRecoveredTurn({
snapshot,
requestId,
streamId,
partial,
streamStillActive,
streamStatus
});
const recoveryRootRequestId = snapshot?.recoveryRootRequestId ?? requestId;
const { incident, config, exhausted } = await this.beginIncident({
requestId,
recoveryRootRequestId,
latestUserMessageId: snapshot?.latestUserMessageId,
recoveryKind
});
if (exhausted) {
if (await this._shouldPersistOrphanedPartial(wake, {
streamId,
streamStillActive,
streamStatus,
snapshot,
options: void 0,
partial
})) await wake.persistOrphanedStream(streamId);
await adapter.exhaustChatRecovery(incident, config, partial, streamId, ctx.createdAt);
return true;
}
try {
const options = await wake.invokeOnChatRecovery?.({
incident,
recoveryKind,
recoveryRootRequestId,
requestId,
streamId,
partial,
snapshot,
recoveryData,
createdAt: ctx.createdAt
}) ?? {};
if (await this._shouldPersistOrphanedPartial(wake, {
streamId,
streamStillActive,
streamStatus,
snapshot,
options,
partial
})) await wake.persistOrphanedStream(streamId);
if (streamStillActive) await wake.completeRecoveredStream(streamId);
await wake.dispatchRecoveredTurn({
incident,
config,
recoveryKind,
options,
snapshot,
requestId,
recoveryRootRequestId,
streamId,
streamStatus,
detail
});
return true;
} catch (error) {
await this.updateIncident(incident.incidentId, "failed", error instanceof Error ? error.message : String(error));
throw error;
}
}
/**
* The shared persist gate: base eligibility (the package's
* {@link ChatFiberWakeHooks.shouldPersistOrphanedPartial}) AND the
* never-drop-settled-work clause `options.persist !== false ||
* partial.hasSettledToolResults`. `options: undefined` (the exhausted branch)
* collapses the clause to the base gate. The clause lives here — not in each
* package — because settled-work preservation is a cross-package invariant
* (#1631), and the codec (not the engine) decides whether a partial carries
* settled tool work, so the engine stays wire-vocabulary-agnostic.
*/
async _shouldPersistOrphanedPartial(wake, input) {
return await wake.shouldPersistOrphanedPartial({
streamId: input.streamId,
streamStillActive: input.streamStillActive,
streamStatus: input.streamStatus,
snapshot: input.snapshot
}) && (input.options?.persist !== false || input.partial.hasSettledToolResults);
}
async beginIncident(input) {
const { adapter } = this;
const config = adapter.resolveConfig();
const key = chatRecoveryIncidentKey(chatRecoveryIncidentId(input));
const now = input.nowMs ?? adapter.now();
await adapter.sweepStaleIncidents(now);
const existing = await adapter.getIncident(key);
adapter.ensureInteractionStateLoaded?.();
const { incident, exhausted, events } = await evaluateChatRecoveryIncident({
identity: input,
config,
existing,
currentProgress: await adapter.readProgress(),
awaitingClientInteraction: adapter.isAwaitingClientInteraction?.() ?? false,
now,
onShouldKeepRecoveringError: (error) => adapter.onShouldKeepRecoveringError?.(error)
});
await adapter.putIncident(key, incident);
for (const event of events) adapter.emitRecoveryEvent(event);
return {
incident,
config,
exhausted
};
}
/**
* Schedule a recovery continuation/retry: the transition + emit + enqueue
* triplet both packages repeat at every fiber-recovery and stall-routing
* decision. In order:
*
* 1. transition the incident to `scheduled` (persist + drive the #1620
* "recovering…" status) via {@link updateIncident};
* 2. emit `chat:recovery:scheduled`; and
* 3. enqueue the callback through the adapter's idempotent schedule.
