@andreprado/agentkit 0.1.0-alpha.10

package/src/runtime/targets/cloudflare/build.ts

@@ -0,0 +1,2517 @@
+import { createHash } from "node:crypto";
+import { mkdir, readFile, readdir, unlink, writeFile } from "node:fs/promises";
+import { dirname, extname, join, relative, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+import { build as esbuild, type Plugin } from "esbuild";
+
+import { loadAgentCapsule, type LoadedAgentCapsule } from "../../config";
+import { buildSharedAgentManifest, type ManifestSchema, type SharedAgentManifest } from "../../core/manifest";
+import { AgentKitError } from "../../errors";
+import { resolveKnowledgeConfig } from "../../knowledge/config";
+import { KNOWLEDGE_SCHEMA_SQL } from "../../knowledge/schema";
+
+export type BuildTarget = "cloudflare";
+
+export type AgentBuildResult = {
+  target: BuildTarget;
+  root: string;
+  buildDir: string;
+  manifestPath: string;
+  workerPath: string;
+  wranglerPath: string;
+  durableObjectSchemaPath: string;
+  tursoSchemaPath: string | null;
+  bundleSha256: string;
+  warnings: string[];
+};
+
+export type AgentManifest = {
+  schema_version: SharedAgentManifest["schema_version"];
+  name: SharedAgentManifest["name"];
+  runtime: "edge";
+  target: "cloudflare";
+  provider: SharedAgentManifest["provider"];
+  prompt: SharedAgentManifest["prompt"];
+  secrets: SharedAgentManifest["secrets"];
+  tools: SharedAgentManifest["tools"];
+  channels: SharedAgentManifest["channels"];
+  knowledge: SharedAgentManifest["knowledge"];
+  access: SharedAgentManifest["access"];
+  storage: {
+    driver: "agentkit";
+    database: SharedAgentManifest["storage"]["database"];
+    files:
+      | {
+          driver: "none";
+        }
+      | {
+          driver: "r2";
+          binding: "AGENTKIT_FILES";
+          bucket: string;
+          prefix: string;
+          maxUploadBytes: number;
+        };
+  };
+};
+
+export type AgentManifestWithBundle = AgentManifest & {
+  bundle: {
+    content_type: "application/javascript";
+    sha256: string;
+  };
+};
+
+const CLOUDFLARE_BUILD_DIR = ".agentkit/build/cloudflare";
+const AGENTKIT_BUILD_DIR = ".agentkit/build";
+const CLOUDFLARE_COMPATIBILITY_DATE = "2026-05-27";
+const CLOUDFLARE_COMPATIBILITY_FLAGS = ["nodejs_compat"] as const;
+const moduleDir = dirname(fileURLToPath(import.meta.url));
+
+export async function buildCloudflareAgentCapsule(
+  cwd = process.cwd(),
+): Promise<AgentBuildResult> {
+  const capsule = await loadAgentCapsule(cwd);
+  validateCloudflareBuild(capsule);
+  await assertEdgeCompatibleImports(capsule);
+
+  const tursoSchema = await loadTursoSchema(capsule);
+  const manifest = buildManifest(capsule, tursoSchema);
+  const warnings = buildWarnings(capsule);
+  const agentkitBuildDir = join(capsule.root, AGENTKIT_BUILD_DIR);
+  const cloudflareBuildDir = join(capsule.root, CLOUDFLARE_BUILD_DIR);
+  const manifestPath = join(agentkitBuildDir, "agent.manifest.json");
+  const workerEntryPath = join(cloudflareBuildDir, "worker.entry.ts");
+  const workerPath = join(cloudflareBuildDir, "worker.js");
+  const wranglerPath = join(cloudflareBuildDir, "wrangler.jsonc");
+  const durableObjectSchemaPath = join(cloudflareBuildDir, "durable-object-schema.sql");
+  const tursoSchemaPath = tursoSchema ? join(cloudflareBuildDir, "turso-schema.sql") : null;
+  const bundleConfig = await writeEdgeBundleConfig(capsule);
+
+  await mkdir(agentkitBuildDir, { recursive: true });
+  await mkdir(cloudflareBuildDir, { recursive: true });
+  try {
+    const workerEntrySource = renderCloudflareWorker({
+      manifest,
+      instructions: capsule.instructions,
+      configPath: bundleConfig.configPath,
+    });
+    await writeFile(workerEntryPath, workerEntrySource);
+    await bundleCloudflareWorker(workerEntryPath, workerPath, bundleConfig.shimPath);
+  } finally {
+    await Promise.all(bundleConfig.cleanupPaths.map((path) => unlink(path).catch(() => undefined)));
+  }
+
+  const workerSource = await readFile(workerPath, "utf8");
+  const bundleSha256 = sha256(workerSource);
+  const manifestWithBundle: AgentManifestWithBundle = {
+    ...manifest,
+    bundle: {
+      content_type: "application/javascript",
+      sha256: bundleSha256,
+    },
+  };
+
+  await writeFile(manifestPath, `${JSON.stringify(manifestWithBundle, null, 2)}\n`);
+  await writeFile(wranglerPath, renderWranglerConfig(capsule.config.name, manifest.storage.files));
+  await writeFile(durableObjectSchemaPath, renderDurableObjectSchema());
+  if (tursoSchemaPath && tursoSchema) {
+    await writeFile(tursoSchemaPath, tursoSchema.source);
+  }
+
+  return {
+    target: "cloudflare",
+    root: capsule.root,
+    buildDir: cloudflareBuildDir,
+    manifestPath,
+    workerPath,
+    wranglerPath,
+    durableObjectSchemaPath,
+    tursoSchemaPath,
+    bundleSha256,
+    warnings,
+  };
+}
+
+function validateCloudflareBuild(capsule: LoadedAgentCapsule): void {
+  if (capsule.config.runtime !== "edge") {
+    throw new AgentKitError(
+      "build_not_edge",
+      'Cloudflare deploy requires runtime: "edge" in agentkit.config.ts.',
+    );
+  }
+
+  if (capsule.config.storage.driver !== "agentkit") {
+    throw new AgentKitError(
+      "build_storage_driver",
+      'Cloudflare deploy requires storage.driver: "agentkit" so hosted state is managed by AgentKit Cloud.',
+    );
+  }
+
+  const knowledge = resolveKnowledgeConfig(capsule.config);
+
+  if (knowledge.enabled && capsule.config.storage.database?.driver !== "turso") {
+    throw new AgentKitError(
+      "build_knowledge_database",
+      'Cloudflare Knowledge deploy requires storage.database.driver: "turso" so chunks and retrieval state are available to the hosted runtime.',
+    );
+  }
+}
+
+function buildWarnings(capsule: LoadedAgentCapsule): string[] {
+  const warnings: string[] = [];
+
+  if (capsule.config.access.mode === "private") {
+    warnings.push(
+      "Private access requires setting AGENTKIT_PRIVATE_TOKEN as a Cloudflare secret before /chat accepts requests.",
+    );
+  }
+
+  if (capsule.config.storage.database?.driver === "turso") {
+    warnings.push(
+      "AgentKit Cloud will provision Turso and inject TURSO_DATABASE_URL/TURSO_AUTH_TOKEN; only --local-wrangler deploys must provide them manually.",
+    );
+  }
+
+  if (capsule.config.storage.files?.driver === "r2") {
+    warnings.push("R2 file storage requires the AGENTKIT_FILES binding in wrangler.jsonc to point at an existing bucket.");
+  }
+
+  return warnings;
+}
+
+function buildManifest(
+  capsule: LoadedAgentCapsule,
+  tursoSchema: ManifestSchema | null,
+): AgentManifest {
+  const shared = buildSharedAgentManifest(capsule, { databaseSchema: tursoSchema });
+
+  return {
+    schema_version: shared.schema_version,
+    name: shared.name,
+    runtime: "edge",
+    target: "cloudflare",
+    provider: shared.provider,
+    prompt: shared.prompt,
+    secrets: shared.secrets,
+    tools: shared.tools,
+    channels: shared.channels,
+    knowledge: shared.knowledge,
+    access: shared.access,
+    storage: {
+      driver: "agentkit",
+      database: shared.storage.database,
+      files: buildCloudflareFilesManifest(shared.storage.files),
+    },
+  };
+}
+
+function buildCloudflareFilesManifest(files: SharedAgentManifest["storage"]["files"]): AgentManifest["storage"]["files"] {
+  if (files.driver === "none") {
+    return { driver: "none" };
+  }
+
+  return {
+    driver: "r2",
+    binding: "AGENTKIT_FILES",
+    bucket: files.bucket,
+    prefix: files.prefix,
+    maxUploadBytes: files.maxUploadBytes,
+  };
+}
+
+async function loadTursoSchema(capsule: LoadedAgentCapsule): Promise<ManifestSchema | null> {
+  const database = capsule.config.storage.database;
+  const knowledge = resolveKnowledgeConfig(capsule.config);
+  const sources: string[] = [];
+
+  if (!database || database.driver !== "turso") {
+    return null;
+  }
+
+  if (database.schema) {
+    sources.push(await readFile(resolve(capsule.root, database.schema), "utf8"));
+  }
+
+  if (knowledge.enabled) {
+    sources.push(KNOWLEDGE_SCHEMA_SQL);
+  }
+
+  if (sources.length === 0) {
+    return null;
+  }
+
+  const source = sources.map((part) => part.trim()).filter(Boolean).join("\n\n") + "\n";
+  const digest = sha256(source);
+  return { source, sha256: digest };
+}
+
+const EDGE_INCOMPATIBLE_IMPORTS = new Map<string, string>([
+  ["bun:sqlite", "Use ctx.db inside tools instead of importing SQLite or Bun database APIs."],
+  ["node:fs", "Cloudflare Workers cannot read local files. Move static data into config, prompts, files, or a tool input."],
+  ["fs", "Cloudflare Workers cannot read local files. Move static data into config, prompts, files, or a tool input."],
+  ["node:path", "Cloudflare Workers do not provide Node path APIs in tool bundles. Avoid filesystem path logic in edge tools."],
+  ["path", "Cloudflare Workers do not provide Node path APIs in tool bundles. Avoid filesystem path logic in edge tools."],
+  ["node:net", "Cloudflare Workers cannot open raw TCP sockets from tools. Use fetch-compatible APIs."],
+  ["net", "Cloudflare Workers cannot open raw TCP sockets from tools. Use fetch-compatible APIs."],
+  ["node:child_process", "Cloudflare Workers cannot spawn local processes. Move this work to a local/container target."],
+  ["child_process", "Cloudflare Workers cannot spawn local processes. Move this work to a local/container target."],
+  ["better-sqlite3", "Use ctx.db inside tools instead of importing native database clients."],