*
* `recoveryKind` is passed explicitly (not read off the incident) because a
* caller can legitimately report a different kind than the incident was opened
* with — e.g. `AIChatAgent`'s lost-partial branch opens a `continue` incident
* but schedules (and reports) a `retry`. `requestId` always matches
* `incident.requestId` (the evaluation rewrites it to the current attempt), so
* it is read from the incident.
*/
async scheduleRecovery(input) {
const { incident } = input;
await this.updateIncident(incident.incidentId, "scheduled");
this.adapter.emitRecoveryEvent({
type: "chat:recovery:scheduled",
incidentId: incident.incidentId,
requestId: incident.requestId,
attempt: incident.attempt,
maxAttempts: incident.maxAttempts,
recoveryKind: input.recoveryKind
});
await this.adapter.scheduleRecovery(input.callback, input.data, input.reason ?? "initial", 0);
}
/**
* Reschedule a recovery continuation/retry that timed out waiting for stable
* state, INSIDE the currently-executing one-shot schedule row. Reads the
* incident; if it is still under the attempt cap, bumps `attempt`, marks it
* `scheduled` with `reason:"stable_timeout_retry"`, and issues a delayed,
* NON-idempotent schedule (`alarm()` deletes the executing row only after this
* returns, so an idempotent reschedule would dedup onto that doomed row and
* never fire — see {@link chatRecoverySchedulePolicy}).
*
* Returns `true` when a retry was scheduled, `false` when there is no incident
* (no id / record gone) or the attempt budget is already spent — in which case
* the caller falls through to the give-up path. Deliberately bypasses the
* `evaluateChatRecoveryIncident` budget (this is a coarse stable-state retry,
* not a fresh interruption) and {@link updateIncident} (no `scheduled` event /
* recovering-flag churn on a same-turn reschedule).
*/
async rescheduleAfterStableTimeout(input) {
const { adapter } = this;
if (!input.incidentId) return false;
const key = chatRecoveryIncidentKey(input.incidentId);
const incident = await adapter.getIncident(key);
if (!incident) return false;
const attempt = incident.attempt ?? 0;
if (attempt >= (incident.maxAttempts ?? input.fallbackMaxAttempts)) return false;
await adapter.putIncident(key, {
...incident,
attempt: attempt + 1,
status: "scheduled",
lastAttemptAt: adapter.now(),
reason: "stable_timeout_retry"
});
await adapter.scheduleRecovery(input.callback, input.data ?? {}, "stable_timeout_retry", 3);
return true;
}
/**
* Record that a recovery callback observed a Durable Object memory-limit reset
* (the isolate exceeded its 128 MB limit — `isDurableObjectMemoryLimitReset`)
* and decide what to do next (#1825).
*
* Bumps the incident's durable `oomAttempts` counter, then:
* - if it is still within `maxOomRetries`, issues a delayed, NON-idempotent
* reschedule of the SAME callback (same machinery as
* {@link rescheduleAfterStableTimeout}: the executing one-shot row is
* deleted only after the callback returns, so an idempotent reschedule
* would dedup onto that doomed row) and returns `"rescheduled"`. The small
* delay lets a transient memory spike clear before the re-run;
* - otherwise leaves the incremented count persisted (so a begin-path
* re-evaluation agrees) and returns `"exhausted"` — the caller then
* terminalizes via the give-up path with `reason="out_of_memory"`.
*
* Returns `"exhausted"` when there is no incident to track against (no id /
* record gone): an OOM we cannot bound must seal rather than loop. Unlike a
* stable-state retry this is gated by the OOM-specific budget, NOT the generic
* attempt cap — re-running an OOM streams a little "progress" that would
* otherwise reset the attempt cap forever (the #1825 loop).