+  ["sqlite3", "Use ctx.db inside tools instead of importing native database clients."],
+  ["libsql", "Use ctx.db inside tools so AgentKit can route local SQLite and hosted Turso consistently."],
+  ["@libsql/client", "Use ctx.db inside tools so AgentKit can route local SQLite and hosted Turso consistently."],
+]);
+
+async function assertEdgeCompatibleImports(capsule: LoadedAgentCapsule): Promise<void> {
+  const files = await listSourceFiles(capsule.root);
+
+  for (const file of files) {
+    const source = await readFile(file, "utf8");
+
+    for (const specifier of findImportSpecifiers(source)) {
+      const guidance = edgeImportGuidance(specifier);
+
+      if (!guidance) {
+        continue;
+      }
+
+      throw new AgentKitError(
+        "edge_incompatible_import",
+        [
+          `Cloudflare build cannot include import "${specifier}" from ${relative(capsule.root, file)}.`,
+          `Target runtime: cloudflare.`,
+          guidance,
+        ].join(" "),
+      );
+    }
+  }
+}
+
+async function listSourceFiles(root: string): Promise<string[]> {
+  const entries = await readdir(root, { withFileTypes: true });
+  const files: string[] = [];
+
+  for (const entry of entries) {
+    if (entry.name === "node_modules" || entry.name === ".agentkit" || entry.name === ".git") {
+      continue;
+    }
+
+    const path = join(root, entry.name);
+
+    if (entry.isDirectory()) {
+      files.push(...(await listSourceFiles(path)));
+      continue;
+    }
+
+    if (entry.isFile() && [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"].includes(extname(entry.name))) {
+      files.push(path);
+    }
+  }
+
+  return files.sort();
+}
+
+function findImportSpecifiers(source: string): string[] {
+  const specifiers: string[] = [];
+  const patterns = [
+    /\bimport\s+(?:type\s+)?(?:[^"'()]*?\s+from\s+)?["']([^"']+)["']/g,
+    /\bexport\s+[^"'()]*?\s+from\s+["']([^"']+)["']/g,
+    /\brequire\(\s*["']([^"']+)["']\s*\)/g,
+    /\bimport\(\s*["']([^"']+)["']\s*\)/g,
+  ];
+
+  for (const pattern of patterns) {
+    for (const match of source.matchAll(pattern)) {
+      if (match[1]) {
+        specifiers.push(match[1]);
+      }
+    }
+  }
+
+  return specifiers;
+}
+
+function edgeImportGuidance(specifier: string): string | null {
+  if (EDGE_INCOMPATIBLE_IMPORTS.has(specifier)) {
+    return EDGE_INCOMPATIBLE_IMPORTS.get(specifier) ?? null;
+  }
+
+  for (const [blocked, guidance] of EDGE_INCOMPATIBLE_IMPORTS) {
+    if (specifier === blocked || specifier.startsWith(`${blocked}/`)) {
+      return guidance;
+    }
+  }
+
+  return null;
+}
+
+async function writeEdgeBundleConfig(
+  capsule: LoadedAgentCapsule,
+): Promise<{ configPath: string; shimPath: string; cleanupPaths: string[] }> {
+  const source = await readFile(capsule.configPath, "utf8");
+  const suffix = `${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  const shimPath = join(dirname(capsule.configPath), `.agentkit.edge-shim-${suffix}.ts`);
+  const bundleConfigPath = join(dirname(capsule.configPath), `.agentkit.config.edge-bundle-${suffix}.ts`);
+  const localAgentKitPath = resolve(moduleDir, "../../../index.ts");
+  const shimImport = JSON.stringify(`./${relative(dirname(capsule.configPath), shimPath)}`);
+  const patchedSource = source
+    .replace(
+      /from\s+(["'])file:\/\/([^"']+)\1/g,
+      (_match, quote: string, path: string) => `from ${quote}${decodeURIComponent(path)}${quote}`,
+    )
+    .replace(/from\s+["']@andreprado\/agentkit["']/g, `from ${shimImport}`)
+    .replace(
+      new RegExp(`from\\s+["']${escapeRegExp(localAgentKitPath)}["']`, "g"),
+      `from ${shimImport}`,
+    );
+
+  await writeFile(shimPath, renderEdgeShim());
+  await writeFile(bundleConfigPath, patchedSource);
+  return { configPath: bundleConfigPath, shimPath, cleanupPaths: [bundleConfigPath, shimPath] };
+}
+
+function renderEdgeShim(): string {
+  return `export function defineAgent(config) {
+  return config;
+}
+
+export function defineTool(tool) {
+  return tool;
+}
+
+export function websiteChannel(input) {
+  return {
+    type: "website",
+    provider: "agentkit",
+    name: input.name,
+    access: input.access ?? { mode: "token" },
+    secrets: normalizeChannelSecrets(input.secrets ?? ["AGENTKIT_WEBSITE_CHANNEL_TOKEN"], "website channel"),
+    ...(input.limits ? { limits: input.limits } : {}),
+    ...(input.buffer ? { buffer: normalizeChannelBuffer(input.buffer, "website channel") } : {}),
+  };
+}
+
+export function telegramChannel(input) {
+  return {
+    type: "telegram",
+    provider: "telegram",
+    name: input.name,
+    secrets: normalizeChannelSecrets(input.secrets ?? ["TELEGRAM_BOT_TOKEN", "TELEGRAM_WEBHOOK_SECRET"], "telegram channel"),
+    allowedUpdates: input.allowedUpdates ?? ["message"],
+    ...(input.limits ? { limits: input.limits } : {}),
+    ...(input.buffer ? { buffer: normalizeChannelBuffer(input.buffer, "telegram channel") } : {}),
+  };
+}
+
+export function whatsappChannel(input) {
+  return {
+    type: "whatsapp",
+    provider: input.provider,
+    name: input.name,
+    secrets: normalizeChannelSecrets(input.secrets ?? defaultWhatsappChannelSecrets(input.provider), \`\${input.provider} whatsapp channel\`),
+    ...(input.limits ? { limits: input.limits } : {}),
+    ...(input.buffer ? { buffer: normalizeChannelBuffer(input.buffer, \`\${input.provider} whatsapp channel\`) } : {}),
+  };
+}
+
+function defaultWhatsappChannelSecrets(provider) {
+  if (provider === "zapster") {
+    return ["ZAPSTER_API_KEY", "ZAPSTER_INSTANCE_ID", "ZAPSTER_WEBHOOK_ID"];
+  }
+
+  return ["META_WHATSAPP_ACCESS_TOKEN", "META_WHATSAPP_APP_SECRET", "META_WHATSAPP_VERIFY_TOKEN"];
+}
+
+function normalizeChannelSecrets(secrets, context) {
+  const uniqueSecrets = new Set();
+
+  for (const secret of secrets) {
+    if (!/^[A-Z_][A-Z0-9_]*$/.test(secret)) {
+      throw new Error(\`\${context} secrets must be environment variable names, not secret values.\`);
+    }
+
+    uniqueSecrets.add(secret);
+  }
+
+  return Array.from(uniqueSecrets).sort();
+}
+
+function normalizeChannelBuffer(input, context) {
+  if (input.mode === "off") {
+    return { mode: "off" };
+  }
+
+  if (input.mode !== undefined && input.mode !== "debounce") {
+    throw new Error(\`\${context} buffer.mode must be "off" or "debounce".\`);
+  }
+
+  const buffer = {
+    mode: "debounce",
+    quietWindowMs: input.quietWindowMs ?? 2500,
+    maxWaitMs: input.maxWaitMs ?? 12000,
+    maxMessages: input.maxMessages ?? 20,
+    maxChars: input.maxChars ?? 8000,
+  };
+
+  for (const field of ["quietWindowMs", "maxWaitMs", "maxMessages", "maxChars"]) {
+    if (!Number.isInteger(buffer[field]) || buffer[field] <= 0) {
+      throw new Error(\`\${context} buffer.\${field} must be a positive integer.\`);
+    }
+  }
+
+  if (buffer.maxWaitMs < buffer.quietWindowMs) {
+    throw new Error(\`\${context} buffer.maxWaitMs must be greater than or equal to buffer.quietWindowMs.\`);
+  }
+
+  return buffer;
+}
+`;
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+async function bundleCloudflareWorker(entryPath: string, workerPath: string, edgeShimPath: string): Promise<void> {
+  const localAgentKitPath = resolve(moduleDir, "../../../index.ts");
+  const localAgentKitFileUrl = pathToFileURL(localAgentKitPath).href;
+  const localAgentKitImportPattern = new RegExp(
+    `^(?:${escapeRegExp(localAgentKitPath)}|${escapeRegExp(localAgentKitFileUrl)})$`,
+  );
+
+  try {
+    const result = await esbuild({
+      entryPoints: [entryPath],
+      bundle: true,
+      platform: "browser",
+      format: "esm",
+      target: "es2022",
+      external: ["cloudflare:workers"],
+      minify: true,
+      write: false,
+      logLevel: "silent",
+      plugins: [
+        {
+          name: "agentkit-edge-shim",
+          setup(build) {
+            build.onResolve({ filter: /^@andreprado\/agentkit$/ }, () => ({
+              path: edgeShimPath,
+            }));
+            build.onResolve({ filter: localAgentKitImportPattern }, () => ({
+              path: edgeShimPath,
+            }));
+          },
+        } satisfies Plugin,
+      ],
+    });
+
+    const output = result.outputFiles?.[0];
+
+    if (!output) {
+      throw new Error("No bundle was emitted.");
+    }
+
+    const processShim = "var process = globalThis.process ?? (globalThis.process = { env: {}, versions: {} });\n";
+    await writeFile(workerPath, processShim + output.text);
+  } catch (error) {
+    throw new AgentKitError(
+      "edge_bundle_failed",
+      `Could not bundle Agent Capsule for Cloudflare Workers. ${formatBuildError(error)}`,
+      { cause: error },
+    );
+  }
+}
+
+function formatBuildError(error: unknown): string {
+  if (error && typeof error === "object" && "errors" in error && Array.isArray(error.errors)) {
+    const messages = error.errors.map((log) => String(log?.text ?? log?.message ?? "")).filter(Boolean);
+    if (messages.length > 0) {
+      return messages.join("\n");
+    }
+  }
+
+  return error instanceof Error ? error.message : String(error);
+}
+
+function renderCloudflareWorker(input: { manifest: AgentManifest; instructions: string; configPath: string }): string {
+  const manifestJson = JSON.stringify(input.manifest, null, 2);
+  const instructionsJson = JSON.stringify(input.instructions);
+  const configImportPath = JSON.stringify(input.configPath);
+  const providerImportPath = JSON.stringify(resolve(moduleDir, "../../../providers/index.ts"));