*/
async recordOomAndDecide(input) {
const { adapter } = this;
if (!input.incidentId) return "exhausted";
const key = chatRecoveryIncidentKey(input.incidentId);
const incident = await adapter.getIncident(key);
if (!incident) return "exhausted";
const oomAttempts = (incident.oomAttempts ?? 0) + 1;
if (oomAttempts > input.maxOomRetries) {
await adapter.putIncident(key, {
...incident,
oomAttempts,
lastAttemptAt: adapter.now(),
reason: "out_of_memory"
});
return "exhausted";
}
await adapter.putIncident(key, {
...incident,
oomAttempts,
status: "scheduled",
lastAttemptAt: adapter.now(),
reason: "oom_retry"
});
await adapter.scheduleRecovery(input.callback, input.data ?? {}, "stable_timeout_retry", 3);
return "rescheduled";
}
/**
* Give up on a recovery turn whose retry budget drained, terminalizing it so
* it can never become an eternal spinner (#1645). The shared spine both
* packages repeated verbatim:
*
* 1. resolve config + the incident key from `data.incidentId`;
* 2. best-effort READ the stored incident — a failed read is tolerated
* (reported via `onGiveUpBookkeepingError("read", …)`) and the incident is
* synthesized, because the read backs only the re-entry guard, not the
* terminal UX;
* 3. re-entry guard: a `stored.status === "exhausted"` record means
* terminalization already fired, so a duplicate stale alarm returns without
* re-broadcasting the banner;
* 4. build the exhausted incident (reuse `stored`, or synthesize a minimal one
* so a swept/missing record STILL terminalizes through `onExhausted`);
* 5. resolve the orphaned stream id + partial;
* 6. terminalize via `exhaustChatRecovery` — BEFORE sealing. The terminal
* writes can reject with a platform transient in the deploy/storage window
* a give-up runs in (#1730); letting that throw propagate is deliberate, so
* `Agent._executeScheduleCallback` defers the one-shot row and the WHOLE
* give-up re-runs on a healthy isolate. Sealing first would arm the
* re-entry guard and turn that re-run into a no-op, dropping the durable
* terminal record. The re-run is idempotent (terminal writes overwrite the
* same key); a second banner is the documented at-least-once edge; and
* 7. best-effort SEAL write so the re-entry guard sees `exhausted` on a
* duplicate alarm — a failed seal (reported via
* `onGiveUpBookkeepingError("seal", …)`) costs at most one re-delivered
* banner.
*
* The two packages diverged only in parameters the caller supplies:
* `reason` (`Think` passes `stable_timeout` | `recovery_error`; `AIChatAgent`
* always `stable_timeout`) and the root-id chain (`Think` includes
* `recoveredRequestId`; `AIChatAgent` never sets it, so the unified chain
* collapses identically). Exactly-once terminalization rests on the re-entry
* guard alone in `AIChatAgent`; `Think` additionally short-circuits duplicate
* alarms earlier in its durable-submission layer.
*/
async exhaustRecoveryGiveUp(input) {
const { adapter } = this;
const config = adapter.resolveConfig();
const incidentKey = input.data?.incidentId ? chatRecoveryIncidentKey(input.data.incidentId) : null;
let stored = null;
if (incidentKey) try {
stored = await adapter.getIncident(incidentKey);
} catch (readError) {
adapter.onGiveUpBookkeepingError("read", readError);
}
if (stored?.status === "exhausted") return;
const rootRequestId = input.data?.originalRequestId ?? input.data?.recoveredRequestId ?? adapter.activeChatRecoveryRootRequestId() ?? stored?.recoveryRootRequestId ?? stored?.requestId ?? "";
const incident = stored ? {
...stored,
status: "exhausted",
reason: input.reason
} : {
incidentId: input.data?.incidentId ?? crypto.randomUUID(),
requestId: rootRequestId,
recoveryRootRequestId: rootRequestId,
recoveryKind: input.callback === "_chatRecoveryRetry" ? "retry" : "continue",
attempt: config.maxAttempts,
maxAttempts: config.maxAttempts,
status: "exhausted",
firstSeenAt: adapter.now(),
lastAttemptAt: adapter.now(),
reason: input.reason
};
const { streamId } = adapter.resolveRecoveryStream(incident.recoveryRootRequestId ?? incident.requestId);
const partial = streamId ? adapter.getPartialStreamText(streamId) : {
text: "",
parts: [],
hasSettledToolResults: false
};
await adapter.exhaustChatRecovery(incident, config, partial, streamId, incident.firstSeenAt);
if (incidentKey) try {
await adapter.putIncident(incidentKey, incident);
} catch (writeError) {
adapter.onGiveUpBookkeepingError("seal", writeError);
}
}
/**
* Apply a status transition to the recovery incident `incidentId`:
*
* - `completed` → drop the record (terminal, never retried);
* - any other status → persist the new status (and `reason`), so the attempt
* budget survives restarts until the TTL sweep reclaims it;
* - emit the matching `completed`/`skipped`/`failed` lifecycle event; and
* - drive the live "recovering…" status (#1620): `scheduled` marks it active
* (keyed by the recovery-root request id), terminal states clear it.
*
* No-op when `incidentId` is undefined or the record is already gone. This is
* the transition twin of {@link beginIncident}: all I/O is adapter-owned, the
* engine owns only the state-machine shape.
*/
async updateIncident(incidentId, status, reason) {
if (!incidentId) return;
const { adapter } = this;
const key = chatRecoveryIncidentKey(incidentId);
const incident = await adapter.getIncident(key);
if (!incident) return;
if (status === "completed") await adapter.deleteIncident(key);
else await adapter.putIncident(key, {
...incident,
status,
...reason ? { reason } : {}
});
const eventType = status === "completed" ? "chat:recovery:completed" : status === "skipped" ? "chat:recovery:skipped" : status === "failed" ? "chat:recovery:failed" : void 0;
if (eventType) adapter.emitRecoveryEvent({
type: eventType,
incidentId,
requestId: incident.requestId,
attempt: incident.attempt,
maxAttempts: incident.maxAttempts,
recoveryKind: incident.recoveryKind,
...reason ? { reason } : {}
});
if (status === "scheduled") await adapter.setRecovering(true, incident.recoveryRootRequestId ?? incident.requestId);
else if (status === "completed" || status === "skipped" || status === "failed") await adapter.setRecovering(false);
}
};
/**
* Build the `ChatRecoveryExhaustedContext` delivered to `onExhausted` and the
* `chat:recovery:exhausted` event. Pure field-mapping shared by both packages;
* the `reason` falls back to `max_attempts_exceeded` when the incident did not
* record a more specific cause.
*/
function buildChatRecoveryExhaustedContext(input) {
const { incident, config } = input;
return {
incidentId: incident.incidentId,
requestId: incident.requestId,
recoveryRootRequestId: incident.recoveryRootRequestId ?? incident.requestId,
attempt: incident.attempt,
maxAttempts: incident.maxAttempts,
recoveryKind: incident.recoveryKind,
streamId: input.streamId,
createdAt: input.createdAt,
partialText: input.partialText,
partialParts: input.partialParts,
reason: incident.reason ?? "max_attempts_exceeded",
terminalMessage: config.terminalMessage
};
}
/**
* Run the shared exhaustion notification: emit `chat:recovery:exhausted`, then
* invoke the caller's `onExhausted` hook. A throwing hook is swallowed (and
* reported via `onError`) so it can NEVER prevent the caller from delivering
* terminal UX — a tested invariant in both packages. The terminal record /
* banner / submission writes that follow are intentionally package-owned (their
* ordering legitimately diverges), so they are NOT part of this helper.
*/
async function notifyChatRecoveryExhausted(ctx, hooks) {
hooks.emit(ctx);
try {
await hooks.onExhausted?.(ctx);
} catch (error) {
hooks.onError(error);
}
}
/**
* The complete give-up choreography from a single call: build the exhausted
* context, fire the shared notification ({@link notifyChatRecoveryExhausted}),
* then hand that context to the host's `terminalize` step. Folds the
* `buildChatRecoveryExhaustedContext` → `notifyChatRecoveryExhausted` → host
* terminalize sequence that every host's `_exhaustChatRecovery` repeated.