+
+  return `import { DurableObject } from "cloudflare:workers";
+import agentConfig from ${configImportPath};
+import { getProviderAdapter } from ${providerImportPath};
+
+const manifest = ${manifestJson};
+const instructions = ${instructionsJson};
+const hostedKnowledgeTool = manifest.knowledge.enabled ? createHostedKnowledgeSearchTool() : null;
+const hostedTools = hostedKnowledgeTool ? [hostedKnowledgeTool, ...(agentConfig.tools ?? [])] : (agentConfig.tools ?? []);
+const DEFAULT_TOOL_TIMEOUT_MS = 30000;
+
+export class AgentKitConversationStore extends DurableObject {
+  constructor(ctx, env) {
+    super(ctx, env);
+    this.sql = ctx.storage.sql;
+    this.sql.exec(\`
+      CREATE TABLE IF NOT EXISTS conversations (
+        id TEXT PRIMARY KEY,
+        agent_name TEXT NOT NULL,
+        title TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS messages (
+        id TEXT PRIMARY KEY,
+        conversation_id TEXT NOT NULL,
+        role TEXT NOT NULL,
+        content TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS runs (
+        id TEXT PRIMARY KEY,
+        conversation_id TEXT NOT NULL,
+        provider TEXT NOT NULL,
+        model TEXT NOT NULL,
+        status TEXT NOT NULL,
+        error_code TEXT,
+        error_message TEXT,
+        created_at TEXT NOT NULL,
+        completed_at TEXT
+      );
+      CREATE TABLE IF NOT EXISTS tool_calls (
+        id TEXT PRIMARY KEY,
+        run_id TEXT NOT NULL,
+        conversation_id TEXT NOT NULL,
+        tool_name TEXT NOT NULL,
+        visibility TEXT NOT NULL,
+        status TEXT NOT NULL,
+        input_json TEXT NOT NULL,
+        output_json TEXT,
+        error_message TEXT,
+        created_at TEXT NOT NULL,
+        completed_at TEXT
+      );
+    \`);
+  }
+
+  async fetch(request) {
+    const url = new URL(request.url);
+
+    if (request.method === "POST" && url.pathname === "/messages") {
+      return this.persistMessages(await request.json());
+    }
+
+    if (request.method === "GET" && url.pathname === "/messages") {
+      return this.getMessages(url.searchParams.get("conversationId"));
+    }
+
+    return Response.json({ error: { code: "not_found", message: "Unknown Durable Object route." } }, { status: 404 });
+  }
+
+  getMessages(conversationId) {
+    if (!conversationId) {
+      return Response.json({ messages: [] });
+    }
+
+    const rows = this.sql.exec(
+      "SELECT role, content FROM messages WHERE conversation_id = ? ORDER BY rowid ASC",
+      String(conversationId),
+    ).toArray();
+
+    return Response.json({
+      messages: rows
+        .filter((row) => row.role === "user" || row.role === "assistant")
+        .map((row) => ({
+          role: String(row.role),
+          content: String(row.content),
+        })),
+    });
+  }
+
+  persistMessages(input) {
+    const now = new Date().toISOString();
+    const conversationId = String(input.conversationId || crypto.randomUUID());
+    const runId = crypto.randomUUID();
+    const userMessageId = crypto.randomUUID();
+    const assistantMessageId = crypto.randomUUID();
+    const title = titleFromMessage(String(input.userMessage || ""));
+
+    this.sql.exec(
+      "INSERT OR IGNORE INTO conversations (id, agent_name, title, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",
+      conversationId,
+      manifest.name,
+      title,
+      now,
+      now,
+    );
+    this.sql.exec("UPDATE conversations SET updated_at = ? WHERE id = ?", now, conversationId);
+    this.sql.exec(
+      "INSERT INTO messages (id, conversation_id, role, content, created_at) VALUES (?, ?, ?, ?, ?)",
+      userMessageId,
+      conversationId,
+      "user",
+      String(input.userMessage || ""),
+      now,
+    );
+    this.sql.exec(
+      "INSERT INTO runs (id, conversation_id, provider, model, status, error_code, error_message, created_at, completed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+      runId,
+      conversationId,
+      manifest.provider.name,
+      manifest.provider.model,
+      String(input.status || "completed"),
+      input.errorCode ? String(input.errorCode) : null,
+      input.errorMessage ? String(input.errorMessage) : null,
+      now,
+      now,
+    );
+
+    if (input.assistantMessage !== undefined) {
+      this.sql.exec(
+        "INSERT INTO messages (id, conversation_id, role, content, created_at) VALUES (?, ?, ?, ?, ?)",
+        assistantMessageId,
+        conversationId,
+        "assistant",
+        String(input.assistantMessage || ""),
+        now,
+      );
+    }
+
+    for (const toolCall of input.toolCalls || []) {
+      this.sql.exec(
+        "INSERT INTO tool_calls (id, run_id, conversation_id, tool_name, visibility, status, input_json, output_json, error_message, created_at, completed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+        String(toolCall.id || crypto.randomUUID()),
+        runId,
+        conversationId,
+        String(toolCall.name || ""),
+        String(toolCall.visibility || "user"),
+        String(toolCall.status || "completed"),
+        JSON.stringify(toolCall.input ?? {}),
+        toolCall.output === undefined ? null : JSON.stringify(toolCall.output),
+        toolCall.errorMessage ? String(toolCall.errorMessage) : null,
+        now,
+        now,
+      );
+    }
+
+    return Response.json({
+      conversationId,
+      runId,
+      userMessageId,
+      assistantMessageId: input.assistantMessage === undefined ? null : assistantMessageId,
+    });
+  }
+}
+
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+
+    if (request.method === "GET" && url.pathname === "/_agentkit") {
+      const auth = authorizeAdmin(request, env);
+
+      if (auth) {
+        return auth;
+      }
+
+      return Response.json({
+        agent: manifest.name,
+        runtime: manifest.runtime,
+        target: manifest.target,
+        provider: manifest.provider,
+        prompt: manifest.prompt,
+        tools: manifest.tools.map((tool) => tool.name),
+        channels: manifest.channels.map((channel) => ({
+          name: channel.name,
+          type: channel.type,
+          provider: channel.provider,
+          secrets: channel.secrets,
+        })),
+        knowledge: manifest.knowledge,
+        access: manifest.access,
+        storage: manifest.storage,
+        database: inspectHostedDatabase(),
+        secrets: Object.fromEntries(manifest.secrets.map((name) => [name, env[name] ? "set" : "missing"])),
+        managedSecrets: hostedManagedSecrets(),
+        userSecrets: manifest.secrets.filter((name) => !hostedManagedSecrets().includes(name)),
+      });
+    }
+
+    if (request.method === "GET" && url.pathname === "/") {
+      return Response.json({
+        agent: manifest.name,
+        status: "ready",
+        inspect: "/_agentkit",
+        chat: "/chat",
+      });
+    }
+
+    if (request.method === "GET" && url.pathname === "/health") {
+      return Response.json({ status: "ok", agent: manifest.name });
+    }
+
+    if (isHostedChannelWebhookPath(url.pathname)) {
+      return forwardHostedChannelWebhook(request, env, url);
+    }
+
+    if (request.method === "POST" && (url.pathname === "/chat" || url.pathname === "/v1/chat")) {
+      return handleChat(request, env);
+    }
+
+    if (request.method === "POST" && url.pathname.startsWith("/tools/")) {
+      return handleTool(request, env, decodeURIComponent(url.pathname.slice("/tools/".length)));
+    }
+
+    if (request.method === "GET" && url.pathname === "/_agentkit/turso/health") {
+      return handleTursoHealth(request, env);
+    }
+
+    if (request.method === "POST" && url.pathname === "/_agentkit/turso/query") {
+      return handleTursoQuery(request, env);
+    }
+
+    if (url.pathname.startsWith("/files/")) {
+      return handleFile(request, env, url.pathname.slice("/files/".length));
+    }
+
+    return Response.json({ error: { code: "not_found", message: "Unknown AgentKit route." } }, { status: 404 });
+  },
+};
+
+function isHostedChannelWebhookPath(pathname) {
+  return (
+    /^\\/channels\\/[^/]+\\/(?:website|telegram)\\/webhook$/.test(pathname) ||
+    /^\\/channels\\/[^/]+\\/whatsapp\\/(?:zapster|meta)\\/webhook$/.test(pathname)
+  );
+}
+
+async function forwardHostedChannelWebhook(request, env, url) {
+  if (!env.AGENTKIT_CLOUD_API_URL) {
+    return Response.json(
+      {
+        error: {
+          code: "channel_webhook_proxy_not_configured",
+          message: "Hosted channel webhooks require AGENTKIT_CLOUD_API_URL on the deployed Worker.",
+        },
+      },
+      { status: 501 },
+    );
+  }
+
+  const target = new URL(\`\${url.pathname}\${url.search}\`, env.AGENTKIT_CLOUD_API_URL);
+  const headers = new Headers(request.headers);
+  headers.delete("host");
+  headers.delete("content-length");
+
+  if (env.AGENTKIT_DEPLOY_ID) {
+    headers.set("X-AgentKit-Deploy-ID", env.AGENTKIT_DEPLOY_ID);
+  }
+
+  if (env.AGENTKIT_RUNTIME_GATE_TOKEN) {
+    headers.set("X-AgentKit-Runtime-Gate", env.AGENTKIT_RUNTIME_GATE_TOKEN);
+  }
+
+  return fetch(target.href, {
+    method: request.method,
+    headers,
+    body: request.method === "GET" || request.method === "HEAD" ? undefined : request.body,
+    redirect: "manual",
+  });
+}
+
+async function handleTursoHealth(request, env) {
+  const auth = authorizeAdmin(request, env);
+
+  if (auth) {
+    return auth;
+  }
+
+  const configError = requireTurso(env);
+
+  if (configError) {
+    return configError;
+  }
+
+  const response = await fetch(toTursoBaseUrl(env.TURSO_DATABASE_URL) + "/health", {
+    headers: {
+      Authorization: \`Bearer \${env.TURSO_AUTH_TOKEN}\`,
+    },
+  });
+
+  return Response.json({
+    driver: "turso",
+    ok: response.ok,
+    status: response.status,
+  }, { status: response.ok ? 200 : 502 });
+}
+
+async function handleTursoQuery(request, env) {
+  const auth = authorizeAdmin(request, env);
+
+  if (auth) {
+    return auth;
+  }
+
+  const configError = requireTurso(env);
+
+  if (configError) {
+    return configError;
+  }
+
+  let body;
+
+  try {
+    body = await request.json();
+  } catch {
+    return Response.json(
+      { error: { code: "validation_error", message: "Expected JSON body with sql and optional args fields." } },
+      { status: 400 },
+    );
+  }
+
+  const sql = String(body.sql || "").trim();
+
+  if (!sql) {
+    return Response.json({ error: { code: "validation_error", message: "sql must be non-empty." } }, { status: 400 });
+  }
+
+  const args = Array.isArray(body.args) ? body.args : [];
+  try {
+    const result = await executeTursoSql(env, sql, args);
+    return Response.json(result);
+  } catch (error) {
+    return hostedErrorResponse(error);
+  }
+}
+
+async function handleFile(request, env, rawKey) {
+  const auth = authorizeAdmin(request, env);
+
+  if (auth) {
+    return auth;
+  }
+
+  if (manifest.storage.files.driver !== "r2") {
+    return Response.json({ error: { code: "files_not_configured", message: "R2 files are not configured." } }, { status: 404 });
+  }
+
+  if (!env.AGENTKIT_FILES) {
+    return Response.json(
+      { error: { code: "deploy_not_ready", message: "AGENTKIT_FILES R2 binding is not configured." } },
+      { status: 503 },
+    );
+  }
+
+  const key = objectKey(rawKey);
+
+  if (!key) {
+    return Response.json({ error: { code: "validation_error", message: "file key must be non-empty." } }, { status: 400 });
+  }
+
+  if (request.method === "PUT" || request.method === "POST") {
+    const contentLengthHeader = request.headers.get("content-length");
+
+    if (contentLengthHeader === null) {
+      return Response.json(
+        { error: { code: "length_required", message: "File upload requires content-length." } },
+        { status: 411 },
+      );
+    }
+
+    const contentLength = Number(contentLengthHeader);
+
+    if (!Number.isFinite(contentLength) || contentLength < 0) {
+      return Response.json(
+        { error: { code: "validation_error", message: "content-length must be a valid non-negative number." } },
+        { status: 400 },
+      );
+    }
+
+    if (contentLength > manifest.storage.files.maxUploadBytes) {
+      return Response.json(
+        { error: { code: "payload_too_large", message: "File exceeds configured maxUploadBytes." } },
+        { status: 413 },
+      );
+    }
+
+    const body = await request.arrayBuffer();
+
+    if (body.byteLength > manifest.storage.files.maxUploadBytes) {
+      return Response.json(
+        { error: { code: "payload_too_large", message: "File exceeds configured maxUploadBytes." } },
+        { status: 413 },
+      );
+    }
+
+    await env.AGENTKIT_FILES.put(key, body, {
+      httpMetadata: {
+        contentType: request.headers.get("content-type") || "application/octet-stream",
+      },
+      customMetadata: {
+        agent: manifest.name,
+      },
+    });
+
+    return Response.json({ key, bucket: manifest.storage.files.bucket });
+  }
+
+  if (request.method === "GET") {
+    const object = await env.AGENTKIT_FILES.get(key);
+
+    if (!object) {
+      return Response.json({ error: { code: "not_found", message: "File not found." } }, { status: 404 });
+    }
+
+    const headers = new Headers();
+    object.writeHttpMetadata(headers);
+    headers.set("etag", object.httpEtag);
+    return new Response(object.body, { headers });
+  }
+
+  if (request.method === "DELETE") {
+    await env.AGENTKIT_FILES.delete(key);
+    return Response.json({ key, deleted: true });
+  }
+
+  return Response.json({ error: { code: "method_not_allowed", message: "Unsupported file method." } }, { status: 405 });
+}
+
+async function handleTool(request, env, toolName) {
+  const auth = authorizeAdmin(request, env);
+
+  if (auth) {
+    return auth;
+  }
+
+  let body;
+
+  try {
+    body = await request.json();
+  } catch {
+    return Response.json(
+      { error: { code: "validation_error", message: "Expected JSON body with optional input field." } },
+      { status: 400 },
+    );
+  }
+
+  try {
+    const result = await executeHostedTool({
+      name: toolName,
+      input: isRecord(body) && "input" in body ? body.input : body ?? {},
+      env,
+      signal: request.signal,
+      invocation: "tool",
+    });
+
+    return Response.json({
+      tool: {
+        id: result.id,
+        name: result.name,
+        visibility: result.visibility,
+      },
+      input: result.input,
+      output: result.output,
+    });
+  } catch (error) {
+    return hostedErrorResponse(error);
+  }
+}
+
+async function handleChat(request, env) {
+  let body;
+
+  try {
+    body = await request.json();
+  } catch {
+    return Response.json(
+      { error: { code: "validation_error", message: "Expected JSON body with a message field." } },
+      { status: 400 },
+    );
+  }
+
+  const auth = await authorizeChat(request, env, body);
+
+  if (auth) {
+    return auth;
+  }
+
+  const message = readChatMessage(body);
+
+  if (!message) {
+    return Response.json(
+      { error: { code: "validation_error", message: "message must be a non-empty string." } },
+      { status: 400 },
+    );
+  }
+
+  let conversationId;
+
+  try {
+    conversationId = normalizeConversationId(body.conversationId) ?? crypto.randomUUID();
+  } catch (error) {
+    return hostedErrorResponse(error);
+  }
+
+  const previousMessages = await loadConversationMessages(env, conversationId).catch(() => []);
+  let content;
+  const toolCalls = [];
+
+  const toolRequest = parseToolRequest(message);
+
+  if (toolRequest) {
+    try {
+      const toolResult = await executeHostedTool({
+        name: toolRequest.name,
+        input: toolRequest.input,
+        env,
+        signal: request.signal,
+        invocation: "chat",
+      });
+      toolCalls.push(toolResult);
+      content =
+        toolResult.visibility === "internal"
+          ? \`Tool \${toolResult.name}: completed\`
+          : \`Tool \${toolResult.name}: \${JSON.stringify(toolResult.output)}\`;
+    } catch (error) {
+      await persistFailure(env, conversationId, message, error);
+      return hostedErrorResponse(error);
+    }
+  }
+
+  if (content === undefined) {
+    try {
+      content = await callHostedProvider(env, [...previousMessages, { role: "user", content: message }], request.signal);
+    } catch (error) {
+      await persistFailure(env, conversationId, message, error);
+      return hostedErrorResponse(error);
+    }
+  }
+
+  const persisted = await persist(env, {
+    conversationId,
+    userMessage: message,
+    assistantMessage: content,
+    toolCalls,
+  });
+
+  return Response.json({
+    message: {
+      role: "assistant",
+      content,
+    },
+    ...persisted,
+  });
+}
+
+function readChatMessage(body) {
+  if (typeof body.message === "string") {
+    return body.message.trim();
+  }
+
+  if (body.message && typeof body.message === "object" && body.message.role === "user" && typeof body.message.content === "string") {
+    return body.message.content.trim();
+  }
+
+  return "";
+}
+
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+async function callHostedProvider(env, messages, signal) {
+  const adapter = getProviderAdapter(manifest.provider);
+  const result = await adapter.run({
+    agent: {
+      name: manifest.name,
+      runtime: manifest.runtime,
+      provider: manifest.provider,
+    },
+    instructions: withToolVisibilityInstructions(appendHostedKnowledgePromptPolicy(instructions), hostedTools),
+    messages,
+    tools: hostedTools,
+    toolRuntime: createHostedProviderToolRuntime(env, signal),
+    env,
+    signal,
+  });
+
+  return result.message.content;
+}
+
+function appendHostedKnowledgePromptPolicy(baseInstructions) {
+  if (!manifest.knowledge.enabled) {
+    return baseInstructions;
+  }
+
+  return \`\${baseInstructions.trimEnd()}
+
+Knowledge rules:
+- Use agentkit_search_knowledge before answering business-specific factual questions about the user's documents, policies, prices, availability, services, procedures, or source-specific claims.
+- Do not invent prices, policies, legal/clinical claims, availability, or source-specific facts when Knowledge has not returned support for the answer.
+- Use retrieved Knowledge as context for the final answer, but do not expose raw retrieval JSON, scores, chunk IDs, or internal tool output objects to the user.
+\`;
+}
+
+function withToolVisibilityInstructions(baseInstructions, tools) {
+  const internalTools = tools
+    .filter((tool) => tool.visibility === "internal")
+    .map((tool) => tool.name)
+    .sort();
+
+  if (internalTools.length === 0) {
+    return baseInstructions;
+  }
+
+  return \`\${baseInstructions.trimEnd()}
+
+Tool visibility rules:
+- Tool outputs marked internal are operational state for the agent, not user-facing content.
+- Use internal outputs to decide what to do next, but do not reveal raw internal labels, scores, statuses, JSON fields, or tool output objects to the user.
+- Internal tools: \${internalTools.join(", ")}.