*
* What this OWNS (the invariant, so it cannot drift per host):
* - the notification ALWAYS runs before any terminal write, and
* - a throwing `onExhausted` can NEVER block terminal delivery — it is swallowed
* via `onError` (a tested invariant in both published packages).
*
* What it deliberately does NOT own: the terminal-record / broadcast /
* recovering-clear writes — their exact set diverges per host (both
* `AIChatAgent` and `Think` broadcast the banner first so it survives a storage
* write that rejects mid-deploy; `Think` additionally writes a submission row)
* — see {@link ChatRecoveryAdapter.exhaustChatRecovery}. The host expresses
* those writes inside `terminalize`. A `terminalize` that throws DOES propagate,
* so the whole give-up re-runs on a healthy isolate (#1730); see
* {@link ChatRecoveryEngine.exhaustRecoveryGiveUp}.
*
* `partialParts` is passed explicitly (not derived from a `RecoveryPartial`) so a
* foreign-vocabulary host can pass `[]` rather than fabricate AI-SDK parts — the
* engine seam stays parts-vocabulary-agnostic.
*/
async function runChatRecoveryExhaustion(input, hooks) {
const ctx = buildChatRecoveryExhaustedContext({
incident: input.incident,
config: input.config,
partialText: input.partialText,
partialParts: input.partialParts,
streamId: input.streamId,
createdAt: input.createdAt
});
await notifyChatRecoveryExhausted(ctx, {
emit: hooks.emit,
onExhausted: hooks.onExhausted,
onError: hooks.onError
});
await hooks.terminalize(ctx);
}
//#endregion
//#region src/chat/stall-watchdog.ts
/**
* Shared inactivity watchdog for UI-message streams.
*
* A model/transport stream can park indefinitely without ever throwing (a hung
* provider, a wedged transport). Left unguarded, the consumer read-loop waits
* forever. {@link iterateWithStallWatchdog} wraps such a stream so that a gap of
* `timeoutMs` between chunks aborts the upstream and throws
* {@link ChatStreamStalledError}, letting the consumer route the stall into
* bounded recovery (#1626) — a transient hang is retried within the existing
* recovery budget — while genuine in-band errors stay terminal.
*
* @internal Sibling-package support for `@cloudflare/ai-chat` and
* `@cloudflare/think`, not a public API. See
* `design/rfc-chat-recovery-foundation.md`.
*/
/**
* Thrown by {@link iterateWithStallWatchdog} when the inactivity watchdog fires
* (a model/transport stream that parks without ever throwing). Distinct from
* in-band model/stream errors so the read-loop catch can route a stall into
* bounded recovery (#1626) — a transient hang is retried within the existing
* recovery budget — while genuine errors stay terminal.
*/
var ChatStreamStalledError = class extends Error {
constructor(message) {
super(message);
this.isChatStreamStall = true;
this.name = "ChatStreamStalledError";
}
};
/**
* Wrap a UI-message stream with an inactivity watchdog. If no chunk arrives
* within `timeoutMs`, `onStall` runs (aborting the upstream model stream) and
* the iterator throws, so the consumer loop exits with a terminal error
* instead of parking forever on a hung provider/transport. `timeoutMs <= 0`
* passes the source through untouched.