+\`;
+}
+
+function createHostedKnowledgeSearchTool() {
+  return {
+    name: manifest.knowledge.internalTool || "agentkit_search_knowledge",
+    description: "Search the Agent Capsule's configured Knowledge sources for business-specific facts.",
+    visibility: "internal",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: { type: "string" },
+        topK: { type: "integer" },
+      },
+      required: ["query"],
+      additionalProperties: false,
+    },
+    outputSchema: {
+      type: "object",
+      properties: {
+        results: {
+          type: "array",
+          items: {
+            type: "object",
+            properties: {
+              content: { type: "string" },
+              score: { type: "number" },
+              source: { type: "object" },
+            },
+            required: ["content", "score", "source"],
+          },
+        },
+      },
+      required: ["results"],
+      additionalProperties: false,
+    },
+    secrets: manifest.knowledge.embedding.secret ? [manifest.knowledge.embedding.secret] : [],
+    async execute(input, ctx) {
+      const query = typeof input?.query === "string" ? input.query : "";
+      const topK = normalizeKnowledgeTopK(input?.topK ?? manifest.knowledge.retrieval.topK);
+      const results = await searchHostedKnowledge(ctx.database, query, topK, ctx.secrets ?? {});
+
+      return {
+        results: results.map((result) => ({
+          content: result.content,
+          score: result.score,
+          source: result.source,
+        })),
+      };
+    },
+  };
+}
+
+async function searchHostedKnowledge(database, query, topK, secrets) {
+  const normalizedQuery = String(query || "").trim();
+
+  if (!normalizedQuery) {
+    throw agentKitError("knowledge_query_invalid", "Knowledge search query must be a non-empty string.");
+  }
+
+  const hasEmbeddingProvider = manifest.knowledge.embedding.provider !== "none";
+  const lexical =
+    manifest.knowledge.retrieval.hybrid || !hasEmbeddingProvider
+      ? await searchHostedKnowledgeLexical(database, normalizedQuery, Math.max(topK * 4, topK))
+      : [];
+  const semantic = hasEmbeddingProvider
+    ? await searchHostedKnowledgeSemantic(database, normalizedQuery, topK * 4, secrets)
+    : [];
+
+  return combineHostedKnowledgeResults(lexical, semantic, topK);
+}
+
+async function searchHostedKnowledgeLexical(database, query, limit) {
+  const tokens = hostedKnowledgeQueryTokens(query);
+
+  if (tokens.length === 0) {
+    return [];
+  }
+
+  try {
+    const result = await database.query(
+      \`
+      SELECT
+        c.id AS chunk_id,
+        c.source_id AS source_id,
+        c.content AS content,
+        c.title AS title,
+        c.section AS section,
+        c.locator AS locator,
+        s.source_key AS source_key,
+        rank
+      FROM agentkit_knowledge_fts
+      JOIN agentkit_knowledge_chunks c ON c.id = agentkit_knowledge_fts.chunk_id
+      JOIN agentkit_knowledge_sources s ON s.id = c.source_id
+      WHERE agentkit_knowledge_fts MATCH ?
+      ORDER BY rank ASC
+      LIMIT ?
+    \`,
+      [tokens.map((token) => \`"\${token.replace(/"/g, '""')}"\`).join(" OR "), limit],
+    );
+
+    return result.rows.map((row, index) => hostedKnowledgeResultFromRow(row, hostedLexicalScore(index), null));
+  } catch {
+    return searchHostedKnowledgeLexicalFallback(database, query, limit);
+  }
+}
+
+async function searchHostedKnowledgeLexicalFallback(database, query, limit) {
+  const like = \`%\${query.toLowerCase()}%\`;
+  const result = await database.query(
+    \`
+    SELECT
+      c.id AS chunk_id,
+      c.source_id AS source_id,
+      c.content AS content,
+      c.title AS title,
+      c.section AS section,
+      c.locator AS locator,
+      s.source_key AS source_key
+    FROM agentkit_knowledge_chunks c
+    JOIN agentkit_knowledge_sources s ON s.id = c.source_id
+    WHERE lower(c.content) LIKE ?
+      OR lower(COALESCE(c.title, '')) LIKE ?
+      OR lower(COALESCE(c.section, '')) LIKE ?
+    ORDER BY c.created_at DESC, c.ordinal ASC
+    LIMIT ?
+  \`,
+    [like, like, like, limit],
+  );
+
+  return result.rows.map((row, index) => hostedKnowledgeResultFromRow(row, hostedLexicalScore(index), null));
+}
+
+async function searchHostedKnowledgeSemantic(database, query, limit, secrets) {
+  const queryEmbedding = await createHostedKnowledgeEmbedding(query, secrets);
+
+  if (!queryEmbedding) {
+    return [];
+  }
+
+  try {
+    return await searchHostedKnowledgeNativeVector(database, queryEmbedding, limit);
+  } catch {
+    return searchHostedKnowledgeSemanticFallback(database, queryEmbedding, limit);
+  }
+}
+
+async function searchHostedKnowledgeNativeVector(database, queryEmbedding, limit) {
+  const vector = JSON.stringify(queryEmbedding);
+  const result = await database.query(
+    \`
+    SELECT
+      c.id AS chunk_id,
+      c.source_id AS source_id,
+      c.content AS content,
+      c.title AS title,
+      c.section AS section,
+      c.locator AS locator,
+      s.source_key AS source_key,
+      vector_distance_cos(v.embedding, vector32(?)) AS vector_distance
+    FROM vector_top_k('agentkit_knowledge_vectors_embedding_idx', vector32(?), ?) nearest
+    JOIN agentkit_knowledge_vectors v ON v.id = nearest.id
+    JOIN agentkit_knowledge_chunks c ON c.id = v.chunk_id
+    JOIN agentkit_knowledge_sources s ON s.id = c.source_id
+    ORDER BY vector_distance ASC
+  \`,
+    [vector, vector, limit],
+  );
+
+  return result.rows
+    .map((row) => {
+      const distance = Number(row.vector_distance);
+      const semantic = Number.isFinite(distance) ? 1 - distance : 0;
+      return hostedKnowledgeResultFromRow(row, 0, semantic);
+    })
+    .filter((result) => result.match.semantic !== null && result.match.semantic > 0)
+    .slice(0, limit);
+}
+
+async function searchHostedKnowledgeSemanticFallback(database, queryEmbedding, limit) {
+  const result = await database.query(
+    \`
+    SELECT
+      c.id AS chunk_id,
+      c.source_id AS source_id,
+      c.content AS content,
+      c.title AS title,
+      c.section AS section,
+      c.locator AS locator,
+      c.embedding_json AS embedding_json,
+      s.source_key AS source_key
+    FROM agentkit_knowledge_chunks c
+    JOIN agentkit_knowledge_sources s ON s.id = c.source_id
+    WHERE c.embedding_json IS NOT NULL
+    ORDER BY c.created_at DESC, c.ordinal ASC
+  \`,
+  );
+
+  return result.rows
+    .map((row) => {
+      const embedding = parseHostedKnowledgeEmbedding(row.embedding_json);
+      const semantic = embedding ? hostedCosineSimilarity(queryEmbedding, embedding) : 0;
+      return hostedKnowledgeResultFromRow(row, 0, semantic);
+    })
+    .filter((result) => result.match.semantic !== null && result.match.semantic > 0)
+    .sort((left, right) => (right.match.semantic ?? 0) - (left.match.semantic ?? 0))
+    .slice(0, limit);
+}
+
+async function createHostedKnowledgeEmbedding(input, secrets) {
+  const provider = manifest.knowledge.embedding.provider;
+
+  if (provider === "none") {
+    return null;
+  }
+
+  if (provider === "test") {
+    return hostedFakeEmbedding(input, manifest.knowledge.embedding.dimensions || 32);
+  }
+
+  if (provider !== "openai") {
+    throw agentKitError("knowledge_embedding_provider_unsupported", "Unsupported knowledge embedding provider.");
+  }
+
+  const secretName = manifest.knowledge.embedding.secret || "OPENAI_API_KEY";
+  const apiKey = secrets[secretName];
+
+  if (!apiKey) {
+    throw agentKitError("knowledge_embedding_secret_missing", \`Knowledge embeddings require missing secret "\${secretName}".\`);
+  }
+
+  const response = await fetch("https://api.openai.com/v1/embeddings", {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: \`Bearer \${apiKey}\`,
+    },
+    body: JSON.stringify({
+      model: manifest.knowledge.embedding.model || "text-embedding-3-small",
+      input,
+      encoding_format: "float",
+      ...(manifest.knowledge.embedding.dimensions ? { dimensions: manifest.knowledge.embedding.dimensions } : {}),
+    }),
+  });
+
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    throw agentKitError(
+      "knowledge_embedding_failed",
+      \`OpenAI embedding request failed with HTTP \${response.status}.\${text ? " " + text.slice(0, 240) : ""}\`,
+    );
+  }
+
+  const payload = await response.json();
+  const embedding = payload?.data?.[0]?.embedding;
+
+  if (!Array.isArray(embedding) || embedding.some((value) => typeof value !== "number")) {
+    throw agentKitError("knowledge_embedding_failed", "OpenAI embedding response did not contain a numeric vector.");
+  }
+
+  return embedding;
+}
+
+function combineHostedKnowledgeResults(lexical, semantic, topK) {
+  const byChunk = new Map();
+
+  for (const result of lexical) {
+    byChunk.set(result.chunkId, result);
+  }
+
+  for (const result of semantic) {
+    const existing = byChunk.get(result.chunkId);
+
+    if (!existing) {
+      byChunk.set(result.chunkId, {
+        ...result,
+        score: hostedCombinedScore(0, result.match.semantic),
+      });
+      continue;
+    }
+
+    byChunk.set(result.chunkId, {
+      ...existing,
+      score: hostedCombinedScore(existing.match.lexical, result.match.semantic),
+      match: {
+        lexical: existing.match.lexical,
+        semantic: result.match.semantic,
+      },
+    });
+  }
+
+  return Array.from(byChunk.values())
+    .map((result) => ({
+      ...result,
+      score: result.score || hostedCombinedScore(result.match.lexical, result.match.semantic),
+    }))
+    .sort((left, right) => right.score - left.score || left.source.path.localeCompare(right.source.path))
+    .slice(0, topK);
+}
+
+function hostedKnowledgeResultFromRow(row, lexical, semantic) {
+  return {
+    chunkId: String(row.chunk_id),
+    content: String(row.content),
+    score: hostedCombinedScore(lexical, semantic),
+    source: {
+      id: String(row.source_id),
+      path: String(row.source_key),
+      title: typeof row.title === "string" ? row.title : null,
+      section: typeof row.section === "string" ? row.section : null,
+      locator: typeof row.locator === "string" ? row.locator : null,
+    },
+    match: {
+      lexical,
+      semantic,
+    },
+  };
+}
+
+function normalizeKnowledgeTopK(value) {
+  const topK = Number(value);
+
+  if (!Number.isInteger(topK) || topK <= 0 || topK > 50) {
+    throw agentKitError("knowledge_query_invalid", "Knowledge search topK must be a positive integer no larger than 50.");
+  }
+
+  return topK;
+}
+
+function hostedKnowledgeQueryTokens(query) {
+  return Array.from(new Set(String(query).toLowerCase().match(/[\\p{L}\\p{N}_-]+/gu) ?? [])).slice(0, 12);
+}
+
+function parseHostedKnowledgeEmbedding(value) {
+  if (typeof value !== "string") {
+    return null;
+  }
+
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) && parsed.every((item) => typeof item === "number") ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function hostedCombinedScore(lexical, semantic) {
+  const semanticScore = semantic === null ? 0 : Math.max(0, (semantic + 1) / 2);
+  return Number((lexical * 0.6 + semanticScore * 0.4).toFixed(6));
+}
+
+function hostedLexicalScore(index) {
+  return Number((1 / (index + 1)).toFixed(6));
+}
+
+function hostedCosineSimilarity(left, right) {
+  if (left.length !== right.length || left.length === 0) {
+    return 0;
+  }
+
+  let dot = 0;
+  let leftNorm = 0;
+  let rightNorm = 0;
+
+  for (let index = 0; index < left.length; index += 1) {
+    dot += left[index] * right[index];
+    leftNorm += left[index] * left[index];
+    rightNorm += right[index] * right[index];
+  }
+
+  if (leftNorm === 0 || rightNorm === 0) {
+    return 0;
+  }
+
+  return dot / (Math.sqrt(leftNorm) * Math.sqrt(rightNorm));
+}
+
+async function hostedFakeEmbedding(input, dimensions) {
+  const values = Array.from({ length: dimensions }, () => 0);
+  const tokens = String(input).toLowerCase().match(/[\\p{L}\\p{N}_-]+/gu) ?? [];
+  const encoder = new TextEncoder();
+
+  for (const token of tokens) {
+    const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(token)));
+    const slot = hash[0] % dimensions;
+    const sign = hash[1] % 2 === 0 ? 1 : -1;
+    values[slot] += sign * (1 + (hash[2] % 7) / 10);
+  }
+
+  const norm = Math.sqrt(values.reduce((sum, value) => sum + value * value, 0));
+  return norm === 0 ? values : values.map((value) => Number((value / norm).toFixed(8)));
+}
+
+async function persistFailure(env, conversationId, userMessage, error) {
+  await persist(env, {
+    conversationId,
+    userMessage,
+    status: "failed",
+    errorCode: error && typeof error === "object" && "code" in error ? String(error.code) : "runtime_error",
+    errorMessage: error instanceof Error ? error.message : String(error),
+    toolCalls: [],
+  }).catch(() => undefined);
+}
+
+function parseToolRequest(content) {
+  let parsed;
+
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return null;
+  }
+
+  if (!isRecord(parsed) || typeof parsed.tool !== "string" || parsed.tool.length === 0) {
+    return null;
+  }
+
+  return {
+    name: parsed.tool,
+    input: "input" in parsed ? parsed.input : {},
+  };
+}
+
+function inspectHostedDatabase() {
+  const schema = manifest.storage.database.driver === "turso" ? manifest.storage.database.schema : null;
+
+  return {
+    local: {
+      driver: "sqlite",
+      path: ".agentkit/agentkit.db",
+      schema,
+    },
+    hosted: {
+      driver: manifest.storage.database.driver,
+      provisioning: manifest.storage.database.driver === "turso" ? "agentkit-managed" : "none",
+      schema,
+    },
+  };
+}
+
+function hostedManagedSecrets() {
+  if (manifest.storage.database.driver !== "turso") {
+    return [];
+  }
+
+  return ["TURSO_AUTH_TOKEN", "TURSO_DATABASE_URL"];
+}
+
+function createHostedProviderToolRuntime(env, signal) {
+  return {
+    definitions: hostedTools,
+    execute(request) {
+      return executeHostedTool({
+        name: request.name,
+        input: request.input,
+        env,
+        signal,
+        invocation: "chat",
+      });
+    },
+  };
+}
+
+async function executeHostedTool(request) {
+  const tool = hostedTools.find((candidate) => candidate.name === request.name);
+  const id = crypto.randomUUID();
+
+  if (!tool) {
+    throw agentKitError("tool_not_found", \`Tool "\${request.name}" is not declared in agentkit.config.ts.\`);
+  }
+
+  const input = normalizeOptionalNulls(request.input ?? {}, tool.inputSchema);
+  validateSchema(input, tool.inputSchema, \`tool "\${tool.name}" input\`);
+
+  const secrets = resolveToolSecrets(tool, request.env);
+  const database = createHostedDatabaseRunner(request.env);
+  const output = await runToolWithTimeout(
+    tool,
+    input,
+    {
+      secrets,
+      database,
+      signal: request.signal,
+      runtime: {
+        environment: "hosted",
+        invocation: request.invocation ?? "tool",
+        target: "cloudflare",
+        database: manifest.storage.database.driver === "turso" ? "turso" : "none",
+      },
+    },
+    tool.timeoutMs ?? DEFAULT_TOOL_TIMEOUT_MS,
+  );
+
+  if (tool.outputSchema) {
+    validateSchema(output, tool.outputSchema, \`tool "\${tool.name}" output\`);
+  }
+
+  return {
+    id,
+    name: tool.name,
+    visibility: tool.visibility ?? "user",
+    status: "completed",
+    input,
+    output,
+  };
+}
+
+function resolveToolSecrets(tool, env) {
+  const secrets = {};
+
+  for (const secretName of tool.secrets ?? []) {
+    if (!env[secretName]) {
+      throw agentKitError("tool_secret_missing", \`Tool "\${tool.name}" requires missing secret "\${secretName}".\`);
+    }
+
+    secrets[secretName] = env[secretName];
+  }
+
+  return secrets;
+}
+
+async function runToolWithTimeout(tool, input, context, timeoutMs) {
+  const controller = new AbortController();
+  const parentSignal = context.signal;
+
+  if (parentSignal?.aborted) {
+    throw agentKitError("runtime_aborted", \`Tool "\${tool.name}" was aborted before it started.\`);
+  }
+
+  const abortFromParent = () => controller.abort(parentSignal?.reason);
+  parentSignal?.addEventListener("abort", abortFromParent, { once: true });
+
+  let timeout;
+
+  try {
+    const timeoutPromise = new Promise((_, reject) => {
+      timeout = setTimeout(() => {
+        controller.abort();
+        reject(agentKitError("tool_timeout", \`Tool "\${tool.name}" timed out after \${timeoutMs}ms.\`));
+      }, timeoutMs);
+    });
+
+    const execution = Promise.resolve().then(() =>
+      tool.execute(input, {
+        secrets: context.secrets,
+        signal: controller.signal,
+        runtime: context.runtime,
+        database: context.database,
+        db: context.database,
+        storage: {
+          sql: context.database,
+        },
+      }),
+    );
+
+    return await Promise.race([execution, timeoutPromise]);
+  } finally {
+    if (timeout) {
+      clearTimeout(timeout);
+    }
+
+    parentSignal?.removeEventListener("abort", abortFromParent);
+  }
+}
+
+function createHostedDatabaseRunner(env) {
+  const run = async (sql, args = []) => {
+    validateDatabaseQuery(sql, args);
+
+    const configError = requireTurso(env);
+
+    if (configError) {
+      const payload = await configError.json().catch(() => null);
+      const error = payload?.error;
+      throw agentKitError(error?.code || "database_not_configured", error?.message || "Hosted database is not configured.");
+    }
+
+    return executeTursoSql(env, sql, args);
+  };
+
+  run.execute = run;
+  run.query = run;
+  run.batch = async (statements) => {
+    if (!Array.isArray(statements)) {
+      throw agentKitError("database_query_invalid", "ctx.db.batch requires an array of statements.");
+    }
+
+    for (const [index, statement] of statements.entries()) {