*/
async function* iterateWithStallWatchdog(source, timeoutMs, onStall) {
if (!(timeoutMs > 0)) {
yield* source;
return;
}
const iterator = source[Symbol.asyncIterator]();
let selfAborted = false;
try {
while (true) {
let timer;
let stalled = false;
const stall = new Promise((_, reject) => {
timer = setTimeout(() => {
stalled = true;
reject(new ChatStreamStalledError(`Chat stream stalled: no activity for ${timeoutMs}ms; the turn was aborted by the stall watchdog.`));
}, timeoutMs);
});
const nextPromise = iterator.next();
nextPromise.catch(() => {});
let next;
try {
next = await Promise.race([nextPromise, stall]);
} catch (err) {
if (stalled) {
selfAborted = true;
onStall();
}
throw err;
} finally {
if (timer !== void 0) clearTimeout(timer);
}
if (next.done) return;
yield next.value;
}
} finally {
if (!selfAborted) await iterator.return?.(void 0).catch(() => {});
}
}
//#endregion
export { AGENT_TOOL_STREAM_PROGRESS_BUMP_THROTTLE_MS, AbortRegistry, AgentToolProgressEmitter, AgentToolStreamProgressThrottle, AutoContinuationController, CHAT_LAST_TERMINAL_KEY, CHAT_MESSAGE_TYPES, CHAT_RECOVERING_FLAG_TTL_MS, CHAT_RECOVERING_KEY, CHAT_RECOVERY_ALARM_DEBOUNCE_MS, CHAT_RECOVERY_INCIDENT_KEY_PREFIX, CHAT_RECOVERY_INCIDENT_TTL_MS, CHAT_RECOVERY_PROGRESS_KEY, CHAT_RECOVERY_STABLE_RETRY_DELAY_SECONDS, CHAT_STREAM_PROGRESS_CREDIT_THROTTLE_MS, ChatRecoveryEngine, ChatStreamStalledError, ContinuationState, DEFAULT_CHAT_RECOVERY_MAX_ATTEMPTS, DEFAULT_CHAT_RECOVERY_MAX_OOM_RETRIES, DEFAULT_CHAT_RECOVERY_MAX_WORK, DEFAULT_CHAT_RECOVERY_NO_PROGRESS_TIMEOUT_MS, DEFAULT_CHAT_RECOVERY_STABLE_TIMEOUT_MS, DEFAULT_CHAT_RECOVERY_TERMINAL_MESSAGE, KV_DELETE_MAX_KEYS, MAX_BOUND_PARAMS, MessageType, PreStreamTurns, ROW_MAX_BYTES, ResumableStream, ResumeHandshake, STREAM_CLEANUP_DELAY_SECONDS, STREAM_RESUME_NONE_REASONS, StreamAccumulator, StreamProgressCreditThrottle, SubmitConcurrencyController, TIMED_OUT, TurnQueue, aiSdkRecoveryCodec, applyAgentToolEvent, applyChunkToParts, applyToolUpdate, awaitWithDeadline, transition as broadcastTransition, buildChatRecoveringFrame, buildInClauseStrings, bumpChatRecoveryProgress, byteLength, chatRecoverySchedulePolicy, classifyAgentToolChildRecovery, cleanupStreamBuffers, clearChatTerminal, clientResolvableToolNames, createAgentToolEventState, createChatFiberSnapshot, createToolsFromClientSchemas, crossMessageToolResultUpdate, drainInteractionApplies, enforceRowSizeLimit, hasIncompleteToolBatch, interceptAgentToolBroadcast, isReplayChunk, iterateWithStallWatchdog, listActiveChatRecoveryIncidents, normalizeToolInput, parseProtocolMessage, partAwaitsClientInteraction, pausedExecutionUpdate, pendingChatTerminal, persistReconstructedOrphan, readChatRecoveryProgress, reconcileMessages, reconcileOrphanPartial, recordChatTerminal, repairInterruptedToolParts, resolveChatRecoveryConfig, resolveToolMergeId, runChatRecoveryExhaustion, sanitizeMessage, sendIfOpen, setChatRecovering, shouldCreditStreamProgress, sweepStaleChatRecoveryIncidents, toolApprovalUpdate, toolPartHasSettledResult, toolResultUpdate, unwrapChatFiberSnapshot, wrapChatFiberSnapshot };
//# sourceMappingURL=index.js.map