+      if (!isRecord(statement)) {
+        throw agentKitError("database_query_invalid", \`ctx.db.batch statement \${index} must be an object.\`);
+      }
+
+      validateDatabaseQuery(statement.sql, statement.args ?? []);
+    }
+
+    const configError = requireTurso(env);
+
+    if (configError) {
+      const payload = await configError.json().catch(() => null);
+      const error = payload?.error;
+      throw agentKitError(error?.code || "database_not_configured", error?.message || "Hosted database is not configured.");
+    }
+
+    return executeTursoBatch(env, statements);
+  };
+  run.transaction = async () => {
+    throw agentKitError(
+      "database_transaction_unsupported",
+      "Hosted Cloudflare tools do not expose long-lived interactive transactions in v1. Use ctx.db.batch([...]) for atomic Turso pipeline operations.",
+    );
+  };
+  return run;
+}
+
+function validateDatabaseQuery(sql, args) {
+  if (typeof sql !== "string" || sql.trim().length === 0) {
+    throw agentKitError("database_query_invalid", "Database SQL must be a non-empty string.");
+  }
+
+  if (!Array.isArray(args)) {
+    throw agentKitError("database_query_invalid", "Database SQL args must be an array.");
+  }
+
+  for (const arg of args) {
+    if (arg !== null && typeof arg !== "string" && typeof arg !== "number" && typeof arg !== "boolean") {
+      throw agentKitError("database_query_invalid", "Database SQL args may only contain strings, numbers, booleans, or null.");
+    }
+  }
+}
+
+function validateSchema(value, schema, label) {
+  const error = validateValue(value, schema, "$");
+
+  if (error) {
+    throw agentKitError("tool_validation_error", \`\${label} failed schema validation: \${error}\`);
+  }
+}
+
+function validateValue(value, schema, path) {
+  if (Array.isArray(schema.enum) && !schema.enum.some((item) => Object.is(item, value))) {
+    return \`\${path} must be one of \${JSON.stringify(schema.enum)}.\`;
+  }
+
+  const types = Array.isArray(schema.type) ? schema.type : [schema.type];
+  const errors = types.map((type) => validateValueForType(value, schema, type, path)).filter((error) => error !== null);
+
+  if (errors.length < types.length) {
+    return null;
+  }
+
+  if (types.length > 1) {
+    return \`\${path} must match one of these schema types: \${types.join(", ")}.\`;
+  }
+
+  return errors[0] ?? null;
+}
+
+function validateValueForType(value, schema, type, path) {
+  switch (type) {
+    case "object":
+      return validateObject(value, schema, path);
+    case "array":
+      return validateArray(value, schema, path);
+    case "string":
+      return typeof value === "string" ? null : \`\${path} must be a string.\`;
+    case "number":
+      return typeof value === "number" && Number.isFinite(value) ? null : \`\${path} must be a number.\`;
+    case "integer":
+      return Number.isInteger(value) ? null : \`\${path} must be an integer.\`;
+    case "boolean":
+      return typeof value === "boolean" ? null : \`\${path} must be a boolean.\`;
+    case "null":
+      return value === null ? null : \`\${path} must be null.\`;
+    default:
+      return \`\${path} has unsupported schema type "\${type}".\`;
+  }
+}
+
+function validateObject(value, schema, path) {
+  if (!isRecord(value)) {
+    return \`\${path} must be an object.\`;
+  }
+
+  for (const property of schema.required ?? []) {
+    if (!(property in value)) {
+      return \`\${path}.\${property} is required.\`;
+    }
+  }
+
+  for (const [property, propertySchema] of Object.entries(schema.properties ?? {})) {
+    if (property in value) {
+      const error = validateValue(value[property], propertySchema, \`\${path}.\${property}\`);
+
+      if (error) {
+        return error;
+      }
+    }
+  }
+
+  if (schema.additionalProperties === false) {
+    const allowedProperties = new Set(Object.keys(schema.properties ?? {}));
+
+    for (const property of Object.keys(value)) {
+      if (!allowedProperties.has(property)) {
+        return \`\${path}.\${property} is not allowed.\`;
+      }
+    }
+  }
+
+  return null;
+}
+
+function validateArray(value, schema, path) {
+  if (!Array.isArray(value)) {
+    return \`\${path} must be an array.\`;
+  }
+
+  if (!schema.items) {
+    return null;
+  }
+
+  for (const [index, item] of value.entries()) {
+    const error = validateValue(item, schema.items, \`\${path}[\${index}]\`);
+
+    if (error) {
+      return error;
+    }
+  }
+
+  return null;
+}
+
+function normalizeOptionalNulls(value, schema) {
+  const types = schemaTypes(schema);
+
+  if (types.includes("object") && isRecord(value)) {
+    const required = new Set(schema.required ?? []);
+    const properties = schema.properties ?? {};
+    const normalized = { ...value };
+
+    for (const [property, propertySchema] of Object.entries(properties)) {
+      if (!(property in normalized)) {
+        continue;
+      }
+
+      if (normalized[property] === null && !required.has(property) && !allowsNull(propertySchema)) {
+        delete normalized[property];
+        continue;
+      }
+
+      normalized[property] = normalizeOptionalNulls(normalized[property], propertySchema);
+    }
+
+    return normalized;
+  }
+
+  if (types.includes("array") && Array.isArray(value) && schema.items) {
+    return value.map((item) => normalizeOptionalNulls(item, schema.items));
+  }
+
+  return value;
+}
+
+function schemaTypes(schema) {
+  return Array.isArray(schema.type) ? schema.type : [schema.type];
+}
+
+function allowsNull(schema) {
+  return schemaTypes(schema).includes("null") || (Array.isArray(schema.enum) && schema.enum.some((item) => item === null));
+}
+
+async function authorizeChat(request, env, body) {
+  const runtimeGate = await authorizeRuntimeGate(request, env, body);
+
+  if (runtimeGate) {
+    if (runtimeGate === "authorized") {
+      return null;
+    }
+
+    return runtimeGate;
+  }
+
+  if (manifest.access.mode === "public") {
+    return null;
+  }
+
+  if (manifest.access.mode === "private") {
+    if (!env.AGENTKIT_PRIVATE_TOKEN) {
+      return Response.json(
+        {
+          error: {
+            code: "deploy_not_ready",
+            message: "Private deploy requires AGENTKIT_PRIVATE_TOKEN to be set as a Cloudflare secret.",
+          },
+        },
+        { status: 503 },
+      );
+    }
+
+    const expected = \`Bearer \${env.AGENTKIT_PRIVATE_TOKEN}\`;
+    if (request.headers.get("authorization") !== expected) {
+      return Response.json(
+        { error: { code: "unauthorized", message: "Missing or invalid deploy access token." } },
+        { status: 401 },
+      );
+    }
+  }
+
+  if (manifest.access.mode === "token") {
+    if (!env.AGENTKIT_ACCESS_TOKEN) {
+      return Response.json(
+        {
+          error: {
+            code: "deploy_not_ready",
+            message: "Token deploy requires AGENTKIT_ACCESS_TOKEN to be set as a Cloudflare secret.",
+          },
+        },
+        { status: 503 },
+      );
+    }
+
+    const expected = \`Bearer \${env.AGENTKIT_ACCESS_TOKEN}\`;
+    if (request.headers.get("authorization") !== expected) {
+      return Response.json(
+        { error: { code: "unauthorized", message: "Missing or invalid deploy access token." } },
+        { status: 401 },
+      );
+    }
+  }
+
+  return null;
+}
+
+async function authorizeRuntimeGate(request, env, body) {
+  if (!env.AGENTKIT_CLOUD_API_URL || !env.AGENTKIT_DEPLOY_ID || !env.AGENTKIT_RUNTIME_GATE_TOKEN) {
+    return null;
+  }
+
+  let response;
+  const token = deployAccessToken(request, body);
+
+  try {
+    response = await fetch(
+      new URL(\`/v1/runtime/deploys/\${encodeURIComponent(env.AGENTKIT_DEPLOY_ID)}/authorize\`, env.AGENTKIT_CLOUD_API_URL).href,
+      {
+        method: "POST",
+        headers: {
+          "Authorization": \`Bearer \${env.AGENTKIT_RUNTIME_GATE_TOKEN}.\${token}\`,
+          "Content-Type": "application/json",
+          "X-AgentKit-Deploy-Access-Token": token,
+        },
+        body: JSON.stringify({
+          token,
+        }),
+      },
+    );
+  } catch {
+    return Response.json(
+      { error: { code: "runtime_gate_unavailable", message: "AgentKit runtime gate is temporarily unavailable." } },
+      { status: 503 },
+    );
+  }
+
+  if (response.ok) {
+    return "authorized";
+  }
+
+  const payload = await response.json().catch(() => ({
+    error: {
+      code: "runtime_gate_failed",
+      message: "AgentKit runtime gate rejected the request.",
+    },
+  }));
+  return Response.json(payload, { status: response.status });
+}
+
+function deployAccessToken(request, body) {
+  const authorization = request.headers.get("authorization");
+
+  if (authorization?.startsWith("Bearer ")) {
+    return authorization.slice("Bearer ".length);
+  }
+
+  const tokenHeader =
+    request.headers.get("x-agentkit-access-token") ??
+    request.headers.get("x-agentkit-deploy-access-token") ??
+    "";
+  const token = tokenHeader.startsWith("Bearer ") ? tokenHeader.slice("Bearer ".length) : tokenHeader;
+  if (token.trim()) {
+    return token.trim();
+  }
+
+  if (body && typeof body === "object") {
+    const bodyToken = typeof body.access_token === "string" ? body.access_token : typeof body.accessToken === "string" ? body.accessToken : "";
+    return bodyToken.trim();
+  }
+
+  return "";
+}
+
+function authorizeAdmin(request, env) {
+  if (!env.AGENTKIT_PRIVATE_TOKEN) {
+    return Response.json(
+      {
+        error: {
+          code: "deploy_not_ready",
+          message: "Privileged AgentKit endpoints require AGENTKIT_PRIVATE_TOKEN to be set as a Cloudflare secret.",
+        },
+      },
+      { status: 503 },
+    );
+  }
+
+  const expected = \`Bearer \${env.AGENTKIT_PRIVATE_TOKEN}\`;
+  if (request.headers.get("authorization") !== expected) {
+    return Response.json(
+      { error: { code: "unauthorized", message: "Missing or invalid AgentKit admin token." } },
+      { status: 401 },
+    );
+  }
+
+  return null;
+}
+
+async function persist(env, input) {
+  if (!env.AGENTKIT_CONVERSATIONS) {
+    return {};
+  }
+
+  const id = env.AGENTKIT_CONVERSATIONS.idFromName(input.conversationId);
+  const stub = env.AGENTKIT_CONVERSATIONS.get(id);
+  const response = await stub.fetch("https://agentkit.internal/messages", {
+    method: "POST",
+    body: JSON.stringify(input),
+  });
+
+  if (!response.ok) {
+    throw new Error(\`Could not persist conversation: \${response.status}\`);
+  }
+
+  return response.json();
+}
+
+async function loadConversationMessages(env, conversationId) {
+  if (!env.AGENTKIT_CONVERSATIONS || !conversationId) {
+    return [];
+  }
+
+  const id = env.AGENTKIT_CONVERSATIONS.idFromName(conversationId);
+  const stub = env.AGENTKIT_CONVERSATIONS.get(id);
+  const response = await stub.fetch(
+    \`https://agentkit.internal/messages?conversationId=\${encodeURIComponent(conversationId)}\`,
+  );
+
+  if (!response.ok) {
+    return [];
+  }
+
+  const payload = await response.json();
+  return Array.isArray(payload.messages)
+    ? payload.messages.filter((message) =>
+        message &&
+        typeof message === "object" &&
+        (message.role === "user" || message.role === "assistant") &&
+        typeof message.content === "string"
+      )
+    : [];
+}
+
+function normalizeConversationId(value) {
+  if (value === undefined || value === null) {
+    return null;
+  }
+
+  if (typeof value !== "string") {
+    throw agentKitError("validation_error", "conversationId must be a non-empty string when provided.");
+  }
+
+  const conversationId = value.trim();
+  if (!conversationId) {
+    throw agentKitError("validation_error", "conversationId must be a non-empty string when provided.");
+  }
+
+  return conversationId;
+}
+
+function agentKitError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function hostedErrorResponse(error) {
+  const code = error && typeof error === "object" && "code" in error ? String(error.code) : "runtime_error";
+  const message = error instanceof Error ? error.message : String(error);
+  const status =
+    code === "tool_not_found" || code === "database_not_configured" || code === "files_not_configured"
+      ? 404
+      : code === "constraint_conflict"
+        ? 409
+      : code === "tool_validation_error" || code === "validation_error" || code === "database_query_invalid"
+        ? 400
+        : code === "database_unavailable" || code === "database_transaction_unsupported"
+          ? 503
+        : code === "database_schema_error"
+          ? 500
+        : code === "provider_not_supported"
+          ? 501
+        : code === "tool_secret_missing" || code === "secret_not_found" || code === "deploy_not_ready"
+          ? 503
+          : 500;
+
+  return Response.json({ error: { code, message } }, { status });
+}
+
+async function executeTursoSql(env, sql, args) {
+  const results = await executeTursoPipeline(env, [
+    {
+      type: "execute",
+      stmt: {
+        sql,
+        args: args.map(toTursoArg),
+      },
+    },
+  ]);
+
+  return results[0] ?? emptyDatabaseResult();
+}
+
+async function executeTursoBatch(env, statements) {
+  const results = await executeTursoPipeline(
+    env,
+    statements.map((statement) => ({
+      type: "execute",
+      stmt: {
+        sql: statement.sql,
+        args: (statement.args ?? []).map(toTursoArg),
+      },
+    })),
+  );
+
+  return results;
+}
+
+async function executeTursoPipeline(env, executeRequests) {
+  let response;
+
+  try {
+    response = await fetch(toTursoBaseUrl(env.TURSO_DATABASE_URL) + "/v2/pipeline", {
+    method: "POST",
+    headers: {
+      Authorization: \`Bearer \${env.TURSO_AUTH_TOKEN}\`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({
+      requests: [...executeRequests, { type: "close" }],
+    }),
+  });
+  } catch (error) {
+    throw agentKitError("database_unavailable", \`Turso SQL over HTTP request failed before a response: \${error instanceof Error ? error.message : String(error)}\`);
+  }
+
+  const payload = await response.json().catch(() => null);
+
+  if (!response.ok) {
+    throw mapTursoHttpError(response.status, payload);
+  }
+
+  const results = [];
+
+  for (const [index, result] of (payload?.results ?? []).entries()) {
+    if (index >= executeRequests.length) {
+      break;
+    }
+
+    const error = result?.response?.error ?? result?.error;
+
+    if (error) {
+      throw mapTursoSqlError(error);
+    }
+
+    results.push(normalizeTursoExecuteResult(result));
+  }
+
+  return results;
+}
+
+function normalizeTursoExecuteResult(payload) {
+  const result = payload?.response?.result ?? payload?.results?.[0]?.response?.result;
+  const columns = Array.isArray(result?.cols) ? result.cols.map((column) => String(column.name || "")) : [];
+  const rows = Array.isArray(result?.rows)
+    ? result.rows.map((row) =>
+        Object.fromEntries(row.map((value, index) => [columns[index] || \`column_\${index}\`, fromTursoValue(value)])),
+      )
+    : [];
+
+  return {
+    rows,
+    rowsAffected: Number(result?.affected_row_count ?? 0),
+    lastInsertRowid: result?.last_insert_rowid ?? null,
+    columns,
+  };
+}
+
+function emptyDatabaseResult() {
+  return {
+    rows: [],
+    rowsAffected: 0,
+    lastInsertRowid: null,
+    columns: [],
+  };
+}
+
+function mapTursoHttpError(status, payload) {
+  if (status === 429 || status === 500 || status === 502 || status === 503 || status === 504) {
+    return agentKitError("database_unavailable", \`Turso SQL over HTTP is unavailable (HTTP \${status}).\`);
+  }
+
+  return mapTursoSqlError(payload?.error ?? payload);
+}
+
+function mapTursoSqlError(error) {
+  const message = readTursoErrorMessage(error);
+
+  if (/constraint failed|unique constraint|primary key|foreign key|check constraint|SQLITE_CONSTRAINT/i.test(message)) {
+    return agentKitError("constraint_conflict", "Database constraint conflict.");
+  }
+
+  if (/no such table|no such column|has no column named|schema|SQLITE_SCHEMA/i.test(message)) {
+    return agentKitError("database_schema_error", \`Database schema error: \${message}\`);
+  }
+
+  if (/syntax error|incomplete input|SQLITE_ERROR|invalid sql/i.test(message)) {
+    return agentKitError("database_query_invalid", \`Database query is invalid: \${message}\`);
+  }
+
+  return agentKitError("database_unavailable", \`Turso SQL over HTTP failed: \${message}\`);
+}
+
+function readTursoErrorMessage(error) {
+  if (!error) {
+    return "unknown Turso error";
+  }
+
+  if (typeof error === "string") {
+    return error;
+  }
+
+  if (typeof error.message === "string") {
+    return error.message;
+  }
+
+  if (typeof error.code === "string") {
+    return error.code;
+  }
+
+  return JSON.stringify(error);
+}
+
+function fromTursoValue(value) {
+  if (!value || value.type === "null") {
+    return null;
+  }
+
+  if (value.type === "integer") {
+    const numberValue = Number(value.value);
+    return Number.isSafeInteger(numberValue) ? numberValue : String(value.value);
+  }
+
+  if (value.type === "float") {
+    return Number(value.value);
+  }
+
+  if (value.type === "text" || value.type === "blob") {
+    return String(value.value ?? "");
+  }
+
+  return value.value ?? null;
+}
+
+function requireTurso(env) {
+  if (manifest.storage.database.driver !== "turso") {
+    return Response.json({ error: { code: "database_not_configured", message: "Turso is not configured." } }, { status: 404 });
+  }
+
+  if (!env.TURSO_DATABASE_URL || !env.TURSO_AUTH_TOKEN) {
+    return Response.json(
+      {
+        error: {
+          code: "deploy_not_ready",
+          message: "TURSO_DATABASE_URL and TURSO_AUTH_TOKEN must be set as Cloudflare secrets.",
+        },
+      },
+      { status: 503 },
+    );
+  }
+
+  return null;
+}
+
+function toTursoBaseUrl(value) {
+  return String(value).replace(/^libsql:\\/\\//, "https://").replace(/\\/$/, "");
+}
+
+function toTursoArg(value) {
+  if (value === null || value === undefined) {
+    return { type: "null" };
+  }
+
+  if (typeof value === "boolean") {
+    return { type: "integer", value: value ? "1" : "0" };
+  }
+
+  if (typeof value === "number" && Number.isInteger(value)) {
+    return { type: "integer", value: String(value) };
+  }
+
+  if (typeof value === "number") {
+    return { type: "float", value: String(value) };
+  }
+
+  if (typeof value === "string") {
+    return { type: "text", value };
+  }
+
+  throw agentKitError("database_query_invalid", "Database SQL args may only contain strings, numbers, booleans, or null.");
+}
+
+function objectKey(rawKey) {
+  const decoded = decodeURIComponent(String(rawKey || "")).replace(/^\\/+/, "");
+
+  if (!decoded || decoded.includes("..")) {
+    return null;
+  }
+
+  const prefix = manifest.storage.files.driver === "r2" ? manifest.storage.files.prefix : "";
+  return [prefix, decoded].filter(Boolean).join("/").replace(/\\/+/g, "/");
+}
+
+function titleFromMessage(content) {
+  const compact = content.split(/\\r?\\n/, 1)[0].replace(/\\s+/g, " ").trim();
+  return compact.length <= 80 ? compact : \`\${compact.slice(0, 77)}...\`;
+}
+`;
+}
+
+function renderWranglerConfig(agentName: string, files: AgentManifest["storage"]["files"]): string {
+  const config: Record<string, unknown> = {
+    $schema: "node_modules/wrangler/config-schema.json",
+    name: `agentkit-${slugify(agentName)}`,
+    main: "./worker.js",
+    compatibility_date: CLOUDFLARE_COMPATIBILITY_DATE,
+    compatibility_flags: [...CLOUDFLARE_COMPATIBILITY_FLAGS],
+    observability: {
+      enabled: true,
+    },
+    durable_objects: {
+      bindings: [
+        {
+          name: "AGENTKIT_CONVERSATIONS",
+          class_name: "AgentKitConversationStore",
+        },
+      ],
+    },
+    migrations: [
+      {
+        tag: "v1",
+        new_sqlite_classes: ["AgentKitConversationStore"],
+      },
+    ],
+  };
+
+  if (files.driver === "r2") {
+    config.r2_buckets = [
+      {
+        binding: files.binding,
+        bucket_name: files.bucket,
+      },
+    ];
+  }
+
+  return `${JSON.stringify(
+    config,
+    null,
+    2,
+  )}\n`;
+}
+
+function renderDurableObjectSchema(): string {
+  return `CREATE TABLE IF NOT EXISTS conversations (
+  id TEXT PRIMARY KEY,
+  agent_name TEXT NOT NULL,
+  title TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS messages (
+  id TEXT PRIMARY KEY,
+  conversation_id TEXT NOT NULL,
+  role TEXT NOT NULL,
+  content TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS runs (
+  id TEXT PRIMARY KEY,
+  conversation_id TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  model TEXT NOT NULL,
+  status TEXT NOT NULL,
+  error_code TEXT,
+  error_message TEXT,
+  created_at TEXT NOT NULL,
+  completed_at TEXT
+);
+
+CREATE TABLE IF NOT EXISTS tool_calls (
+  id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL,
+  conversation_id TEXT NOT NULL,
+  tool_name TEXT NOT NULL,
+  visibility TEXT NOT NULL,
+  status TEXT NOT NULL,
+  input_json TEXT NOT NULL,
+  output_json TEXT,
+  error_message TEXT,
+  created_at TEXT NOT NULL,
+  completed_at TEXT
+);
+`;
+}
+
+function slugify(value: string): string {
+  const slug = value
+    .toLowerCase()
+    .replace(/[^a-z0-9-]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 48);
+
+  return slug || "agent";
+}
+
+function sha256(source: string): string {
+  return createHash("sha256").update(source).digest("hex");
+}